refactor(detmir): retire python runtime paths
This commit is contained in:
igor04091968
@@ -1,55 +1,7 @@
|
||||
---
|
||||
- name: Ensure DLP case management directory
|
||||
ansible.builtin.file:
|
||||
path: /opt/activitywatch/dlp-case-management
|
||||
state: directory
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Copy DLP case management files
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../aw-server/dlp-case-management/{{ item }}"
|
||||
dest: "/opt/activitywatch/dlp-case-management/{{ item }}"
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0644"
|
||||
loop:
|
||||
- case_service.py
|
||||
- case_schema.py
|
||||
- case_storage.py
|
||||
- evidence_chain.py
|
||||
- requirements.txt
|
||||
|
||||
- name: Make case service executable
|
||||
ansible.builtin.file:
|
||||
path: /opt/activitywatch/dlp-case-management/case_service.py
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Create venv for DLP case management
|
||||
ansible.builtin.command:
|
||||
cmd: python3 -m venv /opt/activitywatch/dlp-case-management/.venv
|
||||
args:
|
||||
creates: /opt/activitywatch/dlp-case-management/.venv/bin/python
|
||||
|
||||
- name: Install Python dependencies for DLP case management
|
||||
ansible.builtin.pip:
|
||||
requirements: /opt/activitywatch/dlp-case-management/requirements.txt
|
||||
virtualenv: /opt/activitywatch/dlp-case-management/.venv
|
||||
|
||||
- name: Install systemd unit DLP case management
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../aw-server/dlp-case-management/case-service.service"
|
||||
dest: /etc/systemd/system/aw-dlp-case-management.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Reload systemd and restart DLP case management
|
||||
ansible.builtin.systemd:
|
||||
name: aw-dlp-case-management.service
|
||||
daemon_reload: true
|
||||
enabled: true
|
||||
state: restarted
|
||||
- name: Deprecated role guard - DLP case management is Rust-only
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
ansible/roles/dlp-case-management is deprecated because it deployed the old
|
||||
Python runtime. Use ansible/deploy_aw_server.yml, which installs
|
||||
/usr/local/bin/aw-dlp-case-management-rust from adk-rust.
|
||||
|
||||
@@ -1,54 +1,7 @@
|
||||
---
|
||||
- name: Ensure DLP compliance directory tree
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0755"
|
||||
loop:
|
||||
- /opt/activitywatch/dlp-compliance
|
||||
- /opt/activitywatch/dlp-compliance/templates
|
||||
- /opt/activitywatch/dlp-compliance/reports
|
||||
|
||||
- name: Copy DLP compliance files
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../aw-server/dlp-compliance/{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "{{ item.mode }}"
|
||||
loop:
|
||||
- { src: "report_generator.py", dest: "/opt/activitywatch/dlp-compliance/report_generator.py", mode: "0755" }
|
||||
- { src: "compliance_scheduler.py", dest: "/opt/activitywatch/dlp-compliance/compliance_scheduler.py", mode: "0755" }
|
||||
- { src: "requirements.txt", dest: "/opt/activitywatch/dlp-compliance/requirements.txt", mode: "0644" }
|
||||
- { src: "templates/152-fz-report.html", dest: "/opt/activitywatch/dlp-compliance/templates/152-fz-report.html", mode: "0644" }
|
||||
- { src: "templates/pci-dss-report.html", dest: "/opt/activitywatch/dlp-compliance/templates/pci-dss-report.html", mode: "0644" }
|
||||
- { src: "report-scheduler.service", dest: "/etc/systemd/system/aw-dlp-report-scheduler.service", mode: "0644" }
|
||||
- { src: "report-scheduler.timer", dest: "/etc/systemd/system/aw-dlp-report-scheduler.timer", mode: "0644" }
|
||||
|
||||
- name: Create venv for DLP compliance
|
||||
ansible.builtin.command:
|
||||
cmd: python3 -m venv /opt/activitywatch/dlp-compliance/.venv
|
||||
args:
|
||||
creates: /opt/activitywatch/dlp-compliance/.venv/bin/python
|
||||
|
||||
- name: Install Python dependencies for DLP compliance
|
||||
ansible.builtin.pip:
|
||||
requirements: /opt/activitywatch/dlp-compliance/requirements.txt
|
||||
virtualenv: /opt/activitywatch/dlp-compliance/.venv
|
||||
|
||||
- name: Reload systemd
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
|
||||
- name: Enable and start DLP compliance timer
|
||||
ansible.builtin.systemd:
|
||||
name: aw-dlp-report-scheduler.timer
|
||||
enabled: true
|
||||
state: restarted
|
||||
|
||||
- name: Run DLP compliance report once
|
||||
ansible.builtin.systemd:
|
||||
name: aw-dlp-report-scheduler.service
|
||||
state: started
|
||||
- name: Deprecated role guard - DLP compliance is Rust-only
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
ansible/roles/dlp-compliance is deprecated because it deployed the old
|
||||
Python runtime. Use ansible/deploy_aw_server.yml, which installs
|
||||
/usr/local/bin/aw-dlp-compliance-rust from adk-rust.
|
||||
|
||||
@@ -1,194 +1,7 @@
|
||||
---
|
||||
- name: Ensure DLP integrations directory
|
||||
ansible.builtin.file:
|
||||
path: /opt/activitywatch/dlp-integrations
|
||||
state: directory
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Copy DLP integrations files
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../aw-server/dlp-integrations/{{ item }}"
|
||||
dest: "/opt/activitywatch/dlp-integrations/{{ item }}"
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0644"
|
||||
loop:
|
||||
- cef_exporter.py
|
||||
- syslog_forwarder.py
|
||||
- webhook_sender.py
|
||||
- cef-config.yaml
|
||||
- syslog-forwarder-config.yaml
|
||||
- webhook-config.yaml
|
||||
- requirements.txt
|
||||
|
||||
- name: Make DLP integrations scripts executable
|
||||
ansible.builtin.file:
|
||||
path: "/opt/activitywatch/dlp-integrations/{{ item }}"
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0755"
|
||||
loop:
|
||||
- cef_exporter.py
|
||||
- syslog_forwarder.py
|
||||
- webhook_sender.py
|
||||
|
||||
- name: Create venv for DLP integrations
|
||||
ansible.builtin.command:
|
||||
cmd: python3 -m venv /opt/activitywatch/dlp-integrations/.venv
|
||||
args:
|
||||
creates: /opt/activitywatch/dlp-integrations/.venv/bin/python
|
||||
|
||||
- name: Install Python dependencies for DLP integrations
|
||||
ansible.builtin.pip:
|
||||
requirements: /opt/activitywatch/dlp-integrations/requirements.txt
|
||||
virtualenv: /opt/activitywatch/dlp-integrations/.venv
|
||||
|
||||
- name: Ensure integrations state directory
|
||||
ansible.builtin.file:
|
||||
path: /var/lib/activitywatch/dlp-integrations
|
||||
state: directory
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Install systemd units/timers for DLP integrations
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../aw-server/dlp-integrations/{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
loop:
|
||||
- { src: "cef-exporter.service", dest: "/etc/systemd/system/aw-dlp-cef-exporter.service" }
|
||||
- { src: "cef-exporter.timer", dest: "/etc/systemd/system/aw-dlp-cef-exporter.timer" }
|
||||
- { src: "syslog-forwarder.service", dest: "/etc/systemd/system/aw-dlp-syslog-forwarder.service" }
|
||||
- { src: "syslog-forwarder.timer", dest: "/etc/systemd/system/aw-dlp-syslog-forwarder.timer" }
|
||||
- { src: "webhook-sender.service", dest: "/etc/systemd/system/aw-dlp-webhook-sender.service" }
|
||||
- { src: "webhook-sender.timer", dest: "/etc/systemd/system/aw-dlp-webhook-sender.timer" }
|
||||
|
||||
- name: Check local Rust CEF exporter
|
||||
ansible.builtin.stat:
|
||||
path: "{{ playbook_dir }}/../adk-rust/target/release/dlp-cef-exporter"
|
||||
delegate_to: localhost
|
||||
register: dlp_cef_exporter_rust_binary
|
||||
become: false
|
||||
|
||||
- name: Install Rust CEF exporter
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../adk-rust/target/release/dlp-cef-exporter"
|
||||
dest: /usr/local/bin/dlp-cef-exporter-rust
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: dlp_cef_exporter_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Ensure CEF exporter drop-in directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/system/aw-dlp-cef-exporter.service.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: dlp_cef_exporter_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Switch CEF exporter to Rust
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/system/aw-dlp-cef-exporter.service.d/20-rust-switch.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
[Service]
|
||||
ExecStart=
|
||||
ExecStart=/usr/local/bin/dlp-cef-exporter-rust
|
||||
when: dlp_cef_exporter_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Check local Rust syslog forwarder
|
||||
ansible.builtin.stat:
|
||||
path: "{{ playbook_dir }}/../adk-rust/target/release/dlp-syslog-forwarder"
|
||||
delegate_to: localhost
|
||||
register: dlp_syslog_forwarder_rust_binary
|
||||
become: false
|
||||
|
||||
- name: Install Rust syslog forwarder
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../adk-rust/target/release/dlp-syslog-forwarder"
|
||||
dest: /usr/local/bin/dlp-syslog-forwarder-rust
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: dlp_syslog_forwarder_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Ensure syslog forwarder drop-in directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/system/aw-dlp-syslog-forwarder.service.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: dlp_syslog_forwarder_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Switch syslog forwarder to Rust
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/system/aw-dlp-syslog-forwarder.service.d/20-rust-switch.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
[Service]
|
||||
ExecStart=
|
||||
ExecStart=/usr/local/bin/dlp-syslog-forwarder-rust
|
||||
when: dlp_syslog_forwarder_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Check local Rust webhook sender
|
||||
ansible.builtin.stat:
|
||||
path: "{{ playbook_dir }}/../adk-rust/target/release/dlp-webhook-sender"
|
||||
delegate_to: localhost
|
||||
register: dlp_webhook_sender_rust_binary
|
||||
become: false
|
||||
|
||||
- name: Install Rust webhook sender
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../adk-rust/target/release/dlp-webhook-sender"
|
||||
dest: /usr/local/bin/dlp-webhook-sender-rust
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: dlp_webhook_sender_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Ensure webhook sender drop-in directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/system/aw-dlp-webhook-sender.service.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: dlp_webhook_sender_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Switch webhook sender to Rust
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/system/aw-dlp-webhook-sender.service.d/20-rust-switch.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
[Service]
|
||||
ExecStart=
|
||||
ExecStart=/usr/local/bin/dlp-webhook-sender-rust
|
||||
when: dlp_webhook_sender_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Reload systemd
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
|
||||
- name: Enable and restart DLP integration timers
|
||||
ansible.builtin.systemd:
|
||||
name: "{{ item }}"
|
||||
enabled: true
|
||||
state: restarted
|
||||
loop:
|
||||
- aw-dlp-cef-exporter.timer
|
||||
- aw-dlp-syslog-forwarder.timer
|
||||
- aw-dlp-webhook-sender.timer
|
||||
- name: Deprecated role guard - DLP integrations are Rust-only
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
ansible/roles/dlp-integrations is deprecated because it deployed the old
|
||||
Python runtime. Use ansible/deploy_aw_server.yml, which installs the
|
||||
Rust CEF, syslog, and webhook exporters from adk-rust.
|
||||
|
||||
@@ -1,46 +1,7 @@
|
||||
---
|
||||
- name: Ensure policy engine directory exists
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /opt/activitywatch/dlp-policy-engine
|
||||
state: directory
|
||||
owner: activitywatch
|
||||
group: activitywatch
|
||||
mode: "0755"
|
||||
|
||||
- name: Deploy policy engine files
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: activitywatch
|
||||
group: activitywatch
|
||||
mode: "{{ item.mode | default('0644') }}"
|
||||
loop:
|
||||
- { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/policy_service.py", dest: "/opt/activitywatch/dlp-policy-engine/policy_service.py" }
|
||||
- { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/policy_schema.py", dest: "/opt/activitywatch/dlp-policy-engine/policy_schema.py" }
|
||||
- { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/policy_storage.py", dest: "/opt/activitywatch/dlp-policy-engine/policy_storage.py" }
|
||||
- { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/policy_distributor.py", dest: "/opt/activitywatch/dlp-policy-engine/policy_distributor.py" }
|
||||
- { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/requirements.txt", dest: "/opt/activitywatch/dlp-policy-engine/requirements.txt" }
|
||||
- { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/dlp-policy-engine.service", dest: "/etc/systemd/system/aw-dlp-policy-engine.service" }
|
||||
|
||||
- name: Ensure policy engine venv exists
|
||||
become: true
|
||||
ansible.builtin.command:
|
||||
cmd: python3 -m venv /opt/activitywatch/dlp-policy-engine/.venv
|
||||
args:
|
||||
creates: /opt/activitywatch/dlp-policy-engine/.venv/bin/python
|
||||
|
||||
- name: Install python deps for policy engine venv
|
||||
become: true
|
||||
ansible.builtin.pip:
|
||||
requirements: /opt/activitywatch/dlp-policy-engine/requirements.txt
|
||||
virtualenv: /opt/activitywatch/dlp-policy-engine/.venv
|
||||
|
||||
- name: Enable and restart policy engine
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
name: aw-dlp-policy-engine.service
|
||||
enabled: true
|
||||
state: restarted
|
||||
- name: Deprecated role guard - DLP policy engine is Rust-only
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
ansible/roles/dlp-policy-engine is deprecated because it deployed the old
|
||||
Python runtime. Use ansible/deploy_aw_server.yml, which installs
|
||||
/usr/local/bin/aw-dlp-policy-engine-rust from adk-rust.
|
||||
|
||||
Reference in New Issue
Block a user