)]}'
{"handlers/main.yml":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"8543ea073b039603c1c4081b44b4e757716f6726","unresolved":true,"context_lines":[{"line_number":103,"context_line":""},{"line_number":104,"context_line":"- name: Delete encryption keyfile after starting Galera"},{"line_number":105,"context_line":"  file:"},{"line_number":106,"context_line":"    path: \"/tmp/.keyfile.key\""},{"line_number":107,"context_line":"    state: absent"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"7a9bc1eb_5254e2e1","line":106,"range":{"start_line":106,"start_character":4,"end_line":106,"end_character":29},"updated":"2021-03-31 12:45:42.000000000","message":"We don\u0027t have this path on the destination - we use it on localhost?","commit_id":"56ee28c4c412426c70d210e5ca64c2c015b0011e"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"c03bc05c4044493c5ad09b64ff4bf7d00c3922b1","unresolved":false,"context_lines":[{"line_number":103,"context_line":""},{"line_number":104,"context_line":"- name: Delete encryption keyfile after starting Galera"},{"line_number":105,"context_line":"  file:"},{"line_number":106,"context_line":"    path: \"/tmp/.keyfile.key\""},{"line_number":107,"context_line":"    state: absent"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"876a6a3d_1daa708d","line":106,"range":{"start_line":106,"start_character":4,"end_line":106,"end_character":29},"in_reply_to":"3e519b49_b19d46b9","updated":"2021-04-19 07:24:17.000000000","message":"Done","commit_id":"56ee28c4c412426c70d210e5ca64c2c015b0011e"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"1cc726960333562b0114d2f7abb877bc2655a151","unresolved":true,"context_lines":[{"line_number":103,"context_line":""},{"line_number":104,"context_line":"- name: Delete encryption keyfile after starting Galera"},{"line_number":105,"context_line":"  file:"},{"line_number":106,"context_line":"    path: \"/tmp/.keyfile.key\""},{"line_number":107,"context_line":"    state: absent"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3e519b49_b19d46b9","line":106,"range":{"start_line":106,"start_character":4,"end_line":106,"end_character":29},"in_reply_to":"7a9bc1eb_5254e2e1","updated":"2021-03-31 13:02:50.000000000","message":"This is on the destination. I\u0027ll fix the wrong path.","commit_id":"56ee28c4c412426c70d210e5ca64c2c015b0011e"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"8543ea073b039603c1c4081b44b4e757716f6726","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"4dc300c0_c7a00c07","line":108,"updated":"2021-03-31 12:45:42.000000000","message":"should we add condition here to run only when galera_mariadb_encryption_enabled is true?","commit_id":"56ee28c4c412426c70d210e5ca64c2c015b0011e"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"1cc726960333562b0114d2f7abb877bc2655a151","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"5e404883_4b9632b0","line":108,"in_reply_to":"4dc300c0_c7a00c07","updated":"2021-03-31 13:02:50.000000000","message":"Yes, I\u0027ll add it.","commit_id":"56ee28c4c412426c70d210e5ca64c2c015b0011e"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"c03bc05c4044493c5ad09b64ff4bf7d00c3922b1","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"112ff472_6b0dade1","line":108,"in_reply_to":"5e404883_4b9632b0","updated":"2021-04-19 07:24:17.000000000","message":"Done","commit_id":"56ee28c4c412426c70d210e5ca64c2c015b0011e"}],"releasenotes/notes/add-encryption-support-79e8218926995864.yaml":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"09e15b020139e0db6bb14dc141c77773d5456b02","unresolved":true,"context_lines":[{"line_number":7,"context_line":"    You can override enryption options with ``galera_encryption_overrides``."},{"line_number":8,"context_line":"    The role creates ``galera_db_encryption_keys`` for you, if they\u0027re not specified."},{"line_number":9,"context_line":"    To specify your on encryption keys, provide them like this."},{"line_number":10,"context_line":"    ::"},{"line_number":11,"context_line":"        galera_db_encryption_keys: |"},{"line_number":12,"context_line":"           1;5bbc03648be8db3d2087815717eabdec9fbc310f2b7fd53705b36fbdc80333e3"},{"line_number":13,"context_line":"           2;5bbc03648be8db3d2087815717eabdec9fbc310f2b7fd53705b36ebdc80333e3"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"b50d7110_f20eb91b","line":13,"range":{"start_line":10,"start_character":0,"end_line":13,"end_character":77},"updated":"2021-04-19 14:31:22.000000000","message":"I think CI don\u0027t like that indent..\n\n\nmaybe it would like more smth like that?\n\n\n    .. code-block:: yaml\n\n        galera_db_encryption_keys: |\n           1;5bbc03648be8db3d2087815717eabdec9fbc310f2b7fd53705b36fbdc80333e3\n           2;5bbc03648be8db3d2087815717eabdec9fbc310f2b7fd53705b36ebdc80333e3","commit_id":"8d484d5c0f436ff1ded1276a5e8e759e7a73627c"}],"tasks/galera_server_encryption.yml":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"a884f6a60b48d628a165c4f592db8bd40680edfd","unresolved":true,"context_lines":[{"line_number":45,"context_line":"        - not galera_deployed | bool"},{"line_number":46,"context_line":"      delegate_to: \"localhost\""},{"line_number":47,"context_line":"      run_once: true"},{"line_number":48,"context_line":"    "},{"line_number":49,"context_line":"    - name: Create encryption key for keyfile"},{"line_number":50,"context_line":"      copy: "},{"line_number":51,"context_line":"        content: \"{{ galera_db_encryption_key }}\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"738aa574_139dafe6","line":48,"range":{"start_line":48,"start_character":0,"end_line":48,"end_character":4},"updated":"2021-03-31 11:11:06.000000000","message":"Trailing whitespaces down the file","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"ffe0bb2a5382659fa03e49de0d6e9575fdf18efe","unresolved":false,"context_lines":[{"line_number":45,"context_line":"        - not galera_deployed | bool"},{"line_number":46,"context_line":"      delegate_to: \"localhost\""},{"line_number":47,"context_line":"      run_once: true"},{"line_number":48,"context_line":"    "},{"line_number":49,"context_line":"    - name: Create encryption key for keyfile"},{"line_number":50,"context_line":"      copy: "},{"line_number":51,"context_line":"        content: \"{{ galera_db_encryption_key }}\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"8eb2fb31_fd393a89","line":48,"range":{"start_line":48,"start_character":0,"end_line":48,"end_character":4},"in_reply_to":"738aa574_139dafe6","updated":"2021-03-31 12:18:48.000000000","message":"Will fix.","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"a884f6a60b48d628a165c4f592db8bd40680edfd","unresolved":true,"context_lines":[{"line_number":60,"context_line":"      delegate_to: \"localhost\""},{"line_number":61,"context_line":"      run_once: true"},{"line_number":62,"context_line":"    "},{"line_number":63,"context_line":"    - name: Copy encypted keyfile to servers"},{"line_number":64,"context_line":"      copy:"},{"line_number":65,"context_line":"        src: \"/tmp/keyfile.enc\""},{"line_number":66,"context_line":"        dest: \"/etc/mysql/encryption/keyfile.enc\""},{"line_number":67,"context_line":"        owner: mysql"},{"line_number":68,"context_line":"        group: mysql"},{"line_number":69,"context_line":"        mode: 0600"},{"line_number":70,"context_line":"        force: false  # only copy the file if it does not exist"},{"line_number":71,"context_line":"      notify: Restart all mysql"},{"line_number":72,"context_line":"      when:"},{"line_number":73,"context_line":"        - not galera_deployed | bool"},{"line_number":74,"context_line":"    "},{"line_number":75,"context_line":"    - name: Copy encypted keyfile to servers"},{"line_number":76,"context_line":"      copy:"},{"line_number":77,"context_line":"        src: \"/tmp/.keyfile.key\""},{"line_number":78,"context_line":"        dest: \"/etc/mysql/encryption/.keyfile.key\""},{"line_number":79,"context_line":"        owner: mysql"},{"line_number":80,"context_line":"        group: mysql"},{"line_number":81,"context_line":"        mode: 0600"},{"line_number":82,"context_line":"      notify: Restart all mysql"},{"line_number":83,"context_line":"    "},{"line_number":84,"context_line":"    - name: Delete local keyfile after copying it"},{"line_number":85,"context_line":"      file:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"ec03a562_25b594d3","line":82,"range":{"start_line":63,"start_character":0,"end_line":82,"end_character":31},"updated":"2021-03-31 11:11:06.000000000","message":"I think we can merge this into single task which will just iterate over items","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"819e1cb437314a5e4bf1418c33b2fe0b6b25e989","unresolved":true,"context_lines":[{"line_number":60,"context_line":"      delegate_to: \"localhost\""},{"line_number":61,"context_line":"      run_once: true"},{"line_number":62,"context_line":"    "},{"line_number":63,"context_line":"    - name: Copy encypted keyfile to servers"},{"line_number":64,"context_line":"      copy:"},{"line_number":65,"context_line":"        src: \"/tmp/keyfile.enc\""},{"line_number":66,"context_line":"        dest: \"/etc/mysql/encryption/keyfile.enc\""},{"line_number":67,"context_line":"        owner: mysql"},{"line_number":68,"context_line":"        group: mysql"},{"line_number":69,"context_line":"        mode: 0600"},{"line_number":70,"context_line":"        force: false  # only copy the file if it does not exist"},{"line_number":71,"context_line":"      notify: Restart all mysql"},{"line_number":72,"context_line":"      when:"},{"line_number":73,"context_line":"        - not galera_deployed | bool"},{"line_number":74,"context_line":"    "},{"line_number":75,"context_line":"    - name: Copy encypted keyfile to servers"},{"line_number":76,"context_line":"      copy:"},{"line_number":77,"context_line":"        src: \"/tmp/.keyfile.key\""},{"line_number":78,"context_line":"        dest: \"/etc/mysql/encryption/.keyfile.key\""},{"line_number":79,"context_line":"        owner: mysql"},{"line_number":80,"context_line":"        group: mysql"},{"line_number":81,"context_line":"        mode: 0600"},{"line_number":82,"context_line":"      notify: Restart all mysql"},{"line_number":83,"context_line":"    "},{"line_number":84,"context_line":"    - name: Delete local keyfile after copying it"},{"line_number":85,"context_line":"      file:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"2c01591c_44b4870b","line":82,"range":{"start_line":63,"start_character":0,"end_line":82,"end_character":31},"in_reply_to":"0e60af91_747fae88","updated":"2021-03-31 12:49:35.000000000","message":"Looking at things again - this will be _always_ changed, so each role run will trigger mariadb restart, which is not idempotent and cool actually (since we drop dest with trigger).","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"c03bc05c4044493c5ad09b64ff4bf7d00c3922b1","unresolved":false,"context_lines":[{"line_number":60,"context_line":"      delegate_to: \"localhost\""},{"line_number":61,"context_line":"      run_once: true"},{"line_number":62,"context_line":"    "},{"line_number":63,"context_line":"    - name: Copy encypted keyfile to servers"},{"line_number":64,"context_line":"      copy:"},{"line_number":65,"context_line":"        src: \"/tmp/keyfile.enc\""},{"line_number":66,"context_line":"        dest: \"/etc/mysql/encryption/keyfile.enc\""},{"line_number":67,"context_line":"        owner: mysql"},{"line_number":68,"context_line":"        group: mysql"},{"line_number":69,"context_line":"        mode: 0600"},{"line_number":70,"context_line":"        force: false  # only copy the file if it does not exist"},{"line_number":71,"context_line":"      notify: Restart all mysql"},{"line_number":72,"context_line":"      when:"},{"line_number":73,"context_line":"        - not galera_deployed | bool"},{"line_number":74,"context_line":"    "},{"line_number":75,"context_line":"    - name: Copy encypted keyfile to servers"},{"line_number":76,"context_line":"      copy:"},{"line_number":77,"context_line":"        src: \"/tmp/.keyfile.key\""},{"line_number":78,"context_line":"        dest: \"/etc/mysql/encryption/.keyfile.key\""},{"line_number":79,"context_line":"        owner: mysql"},{"line_number":80,"context_line":"        group: mysql"},{"line_number":81,"context_line":"        mode: 0600"},{"line_number":82,"context_line":"      notify: Restart all mysql"},{"line_number":83,"context_line":"    "},{"line_number":84,"context_line":"    - name: Delete local keyfile after copying it"},{"line_number":85,"context_line":"      file:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"332f987e_e349ab9f","line":82,"range":{"start_line":63,"start_character":0,"end_line":82,"end_character":31},"in_reply_to":"2c01591c_44b4870b","updated":"2021-04-19 07:24:17.000000000","message":"Done","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"8543ea073b039603c1c4081b44b4e757716f6726","unresolved":true,"context_lines":[{"line_number":60,"context_line":"      delegate_to: \"localhost\""},{"line_number":61,"context_line":"      run_once: true"},{"line_number":62,"context_line":"    "},{"line_number":63,"context_line":"    - name: Copy encypted keyfile to servers"},{"line_number":64,"context_line":"      copy:"},{"line_number":65,"context_line":"        src: \"/tmp/keyfile.enc\""},{"line_number":66,"context_line":"        dest: \"/etc/mysql/encryption/keyfile.enc\""},{"line_number":67,"context_line":"        owner: mysql"},{"line_number":68,"context_line":"        group: mysql"},{"line_number":69,"context_line":"        mode: 0600"},{"line_number":70,"context_line":"        force: false  # only copy the file if it does not exist"},{"line_number":71,"context_line":"      notify: Restart all mysql"},{"line_number":72,"context_line":"      when:"},{"line_number":73,"context_line":"        - not galera_deployed | bool"},{"line_number":74,"context_line":"    "},{"line_number":75,"context_line":"    - name: Copy encypted keyfile to servers"},{"line_number":76,"context_line":"      copy:"},{"line_number":77,"context_line":"        src: \"/tmp/.keyfile.key\""},{"line_number":78,"context_line":"        dest: \"/etc/mysql/encryption/.keyfile.key\""},{"line_number":79,"context_line":"        owner: mysql"},{"line_number":80,"context_line":"        group: mysql"},{"line_number":81,"context_line":"        mode: 0600"},{"line_number":82,"context_line":"      notify: Restart all mysql"},{"line_number":83,"context_line":"    "},{"line_number":84,"context_line":"    - name: Delete local keyfile after copying it"},{"line_number":85,"context_line":"      file:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"0e60af91_747fae88","line":82,"range":{"start_line":63,"start_character":0,"end_line":82,"end_character":31},"in_reply_to":"85155133_60ec4bc1","updated":"2021-03-31 12:45:42.000000000","message":"well, you can even with condition.\n\n    - name: Copy encypted keyfile to servers\n      copy:\n        src: \"{{ item.src }}\"\n        dest: \"{{ item.dest }}\"\n        owner: mysql\n        group: mysql\n        mode: 0600\n        force: false  # only copy the file if it does not exist\n      notify: Restart all mysql\n      when: item.condition | default(True)\n      with_items:\n        - src: /tmp/keyfile.enc\n          dest: /etc/mysql/encryption/keyfile.enc\n          condition: \"{{ (not galera_deployed | bool) }}\"\n        - src: /tmp/.keyfile.key\n          dest: /etc/mysql/encryption/.keyfile.key","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"ffe0bb2a5382659fa03e49de0d6e9575fdf18efe","unresolved":true,"context_lines":[{"line_number":60,"context_line":"      delegate_to: \"localhost\""},{"line_number":61,"context_line":"      run_once: true"},{"line_number":62,"context_line":"    "},{"line_number":63,"context_line":"    - name: Copy encypted keyfile to servers"},{"line_number":64,"context_line":"      copy:"},{"line_number":65,"context_line":"        src: \"/tmp/keyfile.enc\""},{"line_number":66,"context_line":"        dest: \"/etc/mysql/encryption/keyfile.enc\""},{"line_number":67,"context_line":"        owner: mysql"},{"line_number":68,"context_line":"        group: mysql"},{"line_number":69,"context_line":"        mode: 0600"},{"line_number":70,"context_line":"        force: false  # only copy the file if it does not exist"},{"line_number":71,"context_line":"      notify: Restart all mysql"},{"line_number":72,"context_line":"      when:"},{"line_number":73,"context_line":"        - not galera_deployed | bool"},{"line_number":74,"context_line":"    "},{"line_number":75,"context_line":"    - name: Copy encypted keyfile to servers"},{"line_number":76,"context_line":"      copy:"},{"line_number":77,"context_line":"        src: \"/tmp/.keyfile.key\""},{"line_number":78,"context_line":"        dest: \"/etc/mysql/encryption/.keyfile.key\""},{"line_number":79,"context_line":"        owner: mysql"},{"line_number":80,"context_line":"        group: mysql"},{"line_number":81,"context_line":"        mode: 0600"},{"line_number":82,"context_line":"      notify: Restart all mysql"},{"line_number":83,"context_line":"    "},{"line_number":84,"context_line":"    - name: Delete local keyfile after copying it"},{"line_number":85,"context_line":"      file:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"85155133_60ec4bc1","line":82,"range":{"start_line":63,"start_character":0,"end_line":82,"end_character":31},"in_reply_to":"ec03a562_25b594d3","updated":"2021-03-31 12:18:48.000000000","message":"The .keyfile has to be copied every time the server gets restarted (not only when galera is deployed), otherwise mysql wouldn\u0027t start. So we cannot use a loop here because of the when-condition. I\u0027ll simplify this task nonetheless.","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"96b6ee25f8b9d3b7231db944a674adace1a70301","unresolved":true,"context_lines":[{"line_number":86,"context_line":"        path: \"/tmp/.keyfile.key\""},{"line_number":87,"context_line":"        state: absent"},{"line_number":88,"context_line":"      delegate_to: \"localhost\""},{"line_number":89,"context_line":"      run_once: true"},{"line_number":90,"context_line":"    "},{"line_number":91,"context_line":"    - name: Set permissions of keyfile on servers"},{"line_number":92,"context_line":"      file:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"54d9336d_431c5fd3","line":89,"updated":"2021-03-31 12:22:48.000000000","message":"\u003e The user has to create the encryption keys (just like the password) themselves and provide them as variables.\n\nI think, if we do this, the role will work on initial deployments as well as re-runs of the role. I\u0027ll test first, though.","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"a884f6a60b48d628a165c4f592db8bd40680edfd","unresolved":true,"context_lines":[{"line_number":81,"context_line":"        mode: 0600"},{"line_number":82,"context_line":"      notify: Restart all mysql"},{"line_number":83,"context_line":"    "},{"line_number":84,"context_line":"    - name: Delete local keyfile after copying it"},{"line_number":85,"context_line":"      file:"},{"line_number":86,"context_line":"        path: \"/tmp/.keyfile.key\""},{"line_number":87,"context_line":"        state: absent"},{"line_number":88,"context_line":"      delegate_to: \"localhost\""},{"line_number":89,"context_line":"      run_once: true"},{"line_number":90,"context_line":"    "},{"line_number":91,"context_line":"    - name: Set permissions of keyfile on servers"},{"line_number":92,"context_line":"      file:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"74f6ddb2_5ccd7a86","line":89,"range":{"start_line":84,"start_character":0,"end_line":89,"end_character":20},"updated":"2021-03-31 11:11:06.000000000","message":"And what if we need to re-deploy galera container?\nI think we instead should put keys into some \"premanent\" storage on the deploy host.\n\nAnd add `creates` to the shell command, so the didn\u0027t override existing keys.","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"c03bc05c4044493c5ad09b64ff4bf7d00c3922b1","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        mode: 0600"},{"line_number":82,"context_line":"      notify: Restart all mysql"},{"line_number":83,"context_line":"    "},{"line_number":84,"context_line":"    - name: Delete local keyfile after copying it"},{"line_number":85,"context_line":"      file:"},{"line_number":86,"context_line":"        path: \"/tmp/.keyfile.key\""},{"line_number":87,"context_line":"        state: absent"},{"line_number":88,"context_line":"      delegate_to: \"localhost\""},{"line_number":89,"context_line":"      run_once: true"},{"line_number":90,"context_line":"    "},{"line_number":91,"context_line":"    - name: Set permissions of keyfile on servers"},{"line_number":92,"context_line":"      file:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"85d311fa_15e8aa52","line":89,"range":{"start_line":84,"start_character":0,"end_line":89,"end_character":20},"in_reply_to":"3733e6df_5f19b8b7","updated":"2021-04-19 07:24:17.000000000","message":"Done","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"9d8640bfae8ebdacf0ffe96a52642deb8d945ccc","unresolved":true,"context_lines":[{"line_number":86,"context_line":"        path: \"/tmp/.keyfile.key\""},{"line_number":87,"context_line":"        state: absent"},{"line_number":88,"context_line":"      delegate_to: \"localhost\""},{"line_number":89,"context_line":"      run_once: true"},{"line_number":90,"context_line":"    "},{"line_number":91,"context_line":"    - name: Set permissions of keyfile on servers"},{"line_number":92,"context_line":"      file:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"df0282ad_a00111dd","line":89,"in_reply_to":"54d9336d_431c5fd3","updated":"2021-03-31 12:47:12.000000000","message":"I\u0027d say we can do this also optional. Ie user may either provide data or it will be generated and stored on the localhost (we generate only when data is not provided)","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"ffe0bb2a5382659fa03e49de0d6e9575fdf18efe","unresolved":true,"context_lines":[{"line_number":81,"context_line":"        mode: 0600"},{"line_number":82,"context_line":"      notify: Restart all mysql"},{"line_number":83,"context_line":"    "},{"line_number":84,"context_line":"    - name: Delete local keyfile after copying it"},{"line_number":85,"context_line":"      file:"},{"line_number":86,"context_line":"        path: \"/tmp/.keyfile.key\""},{"line_number":87,"context_line":"        state: absent"},{"line_number":88,"context_line":"      delegate_to: \"localhost\""},{"line_number":89,"context_line":"      run_once: true"},{"line_number":90,"context_line":"    "},{"line_number":91,"context_line":"    - name: Set permissions of keyfile on servers"},{"line_number":92,"context_line":"      file:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3733e6df_5f19b8b7","line":89,"range":{"start_line":84,"start_character":0,"end_line":89,"end_character":20},"in_reply_to":"74f6ddb2_5ccd7a86","updated":"2021-03-31 12:18:48.000000000","message":"\u003e And what if we need to re-deploy galera container?\n\nGood point, I had not thought about re-deploying a container.\n\n\u003e I think we instead should put keys into some \"premanent\" storage on the deploy host.\n\nI do not use openstack, so I have no permament deploy-host.\nWhat do you think about this:\n\nThe user has to create the encryption keys (just like the password) themselves and provide them as variables. This way, the keys stay the same and it\u0027s no problem if they get re-encrypted on the deploy-host.","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"53912d55aab719e3cf471ed13997788fd3aa2a70","unresolved":true,"context_lines":[{"line_number":86,"context_line":"        path: \"/tmp/.keyfile.key\""},{"line_number":87,"context_line":"        state: absent"},{"line_number":88,"context_line":"      delegate_to: \"localhost\""},{"line_number":89,"context_line":"      run_once: true"},{"line_number":90,"context_line":"    "},{"line_number":91,"context_line":"    - name: Set permissions of keyfile on servers"},{"line_number":92,"context_line":"      file:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"7100014e_9e7938fc","line":89,"in_reply_to":"df0282ad_a00111dd","updated":"2021-03-31 13:14:22.000000000","message":"Okay, where should I put the data on localhost? Any preferences? ` lookup(\u0027env\u0027, \u0027OSA_CONFIG_DIR\u0027)`?","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"8543ea073b039603c1c4081b44b4e757716f6726","unresolved":true,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    - name: Copy encypted keyfile to servers"},{"line_number":50,"context_line":"      copy:"},{"line_number":51,"context_line":"        src: \"/tmp/keyfile.enc\""},{"line_number":52,"context_line":"        dest: \"/etc/mysql/encryption/keyfile.enc\""},{"line_number":53,"context_line":"        owner: mysql"},{"line_number":54,"context_line":"        group: mysql"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"44911aaf_2f33aeae","line":51,"range":{"start_line":51,"start_character":14,"end_line":51,"end_character":19},"updated":"2021-03-31 12:45:42.000000000","message":"I\u0027d really love /tmp/ to be replaced everywhere with `{{ lookup(\u0027env\u0027, \u0027OSA_CONFIG_DIR\u0027) }}/mysql/` and ensure this directory exist first ofc","commit_id":"56ee28c4c412426c70d210e5ca64c2c015b0011e"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"1cc726960333562b0114d2f7abb877bc2655a151","unresolved":true,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    - name: Copy encypted keyfile to servers"},{"line_number":50,"context_line":"      copy:"},{"line_number":51,"context_line":"        src: \"/tmp/keyfile.enc\""},{"line_number":52,"context_line":"        dest: \"/etc/mysql/encryption/keyfile.enc\""},{"line_number":53,"context_line":"        owner: mysql"},{"line_number":54,"context_line":"        group: mysql"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"84285f97_364349b1","line":51,"range":{"start_line":51,"start_character":14,"end_line":51,"end_character":19},"in_reply_to":"44911aaf_2f33aeae","updated":"2021-03-31 13:02:50.000000000","message":"I can do that. Should I add a default-fallback, in case the env is not set?\n\n`{{ lookup(\u0027env\u0027, \u0027OSA_CONFIG_DIR\u0027) | default(\"/tmp\") }}/mysql/`","commit_id":"56ee28c4c412426c70d210e5ca64c2c015b0011e"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"4aff19023ed5170fb5669b3795960a1f45c1eb6c","unresolved":true,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    - name: Copy encypted keyfile to servers"},{"line_number":50,"context_line":"      copy:"},{"line_number":51,"context_line":"        src: \"/tmp/keyfile.enc\""},{"line_number":52,"context_line":"        dest: \"/etc/mysql/encryption/keyfile.enc\""},{"line_number":53,"context_line":"        owner: mysql"},{"line_number":54,"context_line":"        group: mysql"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"9b05da13_80ba2bba","line":51,"range":{"start_line":51,"start_character":14,"end_line":51,"end_character":19},"in_reply_to":"84285f97_364349b1","updated":"2021-03-31 13:49:10.000000000","message":"yeah. I\u0027d still prefer having /etc/openstack_deploy as fallback (or var for fallback), but whatever.","commit_id":"56ee28c4c412426c70d210e5ca64c2c015b0011e"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"c03bc05c4044493c5ad09b64ff4bf7d00c3922b1","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    - name: Copy encypted keyfile to servers"},{"line_number":50,"context_line":"      copy:"},{"line_number":51,"context_line":"        src: \"/tmp/keyfile.enc\""},{"line_number":52,"context_line":"        dest: \"/etc/mysql/encryption/keyfile.enc\""},{"line_number":53,"context_line":"        owner: mysql"},{"line_number":54,"context_line":"        group: mysql"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"d863ef55_334e0aeb","line":51,"range":{"start_line":51,"start_character":14,"end_line":51,"end_character":19},"in_reply_to":"9b05da13_80ba2bba","updated":"2021-04-19 07:24:17.000000000","message":"Done","commit_id":"56ee28c4c412426c70d210e5ca64c2c015b0011e"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"8543ea073b039603c1c4081b44b4e757716f6726","unresolved":true,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"    - name: Copy password to file to servers"},{"line_number":62,"context_line":"      copy:"},{"line_number":63,"context_line":"        src: \"{{ galera_db_encryption_key }}\""},{"line_number":64,"context_line":"        dest: \"/etc/mysql/encryption/.keyfile.key\""},{"line_number":65,"context_line":"        owner: mysql"},{"line_number":66,"context_line":"        group: mysql"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"ecb711a9_5920ae9d","line":63,"range":{"start_line":63,"start_character":8,"end_line":63,"end_character":11},"updated":"2021-03-31 12:45:42.000000000","message":"should it be content?","commit_id":"56ee28c4c412426c70d210e5ca64c2c015b0011e"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"4aff19023ed5170fb5669b3795960a1f45c1eb6c","unresolved":true,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"    - name: Copy password to file to servers"},{"line_number":62,"context_line":"      copy:"},{"line_number":63,"context_line":"        src: \"{{ galera_db_encryption_key }}\""},{"line_number":64,"context_line":"        dest: \"/etc/mysql/encryption/.keyfile.key\""},{"line_number":65,"context_line":"        owner: mysql"},{"line_number":66,"context_line":"        group: mysql"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"cccdf723_cac8dab3","line":63,"range":{"start_line":63,"start_character":8,"end_line":63,"end_character":11},"in_reply_to":"484149d5_3d2caeea","updated":"2021-03-31 13:49:10.000000000","message":"We still can use loop with `| default(omit)` 😋","commit_id":"56ee28c4c412426c70d210e5ca64c2c015b0011e"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"c03bc05c4044493c5ad09b64ff4bf7d00c3922b1","unresolved":true,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"    - name: Copy password to file to servers"},{"line_number":62,"context_line":"      copy:"},{"line_number":63,"context_line":"        src: \"{{ galera_db_encryption_key }}\""},{"line_number":64,"context_line":"        dest: \"/etc/mysql/encryption/.keyfile.key\""},{"line_number":65,"context_line":"        owner: mysql"},{"line_number":66,"context_line":"        group: mysql"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"048c2824_ce3eaa71","line":63,"range":{"start_line":63,"start_character":8,"end_line":63,"end_character":11},"in_reply_to":"cccdf723_cac8dab3","updated":"2021-04-19 07:24:17.000000000","message":"I\u0027d prefer not to do that! :P","commit_id":"56ee28c4c412426c70d210e5ca64c2c015b0011e"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"1cc726960333562b0114d2f7abb877bc2655a151","unresolved":true,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"    - name: Copy password to file to servers"},{"line_number":62,"context_line":"      copy:"},{"line_number":63,"context_line":"        src: \"{{ galera_db_encryption_key }}\""},{"line_number":64,"context_line":"        dest: \"/etc/mysql/encryption/.keyfile.key\""},{"line_number":65,"context_line":"        owner: mysql"},{"line_number":66,"context_line":"        group: mysql"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"484149d5_3d2caeea","line":63,"range":{"start_line":63,"start_character":8,"end_line":63,"end_character":11},"in_reply_to":"ecb711a9_5920ae9d","updated":"2021-03-31 13:02:50.000000000","message":"Yes, locally already fixed. This however means we cannot use a loop here. Which I think is okay, because we don\u0027t need to have a task that creates a local temp-file here.","commit_id":"56ee28c4c412426c70d210e5ca64c2c015b0011e"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"da2d1d3712a8422ff96d04d548d7e5bcdfe05b92","unresolved":true,"context_lines":[{"line_number":67,"context_line":"        - galera_db_encryption_keys is defined"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    - name: Create an encrypted keyfile using encryption key"},{"line_number":70,"context_line":"      shell: \"openssl enc -aes-256-cbc -md sha1 -k {{ galera_db_encryption_password }} -in {{ galera_db_encryption_tmp_dir }}/mysql_encryption_keys -out {{ galera_db_encryption_tmp_dir }}/mysql_encryption_keyfile.enc\""},{"line_number":71,"context_line":"      delegate_to: \"localhost\""},{"line_number":72,"context_line":"      run_once: true"},{"line_number":73,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"43c9b431_a8db9021","line":70,"range":{"start_line":70,"start_character":6,"end_line":70,"end_character":11},"updated":"2021-04-15 16:36:26.000000000","message":"Linters check has failed because of usage shell module here instead of the command. Please either replace that with command as I think shell is really unnecessary here","commit_id":"198d34e323feb0d056f2e437f16d639245d78ce8"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"c03bc05c4044493c5ad09b64ff4bf7d00c3922b1","unresolved":false,"context_lines":[{"line_number":67,"context_line":"        - galera_db_encryption_keys is defined"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    - name: Create an encrypted keyfile using encryption key"},{"line_number":70,"context_line":"      shell: \"openssl enc -aes-256-cbc -md sha1 -k {{ galera_db_encryption_password }} -in {{ galera_db_encryption_tmp_dir }}/mysql_encryption_keys -out {{ galera_db_encryption_tmp_dir }}/mysql_encryption_keyfile.enc\""},{"line_number":71,"context_line":"      delegate_to: \"localhost\""},{"line_number":72,"context_line":"      run_once: true"},{"line_number":73,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"deec08e6_23719578","line":70,"range":{"start_line":70,"start_character":6,"end_line":70,"end_character":11},"in_reply_to":"43c9b431_a8db9021","updated":"2021-04-19 07:24:17.000000000","message":"Done","commit_id":"198d34e323feb0d056f2e437f16d639245d78ce8"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"0345b94be2eb56a754a476e737b0d46d87979f49","unresolved":true,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"    - name: Create a fact for the name of the temporary directory"},{"line_number":43,"context_line":"      set_fact:"},{"line_number":44,"context_line":"        galera_db_encryption_tmp_dir: \"{{ lookup(\u0027env\u0027, \u0027OSA_CONFIG_DIR\u0027) | default(osa_config_dir, True) }}/mysql\""},{"line_number":45,"context_line":"      delegate_to: \"localhost\""},{"line_number":46,"context_line":"      run_once: true"},{"line_number":47,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"a084bed5_61eb6ea2","line":44,"range":{"start_line":44,"start_character":8,"end_line":44,"end_character":36},"updated":"2021-04-19 10:22:58.000000000","message":"oh, just noticed. can we add `when: galera_db_encryption_tmp_dir is not defined` to allow override that in variables just in case?","commit_id":"20d82a12093ef01aa7aec1a5898e661a841db939"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"319f5a933c4d15fdaf50d41a5127b5c9b908aa55","unresolved":true,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"    - name: Create a fact for the name of the temporary directory"},{"line_number":43,"context_line":"      set_fact:"},{"line_number":44,"context_line":"        galera_db_encryption_tmp_dir: \"{{ lookup(\u0027env\u0027, \u0027OSA_CONFIG_DIR\u0027) | default(osa_config_dir, True) }}/mysql\""},{"line_number":45,"context_line":"      delegate_to: \"localhost\""},{"line_number":46,"context_line":"      run_once: true"},{"line_number":47,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"7e601a61_df3c6746","line":44,"range":{"start_line":44,"start_character":8,"end_line":44,"end_character":36},"in_reply_to":"841d315f_9c0003c0","updated":"2021-04-19 10:30:02.000000000","message":"Done, can you check if it is like you wanted?","commit_id":"20d82a12093ef01aa7aec1a5898e661a841db939"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"e12fb75f06bb2079c7c500057502e5abeff5721e","unresolved":true,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"    - name: Create a fact for the name of the temporary directory"},{"line_number":43,"context_line":"      set_fact:"},{"line_number":44,"context_line":"        galera_db_encryption_tmp_dir: \"{{ lookup(\u0027env\u0027, \u0027OSA_CONFIG_DIR\u0027) | default(osa_config_dir, True) }}/mysql\""},{"line_number":45,"context_line":"      delegate_to: \"localhost\""},{"line_number":46,"context_line":"      run_once: true"},{"line_number":47,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"841d315f_9c0003c0","line":44,"range":{"start_line":44,"start_character":8,"end_line":44,"end_character":36},"in_reply_to":"9db791df_b76d9a3c","updated":"2021-04-19 10:26:16.000000000","message":"edit: check for galera_db_encryption_tmp_dir | length \u003d\u003d 0","commit_id":"20d82a12093ef01aa7aec1a5898e661a841db939"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"da3e20506cd436eaffd232e54154472e127f4301","unresolved":true,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"    - name: Create a fact for the name of the temporary directory"},{"line_number":43,"context_line":"      set_fact:"},{"line_number":44,"context_line":"        galera_db_encryption_tmp_dir: \"{{ lookup(\u0027env\u0027, \u0027OSA_CONFIG_DIR\u0027) | default(osa_config_dir, True) }}/mysql\""},{"line_number":45,"context_line":"      delegate_to: \"localhost\""},{"line_number":46,"context_line":"      run_once: true"},{"line_number":47,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"9db791df_b76d9a3c","line":44,"range":{"start_line":44,"start_character":8,"end_line":44,"end_character":36},"in_reply_to":"a084bed5_61eb6ea2","updated":"2021-04-19 10:25:06.000000000","message":"or add it to defaults just empty (it will appear in role docs then) and check for galera_db_encryption_tmp_dir | length \u003e 0","commit_id":"20d82a12093ef01aa7aec1a5898e661a841db939"}],"tasks/galera_server_install.yml":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"a884f6a60b48d628a165c4f592db8bd40680edfd","unresolved":true,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"- include_tasks: \"galera_install_{{ ansible_facts[\u0027pkg_mgr\u0027] }}.yml\""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"- include_tasks: galera_server_encryption.yml"},{"line_number":23,"context_line":"  when:"},{"line_number":24,"context_line":"    - galera_mariadb_encryption_enabled | bool"},{"line_number":25,"context_line":"  tags:"},{"line_number":26,"context_line":"    - galera_server-encryption"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"- name: Record galera has been deployed"},{"line_number":29,"context_line":"  ini_file:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5aa88289_0ee0e478","line":26,"range":{"start_line":22,"start_character":0,"end_line":26,"end_character":30},"updated":"2021-03-31 11:11:06.000000000","message":"What will happen if we re-run the role? I think keys will get rotated and we will got broken data inside db.\nIt also feels, that we should include this also only if galera_deployed is false","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"},{"author":{"_account_id":33299,"name":"Sebastian Gumprich","email":"sebastian.gumprich@t-systems.com","username":"zufallsheld"},"change_message_id":"c03bc05c4044493c5ad09b64ff4bf7d00c3922b1","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"- include_tasks: \"galera_install_{{ ansible_facts[\u0027pkg_mgr\u0027] }}.yml\""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"- include_tasks: galera_server_encryption.yml"},{"line_number":23,"context_line":"  when:"},{"line_number":24,"context_line":"    - galera_mariadb_encryption_enabled | bool"},{"line_number":25,"context_line":"  tags:"},{"line_number":26,"context_line":"    - galera_server-encryption"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"- name: Record galera has been deployed"},{"line_number":29,"context_line":"  ini_file:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3ca9e621_fa349099","line":26,"range":{"start_line":22,"start_character":0,"end_line":26,"end_character":30},"in_reply_to":"5aa88289_0ee0e478","updated":"2021-04-19 07:24:17.000000000","message":"Done","commit_id":"11f706f24415a8d5a749671be7ae041688ae2791"}]}