Merge branch 'edx-west/release' of github.com:edx/configuration into edx-west/release

playbooks/edx-west/carnegie-prod-app.yml

@@ -21,11 +21,13 @@
     - "{{ secure_dir }}/vars/datadog_carn.yml"
   roles:
     - common
+    - php
     - role: nginx
       nginx_sites:
       - lms
       - cms
       - lms-preview
+      - phpmyadmin
       nginx_template_directory: "{{local_dir}}/nginx/templates/carnegie/"
     - {'role': 'edxapp', 'openid_workaround': true}
     - datadog

playbooks/edx-west/carnegie-prod-phpmyadmin.yml

+- hosts: ~tag_Name_app(10|20)_carn
+#- hosts: ~tag_Name_app20_carn
+  sudo: True
+  vars:
+    secure_dir: '../../../configuration-secure/ansible'
+    # this indicates the path to site-specific (with precedence)
+    # things like nginx template files
+    #local_dir:  '../../../edx-secret/ansible/local'
+    local_dir: "{{secure_dir}}/local"
+    # this toggles http basic auth on and off. false in production
+    not_prod: false
+  vars_files:
+    - "{{ secure_dir }}/vars/edxapp_carnegie_vars.yml"
+    - "{{ secure_dir }}/vars/users.yml"
+    - "{{ secure_dir }}/vars/edxapp_prod_users.yml"
+    - "{{ secure_dir }}/vars/datadog_prod.yml"
+  roles:
+    - php
+    - role: nginx
+      nginx_sites:
+      - phpmyadmin

playbooks/edx-west/carnegie-prod-worker.yml

@@ -19,3 +19,20 @@
     - { role: 'edxapp', celery_worker: True }
     - datadog
     #- splunkforwarder
+
+# run the certificate agent on the first util machine only
+- hosts: ~tag_Name_util10_carn
+  sudo: True
+  vars:
+    secure_dir: '../../../configuration-secure/ansible'
+    migrate_db: "no"
+  vars_files:
+    - "{{ secure_dir }}/vars/edxapp_stage_vars.yml"
+    - "{{ secure_dir }}/vars/certifier_prod_vars.yml"
+  roles:
+    - common
+    - role: virtualenv
+      virtualenv_user: "certifier"
+      virtualenv_name: "certifier"
+      virtualenv_user_home: "/opt/wwc/certifier"
+    - certificates

playbooks/edx-west/cme-prod-app.yml

@@ -14,7 +14,7 @@
 #- hosts: tag_environment_prod:&tag_function_webserver
 # or we can get subsets of them by name
 - hosts: ~tag_Name_app(10|20)_cme
-#- hosts: ~tag_Name_app10_cme
+#- hosts: ~tag_Name_app20_cme
   sudo: True
   vars_prompt:
     - name: "migrate_db"
@@ -25,13 +25,13 @@
     secure_dir: '../../../edx-secret/ansible'
     # this indicates the path to site-specific (with precedence)
     # things like nginx template files
-    local_dir:  '../../../../../../edx-secret/ansible/local'
+    local_dir:  '{{ secure_dir }}/local'
     not_prod: true
   vars_files:
     - "{{ secure_dir }}/vars/edxapp_cme_vars.yml"
     - "{{ secure_dir }}/vars/users.yml"
     - "{{ secure_dir }}/vars/edxapp_prod_users.yml"
-    - "{{ secure_dir }}/vars/datadog_stage.yml"
+    - "{{ secure_dir }}/vars/datadog_cme.yml"
   roles:
     #- ansible_debug
     - common

playbooks/edx-west/cme-prod-worker.yml

@@ -7,15 +7,32 @@
     secure_dir: '../../../edx-secret/ansible'
     # this indicates the path to site-specific (with precedence)
     # things like nginx template files
-    local_dir:  '../../../../../../edx-secret/ansible/local'
+    local_dir:  '{{ secure_dir }}/local'
     migrate_db: "no"
   vars_files:
     - "{{ secure_dir }}/vars/edxapp_cme_vars.yml"
     - "{{ secure_dir }}/vars/users.yml"
     - "{{ secure_dir }}/vars/edxapp_prod_users.yml"
-    - "{{ secure_dir }}/vars/datadog_stage.yml"
+    - "{{ secure_dir }}/vars/datadog_cme.yml"
   roles:
     - common
     - { role: 'edxapp', celery_worker: True }
     - datadog
     #- splunkforwarder
+
+# run the certificate agent on the first util machine only
+- hosts: ~tag_Name_util10_cme
+  sudo: True
+  vars:
+    secure_dir: '../../../configuration-secure/ansible'
+    migrate_db: "no"
+  vars_files:
+    - "{{ secure_dir }}/vars/edxapp_stage_vars.yml"
+    - "{{ secure_dir }}/vars/certifier_prod_vars.yml"
+  roles:
+    - common
+    - role: virtualenv
+      virtualenv_user: "certifier"
+      virtualenv_name: "certifier"
+      virtualenv_user_home: "/opt/wwc/certifier"
+    - certificates

playbooks/edx-west/prod-app.yml

 # this gets all running prod webservers
 #- hosts: tag_environment_prod:&tag_function_webserver
 # or we can get subsets of them by name
+#- hosts: ~tag_Name_app(4|11|21|10|20)_prod
 #- hosts: ~tag_Name_app(10|20)_prod
 #- hosts: ~tag_Name_app(11|21)_prod
 ## this is the test box

playbooks/edx-west/prod-worker.yml

@@ -4,10 +4,10 @@
 #- hosts: ~tag_Name_util20_prod
   sudo: True
   vars:
-    secure_dir: '../../../configuration-secure/ansible'
     # this indicates the path to site-specific (with precedence)
     # things like nginx template files
-    local_dir:  '../../../configuration-secure/ansible/local'
+    secure_dir: '../../../configuration-secure/ansible'
+    local_dir:  '{{secure_dir}}/local'
     migrate_db: "no"
   vars_files:
     - "{{ secure_dir }}/vars/edxapp_prod_vars.yml"
@@ -21,6 +21,23 @@
     - datadog
     #- splunkforwarder
 
+# run the certificate agent on the first util machine only
+- hosts: ~tag_Name_util10_prod
+  sudo: True
+  vars:
+    secure_dir: '../../../configuration-secure/ansible'
+    migrate_db: "no"
+  vars_files:
+    - "{{ secure_dir }}/vars/edxapp_stage_vars.yml"
+    - "{{ secure_dir }}/vars/certifier_prod_vars.yml"
+  roles:
+    - common
+    - role: virtualenv
+      virtualenv_user: "certifier"
+      virtualenv_name: "certifier"
+      virtualenv_user_home: "/opt/wwc/certifier"
+    - certificates
+
 #
 # COMMENT OUT THE NOTIFIER UNTIL IT IS READY
 #

playbooks/edx-west/stage-certificates-only.yml

+# run the certificate agent on the first util machine only
+- hosts: ~tag_Name_util10_stage
+  sudo: True
+  vars:
+    secure_dir: '../../../configuration-secure/ansible'
+    migrate_db: "no"
+  vars_files:
+    - "{{ secure_dir }}/vars/edxapp_stage_vars.yml"
+    - "{{ secure_dir }}/vars/certifier_stage_vars.yml"
+  roles:
+    - common
+    - role: virtualenv
+      virtualenv_user: certifier
+      virtualenv_name: certifier
+      virtualenv_user_home: /opt/wwc/certifier
+    - certificates
+

playbooks/edx-west/stage-worker.yml

@@ -4,10 +4,10 @@
 #- hosts: ~tag_Name_util(1|2)_stage
   sudo: True
   vars:
-    secure_dir: ../../../edx-secret/ansible
     # this indicates the path to site-specific (with precedence)
     # things like nginx template files
-    local_dir: ../../../edx-secret/ansible/local
+    secure_dir: ../../../edx-secret/ansible
+    local_dir: {{secure_dir}}/local
     migrate_db: "no"
   vars_files:
     - "{{ secure_dir }}/vars/edxapp_stage_vars.yml"
@@ -35,3 +35,20 @@
       virtualenv_user_home: "/opt/wwc/notifier"
       virtualenv_name: "notifier"
     - notifier
+
+# run the certificate agent on the first util machine only
+- hosts: ~tag_Name_util10_stage
+  sudo: True
+  vars:
+    secure_dir: '../../../configuration-secure/ansible'
+    migrate_db: "no"
+  vars_files:
+    - "{{ secure_dir }}/vars/edxapp_stage_vars.yml"
+    - "{{ secure_dir }}/vars/certifier_stage_vars.yml"
+  roles:
+    - common
+    - role: virtualenv
+      virtualenv_user: "certifier"
+      virtualenv_name: "certifier"
+      virtualenv_user_home: "/opt/wwc/certifier"
+    - certificates

playbooks/roles/certificates/files/git_ssh.sh

+#!/bin/sh
+exec /usr/bin/ssh -o StrictHostKeyChecking=no -i /{{certs_home}}/git-identity "$@"

playbooks/roles/certificates/handlers/main.yml

+- name: certifier | restart certificate-agent
+  supervisorctl: name=certifier-certificate-agent state=restarted

playbooks/roles/certificates/tasks/main.yml

+# requires:
+#  - group_vars/all
+#  - common/tasks/main.yml
+#  - nginx/tasks/main.yml
+---
+
+- name: certificates | create certificates user {{ certs_user }}
+  user:
+    name={{certs_user}} state=present shell=/bin/bash home={{certs_home}} createhome=yes
+  tags:
+  - certificates
+  - install
+  - update
+
+- name: certificates | create location for gpg information
+  file: state=directory path={{certs_home}}/.gpg mode=0700 owner={{certs_user}} 
+  tags:
+  - certificates
+  - install
+  - update
+
+- name: certificates | put gpg information in place
+  copy: src={{secure_dir}}/files/{{item}} dest={{cert_gpg}}/{{item}} mode=0400 owner={{certs_user}} 
+  with_items:
+  - gpg.conf
+  - pubring.gpg
+  - secring.gpg
+  tags:
+  - certificates
+  - install
+  - update
+
+- name: certificates | create certificates log location
+  file: state=directory path={{certs_logs_dir}} mode=0770 owner={{certs_user}} group=adm
+  tags:
+  - certificates
+  - install
+  - update
+
+- name: certificates | upload ssh script
+  copy: src=git_ssh.sh dest=/tmp/git_ssh.sh force=yes owner=root group=adm mode=750
+  tags:
+  - certificates
+  - install
+  - update
+
+- name: certificates | install read-only ssh key for the certs repo
+  copy: src={{secure_dir}}/files/git-identity dest=/{{certs_home}}/git-identity force=yes owner={{certs_user}} group=adm mode=600
+  tags:
+  - certificates
+  - install
+  - update
+
+- name: certificates | checkout certificate code
+  git: dest={{certs_home}}/src repo={{certs_repo}} version={{certs_ver}}
+  environment:
+    GIT_SSH: /tmp/git_ssh.sh
+  tags:
+  - certificates
+  - install
+  - deploy
+
+- name: certificates | fixup permissions on repo
+  # TODO: after remote_user is available in ansible dist, use that in the above task instead of manual perms fixup
+  file: path={{certs_home}}/src state=directory recurse=yes owner={{certs_user}} group=adm mode=755
+  tags:
+  - certificates
+  - install
+  - deploy
+  
+- name: certificates | install prerequisites
+  pip: requirements={{certs_home}}/src/requirements.txt virtualenv={{certs_venv_dir}} state=present
+  tags:
+  - certificates
+  - install
+  - update
+
+- name: certificates | install env
+  template: src=certificates.env.json.j2 dest={{certs_home}}/env.json mode=640 owner={{certs_user}} group=adm
+  tags:
+  - certificates
+  - install
+  - update
+  - deploy
+
+- name: certificates | install auth
+  template: src=certificates.auth.json.j2 dest={{certs_home}}/auth.json mode=640 owner={{certs_user}} group=adm
+  tags:
+  - certificates
+  - install
+  - update
+  - deploy
+
+- name: certifier | install bash_profile
+  copy: src=../../common/files/bash_profile dest={{certs_home}}/.bash_profile owner={{certs_user}} group={{certs_user}}
+  tags:
+  - certificates
+  - install
+  - update
+  - deploy
+
+- name: certifier | setup certifier shell environment
+  template: src=certifier_shell_env.j2 dest={{certs_home}}/certifier_env owner={{certs_user}} group={{certs_user}}
+  tags:
+  - certificates
+  - install
+  - update
+
+- name: certifier | ensure .bashrc exists and sources shell environment
+  lineinfile: 
+    dest={{certs_home}}/.bashrc create=yes state=present insertbefore=BOF
+    regexp='source {{certs_home}}/certifier_env' line='source {{certs_home}}/certifier_env' 
+    mode=640 owner={{certs_user}} group=adm
+  tags:
+  - certificates
+  - install
+  - update
+
+- name: certifier | add source venv to .bashrc
+  lineinfile:
+    dest={{certs_home}}/.bashrc create=yes state=present insertafter=EOF
+    regexp='source {{certs_venv_dir}}/bin/activate' line='source {{certs_venv_dir}}/bin/activate' 
+    mode=640 owner={{certs_user}} group=adm
+  tags:
+  - certificates
+  - install
+  - update
+
+- name: certifier | supervisord config for certificate-agent
+  template: src=certifier-cert-agent-supervisor.j2 dest=/etc/supervisor/conf.d/certifier-cert-agent.conf
+  notify: certifier | restart certificate-agent
+  tags:
+  - certificates
+  - install
+  - update
+

playbooks/roles/certificates/templates/certificates.auth.json.j2

+{{ certs_auth_config | to_nice_json }}

playbooks/roles/certificates/templates/certificates.env.json.j2

+{{ certs_env_config | to_nice_json }}

playbooks/roles/certificates/templates/certifier-cert-agent-supervisor.j2

+;
+;  {{ ansible_managed }}
+;
+[program:certificate-agent]
+
+command={{ certs_venv_dir }}/bin/python {{certs_home}}/src/certificate_agent.py
+
+priority=999
+user={{ certs_user }}
+stdout_logfile={{certs_logs_dir}}/certificate-agent-stdout.log
+stderr_logfile={{certs_logs_dir}}/certificate-agent-stderr.log
+environment=PID='/var/tmp/certifier-certificate-agent.pid',LANG=en_US.UTF-8,
+killasgroup=true
+stopasgroup=true
+startsecs=10
+autostart=true
+autorestart=true
+directory={{certs_home}}
+
+environment=PID='/var/tmp/certifier-certificate-agent.pid',LANG=en_US.UTF-8,
+{%- for name,value in certs_shell_env_vars.items() -%}
+{{name}}="{{value}}"{%- if not loop.last -%},{%- endif -%}
+{%- endfor -%}

playbooks/roles/certificates/templates/certifier_shell_env.j2

+# {{ ansible_managed }}
+
+{% for name,value in certs_shell_env_vars.items() %}
+{% if value %}
+export {{ name }}="{{ value }}"
+{% endif %}		 
+{% endfor %}

playbooks/roles/certificates/templates/notifier_env.j2

+# {{ ansible_managed }}
+
+{% for name,value in notifier_env_vars.items() %}
+{% if value %}
+export {{ name }}="{{ value }}"
+{% endif %}		 
+{% endfor %}

playbooks/roles/datadog/tasks/main.yml

@@ -61,6 +61,8 @@
     src=usr/share/datadog/agent/nginx_log_http_response_counter.py
     dest=/usr/share/datadog/agent/nginx_log_http_response_counter.py
     owner=root group=root mode=0644
+  notify:
+    - datadog | restart the datadog service
   tags:
     - datadog
 
@@ -82,9 +84,16 @@
   tags:
     - datadog
 
-# quoting intentional, missing space after line=api_key: also
+- name: datadog | Install logrotate configuration for datadog
+  template: dest=/etc/logrotate.d/datadog src=datadog_logrotate.j2 owner=root group=root mode=644
+  tags:
+    - logging
+    - datadog
+
+################# Datadog config file lines
+# quoting intentional, missing spaces also
 # ansible wasn't handling the double quoted yaml properly 
-# otherwise.
+# without some weirdness.
 - name: datadog | set hostname if unset
   lineinfile:
     dest="/etc/dd-agent/datadog.conf" 
@@ -96,9 +105,17 @@
   tags:
     - datadog
 
-# quoting intentional, missing space after line=api_key: also
-# ansible wasn't handling the double quoted yaml properly 
-# otherwise.
+- name: datadog | set dogstats update interval
+  lineinfile:
+    dest="/etc/dd-agent/datadog.conf" 
+    "line=dogstatsd_interval:10"
+    state=present 
+    "regexp=^\#?\s*dogstatsd_interval:.+$"
+  notify:
+    - datadog | restart the datadog service
+  tags:
+    - datadog
+
 - name: datadog | update dogstreams
   lineinfile:
     dest="/etc/dd-agent/datadog.conf" 
@@ -112,9 +129,6 @@
   tags:
     - datadog
 
-# quoting intentional, missing space after line=api_key: also
-# ansible wasn't handling the double quoted yaml properly 
-# otherwise.
 - name: datadog | update api-key
   lineinfile: 
     dest="/etc/dd-agent/datadog.conf" 
@@ -125,3 +139,4 @@
   tags:
     - datadog
 
+################# END Datadog config file lines

playbooks/roles/datadog/templates/datadog_logrotate.j2

+/var/log/datadog/*.log {
+  create
+  compress
+  copytruncate
+  delaycompress
+  dateext
+  missingok
+  notifempty
+  daily
+  rotate 90
+  size 1M
+}

playbooks/roles/nginx/templates/edx_logrotate_nginx_access.j2

 # Put in place by ansible
 
 {{log_base_dir}}/nginx/access.log {
-  create 0640 www-data adm
+  create 0640 www-data syslog
   compress
   delaycompress
   dateext
@@ -9,10 +9,8 @@
   notifempty
   daily
   rotate 90
-  size 1M
-  sharedscripts
   postrotate
-	[ ! -f /var/run/nginx.pid ] || kill -HUP `cat /var/run/nginx.pid`
+	[ -f /var/run/nginx.pid ] && kill -HUP `cat /var/run/nginx.pid`
   endscript
 }
 

playbooks/roles/nginx/templates/edx_logrotate_nginx_error.j2

 # Put in place by ansible
 
 {{log_base_dir}}/nginx/error.log {
-  create 0640 www-data adm
+  create 0640 www-data syslog
   compress
   delaycompress
   dateext
@@ -10,8 +10,7 @@
   daily
   rotate 90
   size 1M
-  sharedscripts
   postrotate
-	[ ! -f /var/run/nginx.pid ] || kill -HUP `cat /var/run/nginx.pid`
+	[ -f /var/run/nginx.pid ] && kill -HUP `cat /var/run/nginx.pid`
   endscript
 }

playbooks/roles/nginx/templates/phpmyadmin.j2

+upstream php {
+    server {{ FPM_LISTENER }};
+}
+
+server {
+    listen {{ PHP_SERVER_PORT }} default; ## listen for ipv4; this line is default and implied
+    listen [::]:{{ PHP_SERVER_PORT }} default ipv6only=on; ## listen for ipv6
+
+    charset utf-8;
+
+    access_log {{log_base_dir}}/nginx/phpmyadmin_access.log;
+    error_log {{log_base_dir}}/nginx/phpmyadmin_error.log;
+
+    root {{ PHP_WEB_ROOT }};
+    index index.php index.html index.htm;
+
+    location / {
+        # First attempt to serve request as file, then
+        # as directory, then trigger 404
+        try_files $uri $uri/ =404;
+    }
+
+    location ~ \.php$ {
+        try_files $uri =404;
+
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
+
+        fastcgi_pass php;
+
+        fastcgi_index index.php;
+
+        fastcgi_param SCRIPT_FILENAME {{ PHP_WEB_ROOT }}$fastcgi_script_name;
+        fastcgi_param DOCUMENT_ROOT {{ PHP_WEB_ROOT }};
+
+        # send bad requests to 404
+        fastcgi_intercept_errors on;
+
+        include fastcgi_params;
+    }
+}
\ No newline at end of file

playbooks/roles/php/defaults/main.yml

+PHP_SERVER_PORT: 8088
+
+PHP_WEB_ROOT: '/opt/php-www'
+
+FPM_LISTENER: "127.0.0.1:19010"
+
+INSTALL_PHPMYADMIN: true
+MYSQL_SERVER_HOST: '127.0.0.1'
+MYSQL_SERVER_PORT: 3307
+MYSQL_SERVER_USER: 'root' # used only to create the PHPMYADMIN_CONTROL_USER
+MYSQL_SERVER_PASS: ''     # used only to create the PHPMYADMIN_CONTROL_USER
+
+PHPMYADMIN_DBS_SHOWN:
+  - 'edxapp'
+PHPMYADMIN_REL_PATH: 'pma'
+PHPMYADMIN_SERVER: 'http://127.0.0.1:9010'
+PHPMYADMIN_BLOWFISH_SECRET: '1234567890' # please change me
+PHPMYADMIN_CONTROLUSER: 'pma'
+PHPMYADMIN_CONTROLPASS: ''
+PHPMYADIN_PMADB: 'phpmyadmin'
+
+phpmyadmin_abs_url: '{{ PHPMYADMIN_SERVER }}/{{ PHPMYADMIN_REL_PATH }}'

playbooks/roles/php/handlers/main.yml

+
+---
+- name: restart php5-fpm
+  service: name=php5-fpm state=restarted

playbooks/roles/php/tasks/main.yml

+# installs PHP running on php5-fpm and nginx
+
+---
+- name: install php5 apt packages
+  apt: pkg=php5-cli,php5-fpm state=present
+  tags:
+  - php
+
+- name: change php5-fpm listen
+  lineinfile: dest=/etc/php5/fpm/pool.d/www.conf regexp="^listen=.*$" line="listen={{ FPM_LISTENER }}" state=present
+  notify: restart php5-fpm
+  tags:
+  - php
+
+- name: create php web root dir
+  file: path={{ PHP_WEB_ROOT }} state=directory owner=www-data group=www-data mode=0750
+  tags:
+  - php
+
+- include: phpmyadmin.yml
+  when: INSTALL_PHPMYADMIN
\ No newline at end of file

playbooks/roles/php/tasks/phpmyadmin.yml

+# Installs PHPMYADMIN
+---
+- name: installs phpmyadmin (and python-mysqldb for later ansible tasks)
+  apt: pkg=phpmyadmin,python-mysqldb state=present
+  tags:
+  - php
+  - phpmyadmin
+
+- name: delete setup directories
+  file: path=/usr/share/phpmyadmin/{{ item }} state=absent
+  with_items:
+    - setup
+    - config
+  tags:
+  - php
+  - phpmyadmin
+
+- name: link phpmyadmin
+  file: state=link src=/usr/share/phpmyadmin dest={{ PHP_WEB_ROOT }}/{{ PHPMYADMIN_REL_PATH }} owner=www-data group=www-data mode=0750
+  tags:
+  - php
+  - phpmyadmin
+
+- name: set correct perms in phpmyadmin install
+  file: path=/usr/share/phpmyadmin state=directory recurse=true owner=www-data group=www-data mode=0750
+  tags:
+  - php
+  - phpmyadmin
+
+- name: configure phpmyadmin
+  template: src=config.inc.php.j2 dest=/etc/phpmyadmin/config.inc.php owner=root group=www-data mode=0640
+  tags:
+  - php
+  - phpmyadmin
+
+- name: create phpmyadmin mysql conf user
+  mysql_user: >
+    login_host={{ MYSQL_SERVER_HOST }}
+    login_user={{ MYSQL_SERVER_USER }} login_password={{ MYSQL_SERVER_PASS }}
+    name={{ PHPMYADMIN_CONTROLUSER }} password={{ PHPMYADMIN_CONTROLPASS }} host="%"
+    state=present
+  tags:
+  - php
+  - phpmyadmin
+
+- name: unzip db creation script that creates phpmyadmin db (so we can manipulate it)
+  command: gunzip /usr/share/doc/phpmyadmin/examples/create_tables.sql.gz
+  ignore_errors: true
+  tags:
+  - php
+  - phpmyadmin
+
+- name: write desired phpmyadmin db to script
+  lineinfile: >
+    dest=/usr/share/doc/phpmyadmin/examples/create_tables.sql
+    regexp="^CREATE DATABASE IF NOT EXISTS.*$"
+    line="CREATE DATABASE IF NOT EXISTS `{{ PHPMYADIN_PMADB }}`"
+  tags:
+  - php
+  - phpmyadmin
+
+- name: use desired phpmyadmin db in script
+  lineinfile: >
+    dest=/usr/share/doc/phpmyadmin/examples/create_tables.sql
+    regexp="^USE.*$"
+    line="USE `{{ PHPMYADIN_PMADB }}`;"
+  tags:
+  - php
+  - phpmyadmin
+
+- name: run db creation script (creates phpmyadmin db)
+  shell: "mysql -h {{ MYSQL_SERVER_HOST }} -P {{ MYSQL_SERVER_PORT }} -u{{ MYSQL_SERVER_USER }} -p{{ MYSQL_SERVER_PASS }} < /usr/share/doc/phpmyadmin/examples/create_tables.sql"
+  tags:
+  - php
+  - phpmyadmin
+
+- name: grant all on phpmyadin database to control user
+  mysql_user: >
+    login_host={{ MYSQL_SERVER_HOST }}
+    login_user={{ MYSQL_SERVER_USER }} login_password={{ MYSQL_SERVER_PASS }}
+    name={{ PHPMYADMIN_CONTROLUSER }}
+    priv={{ PHPMYADIN_PMADB }}.*:ALL
+  tags:
+  - php
+  - phpmyadmin

playbooks/roles/php/templates/config.inc.php.j2

+<?php
+
+/* Servers configuration */
+$i = 0;
+
+/* Server: RDS [1] */
+$i++;
+
+$cfg['Servers'][$i]['host'] = '{{ MYSQL_SERVER_HOST }}';
+$cfg['Servers'][$i]['port'] = '{{ MYSQL_SERVER_PORT }}';
+$cfg['Servers'][$i]['socket'] = '';
+$cfg['Servers'][$i]['connect_type'] = 'tcp';
+$cfg['Servers'][$i]['extension'] = 'mysqli';
+$cfg['Servers'][$i]['compress'] = true;
+$cfg['Servers'][$i]['auth_type'] = 'cookie';
+$cfg['Servers'][$i]['user'] = '';
+$cfg['Servers'][$i]['password'] = '';
+$cfg['Servers'][$i]['only_db'] = array({% for db in PHPMYADMIN_DBS_SHOWN %}"{{ db }}",{% endfor %});
+$cfg['Servers'][$i]['controluser'] = '{{ PHPMYADMIN_CONTROLUSER }}';
+$cfg['Servers'][$i]['controlpass'] = '{{ PHPMYADMIN_CONTROLPASS }}';
+$cfg['Servers'][$i]['pmadb'] = '{{ PHPMYADIN_PMADB }}';
+$cfg['Servers'][$i]['bookmarktable'] = 'pma_bookmark';
+$cfg['Servers'][$i]['history'] = 'pma_history';
+
+/* End of servers configuration */
+
+$cfg['blowfish_secret'] = '{{ PHPMYADMIN_BLOWFISH_SECRET }}';
+$cfg['DefaultLang'] = 'en';
+$cfg['ServerDefault'] = 1;
+$cfg['UploadDir'] = '';
+$cfg['SaveDir'] = '';
+$cfg['PmaAbsoluteUri']='{{ phpmyadmin_abs_url }}';
+
+?>
\ No newline at end of file