Update to 2020-11-12 09:00

roles/dolibarr/meta/main.yml

@@ -0,0 +1,4 @@
+---
+
+dependencies:
+  - role: httpd_php

roles/dolibarr/tasks/cleanup.yml

@@ -1,9 +1,11 @@
 ---
 
-- name: Remove temp files
+- name: Remove temp and obsolete files
   file: path={{ item }} state=absent
-  with_items:
+  loop:
     - "{{ dolibarr_root_dir }}/tmp/dolibarr-{{ dolibarr_version }}.tgz"
     - "{{ dolibarr_root_dir }}/tmp/dolibarr-{{ dolibarr_version }}"
+    - /etc/backup/pre.d/dolibarr_{{ dolibarr_id }}_dump_db
+    - /etc/backup/post.d/dolibarr_{{ dolibarr_id }}_rm_dump
   tags: dolibarr
 

roles/dolibarr/tasks/install.yml

@@ -4,7 +4,6 @@
   yum:
     name:
       - tar
-      - MySQL-python
       - mariadb
       - acl
   tags: dolibarr
@@ -104,12 +103,10 @@
   tags: dolibarr
 
 - name: Deploy backup scripts
-  template: src={{ item.script }}.j2 dest=/etc/backup/{{ item.type }}.d/dolibarr_{{ dolibarr_id }}_{{ item.script }} mode=750
+  template: src={{ item }}-backup.j2 dest=/etc/backup/{{ item }}.d/dolibarr_{{ dolibarr_id }} mode=750
-  with_items:
+  loop:
-    - script: dump_db
+    - pre
-      type: pre
+    - post
-    - script: rm_dump
-      type: post
   tags: dolibarr
 
 - name: Setup cron job to sync users and groups from LDAP

roles/dolibarr/tasks/main.yml

@@ -1,8 +1,8 @@
 ---
 
-- include: facts.yml
 - include: user.yml
 - include: directories.yml
+- include: facts.yml
 - include: archive_pre.yml
   when: dolibarr_install_mode == 'upgrade'
 - include: install.yml

roles/dolibarr/templates/post-backup.j2

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+rm -f {{ dolibarr_root_dir }}/db_dumps/*

roles/dolibarr/templates/pre-backup.j2

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+/usr/bin/mysqldump --user={{ dolibarr_db_user }} \
+                   --password={{ dolibarr_db_pass | quote }} \
+                   --host={{ dolibarr_db_server }} \
+                   --quick --single-transaction \
+                   --add-drop-table {{ dolibarr_db_name }} | lz4 -c > {{ dolibarr_root_dir }}/db_dumps/{{ dolibarr_db_name }}.sql.lz4

roles/funkwhale/meta/main.yml

@@ -1,7 +1,7 @@
 ---
 allow_duplicates: true
 dependencies:
-  - role: repo_nux_dextop # for ffmpeg
+  - role: repo_remi # for ffmpeg
   - role: httpd_common
   - role: redis_server
     when: funkwhale_redis_url | urlsplit('hostname') == 'localhost' or funkwhale_redis_url | urlsplit('hostname') == '127.0.0.1'

roles/funkwhale/tasks/conf.yml

@@ -1,10 +1,5 @@
 ---
 
-- name: Deploy funkwhale configuration
-  template: src=env.j2 dest={{ funkwhale_root_dir }}/config/.env group={{ funkwhale_user }}
-  notify: restart funkwhale
-  tags: funkwhale
-
 - name: Deploy permissions script
   template: src=perms.sh.j2 dest={{ funkwhale_root_dir }}/perms.sh mode=755
   register: funkwhale_perms

roles/funkwhale/tasks/facts.yml

@@ -1,5 +1,12 @@
 ---
 
+- include_vars: "{{ item }}"
+  with_first_found:
+    - vars/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml
+    - vars/{{ ansible_distribution }}.yml
+    - vars/{{ ansible_os_family }}.yml
+  tags: funkwhale
+
 - fail: msg="pg_admin_pass must be set"
   when: pg_admin_pass is not defined
   tags: funkwhale
@@ -9,28 +16,26 @@
     - root_dir: "{{ funkwhale_root_dir }}"
     - version: "{{ funkwhale_version }}"
   tags: funkwhale
-- set_fact: funkwhale_install_mode={{ (install_mode == 'upgrade' and not funkwhale_manage_upgrade) | ternary('none',install_mode) }}
+- block:
-  tags: funkwhale
+    - set_fact: funkwhale_install_mode={{ (install_mode == 'upgrade' and not funkwhale_manage_upgrade) | ternary('none',install_mode) }}
-- set_fact: funkwhale_current_version={{ current_version | default('') }}
+    - set_fact: funkwhale_current_version={{ current_version | default('') }}
   tags: funkwhale
 
   # Create a random pass for the DB if needed
-- import_tasks: ../includes/get_rand_pass.yml
+- when: funkwhale_db_pass is not defined
-  vars:
+  block:
-    - pass_file: "{{ funkwhale_root_dir }}/meta/ansible_dbpass"
+    - import_tasks: ../includes/get_rand_pass.yml
-  when: funkwhale_db_pass is not defined
+      vars:
-  tags: funkwhale
+        - pass_file: "{{ funkwhale_root_dir }}/meta/ansible_dbpass"
-- set_fact: funkwhale_db_pass={{ rand_pass }}
+    - set_fact: funkwhale_db_pass={{ rand_pass }}
-  when: funkwhale_db_pass is not defined
   tags: funkwhale
 
   # Create a random django secret key
-- import_tasks: ../includes/get_rand_pass.yml
+- when: funkwhale_secret_key is not defined
-  vars:
+  block:
-    - pass_file: "{{ funkwhale_root_dir }}/meta/ansible_django_key"
+    - import_tasks: ../includes/get_rand_pass.yml
-  when: funkwhale_secret_key is not defined
+      vars:
-  tags: funkwhale
+        - pass_file: "{{ funkwhale_root_dir }}/meta/ansible_django_key"
-- set_fact: funkwhale_secret_key={{ rand_pass }}
+    - set_fact: funkwhale_secret_key={{ rand_pass }}
-  when: funkwhale_secret_key is not defined
   tags: funkwhale
 

roles/funkwhale/tasks/install.yml

@@ -1,21 +1,12 @@
 ---
 
 - name: Install packages
-  yum:
+  yum: name={{ funkwhale_packages }}
-    name:
+  tags: funkwhale
-      - gcc
+
-      - git
+- name: Check if mod_xsendfile is available
-      - postgresql13
+  stat: path=/usr/lib64/httpd/modules/mod_xsendfile.so
-      - postgresql-devel
+  register: funkwhale_xsendfile
-      - openldap-devel
-      - cyrus-sasl-devel
-      - libjpeg-turbo-devel
-      - python-psycopg2
-      - python-setuptools
-      - python3-virtualenv
-      - python3-pip
-      - ffmpeg
-      - mod_xsendfile
   tags: funkwhale
 
 - name: Download funkwhale frontend and api
@@ -121,11 +112,18 @@
   notify: restart funkwhale
   tags: funkwhale
 
+- name: Deploy funkwhale configuration
+  template: src=env.j2 dest={{ funkwhale_root_dir }}/config/.env group={{ funkwhale_user }}
+  notify: restart funkwhale
+  tags: funkwhale
+
 - name: Migrate database
   django_manage:
     command: migrate
     app_path: "{{ funkwhale_root_dir }}/api"
     virtualenv: "{{ funkwhale_root_dir }}/venv"
+  environment:
+    - FUNKWHALE_URL: "{{ funkwhale_public_url }}"
   when: funkwhale_install_mode != 'none'
   notify: restart funkwhale
   tags: funkwhale

roles/funkwhale/templates/env.j2

@@ -31,3 +31,4 @@ FUNKWHALE_FRONTEND_PATH={{ funkwhale_root_dir }}/front/dist
 NGINX_MAX_BODY_SIZE=100M
 MUSIC_USE_DENORMALIZATION=True
 FUNKWHALE_SPA_HTML_ROOT={{ funkwhale_root_dir }}/front/dist/
+FUNKWHALE_URL={{ funkwhale_public_url }}

roles/funkwhale/templates/httpd.conf.j2

@@ -69,7 +69,9 @@
     Require all granted
   </Directory>
 
+{% if funkwhale_xsendfile.stat.exists %}
   LoadModule xsendfile_module modules/mod_xsendfile.so
+{% endif %}
   <IfModule mod_xsendfile.c>
     XSendFile On
     XSendFilePath {{ funkwhale_root_dir }}/data/media

roles/funkwhale/templates/pre-backup.sh.j2

@@ -2,7 +2,7 @@
 
 PGPASSWORD='{{ funkwhale_db_pass }}' /usr/pgsql-13/bin/pg_dump \
   --clean \
-  --username={{ funkwhale_db_user }} \
+  --username={{ funkwhale_db_user | quote }} \
-  --host={{ funkwhale_db_server }} \
+  --host={{ funkwhale_db_server | quote }} \
-  {{ funkwhale_db_name }} | \
+  {{ funkwhale_db_name | quote }} | \
-  zstd -c > {{ funkwhale_root_dir }}/backup/{{ funkwhale_db_name }}.sql.zst
+  zstd -c > {{ funkwhale_root_dir }}/backup/{{ funkwhale_db_name | quote }}.sql.zst

roles/funkwhale/vars/CentOS-7.yml

@@ -0,0 +1,17 @@
+---
+
+funkwhale_packages:
+  - gcc
+  - git
+  - postgresql13
+  - postgresql-devel
+  - openldap-devel
+  - cyrus-sasl-devel
+  - libjpeg-turbo-devel
+  - python-psycopg2
+  - python-setuptools
+  - python3-virtualenv
+  - python3-pip
+  - ffmpeg
+  - mod_xsendfile
+

roles/funkwhale/vars/CentOS-8.yml

@@ -0,0 +1,16 @@
+---
+
+funkwhale_packages:
+  - gcc
+  - git
+  - postgresql13
+  - postgresql-devel
+  - openldap-devel
+  - cyrus-sasl-devel
+  - libjpeg-turbo-devel
+  - python3-psycopg2
+  - python3-setuptools
+  - python3-virtualenv
+  - python3-pip
+  - ffmpeg
+  #- mod_xsendfile

roles/gitea/meta/main.yml

@@ -1,3 +1,6 @@
 ---
 dependencies:
   - role: repo_scl
+    when:
+      - ansible_os_family == 'RedHat'
+      - ansible_distribution_major_version is version('8', '<')

roles/gitea/tasks/cleanup.yml

@@ -0,0 +1,8 @@
+---
+
+- name: Remove tmp and obsolete files
+  file: path={{ item }} state=absent
+  loop:
+    - /etc/profile.d/git.sh
+    - "{{ gitea_root_dir }}/db_dumps"
+  tags: gitea

roles/gitea/tasks/conf.yml

@@ -8,6 +8,7 @@
     - INTERNAL_TOKEN
     - LFS_JWT_SECRET
     - SECRET_KEY
+    - JWT_SECRET
   tags: gitea
 
 - name: Read random tokens
@@ -16,14 +17,11 @@
     - INTERNAL_TOKEN
     - LFS_JWT_SECRET
     - SECRET_KEY
+    - JWT_SECRET
   changed_when: False
   register: gitea_tokens
   tags: gitea
 
-- name: Set sclo-git212 as default git command
-  template: src=git.sh.j2 dest=/etc/profile.d/git.sh mode=755
-  tags: gitea
-
 - name: Deploy gitea configuration
   template: src=app.ini.j2 dest={{ gitea_root_dir }}/etc/app.ini owner=root group=gitea mode=0660
   notify: restart gitea

roles/gitea/tasks/directories.yml

@@ -21,7 +21,7 @@
       owner: root
       group: root
       mode: 700
-    - dir: db_dumps
+    - dir: backup
       owner: root
       group: root
       mode: 700

roles/gitea/tasks/facts.yml

@@ -1,4 +1,12 @@
 ---
+
+- include_vars: "{{ item }}"
+  with_first_found:
+    - vars/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml
+    - vars/{{ ansible_distribution }}.yml
+    - vars/{{ ansible_os_family }}.yml
+  tags: gitea
+
 - import_tasks: ../includes/webapps_set_install_mode.yml
   vars:
     - root_dir: "{{ gitea_root_dir }}"

roles/gitea/tasks/install.yml

@@ -1,9 +1,6 @@
 ---
 - name: Install packages
-  yum:
+  yum: name={{ gitea_packages }}
-    name:
-      - sclo-git212-git
-      - git-lfs
   tags: gitea
 
 - name: Download gitea binary

roles/gitea/tasks/main.yml

@@ -13,4 +13,4 @@
 - include: archive_post.yml
   when: gitea_install_mode == 'upgrade'
 - include: write_version.yml
-
+- include: cleanup.yml

roles/gitea/templates/app.ini.j2

@@ -25,6 +25,9 @@ OFFLINE_MODE     = true
 STATIC_ROOT_PATH = {{ gitea_root_dir }}
 LANDING_PAGE     = explore
 
+[oauth2]
+JWT_SECRET = {{ gitea_tokens.results | selectattr('item','equalto','JWT_SECRET') | map(attribute='stdout') | first | string }}
+
 [ssh.minimum_key_sizes]
 DSA = -1
 

roles/gitea/templates/gitea.service.j2

@@ -8,7 +8,7 @@ Type=simple
 User=gitea
 Group=gitea
 WorkingDirectory={{ gitea_root_dir }}
-ExecStart=/bin/scl enable sclo-git212 -- {{ gitea_root_dir}}/bin/gitea web -c /opt/gitea/etc/app.ini
+ExecStart={{ gitea_scl_cmd }}{{ gitea_root_dir }}/bin/gitea web -c /opt/gitea/etc/app.ini
 Environment=USER=gitea HOME={{ gitea_root_dir }} GITEA_WORK_DIR={{ gitea_root_dir }}
 PrivateTmp=yes
 PrivateDevices=yes

roles/gitea/templates/post_backup.sh.j2

@@ -1,3 +1,3 @@
 #!/bin/bash -e
 
-rm -f {{ gitea_root_dir }}/db_dumps/*
+rm -f {{ gitea_root_dir }}/backup/*

roles/gitea/templates/pre_backup.sh.j2

@@ -1,8 +1,8 @@
 #!/bin/bash -e
 
-/usr/bin/mysqldump --user='{{ gitea_db_user }}' \
+/usr/bin/mysqldump --user={{ gitea_db_user | quote }} \
-                   --password='{{ gitea_db_pass }}' \
+                   --password={{ gitea_db_pass | quote }} \
                    --host={{ gitea_db_server }} \
                    --quick --single-transaction \
                    --add-drop-table {{ gitea_db_name }} | \
-               lz4 -c > {{ gitea_root_dir }}/db_dumps/{{ gitea_db_name }}.sql.lz4
+               zstd -c > {{ gitea_root_dir }}/backup/{{ gitea_db_name }}.sql.zst

roles/gitea/vars/CentOS-7.yml

@@ -0,0 +1,6 @@
+---
+
+gitea_packages:
+  - sclo-git212-git
+  - git-lfs
+gitea_scl_cmd: '/bin/scl enable sclo-git212 -- '

roles/gitea/vars/CentOS-8.yml

@@ -0,0 +1,6 @@
+---
+
+gitea_packages:
+  - git
+  - git-lfs
+gitea_scl_cmd: ''

roles/matomo/defaults/main.yml

@@ -15,8 +15,8 @@ matomo_db_name: matomo_{{ matomo_id }}
 matomo_db_user: matomo_{{ matomo_id }}
 # matomo_db_pass:
 
-# Must be defined
+# Public matomo URL
-# matomo_public_url: https://matomo.example.com
+matomo_public_url: https://matomo.{{ inventory_hostname }}
 
 # If defined, restrict access to those hosts
 # matomo_src_ip:

roles/matomo/tasks/cleanup.yml

@@ -19,3 +19,11 @@
   file: path={{ matomo_root_dir }}/tmp/{{ item }}-{{ matomo_plugins[item].version }}.zip state=absent
   with_items: "{{ matomo_plugins.keys() | list }}"
   tags: matomo
+
+- name: Remove obsolete files
+  file: path={{ item }} state=absent
+  loop:
+    - /etc/backup/pre.d/matomo_{{ matomo_id }}_pre-backup
+    - /etc/backup/post.d/matomo_{{ matomo_id }}_post-backup
+    - "{{ matomo_root_dir }}/db_dumps"
+  tags: matomo

roles/matomo/tasks/directories.yml

@@ -15,6 +15,6 @@
     - path: "{{ matomo_root_dir }}/web"
     - path: "{{ matomo_root_dir }}/meta"
       mode: 700
-    - path: "{{ matomo_root_dir }}/db_dumps"
+    - path: "{{ matomo_root_dir }}/backup"
       mode: 700
   tags: matomo

roles/matomo/tasks/install.yml

@@ -4,11 +4,10 @@
   yum:
     name:
       - unzip
-      - MySQL-python
       - mariadb
       - acl
-      - "{{ (matomo_php_version == '54') | ternary('php-pecl-geoip','php' + matomo_php_version | string + '-php-pecl-geoip') }}"
+      - php{{ matomo_php_version }}-php-pecl-geoip
-  tags: [package,matomo]
+  tags: matomo
 
 - name: Download Matomo
   get_url:
@@ -36,11 +35,13 @@
   when:
     - matomo_install_mode == 'none'
     - not matomo_core_plugins_list.stat.exists
+  changed_when: False
   tags: matomo
 
 - name: Build a list of core plugins, which should never be removed
   shell: find {{ matomo_root_dir }}/tmp/matomo/plugins/ -mindepth 1 -maxdepth 1 -type d -exec basename "{}" \; > {{ matomo_root_dir }}/meta/core_plugins.txt
   when: matomo_install_mode != "none"
+  changed_when: False
   tags: matomo
 
 - name: Remove known non core plugins from the list
@@ -58,6 +59,7 @@
   shell: find {{ matomo_root_dir }}/archives/{{ matomo_current_version }}/web/plugins/ -mindepth 1 -maxdepth 1 -type d -exec basename "{}" \;
   register: matomo_previous_plugins
   when: matomo_install_mode == "upgrade"
+  changed_when: False
   tags: matomo
 
 - name: Move matomo to the web directory
@@ -157,12 +159,10 @@
   tags: matomo
 
 - name: Deploy backup scripts
-  template: src={{ item.script }}.j2 dest=/etc/backup/{{ item.type }}.d/matomo_{{ matomo_id }}_{{ item.script }} mode=750
+  template: src={{ item }}-backup.j2 dest=/etc/backup/{{ item }}.d/matomo_{{ matomo_id }} mode=750
-  with_items:
+  loop:
-    - script: pre-backup
+    - pre
-      type: pre
+    - post
-    - script: post-backup
-      type: post
   tags: matomo
 
 - name: Setup cron task

roles/matomo/tasks/main.yml

@@ -1,8 +1,8 @@
 ---
 
-- include: facts.yml
 - include: user.yml
 - include: directories.yml
+- include: facts.yml
 - include: archive_pre.yml
   when: matomo_install_mode == 'upgrade'
 - include: install.yml

roles/matomo/templates/post-backup.j2

@@ -1,3 +1,3 @@
 #!/bin/sh
 
-rm -f {{ matomo_root_dir }}/db_dump/*
+rm -f {{ matomo_root_dir }}/backup/*

roles/matomo/templates/pre-backup.j2

@@ -1,7 +1,7 @@
 #!/bin/sh
 
-/usr/bin/mysqldump --user={{ matomo_db_user }} \
+/usr/bin/mysqldump --user={{ matomo_db_user | quote }} \
-                   --password={{ matomo_db_pass }} \
+                   --password={{ matomo_db_pass | quote }} \
-                   --host={{ matomo_db_server }} \
+                   --host={{ matomo_db_server | quote }} \
                    --quick --single-transaction \
-                   --add-drop-table {{ matomo_db_name }} | lz4 -c > {{ matomo_root_dir }}/db_dumps/{{ matomo_db_name }}.sql.lz4
+                   --add-drop-table {{ matomo_db_name | quote }} | zstd -c > {{ matomo_root_dir }}/backup/{{ matomo_db_name }}.sql.zst

roles/matrix_synapse/tasks/facts.yml

@@ -1,26 +1,32 @@
 ---
 
-- import_tasks: ../includes/get_rand_pass.yml
+- include_vars: "{{ item }}"
-  vars:
+  with_first_found:
-    - pass_file: "{{ synapse_root_dir }}/meta/ansible_dbpass"
+    - vars/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml
-  when: synapse_pg_db_pass is not defined
+    - vars/{{ ansible_distribution }}.yml
-  tags: matrix
+    - vars/{{ ansible_os_family }}.yml
-- set_fact: synapse_pg_db_pass={{ rand_pass }}
-  when: synapse_pg_db_pass is not defined
   tags: matrix
 
-- import_tasks: ../includes/get_rand_pass.yml
+- when: synapse_pg_db_pass is not defined
-  vars:
+  block:
-    - pass_file: "{{ synapse_root_dir }}/meta/ansible_macaroon_key"
+    - import_tasks: ../includes/get_rand_pass.yml
-  tags: matrix
+      vars:
-- set_fact: synapse_macaroon_key={{ rand_pass }}
+        - pass_file: "{{ synapse_root_dir }}/meta/ansible_dbpass"
+    - set_fact: synapse_pg_db_pass={{ rand_pass }}
   tags: matrix
 
-- import_tasks: ../includes/get_rand_pass.yml
+- block:
-  vars:
+    - import_tasks: ../includes/get_rand_pass.yml
-    - pass_file: "{{ synapse_root_dir }}/meta/ansible_form_secret"
+      vars:
+        - pass_file: "{{ synapse_root_dir }}/meta/ansible_macaroon_key"
+    - set_fact: synapse_macaroon_key={{ rand_pass }}
   tags: matrix
-- set_fact: synapse_form_secret={{ rand_pass }}
+
+- block:
+    - import_tasks: ../includes/get_rand_pass.yml
+      vars:
+        - pass_file: "{{ synapse_root_dir }}/meta/ansible_form_secret"
+    - set_fact: synapse_form_secret={{ rand_pass }}
   tags: matrix
 
 - name: Check if the old venv is present

roles/matrix_synapse/tasks/install.yml

@@ -1,32 +1,20 @@
 ---
 
 - name: Install system dependencies
-  yum:
+  yum: name={{ synapse_packages }}
-    name:
+  tags: matrix
-      - libtiff-devel
+
-      - libjpeg-devel
+- name: Check if pg_config is available
-      - libzip-devel
+  stat: path=/bin/pg_config
-      - freetype-devel
+  register: synapse_pg_config
-      - lcms2-devel
+  tags: matrix
-      - libwebp-devel
+
-      - tcl-devel
+- name: Setup pg_config
-      - tk-devel
+  alternatives:
-      - libffi-devel
+    name: psql-pg_config
-      - openssl-devel
+    link: /bin/pg_config
-      - libxslt-devel
+    path: /usr/pgsql-13/bin/pg_config
-      - gcc
+  when: not synapse_pg_config.stat.exists
-      - gcc-c++
-      - libtool
-      - autoconf
-      - automake
-      - postgresql13
-      - postgresql-devel
-      - libpqxx-devel
-      - jemalloc
-      - python3-virtualenv
-      - python3-pip
-      - python-psycopg2
-      - python-setuptools
   tags: matrix
 
 - name: Wipe pip cache
@@ -51,6 +39,7 @@
       - mock
       - six
       - authlib
+      - twisted
   notify: restart synapse
   tags: matrix
 
@@ -112,3 +101,7 @@
     - post
   tags: matrix
 
+- name: Reset SELinux contexts
+  command: restorecon -R {{ synapse_root_dir }}
+  when: ansible_selinux.status == 'enabled'
+  tags: matrix

roles/matrix_synapse/templates/matrix-synapse.service.j2

@@ -5,7 +5,7 @@ Description=Synapse Matrix homeserver
 Type=simple
 User={{ synapse_user }}
 Group={{ synapse_user }}
-Environment=LD_PRELOAD=/usr/lib64/libjemalloc.so.1
+Environment=LD_PRELOAD={{ synapse_jemalloc }}
 {% if system_proxy is defined and system_proxy != '' %}
 {% for env in ['http_proxy', 'https_proxy', 'HTTP_PROXY', 'HTTPS_PROXY'] %}
 Environment={{ env }}={{ system_proxy | urlsplit('hostname') }}:{{ system_proxy | urlsplit('port') }}

roles/matrix_synapse/vars/CentOS-7.yml

@@ -0,0 +1,29 @@
+---
+
+synapse_packages:
+  - libtiff-devel
+  - libjpeg-devel
+  - libzip-devel
+  - freetype-devel
+  - lcms2-devel
+  - libwebp-devel
+  - tcl-devel
+  - tk-devel
+  - libffi-devel
+  - openssl-devel
+  - libxslt-devel
+  - gcc
+  - gcc-c++
+  - libtool
+  - autoconf
+  - automake
+  - postgresql13
+  - postgresql-devel
+  - libpqxx-devel
+  - jemalloc
+  - python3-virtualenv
+  - python3-pip
+  - python-psycopg2
+  - python-setuptools
+
+synapse_jemalloc: /usr/lib64/libjemalloc.so.1

roles/matrix_synapse/vars/CentOS-8.yml

@@ -0,0 +1,28 @@
+---
+
+synapse_packages:
+  - libtiff-devel
+  - libjpeg-devel
+  - libzip-devel
+  - freetype-devel
+  - lcms2-devel
+  - libwebp-devel
+  - tcl-devel
+  - tk-devel
+  - libffi-devel
+  - openssl-devel
+  - libxslt-devel
+  - gcc
+  - gcc-c++
+  - libtool
+  - autoconf
+  - automake
+  - postgresql13
+  - postgresql-devel
+  - jemalloc
+  - python3-virtualenv
+  - python3-pip
+  - python3-psycopg2
+  - python3-setuptools
+
+synapse_jemalloc: /usr/lib64/libjemalloc.so.2

roles/mongodb_server/meta/main.yml

@@ -1,4 +1,5 @@
 ---
 
 dependencies:
+  - role: mkdir
   - role: repo_mongodb

roles/mongodb_server/tasks/main.yml

@@ -1,5 +1,12 @@
 ---
 
+- include_vars: "{{ item }}"
+  with_first_found:
+    - vars/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml
+    - vars/{{ ansible_distribution }}.yml
+    - vars/{{ ansible_os_family }}.yml
+  tags: mongo
+
 - name: Remove versions from the base repo
   yum:
     name:
@@ -9,18 +16,14 @@
   tags: mongo
 
 - name: Install MongoDB server and tools
-  yum:
+  yum: name={{ mongo_packages }}
-    name:
-      - mongodb-org-server
-      - mongodb-org
-      - python-pymongo
   tags: mongo
 
 - name: Create data dir
   file: path={{ mongo_db_path }} state=directory
   tags: mongo
 
-  # DO it in two times so parent dir don't have restrictive permissions
+  # Do it in two times so parent dir don't have restrictive permissions
 - name: Set permissions on data dir
   file: path={{ mongo_db_path }} state=directory owner=mongod group=mongod mode=700
   tags: mongo
@@ -39,13 +42,6 @@
   changed_when: False
   tags: mongo
 
-- name: Create pre and post backup hook dir
-  file: path=/etc/backup/{{ item }}.d state=directory
-  loop:
-    - pre
-    - post
-  tags: mongo
-
 - name: Deploy pre/post backup scripts
   template: src={{ item }}-backup.j2 dest=/etc/backup/{{ item }}.d/mongo mode=750
   loop:
@@ -68,7 +64,6 @@
       [Service]
       Type=simple
       PrivateTmp=yes
-      PrivateDevices=yes
       ProtectSystem=full
       ProtectHome=yes
       NoNewPrivileges=yes

roles/mongodb_server/vars/CentOS-7.yml

@@ -0,0 +1,6 @@
+---
+
+mongo_packages:
+  - mongodb-org-server
+  - mongodb-org
+  - python-pymongo

roles/mongodb_server/vars/CentOS-8.yml

@@ -0,0 +1,6 @@
+---
+
+mongo_packages:
+  - mongodb-org-server
+  - mongodb-org
+  - python3-pymongo