259 lines
7.4 KiB
YAML
259 lines
7.4 KiB
YAML
---
|
|
|
|
- name: Create the makepkg drop-in config file
|
|
ansible.builtin.template:
|
|
dest: /etc/makepkg.conf.d/makepkg.conf
|
|
src: makepkg.conf.j2
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Create the build user group
|
|
ansible.builtin.group:
|
|
name: "{{ aur_repo_build_account }}"
|
|
system: true
|
|
state: present
|
|
|
|
- name: Create the build user
|
|
ansible.builtin.user:
|
|
name: "{{ aur_repo_build_account }}"
|
|
password: '!'
|
|
group: "{{ aur_repo_build_account }}"
|
|
comment: "AUR Package Builder"
|
|
shell: /sbin/nologin
|
|
home: "{{ aur_repo_dir }}"
|
|
createhome: true
|
|
system: true
|
|
state: present
|
|
|
|
- name: Create the build user sudoer file
|
|
ansible.builtin.template:
|
|
dest: /etc/sudoers.d/{{ aur_repo_build_account }}
|
|
src: aur-sudoer.j2
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
|
|
- name: Create the build dirs
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "{{ aur_repo_build_account }}"
|
|
group: "{{ aur_repo_build_account }}"
|
|
mode: "0775"
|
|
loop:
|
|
- "{{ aur_repo_dir }}"
|
|
- "{{ aur_repo_dir }}/packages"
|
|
- "{{ aur_repo_dir }}/sources"
|
|
- "{{ aur_repo_dir }}/srcpackages"
|
|
- /var/log/makepkg
|
|
- /tmp/build
|
|
|
|
- name: Check if the signing key is in build user's keyring
|
|
become: true
|
|
become_user: "{{ aur_repo_build_account }}"
|
|
ansible.builtin.command:
|
|
cmd: gpg2 --list-secret-key --with-colons {{ aur_repo_key_thumbprint }}
|
|
failed_when: key_result.rc not in [0, 2]
|
|
changed_when: false
|
|
register: key_result
|
|
|
|
- name: GPG key import block
|
|
when: key_result.rc == 2
|
|
block:
|
|
|
|
- name: Template out the signing private key
|
|
ansible.builtin.template:
|
|
dest: "/tmp/build/signing_key.asc"
|
|
src: signing_key.asc.j2
|
|
owner: "{{ aur_repo_build_account }}"
|
|
group: "{{ aur_repo_build_account }}"
|
|
mode: "0600"
|
|
|
|
- name: Import the signing key
|
|
become: true
|
|
become_user: "{{ aur_repo_build_account }}"
|
|
ansible.builtin.command:
|
|
cmd: gpg2 --import /tmp/build/signing_key.asc
|
|
changed_when: true
|
|
|
|
- name: Delete the signing key
|
|
ansible.builtin.file:
|
|
path: "/tmp/build/signing_key.asc"
|
|
state: absent
|
|
|
|
- name: Check if aurutils is already installed
|
|
ansible.builtin.stat:
|
|
follow: true
|
|
path: /usr/bin/aur
|
|
register: aurutils_stat
|
|
|
|
- name: Aurutils install block
|
|
when: not aurutils_stat.stat.exists
|
|
block:
|
|
|
|
- name: Install makepkg dependencies
|
|
community.general.pacman:
|
|
name:
|
|
- git
|
|
- base-devel
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Clone aurutils
|
|
ansible.builtin.git:
|
|
depth: 1
|
|
dest: /tmp/aurutils
|
|
repo: https://aur.archlinux.org/aurutils.git
|
|
single_branch: true
|
|
version: master
|
|
|
|
- name: Slurp PKGBUILD contents
|
|
ansible.builtin.slurp:
|
|
path: /tmp/aurutils/PKGBUILD
|
|
register: aurutils_pkgbuild
|
|
|
|
- name: Parse PKGBUILD into facts
|
|
ansible.builtin.set_fact:
|
|
aurutils_dependencies: "{{ aurutils_pkgbuild['content'] | b64decode | regex_search('(?<=^depends=\\().*(?=\\)$)', multiline=True) | replace(\"'\", '') | split(' ') }}" # noqa: yaml[line-length]
|
|
aurutils_pkgver: "{{ aurutils_pkgbuild['content'] | b64decode | regex_search('(?<=^pkgver=).*(?=$)', multiline=True) }}"
|
|
aurutils_pkgrel: "{{ aurutils_pkgbuild['content'] | b64decode | regex_search('(?<=^pkgrel=).*(?=$)', multiline=True) }}"
|
|
aurutils_arch: "{{ aurutils_pkgbuild['content'] | b64decode | regex_search('(?<=^arch=\\().*(?=\\)$)', multiline=True) | replace(\"'\", '') }}"
|
|
|
|
- name: Install aurutils dependencies
|
|
community.general.pacman:
|
|
name: "{{ aurutils_dependencies }}"
|
|
state: present
|
|
reason: dependency
|
|
update_cache: false
|
|
|
|
- name: Build aurutils
|
|
become: true
|
|
become_user: "{{ aur_repo_build_account }}"
|
|
ansible.builtin.command:
|
|
cmd: makepkg
|
|
chdir: /tmp/aurutils
|
|
creates: "{{ aur_repo_dir }}/packages/aurutils-{{ aurutils_pkgver }}-{{ aurutils_pkgrel }}-{{ aurutils_arch }}.pkg.tar"
|
|
|
|
- name: Update repo database
|
|
become: true
|
|
become_user: "{{ aur_repo_build_account }}"
|
|
ansible.builtin.command:
|
|
argv:
|
|
- repo-add
|
|
- --prevent-downgrade
|
|
- --remove
|
|
- --sign
|
|
- --key
|
|
- "{{ aur_repo_key_thumbprint }}"
|
|
- home.db.tar
|
|
- aurutils-{{ aurutils_pkgver }}-{{ aurutils_pkgrel }}-{{ aurutils_arch }}.pkg.tar
|
|
chdir: "{{ aur_repo_dir }}/packages"
|
|
changed_when: true
|
|
|
|
- name: Check if the signing key is in pacman keyring
|
|
ansible.builtin.command:
|
|
argv:
|
|
- pacman-key
|
|
- -l
|
|
- "{{ aur_repo_key_thumbprint }}"
|
|
failed_when: pacman_key_result.rc not in [0, 1]
|
|
changed_when: false
|
|
register: pacman_key_result
|
|
|
|
- name: Pacman key import block
|
|
when: pacman_key_result.rc == 1
|
|
block:
|
|
|
|
- name: Import the signing public key to arch keyring
|
|
ansible.builtin.command:
|
|
argv:
|
|
- pacman-key
|
|
- -r
|
|
- "{{ aur_repo_key_thumbprint }}"
|
|
- --keyserver
|
|
- hkps://keyserver.ubuntu.com
|
|
changed_when: true
|
|
|
|
- name: Locally sign the imported pacman key
|
|
ansible.builtin.command:
|
|
argv:
|
|
- pacman-key
|
|
- --lsign-key
|
|
- "{{ aur_repo_key_thumbprint }}"
|
|
changed_when: true
|
|
|
|
- name: Add custom repo block to pacman.conf
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/pacman.conf
|
|
block: |
|
|
[home]
|
|
SigLevel = Required TrustedOnly
|
|
Server = file://{{ aur_repo_dir }}/packages
|
|
create: false
|
|
state: present
|
|
insertafter: EOF
|
|
|
|
- name: Install aurutils
|
|
community.general.pacman:
|
|
name: aurutils
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Enable the multilib repository
|
|
ansible.builtin.replace:
|
|
path: /etc/pacman.conf
|
|
backup: true
|
|
regexp: '^[#]?\[multilib\]\n[#]?Include = \/etc\/pacman.d\/mirrorlist$'
|
|
replace: '[multilib]\nInclude = /etc/pacman.d/mirrorlist'
|
|
register: multilib_enable
|
|
|
|
- name: Update the package database # noqa: no-handler
|
|
when: multilib_enable.changed
|
|
community.general.pacman:
|
|
update_cache: true
|
|
|
|
- name: Sync AUR packages
|
|
become: true
|
|
become_user: "{{ aur_repo_build_account }}"
|
|
ansible.builtin.command:
|
|
cmd: aur sync --no-view -CnrS {{ item }}
|
|
loop: "{{ aur_repo_host_packages }}"
|
|
register: aur_sync_result
|
|
changed_when: (aur_sync_result.stderr_lines | last | replace(':','')) != "sync there is nothing to do"
|
|
failed_when: aur_sync_result.rc != 0
|
|
|
|
- name: Add the root www folder if it doesn't exist
|
|
ansible.builtin.file:
|
|
path: /var/www
|
|
state: directory
|
|
owner: http
|
|
group: http
|
|
mode: "0775"
|
|
|
|
- name: Link the aur repo to the web root
|
|
ansible.builtin.file:
|
|
src: "{{ aur_repo_dir }}/packages"
|
|
path: /var/www{{ aur_repo_dir }}
|
|
state: link
|
|
|
|
- name: Add the aur-sync systemd unit files
|
|
ansible.builtin.copy:
|
|
src: "{{ item }}"
|
|
dest: /usr/lib/systemd/system/
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop:
|
|
- aur-sync.service
|
|
- aur-sync.timer
|
|
register: aur_sync_unit_files
|
|
|
|
- name: Enable and start the aur-sync systemd timer # noqa: no-handler
|
|
when: aur_sync_unit_files.changed
|
|
ansible.builtin.systemd:
|
|
name: aur-sync.timer
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|