Define GlitchTip installation role

In a later restructure of Ansible, the GlithTip role should become part
of the admin role, just like the Grafana roles has to be merged in.

Use the reusable Docker definitions to install Docker.
In the compose stack, use the host CA bundle for a.o. uptime monitor as
often custom certs are used on contest floors which must be trusted in
the container.

Author: Kevinjil

provision-contest/ansible/glitchtip.yml

@@ -0,0 +1,21 @@
+---
+- hosts: glitchtip
+  vars:
+    host_type: glitchtip
+  become: true
+  handlers:
+    - include_tasks: handlers.yml
+  roles:
+    - role: base_packages
+      tags: base_packages
+    - role: icpc_fixes
+      tags: icpc_fixes
+      when: ICPC_IMAGE
+    - role: system_fixes
+      tags: system_fixes
+    - role: hosts
+      tags: hosts
+    - role: docker
+      tags: docker
+    - role: glitchtip
+      tags: glitchtip

provision-contest/ansible/group_vars/onprem/secret.yml.example

@@ -69,3 +69,6 @@ PRESCLIENT_CONTEST: nwerc18
 
 # Sentry DSN URL
 # SENTRY_DSN:
+
+# GlitchTip
+# GLITCHTIP_SECRET: {some-strong-glitchtip-password}

provision-contest/ansible/hosts.example

@@ -61,7 +61,12 @@ domjudge-ccsadmin5 ansible_host=10.3.3.227
 [grafana]
 # During the WFs we use one of the ccsadmin machines
 # Doesn't matter which (admin) machine but should not be 1 as that runs ansible
-domjudge-ccsadmin2 ansible_host=10.3.3.225
+domjudge-ccsadmin2 ansible_host=10.3.3.224
+
+[glitchtip]
+# During the WFs we use one of the ccsadmin machines
+# Doesn't matter which (admin) machine but should not be 1 as that runs ansible
+domjudge-ccsadmin3 ansible_host=10.3.3.225
 
 [cds]
 domjudge-cds ansible_host=10.2.2.228

provision-contest/ansible/roles/docker/files/containers-glitchtip/.gitignore

@@ -0,0 +1 @@
+*.tar

provision-contest/ansible/roles/docker/files/containers-glitchtip/glitchtip/.gitignore

@@ -0,0 +1 @@
+*

provision-contest/ansible/roles/glitchtip/defaults/main.yml

@@ -0,0 +1 @@
+GLITCHTIP_PORT: 8000

provision-contest/ansible/roles/glitchtip/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+- name: Restart GlitchTip
+  community.docker.docker_compose_v2:
+    project_src: /opt/glitchtip
+    files:
+      - docker-compose.yaml
+    state: restarted

provision-contest/ansible/roles/glitchtip/tasks/main.yml

@@ -0,0 +1,17 @@
+---
+- name: Create directories
+  become_user: root
+  file:
+    path: /opt/glitchtip
+    state: directory
+
+- name: Create compose file
+  template:
+    src: templates/docker-compose.yaml.j2
+    dest: /opt/glitchtip/docker-compose.yaml
+
+- name: Deploy GlitchTip compose stack
+  community.docker.docker_compose_v2:
+    project_src: /opt/glitchtip
+    files:
+    - docker-compose.yaml

provision-contest/ansible/roles/glitchtip/templates/docker-compose.yaml.j2

@@ -0,0 +1,57 @@
+# Uncomment version if using an older version of docker compose
+# version: "3.8"
+x-environment:
+  &default-environment
+  DATABASE_URL: postgres://postgres:postgres@postgres:5432/postgres
+  SECRET_KEY: {{ GLITCHTIP_SECRET }}
+  PORT: {{ GLITCHTIP_PORT}}
+  EMAIL_URL: consolemail://
+  GLITCHTIP_DOMAIN: http://glitchtip:{{ GLITCHTIP_PORT }}
+  DEFAULT_FROM_EMAIL: email@glitchtip
+  CELERY_WORKER_AUTOSCALE: "1,1"
+  CELERY_WORKER_MAX_TASKS_PER_CHILD: "1000"
+  REQUESTS_CA_BUNDLE: /etc/ssl/certs/ca-certificates.crt
+
+x-depends_on:
+  &default-depends_on
+  - postgres
+  - redis
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_HOST_AUTH_METHOD: "trust"  # Consider removing this and setting a password
+    restart: unless-stopped
+    volumes:
+      - pg-data:/var/lib/postgresql/data
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+  web:
+    image: glitchtip/glitchtip:v4.1.3
+    depends_on: *default-depends_on
+    ports:
+      - {{ GLITCHTIP_PORT }}:{{ GLITCHTIP_PORT }}
+    environment: *default-environment
+    restart: unless-stopped
+    volumes: 
+      - uploads:/code/uploads
+  worker:
+    image: glitchtip/glitchtip:v4.1.3
+    command: ./bin/run-celery-with-beat.sh
+    depends_on: *default-depends_on
+    environment: *default-environment
+    restart: unless-stopped
+    volumes: 
+      - uploads:/code/uploads
+      - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
+  migrate:
+    image: glitchtip/glitchtip:v4.1.3
+    depends_on: *default-depends_on
+    command: ./bin/run-migrate.sh
+    environment: *default-environment
+
+volumes:
+  pg-data:
+  uploads:

provision-contest/ansible/roles/glitchtip/vars/.gitignore

@@ -0,0 +1 @@
+*.yml