ansible-middleware.keycloak/roles/keycloak/tasks/install.yml

---
- name: Validate parameters
  ansible.builtin.assert:
    that:
      - keycloak_jboss_home is defined
      - keycloak_service_user is defined
      - keycloak_dest is defined
      - keycloak_archive is defined
      - keycloak_download_url is defined
      - keycloak_version is defined
    quiet: true

- name: Check for an existing deployment
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
  ansible.builtin.stat:
    path: "{{ keycloak_jboss_home }}"
  register: keycloak_existing_deploy

- name: Stop and restart if existing deployment exists and install forced
  when: keycloak_existing_deploy.stat.exists and keycloak_force_install | bool
  block:
    - name: "Stop the old service: {{ keycloak_config.service_name }}"
      become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
      failed_when: false
      ansible.builtin.systemd:
        name: keycloak
        state: stopped
    - name: "Remove the old deployment: {{ keycloak_config.service_name }}"
      become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
      ansible.builtin.file:
        path: "{{ keycloak_jboss_home }}"
        state: absent

- name: Check for an existing deployment after possible forced removal
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
  ansible.builtin.stat:
    path: "{{ keycloak_jboss_home }}"

- name: "Create service user/group for {{ keycloak_config.service_name }}"
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
  ansible.builtin.user:
    name: "{{ keycloak_service_user }}"
    home: /opt/keycloak
    system: true
    create_home: false

- name: "Create install location for {{ keycloak_config.service_name }}"
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
  ansible.builtin.file:
    dest: "{{ keycloak_dest }}"
    state: directory
    owner: "{{ keycloak_service_user }}"
    group: "{{ keycloak_service_group }}"
    mode: '0750'

- name: Create pidfile folder
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
  ansible.builtin.file:
    dest: "{{ keycloak_service_pidfile | dirname }}"
    state: directory
    owner: "{{ keycloak_service_user if keycloak_service_runas else omit }}"
    group: "{{ keycloak_service_group if keycloak_service_runas else omit }}"
    mode: '0750'

## check remote archive
- name: Set download archive path
  ansible.builtin.set_fact:
    keycloak_archive_full_path: "{{ keycloak_dest }}/{{ keycloak_archive }}"

- name: Check download archive path
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
  ansible.builtin.stat:
    path: "{{ keycloak_archive_full_path }}"
  register: keycloak_archive_path

## download to controller
- name: Check local download archive path
  ansible.builtin.stat:
    path: "{{ lookup('env', 'PWD') }}"
  register: keycloak_local_path
  delegate_to: localhost

- name: Download keycloak archive
  ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user
    url: "{{ keycloak_download_url }}"
    dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
    mode: '0644'
    url_username: "{{ keycloak_binary_download_user | default(omit) }}"
    url_password: "{{ keycloak_binary_download_pass | default(omit) }}"
    validate_certs: false
  delegate_to: localhost
  run_once: true
  when:
    - keycloak_archive_path is defined
    - keycloak_archive_path.stat is defined
    - not keycloak_archive_path.stat.exists
    - not sso_enable is defined or not sso_enable
    - not keycloak_offline_install

- name: Perform download from RHN using Unified Downloads API
  delegate_to: localhost
  run_once: true
  when:
    - keycloak_archive_path is defined
    - keycloak_archive_path.stat is defined
    - not keycloak_archive_path.stat.exists
    - sso_enable is defined and sso_enable
    - not keycloak_offline_install
  block:
    - name: Retrieve product download using Unified Downloads API
      middleware_automation.common.product_search:
        client_id: "{{ rhn_username }}"
        client_secret: "{{ rhn_password }}"
        product_type: DISTRIBUTION
        product_version: "{{ sso_version.split('.')[:2] | join('.') }}"
        product_category: "{{ sso_product_category }}"
        validate_certs: false
      register: keycloak_rhn_products
      no_log: "{{ omit_rhn_output | default(true) }}"
      delegate_to: localhost
      run_once: true

    - name: Determine install zipfile from search results
      ansible.builtin.set_fact:
        keycloak_rhn_filtered_products: >-
          {{ keycloak_rhn_products.results
          | selectattr('file_name', 'search', 'rh-sso-' + sso_version + '-server-dist.zip$')
          | list }}
      delegate_to: localhost
      run_once: true

    - name: Download Red Hat Single Sign-On
      middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user
        client_id: "{{ rhn_username }}"
        client_secret: "{{ rhn_password }}"
        product_id: "{{ (keycloak_rhn_filtered_products | first).id }}"
        dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
        validate_certs: false
      no_log: "{{ omit_rhn_output | default(true) }}"
      delegate_to: localhost
      run_once: true

- name: Download rhsso archive from alternate location
  ansible.builtin.get_url: # noqa risky-file-permissions delegated, uses controller host user
    url: "{{ keycloak_rhsso_download_url }}"
    dest: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
    mode: '0644'
    validate_certs: false
  delegate_to: localhost
  run_once: true
  when:
    - keycloak_archive_path is defined
    - keycloak_archive_path.stat is defined
    - not keycloak_archive_path.stat.exists
    - sso_enable is defined and sso_enable
    - not keycloak_offline_install
    - keycloak_rhsso_download_url is defined

- name: Check downloaded archive
  ansible.builtin.stat:
    path: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
  register: keycloak_local_archive_path
  delegate_to: localhost

## copy and unpack
- name: Copy archive to target nodes
  ansible.builtin.copy:
    src: "{{ keycloak_local_path.stat.path }}/{{ keycloak_archive }}"
    dest: "{{ keycloak_archive_full_path }}"
    owner: "{{ keycloak_service_user }}"
    group: "{{ keycloak_service_group }}"
    mode: '0640'
  register: keycloak_new_version_downloaded
  when:
    - not keycloak_archive_path.stat.exists
    - keycloak_local_archive_path.stat is defined
    - keycloak_local_archive_path.stat.exists
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"

- name: "Check target directory: {{ keycloak_config.home }}"
  ansible.builtin.stat:
    path: "{{ keycloak_config.home }}"
  register: keycloak_path_to_workdir
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"

- name: "Extract archive on target: {{ keycloak_service_desc }}"
  ansible.builtin.unarchive:
    remote_src: true
    src: "{{ keycloak_archive_full_path }}"
    dest: "{{ keycloak_dest }}"
    creates: "{{ keycloak_config.home }}"
    owner: "{{ keycloak_service_user }}"
    group: "{{ keycloak_service_group }}"
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
  when:
    - keycloak_new_version_downloaded.changed or not keycloak_path_to_workdir.stat.exists
  notify:
    - restart keycloak

- name: Inform decompression was not executed
  ansible.builtin.debug:
    msg: "{{ keycloak_config.home }} already exists and version unchanged, skipping decompression"
  when:
    - not keycloak_new_version_downloaded.changed and keycloak_path_to_workdir.stat.exists

- name: "Reown installation directory to {{ keycloak_service_user }}"
  ansible.builtin.file:
    path: "{{ keycloak_config.home }}"
    owner: "{{ keycloak_service_user }}"
    group: "{{ keycloak_service_group }}"
    recurse: true
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
  changed_when: false

- name: Ensure permissions are correct on existing deploy
  ansible.builtin.command: chown -R "{{ keycloak_service_user }}:{{ keycloak_service_group }}" "{{ keycloak_config.home }}"
  when: keycloak_service_runas
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
  changed_when: false

# driver and configuration
- name: "Install database driver: {{ keycloak_jdbc_engine }}"
  ansible.builtin.include_tasks: jdbc_driver.yml
  when: keycloak_jdbc[keycloak_jdbc_engine].enabled

- name: "Deploy custom config: {{ keycloak_config.service_name }}"
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
  ansible.builtin.template:
    src: "templates/{{ keycloak_config_override_template }}"
    dest: "{{ keycloak_config_path_to_standalone_xml }}"
    owner: "{{ keycloak_service_user }}"
    group: "{{ keycloak_service_group }}"
    mode: '0640'
  notify:
    - restart keycloak
  when: (keycloak_config_override_template | default('', true)) | length > 0

- name: "Deploy standalone config: {{ keycloak_config.service_name }}"
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
  ansible.builtin.template:
    src: templates/standalone.xml.j2
    dest: "{{ keycloak_config_path_to_standalone_xml }}"
    owner: "{{ keycloak_service_user }}"
    group: "{{ keycloak_service_group }}"
    mode: '0640'
  notify:
    - restart keycloak
  when:
    - not keycloak_ha_enabled
    - (keycloak_config_override_template | default('', true)) | length == 0

- name: Create tcpping cluster node list
  ansible.builtin.set_fact:
    keycloak_cluster_nodes: >
      {{ keycloak_cluster_nodes | default([]) + [
        {
          "name": item,
          "address": 'jgroups-' + item,
          "inventory_host": hostvars[item].ansible_default_ipv4.address | default(item) + '[' + (keycloak_jgroups_port | string) + ']',
          "value": hostvars[item].ansible_default_ipv4.address | default(item)
        }
      ] }}
  loop: "{{ ansible_play_batch }}"
  when: keycloak_ha_enabled and keycloak_ha_discovery == 'TCPPING'

- name: "Deploy HA config: {{ keycloak_config.service_name }}"
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
  ansible.builtin.template:
    src: templates/standalone-ha.xml.j2
    dest: "{{ keycloak_config_path_to_standalone_xml }}"
    owner: "{{ keycloak_service_user }}"
    group: "{{ keycloak_service_group }}"
    mode: '0640'
  notify:
    - restart keycloak
  when:
    - keycloak_ha_enabled
    - not keycloak_remote_cache_enabled
    - (keycloak_config_override_template | default('', true)) | length == 0

- name: "Deploy HA config with infinispan: {{ keycloak_config.service_name }}"
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
  ansible.builtin.template:
    src: templates/standalone-infinispan.xml.j2
    dest: "{{ keycloak_config_path_to_standalone_xml }}"
    owner: "{{ keycloak_service_user }}"
    group: "{{ keycloak_service_group }}"
    mode: '0640'
  notify:
    - restart keycloak
  when:
    - keycloak_ha_enabled
    - keycloak_remote_cache_enabled
    - (keycloak_config_override_template | default('', true)) | length == 0

- name: "Deploy profile.properties file to {{ keycloak_config_path_to_properties }}"
  become: "{{ keycloak_install_require_privilege_escalation | default(true) }}"
  ansible.builtin.template:
    src: keycloak-profile.properties.j2
    dest: "{{ keycloak_config_path_to_properties }}"
    owner: "{{ keycloak_service_user }}"
    group: "{{ keycloak_service_group }}"
    mode: '0640'
  notify:
    - restart keycloak
  when: (keycloak_features | default([], true)) | length > 0