96 lines
4.0 KiB
YAML
96 lines
4.0 KiB
YAML
---
|
|
- name: Set up domain-watchdog
|
|
hosts: domain-watchdog
|
|
become: yes
|
|
tasks:
|
|
- name: default_packages
|
|
ansible.builtin.include_tasks: ../../templates/default_packages.yml
|
|
|
|
- name: create_user
|
|
ansible.builtin.include_tasks: ../../templates/create_user.yml
|
|
vars:
|
|
username: nick
|
|
github_user: Chewbaccalakis
|
|
|
|
- name: Install Docker
|
|
ansible.builtin.include_tasks: ../../templates/install_docker.yml
|
|
|
|
- name: Add nick to docker group
|
|
ansible.builtin.user:
|
|
name: nick
|
|
groups:
|
|
- docker
|
|
append: true
|
|
|
|
- name: Deploy Domain Watchdog
|
|
vars:
|
|
# Keep this path: compose prefixes named volumes (database_data etc.)
|
|
# with the directory name, so moving it orphans the existing data.
|
|
domain_watchdog_dir: /opt/domain-watchdog
|
|
# Branch of AtlasHorizon/compose to deploy from; override with
|
|
# `-e compose_branch=<branch>` to test unmerged changes.
|
|
compose_branch: main
|
|
block:
|
|
- name: Create public/content directory
|
|
ansible.builtin.file:
|
|
path: "{{ domain_watchdog_dir }}/public/content"
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
# force: true so changes in the compose repo are picked up on reruns;
|
|
# it only reports changed when the content differs.
|
|
- name: Download docker-compose.yml
|
|
ansible.builtin.get_url:
|
|
url: "https://git.atlashorizon.net/AtlasHorizon/compose/raw/branch/{{ compose_branch }}/domain-watchdog/docker-compose.yml"
|
|
dest: "{{ domain_watchdog_dir }}/docker-compose.yml"
|
|
mode: "0644"
|
|
force: true
|
|
|
|
# Pulled from Infisical, not generated/persisted to disk. Run this
|
|
# playbook as `infisical run -- ansible-playbook -i inventory ...`
|
|
# with DOMAIN_WATCHDOG_POSTGRES_PASSWORD, DOMAIN_WATCHDOG_APP_SECRET,
|
|
# and DOMAIN_WATCHDOG_JWT_PASSPHRASE secrets set in the workspace.
|
|
- name: Read secrets from environment (populated by `infisical run`)
|
|
ansible.builtin.set_fact:
|
|
domain_watchdog_postgres_password: "{{ lookup('ansible.builtin.env', 'DOMAIN_WATCHDOG_POSTGRES_PASSWORD') }}"
|
|
domain_watchdog_app_secret: "{{ lookup('ansible.builtin.env', 'DOMAIN_WATCHDOG_APP_SECRET') }}"
|
|
domain_watchdog_jwt_passphrase: "{{ lookup('ansible.builtin.env', 'DOMAIN_WATCHDOG_JWT_PASSPHRASE') }}"
|
|
no_log: true
|
|
|
|
- name: Verify required secrets were provided
|
|
ansible.builtin.assert:
|
|
that:
|
|
- domain_watchdog_postgres_password | length > 0
|
|
- domain_watchdog_app_secret | length > 0
|
|
- domain_watchdog_jwt_passphrase | length > 0
|
|
fail_msg: >-
|
|
DOMAIN_WATCHDOG_POSTGRES_PASSWORD, DOMAIN_WATCHDOG_APP_SECRET, and
|
|
DOMAIN_WATCHDOG_JWT_PASSPHRASE must be set. Run this playbook via
|
|
`infisical run -- ansible-playbook -i inventory ...` with those
|
|
secrets defined in the workspace.
|
|
|
|
- name: Deploy .env file (docker compose variable substitution)
|
|
ansible.builtin.template:
|
|
src: templates/domain-watchdog.env.j2
|
|
dest: "{{ domain_watchdog_dir }}/.env"
|
|
mode: "0600"
|
|
|
|
- name: Deploy .env.local file (app secrets)
|
|
ansible.builtin.template:
|
|
src: templates/domain-watchdog.env.local.j2
|
|
dest: "{{ domain_watchdog_dir }}/.env.local"
|
|
mode: "0600"
|
|
|
|
- name: Pull prebuilt Domain Watchdog images
|
|
ansible.builtin.command:
|
|
cmd: docker compose pull
|
|
chdir: "{{ domain_watchdog_dir }}"
|
|
changed_when: false
|
|
|
|
- name: Start Domain Watchdog via docker compose
|
|
ansible.builtin.command:
|
|
cmd: docker compose up -d
|
|
chdir: "{{ domain_watchdog_dir }}"
|
|
register: domain_watchdog_compose_up
|
|
changed_when: "'Started' in domain_watchdog_compose_up.stderr or 'Created' in domain_watchdog_compose_up.stderr"
|