Define GlitchTip installation role

In a later restructure of Ansible, the GlithTip role should become part
of the admin role, just like the Grafana roles has to be merged in.

Use the reusable Docker definitions to install Docker.
In the compose stack, use the host CA bundle for a.o. uptime monitor as
often custom certs are used on contest floors which must be trusted in
the container.

Author: Kevinjil

Diff for: provision-contest/ansible/glitchtip.yml

@@ -0,0 +1,21 @@
+---
+- hosts: glitchtip
+  vars:
+    host_type: glitchtip
+  become: true
+  handlers:
+    - include_tasks: handlers.yml
+  roles:
+    - role: base_packages
+      tags: base_packages
+    - role: icpc_fixes
+      tags: icpc_fixes
+      when: ICPC_IMAGE
+    - role: system_fixes
+      tags: system_fixes
+    - role: hosts
+      tags: hosts
+    - role: docker
+      tags: docker
+    - role: glitchtip
+      tags: glitchtip

Diff for: provision-contest/ansible/group_vars/onprem/secret.yml.example

@@ -69,3 +69,6 @@ PRESCLIENT_CONTEST: nwerc18
 
 # Sentry DSN URL
 # SENTRY_DSN:
+
+# GlitchTip
+# GLITCHTIP_SECRET: {some-strong-glitchtip-password}

Diff for: provision-contest/ansible/hosts.example

@@ -61,7 +61,12 @@ domjudge-ccsadmin5 ansible_host=10.3.3.227
 [grafana]
 # During the WFs we use one of the ccsadmin machines
 # Doesn't matter which (admin) machine but should not be 1 as that runs ansible
-domjudge-ccsadmin2 ansible_host=10.3.3.225
+domjudge-ccsadmin2 ansible_host=10.3.3.224
+
+[glitchtip]
+# During the WFs we use one of the ccsadmin machines
+# Doesn't matter which (admin) machine but should not be 1 as that runs ansible
+domjudge-ccsadmin3 ansible_host=10.3.3.225
 
 [cds]
 domjudge-cds ansible_host=10.2.2.228

Diff for: provision-contest/ansible/roles/docker/files/containers-glitchtip/.gitignore

@@ -0,0 +1 @@
+*.tar

Diff for: provision-contest/ansible/roles/docker/files/containers-glitchtip/glitchtip/.gitignore

@@ -0,0 +1 @@
+*

Diff for: provision-contest/ansible/roles/glitchtip/defaults/main.yml

@@ -0,0 +1 @@
+GLITCHTIP_PORT: 8000

Diff for: provision-contest/ansible/roles/glitchtip/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+- name: Restart GlitchTip
+  community.docker.docker_compose_v2:
+    project_src: /opt/glitchtip
+    files:
+      - docker-compose.yaml
+    state: restarted

Diff for: provision-contest/ansible/roles/glitchtip/tasks/main.yml

@@ -0,0 +1,17 @@
+---
+- name: Create directories
+  become_user: root
+  file:
+    path: /opt/glitchtip
+    state: directory
+
+- name: Create compose file
+  template:
+    src: templates/docker-compose.yaml.j2
+    dest: /opt/glitchtip/docker-compose.yaml
+
+- name: Deploy GlitchTip compose stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/glitchtip
+    files:
+    - docker-compose.yaml

Diff for: provision-contest/ansible/roles/glitchtip/templates/docker-compose.yaml.j2

@@ -0,0 +1,57 @@
+# Uncomment version if using an older version of docker compose
+# version: "3.8"
+x-environment:
+  &default-environment
+  DATABASE_URL: postgres://postgres:postgres@postgres:5432/postgres
+  SECRET_KEY: {{ GLITCHTIP_SECRET }}
+  PORT: {{ GLITCHTIP_PORT}}
+  EMAIL_URL: consolemail://
+  GLITCHTIP_DOMAIN: http://glitchtip:{{ GLITCHTIP_PORT }}
+  DEFAULT_FROM_EMAIL: email@glitchtip
+  CELERY_WORKER_AUTOSCALE: "1,1"
+  CELERY_WORKER_MAX_TASKS_PER_CHILD: "1000"
+  REQUESTS_CA_BUNDLE: /etc/ssl/certs/ca-certificates.crt
+
+x-depends_on:
+  &default-depends_on
+  - postgres
+  - redis
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_HOST_AUTH_METHOD: "trust"  # Consider removing this and setting a password
+    restart: unless-stopped
+    volumes:
+      - pg-data:/var/lib/postgresql/data
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+  web:
+    image: glitchtip/glitchtip:v4.1.3
+    depends_on: *default-depends_on
+    ports:
+      - {{ GLITCHTIP_PORT }}:{{ GLITCHTIP_PORT }}
+    environment: *default-environment
+    restart: unless-stopped
+    volumes: 
+      - uploads:/code/uploads
+  worker:
+    image: glitchtip/glitchtip:v4.1.3
+    command: ./bin/run-celery-with-beat.sh
+    depends_on: *default-depends_on
+    environment: *default-environment
+    restart: unless-stopped
+    volumes: 
+      - uploads:/code/uploads
+      - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
+  migrate:
+    image: glitchtip/glitchtip:v4.1.3
+    depends_on: *default-depends_on
+    command: ./bin/run-migrate.sh
+    environment: *default-environment
+
+volumes:
+  pg-data:
+  uploads:

Diff for: provision-contest/ansible/roles/glitchtip/vars/.gitignore

@@ -0,0 +1 @@
+*.yml