disable craftbukkit max tick

roles/craftbukkit/defaults/main.yaml

@@ -0,0 +1,22 @@
+---
+craftbukkit_java_package_name: openjdk-8-jre-headless
+craftbukkit_java_package_state: present
+
+craftbukkit_version: 1.15.2
+craftbukkit_jar: "craftbukkit-{{ craftbukkit_version }}.jar"
+
+craftbukkit_service_name: craftbukkit.service
+craftbukkit_service_state: started
+craftbukkit_service_enabled: yes
+
+craftbukkit_port: 25565
+
+craftbukkit_user: craftbukkit
+craftbukkit_group: craftbukkit
+
+craftbukkit_opt_path: /opt/craftbukkit
+craftbukkit_var_path: /var/opt/craftbukkit
+
+craftbukkit_syslog_facility: local5
+
+craftbukkit_notifier_state: present

roles/craftbukkit/files/discord.py

@@ -0,0 +1,120 @@
+#!/usr/bin/env python
+
+from __future__ import print_function
+
+import sys
+import requests
+import re
+import argparse
+
+from urlparse import urljoin
+
+PATTERN = re.compile(r"(\S+) (joined|left) the game")
+
+PATTERNS = (
+    (re.compile(r": (\S+)\[.+logged in"), "{0} joined the game"),
+    (re.compile(r"(\S+) (joined|left) the game"), "{0} {1} the game"),
+    (re.compile(r"\[(\S+): Gave (\d+) \[(.+)\] to (\S+)\]"), "{0} gave {1} \"{2}\" to {3}"), 
+    (re.compile(r"(\S+) was (\S+) by (\S+)"), ":skull: {0} was {1} by {2}"),
+    (re.compile(r"(\S+) tried to swim in lava"), "{0} tried to swim in lava"),
+)
+
+
+def print_err(s):
+    print(s, file=sys.stderr)
+    sys.stderr.flush()
+
+
+def ok():
+    print("OK")
+    sys.stdout.flush()
+
+
+def cli_parse(args):
+    parser = argparse.ArgumentParser()
+    opt = parser.add_argument
+    opt("--config", "-c", dest="config", type=parse_kv_file)
+    opt("--confirm", action="store_const", dest="confirm", const=True, default=True)
+    opt("--no-confirm", action="store_const", dest="confirm", const=False)
+    opt("--verbose", "-v", action="store_true")
+    opt("--debug", "-d", action="store_true")
+    cli_args = parser.parse_args(args[1:])
+    return cli_args, parser
+
+
+def parse_kv_file(f, mode="r"):
+    if isinstance(f, str):
+        f = open(f, mode)
+
+    kv = {}
+    with f:
+        for line in f:
+            k, v = line.partition("=")[::2]
+            kv[k.strip().lower()] = v.strip()
+
+    return kv
+
+
+class DiscordHook:
+    def __init__(self, hook_id, hook_token):
+        url_path = "/".join([hook_id, hook_token])
+        url = urljoin("https://discordapp.com/api/webhooks/", url_path)
+        self.url = url
+
+    def send(self, content):
+        data = {"content": content}
+        r = requests.post(self.url, data=data)
+        r.raise_for_status()
+        return r
+
+
+def loop(handler, confirm=True):
+    if confirm:
+        ok()
+
+    while 1:
+        try:
+            line = sys.stdin.readline()
+        except KeyboardInterrupt:
+            print_err("\nreceived sigint, exiting")
+            break
+
+        if not line:
+            break
+
+        for pattern, fmt in PATTERNS:
+            match = pattern.search(line.strip())
+
+            if match:
+                message = fmt.format(*match.groups())
+
+                try:
+                    handler.send(message)
+                except Exception as e:
+                    print_err(e)
+                    continue
+
+        if confirm:
+            ok()
+
+
+def main(argv):
+    args, _ = cli_parse(argv)
+
+    if args.debug:
+        print("started with args {0}".format(vars(args)))
+
+    webhook_id = args.config.get("webhook_id")
+    webhook_token = args.config.get("webhook_token")
+
+    if webhook_id is None:
+        raise SystemExit("webhook_id is unset")
+    if webhook_token is None:
+        raise SystemExit("webhook_token is unset")
+
+    handler = DiscordHook(webhook_id, webhook_token)
+
+    return loop(handler, confirm=args.confirm)
+
+
+raise SystemExit(main(sys.argv))

roles/craftbukkit/handlers/main.yaml

@@ -0,0 +1,11 @@
+---
+- name: craftbukkit daemon-reload
+  systemd:
+    name: "{{ craftbukkit_service_name }}"
+    daemon_reload: yes
+    state: restarted
+
+- name: restart craftbukkit
+  service:
+    name: "{{ craftbukkit_service_name }}"
+    state: restarted

roles/craftbukkit/tasks/main.yaml

@@ -0,0 +1,120 @@
+---
+- name: create craftbukkit group
+  group:
+    name: "{{ craftbukkit_group }}"
+    gid: "{{ craftbukkit_group_gid | default(omit) }}"
+    state: "{{ craftbukkit_group_state | default('present') }}"
+    system: yes
+
+- name: create craftbukkit user
+  user:
+    name: "{{ craftbukkit_user }}"
+    uid: "{{ craftbukkit_user_uid | default(omit) }}"
+    group: "{{ craftbukkit_group }}"
+    home: "{{ craftbukkit_var_path }}"
+    create_home: no
+    shell: "{{ craftbukkit_shell | default('/usr/sbin/nologin') }}"
+    state: "{{ craftbukkit_user_state | default('present') }}"
+    system: yes
+  
+- name: install java
+  package:
+    name: "{{ craftbukkit_java_package_name }}"
+    state: "{{ craftbukkit_java_package_state }}"
+
+- name: create craftbukkit installation directory
+  file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  with_items:
+    - "{{ craftbukkit_opt_path }}"
+    - "{{ craftbukkit_opt_path }}/bin"
+    - "{{ craftbukkit_opt_path }}/etc"
+
+- name: create craftbukkit var directory
+  file:
+    path: "{{ craftbukkit_var_path }}"
+    state: directory
+    owner: "{{ craftbukkit_user }}"
+    group: "{{ craftbukkit_group }}"
+    mode: "0755"
+
+- name: "upload {{ craftbukkit_jar }}"
+  copy:
+    src: "files/craftbukkit/{{ craftbukkit_jar }}"
+    dest: "{{ craftbukkit_opt_path }}/bin/{{ craftbukkit_jar }}"
+    owner: "{{ craftbukkit_user }}"
+    group: "{{ craftbukkit_group }}"
+    mode: "0644"
+
+- name: agree to the eula
+  copy:
+    content: "eula=true"
+    dest: "{{ craftbukkit_var_path }}/eula.txt"
+    owner: "{{ craftbukkit_user }}"
+    group: "{{ craftbukkit_group }}"
+    mode: "0644"
+
+- name: configure server.properties
+  template:
+    src: server.properties.j2
+    dest: "{{ craftbukkit_var_path }}/server.properties"
+    owner: root
+    group: root
+    mode: 0644
+  notify: restart craftbukkit
+
+- name: configure systemd unit
+  template:
+    src: craftbukkit.service.j2
+    dest: /etc/systemd/system/craftbukkit.service
+    owner: root
+    group: root
+    mode: 0644
+  notify: craftbukkit daemon-reload
+
+- name: manage craftbukkit service
+  service:
+    name: "{{ craftbukkit_service_name }}"
+    state: "{{ craftbukkit_service_state }}"
+    enabled: "{{ craftbukkit_service_enabled }}"
+
+- name: install discord notifier
+  copy:
+    src: discord.py
+    dest: "{{ craftbukkit_opt_path }}/bin/craftbukkit-discord"
+    owner: root
+    group: root
+    mode: 0755
+  notify: restart rsyslog
+
+- name: configure discord notifier
+  copy:
+    dest: "{{ craftbukkit_opt_path }}/etc/discord.cfg"
+    owner: syslog
+    group: syslog
+    mode: 0600
+    content: "{% for k, v in craftbukkit_discord_config.items() %}{{ k }}={{ v }}{{ \"\n\" }}{% endfor %}"
+  notify: restart rsyslog
+
+- name: configure rsyslog program
+  template:
+    src: rsyslog/craftbukkit.conf.j2
+    dest: /etc/rsyslog.d/05-craftbukkit.conf
+    owner: root
+    group: root
+    mode: 0644
+  notify: restart rsyslog
+
+- name: manage rsyslog configuration
+  file:
+    path: "{{ item }}"
+    state: "{{ (craftbukkit_notifier_state == 'present') | ternary('file', 'absent') }}"
+  loop:
+    - /etc/rsyslog.d/05-craftbukkit.conf
+    - "{{ craftbukkit_opt_path }}/etc/discord.cfg"
+    - "{{ craftbukkit_opt_path }}/bin/craftbukkit-discord"
+  notify: restart rsyslog

roles/craftbukkit/templates/craftbukkit.service.j2

@@ -0,0 +1,19 @@
+# {{ ansible_managed }}
+
+[Unit]
+Description=Craftbukkit server %i
+After=network.target
+
+[Service]
+ExecStart=/usr/bin/java -Xmx{{ craftbukkit_java_xmx | default('1024M') }} -Xms{{ craftbukkit_java_xms | default('1024M') }} -jar {{ craftbukkit_opt_path }}/bin/{{ craftbukkit_jar }} nogui
+SuccessExitStatus=143
+Type=simple
+User={{ craftbukkit_user }}
+Group={{ craftbukkit_group }}
+WorkingDirectory={{ craftbukkit_var_path }}/%i
+Restart=on-failure
+SyslogIdentifier=craftbukkit
+SyslogFacility={{ craftbukkit_syslog_facility }}
+
+[Install]
+WantedBy=multi-user.target

roles/craftbukkit/templates/rsyslog/craftbukkit.conf.j2

@@ -0,0 +1,11 @@
+# {{ ansible_managed }}
+
+module(load="omprog")
+
+if ( $programname == "craftbukkit" ) then {
+  action(
+    type="omprog"
+    binary="{{ craftbukkit_opt_path }}/bin/craftbukkit-discord --config {{ craftbukkit_opt_path }}/etc/discord.cfg"
+    confirmmessages="on"
+  )
+}

roles/craftbukkit/templates/server.properties.j2

@@ -0,0 +1,47 @@
+# {{ ansible_managed }}
+
+spawn-protection=16
+max-tick-time=-1
+query.port: {{ craftbukkit_port | default(25565) }}
+generator-settings=
+force-gamemode=false
+allow-nether=true
+enforce-whitelist: {{ (craftbukkit_config.enfoce_whitelist | default(true)) | ternary('true', 'false') }}
+gamemode=survival
+broadcast-console-to-ops=true
+enable-query=false
+player-idle-timeout=0
+difficulty=easy
+spawn-monsters=true
+broadcast-rcon-to-ops=true
+op-permission-level=4
+pvp=true
+snooper-enabled=true
+level-type=default
+hardcore=false
+enable-command-block=false
+max-players=20
+network-compression-threshold=256
+resource-pack-sha1=
+max-world-size=29999984
+function-permission-level=2
+rcon.port=25575
+server-port: {{ craftbukkit_port | default(25565) }}
+debug=false
+server-ip=
+spawn-npcs=true
+allow-flight=false
+level-name=world
+view-distance=10
+resource-pack=
+spawn-animals=true
+white-list: {{ (craftbukkit_config.whitelist | default(true)) | ternary('true', 'false') }}
+rcon.password=
+generate-structures=true
+max-build-height=256
+online-mode=true
+level-seed=
+use-native-transport=true
+prevent-proxy-connections=false
+enable-rcon=false
+motd=A Minecraft Server

roles/gitea/defaults/main.yaml

@@ -4,9 +4,9 @@ gitea_service_state: started
 gitea_service_enabled: yes
 
 gitea_arch: amd64
-gitea_version: 1.10.2
+gitea_version: 1.11.4
 gitea_url: "https://dl.gitea.io/gitea/{{ gitea_version }}/gitea-{{ gitea_version }}-linux-{{ gitea_arch }}"
-gitea_checksum: sha256:e0479c0be2852357a84ac6b45b5de41ca5552c889cff385e6d57aa50a8f5a14c
+gitea_checksum: sha256:4408c781069c36cbb1b5923ae924e67ceee661ba9c9bd6c73cd7408c9cd62af6
 gitea_bin_path: /usr/local/bin
 gitea_var_path: /var/lib/gitea
 gitea_log_path: /var/log/gitea

roles/go/defaults/main.yaml

@@ -1,4 +1,4 @@
 ---
-go_version: 1.13.6
+go_version: 1.14.2
 go_url: "https://dl.google.com/go/go{{ go_version }}.{{ ansible_system | lower }}-{{ go_arch }}.tar.gz"
 go_version_str: "go version go{{ go_version }} {{ ansible_system | lower}}/{{ go_arch }}"

roles/go/tasks/main.yaml

@@ -52,7 +52,8 @@
     src: "/usr/local/src/go{{ go_version }}.{{ ansible_system | lower }}-{{ go_arch }}.tar.gz"
     dest: /usr/local
     remote_src: yes
-  when: st.stat.exists is defined and not st.stat.exists
+  when:
+    - (st.stat.exists is defined and not st.stat.exists) or gv.stdout != go_version_str
 
 - name: environment
   copy:

roles/go/vars/i386.yaml

@@ -1,3 +1,3 @@
 ---
 go_arch: 386
-go_checksum: sha256:27feb013106da784f09e560720aa41ab395c67f7eed4c4a0fce04bc6e3d01c7d
+go_checksum: sha256:cdcdab6c8d1f2dcea3bbec793352ef84db167a2eb6c60ff69e5cf94dca575f9a

roles/go/vars/x86_64.yaml

@@ -1,3 +1,3 @@
 ---
 go_arch: amd64
-go_checksum: sha256:a1bc06deb070155c4f67c579f896a45eeda5a8fa54f35ba233304074c4abbbbd
+go_checksum: sha256:6272d6e940ecb71ea5636ddb5fab3933e087c1356173c61f4a803895e947ebb3

roles/restic/defaults/main.yaml

@@ -10,6 +10,7 @@ restic_checksum: sha256:a88ca09d1dd051d470965667a224a2b81930c6628a0566b7b17868be
 restic_bin_path: /usr/local/bin
 restic_etc_path: /etc/restic
 restic_path: "{{ restic_bin_path }}/restic"
+restic_self_update: true
 
 restic_global_exclude:
   - /dev

roles/restic/files/hooks/craftbukkit.sh

@@ -0,0 +1,116 @@
+#!/bin/bash
+
+set -e
+
+SERVICE=craftbukkit.service
+VAR_DIR=/var/opt/craftbukkit
+WAIT=30
+VERBOSE=${VERBOSE:-4}
+
+prereq() {
+    local service=$1
+    if ! systemctl list-units --full --all | grep -Fq "$service"; then
+        printf "%s unit does not exit\n" "$service"
+        exit 1
+    fi
+}
+
+error_exit() {
+    printf "%s\n" "$1" >&2
+    exit 1
+}
+
+stop_server() {
+    local unit="${1:-$SERVICE}"
+    local attempts="${2:-$WAIT}"
+
+    if ! systemctl -q is-enabled "$unit"; then
+        printf "%s is not enabled, skipping.\n" "$unit"
+        return 0
+    fi
+
+    if ! systemctl -q is-active "$unit"; then
+        printf "%s is already stopped\n" "$unit"
+        return 0
+    fi
+
+    systemctl -q stop "$unit"
+
+    while systemctl -q is-active "$unit"; do
+        printf "waiting for %s to stop ... (%s)\n" "$unit" "$attempts"
+        ((attempts--))
+        if ((attempts == 0)); then
+            return 1
+        fi
+        sleep 1
+    done
+
+    return 0
+}
+
+start_server() {
+    local unit="${1:-$SERVICE}"
+    local attempts="${2:-$WAIT}"
+
+    if ! systemctl -q is-enabled "$unit"; then
+        printf "%s is not enabled, skipping.\n" "$unit"
+        return 0
+    fi
+
+    if systemctl -q is-active "$unit"; then
+        printf "%s is already started\n" "$unit"
+        return 0
+    fi
+
+    systemctl -q start "$unit"
+
+    while ! systemctl -q is-active "$unit"; do
+        printf "waiting for %s to start ... (%d)\n" "$unit" "$attempts"
+        ((attempts--))
+        if ((attempts == 0)); then
+            return 1
+        fi
+        sleep 1
+    done
+
+    return 0
+}
+
+
+open_files() {
+    local dir=${1-$VAR_DIR}
+    local attempts="${2:-$WAIT}"
+
+    while (($(lsof +D "$dir" | wc -l) > 0)); do
+        printf "waiting for open files ... (%d)\n" "$attempts"
+        ((attempts--))
+        if ((attempts == 0)); then
+            return 1
+        fi
+        sleep 1
+    done
+
+    return 0
+}
+
+
+main() {
+
+    if [ "$1" == "pre" ]; then
+        if ! stop_server $SERVICE; then
+            error_exit "Failed to stop $SERVICE"
+        fi
+
+        printf "checking for open files\n"
+
+        if ! open_files $VAR_DIR; then
+            error_exit "Open files exist in $VAR_DIR"
+        fi
+    elif [ "$1" == "post" ]; then
+        if ! start_server $SERVICE; then
+            error_exit "Failed to start $SERVICE"
+        fi
+    fi
+}
+
+main "$@"

roles/restic/files/restic-job.sh

@@ -8,11 +8,27 @@ error_exit() {
 }
 
 RESTIC_ETC_PATH=${RESTIC_ETC_PATH:-/etc/restic}
-RESTIC_PATH=${RESTIC_PATH:-/usr/local/bin/restic}
+LOCK_PATH=/run/restic
 
+# shellcheck source=/dev/null
+source "${RESTIC_ETC_PATH}/env.sh"
+
+KEEP_LOCK=
 MAX_ATTEMPTS=60
 NICE="ionice -c2 nice -n19"
 JOB=$1
+LOCK="/run/restic/${JOB}.lock"
+
+function finish {
+    if [ -z $KEEP_LOCK ]; then
+        rm -f "$LOCK"
+    fi
+}
+trap finish EXIT
+
+if [ ! -d $LOCK_PATH ]; then
+    mkdir $LOCK_PATH
+fi
 
 if [ -z "$JOB" ]; then
     error_exit "job is missing"
@@ -49,6 +65,27 @@ if [ -z "${PATHS+x}" ]; then
     error_exit "\$PATHS is not set"
 fi
 
+if [ -f "$LOCK" ]; then
+    pid=$(cat "$LOCK")
+    if ! kill -0 "$pid" 2> /dev/null; then
+        printf "removing orphaned lock, pid %d does not exist\n" "$pid"
+        rm -f "$LOCK"
+    else
+        if [[ -f "/proc/${pid}/cmdline" ]]; then
+            cmdline=$(tr "\0" " " <"/proc/${pid}/cmdline")
+            if ! [[ $cmdline =~ $(basename "$0") ]]; then
+                printf "removing orphaned lock, pid %d belongs to another process\n" "$pid"
+                rm -f "$LOCK"
+            fi
+        else
+            KEEP_LOCK=1
+            error_exit "another job is running, pid=${pid}"
+        fi
+    fi
+fi
+
+echo $$ > "$LOCK"
+
 printf "job '%s' started\n" "$JOB"
 
 if [ -d "${HOOKS_PATH}" ]; then

roles/restic/files/restic-repo.sh

@@ -8,7 +8,9 @@ error_exit() {
 }
 
 RESTIC_ETC_PATH=${RESTIC_ETC_PATH:-/etc/restic}
-RESTIC_PATH=${RESTIC_PATH:-/usr/local/bin/restic}
+
+# shellcheck source=/dev/null
+source "${RESTIC_ETC_PATH}/env.sh"
 
 if [ $# -lt 2 ]; then
     error_exit "missing arguments"

roles/restic/files/restic-tidy.sh

@@ -8,7 +8,14 @@ error_exit() {
 }
 
 RESTIC_ETC_PATH=${RESTIC_ETC_PATH:-/etc/restic}
-RESTIC_PATH=${RESTIC_PATH:-/usr/local/bin/restic}
+
+# shellcheck source=/dev/null
+source "${RESTIC_ETC_PATH}/env.sh"
+
+if [ "$RESTIC_SELF_UPDATE" -eq 1 ]; then
+  printf "running restic self-update\n"
+  $RESTIC_PATH self-update
+fi
 
 # initial sleep
 MAX_ATTEMPTS=60

roles/restic/tasks/main.yaml

@@ -65,6 +65,14 @@
     - "{{ restic_etc_path }}/repos"
     - "{{ restic_etc_path }}/jobs"
 
+- name: create environment helper
+  template:
+    src: env.sh.j2
+    dest: "{{ restic_etc_path }}/env.sh"
+    owner: root
+    group: root
+    mode: 0400
+
 - name: copy restic helper scripts
   copy:
     src: "{{ item }}"

roles/restic/templates/env.sh.j2

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# {{ ansible_managed }}
+
+RESTIC_ETC_PATH="{{ restic_etc_path | default('/etc/restic') }}"
+RESTIC_PATH="{{ restic_path | default('/usr/local/bin/restic') }}"
+RESTIC_SELF_UPDATE={{ restic_self_update | ternary(1, 0) }}

roles/util/defaults/main.yaml

@@ -24,6 +24,8 @@ util_packages:
     - mbuffer
     - socat
     - spiped
+    - mtr-tiny
+    - traceroute
   math:
     - bc
   misc:
@@ -43,6 +45,7 @@ util_packages:
     - iftop
     - lsof
     - sysdig
+    - dstat
   security:
     - gnupg
     - pass