deploy_jenkins.yum.yml

---
- hosts: jenkins
  remote_user: root
  tasks:


#  Failed in setup
#  - name: Add python to allow normal Ansible management
#    raw: dnf -y install python-simplejson

  - name: Add needed packages (including epel (may not be necessary))
    yum:
      pkg: "{{item}}"
      state: latest
    with_items:
      - "httpd"
      - "git"
      - "mod_proxy_html"
      - "bc"
      - "epel-release"
  
  - name: Update to the latest packages
    yum:
      name: '*'
      state: latest

  - name: Modify the Apache file layout to use sites available/enabled
    file:
      path: "{{item}}"
      state: directory
      mode: 0755
    with_items:
      - "/etc/httpd/sites-enabled"
      - "/etc/httpd/sites-available"
    notify:
      - restart apache

#  - name: Test for new IncludeOptional line
#    shell: grep '^IncludeOptional sites-enabled/*.conf' /etc/httpd/conf/httpd.conf
#    register: test_grep

  - name: Add new IncludeOptional line
    lineinfile:
      dest: /etc/httpd/conf/httpd.conf
      line: "IncludeOptional sites-enabled/*.conf"
    notify:
      - restart apache

  - name: Add Jenkins repository
    get_url:
      url: http://pkg.jenkins-ci.org/redhat-stable/jenkins.repo
      dest: /etc/yum.repos.d/jenkins.repo
      mode: 0644

  - name: Add Jenkins repo key  
    rpm_key:
      state: present 
      key: https://jenkins-ci.org/redhat/jenkins-ci.org.key

  - name: Fix SELinux context on repo file
    file:
      path: /etc/yum.repos.d/jenkins.repo
      seuser: unconfined_u
      serole: object_r 
      setype: system_conf_t
      selevel: s0

#  Only available in Ansible 2.1
#  - name: Add Jenkins repository
#    yumrepo:
#      name: jenkins_repo
#      description: Add Jenkins YUM repo
#      file: jenkins.repo
#      baseurl: http://pkg.jenkins-ci.org/redhat-stable/
#      enabled: yes
#      gpgcheck: no

  - name: Install OpenJDK
    yum:
      name: java-1.7.0-openjdk
      state: present

  - name: Install Jenkins
    yum:
      name: jenkins
      state: present

#  - name: Configure firewalld port 8080/tcp
#    firewalld:
#      zone: public
#      port: 8080/tcp
#      permanent: true
#      immediate:

#  - name: Configure firwalld http service
#    firewalld:
#      zone: public
#      service: http
#      permanent: true
#      immediate:

  - name: Disable Jenkins HTTP listener
    replace:
      dest=/etc/sysconfig/jenkins
      regexp='JENKINS_PORT="8080"'
      replace='JENKINS_PORT="-1"'
    notify:
      - restart jenkins

  - name: Enable MD5 in Java security (work around for current bug)
    replace:
      dest=/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.95-2.6.4.0.el7_2.x86_64/jre/lib/security/java.security
      regexp='jdk.certpath.disabledAlgorithms=MD2, MD5, RSA keySize < 1024'
      replace='jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024'
    notify:
      - restart jenkins

  - name: Limit AJP listener to localhost 
    replace:
      dest=/etc/sysconfig/jenkins
      regexp='JENKINS_AJP_LISTEN_ADDRESS=""'
      replace='JENKINS_AJP_LISTEN_ADDRESS="127.0.0.1"'
    notify:
      - restart jenkins

# Being exploded by Jenkins but not seen in plugins
#  - name: Add the Google OAuth plugin
#    get_url:
#      url: http://updates.jenkins-ci.org/latest/google-oauth-plugin.hpi
#      dest: /var/lib/jenkins/plugins
#    notify:
#      - restart jenkins

  - name: Enable and start Apache
    service:
      name: httpd
      enabled: yes
      state: started

# Need
# Configure SSL Proxy

  - name: Enable and start Jenkins
    service:
      name: jenkins
      enabled: yes
      state: started

  - name: Deploy jenkins proxy template
    template:
      src: apache_ajp_proxy
      dest: /etc/httpd/sites-available/{{ansible_nodename}}.conf
      owner: root
      group: root
      mode: 0644
    notify:
      - restart apache

  - name: Link apache config in sites-available to sites-enabled
    file:
      src: /etc/httpd/sites-available/{{ansible_nodename}}.conf
      dest: /etc/httpd/sites-enabled/{{ansible_nodename}}.conf
      owner: root
      group: root
      state: link
    notify:
      - restart apache
  
  - name: Clone Lets Encrypt repository
    git: 
      repo: https://github.com/letsencrypt/letsencrypt
      dest: /opt/letsencrypt

# Need
# Google app auth (http://stackoverflow.com/questions/17676232/how-to-configure-jenkins-authentication-with-google-apps)

  handlers:
    - name: restart apache
      service:
        name: httpd
        state: restarted

    - name: restart jenkins
      service:
        name: jenkins
        state: restarted