binary deployment of twirre.me rust rewrite
This commit is contained in:
Twirre Meulenbelt
254
roles/binary_app/tasks/app.yml
Normal file
254
roles/binary_app/tasks/app.yml
Normal file
@@ -0,0 +1,254 @@
|
||||
---
|
||||
- name: Set binary app derived values
|
||||
ansible.builtin.set_fact:
|
||||
binary_app_install_root: "{{ binary_app.install_root | default('/opt/' ~ binary_app.name) }}"
|
||||
binary_app_release_dir: "{{ binary_app.install_root | default('/opt/' ~ binary_app.name) }}/releases/{{ binary_app.version }}"
|
||||
binary_app_current_path: "{{ binary_app.install_root | default('/opt/' ~ binary_app.name) }}/current"
|
||||
binary_app_checksum_asset_name: "{{ binary_app.checksum_asset_name | default(binary_app.asset_name ~ '.sha256') }}"
|
||||
binary_app_binary_path: "{{ binary_app.binary_path | default(binary_app.binary_name) }}"
|
||||
|
||||
- name: Ensure binary app group exists
|
||||
ansible.builtin.group:
|
||||
name: "{{ binary_app.deploy_group }}"
|
||||
state: present
|
||||
|
||||
- name: Ensure binary app user exists
|
||||
ansible.builtin.user:
|
||||
name: "{{ binary_app.deploy_user }}"
|
||||
group: "{{ binary_app.deploy_group }}"
|
||||
system: true
|
||||
shell: /usr/sbin/nologin
|
||||
create_home: true
|
||||
|
||||
- name: Ensure binary app directories exist
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path }}"
|
||||
state: directory
|
||||
owner: "{{ item.owner }}"
|
||||
group: "{{ item.group }}"
|
||||
mode: "{{ item.mode }}"
|
||||
loop:
|
||||
- path: "{{ binary_app_install_root }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
- path: "{{ binary_app_install_root }}/releases"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
- path: "{{ binary_app_release_dir }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
- path: "/var/lib/{{ binary_app.name }}"
|
||||
owner: "{{ binary_app.deploy_user }}"
|
||||
group: "{{ binary_app.deploy_group }}"
|
||||
mode: "0755"
|
||||
- path: "/etc/{{ binary_app.name }}"
|
||||
owner: root
|
||||
group: "{{ binary_app.deploy_group }}"
|
||||
mode: "0750"
|
||||
loop_control:
|
||||
label: "{{ item.path }}"
|
||||
|
||||
- name: Ensure binary app extra directories exist
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path }}"
|
||||
state: directory
|
||||
owner: "{{ item.owner | default(binary_app.deploy_user) }}"
|
||||
group: "{{ item.group | default(binary_app.deploy_group) }}"
|
||||
mode: "{{ item.mode | default('0755') }}"
|
||||
loop: "{{ binary_app.extra_directories | default([]) }}"
|
||||
loop_control:
|
||||
label: "{{ item.path }}"
|
||||
|
||||
- name: Remove legacy Bun deploy key
|
||||
ansible.builtin.file:
|
||||
path: "/etc/{{ binary_app.name }}/deploy_key"
|
||||
state: absent
|
||||
when: binary_app.remove_legacy_deploy_key | default(false) | bool
|
||||
|
||||
- name: Look up binary app GitHub release
|
||||
ansible.builtin.uri:
|
||||
url: "https://api.github.com/repos/{{ binary_app.github_repo }}/releases/tags/{{ binary_app.version }}"
|
||||
headers: >-
|
||||
{{
|
||||
{
|
||||
'Accept': 'application/vnd.github+json',
|
||||
'X-GitHub-Api-Version': '2022-11-28'
|
||||
}
|
||||
| combine(
|
||||
{'Authorization': 'Bearer ' ~ binary_app.github_token}
|
||||
if (binary_app.github_token | default('') | length > 0)
|
||||
else {}
|
||||
)
|
||||
}}
|
||||
return_content: true
|
||||
status_code: 200
|
||||
register: binary_app_github_release
|
||||
no_log: "{{ binary_app.github_token | default('') | length > 0 }}"
|
||||
|
||||
- name: Find binary app GitHub release assets
|
||||
ansible.builtin.set_fact:
|
||||
binary_app_asset_matches: "{{ binary_app_github_release.json.assets | selectattr('name', 'equalto', binary_app.asset_name) | list }}"
|
||||
binary_app_checksum_asset_matches: "{{ binary_app_github_release.json.assets | selectattr('name', 'equalto', binary_app_checksum_asset_name) | list }}"
|
||||
|
||||
- name: Validate binary app GitHub release assets
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- binary_app_asset_matches | length == 1
|
||||
- binary_app_checksum_asset_matches | length == 1
|
||||
fail_msg: "Release {{ binary_app.version }} for {{ binary_app.github_repo }} must contain {{ binary_app.asset_name }} and {{ binary_app_checksum_asset_name }}."
|
||||
|
||||
- name: Set binary app GitHub release asset API URLs
|
||||
ansible.builtin.set_fact:
|
||||
binary_app_asset_api_url: "{{ binary_app_asset_matches[0].url }}"
|
||||
binary_app_checksum_asset_api_url: "{{ binary_app_checksum_asset_matches[0].url }}"
|
||||
|
||||
- name: Download binary app checksum
|
||||
ansible.builtin.command:
|
||||
argv: >-
|
||||
{{
|
||||
[
|
||||
'curl',
|
||||
'--fail',
|
||||
'--location',
|
||||
'--silent',
|
||||
'--show-error',
|
||||
'--header',
|
||||
'Accept: application/octet-stream',
|
||||
'--header',
|
||||
'X-GitHub-Api-Version: 2022-11-28'
|
||||
]
|
||||
+ (
|
||||
['--header', 'Authorization: Bearer ' ~ binary_app.github_token]
|
||||
if (binary_app.github_token | default('') | length > 0)
|
||||
else []
|
||||
)
|
||||
+ [
|
||||
'--output',
|
||||
binary_app_release_dir ~ '/' ~ binary_app_checksum_asset_name,
|
||||
binary_app_checksum_asset_api_url
|
||||
]
|
||||
}}
|
||||
creates: "{{ binary_app_release_dir }}/{{ binary_app_checksum_asset_name }}"
|
||||
no_log: "{{ binary_app.github_token | default('') | length > 0 }}"
|
||||
|
||||
- name: Ensure binary app checksum file permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ binary_app_release_dir }}/{{ binary_app_checksum_asset_name }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Download binary app release archive
|
||||
ansible.builtin.command:
|
||||
argv: >-
|
||||
{{
|
||||
[
|
||||
'curl',
|
||||
'--fail',
|
||||
'--location',
|
||||
'--silent',
|
||||
'--show-error',
|
||||
'--header',
|
||||
'Accept: application/octet-stream',
|
||||
'--header',
|
||||
'X-GitHub-Api-Version: 2022-11-28'
|
||||
]
|
||||
+ (
|
||||
['--header', 'Authorization: Bearer ' ~ binary_app.github_token]
|
||||
if (binary_app.github_token | default('') | length > 0)
|
||||
else []
|
||||
)
|
||||
+ [
|
||||
'--output',
|
||||
binary_app_release_dir ~ '/' ~ binary_app.asset_name,
|
||||
binary_app_asset_api_url
|
||||
]
|
||||
}}
|
||||
creates: "{{ binary_app_release_dir }}/{{ binary_app.asset_name }}"
|
||||
register: binary_app_archive
|
||||
no_log: "{{ binary_app.github_token | default('') | length > 0 }}"
|
||||
|
||||
- name: Ensure binary app release archive permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ binary_app_release_dir }}/{{ binary_app.asset_name }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Verify binary app release archive checksum
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- sha256sum
|
||||
- -c
|
||||
- "{{ binary_app_checksum_asset_name }}"
|
||||
chdir: "{{ binary_app_release_dir }}"
|
||||
changed_when: false
|
||||
|
||||
- name: Unpack binary app release archive
|
||||
ansible.builtin.unarchive:
|
||||
src: "{{ binary_app_release_dir }}/{{ binary_app.asset_name }}"
|
||||
dest: "{{ binary_app_release_dir }}"
|
||||
remote_src: true
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
creates: "{{ binary_app_release_dir }}/{{ binary_app_binary_path }}"
|
||||
register: binary_app_unpack
|
||||
|
||||
- name: Ensure binary app executable permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ binary_app_release_dir }}/{{ binary_app_binary_path }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
|
||||
- name: Point binary app current symlink at selected release
|
||||
ansible.builtin.file:
|
||||
src: "{{ binary_app_release_dir }}"
|
||||
dest: "{{ binary_app_current_path }}"
|
||||
state: link
|
||||
force: true
|
||||
register: binary_app_current
|
||||
|
||||
- name: Render binary app environment file
|
||||
ansible.builtin.template:
|
||||
src: binary-app.env.j2
|
||||
dest: "/etc/{{ binary_app.name }}/app.env"
|
||||
owner: root
|
||||
group: "{{ binary_app.deploy_group }}"
|
||||
mode: "0640"
|
||||
register: binary_app_env
|
||||
|
||||
- name: Install binary app systemd unit
|
||||
ansible.builtin.template:
|
||||
src: binary-app.service.j2
|
||||
dest: "/etc/systemd/system/{{ binary_app.service_name }}.service"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
register: binary_app_unit
|
||||
|
||||
- name: Reload systemd for binary app changes
|
||||
ansible.builtin.systemd_service:
|
||||
daemon_reload: true
|
||||
when: binary_app_unit.changed
|
||||
|
||||
- name: Ensure binary app service is enabled and running
|
||||
ansible.builtin.service:
|
||||
name: "{{ binary_app.service_name }}"
|
||||
state: >-
|
||||
{{
|
||||
'restarted'
|
||||
if (
|
||||
binary_app_archive.changed
|
||||
or binary_app_unpack.changed
|
||||
or binary_app_current.changed
|
||||
or binary_app_env.changed
|
||||
or binary_app_unit.changed
|
||||
)
|
||||
else 'started'
|
||||
}}
|
||||
enabled: true
|
||||
Reference in New Issue
Block a user