Service deployment on Nomad POC

.github/workflows/update_service.yml

@@ -0,0 +1,73 @@
+name: Update Service
+
+on:
+  repository_dispatch:
+    types: [deploy]
+
+concurrency:
+  # with this group each combination <env>-<service> can run in parallel.
+  # Requests to the same <env>-<service> get queued
+  group: deploy-${{ github.event.client_payload.env }}-${{ github.event.client_payload.service }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate inputs
+        env:
+          ENV: ${{ github.event.client_payload.env }}
+          SERVICE: ${{ github.event.client_payload.service }}
+          TAG: ${{ github.event.client_payload.tag }}
+        run: |
+          case "$ENV" in dev|prod) ;; *) echo "Invalid env: $ENV"; exit 1 ;; esac
+          case "$SERVICE" in
+            oonimeasurements|ooniprobe|oonifindings|ooniauth|oonirun) ;;
+            *) echo "Invalid service: $SERVICE"; exit 1 ;;
+          esac
+          if [ -z "$TAG" ]; then echo "Missing tag"; exit 1; fi
+
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GH_PAT }}   # needs repo write to commit back
+          ref: nomad-experiment # TODO remove on actual deploy
+
+      - name: Update service_tags.auto.tfvars.json
+        env:
+          ENV: ${{ github.event.client_payload.env }}
+          SERVICE: ${{ github.event.client_payload.service }}
+          TAG: ${{ github.event.client_payload.tag }}
+        run: |
+          FILE="tf/environments/${ENV}/service_tags.auto.tfvars.json"
+          [ -f "$FILE" ] || echo '{}' > "$FILE"
+          jq --arg key "${SERVICE}_tag" --arg tag "$TAG" \
+            '.[$key] = $tag' "$FILE" > tmp.json && mv tmp.json "$FILE"
+
+      - name: Commit and push
+        env:
+          ENV: ${{ github.event.client_payload.env }}
+          SERVICE: ${{ github.event.client_payload.service }}
+          TAG: ${{ github.event.client_payload.tag }}
+        run: |
+          git config user.name "github-actions"
+          git config user.email "github-actions@github.com"
+          git add "tf/environments/${ENV}/service_tags.auto.tfvars.json"
+          git commit -m "deploy: ${SERVICE} -> ${TAG} (${ENV})"
+          git push
+
+      - uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform init
+        working-directory: tf/environments/${{ github.event.client_payload.env }}
+        run: terraform init
+
+      - name: Terraform apply
+        working-directory: tf/environments/${{ github.event.client_payload.env }}
+        env:
+          NOMAD_ADDR: ${{ secrets.NOMAD_ADDR }}
+          NOMAD_TOKEN: ${{ secrets.NOMAD_TOKEN }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.OONIDEVOPS_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.OONIDEVOPS_AWS_SECRET_ACCESS_KEY }}
+          SERVICE: ${{ github.event.client_payload.service }}
+        run: |
+          terraform apply -auto-approve -target="nomad_job.${SERVICE}"

ansible/deploy-nomad.yml

@@ -0,0 +1,13 @@
+---
+# This will be in dev mode for the moment, just as a POC
+- name: Deploy Nomad agent
+  hosts: anonc.dev.ooni.io # Use this host in the meanwhile
+  become: true
+  vars:
+    ssl_domains:
+      - "{{ inventory_hostname }}"
+  roles:
+    # - bootstrap
+    - nginx
+    - dehydrated
+    - nomad

ansible/roles/bootstrap/tasks/main.yml

@@ -68,7 +68,7 @@
 
 - name: install systemd-resolved
   tags: resolved
-  ignore_errors: yes # some ubuntu hosts do not have the systemd-resolved package
+  ignore_errors: true # some ubuntu hosts do not have the systemd-resolved package
   ansible.builtin.apt:
     install_recommends: no
     cache_valid_time: 86400

ansible/roles/nomad/defaults/main.yml

@@ -0,0 +1,8 @@
+---
+nomad_webui_username: "admin"
+nomad_webui_password: "{{ lookup('amazon.aws.aws_ssm', '/oonidevops/secrets/nomad_webui_password', profile='oonidevops_user_dev') }}"
+nomad_htpasswd_path: "/etc/nginx/nomad.htpasswd"
+
+# Choose one that it's outside of system users ranges (0-100)
+# and human user ranges > 1000
+podman_uid: 64501

ansible/roles/nomad/handlers/main.yml

@@ -0,0 +1,32 @@
+- name: test nginx config
+  command: /usr/sbin/nginx -t -c /etc/nginx/nginx.conf
+  listen:
+    - restart nginx
+    - reload nginx
+
+- name: restart nginx
+  service:
+    name: nginx
+    state: restarted
+
+- name: reload nginx
+  service:
+    name: nginx
+    state: reloaded
+
+- name: reload nftables
+  tags: nftables
+  ansible.builtin.systemd_service:
+    name: nftables
+    state: reloaded
+
+- name: restart docker
+  tags: docker
+  ansible.builtin.systemd_service:
+    name: docker
+    state: restarted
+
+- name: restart nomad
+  ansible.builtin.systemd_service:
+    name: nomad
+    state: restarted