Ansible for the docs-rs builder

ansible/envs/staging/group_vars/docs-rs-builder.yml

@@ -0,0 +1,4 @@
+---
+
+sha: "{{ lookup('aws_ssm', '/docs-rs/builder/sha') }}"
+vars_repository_sha: "{{  sha | ternary(sha, 'HEAD') }}"

ansible/playbooks/docs-rs-builder.yml

@@ -0,0 +1,14 @@
+---
+
+- hosts: docs-rs-builder
+  become: yes
+  become_user: root
+
+  roles:
+
+    - role: common
+      papertrail_url: "{{ vars_papertrail_url }}"
+      collect_metrics_from: "{{ global_collect_metrics_from }}"
+      sudo_users: "{{ global_sudo_users }}"
+
+    - role: docs-rs-builder

ansible/requirements.txt

@@ -1,2 +1,2 @@
 ansible==2.9.26
-boto3==1.13.16
+boto3==1.14.0

ansible/roles/common/tasks/metrics.yml

@@ -33,7 +33,7 @@
         state: absent
 
   when: |
-    node_exporter_capture.rc != 0 or not node_exporter_capture.stderr.startswith(
+    node_exporter_capture.rc != 0 or not node_exporter_capture.stdout.startswith(
       "node_exporter, version " + node_exporter_version
     )
 

ansible/roles/docs-rs-builder/defaults/main.yml

@@ -0,0 +1,21 @@
+---
+
+vars_mountpoint_file_path: /builder.fs
+vars_mountpoint_size: 53687091200
+vars_mountpoint_path: /mnt/builder
+
+vars_user: builder
+vars_group: "{{ vars_user }}"
+vars_home_path: "/home/{{ vars_user }}"
+
+vars_repository_url: https://github.com/rust-lang/docs.rs
+vars_repository_sha: HEAD
+
+vars_checkout_path: "{{ vars_home_path }}/builder"
+vars_working_dir: "{{ vars_checkout_path }}"
+vars_executable_path: "{{ vars_working_dir }}/target/release/cratesfyi"
+
+vars_toolchain: nightly
+
+vars_database_url: "{{ lookup('aws_ssm', '/docs-rs/database-url') }}"
+vars_s3_bucket: docs-rs-storage-519825364412

ansible/roles/docs-rs-builder/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+
+- name: restart-docker
+  systemd:
+    name: docker
+    state: restarted
+    daemon_reload: true

ansible/roles/docs-rs-builder/tasks/main.yml

@@ -0,0 +1,152 @@
+---
+
+- name: Create user
+  user:
+    name: "{{ vars_user }}"
+    groups: docker
+    append: true
+
+# --------------------
+
+# Install Docker
+
+- name: Add Docker APT repository GPG key
+  apt_key:
+    state: present
+    keyserver: "https://download.docker.com/linux/{{ ansible_distribution|lower }}/gpg"
+    id: 7EA0A9C3F273FCD8
+
+- name: Add Docker APT repository
+  apt_repository:
+    repo: "deb [arch=amd64] https://download.docker.com/linux/{{ ansible_distribution|lower }} {{ ansible_distribution_release }} stable"
+    state: present
+    update_cache: true
+
+- name: Install Docker
+  apt:
+    name: docker-ce
+    state: present
+  notify: restart-docker
+
+- name: Make sure /etc/docker dir exists
+  file:
+    path: /etc/docker
+    state: directory
+
+- name: Configure Docker daemon
+  template:
+    src: daemon.json
+    dest: /etc/docker/daemon.json
+    mode: 0600
+  notify: restart-docker
+
+# --------------------
+
+# Set up a partition with limited space to avoid temporary
+# input/output files consuming all of the space on the primary
+# partition.
+
+- name: Check for mountpoint file
+  stat:
+    path: "{{ vars_mountpoint_file_path }}"
+  register: mountpoint_stat
+
+- name: Create mountpoint file
+  block:
+    - name: Allocate file
+      command: "fallocate -l {{ vars_mountpoint_size }} {{ vars_mountpoint_file_path }}"
+
+    - name: Locate mountpoint loopback device
+      command: "losetup -f --show {{ vars_mountpoint_file_path }}"
+      register: loopback
+
+    - name: Partition mountpoint
+      command: "mkfs -t ext3 -m 1 -v {{ loopback.stdout }}"
+  when: mountpoint_stat.stat.size is not defined or mountpoint_stat.stat.size != vars_mountpoint_size
+
+- name: Create mountpoint
+  file:
+    path: "{{ vars_mountpoint_path }}"
+    state: directory
+
+- name: Mount mountpoint
+  mount:
+    src: "{{ vars_mountpoint_file_path }}"
+    name: "{{ vars_mountpoint_path }}"
+    fstype: ext3
+    state: mounted
+
+- name: Change kubeconfig file permission
+  file:
+    path: "{{ vars_mountpoint_path }}"
+    owner: "{{ vars_user }}"
+    group: docker
+
+# --------------------
+
+- name: Checkout repository
+  become: true
+  become_user: "{{ vars_user }}"
+  git:
+    repo: "{{ vars_repository_url }}"
+    dest: "{{ vars_checkout_path }}"
+    version: "{{ vars_repository_sha }}"
+
+- name: Install awscli
+  apt:
+    name: awscli
+    state: present
+
+- name: Allow user to start and stop service
+  template:
+    src: sudoers
+    dest: "/etc/sudoers.d/{{ vars_user }}"
+    mode: 0440
+
+# ---------
+
+- name: install apt packages
+  apt:
+    name:
+      - build-essential
+      - cmake
+      - libssl-dev
+      - pkg-config
+    state: present
+
+- name: check if cargo is installed
+  shell: |
+    test -f ~/.cargo/env && . ~/.cargo/env && command -v cargo
+  register: cargo_exists
+  ignore_errors: yes
+
+- name: Download Installer
+  when: cargo_exists is failed
+  get_url:
+    url: https://sh.rustup.rs
+    dest: /tmp/sh.rustup.rs
+    mode: '0755'
+    force: 'yes'
+
+- name: install rust/cargo
+  when: cargo_exists is failed
+  shell: /tmp/sh.rustup.rs -y
+
+- name: Build builder
+  shell: | 
+    . ~/.cargo/env
+    cargo build --release
+  args:
+    chdir: "{{ vars_checkout_path }}"
+
+- name: Configure service
+  template:
+    src: builder.service
+    dest: /etc/systemd/system/builder.service
+    mode: 0644
+
+- name: Start and enable service
+  systemd:
+    name: builder
+    state: started
+    enabled: true

ansible/roles/docs-rs-builder/templates/builder.service

@@ -0,0 +1,27 @@
+#
+# {{ ansible_managed }}
+#
+
+[Unit]
+Description=The docs.rs Builder
+
+[Service]
+Environment=TMPDIR={{ vars_mountpoint_path }}
+Environment=DOCSRS_PREFIX={{ vars_mountpoint_path }}
+Environment=DOCSRS_RUSTWIDE_WORKSPACE={{ vars_mountpoint_path }}
+Environment=DOCSRS_LOG=debug
+Environment=DOCSRS_DATABASE_URL={{ vars_database_url }}
+Environment=DOCSRS_DOCKER_IMAGE=ghcr.io/rust-lang/crates-build-env/linux
+Environment=DOCSRS_STORAGE_BACKEND=s3
+Environment=S3_REGION=us-east-1
+Environment=DOCSRS_S3_BUCKET={{ vars_s3_bucket }}
+Environment=RUST_BACKTRACE=1
+Environment=DOCSRS_TOOLCHAIN={{ vars_toolchain }}
+
+LimitNOFILE=20000 # Consider removing now that we upload zip files
+Restart=on-failure
+WorkingDirectory={{ vars_working_dir }}
+ExecStart={{ vars_executable_path }} start-build-server
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/docs-rs-builder/templates/daemon.json

@@ -0,0 +1,3 @@
+{
+  "storage-driver": "overlay2"
+}

ansible/roles/docs-rs-builder/templates/sudoers

@@ -0,0 +1,7 @@
+#
+# {{ ansible_managed }}
+#
+
+builder ALL= NOPASSWD: /bin/systemctl stop builder.service
+builder ALL= NOPASSWD: /bin/systemctl start builder.service
+builder ALL= NOPASSWD: /bin/systemctl restart builder.service

terragrunt/modules/docs-rs/builder.tf

@@ -0,0 +1,44 @@
+// The instance profile the builder will assume when communicating with
+// other AWS services.
+
+resource "aws_iam_instance_profile" "builder" {
+  name = "builder"
+  role = aws_iam_role.builder.name
+}
+
+resource "aws_iam_role" "builder" {
+  name = "builder"
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Principal = {
+          Service = "ec2.amazonaws.com"
+        }
+        Action = ["sts:AssumeRole"]
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy" "builder_s3" {
+  role = aws_iam_role.builder.name
+  name = "builder_s3"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      // Access to s3
+      {
+        Effect = "Allow"
+        Action = "s3:*"
+
+        Resource = [
+          aws_s3_bucket.storage.arn,
+          "${aws_s3_bucket.storage.arn}/*"
+        ]
+      }
+    ]
+  })
+}