Initial Commit

README.md

@@ -0,0 +1 @@
+# MatteZ02 - Infra

ansible.cfg

@@ -1,12 +1,12 @@
 [defaults]
-inventory = inventories/mpp
+inventory = inventories/xxx
 hash_behaviour = merge
 gathering = smart
 transport = local
 display_skipped_hosts = false
 interpreter_python = auto_silent
 localhost_warning = false
-collections_path = collections
+collections_path = collections:~/.ansible/collections
 inject_facts_as_vars = false
 force_handlers = true
 action_warnings = false

files/certbot/nginx.sh

@@ -1,5 +0,0 @@
-#!/bin/bash
-
-echo -n "$CERTBOT_VALIDATION" > /root/nginx/html/.well-known/acme-challenge/$CERTBOT_TOKEN
-mkdir -p /root/nginx/html/.well-known/acme-challenge
-/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mpp-infra --accept-host-key --private-key ~/.ssh/id_rsa --vault-password-file ~/.ansible/vault.yml tasks.yml -t nginx &> /dev/null

files/nginx/conf/000-default.conf

@@ -1,105 +0,0 @@
-server {
-
-    listen  80 default_server;
-    listen  [::]:80 default_server;
-
-    server_name _;
-
-    expires off;
-    etag off;
-    if_modified_since off;
-
-    gzip on;
-    gzip_min_length 1000;
-    gzip_proxied any;
-    gzip_types *;
-    gunzip on;
-
-    location / {
-        root   /usr/share/nginx/html;
-        index  index.html index.htm;
-
-        return 301 https://$host$request_uri;
-    }
-
-    location /.well-known/acme-challenge/ {
-        root   /usr/share/nginx/html;
-        index  index.html index.htm;
-    }
-
-    if ($request_method !~ ^(GET|HEAD|POST)$ )
-    {
-       return 405;
-    }
-}
-
-server {
-
-    listen  443 ssl default_server;
-    listen  [::]:443 ssl default_server;
-
-    server_name _;
-
-    http2 on;
-
-    ssl_certificate /etc/nginx/certs/mpp/fullchain.pem;
-    ssl_certificate_key /etc/nginx/certs/mpp/privkey.pem;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES256-CCM8:DHE-RSA-AES256-CCM:ECDHE-ARIA256-GCM-SHA384:DHE-RSA-ARIA256-GCM-SHA384:ECDHE-ARIA128-GCM-SHA256:DHE-RSA-ARIA128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-CCM8:DHE-RSA-AES128-CCM';
-    ssl_prefer_server_ciphers on;
-    ssl_session_cache shared:SSL:20m;
-    ssl_session_timeout 180m;
-
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    ssl_trusted_certificate /etc/nginx/certs/mpp/chain.pem;
-
-    expires off;
-    etag off;
-    if_modified_since off;
-
-    gzip on;
-    gzip_min_length 1000;
-    gzip_proxied any;
-    gzip_types *;
-    gunzip on;
-
-    client_max_body_size 256M;
-
-    location / {
-        proxy_pass http://127.0.0.1:5000/;
-        proxy_set_header Host $http_host;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-    }
-
-    location /api/ {
-        proxy_pass http://127.0.0.1:3000/api/;
-        proxy_set_header Host $http_host;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-    }
-
-    location /uploads/ {
-        proxy_pass http://127.0.0.1:3000/uploads/;
-        proxy_set_header Host $http_host;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-    }
-
-    location /docs/ {
-        proxy_pass http://127.0.0.1:3000/docs/;
-        proxy_set_header Host $http_host;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-    }
-
-    if ($request_method !~ ^(GET|HEAD|POST|PUT|DELETE)$ )
-    {
-       return 405;
-    }
-}

files/nginx/config.conf

@@ -1,31 +0,0 @@
-user  nginx;
-worker_processes  1;
-
-error_log  /var/log/nginx/error.log error;
-pid        /var/run/nginx.pid;
-
-events {
-    worker_connections  1024;
-}
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    log_format  main  '[$time_local] $host - $remote_addr - $remote_user "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log  /var/log/nginx/access.log  main;
-
-    server_tokens off;
-
-    sendfile        off;
-    #tcp_nopush     on;
-
-    keepalive_timeout  65;
-
-    resolver 1.1.1.1;
-
-    include /etc/nginx/conf.d/*.conf;
-}

install.sh

@@ -7,7 +7,7 @@ fi
 echo "
 ==============================
 
-MPP - Infra
+MatteZ02 - Infra
 Install Script
 
 ------------------------------
@@ -41,9 +41,7 @@ then
     echo "$PASSWORD" > ~/.ansible/vault.yml
 fi
 
-ssh-keyscan github.com 1> ~/.ssh/known_hosts 2> /dev/null
-
-/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mpp-infra --accept-host-key --private-key ~/.ssh/id_rsa --vault-password-file ~/.ansible/vault.yml tasks.yml -t installer
+/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/infra --accept-host-key --private-key ~/.ssh/id_rsa --vault-password-file ~/.ansible/vault.yml tasks.yml -t installer
 
 echo "
 ==============================

inventories/mpp/host_vars/divari.northeurope.cloudapp.azure.com

@@ -1,14 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-36633733326433396538646338333139653337336137336662666538363861353933386536313164
-3532643739643661356161653064346436623531656134610a363565386431393536626238356331
-31326564633533613763366431353661663238313562333763623638653832663236633266373437
-3061373230313636610a333834303633626663353237396237376465303631396363396535393932
-61636661373930323931643062343538623231643835636662316138646161626436323937366333
-35653031363730613166353033343038616534343464393761363033356133306164646666306536
-31643061333537393333623633366463303335646336656635343434396233333032383037613934
-31653262396436336537666563376463663430356564623034316634333139656333373863623433
-63663563383139663561356539393939366333363033666636653763373339336239356334633432
-37643264386531653265643637373363633038663532333531613963633039653134633465316239
-34626366373465646535643139363539633138653133623164616431353730313461616638373166
-34626363643334643663633561336566393437356338343339313661623136323839313066356164
-65353038626338663736356330333464363366373731646636633064373031616663

inventories/mpp/hosts

@@ -1,7 +0,0 @@
----
-all:
-  hosts:
-    divari.northeurope.cloudapp.azure.com:
-      vars:
-        ansible_connection: local
-        ansible_python_interpreter: "{{ansible_playbook_python}}"

protect.sh

@@ -5,17 +5,17 @@ nounderline=`tput rmul`
 bold=$(tput bold)
 normal=$(tput sgr0)
 
-echo "${bold}MPP / Infra / Protect${normal}"
+echo "${bold}MatteZ02 / Infra / Protect${normal}"
 action=$1
 
 encrypt() {
     echo "${underline}Encrypting...${nounderline}"
-    execute "ansible-vault encrypt --vault-id default@vault/mpp"
+    execute "ansible-vault encrypt --vault-id default@vault/mkj"
 }
 
 decrypt() {
     echo "${underline}Decrypting...${nounderline}"
-    execute "ansible-vault decrypt --vault-id default@vault/mpp"
+    execute "ansible-vault decrypt --vault-id default@vault/mkj"
 }
 
 list() {

tasks/deployer.yml

@@ -1,240 +0,0 @@
----
-- name: "Deployer - Certbot - Renew Certificates"
-  command: "certbot renew"
-  register: task
-  changed_when: task.stdout.find("No renewals were attempted.") == -1
-  tags:
-    - certbot
-    - tls
-
-- name: "Deployer - Certbot - Copy Certificates"
-  copy:
-    src: "/etc/letsencrypt/live/mpp/"
-    dest: "/root/certs/mpp/"
-    follow: true
-  register: task
-  tags:
-    - certbot
-    - tls
-
-- name: "Deployer - MariaDB - Create Folder"
-  file:
-    path: "/root/mariadb"
-    state: directory
-  tags:
-    - mariadb
-
-- name: "Deployer - MariaDB - Pull Image"
-  containers.podman.podman_image:
-    name: docker.io/mariadb
-    tag: latest
-    force: on
-  register: deployerTask101
-
-- name: "Deployer - MariaDB - Run Container"
-  containers.podman.podman_container:
-    name: mariadb
-    image: docker.io/mariadb:latest
-    state: started
-    restart: on
-    network: host
-    volumes:
-      - "/root/mariadb:/var/lib/mysql"
-    restart_policy: always
-    env:
-      MYSQL_ROOT_PASSWORD: "{{ secrets.mariadb.users.root.password }}"
-  register: deployerTask102
-  when:
-    - (deployerTask101 is defined and deployerTask101.changed) or deployerTask101 is undefined
-  tags:
-    - mariadb
-
-- name: "Deployer - MariaDB - Wait"
-  wait_for:
-    host: "127.0.0.1"
-    port: "3306"
-    delay: 10
-  when:
-    - (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
-  tags:
-    - mariadb
-
-- name: "Deployer - MariaDB - Upgrade"
-  containers.podman.podman_container_exec:
-    name: mariadb
-    command: "mariadb-upgrade --host=127.0.0.1 --user=root --password={{ secrets.mariadb.users.root.password }}"
-  register: task
-  ignore_errors: yes
-  changed_when:
-    - task.stdout is defined
-    - task.stdout.find("This installation of MariaDB is already upgraded") == -1
-  when:
-    - (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
-  tags:
-    - mariadb
-
-- name: "Deployer - MariaDB - Create Users"
-  mysql_user:
-    login_host: "127.0.0.1"
-    login_user: root
-    login_password: "{{ secrets.mariadb.users.root.password }}"
-    name: "mpp"
-    host: "%"
-    password: "{{ secrets.mariadb.users.mpp.password }}"
-    priv: "mpp.*:ALL"
-  vars:
-    ansible_python_interpreter: "/opt/ansible/bin/python3"
-  when:
-    - (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
-  tags:
-    - mariadb
-
-- name: "Deployer - MariaDB - Create Database"
-  mysql_db:
-    login_host: "127.0.0.1"
-    login_user: "mpp"
-    login_password: "{{ secrets.mariadb.users.mpp.password }}"
-    name: "mpp"
-  vars:
-    ansible_python_interpreter: "/opt/ansible/bin/python3"
-  when:
-    - (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
-  tags:
-    - mariadb
-
-- name: "Deployer - Nginx - Configure - Create Folder"
-  file:
-    path: "/root/nginx/"
-    state: directory
-  tags:
-    - nginx
-
-- name: "Deployer - Nginx - Configure - Create Subfolders"
-  file:
-    dest: '/root/nginx/{{ item.path }}'
-    state: directory
-  with_filetree: './files/nginx/'
-  loop_control:
-    label: "{{ item.path }}"
-  when:
-    - item.state == 'directory'
-  tags:
-    - nginx
-
-- name: "Deployer - Nginx - Configure - Generating & Transferring Files"
-  template:
-    src: '{{ item.src }}'
-    dest: '/root/nginx/{{ item.path }}'
-  with_filetree: './files/nginx/'
-  loop_control:
-    label: "{{ item.path }}"
-  when:
-    - item.state == 'file'
-  tags:
-    - nginx
-
-- name: "Deployer - Nginx - Pull Image"
-  containers.podman.podman_image:
-    name: docker.io/nginx
-    tag: latest
-    force: on
-  register: deployerTask3
-
-- name: "Deployer - Nginx - Run Container"
-  containers.podman.podman_container:
-    name: nginx
-    image: docker.io/nginx
-    state: started
-    recreate: on
-    network: host
-    volumes:
-      - "/root/nginx/html:/usr/share/nginx/html:ro"
-      - "/root/nginx/config.conf:/etc/nginx/nginx.conf:ro"
-      - "/root/nginx/conf/:/etc/nginx/conf.d/:ro"
-      - "/root/certs/:/etc/nginx/certs/:ro"
-    restart_policy: always
-  when:
-    - (deployerTask3 is defined and deployerTask3.changed) or deployerTask3 is undefined
-  tags:
-    - nginx
-
-- name: "Deployer - Frontend - Git Operations"
-  git:
-    repo: https://github.com/MetroHege/MPP-Frontend.git
-    dest: /root/frontend
-    version: main
-  register: deployerTask531
-
-- name: "Deployer - Frontend - Build Image"
-  containers.podman.podman_image:
-    name: mpp/frontend
-    tag: latest
-    path: /root/frontend
-    build:
-      file: Dockerfile
-      format: docker
-      cache: off
-    force: on
-  register: deployerTask532
-  when:
-    - (deployerTask531 is defined and deployerTask531.changed) or deployerTask531 is undefined
-  tags:
-    - frontend
-
-- name: "Deployer - Frontend - Run Container"
-  containers.podman.podman_container:
-    name: frontend
-    image: mpp/frontend:latest
-    state: started
-    recreate: on
-    network: host
-    volumes:
-      - "/root/frontend/.env:/usr/src/app/.env"
-    restart_policy: always
-    command: "npm start"
-  when:
-    - deployerTask532 is defined
-    - deployerTask532.changed
-  tags:
-    - frontend
-
-- name: "Deployer - Backend - Git Operations"
-  git:
-    repo: https://github.com/MetroHege/MPP-Backend.git
-    dest: /root/backend
-    version: main
-  register: deployerTask521
-
-- name: "Deployer - Backend - Build Image"
-  containers.podman.podman_image:
-    name: mpp/backend
-    tag: latest
-    path: /root/backend
-    build:
-      file: Dockerfile
-      format: docker
-      cache: off
-    force: on
-  register: deployerTask522
-  when:
-    - (deployerTask521 is defined and deployerTask521.changed) or deployerTask521 is undefined
-  tags:
-    - backend
-
-- name: "Deployer - Backend - Run Container"
-  containers.podman.podman_container:
-    name: backend
-    image: mpp/backend:latest
-    state: started
-    recreate: on
-    network: host
-    volumes:
-      - "/root/backend/uploads:/usr/src/app/uploads"
-      - "/root/backend/.env:/usr/src/app/.env:ro"
-    restart_policy: always
-    command: "npm start"
-  when:
-    - deployerTask522 is defined
-    - deployerTask522.changed
-  tags:
-    - backend

tasks/installer.yml

@@ -1,233 +0,0 @@
----
-- name: "Installer - Ansible - Python Library"
-  pip:
-    name: ansible
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
-  tags:
-    - ansible
-
-- name: "Installer - Ansible - Create Symbolic Links"
-  ansible.builtin.file:
-    src: /opt/ansible/bin/{{ binary }}
-    dest: /usr/bin/{{ binary }}
-    state: link
-  vars:
-    binaries:
-      - ansible
-      - ansible-community
-      - ansible-config
-      - ansible-connection
-      - ansible-console
-      - ansible-doc
-      - ansible-galaxy
-      - ansible-inventory
-      - ansible-playbook
-      - ansible-pull
-      - ansible-test
-      - ansible-vault
-  loop: "{{ binaries }}"
-  loop_control:
-    label: "{{ binary }}"
-    loop_var: "binary"
-  tags:
-    - ansible
-
-- name: "Installer - Ansible - Dependencies / Python Library : hvac"
-  pip:
-    name: hvac
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
-  tags:
-    - ansible
-
-- name: "Installer - Ansible - Dependencies / Python Library : netaddr"
-  pip:
-    name: netaddr
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
-  tags:
-    - ansible
-
-- name: "Installer - Ansible - Dependencies / Python Library : jmespath"
-  pip:
-    name: jmespath
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
-  tags:
-    - ansible
-
-- name: "Installer - Ansible - Dependencies / Python Library : pexpect"
-  pip:
-   name: pexpect
-   state: latest
-   extra_args: --upgrade
-   virtualenv: /opt/ansible
-   virtualenv_command: "python3 -m venv"
-  tags:
-    - ansible
-
-- name: "Installer - Podman"
-  apt:
-     name: podman
-     state: latest
-  tags:
-    - podman
-
-- name: "Installer : Podman : Configure - Subordinate Ids : Users : root"
-  lineinfile:
-    path: /etc/subuid
-    regexp: "^root"
-    line: "root:100000:65536"
-
-- name: "Installer : Podman : Configure - Subordinate Ids : Groups : root"
-  lineinfile:
-    path: /etc/subgid
-    regexp: "^root"
-    line: "root:100000:65536"
-
-- name: "Installer - Certbot - Create Folder"
-  file:
-    path: "{{ path }}"
-    state: directory
-  vars:
-    paths:
-      - /root/certs/mpp
-      - /etc/letsencrypt/renewal-hooks/pre
-  loop: "{{ paths }}"
-  loop_control:
-    label: "{{ path }}"
-    loop_var: "path"
-  tags:
-    - certbot
-
-- name: "Installer - Certbot - Python Library"
-  pip:
-    name: certbot
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
-  tags:
-    - certbot
-
-- name: "Installer - Certbot - Create Symbolic Links"
-  ansible.builtin.file:
-    src: /opt/ansible/bin/{{ binary }}
-    dest: /usr/bin/{{ binary }}
-    state: link
-  vars:
-    binaries:
-      - certbot
-  loop: "{{ binaries }}"
-  loop_control:
-    label: "{{ binary }}"
-    loop_var: "binary"
-  tags:
-    - certbot
-
-- name: "Installer - Certbot - Self-Signed Certificates - Generate Private Key"
-  community.crypto.openssl_privatekey:
-    path: "/root/certs/mpp/privkey.pem"
-    type: RSA
-    size: 2048
-    regenerate: never
-  tags:
-    - certbot
-
-- name: "Installer - Certbot - Self-Signed Certificates - Create Certificate Signing Request"
-  community.crypto.openssl_csr:
-    common_name: "{{ ansible_facts.fqdn }}"
-    privatekey_path: "/root/certs/mpp/privkey.pem"
-    path: "/root/certs/mpp/csr.pem"
-  tags:
-    - certbot
-
-- name: "Installer - Certbot - Self-Signed Certificates - Generate Certificate"
-  community.crypto.x509_certificate:
-    path: "/root/certs/mpp/fullchain.pem"
-    privatekey_path: "/root/certs/mpp/privkey.pem"
-    csr_path: "/root/certs/mpp/csr.pem"
-    provider: selfsigned
-  tags:
-    - certbot
-
-- name: "Installer - Certbot - Self-Signed Certificates - Copy Certificate"
-  copy:
-    src: "/root/certs/mpp/fullchain.pem"
-    dest: "/root/certs/mpp/chain.pem"
-    force: true
-  tags:
-    - certbot
-
-- name: "Installer - Certbot - Auth Hook"
-  copy:
-    src: "../files/certbot/nginx.sh"
-    dest: "/etc/letsencrypt/renewal-hooks/pre/nginx.sh"
-    mode: '700'
-    force: true
-  tags:
-    - certbot
-
-- name: "Installer - Certbot - Create Certificates"
-  command: "certbot certonly --cert-name {{ cert.name }} --manual --preferred-challenges http-01 --email {{ cert.email }} --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -n --manual-auth-hook /etc/letsencrypt/renewal-hooks/pre/nginx.sh --debug-challenges --preferred-chain='ISRG Root X1' --key-type rsa -d {{ cert.domains | join(' -d ') }}"
-  register: task
-  changed_when: task.stdout.find("Certificate not yet due for renewal; no action taken.") == -1
-  vars:
-    cert:
-      name: mpp
-      email: "{{ secrets.certbot.email }}"
-      domains:
-        - "{{ ansible_facts.fqdn }}"
-  tags:
-    - certbot
-
-- name: "Installer - MariaDB - Dependencies / Python Library : pymysql"
-  pip:
-    name: pymysql
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
-  tags:
-    - mariadb
-
-- name: "Installer - MariaDB - Dependencies / Package : mariadb-client"
-  apt:
-     name: "mariadb-client"
-     state: latest
-  when:
-    - ansible_facts.distribution == "Debian" or ansible_facts.distribution == "Ubuntu" or ansible_facts.distribution == "Linux Mint"
-  tags:
-    - mariadb
-
-- name: "Installer - Schedule - Setup"
-  cron:
-    name: PATH
-    env: yes
-    value: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-
-- name: "Installer - Schedule - Maintenance"
-  cron:
-    name: Maintenance
-    hour: "*/3"
-    minute: "0"
-    job: "/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mpp-infra --accept-host-key --private-key ~/.ssh/id_rsa --vault-password-file ~/.ansible/vault.yml tasks.yml -t maintenance"
-  tags:
-    - cron
-
-- name: "Installer - Schedule - Deployer"
-  cron:
-    name: Deployer
-    minute: "*/5"
-    job: "/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mpp-infra --accept-host-key --private-key ~/.ssh/id_rsa --vault-password-file ~/.ansible/vault.yml tasks.yml -t deployer"
-  tags:
-    - cron

tasks/maintenance.yml

@@ -1,37 +0,0 @@
----
-- name: "Maintenance - OS Update"
-  apt:
-    upgrade: dist
-    update_cache: yes
-
-- name: "Maintenance - Ansible : Dependencies - Python Library : hvac"
-  pip:
-    name: hvac
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
-
-- name: "Maintenance - Ansible : Dependencies - Python Library : netaddr"
-  pip:
-    name: netaddr
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
-
-- name: "Maintenance - Ansible : Dependencies - Python Library : jmespath"
-  pip:
-    name: jmespath
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
-
-- name: "Maintenance - Ansible : Dependencies - Python Library : pexpect"
-  pip:
-    name: pexpect
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"