ansible: remove bitwarden plugin, upgrade ansible

Author: jakubgs

ansible.cfg

@@ -12,7 +12,7 @@ use_persistent_connections = true
 # human-readable stdout/stderr results display
 stdout_callback = debug
 # Avoid default Python warnings
-interpreter_python = auto
+interpreter_python = auto_silent
 # https://github.com/ansible/ansible/issues/56930
 force_valid_group_names = ignore
 

ansible/README.md

@@ -0,0 +1,66 @@
+# Description
+
+Herein lie all ansible related files __except__ for `ansible.cfg` at the root of the repo for easier usage without having to `cd` here.
+
+# Usage
+
+Simply run the play related to the specific type of configuration you want to deploy:
+```sh
+ > ls -1 ansible/*.yml
+ansible/bootstrap.yml
+ansible/upgrade.yml
+ansible/main.yml
+```
+```sh
+ansible-playbook ansible/main.yml
+```
+
+# Bootstrap
+
+All hosts are bootstraped right after provisioning using these roles:
+
+* [status-im/infra-role-bootstrap-linux](https://github.com/status-im/infra-role-bootstrap-linux)
+* [status-im/infra-role-bootstrap-macos](https://github.com/status-im/infra-role-bootstrap-macos)
+* [status-im/infra-role-bootstrap-windows](https://github.com/status-im/infra-role-bootstrap-windows)
+
+If you want to re-run any bootstrap step you can do it like so:
+```sh
+ansible-playbook ansible/bootstrap.yml -t role::bootstrap:hostname
+```
+In this case only the `hostname` set of tasks will be executed due to the `role::bootstrap:hostname` tag.
+
+# Inventory
+
+The inventory we use is crated by Terraform via the [`terraform-provider-ansible`](https://github.com/nbering/terraform-provider-ansible) which generates the necessary data structures in the [Consul Key/Value store](https://www.consul.io/docs/dynamic-app-config/kv) that is later used by the [`terraform.py`](./terraform.py) script to provide hosts and their variables to Ansible.
+
+Some ways to view existing hosts:
+```sh
+ansible localhost -m debug -a 'var=groups'
+ansible all -o -m debug -a 'var=ansible_host' | columns -t
+```
+
+A backup of the Terraform state is created at `.terraform/terraform.tfstate.backup`. It is symetrically encrypted using [Fernet algorithm](https://cryptography.io/en/latest/fernet/) with a key generated from haed `CONSUL_HTTP_TOKEN` and can be decrypted by using [`decrypt_tf_backup.py`](https://github.com/status-im/infra-utils/blob/master/terraform/decrypt_tf_backup.py) script.
+
+# Variables
+
+Ansible variables can be provided to Ansible using the `--extra-vars`/`-e` flag. An example of such a flag is:
+```yaml
+compose_state: 'present'
+compose_recreate: 'smart'
+compose_restart: false
+```
+
+These are used in every role that starts docker containers. You can use them to change the behaviour of roles.
+For example to re-create all metric related containers use:
+```sh
+ansible-playbook ansible/main.yml -e compose_recreate=always
+```
+
+# Secrets
+
+Secrets are stored and provided in three ways:
+
+* [password-store](https://www.passwordstore.org/) - Using [`passwordstore`](https://docs.ansible.com/ansible/latest/collections/community/general/passwordstore_lookup.html) plugin for core infra secrets.
+* [Vault](https://www.vaultproject.io/) - Using [`vault`](./lookup_plugins/vault.py) plugin for service secrets.
+
+Read [secrets management guide](https://docs.infra.status.im/guides/secret_management.html) for more details.

ansible/lookup_plugins/bitwarden.py

@@ -1,11 +1,7 @@
 {
   description = "infra-shell";
 
-  # bitwarden-cli has a build issue on macOS since 2024.8.0:
-  # this commit fixes nixpkgs right before switching to 2024.8.0
-  # https://github.com/NixOS/nixpkgs/issues/339576
-  inputs.nixpkgs.url = "github:nixos/nixpkgs/c374d94f1536013ca8e92341b540eba4c22f9c62";
-  #inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+  inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
 
   outputs = { self, nixpkgs }:
     let
@@ -19,11 +15,10 @@
         pkgs = pkgsFor.${system};
       in {
         default = let
-          pythonPkgs = pkgs.python3.withPackages (
-            _: with (pkgs.python3Packages); [
+          pythonPkgs = pkgs.python312.withPackages (
+            _: with (pkgs.python312Packages); [
               ipython pyyaml jinja2 PyGithub
-              pyopenssl cryptography
-              hvac
+              pyopenssl cryptography hvac
             ]
           );
         in pkgs.mkShellNoCC {
@@ -33,9 +28,9 @@
             # networking
             curl nmap nettools dnsutils
             # infra
-            terraform ansible_2_16 pythonPkgs
+            terraform ansible_2_17 pythonPkgs
             # security
-            pass vault bitwarden-cli yubikey-manager pwgen
+            pass vault yubikey-manager pwgen
             # cloud
             aliyun-cli awscli doctl google-cloud-sdk
             hcloud s3cmd scaleway-cli