Run ansible in a crontask on service hosts

Because this won't work well in development (it will always look at
prod-hosts), it's easily disabled with no_ansible_pull=true in the
inventory.  Fixes #3089.

group_vars/all

@@ -47,3 +47,6 @@ utility_packages:
 - bash
 - screen
 - vim-lite  # we probably do not want to bring all the stuff
+
+# The upstream repository from which the service host crontask should pull
+ansible_git_repository: https://github.com/buildbot/buildbot-infra

prod-hosts

@@ -1,3 +1,6 @@
+# Available service host variables:
+#  - no_ansible_pull=true -- don't install a crontask to run ansible-pull (useful for development)
+
 [jail-servicehosts]
 service[1:3].buildbot.net
 

roles/base-servicehost/tasks/ansible-pull.yml

@@ -0,0 +1,51 @@
+---
+- name: install ansible
+  pkgng:
+    name: ansible
+    state: present
+
+- name: create service account
+  user:
+    name: "{{ service_account }}"
+    groups: wheel
+    state: present
+
+- name: create /var/ansible
+  file:
+    path: /var/ansible
+    mode: 0700
+    owner: "{{ service_account }}"
+    group: wheel
+    state: directory
+
+- name: install vault password
+  template:
+    src: vault-password.j2
+    dest: /var/ansible/.vault-password
+    mode: 0600
+    owner: "{{ service_account }}"
+    group: wheel
+
+# ansible-pull expects the inventory file to exist already, even before it
+# clones the repo, so we clone the repo explicitly.  The repo needs to be owned
+# by the service user, so it's cloned in a command rather than with the 'git'
+# module
+- name: clone ansible git repository
+  shell: "git clone {{ ansible_git_repository }} /var/ansible/repo && chown -R {{ service_account }}:wheel /var/ansible/repo"
+  args:
+    creates: /var/ansible/repo
+
+- name: test
+  debug:
+    msg: "{{ 'absent' if no_ansible_pull|default('false')|bool else 'present' }}"
+
+- name: install ansible-pull crontask
+  tags: ansible-pull
+  cron:
+    name: ansible-pull
+    job: "ansible-pull -C master -d /var/ansible/repo/ -m git -U {{ ansible_git_repository }} -o -s 3600 -i /var/ansible/repo/prod-hosts --vault-password-file=/var/ansible/.vault-password site.yml"
+    user: "{{ service_account }}"
+    minute: 0
+    state: "{{ 'present' if no_ansible_pull|default('false')|bool else 'absent' }}"
+
+# vim:ft=yaml:nosi:noai:ts=2:sw=2

roles/base-servicehost/tasks/main.yml

@@ -1,2 +1,3 @@
 ---
 - include: users.yml
+- include: ansible-pull.yml

roles/base-servicehost/templates/vault-password.j2

@@ -0,0 +1 @@
+{{ vault_password }}