av
1cf660b4fd
- vars/vars.yml → group_vars/all/main.yml, vars/secrets.yml → group_vars/all/secrets.yml; boilerplate vars_files убран из всех плейбуков - имя secrets.yml сохранено намеренно: pre-commit-хук и .crushignore ищут слово secret(s) в имени файла - host_vars инвентаря теперь имеют приоритет над общими переменными
76 lines
2.5 KiB
YAML
76 lines
2.5 KiB
YAML
---
|
||
- name: "Configure bifrost application"
|
||
hosts: all
|
||
|
||
vars:
|
||
app_name: "bifrost"
|
||
app_user: "{{ app_name }}"
|
||
app_owner_uid: 1107
|
||
app_owner_gid: 1107
|
||
|
||
base_dir: "{{ (application_dir, app_name) | path_join }}"
|
||
config_dir: "{{ (base_dir, 'config') | path_join }}"
|
||
data_dir: "{{ (base_dir, 'data') | path_join }}"
|
||
config_file: "{{ (config_dir, 'config.json') | path_join }}"
|
||
|
||
tasks:
|
||
- name: "Create user and environment"
|
||
ansible.builtin.import_role:
|
||
name: owner
|
||
vars:
|
||
owner_name: "{{ app_user }}"
|
||
owner_uid: "{{ app_owner_uid }}"
|
||
owner_gid: "{{ app_owner_gid }}"
|
||
owner_extra_groups: ["docker"]
|
||
|
||
- name: "Create application internal directories"
|
||
ansible.builtin.file:
|
||
path: "{{ item }}"
|
||
state: "directory"
|
||
owner: "{{ app_user }}"
|
||
group: "{{ app_user }}"
|
||
mode: "0750"
|
||
loop:
|
||
- "{{ base_dir }}"
|
||
- "{{ config_dir }}"
|
||
- "{{ data_dir }}"
|
||
|
||
- name: "Copy bifrost config (source of truth, secret)"
|
||
ansible.builtin.template:
|
||
src: "./files/{{ app_name }}/config.template.json"
|
||
dest: "{{ config_file }}"
|
||
owner: "{{ app_user }}"
|
||
group: "{{ app_user }}"
|
||
mode: "0600"
|
||
register: config_file_result
|
||
|
||
- name: "Copy docker compose file"
|
||
ansible.builtin.template:
|
||
src: "./files/{{ app_name }}/docker-compose.template.yml"
|
||
dest: "{{ base_dir }}/docker-compose.yml"
|
||
owner: "{{ app_user }}"
|
||
group: "{{ app_user }}"
|
||
mode: "0640"
|
||
register: docker_compose_file_result
|
||
|
||
- name: "Run application with docker compose"
|
||
community.docker.docker_compose_v2:
|
||
project_src: "{{ base_dir }}"
|
||
state: "present"
|
||
remove_orphans: true
|
||
tags:
|
||
- run-app
|
||
|
||
# Bifrost читает config.json только при старте. Если изменился лишь конфиг
|
||
# (а compose — нет), `state: present` не пересоздаёт контейнер, и правки
|
||
# (ротация ключа, смена модели/правил) не подхватятся — нужен явный рестарт.
|
||
- name: "Restart docker compose services if config changed but not docker-compose.yml"
|
||
community.docker.docker_compose_v2:
|
||
project_src: "{{ base_dir }}"
|
||
state: "restarted"
|
||
when:
|
||
- config_file_result.changed
|
||
- not docker_compose_file_result.changed
|
||
tags:
|
||
- run-app
|