Add roles to tweak the firewall and add the pbench user.

Add a role to allow http/https traffic through the firewall and a role
to create the pbench user.  Import the roles and invoke them from the
pbench-server-config role.

Cleanup and renaming of some variables - the following variables are
assumed to be defined in the inventory file:

- pbench_repo_url_prefix: specifies the URL prefix of the repo where the
  pbench-server RPM is found. It is only used by the pbench-repo-install
  role.

- pbench_config_url: specifies the URL where the config files for specific
  server environments are found.

- pbench_config_files: specifies a list of config files that should be
  installed on a particular host.

Author: ndokos

server/ansible/Inventory/group_vars/servers

@@ -1,12 +1,23 @@
 # Change the [servers] section to the set of hosts where you want to
 # install pbench-server. The various hosts can be running any
-# combinations of RHEL7, RHEL8, or (supported) Fedora versions
-# (currently 28, 29 and 30). Installing on more than one server (e.g.
-# on a master as well as a satellite server) will require more
-# setup and is described in the server/ansible/README.org file.
+# combinations of RHEL7, RHEL8, or (supported) Fedora
+# versions. Installing on more than one server (e.g.  on a master as
+# well as a satellite server) is possible by overriding variables
+# per host (e.g. satellite servers do not do backups, so the variable
+# `configfiles' can be redefined to contain just one element).
 
 [servers]
 <pbench-server-host>
+<pbench-server-satellite-host>   pbench_config_files='["pbench-server.cfg"]'
+
+[servers:vars]
+# pbench_config_url should be set once for a new environment by an administrator
+# to provide access to the config files for whatever server environment(s)
+# are needed.
+# from where to fetch config files
+pbench_config_url = http://pbench.example.com/server/config/{{ cenv }}
+
+# list of config files to fetch
+pbench_config_files = '["pbench-server.cfg", "pbench-server-backup.cfg"]'
 
-# Variables for this group are defined in ./group_vars/servers
 

server/ansible/Inventory/pbench-server.hosts.example

@@ -1,2 +1,10 @@
 ---
 test_repo_enabled: 0
+
+repos:
+  - tag: pbench
+    baseurl: "{{ pbench_repo_url_prefix }}/pbench/{{ distrodir }}"
+    gpgkey: "{{ pbench_repo_url_prefix }}/pbench/pubkey.gpg"
+    gpgcheck: 1
+    enabled: 1
+

server/ansible/roles/pbench-repo-install/defaults/main.yml

@@ -1,9 +1,9 @@
 ---
-# Install pbench-server.repo
-- name: ensure we have the pbench-server.repo file properly in place
+# Install pbench.repo
+- name: ensure we have the pbench.repo file properly in place
   template:
-    src: etc/yum.repos.d/pbench-server.repo.j2
-    dest: /etc/yum.repos.d/pbench-server.repo
+    src: etc/yum.repos.d/pbench.repo.j2
+    dest: /etc/yum.repos.d/pbench.repo
     owner: root
     group: root
     mode: 0644

server/ansible/roles/pbench-repo-install/tasks/main.yml

@@ -1,7 +1,7 @@
 {% for repo in repos %}
 
 [copr-{{ repo.tag }}]
-name=Copr {{ repo.tag }} repo for pbench-server
+name=Copr {{ repo.tag }} repo
 baseurl={{ repo.baseurl }}
 skip_if_unavailable=True
 gpgcheck= {{ repo.gpgcheck }}

server/ansible/roles/pbench-repo-install/templates/etc/yum.repos.d/pbench-server.repo.j2 renamed to server/ansible/roles/pbench-repo-install/templates/etc/yum.repos.d/pbench.repo.j2

@@ -1,10 +1,14 @@
 ---
 - import_role:
     name: geerlingguy.apache
+- import_role:
+    name: pbench-server-firewall
 - import_role:
     name: pbench-server-install-config-file
 - import_role:
     name: pbench-server-vars
+- import_role:
+    name: pbench-server-user
 - import_role:
     name: pbench-server-activate-create-crontab
 - import_role:

server/ansible/roles/pbench-server-config/tasks/main.yml

@@ -0,0 +1,9 @@
+---
+- name: punch holes into the firewall for some services.
+  firewalld:
+    service: "{{ item }}"
+    permanent: yes
+    state: enabled
+  with_items:
+    - http
+    - https

server/ansible/roles/pbench-server-firewall/tasks/main.yml

@@ -1,14 +1,14 @@
 ---
 # Install config file for pbench agent or server (the inventory file
-# specifies which through the configurl variable). Other variables
+# specifies which through the pbench_config_url variable). Other variables
 # are specified in the default vars of this role, but can be overridden
 # (if necessary) by specifying them in the inventory file.
 
 - name: install the config file
   get_url:
-    url: "{{ configurl }}/{{ item }}"
+    url: "{{ pbench_config_url }}/{{ item }}"
     dest: "{{ pbench_server_config_dest }}"
     mode: 0444
     owner: "{{ pbench_owner }}"
     group: "{{ pbench_group }}"
-  with_items: "{{ configfiles }}"
+  with_items: "{{ pbench_config_files }}"

server/ansible/roles/pbench-server-install-config-file/tasks/main.yml

@@ -0,0 +1,29 @@
+---
+- name: create pbench group
+  group:
+    name: "{{ pbench_group }}"
+    state: present
+
+- name: create pbench user
+  user:
+    name: "{{ pbench_user }}"
+    comment: Pbench user
+    home: /home/{{ pbench_user }}
+    group: "{{ pbench_group }}"
+    state: present
+
+- name: relax perms on pbench home directory
+  file:
+    path: /home/{{ pbench_user }}
+    mode: 0755
+    owner: "{{ pbench_user }}"
+    group: "{{ pbench_group }}"
+    state: directory
+
+- name: create .ssh subdir
+  file:
+    path: /home/{{ pbench_user }}/.ssh
+    mode: 0755
+    owner: "{{ pbench_user }}"
+    group: "{{ pbench_group }}"
+    state: directory