new role to add server packages required by ./securedrop-admin install

freedomofpress · Feb 12, 2019 · de2deba · de2deba
1 parent f6f6ea2
commit de2deba
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/install_files/ansible-base/roles/prepare-servers/tasks/main.yml b/install_files/ansible-base/roles/prepare-servers/tasks/main.yml
@@ -0,0 +1,11 @@
+---
+# Ensures that prequisite packages for anssible and securedrop-admin install
+# are present
+ - name: 'Ensure apt has been safely updated wrt. CVE-2019-3462'
+   raw: 'apt -o Acquire::http::AllowRedirect=false update &&
+    apt -o Acquire::http::AllowRedirect=false --only-upgrade -y install apt'
+ - name: 'run apt update'
+   raw: 'sudo apt -o update'
+ - name: 'install packages'
+   raw: 'sudo apt-get -y install python apt-transport-https dnsutils'
+
diff --git a/install_files/ansible-base/securedrop-prod.yml b/install_files/ansible-base/securedrop-prod.yml
@@ -8,6 +8,14 @@
   roles:
     - { role: validate, tags: validate }
 
+- name: Prepare servers for installation
+  hosts: securedrop
+  gather_facts: no
+  max_fail_percentage: 0
+  any_errors_fatal: yes
+  roles:
+    - { role: prepare-servers }
+
 - name: Add FPF apt repository and install base packages.
   hosts: securedrop
   max_fail_percentage: 0