diff --git a/ansible/group_vars/all/websites.yml b/ansible/group_vars/all/websites.yml index 5f7138e7f..c58ae1650 100644 --- a/ansible/group_vars/all/websites.yml +++ b/ansible/group_vars/all/websites.yml @@ -183,91 +183,6 @@ websites: authenticated: true state: "present" - - name: "execut-speakers.{{ canonical_hostname }}" - user: "symposium" - alternative_names: [] - extra_includes: - - "execut-referer-tracking" - state: "present" - - - name: "execut-partners.{{ canonical_hostname }}" - user: "symposium" - alternative_names: [] - extra_includes: - - "execut-referer-tracking" - state: "absent" - - - name: "execut-survey.{{ canonical_hostname }}" - user: "symposium" - alternative_names: [] - extra_includes: - - "execut-referer-tracking" - state: "present" - - - name: "execut-landing.{{ canonical_hostname }}" - user: "symposium" - alternative_names: [] - extra_includes: - - "execut-referer-tracking" - state: "present" - - - name: "execut-2018.{{ canonical_hostname }}" - user: "symposium" - alternative_names: [] - extra_includes: - - "execut-referer-tracking" - state: "present" - - - name: "execut-2019.{{ canonical_hostname }}" - user: "symposium" - alternative_names: [] - extra_includes: - - "execut-referer-tracking" - state: "present" - - - name: "execut-2020.{{ canonical_hostname }}" - user: "symposium" - alternative_names: [] - extra_includes: - - "execut-referer-tracking" - state: "present" - - - name: "execut-2023.{{ canonical_hostname }}" - user: "symposium" - alternative_names: [] - extra_includes: - - "execut-referer-tracking" - custom_config: true - state: "present" - - - name: "execut-aftermovie.{{ canonical_hostname }}" - user: "symposium" - alternative_names: [] - extra_includes: - - "execut-referer-tracking" - state: "present" - - - name: "execut-app.{{ canonical_hostname }}" - user: "symposium" - alternative_names: [] - extra_includes: - - "execut-referer-tracking" - state: "absent" - - - name: "execut-2021.{{ canonical_hostname }}" - user: "symposium" - alternative_names: [] - extra_includes: [] - custom_config: true - state: "present" - - - name: "execut.{{ canonical_hostname }}" - user: "symposium" - alternative_names: [] - extra_includes: [] - custom_config: true - state: "present" - - name: "snic-preview.{{ canonical_hostname }}" user: "snic" alternative_names: [] @@ -286,16 +201,6 @@ websites: alternative_names: [] state: "present" - - name: "execut-feedback.{{ canonical_hostname }}" - user: "symposium" - alternative_names: [] - state: "present" - - - name: "execut-qa.{{ canonical_hostname }}" - user: "symposium" - alternative_names: [] - state: "present" - - name: "files.{{ canonical_hostname }}" user: "bestuur" custom_config: true diff --git a/ansible/group_vars/production/vars.yml b/ansible/group_vars/production/vars.yml index 1ff3a52d5..2d93b4a00 100644 --- a/ansible/group_vars/production/vars.yml +++ b/ansible/group_vars/production/vars.yml @@ -57,13 +57,6 @@ secret_backup_aws: access_key: "{{ vault_secret_backup_aws.access_key }}" secret_key: "{{ vault_secret_backup_aws.secret_key }}" -secret_execut_website_aws: - access_key: "{{ vault_secret_execut_website_aws.access_key }}" - secret_key: "{{ vault_secret_execut_website_aws.secret_key }}" - -secret_execut_website_secretkey: - "{{ vault_secret_execut_website_secretkey }}" - # To change, regenerate the token in Mollie's web interface. secret_mollie_token: "{{ vault_secret_mollie_token }}" diff --git a/ansible/group_vars/staging/vars.yml b/ansible/group_vars/staging/vars.yml index 7cd69b266..122d6261f 100644 --- a/ansible/group_vars/staging/vars.yml +++ b/ansible/group_vars/staging/vars.yml @@ -49,12 +49,6 @@ secret_backup_aws: access_key: "{{ vault_secret_backup_aws.access_key }}" secret_key: "{{ vault_secret_backup_aws.secret_key }}" -secret_execut_website_aws: - access_key: "{{ vault_secret_execut_website_aws.access_key }}" - secret_key: "{{ vault_secret_execut_website_aws.secret_key }}" - -secret_execut_website_secretkey: "{{ vault_secret_execut_website_secretkey }}" - # To change, regenerate the token in Mollie's web interface. secret_mollie_token: "{{ vault_secret_mollie_token }}" @@ -158,7 +152,7 @@ secret_chroma: fallacious_rooster: git_tag: "0.1.4" - + digidecs: git_tag: "0.1.0" - server_port: 65437 \ No newline at end of file + server_port: 65437 diff --git a/ansible/main.yml b/ansible/main.yml index 4bfbc2acf..074bfc72b 100644 --- a/ansible/main.yml +++ b/ansible/main.yml @@ -62,8 +62,6 @@ tags: "oauth" - role: "outline" tags: "outline" - - role: "execut" - tags: "execut" - role: "radio" tags: "radio" - role: "sodi" @@ -87,3 +85,9 @@ tags: "always" - role: "rooster" tags: "rooster" + +# Following is a list of removed roles, which we did have. +# If, for some reason, we ever want to use on of the removed services again, +# one can easily restore the role by reverting the following PRs: +# +# - execut: #475 diff --git a/ansible/roles/execut/tasks/main.yml b/ansible/roles/execut/tasks/main.yml deleted file mode 100644 index ccc86f8b5..000000000 --- a/ansible/roles/execut/tasks/main.yml +++ /dev/null @@ -1,111 +0,0 @@ ---- -# - name: "add deadsnakes PPA" -# apt_repository: -# repo: "ppa:deadsnakes/ppa" - -# - name: "install Python 3.9" -# apt: -# pkg: -# - "python3.9" -# - "python3.9-venv" -# - "python3.9-dev" -# state: "present" - -# - name: "ensure database user exists" -# postgresql_user: -# name: "symposium" -# become_user: "postgres" -# become: true - -# - name: "ensure database exists" -# postgresql_db: -# name: "execut" -# owner: "symposium" -# become_user: "postgres" -# become: true - -# - name: "ensure database user has the right privileges" -# postgresql_user: -# db: "execut" -# name: "symposium" -# priv: "ALL" -# role_attr_flags: "CREATEDB,LOGIN" -# become_user: "postgres" -# become: true -# ignore_errors: "{{ ansible_check_mode }}" - -- name: "determine website folder" - ansible.builtin.set_fact: - execut_website_path: "/var/www/symposium/execut-2023.{{ canonical_hostname }}" - -- name: "make website directory" - ansible.builtin.file: - path: "{{ item }}" - owner: "symposium" - group: "symposium" - state: "directory" - with_items: - - "{{ execut_website_path }}" - - "/var/www/symposium/.local" - - "/var/www/symposium/.cache" - -- name: "perform stuff as `symposium`" - become_user: "symposium" - become: true - block: - - name: "clone website's repository" - ansible.builtin.git: - repo: "https://github.com/stichtingsticky/execut" - dest: "{{ execut_website_path }}" - version: "main" - diff: false - -# FIXME update pnpm in symposium -- name: "run pnpm install" - ansible.builtin.command: - cmd: > - nix --extra-experimental-features 'nix-command flakes' - shell nixpkgs#nodePackages.pnpm -c - pnpm install - chdir: "/var/www/symposium/execut-2023.{{ canonical_hostname }}/sites/static" - -- name: "run pnpm build" - ansible.builtin.command: - cmd: > - nix --extra-experimental-features 'nix-command flakes' - shell nixpkgs#nodePackages.pnpm -c - pnpm build - chdir: "/var/www/symposium/execut-2023.{{ canonical_hostname }}/sites/static" - -# - name: "install service file" -# template: -# src: "execut.service.j2" -# dest: "/etc/systemd/system/execut-django-website.service" -# mode: "0644" -# notify: "systemctl daemon-reload" - -- name: "install Nginx config" - ansible.builtin.template: - src: "nginx.conf.j2" - dest: "/etc/nginx/sites-available/execut-2023.{{ canonical_hostname }}.conf" - notify: "reload nginx" - -- name: "enable Nginx config" - ansible.builtin.file: - src: "/etc/nginx/sites-available/execut-2023.{{ canonical_hostname }}.conf" - dest: "/etc/nginx/sites-enabled/execut-2023.{{ canonical_hostname }}.conf" - state: "link" - notify: "reload nginx" - -- name: "test Nginx config" - ansible.builtin.command: "nginx -t" - changed_when: false - -- name: "Reload Nginx, systemd if needed" - ansible.builtin.meta: "flush_handlers" - -# - name: "Start and enable website service" -# systemd: -# name: "execut-django-website.service" -# state: "restarted" -# enabled: true diff --git a/ansible/roles/execut/templates/execut.service.j2 b/ansible/roles/execut/templates/execut.service.j2 deleted file mode 100644 index ed5cb4ea5..000000000 --- a/ansible/roles/execut/templates/execut.service.j2 +++ /dev/null @@ -1,22 +0,0 @@ -# {{ ansible_managed }} - -[Unit] -Description=execut web service -After=network.target -OnFailure=failure-notificator@%n.service - -[Service] -User=symposium -Group=symposium -Environment="VIRTUAL_ENV={{ execut_website_path }}/venv" -Environment="PATH={{ execut_website_path }}/venv/bin:/usr/local/bin:/usr/bin:/bin" -EnvironmentFile={{ execut_website_path }}/execut_www.env -ExecStart={{ execut_website_path }}/venv/bin/gunicorn execut_www.wsgi \ - --name execut-django-website --workers 2 \ - --max-requests 1200 --max-requests-jitter 50 \ - --log-level=info --bind=127.0.0.1:6942 -WorkingDirectory={{ execut_website_path }}/execut_www -Restart=on-failure - -[Install] -WantedBy=multi-user.target diff --git a/ansible/roles/execut/templates/execut_www.env.j2 b/ansible/roles/execut/templates/execut_www.env.j2 deleted file mode 100644 index bc95e6435..000000000 --- a/ansible/roles/execut/templates/execut_www.env.j2 +++ /dev/null @@ -1,13 +0,0 @@ -# {{ ansible_managed }} -DEBUG="{% if 'staging' in group_names %}True{% else %}False{% endif %}" -DATABASE_URL="postgresql:///execut" -SECRET_KEY="{{ secret_execut_website_secretkey }}" -ALLOWED_HOSTS="execut-2021.{{ canonical_hostname }},execut.nl,www.execut.nl,execute.nl,www.execute.nl,2021.execut.nl,2022.execut.nl,execut.dev.svsticky.nl" - -AWS_ACCESS_KEY_ID="{{ secret_execut_website_aws.access_key }}" -AWS_SECRET_ACCESS_KEY="{{ secret_execut_website_aws.secret_key }}" -{% if 'staging' in group_names %} -AWS_BUCKET_NAME="execut-django-website-staging" -{% else %} -AWS_BUCKET_NAME="execut-django-website-prod" -{% endif %} diff --git a/ansible/roles/execut/templates/nginx.conf.j2 b/ansible/roles/execut/templates/nginx.conf.j2 deleted file mode 100644 index 4f96ffdf1..000000000 --- a/ansible/roles/execut/templates/nginx.conf.j2 +++ /dev/null @@ -1,71 +0,0 @@ -# {{ ansible_managed }} -server { - listen 443 ssl http2; - listen [::]:443 ssl http2; - server_name execut-2023.{{ canonical_hostname }} www.execut.nl execute.nl www.execute.nl; - - ssl_certificate /etc/letsencrypt/live/execut-2023.{{ canonical_hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/execut-2023.{{ canonical_hostname }}/privkey.pem; - ssl_trusted_certificate /etc/letsencrypt/live/execut-2023.{{ canonical_hostname }}/chain.pem; - - include includes/block-cert-validation-path.conf; - add_header Referrer-Policy same-origin; - add_header X-XSS-Protection "1; mode=block"; - add_header X-Content-Type-Options "nosniff"; - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; - # Security header file not included because frames - -{% if ('production' in group_names) %} - location / { - return 302 https://execut.nl$request_uri; - } -{% else %} - location / { - return 302 https://execut.dev.svsticky.nl$request_uri; - } -{% endif %} -} - -server { - listen 443 ssl http2; - listen [::]:443 ssl http2; - server_name 2023.execut.nl execut.nl www.execut.nl execute.nl www.execute.nl; - - ssl_certificate /etc/letsencrypt/live/execut-2023.{{ canonical_hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/execut-2023.{{ canonical_hostname }}/privkey.pem; - ssl_trusted_certificate /etc/letsencrypt/live/execut-2023.{{ canonical_hostname }}/chain.pem; - - include includes/block-cert-validation-path.conf; - add_header Referrer-Policy same-origin; - add_header X-XSS-Protection "1; mode=block"; - add_header X-Content-Type-Options "nosniff"; - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; - # Security header file not included because frames - - root /var/www/symposium/execut-2023.{{canonical_hostname}}/sites/static/dist/; - index index.html; -} - -{% if ('staging' in group_names) %} -server { - listen 443 ssl http2; - listen [::]:443 ssl http2; - server_name execut.dev.svsticky.nl; - - ssl_certificate /etc/letsencrypt/live/execut.{{ canonical_hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/execut.{{ canonical_hostname }}/privkey.pem; - ssl_trusted_certificate /etc/letsencrypt/live/execut.{{ canonical_hostname }}/chain.pem; - - include includes/block-cert-validation-path.conf; - add_header Referrer-Policy same-origin; - add_header X-XSS-Protection "1; mode=block"; - add_header X-Content-Type-Options "nosniff"; - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; - # Security header file not included because frames - - - root /var/www/symposium/execut-2023.{{canonical_hostname}}/sites/static/dist/; - index index.html; - -} -{% endif %} diff --git a/ansible/roles/nginx/tasks/main.yml b/ansible/roles/nginx/tasks/main.yml index 6e49964f3..a00052399 100644 --- a/ansible/roles/nginx/tasks/main.yml +++ b/ansible/roles/nginx/tasks/main.yml @@ -29,7 +29,6 @@ dest: "/etc/nginx/includes/{{ item }}" loop: - "block-cert-validation-path.conf" - - "execut-referer-tracking.conf" - "php-parameters.conf" - "security-headers.conf" notify: "reload nginx" diff --git a/ansible/roles/nginx/templates/includes/execut-referer-tracking.conf.j2 b/ansible/roles/nginx/templates/includes/execut-referer-tracking.conf.j2 deleted file mode 100644 index 9f19a2ae6..000000000 --- a/ansible/roles/nginx/templates/includes/execut-referer-tracking.conf.j2 +++ /dev/null @@ -1,6 +0,0 @@ -# {{ ansible_managed }} - -# Include to enable Referer logging for Execut. See nginx.conf. - -access_log /var/log/nginx/execut_referer_tracking referer_tracking - if=$do_log_referer; diff --git a/ansible/roles/nginx/templates/nginx.conf.j2 b/ansible/roles/nginx/templates/nginx.conf.j2 index 66a887f76..ec178dc8c 100644 --- a/ansible/roles/nginx/templates/nginx.conf.j2 +++ b/ansible/roles/nginx/templates/nginx.conf.j2 @@ -74,26 +74,6 @@ http { access_log off; error_log /var/log/nginx/error.log crit; - ## - # Execut referer tracking - ## - - # Enables logging Referer header to a separate logfile, if the Referer is not - # under *.execut.nl. - # Adapted from the docs at: - # http://nginx.org/en/docs/http/ngx_http_log_module.html#access_log - # Note that this value is only evaluated if the execut-referer-tracking - # include is used. - - map $http_referer $do_log_referer { - ~^$ 0; - ~^https?:\/\/(.+\.)*execut\.nl 0; - default 1; - } - - log_format referer_tracking escape=json - '$http_referer\t$scheme://$host$request_uri\t$time_iso8601'; - ## # GZip Settings ## diff --git a/ansible/roles/pretix/templates/pretix.conf.j2 b/ansible/roles/pretix/templates/pretix.conf.j2 index fd918c127..72b2bcfa2 100644 --- a/ansible/roles/pretix/templates/pretix.conf.j2 +++ b/ansible/roles/pretix/templates/pretix.conf.j2 @@ -3,7 +3,7 @@ server { listen 443 ssl http2; listen [::]:443 ssl http2; - server_name ~^(pretix|tickets)\.{{ canonical_hostname }} tickets.execut.nl; + server_name ~^(pretix|tickets)\.{{ canonical_hostname }}; ssl_certificate /etc/letsencrypt/live/pretix.{{ canonical_hostname }}/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/pretix.{{ canonical_hostname }}/privkey.pem; diff --git a/docs/deployment-new-production.md b/docs/deployment-new-production.md index 2590eb5d6..636aa0d0e 100644 --- a/docs/deployment-new-production.md +++ b/docs/deployment-new-production.md @@ -94,7 +94,6 @@ addresses of the new droplet. These are the following: - dgdarc.com - dgdarc.nl - - execut.nl - indievelopment.nl - intro-cs.nl - savadaba.nl