Upgrade for debian 13 compatibility & dependancies upgrade

.ansible-lint

@@ -1,7 +1,11 @@
 ---
-parseable: true
+exclude_paths:
+   - .github/
+
 skip_list:
    - meta-no-info # Not intended for galaxy, so that's ok if meta/main miss informations
    - var-naming[no-role-prefix]
    - yaml[quoted-strings]  # There is a bug in this rule
    - jinja[spacing]  # Sometime this is just more readable to not respect this
+
+offline: true

README.md

@@ -21,16 +21,16 @@ We can also provide you a 30-day trial license if you want to test the applicati
 
 ### Online
 - Ansible server:
-  - python >= 3.10
+  - python >= 3.11
   - must be able to contect through ssh to all the applicative servers
 - Applicative servers:
   - python >= 3.5
 
 ### Offline
 - Ansible server:
-  - python >= 3.10
+  - python >= 3.11
   - python3-request
-  - ansible >= 11.4.0
+  - ansible >= 12.3.0
   - sshpass
   - must be able to contect through ssh to all the applicative servers
 

inventory-upgrade.py

@@ -47,7 +47,7 @@
 smtp_default_email: "{{ smtp_default_email if smtp_default_email }}"
 debug_mail_to: "{{ debug_mail_to if debug_mail_to }}"
 
-{%- if docker_private_registry_login is defined and docker_private_registry_login | length %}
+{%- if docker_private_registry_login is defined and (docker_private_registry_login | length > 0) %}
 
 # Docker registry
 docker_private_registry_login: {{ docker_private_registry_login }}

requirements-dev.txt

@@ -1,3 +1,3 @@
-ansible==11.4.0
-yamllint==1.37.0
-ansible-lint==25.2.1
+ansible==12.3.0
+yamllint==1.38.0
+ansible-lint==26.6.0

requirements.txt

@@ -1 +1 @@
-ansible==11.4.0
+ansible==12.3.0

roles/bimdata/templates/compose-app.yml.j2

@@ -40,7 +40,7 @@ services:
     ports:
       - {{ external_port_http }}:80
       - {{ external_port_https }}:443
-{% if nginx_custom_log_format is defined and nginx_custom_log_format | length %}
+{% if nginx_custom_log_format is defined and (nginx_custom_log_format | length > 0) %}
     environment:
       - LOG_FORMAT={{ nginx_custom_log_format }}
 {% endif %}
@@ -179,10 +179,10 @@ services:
       - IAM_URL={{ urls['iam'] }}
       - IAM_ADMIN_LOGIN={{ iam_user }}
       - IAM_ADMIN_PASSWORD={{ iam_password }}
-{% if smtp_host is defined and smtp_host | length %}
+{% if smtp_host is defined and (smtp_host | length > 0) %}
       - SMTP_HOST={{ smtp_host }}
       - SMTP_PORT={{ smtp_port }}
-{% if smtp_user is defined and smtp_user | length %}
+{% if smtp_user is defined and (smtp_user | length > 0) %}
       - SMTP_USER={{ smtp_user }}
       - SMTP_PASS={{ smtp_pass }}
 {% endif %}
@@ -198,7 +198,7 @@ services:
       - S3_SECRET_ACCESS_KEY={{ s3_secret_access_key }}
       - S3_MULTIPART_THRESHOLD={{ s3_multipart_threshold }}
       - S3_STORAGE_BUCKET_NAME={{ s3_storage_api_bucket_name }}
-{% if s3_other_options is defined and s3_other_options | length %}
+{% if s3_other_options is defined and (s3_other_options | length > 0) %}
 {% for option in s3_other_options %}
       - {{ option.name | upper }}={{ option.value }}
 {% endfor %}
@@ -351,10 +351,10 @@ services:
       - DB_NAME={{ db_connect_name }}
       - DB_USER={{ db_connect_user }}
       - DB_PASSWORD={{ db_connect_password }}
-{% if smtp_host is defined and smtp_host | length %}
+{% if smtp_host is defined and (smtp_host | length > 0) %}
       - SMTP_HOST={{ smtp_host }}
       - SMTP_PORT={{ smtp_port }}
-{% if smtp_user is defined and smtp_user | length %}
+{% if smtp_user is defined and (smtp_user | length > 0) %}
       - SMTP_USER={{ smtp_user }}
       - SMTP_PASS={{ smtp_pass }}
 {% endif %}
@@ -371,7 +371,7 @@ services:
       - S3_MULTIPART_THRESHOLD={{ s3_multipart_threshold }}
       - S3_STORAGE_BUCKET_NAME={{ s3_storage_connect_bucket_name }}
       - CSP_STORAGE_URL={{ csp_storage_url }}
-{% if s3_other_options is defined and s3_other_options | length %}
+{% if s3_other_options is defined and (s3_other_options | length > 0) %}
 {% for option in s3_other_options %}
       - {{ option.name | upper }}={{ option.value }}
 {% endfor %}
@@ -451,10 +451,10 @@ services:
       - RABBITMQ_PORT={{ rabbitmq_port }}
       - RABBITMQ_USER={{ rabbitmq_user }}
       - RABBITMQ_PASSWORD={{ rabbitmq_password }}
-{% if smtp_host is defined and smtp_host | length %}
+{% if smtp_host is defined and (smtp_host | length > 0) %}
       - SMTP_HOST={{ smtp_host }}
       - SMTP_PORT={{ smtp_port }}
-{% if smtp_user is defined and smtp_user | length %}
+{% if smtp_user is defined and (smtp_user | length > 0) %}
       - SMTP_USER={{ smtp_user }}
       - SMTP_PASS={{ smtp_pass }}
 {% endif %}
@@ -673,10 +673,10 @@ services:
       - API_URL={{ urls['api'] }}
       - SECRET_KEY={{ marketplace_back_secret_key }}
       - ADMIN_INTERFACE=true
-{% if smtp_host is defined and smtp_host | length %}
+{% if smtp_host is defined and (smtp_host | length > 0) %}
       - SMTP_HOST={{ smtp_host }}
       - SMTP_PORT={{ smtp_port }}
-{% if smtp_user is defined and smtp_user | length %}
+{% if smtp_user is defined and (smtp_user | length > 0) %}
       - SMTP_USER={{ smtp_user }}
       - SMTP_PASS={{ smtp_pass }}
 {% endif %}
@@ -760,7 +760,7 @@ services:
       - INVITATION_SECRET={{ sso_invitation_secret }}
       - SMTP_HOST={{ smtp_host }}
       - SMTP_PORT={{ smtp_port }}
-{% if smtp_user is defined and smtp_user | length %}
+{% if smtp_user is defined and (smtp_user | length > 0) %}
       - SMTP_USER={{ smtp_user }}
       - SMTP_PASS={{ smtp_pass }}
 {% endif %}

roles/bimdata/templates/tls/cert.j2

@@ -1,4 +1,4 @@
 {{ lookup('vars', 'tls_'+item+'_cert') }}
-{% if tls_subca_certificates is defined and tls_subca_certificates | length %}
+{% if tls_subca_certificates is defined and (tls_subca_certificates | length > 0) %}
 {{ tls_subca_certificates }}
 {% endif %}

roles/docker/defaults/main.yml

@@ -2,14 +2,14 @@
 # Docker APT configuration
 docker_apt_dependencies:
   - ca-certificates
+  - python3-debian
 
-docker_apt_keyring_path: /etc/apt/keyrings/docker.asc
-docker_apt_repo_key_url: "{{ docker_repo_url }}/{{ ansible_distribution | lower }}/gpg"
 docker_repo_url: https://download.docker.com/linux
-docker_apt_release_channel: stable
-docker_apt_repo: >-
-  deb [signed-by={{ docker_apt_keyring_path }}] {{ docker_repo_url }}/{{ ansible_distribution | lower }}
-  {{ ansible_distribution_release }} {{ docker_apt_release_channel }}
+
+docker_apt_repo_key_url: "{{ docker_repo_url }}/{{ ansible_distribution | lower }}/gpg"
+docker_apt_repo_url: "{{ docker_repo_url }}/{{ ansible_distribution | lower }}"
+docker_apt_repo_suites: "{{ ansible_distribution_release }}"
+docker_apt_repo_components: stable
 
 docker_dnf_repo: "{{ docker_repo_url }}/centos/docker-{{ docker_edition }}.repo"
 docker_dnf_repo_key_url: "{{ docker_repo_url }}/centos/gpg"
@@ -20,7 +20,7 @@ docker_pkg_name: "docker-{{ docker_edition }}"
 
 # !! ONLY WORKS WITH APT !!
 # dnf seems to ignore the specified version in most cases when a version is already installed
-docker_pkg_version: "5:27.*"
+docker_pkg_version: "5:29.*"
 docker_pkg_version_hold: "{{ docker_pkg_version | default(false) | ternary(true, false) }}"
 
 docker_compose_pkg_name: "docker-compose-plugin"
@@ -31,3 +31,7 @@ docker_compose_pkg_version_hold: "{{ docker_compose_pkg_version | default(false)
 docker_svc_name: docker
 docker_svc_state: started
 docker_svc_enabled: true
+
+
+### Legacy value
+docker_legacy_apt_repository_file: /etc/apt/sources.list.d/docker.list

roles/docker/tasks/install-debian.yml

@@ -1,46 +1,32 @@
 ---
-- name: "Cleanup legacy key in main keyring if needed."
-  ansible.builtin.apt_key:
-    id: "9DC858229FC7DD38854AE2D88D81803C0EBFCD88"
-    state: absent
-
-- name: "Cleanup legacy Docker repository."
-  ansible.builtin.apt_repository:
-    filename: docker
-    repo: >
-      deb [arch=amd64] {{ docker_repo_url }}/{{ ansible_distribution | lower }}
-      {{ ansible_distribution_release }} {{ docker_apt_release_channel }}
-    update_cache: false
-    state: absent
-
 - name: Install Docker prerequisites
   ansible.builtin.apt:
     name: "{{ docker_apt_dependencies }}"
     state: present
     update_cache: true
   environment: "{{ proxy_env }}"
 
-- name: Make sur docker keyring folder exists
+- name: "Remove legacy repository"
   ansible.builtin.file:
-    path: "{{ docker_apt_keyring_path | dirname }}"
-    state: directory
-    mode: '0755'
-
-- name: Add Docker key
-  ansible.builtin.get_url:
-    url: "{{ docker_apt_repo_key_url }}"
-    dest: "{{ docker_apt_keyring_path }}"
-    mode: '0644'
-    force: true
-  environment: "{{ proxy_env }}"
+    path: "{{ docker_legacy_apt_repository_file }}"
+    state: absent
+  register: _remove_apt_legacy
 
 - name: Add Docker repository
-  ansible.builtin.apt_repository:
-    filename: docker
-    repo: "{{ docker_apt_repo }}"
-    update_cache: true
+  ansible.builtin.deb822_repository:
+    name: docker
+    types: deb
+    uris: "{{ docker_apt_repo_url }}"
+    suites: "{{ docker_apt_repo_suites }}"
+    components: "{{ docker_apt_repo_components }}"
+    signed_by: "{{ docker_apt_repo_key_url }}"
     state: present
   environment: "{{ proxy_env }}"
+  register: _add_apt_repo
+
+- name: "Update apt cache if necessary"
+  ansible.builtin.apt:
+    update_cache: "{{ _remove_apt_legacy.changed or _add_apt_repo.changed }}"
 
 - name: Install Docker
   ansible.builtin.apt:
@@ -70,4 +56,3 @@
   ansible.builtin.dpkg_selections:
     name: "{{ docker_compose_pkg_name }}"
     selection: "{{ docker_compose_pkg_version_hold | ternary ('hold', 'install') }}"
-

roles/docker/tasks/main.yml

@@ -15,8 +15,8 @@
     group: root
     mode: "0640"
   when: >
-    (http_proxy is defined and http_proxy | length)
-    or (https_proxy is defined and https_proxy | length)
+    (http_proxy is defined and (http_proxy | length > 0))
+    or (https_proxy is defined and (https_proxy | length > 0))
 
 - name: Configure docker proxy if needed
   ansible.builtin.template:
@@ -26,8 +26,8 @@
     group: root
     mode: "0640"
   when: >
-    (http_proxy is defined and http_proxy | length)
-    or (https_proxy is defined and https_proxy | length)
+    (http_proxy is defined and (http_proxy | length > 0))
+    or (https_proxy is defined and (https_proxy | length > 0))
   notify: Restart Docker
 
 - name: Flush handlers to avoid any conflict with the desired state

roles/post_run/tasks/20260128.yml

@@ -20,7 +20,7 @@
   when:
     - db_info.current_version is version("15", ">=")
 
-- name: "Run Postgres vaccum analyze on the database {{ db_info.name }} on the database {{ db_info.name }}"
+- name: "Run Postgres vaccum analyze on the database {{ db_info.name }}"
   community.docker.docker_container_exec:
     container: "{{ db_info.name }}-db"
     command: >-

roles/post_run/tasks/main.yml

@@ -2,7 +2,7 @@
 - name: "Apply post upgrade tasks for Postgresql major upgrade."
   when:
     - _dbs_upgraded is defined
-    - _dbs_upgraded | length
+    - _dbs_upgraded | length > 0
   ansible.builtin.include_tasks: db_upgraded.yml
   loop: "{{ _dbs_upgraded }}"
   loop_control:

roles/prepare_vars/tasks/bastion.yml

@@ -3,11 +3,11 @@
   ansible.builtin.assert:
     that:
       - bastion_ssh_addr is defined
-      - bastion_ssh_addr | length
+      - bastion_ssh_addr | length > 0
       - bastion_ssh_port is defined
       - bastion_ssh_port | int
       - bastion_ssh_user is defined
-      - bastion_ssh_user | length
+      - bastion_ssh_user | length > 0
     fail_msg: >
       You choose to use a connection through a bastion (use_bastion: true),
       bastion_ssh_addr, bastion_ssh_port, bastion_ssh_user must be defined and not empty.
@@ -16,6 +16,6 @@
   ansible.builtin.set_fact:
     ansible_ssh_common_args: >
       -o ProxyCommand='ssh -W %h:%p -q -p {{ bastion_ssh_port | default(22) }} {{ bastion_ssh_user }}@{{ bastion_ssh_addr }}
-      {%- if bastion_ssh_extra_options is defined and bastion_ssh_extra_options | length %}
+      {%- if bastion_ssh_extra_options is defined and (bastion_ssh_extra_options | length > 0) %}
         {{ bastion_ssh_extra_options }}
       {%- endif -%}'

roles/prepare_vars/tasks/database.yml

@@ -7,7 +7,7 @@
       ansible.builtin.assert:
         that:
           - external_db_host is defined
-          - external_db_host | length
+          - external_db_host | length > 0
           - external_db_port is defined
           - external_db_port | int
         fail_msg: "You choose to use an external database server (use_external_db: true), external_db_host, external_db_port must be defined and not empty."

roles/prepare_vars/tasks/rabbitmq.yml

@@ -7,7 +7,7 @@
       ansible.builtin.assert:
         that:
           - external_rabbitmq_host is defined
-          - external_rabbitmq_host | length
+          - external_rabbitmq_host | length > 0
           - external_rabbitmq_port is defined
           - external_rabbitmq_port | int
         fail_msg: >
@@ -25,7 +25,7 @@
   block:
     - name: Check if rabbitmq is on the same same host
       ansible.builtin.set_fact:
-        rabbit_is_local: "{{ inventory_hostname in groups['app'] | default(false) }}"
+        rabbit_is_local: "{{ (inventory_hostname in groups['app']) | default(false) }}"
 
     - name: Set RabbitMQ connection variable accordingly
       ansible.builtin.set_fact:

roles/prepare_vars/tasks/sso.yml

@@ -3,6 +3,6 @@
   ansible.builtin.assert:
     that:
       - smtp_host is defined
-      - smtp_host | length
+      - smtp_host | length > 0
     fail_msg: "You choose to use the SSO email module (sso_invitation_enabled: true), smtp_host must be defined and not empty."
   when: sso_invitation_enabled

roles/prepare_vars/tasks/storage.yml

@@ -3,13 +3,13 @@
   ansible.builtin.assert:
     that:
       - s3_endpoint_url is defined
-      - s3_endpoint_url | length
+      - s3_endpoint_url | length > 0
       - s3_region_name is defined
-      - s3_region_name | length
+      - s3_region_name | length > 0
       - s3_access_key_id is defined
-      - s3_access_key_id | length
+      - s3_access_key_id | length > 0
       - s3_secret_access_key is defined
-      - s3_secret_access_key | length
+      - s3_secret_access_key | length > 0
     fail_msg: >
       You choose to use an object storage (s3_enabled: true or s3_connect_enabled: true),
       s3_endpoint_url, s3_region_name, s3_access_key_id, s3_secret_access_key must be defined and not empty.
@@ -19,7 +19,7 @@
   ansible.builtin.assert:
     that:
       - s3_storage_api_bucket_name is defined
-      - s3_storage_api_bucket_name | length
+      - s3_storage_api_bucket_name | length > 0
     fail_msg: >
       You choose to use an object storage for the API (s3_enabled: true),
       s3_storage_api_bucket_name must be defined and not empty.
@@ -29,7 +29,7 @@
   ansible.builtin.assert:
     that:
       - s3_storage_connect_bucket_name is defined
-      - s3_storage_connect_bucket_name | length
+      - s3_storage_connect_bucket_name | length > 0
     fail_msg: >
       You choose to use an object storage for the API (s3_connect_enabled: true),
       s3_storage_connect_bucket_name must be defined and not empty.