Troubleshooting the reemo-infra Role¶

This page covers common errors encountered when deploying the Reemo infrastructure with the reemo-infra Ansible role.

HMACSECRET is empty¶

Symptom: The playbook stops on the check if HMACSECRET is not empty task with the following error:

TASK [reemo-infra : check if HMACSECRET is not empty] **************************
[ERROR]: Task failed: Action failed: HMACSECRET is empty
Origin: /path/to/roles/reemo-infra/tasks/main.yml:69:3

fatal: [portal_manager1]: FAILED! => {"changed": false, "msg": "HMACSECRET is empty"}

Root Cause: Your inventory deploys a DMZ architecture: the api_manager and portal_manager groups replace the infra_manager group, and the portal is installed on a machine separate from the API. In this architecture, the portal signs each of its requests to the API with a shared secret, the HMACSECRET variable. The API verifies this signature and rejects any request that doesn’t carry a valid one. If the variable isn’t set in the inventory, the role refuses to continue the deployment.

Solution:

Generate a secret:
- Use a random string of at least 32 characters, for example with openssl rand -hex 32
- Keep it with your instance’s other secrets

Add the variable to the inventory:

Declare HMACSECRET in all.vars, so the API and all portals share the same value:

all:
    vars:
        API_LICENSE: "< license >"
        HMACSECRET: "< generated secret >"
api_manager:
    ...
portal_manager:
    ...

Rerun the playbook:
- Rerun the deployment with the same ansible-playbook command

If the API and the portals don’t share the exact same value, the portal’s requests are rejected by the API after deployment: check that HMACSECRET is defined only once, in all.vars, and not redefined in any group or host.