42 lines
2.3 KiB
YAML
42 lines
2.3 KiB
YAML
---
|
|
- name: Deploy Wikideck
|
|
hosts: localhost
|
|
connection: local
|
|
gather_facts: true
|
|
pre_tasks:
|
|
- name: Require an approved and ready mainnet candidate release
|
|
ansible.builtin.assert:
|
|
that:
|
|
- wikideck_mainnet_deployment_approved | default(false) | bool
|
|
- wikideck_release_image is defined and wikideck_release_image is string and wikideck_release_image is match('^.+@sha256:[a-f0-9]{64}$')
|
|
- wikideck_release_peers is defined and wikideck_release_peers is sequence and wikideck_release_peers is not string and wikideck_release_peers | length >= 2
|
|
- wikideck_release_peers | unique | list | length == wikideck_release_peers | length
|
|
- wikideck_candidate_chain_id is defined and wikideck_candidate_chain_id is match('^[a-f0-9]{64}$')
|
|
- wikideck_candidate_risk_ack | default('') == 'operator-accepts-unaudited-risk'
|
|
- wikideck_release_genesis_time is defined and (wikideck_release_genesis_time | string) is match('^[1-9][0-9]{8,10}$')
|
|
- wikideck_release_genesis_time | int >= 1700000000 and wikideck_release_genesis_time | int <= 4102444800
|
|
- wikideck_release_genesis_time | int <= ansible_date_time.epoch | int
|
|
fail_msg: >-
|
|
Mainnet is currently NO-GO. Supply only an approved digest-pinned image,
|
|
verified frozen manifest and arrived genesis, independent public HTTPS
|
|
peers, and explicit unaudited-risk acceptance.
|
|
roles:
|
|
- role: wikideck
|
|
vars:
|
|
wikideck_image: "{{ wikideck_release_image }}"
|
|
wikideck_image_pull_policy: IfNotPresent
|
|
wikideck_peers: "{{ wikideck_release_peers }}"
|
|
wikideck_mainnet_launch: "{{ wikideck_candidate_chain_id }}"
|
|
wikideck_mainnet_risk_ack: "{{ wikideck_candidate_risk_ack }}"
|
|
wikideck_ingress_enabled: true
|
|
wikideck_ingress_host: wikideck.example.com
|
|
wikideck_public_origin: https://wikideck.example.com
|
|
wikideck_ingress_class_name: nginx
|
|
wikideck_ingress_annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
|
wikideck_network_policy_ingress_from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: ingress-nginx
|