Revert "Revert "WL-451: Clean up ansible services/roles for theming""

This reverts commit 72461609.

playbooks/roles/add_user/defaults/main.yml

+---
+#
+# edX Configuration
+#
+# github:     https://github.com/edx/configuration
+# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
+# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
+# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
+#
+# Example play:
+#
+# Rather than being included in the play, this role
+# is included as a dependency by other roles in the meta/main.yml
+# file.  The including role should add the following
+# dependency definition.
+#
+# dependencies:
+#   - role: add_user
+#     user_name: edx-themes
+#     user_home: /edx/etc/edx-themes
+#     group_name: edx-themes
+#     dirs:
+#       - {path: /edx/var/edx-themes, owner: 'edx-themes', group: "edx-themes", mode: "0646"}
+#       - {path: /edx/etc/edx-themes, owner: 'edx-themes', group: "edx-themes", mode: "0664"}
+#       - ...
+#
+##
+# Defaults for role add_user
+#

playbooks/roles/add_user/meta/main.yml

+---
+#
+# edX Configuration
+#
+# github:     https://github.com/edx/configuration
+# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
+# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
+# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
+#
+##
+# Role includes for role add_user
+#
+
+# Allow this role to be duplicated in dependencies
+allow_duplicates: yes

playbooks/roles/add_user/tasks/main.yml

+---
+#
+# edX Configuration
+#
+# github:     https://github.com/edx/configuration
+# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
+# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
+# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
+#
+#
+#
+# Tasks for role add_user
+#
+# Overview:
+#
+# This role performs the repetitive tasks that most edX roles
+# require in our default configuration.
+#
+# Generating an ssh key so users can do a git
+# clone over ssh for public repositories without any
+# additional configuration
+- name: create application user
+  user:
+    name: "{{ user_name }}"
+    home: "{{ user_home }}"
+    createhome: yes
+    shell: /bin/false
+    generate_ssh_key: yes
+  tags:
+    - install
+    - install:base
+
+# Assumes that the home directory has been created above.
+# In some cases(vagrant boxes) the home directory gets created
+# but does not have the correct owner and group. In vagrant for
+# example we were seeing it defaulting to `root` for both.
+# Here we ensure that the ownership
+# of the home directory is always correct before proceeding.
+- name: ensure correct ownership of home directory
+  file:
+    path: "{{ user_home }}"
+    state: directory
+    owner: "{{ user_name }}"
+    group: "{{ group_name }}"
+  tags:
+    - install
+    - install:base
+
+- name: create dirs for the user
+  file:
+    path: "{{ item.path }}"
+    state: directory
+    owner: "{{ item.owner }}"
+    group: "{{ item.group }}"
+    mode: "{{ item.mode | default('0755') }}"
+  with_items: dirs
+  when: dirs is defined
+  tags:
+    - install
+    - install:base

playbooks/roles/ecommerce/meta/main.yml

@@ -22,6 +22,6 @@ dependencies:
     edx_service_packages:
       debian: "{{ ecommerce_debian_pkgs }}"
       redhat: "{{ ecommerce_redhat_pkgs }}"
-  - role: edx-themes
+  - role: edx_themes
     when: "{{ ECOMMERCE_ENABLE_COMPREHENSIVE_THEMING }}"
   - oraclejdk

playbooks/roles/edx_service/meta/main.yml

@@ -18,3 +18,15 @@
 #   my_role_var0: "foo"
 #   my_role_var1: "bar"
 # }
+
+dependencies:
+  - role: add_user
+    user_name: "{{ edx_service_name }}"
+    user_home: "{{ edx_service_home }}"
+    group_name: "{{ common_web_group }}"
+  - role: git_clone
+    repo_owner: "{{ edx_service_user }}"
+    repo_group: "{{ edx_service_user }}"
+    GIT_REPOS: "{{ edx_service_repos }}"
+    git_home: "{{ edx_service_home }}"
+    when: edx_service_repos is defined

playbooks/roles/edx_service/tasks/main.yml

@@ -43,25 +43,10 @@
 #       debian: [ pkg1, pkg2, pkg3 ]      
 #       redhat: [ pkg4, pkg5 ]
 #
-
-# Generating an ssh key so service users can do a git
-# clone over ssh for public repositories without any
-# additional configuration
-- name: create application user
-  user: >
-    name="{{ edx_service_name }}"
-    home="{{ edx_service_home }}"
-    createhome=yes
-    shell=/bin/false
-    generate_ssh_key=yes
-  tags:
-    - install
-    - install:base
-
 # Assumes that the home directory has been created above.
 # In some cases(vagrant boxes) the home directory gets created
 # but does not have the corrent owner and group. In vagrant for
-# example we were seeing it defaulting it to `root` for both.
+# example we were seeing it defaulting to `root` for both.
 # The item that is a blank string("") ensures the ownership
 # of the home directory is always correct before proceeding.
 - name: create edx_service app, venv, data, and staticfiles dirs
@@ -135,58 +120,6 @@
     - install
     - install:system-requirements
 
-- name: set git fetch.prune to ignore deleted remote refs
-  shell: git config --global fetch.prune true
-  sudo_user: "{{ edx_service_user }}"
-  when: edx_service_repos is defined
-  tags:
-    - install
-    - install:code
-
-- name: validate git protocol
-  fail: msg='REPOS.PROTOCOL must be "https" or "ssh"'
-  when: (item.PROTOCOL != "https") and (item.PROTOCOL != "ssh") and edx_service_repos is defined
-  with_items: edx_service_repos
-  tags:
-    - install
-    - install:code
-
-- name: install read-only ssh key
-  copy: >
-    dest="{{ edx_service_home }}/.ssh/{{ item.REPO }}"
-    content="{{ item.SSH_KEY }}" owner={{ edx_service_user }}
-    group={{ edx_service_user }} mode=0600
-  when: item.PROTOCOL == "ssh" and edx_service_repos is defined
-  with_items: edx_service_repos
-  tags:
-    - install
-    - install:code
-
-- name: checkout code over ssh
-  git_2_0_1: >
-    repo=git@{{ item.DOMAIN }}:{{ item.PATH }}/{{ item.REPO }}
-    dest={{ item.DESTINATION }}  version={{ item.VERSION }}
-    accept_hostkey=yes key_file={{ edx_service_home }}/.ssh/{{ item.REPO }}
-  sudo_user: "{{ edx_service_user }}"
-  register: code_checkout
-  when: item.PROTOCOL == "ssh" and edx_service_repos is defined
-  with_items: edx_service_repos
-  tags:
-    - install
-    - install:code
-
-- name: checkout code over https
-  git_2_0_1: >
-    repo=https://{{ item.DOMAIN }}/{{ item.PATH }}/{{ item.REPO }}
-    dest={{ item.DESTINATION }}  version={{ item.VERSION }}
-  sudo_user: "{{ edx_service_user }}"
-  register: code_checkout
-  when: item.PROTOCOL == "https" and edx_service_repos is defined
-  with_items: edx_service_repos
-  tags:
-    - install
-    - install:code
-
 - name: get instance information
   action: ec2_facts
   tags:

playbooks/roles/edx_themes/meta/main.yml

+---
+#
+# edX Configuration
+#
+# github:     https://github.com/edx/configuration
+# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
+# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
+# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
+#
+##
+# Role includes for role edx_themes
+# 
+dependencies:
+  - role: add_user
+    user_name: "{{ themes_user }}"
+    user_home: "{{ themes_home }}"
+    group_name: "{{ themes_user }}"
+  - role: git_clone
+    repo_owner: "{{ themes_user }}"
+    repo_group: "{{ themes_user }}"
+    GIT_REPOS: "{{ THEMES_REPOS }}"
+    git_home: "{{ themes_home }}"

playbooks/roles/edx_themes/tasks/main.yml

+---
+#
+# edX Configuration
+#
+# github:     https://github.com/edx/configuration
+# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
+# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
+# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
+#
+#
+#
+# Tasks for role themes
+#
+# Overview:
+#
+# This role performs the repetive tasks that most edX roles
+# require in our default configuration.
+#
+# Example play:
+#
+# Rather than being included in the play, this role
+# is included as a dependency by other roles in the meta/main.yml
+# file.  The including role should add the following
+# dependency definition.
+#
+# dependencies:
+#   - role: edx_themes
+#     when do_setup_themes
+#

playbooks/roles/git_clone/defaults/main.yml

+---
+#
+# edX Configuration
+#
+# github:     https://github.com/edx/configuration
+# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
+# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
+# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
+#
+# Example play:
+#
+# Rather than being included in the play, this role
+# is included as a dependency by other roles in the meta/main.yml
+# file.  The including role should add the following
+# dependency definition.
+#
+# dependencies:
+#   - role: git_clone
+#    repo_owner: edx-themes
+#    repo_group: edx-themes
+#    git_home: /edx/etc/edx-themes
+#    GIT_REPOS:
+#      - PROTOCOL: ssh
+#        DOMAIN: github.com
+#        PATH: edx
+#        REPO: sample-themes.git
+#        VERSION: release
+#        DESTINATION: /edx/etc/edx-themes/edx-themes
+#        SSH_KEY: "{{ THEMES_GIT_IDENTITY }}"
+#
+##
+# Defaults for role git_clone
+#

playbooks/roles/git_clone/meta/main.yml

+---
+#
+# edX Configuration
+#
+# github:     https://github.com/edx/configuration
+# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
+# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
+# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
+#
+##
+# Role includes for role git_clone
+#
+
+# Allow this role to be duplicated in dependencies
+allow_duplicates: yes

playbooks/roles/edx-themes/tasks/main.yml → playbooks/roles/git_clone/tasks/main.yml

@@ -9,82 +9,39 @@
 #
 #
 #
-# Tasks for role themes
+# Tasks for role git_clone
 #
 # Overview:
 #
-# This role performs the repetive tasks that most edX roles
+# This role performs the repetitive tasks that most edX roles
 # require in our default configuration.
 #
-# Example play:
 #
-# Rather than being included in the play, this role
-# is included as a dependency by other roles in the meta/main.yml
-# file.  The including role should add the following
-# dependency definition.
-#
-# dependencies:
-#   - role: themes
-#     when do_setup_themes
-#
-
-# Generating an ssh key so service users can do a git
-# clone over ssh for public repositories without any
-# additional configuration
-- name: create application user
-  user:
-    name: "{{ themes_user }}"
-    home: "{{ themes_home }}"
-    createhome: yes
-    shell: /bin/false
-    generate_ssh_key: yes
-  tags:
-    - install
-    - install:base
-
-# Assumes that the home directory has been created above.
-# In some cases(vagrant boxes) the home directory gets created
-# but does not have the current owner and group. In vagrant for
-# example we were seeing it defaulting it to `root` for both.
-# The item that is a blank string ("") ensures the ownership
-# of the home directory is always correct before proceeding.
-- name: create themes home dirs
-  file:
-    path: "{{ themes_home }}/{{ item }}"
-    state: directory
-    owner: "{{ themes_user }}"
-    group: "{{ common_web_group }}"
-  with_items:
-    - ""
-  tags:
-    - install
-    - install:base
-
 - name: set git fetch.prune to ignore deleted remote refs
   shell: git config --global fetch.prune true
-  sudo_user: "{{ themes_user }}"
-  when: THEMES_REPOS is defined
+  sudo_user: "{{ repo_owner }}"
+  when: GIT_REPOS is defined
   tags:
     - install
     - install:code
 
 - name: validate git protocol
-  fail: msg='THEMES_REPOS.PROTOCOL must be "https" or "ssh"'
-  when: (item.PROTOCOL != "https") and (item.PROTOCOL != "ssh") and THEMES_REPOS is defined
-  with_items: THEMES_REPOS
+  fail: msg='GIT_REPOS.PROTOCOL must be "https" or "ssh"'
+  when: (item.PROTOCOL != "https") and (item.PROTOCOL != "ssh") and GIT_REPOS is defined
+  with_items: GIT_REPOS
   tags:
     - install
     - install:code
 
 - name: install read-only ssh key
   copy:
-    dest: "{{ themes_home }}/.ssh/{{ item.REPO }}"
+    dest: "{{ git_home }}/.ssh/{{ item.REPO }}"
     content: "{{ item.SSH_KEY }}"
-    owner: "{{ themes_user }}"
-    group: "{{ themes_user }}"
+    owner: "{{ repo_owner }}"
+    group: "{{ repo_group }}"
     mode: 0600
-  when: item.PROTOCOL == "ssh" and THEMES_REPOS is defined
-  with_items: THEMES_REPOS
+  when: item.PROTOCOL == "ssh" and GIT_REPOS is defined
+  with_items: GIT_REPOS
   tags:
     - install
     - install:code
@@ -95,11 +52,11 @@
     dest: "{{ item.DESTINATION }}"
     version: "{{ item.VERSION }}"
     accept_hostkey: yes
-    key_file: "{{ themes_home }}/.ssh/{{ item.REPO }}"
-  sudo_user: "{{ themes_user }}"
+    key_file: "{{ git_home }}/.ssh/{{ item.REPO }}"
+  sudo_user: "{{ repo_owner }}"
   register: code_checkout
-  when: item.PROTOCOL == "ssh" and THEMES_REPOS is defined
-  with_items: THEMES_REPOS
+  when: item.PROTOCOL == "ssh" and GIT_REPOS is defined
+  with_items: GIT_REPOS
   tags:
     - install
     - install:code
@@ -109,20 +66,20 @@
     repo: "https://{{ item.DOMAIN }}/{{ item.PATH }}/{{ item.REPO }}"
     dest: "{{ item.DESTINATION }}"
     version: "{{ item.VERSION }}"
-  sudo_user: "{{ themes_user }}"
+  sudo_user: "{{ repo_owner }}"
   register: code_checkout
-  when: item.PROTOCOL == "https" and THEMES_REPOS is defined
-  with_items: THEMES_REPOS
+  when: item.PROTOCOL == "https" and GIT_REPOS is defined
+  with_items: GIT_REPOS
   tags:
     - install
     - install:code
 
 - name: remove read-only ssh key
   file:
-    dest: "{{ themes_home }}/.ssh/{{ item.REPO }}"
+    dest: "{{ git_home }}/.ssh/{{ item.REPO }}"
     state: absent
-  when: THEMES_REPOS is defined
-  with_items: THEMES_REPOS
+  when: item.PROTOCOL == "ssh" and GIT_REPOS is defined
+  with_items: GIT_REPOS
   tags:
     - install
     - install:code