Merge pull request #349 from edx/jarv/common-refactor

Jarv/common refactor

playbooks/edx-east/edx_continuous_integration.yml

@@ -7,33 +7,24 @@
     migrate_db: "yes"
     openid_workaround: True
   roles:
-    - ansible_debug
     - common
     - role: nginx
       nginx_sites:
       - cms
       - lms
-      - lms-preview
       - ora
       - xqueue
       - xserver
-      #- discern
     - edxlocal
+    - supervisor
+    - mongo
     - edxapp
     - { role: 'rabbitmq', rabbitmq_ip: '127.0.0.1' }
     - { role: 'edxapp', celery_worker: True }
     - oraclejdk
     - elasticsearch
-    - role: rbenv
-      rbenv_user: "{{ forum_user }}"
-      rbenv_user_home: "{{ forum_home }}"
-      rbenv_ruby_version: "{{ forum_ruby_version }}"
     - forum
-    - role: virtualenv
-      virtualenv_user: "{{ xqueue_user }}"
-      virtualenv_user_home: "{{ xqueue_user_home }}"
-      virtualenv_name: "{{ xqueue_user }}"
     - { role: "xqueue", update_users: True }
     - xserver
     - ora
-    #- discern
+    - discern

playbooks/edx-east/edx_dev2.yml

@@ -15,6 +15,7 @@
     - "{{ secure_dir }}/vars/users.yml"
   roles:
     - common
+    - supervisor
     - datadog
     - role: nginx
       nginx_sites:
@@ -34,6 +35,7 @@
     - "{{ secure_dir }}/vars/users.yml"
   roles:
     - common
+    - supervisor
     - datadog
     - role: nginx
       nginx_sites:

playbooks/edx-east/edx_feanilsandbox.yml

@@ -7,12 +7,13 @@
     - "{{ secure_dir }}/vars/users.yml"
   roles:
     - common
+    - supervisor
     - datadog
     - role: nginx
       nginx_sites:
       - lms
       - cms
-      - lms-preview 
+      - lms-preview
     - role: 'edxapp'
       edxapp_lms_env: 'lms.envs.load_test'
       edx_platform_commit: 'release'
@@ -25,12 +26,13 @@
     - "{{ secure_dir }}/vars/users.yml"
   roles:
     - common
+    - supervisor
     - datadog
     - role: nginx
       nginx_sites:
       - lms
       - cms
-      - lms-preview 
+      - lms-preview
     - role: 'edxapp'
       edxapp_lms_env: 'lms.envs.load_test'
       celery_worker: True
@@ -43,9 +45,10 @@
     - "{{ secure_dir }}/vars/users.yml"
   roles:
     - common
+    - supervisor
     - role: nginx
       nginx_sites:
-      - xserver 
+      - xserver
     - xserver
     - splunkforwarder
 - hosts: tag_aws_cloudformation_stack-name_feanilsandbox:&tag_group_rabbitmq
@@ -56,6 +59,7 @@
     - "{{ secure_dir }}/vars/users.yml"
   roles:
     - common
+    - supervisor
     - rabbitmq
     - splunkforwarder
 - hosts: tag_aws_cloudformation_stack-name_feanilsandbox:&tag_group_xqueue
@@ -65,6 +69,7 @@
     - "{{ secure_dir }}/vars/users.yml"
   roles:
     - common
+    - supervisor
     - role: nginx
       nginx_sites:
       - xqueue

playbooks/edx-east/edx_mirror.yml

@@ -5,6 +5,7 @@
   gather_facts: False
   roles:
     - common
+    - supervisor
     - role: nginx
       nginx_sites:
       - devpi
@@ -17,4 +18,4 @@
       tags: ['r_devpi']
     - role: gh_mirror
       tags: ['r_gh_mirror']
- 
+

playbooks/edx-east/edx_notifier.yml

@@ -7,6 +7,7 @@
   gather_facts: True
   roles:
     - common
+    - supervisor
     - role: virtualenv
       virtualenv_user: "notifier"
       virtualenv_user_home: "/opt/wwc/notifier"
@@ -22,6 +23,7 @@
   gather_facts: True
   roles:
     - common
+    - supervisor
     - role: virtualenv
       virtualenv_user: "notifier"
       virtualenv_user_home: "/opt/wwc/notifier"
@@ -37,6 +39,7 @@
   gather_facts: True
   roles:
     - common
+    - supervisor
     - role: virtualenv
       virtualenv_user: "notifier"
       virtualenv_user_home: "/opt/wwc/notifier"
@@ -52,6 +55,7 @@
   gather_facts: True
   roles:
     - common
+    - supervisor
     - role: virtualenv
       virtualenv_user: "notifier"
       virtualenv_user_home: "/opt/wwc/notifier"
@@ -68,6 +72,7 @@
   vars:
   roles:
     - common
+    - supervisor
     - role: virtualenv
       virtualenv_user: "notifier"
       virtualenv_user_home: "/opt/wwc/notifier"

playbooks/edx-east/edx_sandbox.yml

@@ -13,6 +13,7 @@
     mysql5_workaround: True
   roles:
     - common
+    - supervisor
     - role: nginx
       nginx_sites:
       - lms
@@ -27,6 +28,6 @@
     - { role: 'edxapp', celery_worker: True }
     - role: rbenv
       rbenv_user: "{{ forum_user }}"
-      rbenv_user_home: "{{ forum_home }}"
+      rbenv_dir: "{{ forum_home }}"
       rbenv_ruby_version: "{{ forum_ruby_version }}"
     - forum

playbooks/edx-east/mlapi_prod.yml

@@ -6,6 +6,7 @@
     - "{{ secure_dir }}/vars/mlapi_prod_users.yml"
   roles:
     - common
+    - supervisor
     - discern
   sudo: True
 - hosts:
@@ -17,4 +18,4 @@
     - "{{ secure_dir }}/vars/mlapi_prod_users.yml"
   roles:
     - common
-  sudo: True
\ No newline at end of file
+  sudo: True

playbooks/edx-east/mlapi_sandbox.yml

@@ -6,6 +6,7 @@
     - "{{ secure_dir }}/vars/mlapi_sandbox_users.yml"
   roles:
     - common
+    - supervisor
     - discern
   sudo: True
 - hosts:

playbooks/edx-east/mlapi_stage.yml

@@ -6,6 +6,7 @@
     - "{{ secure_dir }}/vars/mlapi_stage_users.yml"
   roles:
     - common
+    - supervisor
     - discern
   sudo: True
 - hosts:

playbooks/edx-west/carnegie-prod-app.yml

@@ -19,6 +19,7 @@
     - "{{ secure_dir }}/vars/edxapp_prod_users.yml"
   roles:
     - common
+    - supervisor
     - {'role': 'nginx', 'nginx_conf': true}
     - {'role': 'edxapp', 'openid_workaround': true, 'template_subdir': 'carnegie'}
     # run this role last

playbooks/edx-west/carnegie-prod-worker.yml

@@ -15,4 +15,5 @@
     - "{{ secure_dir }}/vars/edxapp_prod_users.yml"
   roles:
     - common
+    - supervisor
     - { role: 'edxapp', celery_worker: True }

playbooks/edx-west/cme-prod-app.yml

@@ -32,6 +32,7 @@
     - "{{ secure_dir }}/vars/edxapp_prod_users.yml"
   roles:
     - common
+    - supervisor
     - role: nginx
       nginx_conf: true
       nginx_sites:

playbooks/edx-west/cme-prod-worker.yml

@@ -15,4 +15,5 @@
     - "{{ secure_dir }}/vars/edxapp_prod_users.yml"
   roles:
     - common
+    - supervisor
     - { role: 'edxapp', celery_worker: True }

playbooks/edx-west/edxapp_rolling_example.yml

-# ansible-playbook -v --user=ubuntu  edxapp_rolling_example.yml -i ./ec2.py  --private-key=/path/to/deployment.pem 
+# ansible-playbook -v --user=ubuntu  edxapp_rolling_example.yml -i ./ec2.py  --private-key=/path/to/deployment.pem
 
 - hosts: tag_Group_anothermulti
   serial: 2
@@ -6,8 +6,8 @@
     - "{{ secure_dir }}/vars/edxapp_stage_vars.yml"
     - "{{ secure_dir }}/vars/users.yml"
   pre_tasks:
-    - name: Gathering ec2 facts 
-      ec2_facts: 
+    - name: Gathering ec2 facts
+      ec2_facts:
     - name: Removing instance from the ELB
       local_action: ec2_elb
       args:
@@ -15,7 +15,8 @@
         state: 'absent'
   roles:
     - common
-    - role: nginx 
+    - supervisor
+    - role: nginx
       nginx_sites:
       - lms
       - cms

playbooks/edx-west/prod-app.yml

@@ -26,6 +26,7 @@
     - "{{ secure_dir }}/vars/shib_prod_vars.yml"
   roles:
     - common
+    - supervisor
     - role: nginx
       nginx_sites:
       - lms

playbooks/edx-west/prod-jumpbox.yml

@@ -7,3 +7,4 @@
     local_dir:  '../../../configuration-secure/ansible/local'
   roles:
     - common
+    - supervisor

playbooks/edx-west/prod-ora.yml

@@ -18,6 +18,7 @@
     - "{{ secure_dir }}/vars/edxapp_prod_users.yml"
   roles:
     - common
+    - supervisor
     - role: nginx
       nginx_sites:
       - ora

playbooks/edx-west/prod-worker.yml

@@ -16,6 +16,7 @@
     - "{{ secure_dir }}/vars/shib_prod_vars.yml"
   roles:
     - common
+    - supervisor
     - { role: 'edxapp', celery_worker: True }
 
 #

playbooks/edx-west/prod-xqueue.yml

@@ -15,6 +15,7 @@
     - "{{ secure_dir }}/vars/edxapp_prod_users.yml"
   roles:
     - common
+    - supervisor
     - role: nginx
       nginx_sites:
       - xqueue

playbooks/edx-west/stage-all.yml

@@ -12,4 +12,5 @@
     - "{{ secure_dir }}/vars/edxapp_stage_users.yml"
   roles:
     - common
+    - supervisor
 

playbooks/edx-west/stage-app.yml

@@ -17,6 +17,7 @@
     - "{{ secure_dir }}/vars/shib_stage_vars.yml"
   roles:
     - common
+    - supervisor
     - role: nginx
       nginx_sites:
       - lms

playbooks/edx-west/stage-debug.yml

@@ -12,6 +12,7 @@
     #- "{{ secure_dir }}/vars/shib_stage_vars.yml"
   roles:
     - common
+    - supervisor
     - role: nginx
       nginx_sites:
       - lms

playbooks/edx-west/stage-notifier-only.yml

@@ -8,6 +8,7 @@
     - "{{ secure_dir }}/vars/edxapp_stage_vars.yml"
     - "{{ secure_dir }}/vars/notifier_stage_vars.yml"
   roles:
+    - supervisor
     - role: virtualenv
       virtualenv_user: "notifier"
       virtualenv_user_home: "/opt/wwc/notifier"

playbooks/edx-west/stage-ora.yml

@@ -10,6 +10,7 @@
     - "{{ secure_dir }}/vars/edxapp_stage_users.yml"
   roles:
     - common
+    - supervisor
     - role: nginx
       nginx_sites:
       - ora

playbooks/edx-west/stage-rabbit.yml

@@ -10,6 +10,7 @@
     - "{{ secure_dir }}/vars/edxapp_stage_users.yml"
   roles:
     - common
+    - supervisor
     - rabbitmq
 
 #- hosts: tag_aws_cloudformation_stack-name_feanilpractice:&tag_group_edxapp

playbooks/edx-west/stage-worker.yml

@@ -15,6 +15,7 @@
     - "{{ secure_dir }}/vars/edxapp_stage_users.yml"
   roles:
     - common
+    - supervisor
     - { role: 'edxapp', celery_worker: True }
 
 # run the notifier on the first util machine only

playbooks/edx-west/stage-xqueue.yml

@@ -10,6 +10,7 @@
     - "{{ secure_dir }}/vars/edxapp_stage_users.yml"
   roles:
     - common
+    - supervisor
     - role: nginx
       nginx_sites:
       - xqueue

playbooks/group_vars/all

 ---
-# This should only have variables
-# that are applicable to all edX roles
-
-storage_base_dir: /mnt
-app_base_dir: /opt/wwc
-log_base_dir: "{{ storage_base_dir }}/logs"
-venv_dir: /opt/edx
-os_name: ubuntu
-
-ENV_NAME: 'default_env'
-ENV_TYPE: 'default_type'
-
 # these pathes are relative to the playbook dir
 # directory for secret settings (keys, etc)
-secure_dir: 'secure_example'
+#
+
+secure_dir: 'path/to/secure_example'
 
 # this indicates the path to site-specific (with precedence)
 # things like nginx template files
-local_dir:  '../../ansible_local'
-# include http/https
-PYPI_MIRROR_URL: 'https://pypi.python.org/simple'
-# do not include http/https
-GIT_MIRROR: 'github.com'
+local_dir:  'path/to/ansible_local'

playbooks/library/supervisorctl

+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# (c) 2012, Matt Wright <matt@nobien.net>
+#
+# This file is part of Ansible
+#
+# Ansible is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Ansible is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
+#
+import os
+
+DOCUMENTATION = '''
+---
+module: supervisorctl
+short_description: Manage the state of a program or group of programs running via Supervisord
+description:
+     - Manage the state of a program or group of programs running via I(Supervisord)
+version_added: "0.7"
+options:
+  name:
+    description:
+      - The name of the I(supervisord) program/process to manage
+    required: true
+    default: null
+  config:
+    description:
+      - configuration file path, passed as -c to supervisorctl
+    required: false
+    default: null
+    version_added: "1.3"
+  server_url:
+    description:
+      - URL on which supervisord server is listening, passed as -s to supervisorctl
+    required: false
+    default: null
+    version_added: "1.3"
+  username:
+    description:
+      - username to use for authentication with server, passed as -u to supervisorctl
+    required: false
+    default: null
+    version_added: "1.3"
+  password:
+    description:
+      - password to use for authentication with server, passed as -p to supervisorctl
+    required: false
+    default: null
+    version_added: "1.3"
+  state:
+    description:
+      - The state of service
+    required: true
+    default: null
+    choices: [ "present", "started", "stopped", "restarted" ]
+  supervisorctl_path:
+    description:
+      - Path to supervisorctl executable to use
+    required: false
+    default: null
+    version_added: "1.4"
+requirements:
+  - supervisorctl
+requirements: [ ]
+author: Matt Wright
+'''
+
+EXAMPLES = '''
+# Manage the state of program to be in 'started' state.
+- supervisorctl: name=my_app state=started
+
+# Restart my_app, reading supervisorctl configuration from a specified file.
+- supervisorctl: name=my_app state=restarted config=/var/opt/my_project/supervisord.conf
+
+# Restart my_app, connecting to supervisord with credentials and server URL.
+- supervisorctl: name=my_app state=restarted username=test password=testpass server_url=http://localhost:9001
+
+'''
+
+def main():
+    arg_spec = dict(
+        name=dict(required=True),
+        config=dict(required=False),
+        server_url=dict(required=False),
+        username=dict(required=False),
+        password=dict(required=False),
+        supervisorctl_path=dict(required=False),
+        state=dict(required=True, choices=['present', 'started', 'restarted', 'stopped'])
+    )
+
+    module = AnsibleModule(argument_spec=arg_spec, supports_check_mode=True)
+
+    name = module.params['name']
+    state = module.params['state']
+    config = module.params.get('config')
+    server_url = module.params.get('server_url')
+    username = module.params.get('username')
+    password = module.params.get('password')
+    supervisorctl_path = module.params.get('supervisorctl_path')
+
+    if supervisorctl_path:
+        supervisorctl_path = os.path.expanduser(supervisorctl_path)
+        if os.path.exists(supervisorctl_path) and module.is_executable(supervisorctl_path):
+            supervisorctl_args = [ supervisorctl_path ]
+        else:
+            module.fail_json(msg="Provided path to supervisorctl does not exist or isn't executable: %s" % supervisorctl_path)
+    else:
+        supervisorctl_args = [ module.get_bin_path('supervisorctl', True) ]
+
+    if config:
+        supervisorctl_args.extend(['-c', os.path.expanduser(config)])
+    if server_url:
+        supervisorctl_args.extend(['-s', server_url])
+    if username:
+        supervisorctl_args.extend(['-u', username])
+    if password:
+        supervisorctl_args.extend(['-p', password])
+
+    def run_supervisorctl(cmd, name=None, **kwargs):
+        args = list(supervisorctl_args)  # copy the master args
+        args.append(cmd)
+        if name:
+            args.append(name)
+        return module.run_command(args, **kwargs)
+
+    rc, out, err = run_supervisorctl('status')
+    present = name in out
+
+    if state == 'present':
+        if not present:
+            if module.check_mode:
+                module.exit_json(changed=True)
+            run_supervisorctl('reread', check_rc=True)
+            rc, out, err = run_supervisorctl('add', name)
+
+            if '%s: added process group' % name in out:
+                module.exit_json(changed=True, name=name, state=state)
+            else:
+                module.fail_json(msg=out, name=name, state=state)
+
+        module.exit_json(changed=False, name=name, state=state)
+
+    rc, out, err = run_supervisorctl('status', name)
+    running = 'RUNNING' in out
+
+    if running and state == 'started':
+        module.exit_json(changed=False, name=name, state=state)
+
+    if running and state == 'stopped':
+        if module.check_mode:
+            module.exit_json(changed=True)
+        rc, out, err = run_supervisorctl('stop', name)
+
+        if '%s: stopped' % name in out:
+            module.exit_json(changed=True, name=name, state=state)
+
+        module.fail_json(msg=out)
+
+    elif state == 'restarted':
+        if module.check_mode:
+            module.exit_json(changed=True)
+        rc, out, err = run_supervisorctl('update', name)
+        rc, out, err = run_supervisorctl('restart', name)
+
+        if '%s: started' % name in out:
+            module.exit_json(changed=True, name=name, state=state)
+
+        module.fail_json(msg=out)
+
+    elif not running and state == 'started':
+        if module.check_mode:
+            module.exit_json(changed=True)
+        rc, out, err = run_supervisorctl('start',name)
+
+        if '%s: started' % name in out:
+            module.exit_json(changed=True, name=name, state=state)
+
+        module.fail_json(msg=out)
+
+    module.exit_json(changed=False, name=name, state=state)
+
+# this is magic, see lib/ansible/module_common.py
+#<<INCLUDE_ANSIBLE_MODULE_COMMON>>
+
+main()

playbooks/roles/apache/templates/lms.j2

-WSGIPythonHome {{venv_dir}}
+WSGIPythonHome {{ edxapp_venv_dir }}
 WSGIRestrictEmbedded On
 
 <VirtualHost *:{{apache_port}}>
@@ -15,9 +15,9 @@ WSGIRestrictEmbedded On
 
     SetEnv SERVICE_VARIANT lms
     
-    WSGIScriptAlias / {{edx_platform_code_dir}}/lms/wsgi_apache_lms.py
+    WSGIScriptAlias / {{ edxapp_code_dir }}/lms/wsgi_apache_lms.py
 
-    <Directory {{edx_platform_code_dir}}/lms>
+    <Directory {{ edxapp_code_dir }}/lms>
     <Files wsgi_apache_lms.py>
         Order deny,allow
         Allow from all
@@ -39,7 +39,7 @@ WSGIRestrictEmbedded On
         require valid-user
     </Location>
 
-    WSGIDaemonProcess lms user=www-data group=adm processes=1 python-path={{edx_platform_code_dir}}:{{venv_dir}}/lib/python2.7/site-packages display-name=%{GROUP}
+    WSGIDaemonProcess lms user=www-data group=adm processes=1 python-path={{ edxapp_code_dir }}:{{ edxapp_venv_dir }}/lib/python2.7/site-packages display-name=%{GROUP}
     WSGIProcessGroup lms
     WSGIApplicationGroup %{GLOBAL}
     
@@ -48,4 +48,4 @@ WSGIRestrictEmbedded On
     LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" %D" apache-edx
     CustomLog ${APACHE_LOG_DIR}/apache-edx-access.log apache-edx
 
-</VirtualHost>
\ No newline at end of file
+</VirtualHost>

playbooks/roles/common/defaults/main.yml

+
+# Override these variables
+# to change the base directory
+# where edX is installed
+
+COMMON_BASE_DIR: /edx
+COMMON_DATA_DIR: "{{ COMMON_BASE_DIR}}/var"
+COMMON_APP_DIR: "{{ COMMON_BASE_DIR}}/app"
+COMMON_LOG_DIR: "{{ COMMON_DATA_DIR }}/log"
+
+# these directories contain
+# symlinks for convenience
+COMMON_BIN_DIR: "{{ COMMON_BASE_DIR }}/bin"
+COMMON_CFG_DIR: "{{ COMMON_BASE_DIR }}/etc"
+
+COMMON_ENV_NAME: 'default_env'
+COMMON_ENV_TYPE: 'default_type'
+COMMON_PYPI_MIRROR_URL: 'https://pypi.python.org/simple'
+# do not include http/https
+COMMON_GIT_MIRROR: 'github.com'
+
+
+
 common_debian_pkgs:
   - ack-grep
   - lynx-cur
@@ -8,3 +31,14 @@ common_debian_pkgs:
   - tree
   - git
   - unzip
+  - python2.7
+  - python-pip
+  - python2.7-dev
+
+common_pip_pkgs:
+  - virtualenv
+  - virtualenvwrapper
+
+common_web_user: www-data
+common_web_group: www-data
+common_log_user: syslog

playbooks/roles/common/tasks/create_github_users.yml

----
-
-# Overview:
-# 
-# Creates OS accounts for users based on their github credential.
-# Expects to find a list in scope named GITHUB_USERS with
-# the following structure:
-#
-# GITHUB_USERS:
-#   - user: me_at_github
-#     groups:
-#     - adm
-#   - user: otheruser
-#     groups: 
-#     - users
-#
-
-- name: common | create local user for github user
-  user: 
-    name={{ item.user }} 
-    groups={{ ",".join(item.groups) }}
-    shell=/bin/bash
-  with_items: GITHUB_USERS
-  tags:
-    - users
-    - update
-
-- name: common | create .ssh directory
-  file: 
-    path=/home/{{ item.user }}/.ssh state=directory mode=0700 
-    owner={{ item.user }} group={{ item.user }}
-  with_items: GITHUB_USERS
-  tags:
-    - users
-    - update
-
-- name: common | copy github key[s] to .ssh/authorized_keys
-  get_url: 
-    url=https://github.com/{{ item.user }}.keys 
-    dest=/home/{{ item.user }}/.ssh/authorized_keys mode=0600 
-    owner={{ item.user }} group={{ item.user }}
-  with_items: GITHUB_USERS
-  tags:
-    - users
-    - update

playbooks/roles/common/tasks/create_users.yml

----
-- name: common | Create 'edx' users group
-  group: name=edx state=present
-  tags:
-  - users
-  - admin_users
-  - update
-
-- name: common | Add user 'ubuntu' to 'edx' group
-  # This is a temporary measure for initial configuration; after the last 
-  # play is run and we've got a good set of users, ubuntu should no longer be used
-  user: name=ubuntu append=yes groups="edx"
-  tags:
-  - users
-  - admin_users
-  - update
-
-- name: common | Creating admin users
-  # Admin users, by definition, should be able to sudo w/ password, and read adm-only files
-  user: name={{ item.user }} append=yes groups={{ "adm,edx,"+",".join(item.groups) }} shell=/bin/bash
-  with_items: admin_users
-  when: admin_users is defined
-  tags:
-  - users
-  - admin_users
-  - update
-
-- name: common | Copying ssh keys for admin users
-  authorized_key: user={{item.user}} key="{{ lookup('file', item.path ) }}"
-  with_items: admin_keys
-  when: admin_keys is defined
-  tags:
-  - users
-  - admin_users
-  - update
-
-- name: common | Creating env users
-  user: name={{ item.user }} {% if item.groups %}groups={{ ",".join(item.groups) }}{% endif %} shell=/bin/bash
-  with_items: ENV_USERS
-  when: ENV_USERS is defined
-  tags:
-  - users
-  - update
-
-- name: common | Copying ssh keys for env users
-  authorized_key: user={{ item.user }} key="{{ lookup('file', item.path ) }}"
-  with_items: env_keys
-  when: env_keys is defined
-  tags:
-  - users
-  - update
-
-- name: common | Group adm passwordless sudo
-  copy: content="%adm ALL=(ALL) NOPASSWD:ALL" dest=/etc/sudoers.d/adm-group owner=root group=root mode=0440
-  tags:
-  - users
-  - admin_users
-  - update

playbooks/roles/common/tasks/create_venv.yml

----
-# create the 'edx' virtual environment in /opt so that roles can populate it
-- name: common | Install python and pip
-  apt: pkg={{item}} install_recommends=yes state=present update_cache=yes
-  with_items:
-  - python2.7
-  - python-pip
-  - python2.7-dev
-  tags:
-  - pre_install
-  - install
-
-- name: common | pip install virtualenv
-  pip: >
-    name=virtualenv 
-    state=present
-    extra_args="-i {{ PYPI_MIRROR_URL }}"
-  tags:
-  - venv_base
-  - install
-
-- name: common | pip install virtualenvwrapper
-  pip: >
-    name=virtualenvwrapper 
-    state=present
-    extra_args="-i {{ PYPI_MIRROR_URL }}"
-  tags:
-  - venv_base
-  - install
-
-- name: common | create edx virtualenv directory
-  file: path={{ venv_dir }} owner=ubuntu group=adm mode=2775 state=directory
-  tags:
-  - venv_base
-  - install
-
-- name: common | create the edx virtualenv directory initial contents
-  command: /usr/local/bin/virtualenv {{ venv_dir }} --distribute creates=$venv_dir/bin/activate
-  tags:
-  - venv_base
-  - install
-
-- name: common |  pip install gunicorn
-  pip: >
-    name=gunicorn 
-    virtualenv="{{venv_dir}}" 
-    state=present
-    extra_args="-i {{ PYPI_MIRROR_URL }}"
-  tags:
-  - gunicorn
-  - install

playbooks/roles/common/tasks/edx_logging_base.yml

----
-#- name: common | Install rsyslog configuration for ansible runs
-#  template: dest=/etc/rsyslog.d/90-edx.conf src=ansible_rsyslog.j2 owner=root group=root mode=644
-#  notify: common | restart rsyslogd
-#  tags:
-#  - lms-env
-#  - cms-env
-#  - logging
-#  - update
-
-- name: common | Install rsyslog configuration for edX
-  template: dest=/etc/rsyslog.d/99-edx.conf src=edx_rsyslog.j2 owner=root group=root mode=644
-  notify: common | restart rsyslogd
-  tags:
-  - logging
-  - update
-
-- name: common | Install logrotate configuration for edX
-  template: dest=/etc/logrotate.d/edx-services src=edx_logrotate.j2 owner=root group=root mode=644
-  tags:
-  - logging
-  - update
-
-- name: common | Touch tracking file into existence
-  command: touch -a {{log_base_dir}}/tracking.log creates={{log_base_dir}}/tracking.log
-  tags:
-  - logging
-  - update
-
-- name: common | Set permissions on tracking file
-  file: path={{log_base_dir}}/tracking.log owner=syslog group=adm mode=640
-  tags:
-  - logging
-  - update
-
-- name: common | Install logrotate configuration for tracking file
-  template: dest=/etc/logrotate.d/tracking.log src=edx_logrotate_tracking_log.j2 owner=root group=root mode=644
-  tags:
-  - logging
-  - update

playbooks/roles/common/tasks/main.yml

 ---
-- include: create_users.yml
-- include: create_github_users.yml
-  when: GITHUB_USERS is defined
-
 - name: common | Add user www-data
-  # This user should be created on the system by default
-  user: name=www-data
-  tags:
-  - pre_install
-  - update
+  # This is the default user for nginx
+  user: >
+    name="{{ common_web_user }}"
+    shell=/bin/false
 
-- name: common | Create the base directory for storage
+- name: common | Create common directories
   file: >
-    path={{ storage_base_dir }}
-      state=directory
-      owner=root
-      group=root
-      mode=0755
-
-- name: common | Create application root
-  # In the future consider making group edx r/t adm
-  file: path={{ app_base_dir }} state=directory owner=root group=adm mode=2775 
-  tags:
-  - pre_install
-  - update
-
-- name: common | Create upload directory
-  file: path={{ app_base_dir }}/uploads mode=2775 state=directory owner=root group=adm
-  tags:
-  - pre_install
-  - update
+    path={{ item }} state=directory owner=root
+    group=root mode=0755
+  with_items:
+    - "{{ COMMON_DATA_DIR }}"
+    - "{{ COMMON_APP_DIR }}"
+    - "{{ COMMON_LOG_DIR }}"
+    - "{{ COMMON_BIN_DIR }}"
+    - "{{ COMMON_CFG_DIR }}"
 
-- name: common | Create data dir
-  file: path={{ app_base_dir }}/data state=directory owner=www-data group=root
-  tags:
-  - pre_install
-  - update
-  
-- name: common | Create staticfiles dir
-  file: path={{ app_base_dir }}/staticfiles state=directory owner=www-data group=adm mode=2775 
-  tags:
-  - pre_install
-  - update
-  
 - name: common | Install role-independent useful system packages
   # do this before log dir setup; rsyslog package guarantees syslog user present
-  apt: pkg={{','.join(common_debian_pkgs)}} install_recommends=yes state=present update_cache=yes
-  tags:
-  - pre_install
-  - update
+  apt: >
+    pkg={{','.join(common_debian_pkgs)}} install_recommends=yes
+    state=present update_cache=yes
 
-- name: common | Create log directory
-  file: path={{log_base_dir}} state=directory mode=2755 group=adm owner=syslog
-  tags:
-  - pre_install
-  - update
-
-- name: common | Create alias from app_base_dir to the log_base_dir
-  file: state=link src={{log_base_dir}} path={{app_base_dir}}/log
-  tags:
-  - pre_install
-  - logging
-  - update
+- name: common | upload sudo config for key forwarding as root
+  copy: >
+    src=ssh_key_forward dest=/etc/sudoers.d/ssh_key_forward
+    validate='visudo -c -f %s' owner=root group=root mode=0440
 
-- name: common | Create convenience link from log_base_dir to system logs
-  file: state=link src=/var/log path=$log_base_dir/system
-  tags:
-  - pre_install
-  - logging
-  - update
+- name: common | pip install virtualenv
+  pip: >
+    name="{{ item }}" state=present
+    extra_args="-i {{ COMMON_PYPI_MIRROR_URL }}"
+  with_items: common_pip_pkgs
 
-- name: common | Touch edx log file into place 
-  # This is done for the benefit of the rake commands, which expect it
-  command: touch -a {{log_base_dir}}/edx.log creates={{log_base_dir}}/edx.log
-  tags:
-  - pre_install
-  - logging
-  - install
+- name: common | Install rsyslog configuration for edX
+  template: dest=/etc/rsyslog.d/99-edx.conf src=edx_rsyslog.j2 owner=root group=root mode=644
+  notify: common | restart rsyslogd
 
-- name: common | Set permissions on edx log file
-  # This is done for the benefit of the rake commands, which expect it
-  file: path={{log_base_dir}}/edx.log owner=syslog group=adm mode=640
-  tags:
-  - pre_install
-  - logging
-  - update
 
-- name: common | upload sudo config for key forwarding as root
-  copy: src=ssh_key_forward dest=/etc/sudoers.d/ssh_key_forward validate='visudo -c -f %s' owner=root group=root mode=0440
+- name: common | Install logrotate configuration for edX
+  template: dest=/etc/logrotate.d/edx-services src=edx_logrotate.j2 owner=root group=root mode=644
 
-- include: create_venv.yml
-- include: edx_logging_base.yml

playbooks/roles/common/tasks/software_update.yml

----
-- name: common | edx-update.sh, manual lms/cms update script
-  template: src=edx-update.sh.j2 dest=/usr/local/bin/edx-update.sh owner=ubuntu group=adm mode=0775
-  tags:
-  - release
-  - update

playbooks/roles/common/templates/edx_logrotate.j2

-{{log_base_dir}}/*/edx.log {
+{{ COMMON_LOG_DIR }}/*/edx.log {
   create
   compress
   copytruncate

playbooks/roles/common/templates/edx_rsyslog.j2

@@ -27,12 +27,12 @@ auth,authpriv.*                                         /var/log/auth.log
 $template tracking,"%syslogtag%%msg%\n"
 
 # looks for [service_name=<name>] in the beginning of the log message,
-# if it exists the log will go into {{log_base_dir}}/<name>/edx.log, otherwise
-# it will go into {{log_base_dir}}/edx.log
-$template DynaFile,"{{log_base_dir}}/%syslogtag:R,ERE,1,BLANK:\[service_variant=([a-zA-Z_-]*)\].*--end%/edx.log"
+# if it exists the log will go into {{ COMMON_LOG_DIR }}/<name>/edx.log, otherwise
+# it will go into {{ COMMON_LOG_DIR }}/edx.log
+$template DynaFile,"{{ COMMON_LOG_DIR }}/%syslogtag:R,ERE,1,BLANK:\[service_variant=([a-zA-Z_-]*)\].*--end%/edx.log"
 
 local0.*                        -?DynaFile
-local1.*                        {{log_base_dir}}/tracking.log;tracking
+local1.*                        {{ COMMON_LOG_DIR }}/tracking.log;tracking
 #cron.*                         /var/log/cron.log
 #daemon.*                       -/var/log/daemon.log
 kern.*                          -/var/log/kern.log

playbooks/roles/devpi/defaults/main.yml

 ---
-devpi_venv_dir: "{{ app_base_dir }}/devpi/venvs/devpi"
+devpi_venv_dir: "{{ COMMON_APP_DIR }}/devpi/venvs/devpi"
 devpi_pip_pkgs:
   - devpi-server
   - eventlet

playbooks/roles/discern/defaults/main.yml

 DISCERN_NGINX_PORT: 18070
 DISCERN_BASIC_AUTH: False
+DISCERN_MEMCACHE: [ 'localhost:11211' ]
+DISCERN_AWS_ACCESS_KEY_ID: ""
+DISCERN_AWS_SECRET_ACCESS_KEY: ""
+DISCERN_BROKER_URL: ""
+DISCERN_RESULT_BACKEND: ""
+DISCERN_GOOGLE_ANALYTICS_PROPERTY_ID: ""
+DISCERN_MYSQL_DB_NAME: 'discern'
+DISCERN_MYSQL_USER: 'root'
+DISCERN_MYSQL_PASSWORD: ''
+DISCERN_MYSQL_HOST: 'localhost'
+DISCERN_MYSQL_PORT: '3306'
+
+
+discern_app_dir: "{{ COMMON_APP_DIR }}/discern"
+discern_code_dir: "{{ discern_app_dir }}/discern"
+discern_data_dir: "{{ COMMON_DATA_DIR }}/discern"
+discern_venvs_dir: "{{ discern_app_dir }}/venvs"
+discern_venv_dir: "{{ discern_venvs_dir }}/discern"
+discern_venv_bin: "{{ discern_venv_dir }}/bin"
+discern_pre_requirements_file: "{{ discern_code_dir }}/pre-requirements.txt"
+discern_post_requirements_file: "{{ discern_code_dir }}/requirements.txt"
+discern_user: "discern"
+
+discern_ease_venv_dir: "{{ discern_venv_dir }}"
+discern_ease_code_dir: "{{ discern_app_dir }}/ease"
+discern_ease_source_repo: https://github.com/edx/ease.git
+discern_ease_version: 'HEAD'
+discern_ease_pre_requirements_file: "{{ discern_ease_code_dir }}/pre-requirements.txt"
+discern_ease_post_requirements_file: "{{ discern_ease_code_dir }}/requirements.txt"
+
+discern_nltk_data_dir: "{{ discern_data_dir}}/nltk_data"
 
 discern_source_repo: https://github.com/edx/discern.git
-ease_source_repo: https://github.com/edx/ease.git
-ease_dir: $app_base_dir/ease
-discern_dir: $app_base_dir/discern
 discern_settings: discern.aws
-nltk_data_dir: /usr/share/nltk_data
-ease_branch: master
 discern_branch: dev
 discern_gunicorn_port: 8070
 discern_gunicorn_host: 127.0.0.1
-discern_user: discern
-site_name: discern
+
+discern_env_config:
+  ACCOUNT_EMAIL_VERIFICATION: "mandatory"
+  AWS_SES_REGION_NAME: "us-east-1"
+  DEFAULT_FROM_EMAIL: "registration@example.com"
+  DNS_HOSTNAME: ""
+  ELB_HOSTNAME: ""
+  EMAIL_BACKEND: "django.core.mail.backends.smtp.EmailBackend"
+  S3_BUCKETNAME: ""
+  USE_S3_TO_STORE_MODElS: false
+
+
+discern_auth_config:
+  AWS_ACCESS_KEY_ID: $DISCERN_AWS_ACCESS_KEY_ID
+  AWS_SECRET_ACCESS_KEY: $DISCERN_SECRET_ACCESS_KEY
+  BROKER_URL: $DISCERN_BROKER_URL
+  CACHES:
+    default:
+      BACKEND: 'django.core.cache.backends.memcached.MemcachedCache'
+      LOCATION: $DISCERN_MEMCACHE
+  CELERY_RESULT_BACKEND: $DISCERN_RESULT_BACKEND
+  DATABASES:
+    default:
+      ENGINE: django.db.backends.mysql
+      HOST: $DISCERN_MYSQL_HOST
+      NAME: $DISCERN_MYSQL_DB_NAME
+      PASSWORD: $DISCERN_MYSQL_PASSWORD
+      PORT: $DISCERN_MYSQL_PORT
+      USER: $DISCERN_MYSQL_USER
+  GOOGLE_ANALYTICS_PROPERTY_ID: $DISCERN_GOOGLE_ANALYTICS_PROPERTY_ID
+
+
+discern_debian_pkgs:
+  - policykit-1
+  - python-virtualenv
+  - gcc
+  - g++
+  - build-essential
+  - python-dev
+  - gfortran
+  - libfreetype6-dev
+  - libpng12-dev
+  - libxml2-dev
+  - libxslt1-dev
+  - libreadline6
+  - libreadline6-dev
+  - redis-server
+  - python-pip
+  - ipython
+  - nginx
+  - libmysqlclient-dev
+  - libblas3gf
+  - libblas-dev
+  - liblapack3gf
+  - liblapack-dev
+  - libatlas-base-dev
+  - curl
+  - yui-compressor
+
+discern_ease_debian_pkgs:
+  - python-pip
+  - gcc
+  - g++
+  - gfortran
+  - libblas3gf
+  - libblas-dev
+  - liblapack3gf
+  - liblapack-dev
+  - libatlas-base-dev
+  - libxml2-dev
+  - libxslt1-dev
+  - aspell
+  - python

playbooks/roles/discern/tasks/deploy.yml

+---
+#Upload config files for django (auth and env)
+- name: discern | create discern application config env.json file
+  template: src=env.json.j2 dest={{ discern_app_dir }}/env.json
+  sudo_user: "{{ discern_user }}"
+  notify:
+    - discern | restart celery
+    - discern | restart discern
+  tags:
+    - deploy
+
+- name: discern | create discern auth file auth.json
+  template: src=auth.json.j2 dest={{ discern_app_dir }}/auth.json
+  sudo_user: "{{ discern_user }}"
+  notify:
+    - discern | restart celery
+    - discern | restart discern
+  tags:
+    - deploy
+
+- name: discern | git checkout discern repo into discern_code_dir
+  git: dest={{ discern_code_dir }} repo={{ discern_source_repo }} version={{ discern_branch }}
+  sudo_user: "{{ discern_user }}"
+  notify:
+    - discern | restart celery
+    - discern | restart discern
+  tags:
+    - deploy
+
+- name: discern | git checkout ease repo into discern_ease_code_dir
+  git: dest={{ discern_ease_code_dir}} repo={{ discern_ease_source_repo }} version={{ discern_ease_version }}
+  sudo_user: "{{ discern_user }}"
+  notify:
+    - discern | restart celery
+    - discern | restart discern
+  tags:
+    - deploy
+
+#Numpy has to be a pre-requirement in order for scipy to build
+- name : install python pre-requirements for discern and ease
+  pip: requirements={{item}} virtualenv={{ discern_venv_dir }} state=present
+  sudo_user: "{{ discern_user }}"
+  with_items:
+    - "{{ discern_pre_requirements_file }}"
+    - "{{ discern_ease_pre_requirements_file }}"
+  tags:
+    - deploy
+
+- name : install python requirements for discern and ease
+  pip: requirements={{item}} virtualenv={{ discern_venv_dir }} state=present
+  sudo_user: "{{ discern_user }}"
+  with_items:
+    - "{{ discern_post_requirements_file }}"
+    - "{{ discern_ease_post_requirements_file }}"
+  tags:
+    - deploy
+
+- name: discern | install ease python package
+  shell: command="{{discern_venv_dir}}/bin/activate; cd {{ discern_ease_code_dir }}; python setup.py install"
+  tags:
+    - deploy
+
+#Needed for the ease package to work
+- name: discern | install nltk data using rendered shell script
+  shell: command="{{ discern_venv_dir }}/bin/python -m nltk.downloader -d {{ discern_nltk_data_dir }} all"
+  sudo_user: "{{ discern_user }}"
+  tags:
+    - deploy
+
+#Run this instead of using the ansible module because the ansible module only support syncdb of these three, and does not
+#support virtualenvs as of this comment
+- name: discern | django syncdb migrate and collectstatic for discern
+  shell: >
+    command="{{ discern_venv_dir }}/bin/python {{discern_code_dir}}/manage.py {{item}} --noinput --settings={{discern_settings}} --pythonpath={{discern_code_dir}}"
+      chdir={{ discern_code_dir }}
+  sudo_user: "{{ discern_user }}"
+  with_items:
+    - syncdb
+    - migrate
+    - collectstatic
+  tags:
+    - deploy
+#Have this separate from the other three because it doesn't take the noinput flag
+- name: discern | django update_index for discern
+  shell: >
+    command="{{ discern_venv_dir}}/bin/python {{discern_code_dir}}/manage.py update_index --settings={{discern_settings}} --pythonpath={{discern_code_dir}}"
+      chdir={{ discern_code_dir }}
+  sudo_user: "{{ discern_user }}"
+  tags:
+    - deploy

playbooks/roles/discern/tasks/main.yml

 ---
-#Create the templates for upstart services
+- name: discern | create application user
+  user: >
+    name="{{ discern_user }}"
+    home="{{ discern_app_dir }}"
+    createhome=no
+    shell=/bin/false
+
+- name: discern | create discern app and data dir
+  file: >
+    path="{{ item }}"
+    state=directory
+    owner="{{ discern_user }}"
+    group="{{ common_web_group }}"
+  with_items:
+    - "{{ discern_app_dir }}"
+    - "{{ discern_data_dir }}"
+    - "{{ discern_venvs_dir }}"
+
+- name: discern | install debian packages that discern needs
+  apt: pkg={{ item }} state=present
+  with_items: discern_debian_pkgs
+
+- name: discern | install debian packages for ease that discern needs
+  apt: pkg={{ item }} state=present
+  with_items: discern_ease_debian_pkgs
+
 - name: discern | render celery service from template
-  template: src=celery.conf.j2 dest=/etc/init/celery.conf owner=root group=edx mode=0664
+  template: >
+    src=celery.conf.j2 dest=/etc/init/celery.conf
+    owner=root group=root
   notify: discern | restart celery
 
 - name: discern | render discern service from template
-  template: src=discern.conf.j2 dest=/etc/init/discern.conf owner=root group=edx mode=0664
+  template: >
+    src=discern.conf.j2 dest=/etc/init/discern.conf
+    owner=root group=root
   notify: discern | restart discern
 
-#Allows us to recover from a bad sudoers file
-- name: discern | Install policykit
-  apt: pkg=policykit-1 install_recommends=yes state=present update_cache=yes
-
-#Discern user is admin
-- name: discern | Create discern user
-  user: name={{ discern_user }} append=yes groups="adm,edx" shell=/bin/bash
-
-- name: discern | upload sudoers template to /tmp/sudoers
-  copy: src=sudoers-discern dest=/tmp/{{site_name}} owner=root group=root mode=0440
-
-#Verify file and move to sudoers.d folder
-- name: discern | move temp file to sudoers.d
-  shell: visudo -q -c -f /tmp/{{site_name}} && cp /tmp/{{site_name}} /etc/sudoers.d/{{site_name}}
-
-#Upload config files for django (auth and env)
-- name: discern | create discern application config env.json file
-  template: src=env.json.j2 dest={{app_base_dir}}/env.json owner={{discern_user}} group=edx mode=0640
-  notify:
-    - discern | restart celery
-    - discern | restart discern
-
-- name: discern | create discern auth file auth.json
-  template: src=auth.json.j2 dest={{app_base_dir}}/auth.json owner={{discern_user}} group=edx mode=0640
-  notify:
-    - discern | restart celery
-    - discern | restart discern
+- name: discern | copy sudoers file for discern
+  copy: >
+    src=sudoers-discern dest=/etc/sudoers.d/discern
+    mode=0440 validate='visudo -cf %s' owner=root group=root
 
 #Needed if using redis to prevent memory issues
 - name: discern | change memory commit settings -- needed for redis
   command: sysctl vm.overcommit_memory=1
 
-- name: discern | set permissions on app_base_dir sgid for edx
-  file: path={{app_base_dir}} owner=root group=edx mode=2775 state=directory
-  file: path={{venv_dir}} owner=root group=edx mode=2775 state=directory
-
-- name: discern | Install git so that we can clone repos
-  apt: pkg=git install_recommends=yes state=present
-
-#Create directories for repos
-- name: discern | create discern and ease directories and set permissions
-  file: path={{item}} owner={{discern_user}} group=edx mode=2775 state=directory
-  with_items:
-   - ${discern_dir}
-   - ${ease_dir}
-
-#Grab both repos or update
-- name: discern | git checkout discern repo into discern_dir
-  git: dest={{discern_dir}} repo={{discern_source_repo}} version={{discern_branch}}
-  notify:
-    - discern | restart celery
-    - discern | restart discern
-
-- name: discern | git checkout ease repo into ease_dir
-  git: dest={{ease_dir}} repo={{ease_source_repo}} version={{ease_branch}}
-  notify:
-    - discern | restart celery
-    - discern | restart discern
-
-#Install system packages
-- name: discern | install discern and ease apt packages
-  command: xargs -a {{item}}/apt-packages.txt apt-get install -y
-  with_items:
-    - ${discern_dir}
-    - ${ease_dir}
-
-#Numpy has to be a pre-requirement in order for scipy to build
-- name : install python pre-requirements for discern and ease
-  pip: requirements="{{item}}/pre-requirements.txt" virtualenv="{{venv_dir}}" state=present
-  with_items:
-    - ${discern_dir}
-    - ${ease_dir}
-
-- name : install python requirements for discern and ease
-  pip: requirements="{{item}}/requirements.txt" virtualenv="{{venv_dir}}" state=present
-  with_items:
-    - ${discern_dir}
-    - ${ease_dir}
-
-- name: discern | install ease python package
-  shell: command="{{venv_dir}}/bin/activate; cd {{ease_dir}}; python setup.py install"
-
-#Needed for the ease package to work
-- name: discern | install nltk data using rendered shell script
-  shell: command="{{venv_dir}}/bin/python -m nltk.downloader -d {{nltk_data_dir}} all"
-
-- name: discern | set permissions on nltk data directory
-  file: path={{nltk_data_dir}} owner={{discern_user}} group=edx mode=2775 state=directory
-
-#Run this instead of using the ansible module because the ansible module only support syncdb of these three, and does not
-#support virtualenvs as of this comment
-- name: discern | django syncdb, migrate, and collectstatic for discern
-  shell: ${venv_dir}/bin/python {{discern_dir}}/manage.py {{item}} --noinput --settings={{discern_settings}} --pythonpath={{discern_dir}}
-  with_items:
-    - syncdb
-    - migrate
-    - collectstatic
+- include: deploy.yml
 
-#Have this separate from the other three because it doesn't take the noinput flag
-- name: discern | django update_index for discern
-  shell: ${venv_dir}/bin/python {{discern_dir}}/manage.py update_index --settings={{discern_settings}} --pythonpath={{discern_dir}}
+- name: discern | create a symlink for venv python
+  file: >
+    src="{{ discern_venv_bin }}/python"
+    dest={{ COMMON_BIN_DIR }}/python.discern
+    state=link

playbooks/roles/discern/templates/auth.json.j2

-{{ auth_config | to_nice_json }}
\ No newline at end of file
+{{ discern_auth_config | to_nice_json }}

playbooks/roles/discern/templates/celery.conf.j2

@@ -11,7 +11,7 @@ respawn limit 3 30
 
 env DJANGO_SETTINGS_MODULE={{discern_settings}}
 
-chdir {{discern_dir}}
+chdir {{ discern_code_dir }}
 setuid {{discern_user}}
 
-exec {{venv_dir}}/bin/python {{discern_dir}}/manage.py celeryd --loglevel=info --settings={{discern_settings}} --pythonpath={{discern_dir}} -B --autoscale={{ ansible_processor_cores * 2 }},1
+exec {{ discern_venv_dir }}/bin/python {{ discern_code_dir }}/manage.py celeryd --loglevel=info --settings={{ discern_settings }} --pythonpath={{ discern_code_dir }} -B --autoscale={{ ansible_processor_cores * 2 }},1

playbooks/roles/discern/templates/discern.conf.j2

@@ -14,9 +14,9 @@ env WORKERS={{ ansible_processor_cores * 2 }}
 env PORT={{ discern_gunicorn_port }}
 env ADDRESS={{ discern_gunicorn_host }}
 env LANG=en_US.UTF-8
-env DJANGO_SETTINGS_MODULE={{discern_settings}}
+env DJANGO_SETTINGS_MODULE={{ discern_settings }}
 
-chdir {{discern_dir}}
-setuid {{discern_user}}
+chdir {{ discern_code_dir }}
+setuid {{ discern_user }}
 
-exec {{venv_dir}}/bin/gunicorn --preload -b $ADDRESS:$PORT -w $WORKERS --timeout=30 --pythonpath={{discern_dir}} discern.wsgi
+exec {{ discern_venv_bin }}/gunicorn --preload -b $ADDRESS:$PORT -w $WORKERS --timeout=30 --pythonpath={{ discern_code_dir }} discern.wsgi

playbooks/roles/discern/templates/env.json.j2

-{{ env_config | to_nice_json }}
\ No newline at end of file
+{{ discern_env_config | to_nice_json }}

playbooks/roles/edxapp/defaults/main.yml

@@ -54,7 +54,7 @@ EDXAPP_ANALYTICS_API_KEY:  ''
 EDXAPP_ZENDESK_USER: ''
 EDXAPP_ZENDESK_API_KEY: ''
 EDXAPP_CELERY_USER: 'celery'
-EDXAPP_CELERY_PASSWORD: ''
+EDXAPP_CELERY_PASSWORD: 'celery'
 
 EDXAPP_MITX_FEATURES:
   AUTH_USE_OPENID_PROVIDER: true
@@ -75,7 +75,7 @@ EDXAPP_CELERY_BROKER_HOSTNAME: ''
 EDXAPP_LOGGING_ENV:  'sandbox'
 
 EDXAPP_SYSLOG_SERVER: ''
-EDXAPP_RABBIT_HOSTNAME: 'rabbit.{{ENV_NAME}}.vpc.edx.org'
+EDXAPP_RABBIT_HOSTNAME: 'localhost'
 EDXAPP_XML_MAPPINGS: {}
 
 EDXAPP_LMS_NGINX_PORT: 80
@@ -85,12 +85,68 @@ EDXAPP_CMS_NGINX_PORT: 18010
 EDXAPP_LMS_BASIC_AUTH: False
 EDXAPP_CMS_BASIC_AUTH: False
 EDXAPP_LMS_PREVIEW_BASIC_AUTH: False
-
+EDXAPP_LANG: 'en_US.UTF-8'
 
 #-------- Everything below this line is internal to the role ------------
 
 #Use YAML references (& and *) and hash merge <<: to factor out shared settings
 #see http://atechie.net/2009/07/merging-hashes-in-yaml-conf-files/
+
+edxapp_data_dir: "{{ COMMON_DATA_DIR }}/edxapp"
+edxapp_app_dir: "{{ COMMON_APP_DIR }}/edxapp"
+edxapp_log_dir: "{{ COMMON_LOG_DIR }}/edxapp"
+edxapp_venvs_dir: "{{ edxapp_app_dir }}/venvs"
+edxapp_venv_dir: "{{ edxapp_venvs_dir }}/edxapp"
+edxapp_venv_bin: "{{ edxapp_venv_dir }}/bin"
+edxapp_rbenv_dir: "{{ edxapp_app_dir }}"
+edxapp_rbenv_root: "{{ edxapp_rbenv_dir }}/.rbenv"
+edxapp_rbenv_shims: "{{ edxapp_rbenv_root }}/shims"
+edxapp_rbenv_bin: "{{ edxapp_rbenv_root }}/bin"
+edxapp_gem_root: "{{ edxapp_rbenv_dir }}/.gem"
+edxapp_gem_bin: "{{ edxapp_gem_root }}/bin"
+edxapp_user: edxapp
+edxapp_deploy_path: "{{ edxapp_venv_bin }}:{{ edxapp_code_dir }}/bin:{{ edxapp_rbenv_bin }}:{{ edxapp_rbenv_shims }}:{{ edxapp_gem_bin }}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+edxapp_staticfile_dir: "{{ edxapp_data_dir }}/staticfiles"
+edxapp_course_data_dir: "{{ edxapp_data_dir }}/data"
+edxapp_upload_dir: "{{ edxapp_data_dir }}/uploads"
+edxapp_theme_dir: "{{ edxapp_data_dir }}/themes"
+edxapp_workers:
+  - queue: low
+    service_variant: cms
+    concurrency: 3
+  - queue: default
+    service_variant: cms
+    concurrency: 4
+  - queue: high
+    service_variant: cms
+    concurrency: 1
+  - queue: low
+    service_variant: lms
+    concurrency: 1
+  - queue: default
+    service_variant: lms
+    concurrency: 3
+  - queue: high
+    service_variant: lms
+    concurrency: 4
+
+
+
+
+
+
+# TODO: old style variable syntax is necessary
+# here until ansible 1.4
+edxapp_deploy_environment:
+  LANG: "en_US.UTF-8"
+  NO_PREREQ_INSTALL: 1
+  SKIP_WS_MIGRATIONS: 1
+  RBENV_ROOT: $edxapp_rbenv_root
+  GEM_HOME: $edxapp_gem_root
+  GEM_PATH: $edxapp_gem_root
+  PATH: $edxapp_deploy_path
+
+
 edxapp_generic_auth_config:  &edxapp_generic_auth
   AWS_ACCESS_KEY_ID:  $EDXAPP_AWS_ACCESS_KEY_ID
   AWS_SECRET_ACCESS_KEY: $EDXAPP_AWS_SECRET_ACCESS_KEY
@@ -126,7 +182,7 @@ edxapp_generic_auth_config:  &edxapp_generic_auth
         collection:  'modulestore'
         db:  $EDXAPP_MONGO_DB_NAME
         default_class:  'xmodule.hidden_module.HiddenDescriptor'
-        fs_root:  '/opt/wwc/data'
+        fs_root:  $edxapp_course_data_dir
         host: $EDXAPP_MONGO_HOSTS
         password:  $EDXAPP_MONGO_PASSWORD
         port: $EDXAPP_MONGO_PORT
@@ -161,6 +217,7 @@ edxapp_generic_auth_config:  &edxapp_generic_auth
   CELERY_BROKER_PASSWORD: $EDXAPP_CELERY_PASSWORD
 
 generic_env_config:  &edxapp_generic_env
+  STATIC_ROOT_BASE: $edxapp_staticfile_dir
   LMS_BASE: $EDXAPP_LMS_BASE
   CMS_BASE: $EDXAPP_CMS_BASE
   BOOK_URL:  $EDXAPP_BOOK_URL
@@ -172,7 +229,7 @@ generic_env_config:  &edxapp_generic_env
   WIKI_ENABLED: true
   SYSLOG_SERVER:  $EDXAPP_SYSLOG_SERVER
   SITE_NAME:  $EDXAPP_SITE_NAME
-  LOG_DIR:  "{{ storage_base_dir }}/logs/edx"
+  LOG_DIR:  "{{ COMMON_DATA_DIR }}/logs/edx"
   MEDIA_URL:  $EDXAPP_MEDIA_URL
   ANALYTICS_SERVER_URL:  $EDXAPP_ANALYTICS_SERVER_URL
   FEEDBACK_SUBMISSION_EMAIL: $EDXAPP_FEEDBACK_SUBMISSION_EMAIL
@@ -218,7 +275,7 @@ lms_auth_config:
           xml:
             ENGINE: 'xmodule.modulestore.xml.XMLModuleStore'
             OPTIONS:
-              data_dir: '/opt/wwc/data'
+              data_dir: $edxapp_course_data_dir
               default_class: 'xmodule.hidden_module.HiddenDescriptor'
           default:
             OPTIONS:
@@ -230,7 +287,7 @@ lms_auth_config:
               user: $EDXAPP_MONGO_USER
               password: $EDXAPP_MONGO_PASSWORD
               port: $EDXAPP_MONGO_PORT
-              fs_root: '/opt/wwc/data'
+              fs_root: $edxapp_course_data_dir
             ENGINE: 'xmodule.modulestore.mongo.MongoModuleStore'
             DOC_STORE_CONFIG: *edxapp_generic_default_docstore
 
@@ -250,7 +307,7 @@ lms_preview_env_config:
 
 
 # install dir for the edx-platform repo
-edx_platform_code_dir: "{{ app_base_dir }}/edx-platform"
+edxapp_code_dir: "{{ edxapp_app_dir }}/edx-platform"
 
 
 # gunicorn ports/hosts, these shouldn't need to be overridden
@@ -273,6 +330,7 @@ service_variants_enabled:
   - cms
 
 edxapp_lms_env: 'lms.envs.aws'
+edxapp_cms_env: 'cms.envs.aws'
 
 
 #Number of gunicorn worker processes to spawn, as a multiplier to number of virtual cores
@@ -285,29 +343,30 @@ worker_core_mult:
 #To turn off theming, specify edxapp_theme_name: ''
 #Stanford, for example, uses edxapp_theme_name: 'stanford'
 edxapp_theme_name: ''
-edxapp_theme_source_repo: 'https://{{ GIT_MIRROR }}/Stanford-Online/edx-theme.git'
+edxapp_theme_source_repo: 'https://{{ COMMON_GIT_MIRROR }}/Stanford-Online/edx-theme.git'
 edxapp_theme_version: 'HEAD'
 
 # make this the public URL instead of writable
-edx_platform_repo: "https://{{ GIT_MIRROR }}/edx/edx-platform.git"
+edx_platform_repo: "https://{{ COMMON_GIT_MIRROR }}/edx/edx-platform.git"
 # `edx_platform_commit` can be anything that git recognizes as a commit
 # reference, including a tag, a branch name, or a commit hash
 edx_platform_commit: 'release'
-local_requirements_file:  "{{ edx_platform_code_dir }}/requirements/edx/local.txt"
-pre_requirements_file:    "{{ edx_platform_code_dir }}/requirements/edx/pre.txt"
-post_requirements_file:   "{{ edx_platform_code_dir }}/requirements/edx/post.txt"
-base_requirements_file:   "{{ edx_platform_code_dir }}/requirements/edx/base.txt"
-github_requirements_file: "{{ edx_platform_code_dir }}/requirements/edx/github.txt"
-repo_requirements_file:   "{{ edx_platform_code_dir }}/requirements/edx/repo.txt"
+local_requirements_file:  "{{ edxapp_code_dir }}/requirements/edx/local.txt"
+pre_requirements_file:    "{{ edxapp_code_dir }}/requirements/edx/pre.txt"
+post_requirements_file:   "{{ edxapp_code_dir }}/requirements/edx/post.txt"
+base_requirements_file:   "{{ edxapp_code_dir }}/requirements/edx/base.txt"
+github_requirements_file: "{{ edxapp_code_dir }}/requirements/edx/github.txt"
+repo_requirements_file:   "{{ edxapp_code_dir }}/requirements/edx/repo.txt"
 
-sandbox_base_requirements:  "{{ edx_platform_code_dir }}/requirements/edx-sandbox/base.txt"
-sandbox_local_requirements: "{{ edx_platform_code_dir }}/requirements/edx-sandbox/local.txt"
-sandbox_post_requirements:  "{{ edx_platform_code_dir }}/requirements/edx-sandbox/post.txt"
+sandbox_base_requirements:  "{{ edxapp_code_dir }}/requirements/edx-sandbox/base.txt"
+sandbox_local_requirements: "{{ edxapp_code_dir }}/requirements/edx-sandbox/local.txt"
+sandbox_post_requirements:  "{{ edxapp_code_dir }}/requirements/edx-sandbox/post.txt"
 
 #do we want to install the sandbox requirements into the regular virtual env
 install_sandbox_reqs_into_regular_venv: true
 
-lms_debian_pkgs:
+edxapp_debian_pkgs:
+  - npm
   # for compiling the virtualenv
   # (only needed if wheel files aren't available)
   - build-essential
@@ -336,22 +395,11 @@ lms_debian_pkgs:
   - libgeos-dev
 
 # Ruby Specific Vars
-ruby_base: /opt/www
-rbenv_root: "{{ ruby_base }}/.rbenv"
-ruby_version: "1.9.3-p374"
-gem_home: "{{ ruby_base }}/.gem"
+edxapp_ruby_version: "1.9.3-p374"
 
 # Deploy Specific Vars
-lms_variant: lms
-cms_variant: cms
-
-deploy_environment:
-  LANG: "en_US.UTF-8"
-  NO_PREREQ_INSTALL: 1
-  SKIP_WS_MIGRATIONS: 1
-  RBENV_ROOT: "{{ rbenv_root }}"
-  GEM_HOME: "{{ gem_home }}"
-  PATH: "{{ venv_dir }}/bin:{{ edx_platform_code_dir }}/bin:{{ rbenv_root }}/bin:{{ rbenv_root }}/shims:{{ gem_home }}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+edxapp_lms_variant: lms
+edxapp_cms_variant: cms
 
 # Worker Settings
 worker_django_settings_module: 'aws'

playbooks/roles/edxapp/handlers/main.yml

 ---
-- name: start edxapp
+- name: edxapp | start edxapp
   service: name=edxapp state=started
   tags:
   - lms
@@ -7,7 +7,7 @@
   - cms
   - deploy
 
-- name: stop edxapp
+- name: edxapp | stop edxapp
   service: name=edxapp state=stopped
   tags:
   - lms
@@ -15,7 +15,7 @@
   - cms
   - deploy
 
-- name: restart edxapp
+- name: edxapp | restart edxapp
   service: name=edxapp state=restarted
   tags:
   - lms

playbooks/roles/edxapp/meta/main.yml

+---
+dependencies:
+  - role: rbenv
+    rbenv_user: "{{ edxapp_user }}"
+    rbenv_dir: "{{ edxapp_app_dir }}"
+    rbenv_ruby_version: "{{ edxapp_ruby_version }}"

playbooks/roles/edxapp/tasks/cms.yml

-# requires:
-#  - group_vars/all
-#  - common/tasks/main.yml
----
-- name: create cms application config
-  template: src=cms.env.json.j2 dest=$app_base_dir/cms.env.json mode=640 owner=www-data group=adm
-  tags:
-  - cms-env
-  - cms
-  - update
-  - deploy
-
-- name: create cms auth file
-  template: src=cms.auth.json.j2 dest=$app_base_dir/cms.auth.json mode=640 owner=www-data group=adm
-  tags:
-  - cms-env
-  - cms
-  - update
-  - deploy
-
-- name: Create CMS log target directory
-  file: path={{log_base_dir}}/cms state=directory owner=syslog group=syslog mode=2750
-  tags:
-  - cms 
-  - cms-env
-  - logging
-  - update
-  - deploy
-
-# Creates CMS upstart file
-- include: upstart.yml basename=cms
-  when: celery_worker is not defined
-
-- include: upstart.yml basename=edx-worker-cms
-  when: celery_worker is defined

playbooks/roles/edxapp/tasks/deploy.yml

 # Stop all services.
-- name: stop edxapp services
-  service: name=edxapp state=stopped
+#
+#
+
+# TODO: the supervisor ansible module does not support
+# stopping and starting services by group.
+
+- name: edxapp | stop the edxapp services (supervisor)
+  supervisorctl: >
+    name="edxapp:{{ item }}"
+    supervisorctl_path={{ supervisor_ctl }}
+    config={{ supervisor_cfg }}
+    state=stopped
   when: celery_worker is not defined
+  with_items: service_variants_enabled
   tags:
-  - lms
-  - lms-preview
-  - cms
-  - deploy
+    - deploy
 
-- name: stop edx workers
-  service: name=edx-workers state=stopped
+- name: edxapp | stop the celery worker services (supervisor)
+  supervisorctl: >
+    name="edxapp_worker:{{ item.service_variant }}_{{ item.queue }}_{{ item.concurrency }}"
+    supervisorctl_path={{ supervisor_ctl }}
+    config={{ supervisor_cfg }}
+    state=stopped
   when: celery_worker is defined
+  with_items: edxapp_workers
   tags:
-  - deploy
-
-# update json configs for the application
-
-- include: lms.yml
-  when: "'lms' in service_variants_enabled"
-- include: cms.yml
-  when: "'cms' in service_variants_enabled"
-- include: lms-preview.yml
-  when: "'lms-preview' in service_variants_enabled"
-
+    - deploy
 
 # Do A Checkout
-- name: edxapp | checkout edx-platform repo into {{edx_platform_code_dir}}
-  git: dest={{edx_platform_code_dir}} repo={{edx_platform_repo}} version={{edx_platform_commit}}
+- name: edxapp | checkout edx-platform repo into {{edxapp_code_dir}}
+  git: dest={{edxapp_code_dir}} repo={{edx_platform_repo}} version={{edx_platform_commit}}
   register: edx_platform_checkout
+  sudo_user: "{{ edxapp_user }}"
   tags:
-  - lms
-  - cms
-  - install
   - deploy
 
-- name: git clean after checking out edx-platform
-  shell: cd {{edx_platform_code_dir}} && git clean -xdf
+
+- name: edxapp | git clean after checking out edx-platform
+  shell: cd {{edxapp_code_dir}} && git clean -xdf
   when: edx_platform_checkout.changed
+  sudo_user: "{{ edxapp_user }}"
   tags:
-  - lms
-  - cms
-  - install
   - deploy
 
-# Do Post Checkout Tasks.
-- name: create platform code dir
-  file: path={{edx_platform_code_dir}} state=directory owner=www-data group=www-data mode=755
-  tags:
-  - lms
-  - cms
-  - install
-  - deploy
 
-- name: checkout theme
-  git: dest={{app_base_dir}}/themes/{{edxapp_theme_name}} repo={{edxapp_theme_source_repo}} version={{edxapp_theme_version}}
+- name: edxapp | checkout theme
+  git: dest={{ edxapp_app_dir }}/themes/{{edxapp_theme_name}} repo={{edxapp_theme_source_repo}} version={{edxapp_theme_version}}
   when: edxapp_theme_name != ''
+  sudo_user: "{{ edxapp_user }}"
   tags:
-  - cms
-  - lms-preview
-  - lms
-  - update
-  - deploy
-
-
-# TODO: Check git.py _run_if_changed() to see if the logic there to skip running certain
-# portions of the deploy needs to be incorporated here.
-
-- name: sets permissions on platform code dir and contents
-  file: path={{edx_platform_code_dir}} state=directory owner=www-data group=www-data recurse=yes
-  # Post Checkout tasks will get run as handlers when the {{ edx_platform_code_dir }} is ready.
-  # Look at the handlers/main.yml in this role for a description of the tasks stated below.
-  when: edx_platform_checkout.changed
-  tags:
-  - lms
-  - cms
-  - install
   - deploy
 
 # Ruby plays that need to be run after platform updates.
-- name: gem | gem install bundler
+- name: edxapp | gem install bundler
   shell: >
-    RBENV_ROOT={{ rbenv_root }} GEM_HOME={{ gem_home }} {{ rbenv_root }}/shims/gem install bundle
-      chdir={{ edx_platform_code_dir }}
+    gem install bundle
+      chdir={{ edxapp_code_dir }}
+      executable=/bin/bash
+  environment: "{{ edxapp_deploy_environment }}"
+  sudo_user: "{{ edxapp_user }}"
   tags:
-  - ruby
   - deploy
-  - install
 
-- name: bundle | bundle install
+- name: edxapp | bundle install
   shell: >
-    RBENV_ROOT={{ rbenv_root }} GEM_HOME={{ gem_home }} {{ gem_home }}/bin/bundle install --binstubs
-      chdir={{ edx_platform_code_dir }}
+    bundle install --binstubs
+      chdir={{ edxapp_code_dir }}
+      executable=/bin/bash
+  sudo_user: "{{ edxapp_user }}"
+  environment: "{{ edxapp_deploy_environment }}"
   tags:
-  - ruby
   - deploy
-  - install
 
 # Node play that need to be run after platform updates.
-- name: Install edx-platform npm dependencies
-  shell: npm install chdir={{ edx_platform_code_dir }}
+- name: edxapp | Install edx-platform npm dependencies
+  shell: npm install chdir={{ edxapp_code_dir }}
+  sudo_user: "{{ edxapp_user }}"
+  environment: "{{ edxapp_deploy_environment }}"
   tags:
-  - npm
-  - update
   - deploy
 
 # Python plays that need to be run after platform updates.
 
 # Substitute github mirror in all requirements files
 #
-- name: Updating requirement files for git mirror
+- name: edxapp | Updating requirement files for git mirror
   command: |
-    /bin/sed -i -e 's/github\.com/{{ GIT_MIRROR }}/g' {{ item }}
+    /bin/sed -i -e 's/github\.com/{{ COMMON_GIT_MIRROR }}/g' {{ item }}
   with_items:
     - "{{ pre_requirements_file }}"
     - "{{ post_requirements_file }}"
@@ -120,161 +96,105 @@
     - "{{ sandbox_base_requirements }}"
     - "{{ sandbox_local_requirements }}"
     - "{{ sandbox_post_requirements }}"
+  sudo_user: "{{ edxapp_user }}"
   tags:
-    - lms
-    - cms
-    - install
     - deploy
 
-# Install the python pre requirements into {{ venv_dir }}
-- name : install python pre-requirements
+# Install the python pre requirements into {{ edxapp_venv_dir }}
+- name : edxapp | install python pre-requirements
   pip: >
     requirements="{{pre_requirements_file}}"
-    virtualenv="{{venv_dir}}"
+    virtualenv="{{edxapp_venv_dir}}"
     state=present
-    extra_args="-i {{ PYPI_MIRROR_URL }}"
+    extra_args="-i {{ COMMON_PYPI_MIRROR_URL }}"
+  sudo_user: "{{ edxapp_user }}"
   tags:
-  - lms
-  - cms
-  - install
   - deploy
 
-# Install the python modules into {{ venv_dir }}
-- name : install python base-requirements
+# Install the python modules into {{ edxapp_venv_dir }}
+- name : edxapp | install python base-requirements
   # Need to use shell rather than pip so that we can maintain the context of our current working directory; some
   # requirements are pathed relative to the edx-platform repo. Using the pip from inside the virtual environment implicitly
   # installs everything into that virtual environment.
-  shell: cd {{ edx_platform_code_dir }} && {{ venv_dir }}/bin/pip install -i {{ PYPI_MIRROR_URL }} --exists-action w --use-mirrors -r {{ base_requirements_file }}
+  shell: cd {{ edxapp_code_dir }} && {{ edxapp_venv_dir }}/bin/pip install -i {{ COMMON_PYPI_MIRROR_URL }} --exists-action w --use-mirrors -r {{ base_requirements_file }}
+  sudo_user: "{{ edxapp_user }}"
   tags:
-  - lms
-  - cms
-  - install
   - deploy
 
-# Install the python post requirements into {{ venv_dir }}
-- name : install python post-requirements
+# Install the python post requirements into {{ edxapp_venv_dir }}
+- name : edxapp | install python post-requirements
   pip: >
     requirements="{{post_requirements_file}}"
-    virtualenv="{{venv_dir}}"
+    virtualenv="{{edxapp_venv_dir}}"
     state=present
-    extra_args="-i {{ PYPI_MIRROR_URL }}"
+    extra_args="-i {{ COMMON_PYPI_MIRROR_URL }}"
+  sudo_user: "{{ edxapp_user }}"
   tags:
-  - lms
-  - cms
-  - install
   - deploy
 
-# Install the final python modules into {{ venv_dir }}
-- name : install python post-post requirements
+# Install the final python modules into {{ edxapp_venv_dir }}
+- name : edxapp | install python post-post requirements
   # Need to use shell rather than pip so that we can maintain the context of our current working directory; some
   # requirements are pathed relative to the edx-platform repo. Using the pip from inside the virtual environment implicitly
   # installs everything into that virtual environment.
-  shell: cd {{ edx_platform_code_dir }} && {{ venv_dir }}/bin/pip install -i {{ PYPI_MIRROR_URL }} --exists-action w --use-mirrors -r {{ item }}
+  shell: cd {{ edxapp_code_dir }} && {{ edxapp_venv_dir }}/bin/pip install -i {{ COMMON_PYPI_MIRROR_URL }} --exists-action w --use-mirrors -r {{ item }}
   with_items:
   - "{{ repo_requirements_file }}"
   - "{{ github_requirements_file }}"
   - "{{ local_requirements_file }}"
+  sudo_user: "{{ edxapp_user }}"
   tags:
-  - lms
-  - cms
-  - install
   - deploy
 
 
-# Install the sandbox python modules into {{ venv_dir }}
-- name : install sandbox requirements into regular venv
+# Install the sandbox python modules into {{ edxapp_venv_dir }}
+- name : edxapp | install sandbox requirements into regular venv
   # Need to use shell rather than pip so that we can maintain the context of our current working directory; some
   # requirements are pathed relative to the edx-platform repo. Using the pip from inside the virtual environment implicitly
   # installs everything into that virtual environment.
-  shell: cd {{ edx_platform_code_dir }} && {{ venv_dir }}/bin/pip install -i {{ PYPI_MIRROR_URL }} --exists-action w --use-mirrors -r {{ item }}
+  shell: cd {{ edxapp_code_dir }} && {{ edxapp_venv_dir }}/bin/pip install -i {{ COMMON_PYPI_MIRROR_URL }} --exists-action w --use-mirrors -r {{ item }}
   with_items:
   - "{{ sandbox_base_requirements }}"
   - "{{ sandbox_local_requirements }}"
   - "{{ sandbox_post_requirements }}"
   when: install_sandbox_reqs_into_regular_venv
+  sudo_user: "{{ edxapp_user }}"
   tags:
-  - lms
-  - cms
-  - install
   - deploy
 
-- name: changing group ownership to www-data for everything in the venv (workaround)
-  shell: chgrp -R www-data {{ venv_dir }}
-
 # https://code.launchpad.net/~wligtenberg/django-openid-auth/mysql_fix/+merge/22726
 # This is necessary for when syncdb is run and the django_openid_auth module is installed,
 # not sure if this fix will ever get merged
 # We should never do this in production
-- name: openid workaround - NOT FOR PRODUCTION
-  shell: sed -i -e 's/claimed_id = models.TextField(max_length=2047, unique=True/claimed_id = models.TextField(max_length=2047/' /opt/edx/lib/python2.7/site-packages/django_openid_auth/models.py
+- name: edxapp | openid workaround - NOT FOR PRODUCTION
+  shell: sed -i -e 's/claimed_id = models.TextField(max_length=2047, unique=True/claimed_id = models.TextField(max_length=2047/' {{ edxapp_venv_dir }}/lib/python2.7/site-packages/django_openid_auth/models.py
   when: openid_workaround is defined
   tags:
   - deploy
-  - lms
-  - lms-preview
-  - cms
-  - syncdb
-
-- name: syncdb and migrate
-  shell: sudo -u www-data SERVICE_VARIANT=lms /opt/edx/bin/django-admin.py syncdb --migrate --noinput --settings=lms.envs.aws --pythonpath=/opt/wwc/edx-platform
-  when: migrate_db is defined and migrate_db|lower == "yes"
-  tags:
-  - deploy
-  - lms
-  - lms-preview
-  - cms
-  - syncdb
-
-- name: db migrate
-  shell: sudo -u www-data SERVICE_VARIANT=lms /opt/edx/bin/django-admin.py migrate --noinput --settings=lms.envs.aws --pythonpath=/opt/wwc/edx-platform
-  when: migrate_only is defined and migrate_only|lower == "yes"
-  tags:
-  - deploy
-  - lms
-  - lms-preview
-  - cms
-  - migrate
-
-
-# Gather lms assets using rake if possible
-- name: gather lms static assets with rake
-  shell: executable=/bin/bash chdir={{ edx_platform_code_dir }} SERVICE_VARIANT={{ lms_variant }} rake lms:gather_assets:aws
-  notify:
-  - restart edxapp
-  sudo: yes
-  sudo_user: www-data
-  when: celery_worker is not defined
-  environment: "{{ deploy_environment }}"
-  tags:
-  - lms
-  - lms-preview
-  - deploy
-
-# Gather cms assets using rake if possible
-- name: gather cms static assets with rake
-  shell: executable=/bin/bash chdir={{ edx_platform_code_dir }} SERVICE_VARIANT={{ cms_variant }} rake cms:gather_assets:aws
-  notify:
-  - restart edxapp
-  sudo: yes
-  sudo_user: www-data
-  when: celery_worker is not defined
-  environment: "{{ deploy_environment }}"
-  tags:
-  - cms
-  - deploy
 
+# creates the supervisor jobs for the
+# service variants configured, runs
+# gather_assets and db migrations
+- include: service_variant_config.yml
 
-- name: restart edxapp
-  service: name=edxapp state=restarted
+- name: edxapp | restart the edxapp services (supervisor)
+  supervisorctl: >
+    name="edxapp:{{ item }}"
+    supervisorctl_path={{ supervisor_ctl }}
+    config={{ supervisor_cfg }}
+    state=restarted
   when: celery_worker is not defined
+  with_items: service_variants_enabled
   tags:
-  - lms
-  - lms-preview
-  - cms
-  - deploy
+    - deploy
 
-- name: restart workers
-  service: name=edx-workers state=restarted
+- name: edxapp | restart the celery worker services (supervisor)
+  supervisorctl: >
+    name="edxapp_worker:{{ item.service_variant }}_{{ item.queue }}_{{ item.concurrency }}"
+    supervisorctl_path={{ supervisor_ctl }}
+    config={{ supervisor_cfg }}
+    state=restarted
   when: celery_worker is defined
+  with_items: edxapp_workers
   tags:
-  - deploy
+    - deploy

playbooks/roles/edxapp/tasks/lms-preview.yml

-# requires:
-#  - group_vars/all
-#  - common/tasks/main.yml
----
-- name: create lms application config
-  template: src=lms-preview.env.json.j2 dest=$app_base_dir/lms-preview.env.json mode=640 owner=www-data group=adm
-  tags:
-  - lms-preview
-  - lms-preview-env
-  - deploy
-
-- name: create lms auth file
-  template: src=lms-preview.auth.json.j2 dest=$app_base_dir/lms-preview.auth.json mode=640 owner=www-data group=adm
-  tags:
-  - lms-preview
-  - lms-preview-env
-  - deploy
-
-- name: Create lms-preview log target directory
-  file: path={{log_base_dir}}/lms-preview state=directory owner=syslog group=syslog mode=2750
-  tags:
-  - lms-preview
-  - lms-preview-env
-  - logging
-  - update
-  - deploy
-
-# Creates LMS Preview upstart file
-- include: upstart.yml basename=lms-preview

playbooks/roles/edxapp/tasks/lms.yml

----
-- name: create lms application config
-  template: src=lms.env.json.j2 dest=$app_base_dir/lms.env.json mode=640 owner=www-data group=adm
-  tags:
-  - lms
-  - lms-env
-  - update
-  - deploy
-
-- name: create lms auth file
-  template: src=lms.auth.json.j2 dest=$app_base_dir/lms.auth.json mode=640 owner=www-data group=adm
-  tags:
-  - lms
-  - lms-env
-  - update
-  - deploy
-
-- name: Create lms log target directory
-  file: path={{log_base_dir}}/lms state=directory owner=syslog group=syslog mode=2750
-  tags:
-  - lms
-  - lms-env
-  - logging
-  - update
-  - deploy
-
-# Creates LMS upstart file
-- include: upstart.yml basename=lms
-  when: celery_worker is not defined
-
-- include: upstart.yml basename=edx-worker-lms
-  when: celery_worker is defined

playbooks/roles/edxapp/tasks/main.yml

@@ -2,54 +2,61 @@
 #  - group_vars/all
 #  - common/tasks/main.yml
 ---
-- name: Change permissions on datadir
-  file: path={{ app_base_dir }}/data state=directory owner=www-data group=www-data
-  tags:
-  - cms
-  - lms
-  - lms-env
-  - update
-
-- name: Change owner on staticfiles
-  file: path={{ app_base_dir }}/staticfiles state=directory owner=www-data group=adm
-  tags:
-  - cms
-  - lms
-  - lms-env
-  - update
-
-- name: Create theming directory
-  file: path={{ app_base_dir }}/themes state=directory mode=2775 group=adm owner=www-data
-  tags:
-  - cms
-  - lms
-  - cms-env
-  - lms-env
-  - update
-
-- name: install a bunch of system packages on which LMS and CMS rely
-  apt: pkg={{','.join(lms_debian_pkgs)}} state=present
-  tags:
-  - lms
-  - cms
-  - install
-
-- name: creating edxapp upstart script
-  sudo: True
-  template: src=edxapp.conf.j2 dest=/etc/init/edxapp.conf owner=root group=root
-  when: "celery_worker is not defined"
-  tags:
-  - upstart
-  - gunicorn
-  - update
-
-- name: create edx-workers upstart script
-  template: src=edx-workers.conf.j2 dest=/etc/init/edx-workers.conf owner=root group=root
-  when: "celery_worker is defined"
-  tags:
-  - upstart
-  - update
-
-- include: npm.yml
-- include: ruby.yml
+
+
+- name: edxapp | Install logrotate configuration for tracking file
+  template: dest=/etc/logrotate.d/tracking.log src=edx_logrotate_tracking_log.j2 owner=root group=root mode=644
+
+- name: edxapp | create application user
+  user: >
+    name="{{ edxapp_user }}" home="{{ edxapp_app_dir }}"
+    createhome=no shell=/bin/false
+
+- name: edxapp | create edxapp app dir
+  file: >
+    path="{{ item }}" state=directory
+    owner="{{ edxapp_user }}" group="{{ common_web_group }}"
+  with_items:
+    - "{{ edxapp_app_dir }}"
+    - "{{ edxapp_venvs_dir }}"
+
+- name: edxapp | create edxapp log dir
+  file: >
+    path="{{ edxapp_log_dir }}" state=directory
+    owner="{{ common_log_user }}" group="{{ common_log_user }}"
+
+- name: edxapp | create edxapp writable dirs
+  file: >
+    path="{{ item }}" state=directory
+    owner="{{ edxapp_user }}" group="{{ edxapp_user }}"
+  with_items:
+    - "{{ edxapp_staticfile_dir }}"
+    - "{{ edxapp_theme_dir }}"
+
+
+- name: edxapp | create web-writable edxapp data dirs
+  file: >
+    path="{{ item }}" state=directory
+    owner="{{ common_web_user }}" group="{{ edxapp_user }}"
+    mode="0775"
+  with_items:
+    - "{{ edxapp_course_data_dir }}"
+    - "{{ edxapp_upload_dir }}"
+
+- name: edxapp | install system packages on which LMS and CMS rely
+  apt: pkg={{','.join(edxapp_debian_pkgs)}} state=present
+
+- name: edxapp | create log directories for service variants
+  file: >
+    path={{ edxapp_log_dir }}/{{ item }} state=directory
+    owner={{ common_log_user }} group={{ common_log_user }}
+    mode=0750
+  with_items: service_variants_enabled
+
 - include: deploy.yml
+
+- name: edxapp | create a symlink for venv python
+  file: >
+    src="{{ edxapp_venv_bin }}/python"
+    dest={{ COMMON_BIN_DIR }}/python.edxapp
+    state=link

playbooks/roles/edxapp/tasks/npm.yml

-# requires:
-#   - common/tasks/main.yml
-#   - ruby/tasks/main.yml
----
-- name: Install npm
-  apt: pkg=npm state=present install_recommends=no
-  tags:
-  - npm
-  - install

playbooks/roles/edxapp/tasks/ruby.yml

-#
-#cribbed from https://github.com/mmoya/ansible-playbooks/blob/master/rbenv/main.yml
-- name: Create 'www' user (replicating historical environment)
-  user: name=www state=present
-  tags:
-  - ruby
-  - update
-
-- name: Create ruby base
-  file: path=$ruby_base state=directory owner=www group=www
-  tags:
-  - ruby
-  - update
-
-- name: rbenv | install build depends
-  apt: pkg=$item state=present install_recommends=no
-  with_items:
-    - build-essential
-    - git
-    - libcurl4-openssl-dev
-    - libmysqlclient-dev
-    - libreadline-dev
-    - libssl-dev
-    - libxml2-dev
-    - libxslt1-dev
-    - zlib1g-dev
-  tags:
-  - ruby
-  - install
-
-- name: rbenv | update rbenv repo
-  git: repo=https://github.com/sstephenson/rbenv.git dest=$rbenv_root version=v0.4.0
-  tags:
-  - ruby
-  - install
-
-- name: rbenv | add rbenv to path
-  file: path=/usr/local/bin/rbenv src=${rbenv_root}/bin/rbenv state=link
-  tags:
-  - ruby
-  - update
-
-- name: rbenv | add rbenv initialization to profile
-  template: src=rbenv.sh.j2 dest=/etc/profile.d/rbenv.sh owner=root group=root mode=0755
-  tags:
-  - ruby
-  - update
-
-- name: rbenv | check ruby-build installed
-  command: test -x /usr/local/bin/ruby-build
-  register: rbuild_present
-  ignore_errors: yes
-  tags:
-  - ruby
-  - install
-
-- name: rbenv | create temporary directory
-  command: mktemp -d
-  register: tempdir
-  when: rbuild_present|failed
-  tags:
-  - ruby
-  - install
-
-- name: rbenv | clone ruby-build repo
-  git: repo=https://github.com/sstephenson/ruby-build.git dest=${tempdir.stdout}/ruby-build
-  when: rbuild_present|failed
-  tags:
-  - ruby
-  - install
-
-- name: rbenv | install ruby-build
-  command: ./install.sh chdir=${tempdir.stdout}/ruby-build
-  when: rbuild_present|failed
-  tags:
-  - ruby
-  - install
-
-- name: rbenv | remove temporary directory
-  file: path=${tempdir.stdout} state=absent
-  when: rbuild_present|failed
-  tags:
-  - ruby
-  - install
-
-- name: rbenv | check ruby $ruby_version installed
-  shell: RBENV_ROOT=${rbenv_root} rbenv versions | grep $ruby_version
-  register: ruby_installed
-  ignore_errors: yes
-  tags:
-  - ruby
-  - install
-
-- name: rbenv | install ruby $ruby_version
-  shell: RBENV_ROOT=${rbenv_root} rbenv install $ruby_version
-  when: ruby_installed|failed
-  tags:
-  - ruby
-  - install
-
-- name: rbenv | set global ruby $ruby_version
-  shell: RBENV_ROOT=${rbenv_root} rbenv global $ruby_version
-  when: ruby_installed|failed
-  tags:
-  - ruby
-  - install
-
-- name: rbenv | rehash
-  shell: RBENV_ROOT=${rbenv_root} rbenv rehash
-  when: ruby_installed|failed
-  tags:
-  - ruby
-  - install
-

playbooks/roles/edxapp/tasks/service_variant_config.yml

+- name: "create {{ item }} application config"
+  template: >
+    src={{ item }}.env.json.j2
+    dest={{ edxapp_app_dir }}/{{ item }}.env.json
+  sudo_user: "{{ edxapp_user }}"
+  with_items: service_variants_enabled
+  tags:
+  - deploy
+
+- name: "create {{ item }} auth file"
+  template: >
+    src={{ item }}.auth.json.j2
+    dest={{ edxapp_app_dir }}/{{ item }}.auth.json
+  sudo_user: "{{ edxapp_user }}"
+  with_items: service_variants_enabled
+  tags:
+  - deploy
+
+# write the supervisor script for {{ service_variant }}
+# for non-celery servers
+
+- name: "writing {{ item }} supervisor script"
+  template: >
+    src={{ item }}.conf.j2 dest={{ supervisor_cfg_dir }}/{{ item }}.conf
+    owner={{ supervisor_user }} group={{ common_web_user }} mode=0644
+  with_items: service_variants_enabled
+  when: celery_worker is not defined
+  notify: supervisor | reload supervisor
+  tags:
+  - deploy
+
+- name: "writing edxapp supervisor script"
+  template: >
+    src=edxapp.conf.j2 dest={{ supervisor_cfg_dir }}/edxapp.conf
+    owner={{ supervisor_user }} group={{ common_web_user }} mode=0644
+  when: celery_worker is not defined
+  tags:
+  - deploy
+
+
+# write the supervisor script for celery workers
+
+- name: writing celery worker supervisor script
+  template: >
+    src=workers.conf.j2 dest={{ supervisor_cfg_dir }}/workers.conf
+    owner={{ supervisor_user }} group={{ common_web_user }} mode=0644
+  when: celery_worker is defined
+  tags:
+  - deploy
+
+- name: supervisor | reload supervisor
+  shell: "{{ supervisor_ctl }} -c {{ supervisor_cfg }} reload"
+
+# Gather assets using rake if possible
+
+- name: edxapp | gather {{ item }} static assets with rake
+  shell: >
+    command=SERVICE_VARIANT={{ item }} rake {{ item }}:gather_assets:aws
+    executable=/bin/bash
+    chdir={{ edxapp_code_dir }}
+  sudo_user: "{{ edxapp_user }}"
+  when: celery_worker is not defined
+  with_items: service_variants_enabled
+  environment: "{{ edxapp_deploy_environment }}"
+  tags:
+  - deploy
+
+
+- name: edxapp | syncdb and migrate
+  shell: sudo -u {{ edxapp_user }} SERVICE_VARIANT=lms {{ edxapp_venv_bin}}/django-admin.py syncdb --migrate --noinput --settings=lms.envs.aws --pythonpath={{ edxapp_code_dir }}
+  when: migrate_db is defined and migrate_db|lower == "yes"
+  tags:
+  - deploy
+
+- name: edxapp | db migrate
+  shell: sudo -u {{ edxapp_user }} SERVICE_VARIANT=lms {{ edxapp_venv_bin }}/django-admin.py migrate --noinput --settings=lms.envs.aws --pythonpath={{ edxapp_code_dir }}
+  when: migrate_only is defined and migrate_only|lower == "yes"
+  tags:
+  - deploy
+
+

playbooks/roles/edxapp/tasks/upstart.yml

-# write the gunicorn upstart script for {{ service_variant }}
-- name: writing {{ basename }} upstart script to /etc/init
-  sudo: True
-  template: src={{ basename }}.conf.j2 dest=/etc/init/{{ basename }}.conf owner=root group=root
-  tags:
-  - upstart
-  - gunicorn
-  - update
-  - deploy

playbooks/roles/edxapp/templates/cms.conf.j2

-# gunicorn
-# Templated and placed by ansible from jinja2 source
-description "cms gunicorn"
-# CMS Upstart Script
-start on started edxapp
-stop on stopped edxapp
- 
-respawn
-respawn limit 3 30
- 
-env PID=/var/tmp/cms.pid
-#env NEW_RELIC_CONFIG_FILE={{app_base_dir}}/newrelic.ini
-#env NEWRELIC={{venv_dir}}/bin/newrelic-admin
+[program:cms]
 {% if ansible_processor|length > 0 %}
-env WORKERS={{ ansible_processor|length * worker_core_mult.cms }}
+command={{ edxapp_venv_dir }}/bin/gunicorn --preload -b {{ edxapp_cms_gunicorn_host }}:{{ edxapp_cms_gunicorn_port }} -w {{ ansible_processor|length * worker_core_mult.cms }} --timeout=300 --pythonpath={{ edxapp_code_dir }} cms.wsgi
 {% else %}
-env WORKERS={{ worker_core_mult.cms }}
+command={{ edxapp_venv_dir }}/bin/gunicorn --preload -b {{ edxapp_cms_gunicorn_host }}:{{ edxapp_cms_gunicorn_port }} -w {{ worker_core_mult.cms }} --timeout=300 --pythonpath={{ edxapp_code_dir }} cms.wsgi
 {% endif %}
-env PORT={{edxapp_cms_gunicorn_port}}
-env ADDRESS={{edxapp_cms_gunicorn_host}}
-env LANG=en_US.UTF-8
-env DJANGO_SETTINGS_MODULE=cms.envs.aws
-env SERVICE_VARIANT="cms"
- 
-chdir {{edx_platform_code_dir}}
-setuid www-data
 
-exec {{venv_dir}}/bin/gunicorn_django -b $ADDRESS:$PORT -w $WORKERS --timeout=300 --pythonpath={{edx_platform_code_dir}} --settings=cms.envs.aws
+user={{ common_web_user }}
+directory={{ edxapp_code_dir }}
+environment=PORT={{edxapp_cms_gunicorn_port}},ADDRESS={{edxapp_cms_gunicorn_host}},LANG={{ EDXAPP_LANG }},DJANGO_SETTINGS_MODULE={{ edxapp_cms_env }},SERVICE_VARIANT="cms"
+stdout_logfile={{ supervisor_log_dir }}/%(program_name)-stdout.log
+stderr_logfile={{ supervisor_log_dir }}/%(program_name)-stderr.log

playbooks/roles/edxapp/templates/edx-worker-cms.conf.j2

-# gunicorn
-# Templated and placed by ansible from jinja2 source
-# CMS Celery Worker Upstart Script
-description "cms celery worker"
-
-stop on stopping edx-workers
-
-respawn
-
-instance edx.${SERVICE_VARIANT}.core.${QUEUE}
-
-#env NEW_RELIC_CONFIG_FILE=/opt/wwc/newrelic.ini
-#env NEWRELIC={{venv_dir}}/bin/newrelic-admin
-env CONCURRENCY=${CONCURRENCY}
-env LOGLEVEL=info
-env DJANGO_SETTINGS_MODULE={{worker_django_settings_module}}
-env PYTHONPATH={{edx_platform_code_dir}}
-env SERVICE_VARIANT=${SERVICE_VARIANT}
-
-setuid www-data
-
-chdir {{edx_platform_code_dir}}
-
-exec {{venv_dir}}/bin/python {{edx_platform_code_dir}}/manage.py $SERVICE_VARIANT --settings=$DJANGO_SETTINGS_MODULE celery worker --loglevel=$LOGLEVEL --queues=edx.${SERVICE_VARIANT}.core.${QUEUE} --hostname=edx.${SERVICE_VARIANT}.core.${QUEUE}.`hostname` --concurrency=$CONCURRENCY

playbooks/roles/edxapp/templates/edx-worker-lms.conf.j2

-# gunicorn
-# Templated and placed by ansible from jinja2 source
-# CMS Celery Worker Upstart Script
-description "lms celery worker"
-
-stop on stopping edx-workers
-
-respawn
-
-instance edx.${SERVICE_VARIANT}.core.${QUEUE}
-
-#env NEW_RELIC_CONFIG_FILE=/opt/wwc/newrelic.ini
-#env NEWRELIC={{venv_dir}}/bin/newrelic-admin
-env CONCURRENCY=${CONCURRENCY}
-env LOGLEVEL=info
-env DJANGO_SETTINGS_MODULE={{worker_django_settings_module}}
-env PYTHONPATH={{edx_platform_code_dir}}
-env SERVICE_VARIANT=${SERVICE_VARIANT}
-
-setuid www-data
-
-chdir {{edx_platform_code_dir}}
-
-exec {{venv_dir}}/bin/python {{edx_platform_code_dir}}/manage.py lms --service-variant=$SERVICE_VARIANT --settings=$DJANGO_SETTINGS_MODULE celery worker --loglevel=$LOGLEVEL --queues=edx.${SERVICE_VARIANT}.core.${QUEUE} --hostname=edx.${SERVICE_VARIANT}.core.${QUEUE}.`hostname` --concurrency=$CONCURRENCY

playbooks/roles/edxapp/templates/edx-workers.conf.j2

-# edx workers
-# managed by puppet or ansible
-
-description "start edX app workers"
-
-start on runlevel [2345]
-stop on runlevel [!2345]
-
-pre-start script
-
-   {% if 'cms' in service_variants_enabled %}
-   start edx-worker-cms QUEUE=low CONCURRENCY=1 SERVICE_VARIANT=cms
-   start edx-worker-cms QUEUE=default CONCURRENCY=3 SERVICE_VARIANT=cms
-   start edx-worker-cms QUEUE=high CONCURRENCY=4 SERVICE_VARIANT=cms
-   {% endif %}
-
-   {% if 'lms' in service_variants_enabled %}
-   start edx-worker-lms QUEUE=low CONCURRENCY=1 SERVICE_VARIANT=lms
-   start edx-worker-lms QUEUE=default CONCURRENCY=3 SERVICE_VARIANT=lms
-   start edx-worker-lms QUEUE=high CONCURRENCY=4 SERVICE_VARIANT=lms
-   {% endif %}
-
-end script

playbooks/roles/common/templates/edx_logrotate_tracking_log.j2 → playbooks/roles/edxapp/templates/edx_logrotate_tracking_log.j2

-{{log_base_dir}}/tracking.log {
+{{ COMMON_LOG_DIR }}/tracking.log {
   create
   compress
   delaycompress

playbooks/roles/edxapp/templates/edxapp.conf.j2

-#/etc/init/edxapp.conf
-
-description "Starts and stops multiple edX services, e.g., lms, cms, etc., installed in a stacked configuration."
-
-start on runlevel [2345]
-stop on runlevel [!2345]
-
-##
-## Each awaited service is responsible for ensuring that it is ready
-## for service when it returns.
-##
-pre-start script
-
-{% if 'lms' in service_variants_enabled %}
-if [ -e /etc/init/lms.conf ]; then
-  start wait-for-state WAIT_FOR=lms WAITER=$UPSTART_JOB
-fi
-{% endif %}
-
-{% if 'lms-preview' in service_variants_enabled %}
-if [ -e /etc/init/lms-preview.conf ]; then
-  start wait-for-state WAIT_FOR=lms-preview WAITER=$UPSTART_JOB
-fi
-{% endif %}
-
-{% if 'cms' in service_variants_enabled %}
-if [ -e /etc/init/cms.conf ]; then
-  start wait-for-state WAIT_FOR=cms WAITER=$UPSTART_JOB
-fi
-{% endif %}
-
-end script
-
-script
-  # Noop process for other edX components to take their
-  # marching orders from.  In the edxapp deployment, 
-  # lms, cms, etc. will listen for this process to start
-  # and stop and follow suit.
-  while true
-    do
-      logger -t $0 "edX App Shell Daemon is running..."
-      sleep 600
-    done
-end script
-
-pre-stop script
-
-{% if 'lms' in service_variants_enabled %}
-if [ -e /etc/init/lms.conf ]; then
-  start wait-for-state WAIT_FOR=lms WAITER=$UPSTART_JOB TARGET_GOAL="stop"
-fi
-{% endif %}
-
-{% if 'lms-preview' in service_variants_enabled %}
-if [ -e /etc/init/lms-preview.conf ]; then
-  start wait-for-state WAIT_FOR=lms-preview WAITER=$UPSTART_JOB TARGET_GOAL="stop"
-fi
-{% endif %}
-
-{% if 'cms' in service_variants_enabled %}
-if [ -e /etc/init/cms.conf ]; then
-  start wait-for-state WAIT_FOR=cms WAITER=$UPSTART_JOB TARGET_GOAL="stop"
-fi
-{% endif %}
-
-end script
-
+[group:edxapp]
+programs={{ ",".join(service_variants_enabled) }}

playbooks/roles/edxapp/templates/lms-preview.conf.j2

@@ -10,8 +10,6 @@ respawn
 respawn limit 3 30
 
 env PID=/var/tmp/lms.pid
-#env NEW_RELIC_CONFIG_FILE={{app_base_dir}}/newrelic.ini
-#env NEWRELIC={{venv_dir}}/bin/newrelic-admin
 {% if ansible_processor|length > 0 %}
 env WORKERS={{ ansible_processor|length * worker_core_mult.lms_preview }}
 {% else %}
@@ -23,10 +21,10 @@ env LANG=en_US.UTF-8
 env DJANGO_SETTINGS_MODULE=lms.envs.aws
 env SERVICE_VARIANT="lms-preview"
   
-chdir {{edx_platform_code_dir}}
+chdir {{edxapp_code_dir}}
 setuid www-data
 
-exec {{venv_dir}}/bin/gunicorn --preload -b $ADDRESS:$PORT -w $WORKERS --timeout=300 --pythonpath={{edx_platform_code_dir}} lms.wsgi
+exec {{edxapp_venv_dir}}/bin/gunicorn --preload -b $ADDRESS:$PORT -w $WORKERS --timeout=300 --pythonpath={{edxapp_code_dir}} lms.wsgi
 
 post-start script
   while true

playbooks/roles/edxapp/templates/lms.conf.j2

-# gunicorn
-# Templated and placed by ansible from jinja2 source
-start on started edxapp
-stop on stopped edxapp
-
-respawn
-respawn limit 3 30
-
-env PID=/var/tmp/lms.pid
-#env NEW_RELIC_CONFIG_FILE={{app_base_dir}}/newrelic.ini
-#env NEWRELIC={{venv_dir}}/bin/newrelic-admin
+[program:lms]
 {% if ansible_processor|length > 0 %}
-env WORKERS={{ ansible_processor|length * worker_core_mult.lms }}
+command={{ edxapp_venv_dir }}/bin/gunicorn --preload -b {{ edxapp_lms_gunicorn_host }}:{{ edxapp_lms_gunicorn_port }} -w {{ ansible_processor|length * worker_core_mult.lms }} --timeout=300 --pythonpath={{ edxapp_code_dir }} lms.wsgi
 {% else %}
-env WORKERS={{ worker_core_mult.lms }}
+command={{ edxapp_venv_dir }}/bin/gunicorn --preload -b {{ edxapp_lms_gunicorn_host }}:{{ edxapp_lms_gunicorn_port }} -w {{ worker_core_mult.lms }} --timeout=300 --pythonpath={{ edxapp_code_dir }} lms.wsgi
 {% endif %}
-env PORT={{edxapp_lms_gunicorn_port}}
-env ADDRESS={{edxapp_lms_gunicorn_host}}
-env LANG=en_US.UTF-8
-env DJANGO_SETTINGS_MODULE={{ edxapp_lms_env }}
-env SERVICE_VARIANT="lms"
-
-chdir {{edx_platform_code_dir}}
-setuid www-data
-
-exec {{venv_dir}}/bin/gunicorn --preload -b $ADDRESS:$PORT -w $WORKERS --timeout=300 --pythonpath={{edx_platform_code_dir}} lms.wsgi
 
-post-start script
-  while true
-  do
-    if $(curl -s -i localhost:$PORT/heartbeat | egrep -q '200 OK'); then
-      break;
-    else
-      sleep 1;
-    fi
-  done
-end script
+user={{ common_web_user }}
+directory={{ edxapp_code_dir }}
+environment=PORT={{edxapp_lms_gunicorn_port}},ADDRESS={{edxapp_lms_gunicorn_host}},LANG={{ EDXAPP_LANG }},DJANGO_SETTINGS_MODULE={{ edxapp_lms_env }},SERVICE_VARIANT="lms"
+stdout_logfile={{ supervisor_log_dir }}/%(program_name)-stdout.log
+stderr_logfile={{ supervisor_log_dir }}/%(program_name)-stderr.log

playbooks/roles/edxapp/templates/rbenv.sh.j2

-export RBENV_ROOT="{{ rbenv_root }}"
-export GEM_HOME="{{ gem_home }}"
-export PATH="{{ gem_home }}/bin:$PATH"
-eval "$(rbenv init -)"

playbooks/roles/edxapp/templates/workers.conf.j2

+{% for w in edxapp_workers %}
+[program:{{ w.service_variant }}_{{ w.queue }}_{{ w.concurrency }}]
+
+environment=CONCURRENCY={{ w.concurrency }},LOGLEVEL=info,DJANGO_SETTINGS_MODULE=aws,PYTHONPATH={{ edxapp_code_dir }},SERVICE_VARIANT={{ w.service_variant }}
+user={{ common_web_user }}
+directory={{ edxapp_code_dir }}
+stdout_logfile={{ supervisor_log_dir }}/%(program_name)-stdout.log
+stderr_logfile={{ supervisor_log_dir }}/%(program_name)-stderr.log
+
+command={{ edxapp_venv_bin}}/python {{ edxapp_code_dir }}/manage.py {{ w.service_variant }} --settings=aws celery worker --loglevel=info --queues=edx.{{ w.service_variant }}.core.{{ w.queue }} --hostname=edx.{{ w.service_variant }}.core.{{ w.queue }}.`hostname` --concurrency={{ w.concurrency }}
+
+{% endfor %}
+
+[group:edxapp_worker]
+programs={%- for w in edxapp_workers %}{{ w.service_variant }}_{{ w.queue }}_{{ w.concurrency }}{%- if not loop.last %},{%- endif %}{%- endfor %}

playbooks/roles/edxlocal/tasks/main.yml

@@ -10,7 +10,7 @@
 #  http://downloads.mysql.com/archives/mysql-5.1/mysql-5.1.62.tar.gz
 #
 ---
-- name: edxlocal| install packages needed for single server 
+- name: edxlocal| install packages needed for single server
   apt: pkg={{','.join(edxlocal_debian_pkgs)}} install_recommends=yes state=present
 
 - name: edxlocal | create a database for edxapp
@@ -31,5 +31,12 @@
     state=present
     encoding=utf8
 
+- name: edxlocal | create a database for discern
+  mysql_db: >
+    db=discern
+    state=present
+    encoding=utf8
+
+
 - name: edxlocal | install memcached
   apt: pkg=memcached state=present

playbooks/roles/forum/defaults/main.yml

 ---
+forum_app_dir: "{{ COMMON_APP_DIR }}/forum"
+forum_code_dir: "{{ forum_app_dir }}/cs_comments_service"
+forum_data_dir: "{{ COMMON_DATA_DIR }}/forum"
+forum_rbenv_dir: "{{ forum_app_dir }}"
+forum_rbenv_root: "{{ forum_app_dir }}/.rbenv"
+forum_rbenv_shims: "{{ forum_rbenv_root }}/shims"
+forum_rbenv_bin: "{{ forum_rbenv_root }}/bin"
+forum_supervisor_wrapper: "{{ forum_app_dir }}/forum-supervisor.sh"
+forum_gem_root: "{{ forum_rbenv_dir }}/.gem"
+forum_gem_bin: "{{ forum_gem_root }}/bin"
+forum_path: "{{ forum_code_dir }}/bin:{{ forum_rbenv_bin }}:{{ forum_rbenv_shims }}:{{ forum_gem_bin }}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+forum_environment:
+  RBENV_ROOT: "{{ forum_rbenv_root }}"
+  GEM_HOME: "{{ forum_gem_root }}"
+  GEM_PATH: "{{ forum_gem_root }}"
+  PATH: "{{ forum_path }}"
+  MONGOHQ_USER: "{{ forum_mongo_user }}"
+  MONGOHQ_PASS: "{{ forum_mongo_password }}"
+  RACK_ENV: "{{ forum_rack_env }}"
+  SINATRA_ENV: "{{ forum_sinatra_env }}"
+  API_KEY: "{{ forum_api_key }}"
+  SEARCH_SERVER: "{{ forum_elasticsearch_url }}"
+  MONGOHQ_URL: "{{ forum_mongo_url }}"
+  HOME: "{{ forum_app_dir }}"
 
 forum_user: "forum"
-forum_home: "/opt/wwc/forum"
 forum_ruby_version: "1.9.3-p448"
-forum_code_dir: "{{ forum_home }}/cs_comments_service"
 forum_source_repo: "https://github.com/edx/cs_comments_service.git"
 forum_version: "HEAD"
 forum_mongo_user: "cs_comments_service"

playbooks/roles/forum/handlers/main.yml

 ---
-
 - name: forum | restart the forum service
-  service: name=cs_comments_service state=restarted
+  supervisorctl: >
+    name=forum
+    supervisorctl_path={{ supervisor_ctl }}
+    config={{ supervisor_cfg }}
+    state=restarted

playbooks/roles/forum/meta/main.yml

+---
+dependencies:
+  - role: rbenv
+    # TODO: setting the rbenv ownership to
+    # the common_web_user is a workaround
+    rbenv_user: "{{ common_web_user }}"
+    rbenv_dir: "{{ forum_app_dir }}"
+    rbenv_ruby_version: "{{ forum_ruby_version }}"

playbooks/roles/forum/tasks/deploy.yml

 ---
 
 - name: forum | stop the forum service
-  service: name=cs_comments_service state=stopped
+  supervisorctl: >
+    name=forum
+    supervisorctl_path={{ supervisor_ctl }}
+    config={{ supervisor_cfg }}
+    state=stopped
+  tags:
+  - deploy
+
+- name: forum | create the supervisor wrapper
+  template: >
+    src={{ forum_supervisor_wrapper|basename }}.j2
+    dest={{ forum_supervisor_wrapper }}
+    mode=0755
+  sudo_user: "{{ forum_user }}"
   tags:
   - deploy
 
 - name:  forum | git checkout forum repo into {{ forum_code_dir }}
   git: dest={{ forum_code_dir }} repo={{ forum_source_repo }} version={{ forum_version }}
-  sudo: yes
   sudo_user: "{{ forum_user }}"
-  notify: 
-    - forum | restart the forum service
   tags:
-  - forum
   - deploy
 
+# TODO: This is done as the common_web_user
+# since the process owner needs write access
+# to the rbenv
 - name: forum | install comments service bundle
-  shell: executable=/bin/bash {{ forum_home }}/.rbenv/shims/bundle install chdir={{ forum_code_dir }}
-  sudo: yes
-  sudo_user: "{{ forum_user }}"
+  shell: bundle install chdir={{ forum_code_dir }}
+  sudo_user: "{{ common_web_user }}"
+  environment: "{{ forum_environment }}"
   tags:
-  - forum
   - deploy
 
+- name: forum | create the supervisor config
+  template: >
+    src=forum.conf.j2 dest={{ supervisor_cfg_dir }}/forum.conf
+    owner={{ common_web_user }} group={{ supervisor_user }}
+    mode=0644
+  register: forum_supervisor
+
 - name: forum | restart the forum service
-  service: name=cs_comments_service state=restarted
-  tags:
-  - deploy
+  supervisorctl: >
+    name=forum
+    supervisorctl_path={{ supervisor_ctl }}
+    config={{ supervisor_cfg }}
+    state=restarted

playbooks/roles/forum/tasks/main.yml

@@ -8,65 +8,45 @@
 #   * elasticsearch
 #   * oraclejdk
 #   * rbenv
-# 
-# 
+#
+#
 # Example play:
 #   roles:
 #   - common
 #   - oraclejdk
-#   - elasticsearch 
+#   - elasticsearch
 #   - role: rbenv
 #     rbenv_user: "{{ forum_user }}"
-#     rbenv_user_home: "{{ forum_rbenv_dir }}"
+#     rbenv_dir: "{{ forum_rbenv_dir }}"
 #     rbenv_ruby_version: "{{ forum_ruby_version }}"
 #   - forum
 
-- name: forum | setup the forum env
-  template: src=forum_env.j2 dest={{ forum_home }}/forum_env owner={{ forum_user }} group={{ forum_user }}
-  notify: 
-    - forum | restart the forum service
-  tags:
-  - forum
-  - update
-
-- name: forum | ensure .bashrc exists
-  shell: touch {{ forum_home }}/.bashrc
-  sudo: true  
-  sudo_user: "{{ forum_user }}"
-  tags:
-  - forum
-  - update
+- name: forum | create application user
+  user: >
+    name="{{ forum_user }}" home="{{ forum_app_dir }}"
+    createhome=no
+    shell=/bin/false
 
-- name: forum | add source of ruby_env to .bashrc
-  lineinfile:
-    dest="{{ forum_home }}/.bashrc"
-    regexp='. {{ forum_home }}/forum_env'    
-    line='. {{ forum_home }}/forum_env'
-  notify: 
-    - forum | restart the forum service
-  tags:
-  - forum
-  - update
+- name: forum | create forum app dir
+  file: >
+    path="{{ forum_app_dir }}" state=directory
+    owner="{{ forum_user }}" group="{{ common_web_group }}"
 
-
-- name: forum | copy cs_comments_service SysVunit script
-  template: src=cs_comments_service.j2 dest=/etc/init.d/cs_comments_service owner=root group=root mode=750
-  notify: 
+- name: forum | setup the forum env
+  template: >
+    src=forum_env.j2 dest={{ forum_app_dir }}/forum_env
+    owner={{ forum_user }}  group={{ common_web_user }}
+    mode=0644
+  notify:
     - forum | restart the forum service
-  tags:
-  - forum
-  - install
-  when: ansible_distribution == 'Debian'
 
-
-- name: forum | copy cs_comments_service upstart script
-  template: src=cs_comments_service.conf.j2 dest=/etc/init/cs_comments_service.conf owner=root group=root mode=644
-  notify: 
-    - forum | restart the forum service
-  tags:
-  - forum
-  - install
-  when: ansible_distribution == 'Ubuntu'
+- name: forum | create the supervisor config
+  template: >
+    src=forum.conf.j2 dest={{ supervisor_cfg_dir }}/forum.conf
+    owner={{ common_web_user }} group={{ supervisor_user }}
+    mode=0644
+  register: forum_supervisor
 
 - include: deploy.yml
 - include: test.yml
+

playbooks/roles/forum/templates/cs_comments_service.conf.j2

@@ -10,7 +10,7 @@ env PID=/var/tmp/comments_service.pid
 chdir {{ forum_code_dir }}
 
 script
-  . {{forum_home}}/forum_env
-  {{forum_home}}/.rbenv/shims/ruby app.rb
+  . {{forum_app_dir}}/forum_env
+  {{forum_app_dir}}/.rbenv/shims/ruby app.rb
 
-end script
\ No newline at end of file
+end script

playbooks/roles/forum/templates/cs_comments_service.j2

@@ -15,7 +15,7 @@ USER={{ forum_user }}
 NAME="cs_comments_service"
 RETVAL=0
 APP_ROOT={{ forum_code_dir }}
-DAEMON={{ forum_home }}/.rbenv/shims/ruby
+DAEMON={{ forum_app_dir }}/.rbenv/shims/ruby
 PID=/var/tmp/cs_comments_service.pid
 OPTIONS="app.rb"
 

playbooks/roles/forum/templates/forum-supervisor.sh.j2

+#!/bin/bash
+source {{ forum_app_dir }}/forum_env
+cd {{ forum_code_dir }}
+{{ forum_rbenv_shims }}/ruby app.rb

playbooks/roles/forum/templates/forum.conf.j2

+[program:forum]
+command={{ forum_supervisor_wrapper }}
+priority=999
+user={{ common_web_user }}
+startsecs=10
+stdout_logfile={{ supervisor_log_dir }}/%(program_name)-stdout.log
+stderr_logfile={{ supervisor_log_dir }}/%(program_name)-stderr.log
+killasgroup=true
+stopasgroup=true

playbooks/roles/forum/templates/forum_env.j2

 # {{ ansible_managed }}
-
-#
-# This file is sourced in .bashrc.
-# The environment variables are used by the cs_comments_service
-# to configure itself at start-time.
-#
-export MONGOHQ_USER="{{ forum_mongo_user }}"
-export MONGOHQ_PASS="{{ forum_mongo_password }}"
-export RACK_ENV="{{ forum_rack_env }}"
-export SINATRA_ENV="{{ forum_sinatra_env }}"
-export API_KEY="{{ forum_api_key }}"
-export SEARCH_SERVER="{{ forum_elasticsearch_url }}"
-export MONGOHQ_URL="{{ forum_mongo_url }}"
\ No newline at end of file
+{% for name,value in forum_environment.items() %}
+{%- if value %}
+export {{ name }}="{{ value }}"
+{%- endif %}                 
+{% endfor %}
+eval "$(rbenv init -)"

playbooks/roles/gh_users/tasks/main.yml

 ---
 
 # gh_users
-# 
+#
 # Creates OS accounts for users based on their github credential.
 # Takes a list gh_users as a parameter which is a list of users
 #
 # roles:
 #   - role: gh_users
 #     gh_users:
-#      - user: github_admin_username
-#        groups: 
-#        - adm
-#      - user: another_github_username
-#        groups: !!null
-         
+#      - joe
+#      - mark
+
 
 - fail: gh_users list must be defined for this parameterized role
   when: not gh_users
 
-- name: gh_users | create local user for github user
+- name: gh_users | create gh group
+  group: name=gh state=present
+
+# TODO: give limited sudo access to this group
+- name: gh_users | grant full sudo access to gh group
+  copy: >
+    content="%adm ALL=(ALL) NOPASSWD:ALL"
+    dest=/etc/sudoers.d/gh owner=root group=root
+    mode=0440 validate='visudo -cf %s'
+
+- name: gh_users | create github users
   user:
-    name={{ item.user }}
-    groups={{ ",".join(item.groups) }}
+    name={{ item }} group=gh
     shell=/bin/bash
   with_items: gh_users
 
 - name: gh_users | create .ssh directory
   file:
-    path=/home/{{ item.user }}/.ssh state=directory mode=0700
-    owner={{ item.user }} group={{ item.user }}
+    path=/home/{{ item }}/.ssh state=directory mode=0700
+    owner={{ item }} group={{ item }}
   with_items: gh_users
 
 - name: gh_users | copy github key[s] to .ssh/authorized_keys

playbooks/roles/jenkins_master/defaults/main.yml

-jenkins_home: "{{ storage_base_dir }}/jenkins"
+jenkins_home: "{{ COMMON_DATA_DIR }}/jenkins"
 jenkins_user: "jenkins"
 jenkins_group: "edx"
 jenkins_server_name: "jenkins.testeng.edx.org"

playbooks/roles/jenkins_master/tasks/main.yml

@@ -31,7 +31,7 @@
   file: path={{ jenkins_home }} recurse=yes state=directory
         owner={{ jenkins_user }} group={{ jenkins_group }}
 
-# Symlink /var/lib/jenkins to {{ storage_base_dir }}/jenkins
+# Symlink /var/lib/jenkins to {{ COMMON_DATA_DIR }}/jenkins
 # since Jenkins will expect its files to be in /var/lib/jenkins
 - name: jenkins_master | Symlink /var/lib/jenkins
   file: src={{ jenkins_home }} dest=/var/lib/jenkins state=link

playbooks/roles/jenkins_worker/defaults/main.yml

 ---
-jenkins_workspace: "{{ storage_base_dir }}/jenkins"
+jenkins_workspace: "{{ COMMON_DATA_DIR }}/jenkins"
 jenkins_phantomjs_url: https://phantomjs.googlecode.com/files/phantomjs-1.9.1-linux-x86_64.tar.bz2
 jenkins_phantomjs_archive: phantomjs-1.9.1-linux-x86_64.tar.bz2
 jenkins_phantomjs_folder: phantomjs-1.9.1-linux-x86_64
@@ -48,10 +48,10 @@ jscover_url: "http://superb-dca2.dl.sourceforge.net/project/jscover/JSCover-1.0.
 jscover_version: "1.0.2"
 
 # Mongo config
-mongo_dir: "{{ storage_base_dir }}/mongodb"
-mongo_log_dir: "{{ storage_base_dir }}/logs/mongodb"
+mongo_dir: "{{ COMMON_DATA_DIR }}/mongodb"
+mongo_log_dir: "{{ COMMON_DATA_DIR }}/logs/mongodb"
 
 # URL of S3 bucket containing pre-compiled Python packages
 python_pkg_url: "https://s3.amazonaws.com/jenkins.python_pkgs"
-python_download_dir: "{{ storage_base_dir }}/python_pkgs"
-python_virtualenv: "{{ storage_base_dir}}/venv"
+python_download_dir: "{{ COMMON_DATA_DIR }}/python_pkgs"
+python_virtualenv: "{{ COMMON_DATA_DIR}}/venv"

playbooks/roles/jenkins_worker/tasks/mongo.yml

 ---
 
-# Configure Mongo to use {{ storage_base_dir }} so we don't
+# Configure Mongo to use {{ COMMON_DATA_DIR }} so we don't
 # run out of disk space
 - name: jenkins_worker | Stop mongo service
   service: name=mongodb state=stopped

playbooks/roles/mongo/defaults/main.yml

-mongo_dbpath: /var/lib/mongodb
-mongo_logpath: /var/log/mongodb/mongodb.log
 mongo_logappend: true
 mongo_version: 2.4.7
 mongo_bind_ip: 127.0.0.1
 mongo_extra_conf: ''
 mongo_key_file: '/etc/mongodb_key'
 mongo_repl_set: rs0
-mongo_cluster_members: 
+mongo_cluster_members:
 
+mongo_data_dir: "{{ COMMON_DATA_DIR }}/mongo"
+mongo_log_dir: "{{ COMMON_LOG_DIR }}/mongo"
+mongo_user: mongodb
 MONGO_USERS:
   - user: cs_comments_service
     password: password
@@ -15,3 +16,6 @@ MONGO_USERS:
   - user: exdapp
     password: password
     database: edxapp
+
+mongo_logpath: "{{ mongo_log_dir }}/mongodb.log"
+mongo_dbpath: "{{ mongo_data_dir }}/mongodb"

playbooks/roles/mongo/tasks/main.yml

@@ -2,11 +2,8 @@
 ---
 - name: mongo | install python pymongo for mongo_user ansible module
   pip: >
-    name=pymongo
-    state=present
-    version=2.6.3
-    extra_args="-i {{ PYPI_MIRROR_URL }}"
-  tags: mongo
+    name=pymongo state=present
+    version=2.6.3 extra_args="-i {{ COMMON_PYPI_MIRROR_URL }}"
 
 - name: mongo | add the mongodb signing key
   apt_key: >
@@ -22,21 +19,25 @@
 - name: mongo | install mongo server and recommends
   apt: >
     pkg=mongodb-10gen={{ mongo_version }}
-    state=present
-    install_recommends=yes
+    state=present install_recommends=yes
     update_cache=yes
 
+- name: mongo | create mongo dirs
+  file: >
+    path="{{ item }}" state=directory
+    owner="{{ mongo_user  }}"
+    group="{{ mongo_user }}"
+  with_items:
+    - "{{ mongo_data_dir }}"
+    - "{{ mongo_dbpath }}"
+    - "{{ mongo_log_dir }}"
+
 - name: mongo | stop mongo service
   service: name=mongodb state=stopped
-  tags: mongo
 
-- name: mongo | move mongodb to {{ storage_base_dir }}
-  command: mv /var/lib/mongodb  {{ storage_base_dir}}/.  creates={{ storage_base_dir }}/mongodb
-  tags: mongo
+- name: mongo | move mongodb to {{ mongo_data_dir }}
+  command: mv /var/lib/mongodb  {{ mongo_data_dir}}/.  creates={{ mongo_data_dir }}/mongodb
 
-- name: mongo | create mongodb symlink
-  file: src={{ storage_base_dir }}/mongodb dest=/var/lib/mongodb state=link
-  tags: mongo
 
 - name: mongo | copy mongodb key file
   copy: >
@@ -50,25 +51,20 @@
 - name: mongo | copy configuration template
   template: src=mongodb.conf.j2 dest=/etc/mongodb.conf backup=yes
   notify: restart mongo
-  tags: mongo
 
 - name: mongo | start mongo service
   service: name=mongodb state=started
-  tags: mongo
 
 - name: mongo | wait for mongo server to start
   wait_for: port=27017 delay=2
-  tags: mongo
 
 - name: mongo | Create the file to initialize the mongod replica set
   template: src=repset_init.j2 dest=/tmp/repset_init.js
   when: mongo_clustered is defined
-  tags: mongo
 
 - name: mongo | Initialize the replication set
-  shell: /usr/bin/mongo  /tmp/repset_init.js 
-  when: mongo_clustered is defined
-  tags: mongo
+  shell: /usr/bin/mongo  /tmp/repset_init.js
+  when: mongo_clusterd is defined
 
 # Ignoring errors here because slave instances will fail this command
 # since slaveOk is false in ansible 1.3.
@@ -79,5 +75,3 @@
     password={{ item.password }}
     state=present
   with_items: MONGO_USERS
-  tags: mongo
-  ignore_errors: yes

playbooks/roles/nginx/defaults/main.yml

 # Variables for nginx role
 ---
+
+nginx_app_dir: "{{ COMMON_APP_DIR }}/nginx"
+nginx_data_dir: "{{ COMMON_DATA_DIR }}/nginx"
+nginx_conf_dir: "{{ COMMON_APP_DIR }}/conf.d"
+nginx_log_dir: "{{ COMMON_LOG_DIR }}/nginx"
+nginx_sites_available_dir: "{{ nginx_app_dir }}/sites-available"
+nginx_sites_enabled_dir: "{{ nginx_app_dir }}/sites-enabled"
+nginx_user: root
+
 pkgs:
   nginx:
     state: installed
@@ -25,8 +34,8 @@ nginx_cfg:
     edx_release: link
   # path to version files for the basic
   # nginx configuration
-  version_html: $app_base_dir/versions.html
-  version_json: $app_base_dir/versions.json
+  version_html: "{{ nginx_app_dir }}/versions.html"
+  version_json: "{{ nginx_app_dir }}/versions.json"
   # default htpasswd contents set to edx/edx
   # this value can be overiden in vars/secure/<group>.yml
   htpasswd: |

playbooks/roles/nginx/tasks/main.yml

 # requires:
 #   - common/tasks/main.yml
 ---
+
+- name: nginx | create nginx app dirs
+  file: >
+    path="{{ item }}"
+    state=directory
+    owner="{{ nginx_user }}"
+    group="{{ common_web_group }}"
+  with_items:
+    - "{{ nginx_app_dir }}"
+    - "{{ nginx_sites_available_dir }}"
+    - "{{ nginx_sites_enabled_dir }}"
+  notify: nginx | restart nginx
+
+- name: nginx | create nginx data dirs
+  file: >
+    path="{{ item }}"
+    state=directory
+    owner="{{ common_web_user }}"
+    group="{{ nginx_user }}"
+  with_items:
+    - "{{ nginx_data_dir }}"
+    - "{{ nginx_log_dir }}"
+  notify: nginx | restart nginx
+
 - name: nginx | Install nginx
   apt: pkg=nginx state={{ pkgs.nginx.state }}
   notify: nginx | restart nginx
-  tags:
-  - nginx
-  - install
 
 - name: nginx | Server configuration file
-  copy: src={{secure_dir}}/files/nginx.conf dest=/etc/nginx/nginx.conf owner=root group=root mode=0644
-  when: nginx_conf is defined
+  template: >
+    src=nginx.conf.j2 dest=/etc/nginx/nginx.conf
+    owner=root group={{ common_web_user }} mode=0644
   notify: nginx | reload nginx
-  tags:
-  - nginx
-  - install
 
 - name: nginx | Creating common nginx configuration
-  template: src=edx-release.j2 dest=/etc/nginx/sites-available/edx-release owner=root group=root mode=0600
+  template: >
+    src=edx-release.j2 dest={{ nginx_sites_available_dir }}/edx-release
+    owner=root group=root mode=0600
   notify: nginx | reload nginx
-  tags:
-  - nginx
 
 - name: nginx | Creating link for common nginx configuration
-  file: src=/etc/nginx/sites-available/edx-release dest=/etc/nginx/sites-enabled/edx-release state=link owner=root group=root
+  file: >
+    src={{ nginx_sites_available_dir }}/edx-release
+    dest={{ nginx_sites_enabled_dir }}/edx-release
+    state=link owner=root group=root
   notify: nginx | reload nginx
-  tags:
-  - nginx
 
 - name: nginx | Copying nginx configs for {{ nginx_sites }}
-  template: src={{ item }}.j2 dest=/etc/nginx/sites-available/{{ item }} owner=root group=root mode=0600
+  template: >
+    src={{ item }}.j2 dest={{ nginx_sites_available_dir }}/{{ item }}
+    owner=root group={{ common_web_user }} mode=0640
   notify: nginx | reload nginx
   with_items: nginx_sites
-  tags:
-  - nginx
 
 - name: nginx | Creating nginx config links for {{ nginx_sites }}
-  file: src=/etc/nginx/sites-available/{{ item  }} dest=/etc/nginx/sites-enabled/{{ item }} state=link owner=root group=root
+  file: >
+    src={{ nginx_sites_available_dir }}/{{ item  }}
+    dest={{ nginx_sites_enabled_dir }}/{{ item }}
+    state=link owner=root group=root
   notify: nginx | reload nginx
   with_items: nginx_sites
-  tags:
-  - nginx
 
 - name: nginx | Write out default htpasswd file
-  copy: content={{ nginx_cfg.htpasswd }} dest=/etc/nginx/nginx.htpasswd owner=www-data group=www-data mode=0600
-  tags:
-  - nginx
-  - update
+  copy: >
+    content={{ nginx_cfg.htpasswd }} dest={{ nginx_app_dir }}/nginx.htpasswd
+    owner=www-data group=www-data mode=0600
 
 - name: nginx | Create nginx log file location (just in case)
-  file: path={{log_base_dir}}/nginx state=directory owner=syslog group=syslog mode=2770 recurse=yes
-  tags:
-  - nginx
-  - logging
-  - update
+  file: >
+    path={{ nginx_log_dir}} state=directory
+    owner={{ common_web_user }} group={{ common_web_user }}
 
 # removing default link
 - name: nginx | Removing default nginx config and restart (enabled)
-  file: path=/etc/nginx/sites-enabled/default state=absent
+  file: path={{ nginx_sites_enabled_dir }}/default state=absent
   notify: nginx | reload nginx
-  tags:
-  - nginx
-  - update
 
 # Note that nginx logs to /var/log until it reads its configuration, so /etc/logrotate.d/nginx is still good
 
 - name: nginx | Set up nginx access log rotation
-  template: dest=/etc/logrotate.d/nginx-access src=edx_logrotate_nginx_access.j2 owner=root group=root mode=644
-  tags:
-  - logging
-  - update
+  template: >
+    dest=/etc/logrotate.d/nginx-access src=edx_logrotate_nginx_access.j2
+    owner=root group=root mode=644
 
 - name: nginx | Set up nginx access log rotation
-  template: dest=/etc/logrotate.d/nginx-error src=edx_logrotate_nginx_error.j2 owner=root group=root mode=644
-  tags:
-  - logging
-  - update
-
-- name: nginx | Removing default nginx config (available)
-  file: path=/etc/nginx/sites-available/default state=absent
-  notify: nginx | reload nginx
-  tags:
-  - nginx
-  - update
+  template: >
+    dest=/etc/logrotate.d/nginx-error src=edx_logrotate_nginx_error.j2
+    owner=root group=root mode=644
 
 # If tasks that notify restart nginx don't change the state of the remote system
 # their corresponding notifications don't get run.  If nginx has been stopped for

playbooks/roles/nginx/templates/basic-auth.j2

      auth_basic            "Restricted";
-     auth_basic_user_file  /etc/nginx/nginx.htpasswd;
-     root {{ app_base_dir }}/main_static;
+     auth_basic_user_file  {{ nginx_app_dir }}/nginx.htpasswd;
      index index.html
      proxy_set_header X-Forwarded-Proto https;

playbooks/roles/nginx/templates/cms.j2

@@ -11,8 +11,8 @@ server {
 
   server_name studio.*;
 
-  access_log {{log_base_dir}}/nginx/access.log;
-  error_log {{log_base_dir}}/nginx/error.log error;
+  access_log {{ nginx_log_dir }}/access.log;
+  error_log {{ nginx_log_dir }}/error.log error;
 
   # CS184 requires uploads of up to 4MB for submitting screenshots. 
   # CMS requires larger value for course assest, values provided 
@@ -50,7 +50,7 @@ server {
 
   # Check security on this
   location ~ /static/(?P<file>.*) {
-    root {{app_base_dir}};
+    root {{ edxapp_data_dir }};
     try_files /staticfiles/$file /course_static/$file =404;
 
     # return a 403 for static files that shouldn't be

playbooks/roles/nginx/templates/discern.j2

@@ -9,7 +9,7 @@ server {
 
     # https://docs.djangoproject.com/en/dev/howto/static-files/#serving-static-files-in-production
     location /static/ { # STATIC_URL
-        alias {{ discern_dir }}/staticfiles/;
+        alias {{ discern_app_dir }}/staticfiles/;
         expires 1m;
 	autoindex on;
     }

playbooks/roles/nginx/templates/edx_logrotate_nginx_access.j2

 # Put in place by ansible
 
-{{log_base_dir}}/nginx/access.log {
+{{ nginx_log_dir }}/access.log {
   create 0640 www-data adm
   compress
   delaycompress

playbooks/roles/nginx/templates/edx_logrotate_nginx_error.j2

 # Put in place by ansible
 
-{{log_base_dir}}/nginx/error.log {
+{{ nginx_log_dir }}/error.log {
   create 0640 www-data adm
   compress
   delaycompress

playbooks/roles/nginx/templates/lms-preview.j2

@@ -48,7 +48,7 @@ server {
 
   # Check security on this
   location ~ /static/(?P<file>.*) {
-    root {{app_base_dir}};
+    root {{ edxapp_data_dir}};
     try_files /staticfiles/$file /course_static/$file =404;
 
     # return a 403 for static files that shouldn't be

playbooks/roles/nginx/templates/lms.j2

@@ -9,8 +9,8 @@ server {
 
   listen {{EDXAPP_LMS_NGINX_PORT}} default;
 
-  access_log {{log_base_dir}}/nginx/access.log;
-  error_log {{log_base_dir}}/nginx/error.log error;
+  access_log {{ nginx_log_dir }}/access.log;
+  error_log {{ nginx_log_dir }}/error.log error;
 
   # CS184 requires uploads of up to 4MB for submitting screenshots.
   # CMS requires larger value for course assest, values provided
@@ -50,7 +50,7 @@ server {
 
   # Check security on this
   location ~ /static/(?P<file>.*) {
-    root {{app_base_dir}};
+    root {{ edxapp_data_dir }};
     try_files /staticfiles/$file /course_static/$file =404;
 
     # return a 403 for static files that shouldn't be

playbooks/roles/nginx/templates/nginx.conf.j2

+user www-data;
+worker_processes 4;
+pid /var/run/nginx.pid;
+
+events {
+        worker_connections 768;
+        # multi_accept on;
+}
+
+http {
+
+        ##
+        # Basic Settings
+        ##
+
+        sendfile on;
+        tcp_nopush on;
+        tcp_nodelay on;
+        keepalive_timeout 65;
+        types_hash_max_size 2048;
+        # increase header buffer for for https://edx-wiki.atlassian.net/browse/LMS-467&gt
+        # see http://orensol.com/2009/01/18/nginx-and-weird-400-bad-request-responses/
+        large_client_header_buffers 4 16k;
+        # server_tokens off;
+
+        # server_names_hash_bucket_size 64;
+        # server_name_in_redirect off;
+
+        include /etc/nginx/mime.types;
+        default_type application/octet-stream;
+
+        ##
+        # Logging Settings
+        ##
+
+        log_format p_combined '$http_x_forwarded_for - $remote_addr - $remote_user [$time_local]  '
+                            '"$request" $status $body_bytes_sent $request_time '
+                            '"$http_referer" "$http_user_agent"';
+        access_log {{ nginx_log_dir }}/access.log p_combined;
+        error_log {{ nginx_log_dir }}/error.log;
+
+        ##
+        # Gzip Settings
+        ##
+
+        gzip on;
+        gzip_disable "msie6";
+
+        gzip_vary on;
+        gzip_proxied any;
+        gzip_comp_level 6;
+        gzip_buffers 16 8k;
+        gzip_http_version 1.1;
+        gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+
+        ##
+        # Virtual Host Configs
+        ##
+
+        include {{ nginx_sites_enabled_dir }}/*;
+        include {{ nginx_conf_dir }}/*.conf;
+}
+

playbooks/roles/notifier/defaults/main.yml

@@ -38,7 +38,7 @@ NOTIFIER_USER_SERVICE_HTTP_AUTH_USER: "guido"
 NOTIFIER_USER_SERVICE_HTTP_AUTH_PASS: "vanrossum"
 NOTIFIER_CELERY_BROKER_URL: "django://"
 
-NOTIFIER_SUPERVISOR_LOG_DEST: "{{ storage_base_dir }}/logs/supervisor"
+NOTIFIER_SUPERVISOR_LOG_DEST: "{{ COMMON_DATA_DIR }}/logs/supervisor"
 
 NOTIFER_REQUESTS_CA_BUNDLE: "/etc/ssl/certs/ca-certificates.crt"
 

playbooks/roles/notifier/tasks/main.yml

@@ -2,16 +2,16 @@
 
 #
 # notifier
-# 
+#
 # Overview:
-# 
-# Provides the edX notifier service, a service for sending 
+#
+# Provides the edX notifier service, a service for sending
 # notifications over messaging protocols.
 #
 # Dependencies:
 #
 #   * common
-# 
+#
 # Example play:
 #   roles:
 #   - common
@@ -19,153 +19,84 @@
 #
 - name: notifier | install notifier specific system packages
   apt: pkg={{','.join(notifier_debian_pkgs)}} state=present
-  tags:
-  - notifier
-  - install
-  - update
 
 - name: notifier | check if incommon ca is installed
   command: test -e /usr/share/ca-certificates/incommon/InCommonServerCA.crt
   register: incommon_present
   ignore_errors: yes
-  tags:
-  - notifier
-  - install
-  - update
 
 - name: common | create incommon ca directory
-  file: 
+  file:
     path="/usr/share/ca-certificates/incommon" mode=2775 state=directory
   when: incommon_present|failed
-  tags:
-  - notifier
-  - install
-  - update
-  - ubuntu
 
 - name: common | retrieve incommon server CA
   shell: curl https://www.incommon.org/cert/repository/InCommonServerCA.txt -o /usr/share/ca-certificates/incommon/InCommonServerCA.crt
   when: incommon_present|failed
-  tags:
-  - notifier
-  - install
-  - update
-  - ubuntu
 
 - name: common | add InCommon ca cert
   lineinfile:
     dest=/etc/ca-certificates.conf
-    regexp='incommon/InCommonServerCA.crt'    
+    regexp='incommon/InCommonServerCA.crt'
     line='incommon/InCommonServerCA.crt'
-  tags:
-  - notifier
-  - install
-  - update
-  - ubuntu
 
 - name: common | update ca certs globally
   shell: update-ca-certificates
-  tags:
-  - notifier
-  - install
-  - update
-  - ubuntu
 
 - name: notifier | create notifier user {{ NOTIFIER_USER }}
-  user: 
-    name={{ NOTIFIER_USER }} state=present shell=/bin/bash 
+  user:
+    name={{ NOTIFIER_USER }} state=present shell=/bin/bash
     home={{ NOTIFIER_HOME }} createhome=yes
-  tags:
-  - notifier
-  - install
-  - update
 
 - name: notifier | setup the notifier env
-  template: 
-    src=notifier_env.j2 dest={{ NOTIFIER_HOME }}/notifier_env 
+  template:
+    src=notifier_env.j2 dest={{ NOTIFIER_HOME }}/notifier_env
     owner="{{ NOTIFIER_USER }}" group="{{ NOTIFIER_USER }}"
-  tags:
-  - notifier
-  - install
-  - update
 
 - name: notifier | drop a bash_profile
   copy: >
-    src=../../common/files/bash_profile 
-    dest={{ NOTIFIER_HOME }}/.bash_profile 
-    owner={{ NOTIFIER_USER }} 
+    src=../../common/files/bash_profile
+    dest={{ NOTIFIER_HOME }}/.bash_profile
+    owner={{ NOTIFIER_USER }}
     group={{ NOTIFIER_USER }}
 
 - name: notifier | ensure .bashrc exists
   shell: touch {{ NOTIFIER_HOME }}/.bashrc
-  sudo: true  
+  sudo: true
   sudo_user: "{{ NOTIFIER_USER }}"
-  tags:
-  - notifier
-  - install
-  - update
 
 - name: notifier | add source of notifier_env to .bashrc
   lineinfile:
     dest={{ NOTIFIER_HOME }}/.bashrc
-    regexp='. {{ NOTIFIER_HOME }}/notifier_env'    
+    regexp='. {{ NOTIFIER_HOME }}/notifier_env'
     line='. {{ NOTIFIER_HOME }}/notifier_env'
-  tags:
-  - notifier
-  - install
-  - update
 
 - name: notifier | add source venv to .bashrc
   lineinfile:
     dest={{ NOTIFIER_HOME }}/.bashrc
-    regexp='. {{ NOTIFIER_VENV_DIR }}/bin/activate'    
+    regexp='. {{ NOTIFIER_VENV_DIR }}/bin/activate'
     line='. {{ NOTIFIER_VENV_DIR }}/bin/activate'
-  tags:
-  - notifier
-  - install
-  - update
 
 - name: notifier | create notifier DB directory
   file:
     path="{{ NOTIFIER_DB_DIR }}" mode=2775 state=directory
-  tags:
-  - notifier
-  - install
-  - update
 
 - name: notifier | create notifier/bin directory
-  file: 
+  file:
     path="{{ NOTIFIER_HOME }}/bin" mode=2775 state=directory
-  tags:
-  - notifier
-  - install
-  - update
 
 - name: common | create supervisor log directoy
-  file: 
+  file:
     path={{NOTIFIER_SUPERVISOR_LOG_DEST }} mode=2750 state=directory
-  tags:
-  - notifier
-  - install
-  - update
-  - ubuntu
 
 - name: notifier | supervisord config for celery workers
-  template: 
-    src=etc/supervisor/conf.d/notifier-celery-workers.conf.j2 dest=/etc/supervisor/conf.d/notifier-celery-workers.conf 
+  template:
+    src=etc/supervisor/conf.d/notifier-celery-workers.conf.j2 dest=/etc/supervisor/conf.d/notifier-celery-workers.conf
   notify: notifier | restart notifier-celery-workers
-  tags:
-  - notifier
-  - install
-  - update
 
 - name: notifier | supervisord config for scheduler
-  template: 
-    src=etc/supervisor/conf.d/notifier-scheduler.conf.j2 dest=/etc/supervisor/conf.d/notifier-scheduler.conf 
+  template:
+    src=etc/supervisor/conf.d/notifier-scheduler.conf.j2 dest=/etc/supervisor/conf.d/notifier-scheduler.conf
   notify: notifier | restart notifier-scheduler
-  tags:
-  - notifier
-  - install
-  - update
 
 - include: deploy.yml

playbooks/roles/ora/defaults/main.yml

@@ -3,14 +3,31 @@
 ORA_NGINX_PORT: 18060
 ORA_BASIC_AUTH: False
 
-ora_code_dir: "{{ app_base_dir }}/edx-ora"
+ora_app_dir: "{{ COMMON_APP_DIR }}/ora"
+ora_code_dir: "{{ ora_app_dir }}/ora"
+ora_data_dir: "{{ COMMON_DATA_DIR }}/ora"
+ora_venvs_dir: "{{ ora_app_dir }}/venvs"
+ora_venv_dir: "{{ ora_venvs_dir }}/ora"
+ora_venv_bin: "{{ ora_venv_dir }}/bin"
+ora_user: "ora"
+ora_nltk_data_dir: "{{ ora_data_dir}}/nltk_data"
+
+ora_source_repo: https://github.com/edx/edx-ora.git
+ora_version: 'HEAD'
+ora_pre_requirements_file: "{{ ora_code_dir }}/pre-requirements.txt"
+ora_post_requirements_file: "{{ ora_code_dir }}/requirements.txt"
+
+ora_ease_venv_dir: "{{ ora_venv_dir }}"
+ora_ease_code_dir: "{{ ora_app_dir }}/ease"
+ora_ease_source_repo: https://github.com/edx/ease.git
+ora_ease_version: 'HEAD'
+ora_ease_pre_requirements_file: "{{ ora_ease_code_dir }}/pre-requirements.txt"
+ora_ease_post_requirements_file: "{{ ora_ease_code_dir }}/requirements.txt"
+
+
 # Default nginx listen port
 # These should be overrided if you want
 # to serve all content on port 80
-ora_user: "edx-ora"
-ora_user_home: "/opt/edx-ora"
-ora_venv_dir: "{{ ora_user_home }}/virtualenvs/{{ ora_user }}"
-ease_venv_dir: "{{ ora_venv_dir }}"
 ora_gunicorn_workers: 4
 ora_gunicorn_port: 8060
 ora_gunicorn_host: 127.0.0.1
@@ -67,18 +84,6 @@ ora_auth_config:
   'AWS_ACCESS_KEY_ID' : ''
   'AWS_SECRET_ACCESS_KEY' : ''
 
-ora_source_repo: https://github.com/edx/edx-ora.git
-ora_version: 'HEAD'
-ora_pre_requirements_file: "{{ ora_code_dir }}/pre-requirements.txt"
-ora_post_requirements_file: "{{ ora_code_dir }}/requirements.txt"
-
-ease_code_dir: "{{ app_base_dir }}/ease"
-ease_source_repo: https://github.com/edx/ease.git
-ease_version: 'HEAD'
-ease_pre_requirements_file: "{{ ease_code_dir }}/pre-requirements.txt"
-ease_post_requirements_file: "{{ ease_code_dir }}/requirements.txt"
-nltk_data_dir: /usr/share/nltk_data
-
 ora_debian_pkgs:
   - python-software-properties
   - pkg-config
@@ -107,7 +112,7 @@ ora_debian_pkgs:
   - libatlas-base-dev
   - redis-server
 
-ease_debian_pkgs:
+ora_ease_debian_pkgs:
   - python-pip
   - gcc
   - g++

playbooks/roles/ora/tasks/deploy.yml

+
+- include: ease.yml
+
 - name: ora | See if edx-ora.conf is installed
   shell: "[ -f /etc/init/edx-ora.conf ] && echo 'Found' || echo ''"
   register: edx_ora_installed
   tags:
-  - ora
   - deploy
 
 - name: ora | See if edx-ora-celery.conf is installed
   shell: "[ -f /etc/init/edx-ora-celery.conf ] && echo 'Found' || echo ''"
   register: edx_ora_celery_installed
   tags:
-  - ora
   - deploy
 
 # Stop ora service.
@@ -18,7 +19,6 @@
   when: edx_ora_installed.stdout == 'Found'
   notify: ora | restart edx-ora
   tags:
-  - ora
   - deploy
 
 - name: ora | stop edx-ora-celery service
@@ -26,76 +26,62 @@
   when: edx_ora_celery_installed.stdout == 'Found'
   notify: ora | restart edx-ora-celery
   tags:
-  - ora
   - deploy
 
 - name: ora | create ora application config
-  template: src=ora.env.json.j2 dest={{ora_code_dir}}/../ora.env.json mode=0640 owner={{ ora_user }} group=adm
+  template: src=ora.env.json.j2 dest={{ora_app_dir}}/ora.env.json
+  sudo_user: "{{ ora_user }}"
   tags:
-  - ora
   - deploy
 
 - name: ora | create ora auth file
-  template: src=ora.auth.json.j2 dest={{ora_code_dir}}/../ora.auth.json mode=0640 owner={{ ora_user }} group=adm
+  template: src=ora.auth.json.j2 dest={{ora_app_dir}}/ora.auth.json
+  sudo_user: "{{ ora_user }}"
   tags:
-  - ora
   - deploy
 
 - name: ora | create ora upstart script
-  template: src=edx-ora.conf.j2 dest=/etc/init/edx-ora.conf mode=0640 owner=root group=adm
+  template: src=edx-ora.conf.j2 dest=/etc/init/edx-ora.conf
   tags:
-  - ora
   - deploy
 
 - name: ora | create ora-celery upstart script
-  template: src=edx-ora-celery.conf.j2 dest=/etc/init/edx-ora-celery.conf mode=0640 owner=root group=adm
+  template: src=edx-ora-celery.conf.j2 dest=/etc/init/edx-ora-celery.conf
   tags:
-  - ora
   - deploy
 
 # Do A Checkout
-- name: ora | git checkout ora repo into $app_base_dir
-  git: dest={{ora_code_dir}} repo={{ora_source_repo}} version={{ora_version}}
+- name: ora | git checkout ora repo into {{ ora_app_dir }}
+  git: dest={{ ora_code_dir }} repo={{ ora_source_repo }} version={{ ora_version }}
+  sudo_user: "{{ ora_user }}"
   notify:
     - ora | restart edx-ora
     - ora | restart edx-ora-celery
   tags:
-  - ora
   - deploy
 
-# Do Post Checkout Tasks.
-- name: ora | change permissions on ora code dir
-  file: path={{ora_code_dir}} state=directory owner={{ ora_user }} group={{ ora_user }} mode=755 recurse=yes
-  notify:
-    - ora | restart edx-ora
-    - ora | restart edx-ora-celery
-  tags:
-  - ora
-  - deploy
-
-
 # TODO: Check git.py _run_if_changed() to see if the logic there to skip running certain
 # portions of the deploy needs to be incorporated here.
 
 
 # Install the python pre requirements into {{ ora_venv_dir }}
 - name: ora | install python pre-requirements
-  pip: requirements="{{ora_pre_requirements_file}}" virtualenv="{{ora_venv_dir}}" state=present
+  pip: requirements="{{ ora_pre_requirements_file }}" virtualenv="{{ ora_venv_dir }}" state=present
+  sudo_user: "{{ ora_user }}"
   notify:
     - ora | restart edx-ora
     - ora | restart edx-ora-celery
   tags:
-  - ora
   - deploy
 
 # Install the python post requirements into {{ ora_venv_dir }}
 - name: ora | install python post-requirements
-  pip: requirements="{{ora_post_requirements_file}}" virtualenv="{{ora_venv_dir}}" state=present
+  pip: requirements="{{ ora_post_requirements_file }}" virtualenv="{{ ora_venv_dir }}" state=present
+  sudo_user: "{{ ora_user }}"
   notify:
     - ora | restart edx-ora
     - ora | restart edx-ora-celery
   tags:
-  - ora
   - deploy
 
   #Needed if using redis to prevent memory issues
@@ -105,26 +91,23 @@
     - ora | restart edx-ora
     - ora | restart edx-ora-celery
   tags:
-  - ora
   - deploy
 
 - name: ora | syncdb and migrate
-  shell: sudo -u {{ ora_user }} SERVICE_VARIANT=ora {{ora_venv_dir}}/bin/django-admin.py syncdb --migrate --noinput --settings=edx_ora.aws --pythonpath={{ora_code_dir}}
+  shell: SERVICE_VARIANT=ora {{ora_venv_dir}}/bin/django-admin.py syncdb --migrate --noinput --settings=edx_ora.aws --pythonpath={{ora_code_dir}}
   when: migrate_db is defined and migrate_db|lower == "yes"
+  sudo_user: "{{ ora_user }}"
   notify:
     - ora | restart edx-ora
     - ora | restart edx-ora-celery
   tags:
-  - ora
-  - syncdb
   - deploy
 
 - name: ora | create users
-  shell: sudo -u {{ ora_user }} SERVICE_VARIANT=ora {{ora_venv_dir}}/bin/django-admin.py update_users --settings=edx_ora.aws --pythonpath={{ora_code_dir}}
+  shell: SERVICE_VARIANT=ora {{ora_venv_dir}}/bin/django-admin.py update_users --settings=edx_ora.aws --pythonpath={{ora_code_dir}}
+  sudo_user: "{{ ora_user }}"
   notify:
     - ora | restart edx-ora
     - ora | restart edx-ora-celery
   tags:
-  - ora
-  - syncdb
   - deploy

playbooks/roles/ora/tasks/ease.yml

@@ -2,14 +2,12 @@
   shell: "[ -f /etc/init/edx-ora.conf ] && echo 'Found' || echo ''"
   register: edx_ora_installed
   tags:
-  - ora
   - deploy
 
 - name: ora | See if edx-ora-celery.conf is installed
   shell: "[ -f /etc/init/edx-ora-celery.conf ] && echo 'Found' || echo ''"
   register: edx_ora_celery_installed
   tags:
-  - ora
   - deploy
 
 # Stop ora service.
@@ -17,81 +15,60 @@
   service: name=edx-ora state=stopped
   when: edx_ora_installed.stdout == 'Found'
   tags:
-  - ora
   - deploy
 
 - name: ora | stop edx-ora-celery service
   service: name=edx-ora-celery state=stopped
   when: edx_ora_celery_installed.stdout == 'Found'
   tags:
-  - ora
   - deploy
 
 
 # Do A Checkout
 - name: ora | git checkout ease repo into its base dir
-  git: dest={{ease_code_dir}} repo={{ease_source_repo}} version={{ease_version}}
+  git: dest={{ora_ease_code_dir}} repo={{ora_ease_source_repo}} version={{ora_ease_version}}
+  sudo_user: "{{ ora_user }}"
   tags:
-  - ease
   - deploy
 
-# Do Post Checkout Tasks.
-- name: ora | change permissions on ease code dir
-  file: path={{ease_code_dir}} state=directory owner={{ ora_user }} group={{ ora_user }} mode=755 recurse=yes
-  tags:
-  - ease
-  - deploy
-
-
-# TODO: Check git.py _run_if_changed() to see if the logic there to skip running certain
-# portions of the deploy needs to be incorporated here.
-#
 - name: ora | install ease system packages
   apt: pkg={{item}} state=present
-  with_items: ease_debian_pkgs
+  with_items: ora_ease_debian_pkgs
   tags:
-  - ease
   - deploy
 
 
-# Install the python pre requirements into {{ ease_venv_dir }}
+# Install the python pre requirements into {{ ora_ease_venv_dir }}
 - name: ora | install ease python pre-requirements
-  pip: requirements="{{ease_pre_requirements_file}}" virtualenv="{{ease_venv_dir}}" state=present
+  pip: requirements="{{ora_ease_pre_requirements_file}}" virtualenv="{{ora_ease_venv_dir}}" state=present
+  sudo_user: "{{ ora_user }}"
   tags:
-  - ease
   - deploy
 
-# Install the python post requirements into {{ ease_venv_dir }}
+# Install the python post requirements into {{ ora_ease_venv_dir }}
 - name: ora | install ease python post-requirements
-  pip: requirements="{{ease_post_requirements_file}}" virtualenv="{{ease_venv_dir}}" state=present
+  pip: requirements="{{ora_ease_post_requirements_file}}" virtualenv="{{ora_ease_venv_dir}}" state=present
+  sudo_user: "{{ ora_user }}"
   tags:
-  - ease
   - deploy
 
 - name: ora | install ease python package
-  shell: command="{{ease_venv_dir}}/bin/activate; cd {{ease_code_dir}}; python setup.py install"
+  shell: command="{{ora_ease_venv_dir}}/bin/activate; cd {{ora_ease_code_dir}}; python setup.py install"
+  sudo_user: "{{ ora_user }}"
   tags:
-  - ease
   - deploy
 
 #Needed for the ease package to work
 - name: ora | check for the existence of nltk data taggers/maxent_treebank_pos_tagger/english.pickle
-  shell: "[ -f {{nltk_data_dir}}/taggers/maxent_treebank_pos_tagger/english.pickle ] && echo 'Found' || echo ''"
-  register: nltk_data_installed
+  shell: "[ -f {{ ora_nltk_data_dir }}/taggers/maxent_treebank_pos_tagger/english.pickle ] && echo 'Found' || echo ''"
+  register: ora_nltk_data_installed
   tags:
-  - ease
   - deploy
 
 
 - name: ora | install nltk data using rendered shell script
-  command: "{{ease_venv_dir}}/bin/python -m nltk.downloader -d {{nltk_data_dir}} all"
-  when: nltk_data_installed.stdout  != "Found"
-  tags:
-  - ease
-  - deploy
-
-- name: ora | set permissions on nltk data directory
-  file: path={{nltk_data_dir}} owner=ubuntu group=adm mode=2775 state=directory
+  command: "{{ora_ease_venv_dir}}/bin/python -m nltk.downloader -d {{ ora_nltk_data_dir }} all"
+  when: ora_nltk_data_installed.stdout  != "Found"
+  sudo_user: "{{ ora_user }}"
   tags:
-  - ease
   - deploy

playbooks/roles/ora/tasks/main.yml

@@ -2,27 +2,33 @@
 #  - group_vars/all
 #  - common/tasks/main.yml
 ---
-- name: ora | create the ora application user
-  user: name={{ ora_user }}
-  tags:
-  - ora
 
-- name: ora | Create ml_models directory
-  file: path={{ora_code_dir}}/../ml_models state=directory owner={{ ora_user }} group={{ ora_user }}
-  tags:
-  - ora
+- name: ora | create application user
+  user: >
+    name="{{ ora_user }}" home="{{ ora_app_dir }}"
+    createhome=no shell=/bin/false
 
-# Check out ora repo to {{ora_code_dir}}
-- name: ora | install git and its recommends
-  apt: pkg=git state=present install_recommends=yes
-  tags:
-  - ora
+- name: ora | create ora app and data dir
+  file: >
+    path="{{ item }}" state=directory
+    owner="{{ ora_user }}" group="{{ common_web_group }}"
+  with_items:
+    - "{{ ora_venvs_dir }}"
+    - "{{ ora_app_dir }}"
+    - "{{ ora_data_dir }}"
+    - "{{ ora_app_dir }}/ml_models"
 
 - name: ora | install debian packages that ora needs
   apt: pkg={{item}} state=present
   with_items: ora_debian_pkgs
-  tags:
-  - ora
 
-- include: ease.yml
+- name: ora | install debian packages for ease that ora needs
+  apt: pkg={{item}} state=present
+  with_items: ora_ease_debian_pkgs
+
 - include: deploy.yml
+
+- name: ora | create a symlink for venv python
+  file: >
+    src="{{ ora_venv_bin }}/python"
+    dest={{ COMMON_BIN_DIR }}/python.ora state=link

playbooks/roles/oraclejdk/tasks/main.yml

 ---
 
 # oraclejdk
-# 
+#
 # Dependencies:
 #
 #   * common
-# 
+#
 # Example play:
 #
 #   roles:
@@ -16,40 +16,28 @@
   command: test -d /usr/lib/jvm/{{ oraclejdk_base }}
   ignore_errors: true
   register: oraclejdk_present
-  tags:
-    - oraclejdk
-    - install
 
 - name: oraclejdk | download Oracle Java
   shell: >
-    curl -b gpw_e24=http%3A%2F%2Fwww.oracle.com -O -L {{ oraclejdk_url }} 
-      executable=/bin/bash 
-      chdir=/var/tmp 
-      creates=/var/tmp/{{ oraclejdk_file }} 
+    curl -b gpw_e24=http%3A%2F%2Fwww.oracle.com -O -L {{ oraclejdk_url }}
+      executable=/bin/bash
+      chdir=/var/tmp
+      creates=/var/tmp/{{ oraclejdk_file }}
   when: oraclejdk_present|failed
 
 - name: oraclejdk | install Oracle Java
   shell: >
-    mkdir -p /usr/lib/jvm && tar -C /usr/lib/jvm -zxvf /var/tmp/{{ oraclejdk_file }} 
+    mkdir -p /usr/lib/jvm && tar -C /usr/lib/jvm -zxvf /var/tmp/{{ oraclejdk_file }}
     creates=/usr/lib/jvm/{{ oraclejdk_base }}
-    executable=/bin/bash 
+    executable=/bin/bash
 
   sudo: true
   when: oraclejdk_present|failed
-  tags:
-    - oraclejdk
-    - install
 
 - name: oraclejdk | create symlink expected by elasticsearch
   file: src=/usr/lib/jvm/{{ oraclejdk_base }} dest={{ oraclejdk_link }} state=link
   when: oraclejdk_present|failed
-  tags:
-    - oraclejdk
-    - install
 
 - name: oraclejdk | add JAVA_HOME for Oracle Java
   template: src=java.sh.j2 dest=/etc/profile.d/java.sh owner=root group=root mode=0755
   when: oraclejdk_present|failed
-  tags:
-  - oraclejdk
-  - install

playbooks/roles/rabbitmq/defaults/main.yml

@@ -23,6 +23,8 @@ RABBIT_USERS:
     password: 'the example admin password'
   - name: 'edx'
     password: 'edx'
+  - name: 'celery'
+    password: 'celery'
 
 # Structure for auth config file.
 rabbitmq_auth_config:

playbooks/roles/rabbitmq/tasks/main.yml

@@ -20,26 +20,35 @@
 
 # Defaulting to /var/lib/rabbitmq
 - name: rabbitmq | create cookie directory
-  file: path={{rabbitmq_cookie_dir}} owner=rabbitmq group=rabbitmq mode=0755 state=directory
-
+  file: >
+    path={{rabbitmq_cookie_dir}}
+    owner=rabbitmq group=rabbitmq mode=0755 state=directory
 
 - name: rabbitmq | add rabbitmq erlang cookie
-  template: src=erlang.cookie.j2 dest={{rabbitmq_cookie_location}} owner=rabbitmq group=rabbitmq mode=0400
+  template: >
+    src=erlang.cookie.j2 dest={{rabbitmq_cookie_location}}
+    owner=rabbitmq group=rabbitmq mode=0400
   register: erlang_cookie
 
 # Defaulting to /etc/rabbitmq
 - name: rabbitmq | create rabbitmq config directory
-  file: path={{rabbitmq_config_dir}} owner=root group=root mode=0755 state=directory
- 
+  file: >
+    path={{rabbitmq_config_dir}}
+    owner=root group=root mode=0755 state=directory
+
 - name: rabbitmq | add rabbitmq environment configuration
-  template: src=rabbitmq-env.conf.j2 dest={{rabbitmq_config_dir}}/rabbitmq-env.conf owner=root group=root mode=0644
+  template: >
+    src=rabbitmq-env.conf.j2 dest={{rabbitmq_config_dir}}/rabbitmq-env.conf
+    owner=root group=root mode=0644
 
 - name: rabbitmq | add rabbitmq cluster configuration
-  template: src=rabbitmq.config.j2 dest={{rabbitmq_config_dir}}/rabbitmq.config owner=root group=root mode=0644
+  template: >
+    src=rabbitmq.config.j2 dest={{rabbitmq_config_dir}}/rabbitmq.config
+    owner=root group=root mode=0644
   register: cluster_configuration
 
 - name: rabbitmq | install plugins
-  rabbitmq_plugin: 
+  rabbitmq_plugin:
     names={{",".join(rabbitmq_plugins)}} state=enabled
 
 # When rabbitmq starts up it creates a folder of metadata at '/var/lib/rabbitmq/mnesia'.
@@ -60,13 +69,9 @@
 
 - name: rabbitmq | add admin users
   rabbitmq_user: >
-    user='{{item.name}}'
-    password='{{item.password}}'
-    read_priv='.*'
-    write_priv='.*'
-    configure_priv='.*'
-    tags="administrator"
-    state=present
+    user='{{item.name}}' password='{{item.password}}'
+    read_priv='.*' write_priv='.*'
+    configure_priv='.*' tags="administrator" state=present
   with_items: rabbitmq_auth_config.admins
   when: "'admins' in rabbitmq_auth_config"
 
@@ -74,11 +79,11 @@
 # Depends upon the management plugin
 #
 - name: rabbitmq | install admin tools
-  get_url: 
+  get_url: >
     url=http://localhost:{{ rabbitmq_management_port }}/cli/rabbitmqadmin
     dest=/usr/local/bin/rabbitmqadmin
 
 - name: rabbitmq | ensure rabbitmqadmin attributes
-  file: 
-    path=/usr/local/bin/rabbitmqadmin owner=root 
+  file: >
+    path=/usr/local/bin/rabbitmqadmin owner=root
     group=root mode=0655

playbooks/roles/rbenv/defaults/main.yml

 ---
 
 rbenv_version: 'v0.4.0'
-rbenv_bundler_version: '1.3.2'
\ No newline at end of file
+rbenv_bundler_version: '1.3.2'
+rbenv_root: "{{ rbenv_dir }}/.rbenv"
+rbenv_gem_root: "{{ rbenv_dir }}/.gem"
+rbenv_gem_bin: "{{ rbenv_gem_root }}/bin"
+rbenv_bin: "{{ rbenv_dir }}/.rbenv/bin"
+rbenv_shims: "{{ rbenv_root }}/shims"
+rbenv_path: "{{ rbenv_bin }}:{{ rbenv_shims }}:{{ rbenv_gem_bin }}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+rbenv_debian_pkgs:
+  - build-essential
+  - libcurl4-openssl-dev
+  - libreadline-dev
+  - libssl-dev
+  - libxml2-dev
+  - libxslt1-dev
+  - zlib1g-dev
+rbenv_environment:
+  RBENV_ROOT: "{{ rbenv_root }}"
+  GEM_ROOT: "{{ rbenv_gem_root }}"
+  GEM_HOME: "{{ rbenv_gem_root }}"
+  PATH: "{{ rbenv_path }}"
+  HOME: "{{ rbenv_root }}"

playbooks/roles/rbenv/tasks/main.yml

 ---
 
 # rbenv
-# 
+#
 # Dependencies:
 #
 #   * common
-# 
+#
 # Example play:
 #
 #   roles:
 #   - common
 #   - role: rbenv
 #     rbenv_user: "{{ forum_user }}"
-#     rbenv_user_home: "{{ forum_rbenv_dir }}"
+#     rbenv_dir: "{{ forum_rbenv_dir }}"
 #     rbenv_ruby_version: "{{ forum_ruby_version }}"
 #
 # Parameters:
-#  
+#
 #   * rbenv_user
-#   * rbenv_user_home
+#   * rbenv_dir
 #   * rbenv_ruby_version
 #
 # cribbed from https://github.com/mmoya/ansible-playbooks/blob/master/rbenv/main.yml
@@ -28,196 +28,93 @@
 - fail: rbenv_user required for role
   when: rbenv_user is not defined
 
-- fail: rbenv_user_home required for role
-  when: rbenv_user_home is not defined
+- fail: rbenv_dir required for role
+  when: rbenv_dir is not defined
 
 - fail: rbenv_ruby_version required for role
   when: rbenv_ruby_version is not defined
 
-- name: rbenv | create {{ rbenv_user_home }}
-  # workaround for the case where the parent
-  # directory doesn't exist
-  file: >
-    path={{ rbenv_user_home }} 
-    state=directory
-
 - name: rbenv | create rbenv user {{ rbenv_user }}
   user: >
-    name={{ rbenv_user }} 
-    state=present 
-    shell=/bin/bash 
-    home={{ rbenv_user_home }}
-    createhome=yes
-  tags:
-  - forum
-  - update
-
-- name: rbenv | ensure homedir permissions {{ rbenv_user_home }}
-  # workaround for the case where the parent
-  # directory doesn't exist
+    name={{ rbenv_user }} home={{ rbenv_dir }}
+    shell=/bin/false createhome=no
+  when: rbenv_user != common_web_user
+
+- name: rbenv | create rbenv dir if it does not exist
   file: >
-    path={{ rbenv_user_home }} 
-    owner={{ rbenv_user }}
-    group={{ rbenv_user }}
+    path="{{ rbenv_dir }}" owner="{{ rbenv_user }}"
     state=directory
-    recurse=yes
 
 - name: rbenv | install build depends
-  apt: pkg={{ item }} state=present install_recommends=no
-  with_items:
-    - build-essential
-    - git
-    - libcurl4-openssl-dev
-    - libmysqlclient-dev
-    - libreadline-dev
-    - libssl-dev
-    - libxml2-dev
-    - libxslt1-dev
-    - zlib1g-dev
-  tags:
-  - ruby
-  - install
+  apt: pkg={{ ",".join(rbenv_debian_pkgs) }} state=present install_recommends=no
+  with_items: rbenv_debian_pkgs
 
 - name: rbenv | update rbenv repo
   git: >
-    repo=https://github.com/sstephenson/rbenv.git 
-    dest={{ rbenv_user_home }}/.rbenv 
-    version={{ rbenv_version }}
-  sudo: true  
-  sudo_user: "{{ rbenv_user }}"
-  tags:
-  - ruby
-  - install
-
-- name: rbenv | ensure .bashrc exists
-  shell: touch {{ rbenv_user_home }}/.bashrc
-  sudo: true  
+    repo=https://github.com/sstephenson/rbenv.git
+    dest={{ rbenv_dir }}/.rbenv version={{ rbenv_version }}
   sudo_user: "{{ rbenv_user }}"
-  tags:
-  - ruby
-  - update
-
-- name: rbenv | drop a bash_profile
-  copy: >
-    src=../../common/files/bash_profile 
-    dest={{ rbenv_user_home }}/.bash_profile 
-    owner={{ rbenv_user }} 
-    group={{ rbenv_user }}
-
 
 - name: rbenv | ensure ruby_env exists
   template: >
-    src=ruby_env.j2 
-    dest={{ rbenv_user_home }}/ruby_env 
-    owner={{ rbenv_user }} 
-    group={{ rbenv_user }}
-  tags:
-  - ruby
-  - update
-
-- name: rebenv | add source of ruby_env to .bashrc
-  lineinfile:
-    dest="{{ rbenv_user_home }}/.bashrc"
-    regexp='. {{ rbenv_user_home }}/ruby_env'    
-    line='. {{ rbenv_user_home }}/ruby_env'
-
-- name: rbenv | drop a bash_profile
-  copy: >
-    src=../../common/files/bash_profile 
-    dest={{ rbenv_user_home }}/.bash_profile 
-    owner={{ rbenv_user }} 
-    group={{ rbenv_user }}
+    src=ruby_env.j2 dest={{ rbenv_dir }}/ruby_env
+  sudo_user: "{{ rbenv_user }}"
 
 - name: rbenv | check ruby-build installed
   command: test -x /usr/local/bin/ruby-build
   register: rbuild_present
   ignore_errors: yes
-  tags:
-  - ruby
-  - install
 
 - name: rbenv | if ruby-build exists, which versions we can install
   command: /usr/local/bin/ruby-build --definitions
   when: rbuild_present|success
   register: installable_ruby_vers
   ignore_errors: yes
-  tags:
-  - ruby
-  - install
 
 ### in this block, we (re)install ruby-build if it doesn't exist or if it can't install the requested version
 - name: rbenv | create temporary directory
   command: mktemp -d
   register: tempdir
-  sudo: true  
   sudo_user: "{{ rbenv_user }}"
   when: rbuild_present|failed or (installable_ruby_vers is defined and rbenv_ruby_version not in installable_ruby_vers)
-  tags:
-  - ruby
-  - install
 
 - name: rbenv | clone ruby-build repo
   git: repo=https://github.com/sstephenson/ruby-build.git dest={{ tempdir.stdout }}/ruby-build
   when: rbuild_present|failed or (installable_ruby_vers is defined and rbenv_ruby_version not in installable_ruby_vers)
-  sudo: true
-  sudo_user: "{{ rbenv_user }}" 
-  tags:
-  - ruby
-  - install
+  sudo_user: "{{ rbenv_user }}"
 
 - name: rbenv | install ruby-build
   command: ./install.sh chdir={{ tempdir.stdout }}/ruby-build
   when: rbuild_present|failed or (installable_ruby_vers is defined and rbenv_ruby_version not in installable_ruby_vers)
-  tags:
-  - ruby
-  - install
 
 - name: rbenv | remove temporary directory
   file: path={{ tempdir.stdout }} state=absent
   when: rbuild_present|failed or (installable_ruby_vers is defined and rbenv_ruby_version not in installable_ruby_vers)
-  tags:
-  - ruby
-  - install
 
 - name: rbenv | check ruby {{ rbenv_ruby_version }} installed
-  shell: "{{ rbenv_user_home }}/.rbenv/bin/rbenv versions | grep {{ rbenv_ruby_version }}"
+  shell: "rbenv versions | grep {{ rbenv_ruby_version }}"
   register: ruby_installed
-  sudo: true
-  sudo_user: "{{ rbenv_user }}" 
+  sudo_user: "{{ rbenv_user }}"
+  environment: "{{ rbenv_environment }}"
   ignore_errors: yes
-  tags:
-  - ruby
-  - install
 
 - name: rbenv | install ruby {{ rbenv_ruby_version }}
-  shell: "{{ rbenv_user_home }}/.rbenv/bin/rbenv install {{ rbenv_ruby_version }} creates={{rbenv_user_home}}/.rbenv/versions/{{rbenv_ruby_version}}"
+  shell: "rbenv install {{ rbenv_ruby_version }} creates={{ rbenv_dir }}/.rbenv/versions/{{ rbenv_ruby_version }}"
   when: ruby_installed|failed
-  sudo: true
-  sudo_user: "{{ rbenv_user }}" 
-  tags:
-  - ruby
-  - install
+  sudo_user: "{{ rbenv_user }}"
+  environment: "{{ rbenv_environment }}"
 
 - name: rbenv | set global ruby {{ rbenv_ruby_version }}
-  shell: "{{rbenv_user_home }}/.rbenv/bin/rbenv global {{ rbenv_ruby_version }}"
-  sudo: true
+  shell: "rbenv global {{ rbenv_ruby_version }}"
   sudo_user: "{{ rbenv_user }}"
-  tags:
-  - ruby
-  - install
+  environment: "{{ rbenv_environment }}"
 
 - name: rbenv | install bundler
-  shell: "{{ rbenv_user_home }}/.rbenv/shims/gem install bundler -v {{ rbenv_bundler_version }}"
-  sudo: true
-  sudo_user: "{{ rbenv_user }}" 
-  tags:
-  - ruby
-  - install
+  shell: "gem install bundler -v {{ rbenv_bundler_version }}"
+  sudo_user: "{{ rbenv_user }}"
+  environment: "{{ rbenv_environment }}"
 
 - name: rbenv | rehash
-  shell: "{{rbenv_user_home}}/.rbenv/bin/rbenv rehash"
-  sudo: true
-  sudo_user: "{{ rbenv_user }}" 
-  tags:
-  - ruby
-  - install
+  shell: "rbenv rehash"
+  sudo_user: "{{ rbenv_user }}"
+  environment: "{{ rbenv_environment }}"

playbooks/roles/rbenv/templates/ruby_env.j2

-##
-## Managed by Ansible, do not edit.
-##
-export RBENV_ROOT="{{ rbenv_root }}"
-export PATH=$RBENV_ROOT/bin/:$PATH
+# {{ ansible_managed }}
+
+{% for name,value in rbenv_environment.items() %}
+{% if value %}
+export {{ name }}="{{ value }}"
+{% endif %}                 
+{% endfor %}
 eval "$(rbenv init -)"

playbooks/roles/s3fs/tasks/main.yml

@@ -23,7 +23,7 @@
 # Assuming the following config
 #
 # my_role_s3fs_mounts:
-#   - { bucket: "my_bucket", mount_point: "{{ storage_base_dir}}/s3/my_bucket", owner: "root", group: "adm", mode: "0755" }
+#   - { bucket: "my_bucket", mount_point: "{{ COMMON_DATA_DIR}}/s3/my_bucket", owner: "root", group: "adm", mode: "0755" }
 #
 # The role would need to include tasks like the following
 #

playbooks/roles/splunkforwarder/defaults/main.yml

@@ -23,17 +23,17 @@ SPLUNKFORWARDER_DEB: !!null
 SPLUNKFORWARDER_PASSWORD: !!null
 
 SPLUNKFORWARDER_LOG_ITEMS:
-  - directory: '{{log_base_dir}}'
+  - directory: '{{ COMMON_LOG_DIR }}'
     recursive: true
-    index: '{{ENV_TYPE}}-{{ENV_NAME}}'
+    index: '{{COMMON_ENV_TYPE}}-{{COMMON_ENV_NAME}}'
     sourcetype: 'edx'
   - directory: '/var/log'
     recursive: true
-    index: '{{ENV_TYPE}}-{{ENV_NAME}}'
+    index: '{{COMMON_ENV_TYPE}}-{{COMMON_ENV_NAME}}'
     sourcetype: 'syslog'
-  - directory: '{{log_base_dir}}/nginx'
+  - directory: '{{ COMMON_LOG_DIR }}/nginx'
     recursive: true
-    index: '{{ENV_TYPE}}-{{ENV_NAME}}'
+    index: '{{COMMON_ENV_TYPE}}-{{COMMON_ENV_NAME}}'
     sourcetype: 'nginx'
 
 #

playbooks/roles/supervisor/defaults/main.yml

@@ -11,5 +11,17 @@
 # Defaults for role supervisor
 #
 ---
-supervisor_log_dir: /var/log/supervisor
-supervisor_cfg: /etc/supervisord.conf
+supervisor_app_dir: "{{ COMMON_APP_DIR }}/supervisor"
+supervisor_cfg_dir: "{{ supervisor_app_dir }}/conf.d"
+supervisor_data_dir: "{{ COMMON_DATA_DIR }}/supervisor"
+supervisor_venvs_dir: "{{ supervisor_app_dir }}/venvs"
+supervisor_venv_dir: "{{ supervisor_venvs_dir }}/supervisor"
+supervisor_venv_bin: "{{ supervisor_venv_dir }}/bin"
+supervisor_ctl: "{{ supervisor_venv_bin }}/supervisorctl"
+
+# by default supervisor runs as the web user
+# which by default is set to www-data in
+# the common role
+supervisor_user: supervisor
+supervisor_log_dir: "{{ COMMON_LOG_DIR }}/supervisor"
+supervisor_cfg: "{{ supervisor_app_dir }}/supervisord.conf"

playbooks/roles/supervisor/handlers/main.yml

+- name: supervisor | restart supervisor
+  service: >
+    name=supervisor
+    state=restarted
+
+- name: supervisor | reload supervisor
+  shell: "{{ supervisor_ctl }} -c {{ supervisor_cfg }} reload"

playbooks/roles/supervisor/tasks/main.yml

@@ -11,10 +11,9 @@
 # Tasks for role supervisor
 #
 # Overview:
-#   Parameterized role for supervisord
-#   Supervisor templates must exist in the
-#   templates/ dir for each server
-# 
+#   Role for supervisord
+#   Installs supervisor in its own venv.
+#
 # Dependencies:
 #   - common
 #
@@ -22,32 +21,73 @@
 #   roles:
 #     - common
 #     - role: supervisor
-#       supervisor_servers:
-#       - ...
 
 ---
-- fail: supervisor_servers is a required parameter for this role
-  when: supervisor_servers is not defined
+- name: supervisor | create application user
+  user: >
+    name="{{ supervisor_user }}"
+    home="{{ supervisor_app_dir }}"
+    createhome=no
+    shell=/bin/false
 
-- name: supervisor | install supervisor at the system level
-  pip: name=supervisor state=present
+- name: supervisor | create supervisor directories
+  file: >
+    name={{ item }}
+    state=directory
+    owner={{ supervisor_user }}
+    group={{ common_web_user }}
+  with_items:
+    - "{{ supervisor_app_dir }}"
+    - "{{ supervisor_venvs_dir }}"
 
 - name: supervisor | create supervisor directories
-  file: name={{ item }} state=directory
+  file: >
+    name={{ item }}
+    state=directory
+    owner={{ common_web_user }}
+    group={{ supervisor_user }}
   with_items:
-    - /etc/supervisor
-    - /etc/supervisor/conf.d
+    - "{{ supervisor_cfg_dir }}"
+    - "{{ supervisor_data_dir }}"
     - "{{ supervisor_log_dir }}"
 
+
+- name: supervisor | install supervisor in its venv
+  pip: name=supervisor virtualenv="{{supervisor_venv_dir}}" state=present
+  sudo_user: "{{ supervisor_user }}"
+  notify: supervisor | restart supervisor
+
 - name: supervisor | create supervisor upstart job
-  template: src=supervisor-upstart.conf.j2 dest=/etc/init/supervisor.conf
+  template: >
+    src=supervisor-upstart.conf.j2 dest=/etc/init/supervisor.conf
+    owner=root group=root
+  notify: supervisor | restart supervisor
 
 - name: supervisor | create supervisor master config
-  template: src=supervisord.conf.j2 dest={{ supervisor_cfg }}
+  template: >
+    src=supervisord.conf.j2 dest={{ supervisor_cfg }}
+    owner={{ supervisor_user }} group={{ common_web_user }}
+    mode=0644
+  notify: supervisor | restart supervisor
+
+- name: supervisor | create a symlink for supervisortctl
+  file: >
+    src={{ supervisor_ctl }}
+    dest={{ COMMON_BIN_DIR }}/{{ supervisor_ctl|basename }}
+    state=link
+
+- name: supervisor | create a symlink for supervisor cfg
+  file: >
+    src={{ supervisor_cfg }}
+    dest={{ COMMON_CFG_DIR }}/{{ supervisor_cfg|basename }}
+    state=link
+
+- name: supervisor | create a symlink for supervisor cfg
+  file: >
+    src={{ supervisor_cfg_dir }}
+    dest={{ COMMON_BIN_DIR }}/supervisor.{{ supervisor_cfg_dir|basename }}
+    state=link
 
-- name: supervisor | create supervisor configs
-  template: src={{ item }}.conf.j2 dest=/etc/supervisor/conf.d/{{ item }}.conf
-  with_items: supervisor_servers
 
 - name: supervisor | ensure supervisor is started
   service: name=supervisor state=started

playbooks/roles/supervisor/templates/supervisor-upstart.conf.j2

@@ -4,5 +4,5 @@ start on runlevel [2345]
 stop on runlevel [!2345]
 
 respawn
-
-exec /usr/local/bin/supervisord --nodaemon --configuration {{ supervisor_cfg }}
+setuid {{ common_web_user }}
+exec {{ supervisor_venv_dir }}/bin/supervisord --nodaemon --configuration {{ supervisor_cfg }}

playbooks/roles/supervisor/templates/supervisord.conf.j2

 ; supervisor config file
 
 [unix_http_server]
-file=/var/run//supervisor.sock   ; (the path to the socket file)
+file={{ supervisor_data_dir }}/supervisor.sock   ; (the path to the socket file)
 chmod=0700                       ; sockef file mode (default 0700)
 
 [supervisord]
-logfile=/var/log/supervisor/supervisord.log ; (main log file;default $CWD/supervisord.log)
-pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
-childlogdir=/var/log/supervisor            ; ('AUTO' child log dir, default $TEMP)
+logfile={{ supervisor_log_dir }}/supervisord.log ; (main log file;default $CWD/supervisord.log)
+pidfile={{ supervisor_data_dir }}/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
+childlogdir={{ supervisor_log_dir }}            ; ('AUTO' child log dir, default $TEMP)
 
 ; the below section must remain in the config file for RPC
 ; (supervisorctl/web interface) to work, additional interfaces may be
@@ -16,7 +16,7 @@ childlogdir=/var/log/supervisor            ; ('AUTO' child log dir, default $TEM
 supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
 
 [supervisorctl]
-serverurl=unix:///var/run//supervisor.sock ; use a unix:// URL  for a unix socket
+serverurl=unix://{{ supervisor_data_dir }}/supervisor.sock ; use a unix:// URL  for a unix socket
 
 ; The [include] section can just contain the "files" setting.  This
 ; setting can list multiple files (separated by whitespace or
@@ -25,5 +25,5 @@ serverurl=unix:///var/run//supervisor.sock ; use a unix:// URL  for a unix socke
 ; include files themselves.
 
 [include]
-files = /etc/supervisor/conf.d/*.conf
+files = {{ supervisor_cfg_dir }}/*.conf
 

playbooks/roles/virtualenv/defaults/main.yml

----
-
-virtualenv_apt_pkgs:
-  - python2.7
-  - python-pip
-  - python2.7-dev
-
-virtualenv_python_pkgs:
-  - virtualenv
-  - virtualenvwrapper
\ No newline at end of file

playbooks/roles/virtualenv/tasks/main.yml

----
-
-# virtualenv
-#
-# Overview:
-#
-# Creates the edX standard virtual env associated with 
-# a particular service account.  The name of the account, the
-# path to the accounts home directory and the name of the 
-# virtualenv are provided as parameters.
-# 
-# Dependencies:
-#
-#   * common
-# 
-# Example play:
-#
-#   roles:
-#   - common
-#   - role: virtualenv
-#     virtualenv_user: "{{ user }}"
-#     virtualenv_user_home: "{{ user_home }}"
-#     virtualenv_name: "{{ name }}"
-#
-# Parameters:
-#  
-#   * virtualenv_user
-#   * virtualenv_user_home
-#   * virtualenv_name
-#
-
-- fail: virtualenv_user required for role
-  when: virtualenv_user is not defined
-
-- fail: virtualenv_user_home required for role
-  when: virtualenv_user_home is not defined
-
-- fail: virtualenv_name required for role
-  when: virtualenv_name is not defined
-
-- name: virtualenv | create {{ virtualenv_user_home }}
-  # workaround for the case where the parent
-  # directory doesn't exist
-  file: >
-    path={{ virtualenv_user_home }} 
-    state=directory
-  tags: 
-    - install
-    - update
-
-- name: virtualenv | create virtualenv user {{ virtualenv_user }}
-  user: >
-    name={{ virtualenv_user }} 
-    state=present 
-    shell=/bin/bash 
-    home={{ virtualenv_user_home }}
-    createhome=yes
-  tags:
-  - install
-  - update
-
-- name: virtualenv | ensure homedir permissions {{ virtualenv_user_home }}
-  # workaround for the case where the parent
-  # directory doesn't exist
-  file: >
-    path={{ virtualenv_user_home }} 
-    owner={{ virtualenv_user }}
-    group={{ virtualenv_user }}
-    state=directory
-  tags:
-    - install
-    - update
-
-- name: virtualenv | install pre-requisities
-  apt: pkg={{','.join(virtualenv_apt_pkgs)}} install_recommends=yes state=present update_cache=yes
-  tags:
-  - install
-  - update
-
-- name: virtualenv | pip install virtualenv
-  pip: name=virtualenv state=latest
-  with_items: virtualenv_python_pkgs
-  tags:
-  - install
-  - update
-
-- name: virtualenv | create virtualenv directory
-  file: 
-    path="{{ virtualenv_user_home }}/virtualenvs/{{ virtualenv_name }}" owner={{ virtualenv_user }} 
-    group={{ virtualenv_user }}  mode=2775 state=directory recurse=yes
-  tags:
-  - install
-  - update
-
-- name: virtualenv | create the virtualenv directory initial contents
-  command: 
-    /usr/local/bin/virtualenv "{{ virtualenv_user_home }}/virtualenvs/{{ virtualenv_name }}" --distribute 
-    creates="{{ virtualenv_user_home }}/virtualenvs/{{ virtualenv_name }}/bin/activate"
-  sudo: yes
-  sudo_user: "{{ virtualenv_user }}"
-  tags:
-  - install
-  - update
-
-- name:  virtualenv | pip install gunicorn
-  pip: 
-    name=gunicorn virtualenv="{{ virtualenv_user_home }}/virtualenvs/{{ virtualenv_name }}" 
-    state=present
-  sudo: yes
-  sudo_user: "{{ virtualenv_user }}"
-  tags:
-  - install
-  - update
\ No newline at end of file

playbooks/roles/xqueue/defaults/main.yml

@@ -4,19 +4,20 @@
 XQUEUE_NGINX_PORT: 18040
 XQUEUE_BASIC_AUTH: False
 
-xqueue_code_dir: "{{ app_base_dir }}/xqueue"
+xqueue_app_dir: "{{ COMMON_APP_DIR }}/xqueue"
+xqueue_code_dir: "{{ xqueue_app_dir }}/xqueue"
+xqueue_data_dir: "{{ COMMON_DATA_DIR }}/xqueue"
+xqueue_venvs_dir: "{{ xqueue_app_dir }}/venvs"
+xqueue_venv_dir: "{{ xqueue_venvs_dir }}/xqueue"
+xqueue_venv_bin: "{{ xqueue_venv_dir }}/bin"
+xqueue_user: "xqueue"
 
 # Default nginx listen port
 # These should be overrided if you want
 # to serve all content on port 80
-xqueue_code_dir: "{{ app_base_dir }}/xqueue"
 xqueue_gunicorn_port: 8040
 xqueue_gunicorn_host: 127.0.0.1
 
-xqueue_user: "xqueue"
-xqueue_user_home: "/opt/xqueue"
-xqueue_venv_dir: "{{ xqueue_user_home }}/virtualenvs/{{ xqueue_user }}"
-
 XQUEUE_QUEUES:
   # push queue
   'edX-DemoX': 'http://localhost:18050'
@@ -47,11 +48,11 @@ XQUEUE_MYSQL_PORT: '3306'
 xqueue_env_config:
   XQUEUES: $XQUEUE_QUEUES
   XQUEUE_WORKERS_PER_QUEUE: 12
-  LOGGING_ENV: $XQUEUE_LOGGING_ENV
+  LOGGING_ENV : $XQUEUE_LOGGING_ENV
   SYSLOG_SERVER: $XQUEUE_SYSLOG_SERVER
-  LOG_DIR: "{{ storage_base_dir }}/logs/xqueue"
-  RABBIT_HOST: $XQUEUE_RABBITMQ_HOSTNAME
-  S3_BUCKET: $XQUEUE_S3_BUCKET
+  LOG_DIR : "{{ COMMON_DATA_DIR }}/logs/xqueue"
+  RABBIT_HOST : $XQUEUE_RABBITMQ_HOSTNAME
+  S3_BUCKET : $XQUEUE_S3_BUCKET
   S3_PATH_PREFIX: $XQUEUE_S3_PATH_PREFIX
   LOCAL_LOGLEVEL: $XQUEUE_LOCAL_LOGLEVEL
 

playbooks/roles/xqueue/tasks/deploy.yml

@@ -2,97 +2,74 @@
 - name: xqueue | stop xqueue service
   service: name=xqueue state=stopped
   tags:
-  - xqueue
   - deploy
 
 - name: xqueue | stop xqueue consumer service
   service: name=xqueue_consumer state=stopped
   tags:
-  - xqueue
   - deploy
 
 - name: xqueue | create xqueue application config
-  template: src=xqueue.env.json.j2 dest={{app_base_dir}}/xqueue.env.json mode=0640 owner={{ xqueue_user }} group=adm
+  template: src=xqueue.env.json.j2 dest={{ xqueue_app_dir }}/xqueue.env.json mode=0644
+  sudo_user: "{{ xqueue_user }}"
   tags:
-  - xqueue
   - deploy
 
 - name: xqueue | create xqueue auth file
-  template: src=xqueue.auth.json.j2 dest={{app_base_dir}}/xqueue.auth.json mode=0640 owner={{ xqueue_user }} group=adm
+  template: src=xqueue.auth.json.j2 dest={{ xqueue_app_dir }}/xqueue.auth.json mode=0644
+  sudo_user: "{{ xqueue_user }}"
   tags:
-  - xqueue
   - deploy
 
 # Do A Checkout
-- name: xqueue | git checkout xqueue repo into {{app_base_dir}}
-  git: dest={{xqueue_code_dir}} repo={{xqueue_source_repo}} version={{xqueue_version}}
+- name: xqueue | git checkout xqueue repo into xqueue_code_dir
+  git: dest={{ xqueue_code_dir }} repo={{ xqueue_source_repo }} version={{ xqueue_version }}
+  sudo_user: "{{ xqueue_user }}"
   tags:
-  - xqueue
   - deploy
 
-# Do Post Checkout Tasks.
-- name: xqueue | create xqueue code dir
-  file: path={{xqueue_code_dir}} state=directory owner={{ xqueue_user }} group={{ xqueue_user }} mode=755
-  tags:
-  - xqueue
-  - deploy
-
-
-# TODO: Check git.py _run_if_changed() to see if the logic there to skip running certain
-# portions of the deploy needs to be incorporated here.
-
-- name: xqueue | sets permissions on xqueue code dir and contents
-  file: path={{xqueue_code_dir}} state=directory owner={{ xqueue_user }} group={{ xqueue_user }} recurse=yes
-  # Post Checkout tasks will get run as handlers when the {{ xqueue_code_dir }} is ready.
-  # Look at the handlers/main.yml in this role for a description of the tasks stated below.
-  tags:
-  - xqueue
-  - deploy
 
 # Install the python pre requirements into {{ xqueue_venv_dir }}
 - name : install python pre-requirements
-  pip: requirements="{{xqueue_pre_requirements_file}}" virtualenv="{{xqueue_venv_dir}}" state=present
+  pip: requirements="{{ xqueue_pre_requirements_file }}" virtualenv="{{ xqueue_venv_dir }}" state=present
+  sudo_user: "{{ xqueue_user }}"
   tags:
-  - xqueue
   - deploy
 
 # Install the python post requirements into {{ xqueue_venv_dir }}
 - name : install python post-requirements
-  pip: requirements="{{xqueue_post_requirements_file}}" virtualenv="{{xqueue_venv_dir}}" state=present
+  pip: requirements="{{ xqueue_post_requirements_file }}" virtualenv="{{ xqueue_venv_dir }}" state=present
+  sudo_user: "{{ xqueue_user }}"
   tags:
-  - xqueue
   - deploy
 
 - name: xqueue | syncdb and migrate
-  shell: sudo -u {{ xqueue_user }} SERVICE_VARIANT=xqueue {{ xqueue_venv_dir }}/bin/django-admin.py syncdb --migrate --noinput --settings=xqueue.aws_settings --pythonpath=/opt/wwc/xqueue
+  shell: >
+    SERVICE_VARIANT=xqueue {{ xqueue_venv_bin }}/django-admin.py syncdb --migrate --noinput --settings=xqueue.aws_settings --pythonpath={{ xqueue_code_dir }}
   when: migrate_db is defined and migrate_db|lower == "yes"
+  sudo_user: "{{ xqueue_user }}"
   tags:
-  - xqueue
-  - syncdb
   - deploy
 
 - name: xqueue | create users
-  shell: sudo -u {{ xqueue_user }} SERVICE_VARIANT=xqueue {{ xqueue_venv_dir }}/bin/django-admin.py update_users --settings=xqueue.aws_settings --pythonpath=/opt/wwc/xqueue
+  shell: >
+    SERVICE_VARIANT=xqueue {{ xqueue_venv_bin }}/django-admin.py update_users --settings=xqueue.aws_settings --pythonpath={{ xqueue_code_dir }}
   when: update_users is defined
+  sudo_user: "{{ xqueue_user }}"
   tags:
-  - xqueue
-  - syncdb
   - deploy
 
 - name: xqueue | stop xqueue
   service: name=xqueue state=stopped
   tags:
-  - xqueue
   - deploy
 
 - name: xqueue | start xqueue
   service: name=xqueue state=started
   tags:
-  - xqueue
   - deploy
 
 - name: xqueue | start xqueue consumer
   service: name=xqueue_consumer state=started
   tags:
-  - xqueue
   - deploy

playbooks/roles/xqueue/tasks/main.yml

@@ -3,46 +3,32 @@
 #  - common/tasks/main.yml
 ---
 # Check out xqueue repo to {{xqueue_code_dir}}
-- name: xqueue | install git and its recommends
-  apt: pkg=git state=present install_recommends=yes 
-  tags:
-  - xqueue
+#
+#
+
+- name: xqueue | create application user
+  user: >
+    name="{{ xqueue_user }}"
+    home="{{ xqueue_app_dir }}"
+    createhome=no
+    shell=/bin/false
+
+- name: xqueue | create xqueue app and venv dir
+  file: >
+    path="{{ item }}"
+    state=directory
+    owner="{{ xqueue_user }}"
+    group="{{ common_web_group }}"
+  with_items:
+    - "{{ xqueue_app_dir }}"
+    - "{{ xqueue_venvs_dir }}"
 
 - name: xqueue | install a bunch of system packages on which xqueue relies
   apt: pkg={{','.join(xqueue_debian_pkgs)}} state=present
   notify:
   - xqueue | restart xqueue
   - xqueue | restart xqueue consumer
-  tags:
-  - xqueue
-
-- name: xqueue | create {{ xqueue_user_home }}
-  # workaround for the case where the parent
-  # directory doesn't exist
-  file: >
-    path={{ xqueue_user_home }}
-    state=directory
-
-- name: xqueue | create xqueue user {{ xqueue_user }}
-  user: >
-    name={{ xqueue_user }}
-    state=present
-    shell=/bin/bash
-    home={{ xqueue_user_home }}
-    createhome=yes
-  tags:
-  - forum
-  - update
 
-- name: xqueue | ensure homedir permissions {{ xqueue_user_home }}
-  # workaround for the case where the parent
-  # directory doesn't exist
-  file: >
-    path={{ xqueue_user_home }}
-    owner={{ xqueue_user }}
-    group={{ xqueue_user }}
-    state=directory
-    recurse=yes
 
 - name: xqueue | create xqueue db
   mysql_db: >
@@ -56,17 +42,14 @@
 
 - name: xqueue | creating xqueue upstart script
   template: src=xqueue.conf.j2 dest=/etc/init/xqueue.conf mode=0640 owner=root group=adm
-  tags:
-  - xqueue
-  - deploy
 
 - name: xqueue | create xqueue consumer upstart script
   template: src=xqueue_consumer.conf.j2 dest=/etc/init/xqueue_consumer.conf mode=0640 owner=root group=adm
-  tags:
-  - xqueue
-  - deploy
-
-
-
 
 - include: deploy.yml
+
+- name: xqueue | create a symlink for venv python
+  file: >
+    src="{{ xqueue_venv_bin }}/python"
+    dest={{ COMMON_BIN_DIR }}/python.xqueue
+    state=link

playbooks/roles/xserver/defaults/main.yml

@@ -14,26 +14,35 @@ XSERVER_SYSLOG_SERVER: ''
 # source repo
 XSERVER_GRADER_CHECKOUT: False
 
+xserver_app_dir: "{{ COMMON_APP_DIR }}/xserver"
+xserver_code_dir: "{{ xserver_app_dir }}/xserver"
+xserver_data_dir: "{{ COMMON_DATA_DIR }}/xserver"
+xserver_venvs_dir: "{{ xserver_app_dir }}/venvs"
+xserver_venv_dir: "{{ xserver_venvs_dir }}/xserver"
+xserver_venv_sandbox_dir: "{{ xserver_venv_dir }}-sandbox"
+xserver_venv_bin: "{{ xserver_venv_dir }}/bin"
+xserver_user: "xserver"
+xserver_sandbox_user: "xserver-sandbox"
+xserver_log_dir: "{{ COMMON_LOG_DIR }}/xserver"
+
 xserver_env_config:
   RUN_URL: $XSERVER_RUN_URL
   GRADER_ROOT: $XSERVER_GRADER_ROOT
   LOGGING_ENV: $XSERVER_LOGGING_ENV
-  LOG_DIR: "{{ storage_base_dir }}/logs/xserver"
+  LOG_DIR: "{{ xserver_log_dir }}"
   SYSLOG_SERVER: $XSERVER_SYSLOG_SERVER
-  SANDBOX_PYTHON: '/opt/edx_apparmor_sandbox/bin/python'
+  SANDBOX_PYTHON: '{{ xserver_venv_sandbox_dir }}/bin/python'
 
 xserver_git_identity_path: "{{ secure_dir }}/files/git-identity"
-xserver_code_dir: "{{ app_base_dir }}/xserver"
 xserver_source_repo: "git://github.com/edx/xserver.git"
 # This should probably be overridden in the playbook or groupvars
 # with the default pointing to the head of master.
 xserver_version: HEAD
 
-xserver_grader_dir: "{{ app_base_dir }}/data/content-mit-600x~2012_Fall"
+xserver_grader_dir: "{{ xserver_data_dir }}/data/content-mit-600x~2012_Fall"
 xserver_grader_source: "git@github.com:/MITx/6.00x.git"
 xserver_grader_version: HEAD
 
-xserver_sandbox_venv_dir: "{{ venv_dir }}_apparmor_sandbox"
 
 xserver_requirements_file: "{{ xserver_code_dir }}/requirements.txt"
 
@@ -50,3 +59,4 @@ xserver_debian_pkgs:
   - libxml2-utils
   - libxslt1-dev
   - python-dev
+  - apparmor-utils

playbooks/roles/xserver/files/git-identity-example

+example identity file

playbooks/roles/xserver/files/sandbox.conf

-sandbox       hard   core  0
-sandbox       hard   data  100000
-sandbox       hard   fsize 10000
-sandbox       hard   memlock 10000
-sandbox       hard   nofile 20
-sandbox       hard   rss    10000
-sandbox       hard   stack  100000
-sandbox       hard   cpu    0
-sandbox       hard   nproc  8
-sandbox       hard   as     32000
-sandbox       hard   maxlogins  1
-sandbox       hard   priority  19
-sandbox       hard   locks     4
-sandbox       hard   sigpending  100
-sandbox       hard   msgqueue  100000
-sandbox       hard   nice     19

playbooks/roles/xserver/tasks/deploy.yml

@@ -5,34 +5,42 @@
 
 - name: xserver | checkout code
   git: dest={{xserver_code_dir}} repo={{xserver_source_repo}} version={{xserver_version}}
+  sudo_user: "{{ xserver_user }}"
   tags:
   - deploy
 
 - name: xserver | install requirements
-  pip: requirements="{{xserver_requirements_file}}" virtualenv="{{venv_dir}}" state=present
+  pip: requirements="{{xserver_requirements_file}}" virtualenv="{{ xserver_venv_dir }}" state=present
+  sudo_user: "{{ xserver_user }}"
   tags:
   - deploy
 
 - name: xserver | install sandbox requirements
-  pip: requirements="{{xserver_requirements_file}}" virtualenv="{{xserver_sandbox_venv_dir}}" state=present
+  pip: requirements="{{xserver_requirements_file}}" virtualenv="{{xserver_venv_sandbox_dir}}" state=present
+  sudo_user: "{{ xserver_user }}"
   tags:
   - deploy
 
 - name: xserver | create xserver application config
-  template: src=xserver.env.json.j2 dest={{app_base_dir}}/env.json mode=640 owner=www-data group=adm
+  template: src=xserver.env.json.j2 dest={{ xserver_app_dir }}/env.json
+  sudo_user: "{{ xserver_user }}"
   tags:
   - deploy
 
 - name: xserver | install read-only ssh key for the content repo that is required for grading
-  copy: src={{ xserver_git_identity_path }} dest=/etc/git-identity force=yes owner=ubuntu group=adm mode=60
+  copy: src={{ item }} dest=/etc/git-identity force=yes owner=ubuntu group=adm mode=60
+  first_available_file:
+    - "{{ secure_dir }}/files/git-identity"
+    - "git-identity-example"
   tags:
   - deploy
 
 - name: xserver | checkout grader code
-  git: dest={{xserver_grader_dir}} repo={{xserver_grader_source}} version={{xserver_grader_version}}
+  git: dest={{ xserver_grader_dir }} repo={{ xserver_grader_source }} version={{ xserver_grader_version }}
   environment:
     GIT_SSH: /tmp/git_ssh.sh
   when: XSERVER_GRADER_CHECKOUT
+  sudo_user: "{{ xserver_user }}"
   tags:
   - deploy
 

playbooks/roles/xserver/tasks/main.yml

@@ -3,21 +3,34 @@
 # access to the edX 6.00x repo which is not public
 ---
 
-- name: xserver | ensure sandbox group exists
-  group: name=sandbox
+- name: xserver | create application user
+  user: >
+    name="{{ xserver_user }}"
+    home="{{ xserver_app_dir }}"
+    createhome=no
+    shell=/bin/false
 
-- name: xserver | ensure sandbox user exists
-  user: name=sandbox group=sandbox
+- name: xserver | create application sandbox user
+  user: >
+    name="{{ xserver_sandbox_user }}"
+    createhome=no
+    shell=/bin/false
 
-- name: xserver | create sandbox python directory
-  file: path={{ xserver_sandbox_venv_dir }} owner=ubuntu group=adm mode=2775 state=directory
+
+- name: xserver | create xserver app and data dirs
+  file: >
+    path="{{ item }}"
+    state=directory
+    owner="{{ xserver_user }}"
+    group="{{ common_web_group }}"
+  with_items:
+    - "{{ xserver_app_dir }}"
+    - "{{ xserver_venvs_dir }}"
+    - "{{ xserver_data_dir }}"
 
 - name: xserver | create sandbox sudoers file
   template: src=99-sandbox.j2 dest=/etc/sudoers.d/99-sandbox owner=root group=root mode=0440
 
-- name: xserver | create sandbox python
-  command: /usr/local/bin/virtualenv {{ xserver_sandbox_venv_dir }} --distribute creates={{ xserver_sandbox_venv_dir }}/bin/activate
-
 # Make sure this line is in the common-session file.
 - name: xserver | ensure pam-limits module is loaded
   lineinfile:
@@ -26,13 +39,14 @@
     line="session required pam_limits.so"
 
 - name: xserver | set sandbox limits
-  copy: src={{ item }} dest=/etc/security/limits.d/sandbox.conf
+  template: src={{ item }} dest=/etc/security/limits.d/sandbox.conf
   first_available_file:
-  - "{{ secure_dir }}/sandbox.conf"
-  - "sandbox.conf"
+  - "{{ secure_dir }}/sandbox.conf.j2"
+  - "sandbox.conf.j2"
 
-- name: xserver | ensure apparmor package
-  apt: pkg=apparmor-utils state=present
+- name: xserver | install system dependencies of xserver
+  apt: pkg={{ item }} state=present
+  with_items: xserver_debian_pkgs
 
 - name: xserver | load python-sandbox apparmor profile
   template: src={{ item }} dest=/etc/apparmor.d/edx_apparmor_sandbox
@@ -40,17 +54,20 @@
   - "{{ secure_dir }}/files/edx_apparmor_sandbox.j2"
   - "usr.bin.python-sandbox.j2"
 
-- name: xserver | enforce app-armor rules
-  command: aa-enforce {{ xserver_sandbox_venv_dir }}
-
 - name: xserver | setup upstart script
   template: src=xserver.conf.j2 dest=/etc/init/xserver.conf owner=root group=root
 
-- name: xserver | install system dependencies of xserver
-  apt: pkg={{ item }} state=present
-  with_items: xserver_debian_pkgs
-
 - name: xserver | upload ssh script
   copy: src=git_ssh.sh dest=/tmp/git_ssh.sh force=yes owner=root group=adm mode=750
 
 - include: deploy.yml
+
+- name: xserver | enforce app-armor rules
+  command: aa-enforce {{ xserver_venv_sandbox_dir }}
+
+- name: xserver | create a symlink for venv python
+  file: >
+    src="{{ xserver_venv_bin }}/python"
+    dest={{ COMMON_BIN_DIR }}/python.xserver
+    state=link
+

playbooks/roles/xserver/templates/99-sandbox.j2

-www-data ALL=(sandbox) NOPASSWD:{{xserver_sandbox_venv_dir}}/bin/python
+www-data ALL=({{ xserver_sandbox_user }}) NOPASSWD:{{xserver_venv_sandbox_dir}}/bin/python

playbooks/roles/xserver/templates/sandbox.conf.j2

+{{ xserver_sandbox_user }}       hard   core  0
+{{ xserver_sandbox_user }}       hard   data  100000
+{{ xserver_sandbox_user }}       hard   fsize 10000
+{{ xserver_sandbox_user }}       hard   memlock 10000
+{{ xserver_sandbox_user }}       hard   nofile 20
+{{ xserver_sandbox_user }}       hard   rss    10000
+{{ xserver_sandbox_user }}       hard   stack  100000
+{{ xserver_sandbox_user }}       hard   cpu    0
+{{ xserver_sandbox_user }}       hard   nproc  8
+{{ xserver_sandbox_user }}       hard   as     32000
+{{ xserver_sandbox_user }}       hard   maxlogins  1
+{{ xserver_sandbox_user }}       hard   priority  19
+{{ xserver_sandbox_user }}       hard   locks     4
+{{ xserver_sandbox_user }}       hard   sigpending  100
+{{ xserver_sandbox_user }}       hard   msgqueue  100000
+{{ xserver_sandbox_user }}       hard   nice     19

playbooks/roles/xserver/templates/xserver.conf.j2

@@ -10,8 +10,8 @@ respawn
 respawn limit 3 30
 
 env PID=/var/tmp/xserver.pid
-env NEW_RELIC_CONFIG_FILE={{ app_base_dir }}/newrelic.ini
-env NEWRELIC={{ venv_dir }}/bin/newrelic-admin
+env NEW_RELIC_CONFIG_FILE={{ xserver_app_dir }}/newrelic.ini
+env NEWRELIC={{ xserver_venv_dir }}/bin/newrelic-admin
 env WORKERS={{ ansible_processor|length }}
 env PORT={{ xserver_gunicorn_port }}
 env ADDRESS={{ xserver_gunicorn_host }}
@@ -23,5 +23,5 @@ env SERVICE_VARIANT="xserver"
 chdir {{ xserver_code_dir }}
 setuid www-data
 
-exec {{ venv_dir }}/bin/gunicorn --preload -b $ADDRESS:$PORT -w $WORKERS --timeout=30 --pythonpath={{ xserver_code_dir }} pyxserver_wsgi:application
+exec {{ xserver_venv_dir }}/bin/gunicorn --preload -b $ADDRESS:$PORT -w $WORKERS --timeout=30 --pythonpath={{ xserver_code_dir }} pyxserver_wsgi:application
 

playbooks/secure_example/vars/edxapp_ref_vars.yml

@@ -178,7 +178,7 @@ cms_env_config:
       'KEY_PREFIX':  'hidden-prod'
       'LOCATION': [ 'hidden-prod',
         'hidden-prod']
-  'LOG_DIR': '{{log_base_dir}}/edx'
+  'LOG_DIR': '{{ COMMON_LOG_DIR }}/edx'
   'LOGGING_ENV': 'cms-dev'
   'SITE_NAME': 'studio.cms-dev.m.edx.org'
   'SYSLOG_SERVER': 'syslog.a.m.i4x.org'

playbooks/vagrant-fullstack.yml

@@ -17,6 +17,7 @@
       - xserver
       - xqueue
     - edxlocal
+    - supervisor
     - mongo
     - edxapp
     - { role: 'rabbitmq', rabbitmq_ip: '127.0.0.1' }

playbooks/vagrant-shortstack-xml.yml

@@ -15,5 +15,6 @@
       - cms
       - lms-preview
     - edxlocal
+    - supervisor
     - mongo
     - { role: 'edxapp', EDXAPP_LMS_NGINX_PORT: 18030, EDXAPP_LMS_XML_NGINX_PORT: 80 }

playbooks/vagrant-shortstack.yml

@@ -15,6 +15,7 @@
       - cms
       - lms-preview
     - edxlocal
+    - supervisor
     - mongo
     - edxapp
     - oraclejdk

util/jenkins/ansible-deploy.sh

@@ -48,8 +48,8 @@ ora_version: $ora_version
 ease_version: $ease_version
 
 ansible_ssh_private_key_file: /var/lib/jenkins/${keypair}.pem
-PYPI_MIRROR_URL: 'https://pypi.edx.org/root/pypi/+simple/'
-GIT_MIRROR: 'git.edx.org'
+COMMON_PYPI_MIRROR_URL: 'https://pypi.edx.org/root/pypi/+simple/'
+COMMON_GIT_MIRROR: 'git.edx.org'
 
 migrate_only: '$run_migration'
 EOF

util/jenkins/ansible-provision.sh

@@ -79,21 +79,13 @@ region: $region
 instance_tags: '{"environment": "$environment", "github_username": "$github_username", "Name": "$name_tag", "source": "jenkins", "owner": "$BUILD_USER"}'
 root_ebs_size: $root_ebs_size
 name_tag: $name_tag
-PYPI_MIRROR_URL: 'https://pypi.edx.org/root/pypi/+simple/'
-GIT_MIRROR: 'git.edx.org'
+COMMON_PYPI_MIRROR_URL: 'https://pypi.edx.org/root/pypi/+simple/'
+COMMON_GIT_MIRROR: 'git.edx.org'
 gh_users:
-  - user: jarv
-    groups:
-    - adm
-  - user: feanil
-    groups:
-    - adm
-  - user: e0d
-    groups:
-    - adm
-  - user: ${github_username}
-    groups:
-    - adm
+  - jarv
+  - feanil
+  - e0d
+  - ${github_username}
 dns_zone: $dns_zone
 EOF