mirror of
https://github.com/MatteZ02/infra.git
synced 2024-11-10 04:50:20 +00:00
First setup
This commit is contained in:
commit
06b582cc61
3
.gitignore
vendored
Normal file
3
.gitignore
vendored
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
!/collections/.gitkeep
|
||||||
|
/collections
|
||||||
|
__pycache__
|
16
ansible.cfg
Normal file
16
ansible.cfg
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
[defaults]
|
||||||
|
inventory = inventory.yml
|
||||||
|
hash_behaviour = merge
|
||||||
|
gathering = smart
|
||||||
|
transport = local
|
||||||
|
display_skipped_hosts = false
|
||||||
|
interpreter_python = auto_silent
|
||||||
|
localhost_warning = false
|
||||||
|
collections_path = collections
|
||||||
|
inject_facts_as_vars = false
|
||||||
|
force_handlers = true
|
||||||
|
action_warnings = false
|
||||||
|
inventory_unparsed_warning = false
|
||||||
|
|
||||||
|
[inventory]
|
||||||
|
host_pattern_mismatch = ignore
|
39
install.sh
Normal file
39
install.sh
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
if [ ! "$BASH_VERSION" ] ; then
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "
|
||||||
|
==============================
|
||||||
|
|
||||||
|
Multi Platform Project - Ansible
|
||||||
|
Install Script
|
||||||
|
|
||||||
|
------------------------------
|
||||||
|
"
|
||||||
|
|
||||||
|
stop () {
|
||||||
|
|
||||||
|
echo "
|
||||||
|
==============================
|
||||||
|
"
|
||||||
|
|
||||||
|
exit 1
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
mkdir -p ~/.ssh &> /dev/null
|
||||||
|
|
||||||
|
apt-get install -y python3-pip python3-venv jq git curl &> /dev/null
|
||||||
|
python3 -m venv /opt/ansible &> /dev/null
|
||||||
|
/opt/ansible/bin/pip3 install ansible hvac netaddr jmespath pexpect &> /dev/null
|
||||||
|
|
||||||
|
/opt/ansible/bin/ansible-galaxy collection install -r requirements.yml --upgrade &> /dev/null
|
||||||
|
|
||||||
|
/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mpp-ansible --private-key ~/.ssh/id_rsa tasks.yml -t install
|
||||||
|
|
||||||
|
|
||||||
|
echo "
|
||||||
|
==============================
|
||||||
|
"
|
7
inventory.yml
Normal file
7
inventory.yml
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
all:
|
||||||
|
hosts:
|
||||||
|
localhost:
|
||||||
|
vars:
|
||||||
|
ansible_connection: local
|
||||||
|
ansible_python_interpreter: "{{ansible_playbook_python}}"
|
3
requirements.yml
Normal file
3
requirements.yml
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
---
|
||||||
|
collections:
|
||||||
|
- containers.docker
|
25
tasks.yml
Normal file
25
tasks.yml
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
---
|
||||||
|
- name: "Tasks"
|
||||||
|
hosts: all
|
||||||
|
module_defaults:
|
||||||
|
ansible.builtin.gather_facts:
|
||||||
|
gather_timeout: 10
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: "Install"
|
||||||
|
import_tasks: tasks/install.yml
|
||||||
|
tags:
|
||||||
|
- install
|
||||||
|
- never
|
||||||
|
|
||||||
|
- name: "Maintenance"
|
||||||
|
import_tasks: tasks/maintenance.yml
|
||||||
|
tags:
|
||||||
|
- maintenance
|
||||||
|
- never
|
||||||
|
|
||||||
|
- name: "Deployer"
|
||||||
|
import_tasks: tasks/deployer.yml
|
||||||
|
tags:
|
||||||
|
- deployer
|
||||||
|
- never
|
217
tasks/deployer.yml
Normal file
217
tasks/deployer.yml
Normal file
@ -0,0 +1,217 @@
|
|||||||
|
---
|
||||||
|
- name: "Deployer - SSH - Generate Keypairs"
|
||||||
|
community.crypto.openssh_keypair:
|
||||||
|
path: "/root/.ssh/keys/{{ path }}"
|
||||||
|
type: rsa
|
||||||
|
comment: "{{ ansible_facts.fqdn }}"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: '0600'
|
||||||
|
loop: "{{ paths[ansible_facts.fqdn] }}"
|
||||||
|
loop_control:
|
||||||
|
label: "{{ path }}"
|
||||||
|
loop_var: "path"
|
||||||
|
vars:
|
||||||
|
paths:
|
||||||
|
http://divarinet.northeurope.cloudapp.azure.com:
|
||||||
|
- github-MetroHege-MPP-Frontend
|
||||||
|
- github-metrohege-MPP-Backend
|
||||||
|
tags:
|
||||||
|
- ssh
|
||||||
|
|
||||||
|
- name: "Deployer - Certbot - Renew Certificates"
|
||||||
|
command: "certbot renew"
|
||||||
|
register: task
|
||||||
|
changed_when: task.stdout.find("No renewals were attempted.") == -1
|
||||||
|
tags:
|
||||||
|
- certbot
|
||||||
|
- tls
|
||||||
|
|
||||||
|
- name: "Deployer - Certbot - Copy Certificates"
|
||||||
|
copy:
|
||||||
|
src: "/etc/letsencrypt/live/mpp/"
|
||||||
|
dest: "/root/certs/mpp/"
|
||||||
|
follow: true
|
||||||
|
register: task
|
||||||
|
tags:
|
||||||
|
- certbot
|
||||||
|
- tls
|
||||||
|
|
||||||
|
- name: "Deployer - MariaDB - Pull Image"
|
||||||
|
containers.podman.podman_image:
|
||||||
|
name: docker.io/mariadb
|
||||||
|
tag: latest
|
||||||
|
register: deployerTask101
|
||||||
|
when:
|
||||||
|
- ansible_facts.fqdn == "http://divarinet.northeurope.cloudapp.azure.com"
|
||||||
|
|
||||||
|
- name: "Deployer - MariaDB - Run Container"
|
||||||
|
containers.podman.podman_container:
|
||||||
|
name: mariadb
|
||||||
|
image: docker.io/mariadb:latest
|
||||||
|
state: started
|
||||||
|
restart: on
|
||||||
|
network: host
|
||||||
|
volumes:
|
||||||
|
- "/root/mariadb:/var/lib/mysql"
|
||||||
|
restart_policy: always
|
||||||
|
env:
|
||||||
|
# TODO
|
||||||
|
MYSQL_ROOT_PASSWORD: "no password?"
|
||||||
|
register: deployerTask102
|
||||||
|
when:
|
||||||
|
- ansible_facts.fqdn == "http://divarinet.northeurope.cloudapp.azure.com"
|
||||||
|
- (deployerTask101 is defined and deployerTask101.changed) or deployerTask101 is undefined
|
||||||
|
tags:
|
||||||
|
- mariadb
|
||||||
|
|
||||||
|
- name: "Deployer - MariaDB - Wait"
|
||||||
|
wait_for:
|
||||||
|
host: "127.0.0.1"
|
||||||
|
port: "3306"
|
||||||
|
delay: 10
|
||||||
|
when:
|
||||||
|
- ansible_facts.fqdn == "http://divarinet.northeurope.cloudapp.azure.com"
|
||||||
|
- (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
|
||||||
|
tags:
|
||||||
|
- mariadb
|
||||||
|
|
||||||
|
- name: "Deployer - MariaDB - Upgrade"
|
||||||
|
containers.podman.podman_container_exec:
|
||||||
|
container: "mariadb"
|
||||||
|
command: "mariadb-upgrade --host=127.0.0.1 --user=root --password=wE7qVL67xJaaXkfo"
|
||||||
|
register: task
|
||||||
|
ignore_errors: yes
|
||||||
|
changed_when: task.stdout.find("This installation of MariaDB is already upgraded") == -1
|
||||||
|
when:
|
||||||
|
- ansible_facts.fqdn == "http://divarinet.northeurope.cloudapp.azure.com"
|
||||||
|
- (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
|
||||||
|
tags:
|
||||||
|
- mariadb
|
||||||
|
|
||||||
|
- name: "Deployer - MariaDB - Create Users"
|
||||||
|
mysql_user:
|
||||||
|
login_host: "127.0.0.1"
|
||||||
|
login_user: root
|
||||||
|
login_password: "wE7qVL67xJaaXkfo"
|
||||||
|
ca_cert: "/etc/letsencrypt/live/mpp/chain.pem"
|
||||||
|
check_hostname: no
|
||||||
|
name: "mpp"
|
||||||
|
host: "%"
|
||||||
|
password: "UOzw4ijLaJQI13Ec"
|
||||||
|
priv: "mpp.*:ALL"
|
||||||
|
vars:
|
||||||
|
ansible_python_interpreter: "/opt/ansible/bin/python3"
|
||||||
|
when:
|
||||||
|
- ansible_facts.fqdn == "http://divarinet.northeurope.cloudapp.azure.com"
|
||||||
|
- (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
|
||||||
|
tags:
|
||||||
|
- mariadb
|
||||||
|
|
||||||
|
- name: "Deployer - MariaDB - Create Database"
|
||||||
|
mysql_db:
|
||||||
|
login_host: "127.0.0.1"
|
||||||
|
login_user: "mpp"
|
||||||
|
login_password: "UOzw4ijLaJQI13Ec"
|
||||||
|
ca_cert: "/etc/letsencrypt/live/mpp/chain.pem"
|
||||||
|
check_hostname: no
|
||||||
|
name: "mpp"
|
||||||
|
vars:
|
||||||
|
ansible_python_interpreter: "/opt/ansible/bin/python3"
|
||||||
|
when:
|
||||||
|
- ansible_facts.fqdn == "http://divarinet.northeurope.cloudapp.azure.com"
|
||||||
|
- (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
|
||||||
|
tags:
|
||||||
|
- mariadb
|
||||||
|
|
||||||
|
- name: "Deployer - Backend - Git Operations"
|
||||||
|
git:
|
||||||
|
repo: git@github.com:MetroHege/MPP-Frontend.git
|
||||||
|
dest: /root/backend
|
||||||
|
version: master
|
||||||
|
register: deployerTask521
|
||||||
|
when:
|
||||||
|
- ansible_facts.fqdn == "http://divarinet.northeurope.cloudapp.azure.com"
|
||||||
|
|
||||||
|
- name: "Deployer - Backend - Build Image"
|
||||||
|
containers.podman.podman_image:
|
||||||
|
name: mpp/backend
|
||||||
|
tag: latest
|
||||||
|
path: /root/backend
|
||||||
|
build:
|
||||||
|
file: Dockerfile
|
||||||
|
format: docker
|
||||||
|
cache: on
|
||||||
|
force: on
|
||||||
|
become: on
|
||||||
|
become_user: root
|
||||||
|
register: deployerTask522
|
||||||
|
when:
|
||||||
|
- ansible_facts.fqdn == "http://divarinet.northeurope.cloudapp.azure.com"
|
||||||
|
- (deployerTask521 is defined and deployerTask521.changed) or deployerTask521 is undefined
|
||||||
|
tags:
|
||||||
|
- backend
|
||||||
|
|
||||||
|
- name: "Deployer -Backend - Run Container"
|
||||||
|
containers.podman.podman_container:
|
||||||
|
name: backend
|
||||||
|
image: mpp/backend:latest
|
||||||
|
state: started
|
||||||
|
recreate: on
|
||||||
|
network: host
|
||||||
|
volumes:
|
||||||
|
- "/root/backend/.env:/usr/src/app/.env:ro"
|
||||||
|
restart_policy: always
|
||||||
|
command: "npm start"
|
||||||
|
when:
|
||||||
|
- ansible_facts.fqdn == "http://divarinet.northeurope.cloudapp.azure.com"
|
||||||
|
- deployerTask522 is defined
|
||||||
|
- deployerTask522.changed
|
||||||
|
tags:
|
||||||
|
- backend
|
||||||
|
|
||||||
|
- name: "Deployer - Frontend - Git Operations"
|
||||||
|
git:
|
||||||
|
repo: git@github.com:MetroHege/MPP-Frontend.git
|
||||||
|
dest: /root/backend/client
|
||||||
|
version: master
|
||||||
|
register: deployerTask531
|
||||||
|
when:
|
||||||
|
- ansible_facts.fqdn == "http://divarinet.northeurope.cloudapp.azure.com"
|
||||||
|
|
||||||
|
- name: "Deployer - Frontend - Build Image"
|
||||||
|
containers.podman.podman_image:
|
||||||
|
name: mpp/frontend
|
||||||
|
tag: latest
|
||||||
|
path: /root/backend/client
|
||||||
|
build:
|
||||||
|
file: Dockerfile
|
||||||
|
format: docker
|
||||||
|
cache: on
|
||||||
|
force: on
|
||||||
|
become: on
|
||||||
|
become_user: root
|
||||||
|
register: deployerTask532
|
||||||
|
when:
|
||||||
|
- ansible_facts.fqdn == "http://divarinet.northeurope.cloudapp.azure.com"
|
||||||
|
- (deployerTask531 is defined and deployerTask531.changed) or deployerTask531 is undefined
|
||||||
|
tags:
|
||||||
|
- frontend
|
||||||
|
|
||||||
|
- name: "Deployer - Frontend - Run Container"
|
||||||
|
containers.podman.podman_container:
|
||||||
|
name: frontend
|
||||||
|
image: mpp/frontend:latest
|
||||||
|
state: started
|
||||||
|
recreate: on
|
||||||
|
network: host
|
||||||
|
volumes:
|
||||||
|
- "/root/backend/client/.env:/usr/src/app/.env:ro"
|
||||||
|
restart_policy: always
|
||||||
|
command: "npm start"
|
||||||
|
when:
|
||||||
|
- ansible_facts.fqdn == "http://divarinet.northeurope.cloudapp.azure.com"
|
||||||
|
- deployerTask532 is defined
|
||||||
|
- deployerTask532.changed
|
||||||
|
tags:
|
||||||
|
- frontend
|
163
tasks/install.yml
Normal file
163
tasks/install.yml
Normal file
@ -0,0 +1,163 @@
|
|||||||
|
---
|
||||||
|
- name: "Install - Ansible - Python Library"
|
||||||
|
pip:
|
||||||
|
name: ansible
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
tags:
|
||||||
|
- ansible
|
||||||
|
|
||||||
|
- name: "Install - Ansible - Create Symbolic Links"
|
||||||
|
ansible.builtin.file:
|
||||||
|
src: /opt/ansible/bin/{{ binary }}
|
||||||
|
dest: /usr/local/bin/{{ binary }}
|
||||||
|
state: link
|
||||||
|
vars:
|
||||||
|
binaries:
|
||||||
|
- ansible
|
||||||
|
- ansible-community
|
||||||
|
- ansible-config
|
||||||
|
- ansible-connection
|
||||||
|
- ansible-console
|
||||||
|
- ansible-doc
|
||||||
|
- ansible-galaxy
|
||||||
|
- ansible-inventory
|
||||||
|
- ansible-playbook
|
||||||
|
- ansible-pull
|
||||||
|
- ansible-test
|
||||||
|
- ansible-vault
|
||||||
|
loop: "{{ binaries }}"
|
||||||
|
loop_control:
|
||||||
|
label: "{{ binary }}"
|
||||||
|
loop_var: "binary"
|
||||||
|
tags:
|
||||||
|
- ansible
|
||||||
|
|
||||||
|
- name: "Install - Ansible - Dependencies / Python Library : hvac"
|
||||||
|
pip:
|
||||||
|
name: hvac
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
tags:
|
||||||
|
- ansible
|
||||||
|
|
||||||
|
- name: "Install - Ansible - Dependencies / Python Library : netaddr"
|
||||||
|
pip:
|
||||||
|
name: netaddr
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
tags:
|
||||||
|
- ansible
|
||||||
|
|
||||||
|
- name: "Install - Ansible - Dependencies / Python Library : jmespath"
|
||||||
|
pip:
|
||||||
|
name: jmespath
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
tags:
|
||||||
|
- ansible
|
||||||
|
|
||||||
|
- name: "Install - Ansible - Dependencies / Python Library : pexpect"
|
||||||
|
pip:
|
||||||
|
name: pexpect
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
tags:
|
||||||
|
- ansible
|
||||||
|
|
||||||
|
- name: "Install - Podman"
|
||||||
|
apt:
|
||||||
|
name: podman
|
||||||
|
state: latest
|
||||||
|
tags:
|
||||||
|
- podman
|
||||||
|
|
||||||
|
- name: "Install - Certbot - Python Library"
|
||||||
|
pip:
|
||||||
|
name: certbot
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
when:
|
||||||
|
- ansible_facts.fqdn == "http://divarinet.northeurope.cloudapp.azure.com"
|
||||||
|
tags:
|
||||||
|
- certbot
|
||||||
|
|
||||||
|
- name: "Install - Certbot - Create Symbolic Links"
|
||||||
|
ansible.builtin.file:
|
||||||
|
src: /opt/ansible/bin/{{ binary }}
|
||||||
|
dest: /usr/local/bin/{{ binary }}
|
||||||
|
state: link
|
||||||
|
vars:
|
||||||
|
binaries:
|
||||||
|
- certbot
|
||||||
|
loop: "{{ binaries }}"
|
||||||
|
loop_control:
|
||||||
|
label: "{{ binary }}"
|
||||||
|
loop_var: "binary"
|
||||||
|
when:
|
||||||
|
- ansible_facts.fqdn == "http://divarinet.northeurope.cloudapp.azure.com"
|
||||||
|
tags:
|
||||||
|
- certbot
|
||||||
|
|
||||||
|
- name: "Install - Certbot - Auth Hook"
|
||||||
|
get_url:
|
||||||
|
url: "https://git.waren.io/warengroup/acme-dns-auth/raw/branch/master/acme-dns-auth.py"
|
||||||
|
dest: "/etc/letsencrypt/renewal-hooks/pre/acme-dns-auth.py"
|
||||||
|
mode: '700'
|
||||||
|
force: true
|
||||||
|
tags:
|
||||||
|
- certbot
|
||||||
|
|
||||||
|
- name: "Install - Certbot - Create Certificates"
|
||||||
|
command: "certbot certonly --cert-name {{ cert.name }} --manual --preferred-challenges dns-01 --email {{ cert.email }} --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -n --manual-auth-hook /etc/letsencrypt/renewal-hooks/pre/acme-dns-auth.py --debug-challenges --preferred-chain='ISRG Root X1' --key-type rsa -d {{ cert.domains | join(' -d ') }}"
|
||||||
|
register: task
|
||||||
|
changed_when: task.stdout.find("Certificate not yet due for renewal; no action taken.") == -1
|
||||||
|
vars:
|
||||||
|
cert:
|
||||||
|
name: musix
|
||||||
|
email: musixdiscordbot@gmail.com
|
||||||
|
domains:
|
||||||
|
- musix-org.com
|
||||||
|
- "*.musix-org.com"
|
||||||
|
tags:
|
||||||
|
- certbot
|
||||||
|
|
||||||
|
- name: "Install - MariaDB - Dependencies / Python Library : pymysql"
|
||||||
|
pip:
|
||||||
|
name: pymysql
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
|
||||||
|
- name: "Install - MariaDB - Dependencies / Package : mariadb-client"
|
||||||
|
apt:
|
||||||
|
name: "mariadb-client"
|
||||||
|
state: latest
|
||||||
|
when:
|
||||||
|
- ansible_facts.distribution == "Debian" or ansible_facts.distribution == "Ubuntu" or ansible_facts.distribution == "Linux Mint"
|
||||||
|
|
||||||
|
- name: "Install - Schedule - Maintenance"
|
||||||
|
cron:
|
||||||
|
name: Maintenance
|
||||||
|
hour: "*/3"
|
||||||
|
minute: "0"
|
||||||
|
job: "/opt/ansible/bin/ansible-pull -U ssh://git@github.com/musix-org/ansible --accept-host-key --private-key ~/.ssh/id_rsa tasks.yml -t maintenance"
|
||||||
|
|
||||||
|
- name: "Install - Schedule - Deployer"
|
||||||
|
cron:
|
||||||
|
name: Deployer
|
||||||
|
minute: "*/5"
|
||||||
|
job: "/opt/ansible/bin/ansible-pull -U ssh://git@github.com/musix-org/ansible --accept-host-key --private-key ~/.ssh/id_rsa tasks.yml -t deployer"
|
37
tasks/maintenance.yml
Normal file
37
tasks/maintenance.yml
Normal file
@ -0,0 +1,37 @@
|
|||||||
|
---
|
||||||
|
- name: "Maintenance - OS Update"
|
||||||
|
apt:
|
||||||
|
upgrade: dist
|
||||||
|
update_cache: yes
|
||||||
|
|
||||||
|
- name: "Maintenance - Ansible : Dependencies - Python Library : hvac"
|
||||||
|
pip:
|
||||||
|
name: hvac
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
|
||||||
|
- name: "Maintenance - Ansible : Dependencies - Python Library : netaddr"
|
||||||
|
pip:
|
||||||
|
name: netaddr
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
|
||||||
|
- name: "Maintenance - Ansible : Dependencies - Python Library : jmespath"
|
||||||
|
pip:
|
||||||
|
name: jmespath
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
||||||
|
|
||||||
|
- name: "Maintenance - Ansible : Dependencies - Python Library : pexpect"
|
||||||
|
pip:
|
||||||
|
name: pexpect
|
||||||
|
state: latest
|
||||||
|
extra_args: --upgrade
|
||||||
|
virtualenv: /opt/ansible
|
||||||
|
virtualenv_command: "python3 -m venv"
|
Loading…
Reference in New Issue
Block a user