ansible: describe what runs on the servers
The roles had drifted far from production: Forgejo was pinned at 12 while 15.0.11 runs, its config lacked the mailer, packages and the real database path, and several services existed only on the hosts. Running a role would have rolled production back. Take the servers as the truth and make the repository match them. site.yaml now holds the desired state of both hosts: - base: unattended upgrades, fail2ban, Docker daemon config and the weekly image prune, as found on the hosts. New: a 500M journal cap, and the Docker systemd override is kept absent. That override once opened dockerd on tcp/2375 without authentication. - traefik: templates as deployed, version in a variable (v3.7.18). The Coraza WAF files are removed; no router ever used them. - forgejo: 15.0.11, app.ini generated from the live file with the secrets taken from the vault. - crawler_alert, sillytavern, minecraft, minecraft_fossils: added from the hosts. Forgejo's canonical name becomes git.asxp.io; git.czsk.it stays as an alias on the same router. docker_service restarts a stack when its config changes, no longer forces ownership on existing data directories, and hides template diffs because they carry secrets. Containers listed in service_graceful_stop are saved and stopped with a long timeout before compose recreates them: Docker's 10 s default is too short for a Minecraft world. Both game servers get stop_grace_period for the same reason. Removed: the full-deployment and runner playbooks with their prompts, the Forgejo backup and restore roles for the old bare-metal host, and inventory entries for services that were never deployed. SSH hardening stays a manual playbook, since a mistake there locks everyone out. New secrets (SMTP, RCON, CurseForge key) went into the vault. Assisted-by: Claude:fable-5-2
This commit is contained in:
parent
e5322cbac2
commit
27ccdc4255
52 changed files with 1554 additions and 1031 deletions
|
|
@ -1,34 +1,28 @@
|
|||
---
|
||||
# Default variables for docker_service role
|
||||
# These can be overridden when including this role
|
||||
service_name: "" # required, also the compose project name
|
||||
service_base_path: "" # required, e.g. /opt/traefik
|
||||
|
||||
# Service configuration
|
||||
service_name: "" # REQUIRED: Name of the service (e.g., "traefik", "forgejo")
|
||||
service_base_path: "" # REQUIRED: Base installation path (e.g., "/opt/traefik")
|
||||
|
||||
# Directories to create under service_base_path
|
||||
# Format: list of dicts with 'path' and 'mode' keys
|
||||
# Each list item: path/dest plus optional owner, group, mode. Ownership and
|
||||
# mode are only enforced when given, so existing data directories keep theirs.
|
||||
service_directories: []
|
||||
# Example:
|
||||
# - { path: "data", mode: "0755" }
|
||||
# - { path: "config", mode: "0644" }
|
||||
service_templates: [] # src (template), dest
|
||||
service_files: [] # src (plain file, copied verbatim), dest
|
||||
service_absent: [] # paths under the base path that must not exist
|
||||
|
||||
# Template files to deploy
|
||||
# Format: list of dicts with 'src', 'dest', and optional 'mode' keys
|
||||
service_templates: []
|
||||
# Example:
|
||||
# - { src: "docker-compose.yml.j2", dest: "docker-compose.yml", mode: "0644" }
|
||||
# - { src: "config.yaml.j2", dest: "config/config.yaml", mode: "0600" }
|
||||
# Containers to save and stop properly before compose recreates them:
|
||||
# - { container: name, timeout: 120, pre_stop: "docker exec ..." }
|
||||
service_graceful_stop: []
|
||||
|
||||
# Docker compose configuration
|
||||
docker_compose_file: "docker-compose.yml" # Name of the compose file
|
||||
docker_compose_project_name: "{{ service_name }}" # Docker compose project name
|
||||
docker_compose_file: "docker-compose.yml"
|
||||
docker_compose_project_name: "{{ service_name }}"
|
||||
|
||||
# Health check configuration
|
||||
health_check_enabled: true # Whether to perform health check after deployment
|
||||
health_check_url: "" # URL to check (empty = skip HTTP check)
|
||||
health_check_host: "localhost" # Host to check port on (default: localhost)
|
||||
health_check_port: "" # Port to check (empty = skip port check)
|
||||
health_check_delay: 10 # Seconds to wait before health check
|
||||
health_check_retries: 30 # Number of retries for health check
|
||||
health_check_retry_delay: 2 # Seconds between retries
|
||||
# A changed config file restarts the stack unless compose already recreated it
|
||||
service_restart_on_change: true
|
||||
|
||||
health_check_enabled: true
|
||||
health_check_url: ""
|
||||
health_check_host: "localhost"
|
||||
health_check_port: ""
|
||||
health_check_delay: 10
|
||||
health_check_retries: 30
|
||||
health_check_retry_delay: 2
|
||||
|
|
|
|||
|
|
@ -1,46 +1,94 @@
|
|||
---
|
||||
# Shared tasks for deploying Docker-based services
|
||||
# This role provides a standardized pattern for service deployment
|
||||
|
||||
- name: Validate required variables
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- service_name is defined
|
||||
- service_name | length > 0
|
||||
- service_base_path is defined
|
||||
- service_base_path | length > 0
|
||||
fail_msg: "service_name and service_base_path are required variables"
|
||||
success_msg: "Required variables validated for {{ service_name }}"
|
||||
fail_msg: "service_name and service_base_path are required"
|
||||
quiet: true
|
||||
|
||||
- name: Create base service directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ service_base_path }}"
|
||||
state: directory
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Create service subdirectories
|
||||
ansible.builtin.file:
|
||||
path: "{{ service_base_path }}/{{ item.path }}"
|
||||
state: directory
|
||||
mode: "{{ item.mode | default('0755') }}"
|
||||
owner: root
|
||||
group: root
|
||||
owner: "{{ item.owner | default(omit) }}"
|
||||
group: "{{ item.group | default(omit) }}"
|
||||
mode: "{{ item.mode | default(omit) }}"
|
||||
loop: "{{ service_directories }}"
|
||||
when: service_directories | length > 0
|
||||
loop_control:
|
||||
label: "{{ item.path }}"
|
||||
|
||||
- name: Deploy service template files
|
||||
- name: Deploy service templates
|
||||
ansible.builtin.template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ service_base_path }}/{{ item.dest }}"
|
||||
owner: "{{ item.owner | default('root') }}"
|
||||
group: "{{ item.group | default('root') }}"
|
||||
mode: "{{ item.mode | default('0644') }}"
|
||||
owner: root
|
||||
group: root
|
||||
loop: "{{ service_templates }}"
|
||||
when: service_templates | length > 0
|
||||
loop_control:
|
||||
label: "{{ item.dest }}"
|
||||
# Templates may carry secrets; never print their contents
|
||||
diff: false
|
||||
register: template_result
|
||||
|
||||
- name: Deploy service files
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ service_base_path }}/{{ item.dest }}"
|
||||
owner: "{{ item.owner | default('root') }}"
|
||||
group: "{{ item.group | default('root') }}"
|
||||
mode: "{{ item.mode | default('0644') }}"
|
||||
loop: "{{ service_files }}"
|
||||
loop_control:
|
||||
label: "{{ item.dest }}"
|
||||
register: file_result
|
||||
|
||||
- name: Remove files that are no longer part of the service
|
||||
ansible.builtin.file:
|
||||
path: "{{ service_base_path }}/{{ item }}"
|
||||
state: absent
|
||||
loop: "{{ service_absent }}"
|
||||
|
||||
# Game servers need time to save: Docker's default stop timeout is 10 s.
|
||||
# When compose is about to recreate one of the listed containers, save
|
||||
# and stop it properly first; compose then replaces the stopped container.
|
||||
- name: Ask compose what it would do
|
||||
ansible.builtin.command:
|
||||
cmd: docker compose -p {{ docker_compose_project_name }} -f {{ docker_compose_file }} up -d --dry-run
|
||||
chdir: "{{ service_base_path }}"
|
||||
register: compose_plan
|
||||
changed_when: false
|
||||
# The dry run exits non-zero when an image still has to be pulled; the
|
||||
# plan it prints up to that point is all that is needed here
|
||||
failed_when: false
|
||||
check_mode: false
|
||||
when: service_graceful_stop | length > 0
|
||||
|
||||
- name: Run pre-stop command before recreation
|
||||
ansible.builtin.command:
|
||||
cmd: "{{ item.pre_stop }}"
|
||||
loop: "{{ service_graceful_stop }}"
|
||||
loop_control:
|
||||
label: "{{ item.container }}"
|
||||
when:
|
||||
- item.pre_stop is defined
|
||||
- (compose_plan.stdout ~ compose_plan.stderr) is search('Container ' ~ item.container ~ ' Recreate')
|
||||
failed_when: false
|
||||
|
||||
- name: Stop gracefully before recreation
|
||||
ansible.builtin.command:
|
||||
cmd: "docker stop -t {{ item.timeout | default(120) }} {{ item.container }}"
|
||||
loop: "{{ service_graceful_stop }}"
|
||||
loop_control:
|
||||
label: "{{ item.container }}"
|
||||
when: (compose_plan.stdout ~ compose_plan.stderr) is search('Container ' ~ item.container ~ ' Recreate')
|
||||
|
||||
- name: Start service with Docker Compose
|
||||
community.docker.docker_compose_v2:
|
||||
project_src: "{{ service_base_path }}"
|
||||
|
|
@ -49,33 +97,45 @@
|
|||
- "{{ docker_compose_file }}"
|
||||
state: present
|
||||
register: compose_result
|
||||
# In check mode compose cannot pull, so a missing image looks like an error
|
||||
ignore_errors: "{{ ansible_check_mode }}"
|
||||
|
||||
- name: Restart service after a config change
|
||||
community.docker.docker_compose_v2:
|
||||
project_src: "{{ service_base_path }}"
|
||||
project_name: "{{ docker_compose_project_name }}"
|
||||
files:
|
||||
- "{{ docker_compose_file }}"
|
||||
state: restarted
|
||||
when:
|
||||
- service_restart_on_change
|
||||
- template_result is changed or file_result is changed
|
||||
- compose_result is not changed
|
||||
|
||||
- name: Wait before health check
|
||||
ansible.builtin.pause:
|
||||
seconds: "{{ health_check_delay }}"
|
||||
when: health_check_enabled and (health_check_url != "" or health_check_port != "")
|
||||
when:
|
||||
- health_check_enabled
|
||||
- health_check_url != "" or health_check_port != ""
|
||||
- compose_result is changed or template_result is changed or file_result is changed
|
||||
|
||||
- name: Wait for service HTTP endpoint
|
||||
ansible.builtin.uri:
|
||||
url: "{{ health_check_url }}"
|
||||
status_code: [200, 301, 302, 401, 404] # Accept various codes (service-dependent)
|
||||
status_code: [200, 301, 302, 303, 401, 404]
|
||||
follow_redirects: none
|
||||
timeout: 5
|
||||
register: health_result
|
||||
until: health_result is not failed
|
||||
retries: "{{ health_check_retries }}"
|
||||
delay: "{{ health_check_retry_delay }}"
|
||||
when: health_check_enabled and health_check_url != ""
|
||||
failed_when: false
|
||||
check_mode: false
|
||||
|
||||
- name: Wait for service port
|
||||
ansible.builtin.wait_for:
|
||||
host: "{{ health_check_host }}"
|
||||
port: "{{ health_check_port }}"
|
||||
delay: 0
|
||||
timeout: "{{ health_check_retries * health_check_retry_delay }}"
|
||||
state: started
|
||||
when: health_check_enabled and health_check_port != ""
|
||||
|
||||
- name: Display deployment status
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ service_name }} deployment completed successfully"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue