Skip to content

Commit e09505f

Browse files
tomashleytomashley
committed
feat: Install gandalf, salt-wrapper for infra
1 parent 4b77682 commit e09505f

File tree

7 files changed

+138
-0
lines changed

7 files changed

+138
-0
lines changed

‎ansible/files/gandalf_config/gandalf.sudoers.conf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
%gandalf ALL= NOPASSWD: /usr/bin/salt-call
2+
%gandalf ALL= NOPASSWD: /usr/bin/gpg --homedir /etc/salt/gpgkeys --import, /usr/bin/gpg --homedir /etc/salt/gpgkeys --list-secret-keys *

‎ansible/files/gandalf_config/gandalf_salt.service‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
[Unit]
2+
Description=Configuration management via gandalf salt
3+
After=network.target
4+
5+
[Service]
6+
Type=oneshot
7+
ExecStart=/opt/gandalf/gandalf --config /opt/gandalf/config.yaml salt --apply --store-result
8+
User=gandalf
9+
Group=gandalf
10+
StandardOutput=journal
11+
StandardError=journal
12+
StateDirectory=gandalf
13+
CacheDirectory=gandalf
14+
15+
# Security hardening
16+
PrivateTmp=true
17+
18+
[Install]
19+
WantedBy=multi-user.target

‎ansible/files/gandalf_config/gandalf_salt.timer‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
[Unit]
2+
Description=Run Supabase gandalf salt on a schedule
3+
Requires=gandalf_salt.service
4+
5+
[Timer]
6+
OnCalendar=*:0/10
7+
# Random delay up to 30 seconds splay
8+
RandomizedDelaySec=30
9+
AccuracySec=1s
10+
Persistent=true
11+
12+
[Install]
13+
WantedBy=timers.target

‎ansible/manifest-playbook.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,22 @@
6161
shell: |
6262
cd /tmp && tar -cJf admin-mgr-{{ adminmgr_release }}-arm64.tar.xz admin-mgr
6363
64+
- name: Download gandalf archive
65+
get_url:
66+
url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/gandalf/v{{ gandalf_release }}/gandalf_{{ gandalf_release }}_linux_arm64.tar.gz"
67+
dest: "/tmp/gandalf.tar.gz"
68+
timeout: 90
69+
70+
- name: gandalf - unpack archive in /tmp
71+
unarchive:
72+
remote_src: yes
73+
src: /tmp/gandalf.tar.gz
74+
dest: /tmp
75+
76+
- name: gandalf - pack archive
77+
shell: |
78+
cd /tmp && tar -cJf gandalf-{{ gandalf_release }}-arm64.tar.xz gandalf
79+
6480
- name: upload archives
6581
shell: |
6682
aws s3 cp /tmp/{{ item.file }} s3://{{ internal_artifacts_bucket }}/upgrades/{{ item.service }}/{{ item.file }}
@@ -73,3 +89,5 @@
7389
file: supabase-admin-api-{{ adminapi_release }}-arm64.tar.xz
7490
- service: admin-mgr
7591
file: admin-mgr-{{ adminmgr_release }}-arm64.tar.xz
92+
- service: gandalf
93+
file: gandalf-{{ gandalf_release }}-arm64.tar.xz

‎ansible/tasks/internal/gandalf.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
- name: gandalf - system user
2+
user:
3+
name: gandalf
4+
groups: admin,gandalf,salt
5+
append: yes
6+
system: yes
7+
shell: /bin/sh
8+
9+
- name: Setting arch (x86)
10+
set_fact:
11+
arch: "x86"
12+
when: platform == "amd64"
13+
14+
- name: Setting arch (arm)
15+
set_fact:
16+
arch: "arm64"
17+
when: platform == "arm64"
18+
19+
- name: Download gandalf archive
20+
get_url:
21+
url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/gandalf/v{{ gandalf_release }}/gandalf_{{ gandalf_release }}_linux_{{ arch }}.tar.gz"
22+
dest: "/tmp/gandalf.tar.gz"
23+
timeout: 90
24+
25+
- name: gandalf - unpack archive in /opt
26+
unarchive:
27+
remote_src: yes
28+
src: /tmp/gandalf.tar.gz
29+
dest: /opt
30+
owner: gandalf
31+
32+
- name: gandalf - create symlink
33+
ansible.builtin.file:
34+
path: /opt/gandalf/gandalf
35+
src: "/opt/gandalf/gandalf-linux-{{ arch }}"
36+
state: link
37+
owner: gandalf
38+
mode: '0755'
39+
force: yes
40+
41+
- name: gandalf - config dir
42+
file:
43+
path: /opt/gandalf
44+
owner: gandalf
45+
state: directory
46+
47+
- name: gandalf - gpg dir
48+
file:
49+
path: /etc/salt/gpgkeys
50+
owner: root
51+
group: salt
52+
state: directory
53+
54+
- name: give gandalf user permissions
55+
copy:
56+
src: files/gandalf.sudoers.conf
57+
dest: /etc/sudoers.d/gandalf
58+
mode: "0644"
59+
60+
- name: gandalf - create salt systemd timer file
61+
copy:
62+
src: files/gandalf_config/gandalf_salt.timer
63+
dest: /etc/systemd/system/gandalf_salt.timer
64+
65+
- name: gandalf - create salt service file
66+
copy:
67+
src: files/gandalf_config/gandalf_salt.service
68+
dest: /etc/systemd/system/gandalf_salt.service
69+
70+
- name: gandalf - reload systemd
71+
systemd:
72+
daemon_reload: yes
73+
74+
# Initially ensure gandalf is installed but not started
75+
- name: gandalf - DISABLE service
76+
systemd:
77+
name: gandalf_salt
78+
enabled: no
79+
state: stopped

‎ansible/tasks/setup-supabase-internal.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,5 +115,10 @@
115115
tags:
116116
- aws-only
117117

118+
- name: Install gandalf
119+
import_tasks: internal/gandalf.yml
120+
tags:
121+
- aws-only
122+
118123
- name: Envoy - use lds.supabase.yaml for /etc/envoy/lds.yaml
119124
command: mv /etc/envoy/lds.supabase.yaml /etc/envoy/lds.yaml

‎ansible/vars.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,3 +57,5 @@ adminmgr_release: 0.25.1
5757

5858
vector_x86_deb: "https://packages.timber.io/vector/0.22.3/vector_0.22.3-1_amd64.deb"
5959
vector_arm_deb: "https://packages.timber.io/vector/0.22.3/vector_0.22.3-1_arm64.deb"
60+
61+
gandalf_release: 1.4.18

0 commit comments

Comments
 (0)