255 lines
8.0 KiB
YAML
255 lines
8.0 KiB
YAML
---
|
|
- name: Set binary app derived values
|
|
ansible.builtin.set_fact:
|
|
binary_app_install_root: "{{ binary_app.install_root | default('/opt/' ~ binary_app.name) }}"
|
|
binary_app_release_dir: "{{ binary_app.install_root | default('/opt/' ~ binary_app.name) }}/releases/{{ binary_app.version }}"
|
|
binary_app_current_path: "{{ binary_app.install_root | default('/opt/' ~ binary_app.name) }}/current"
|
|
binary_app_checksum_asset_name: "{{ binary_app.checksum_asset_name | default(binary_app.asset_name ~ '.sha256') }}"
|
|
binary_app_binary_path: "{{ binary_app.binary_path | default(binary_app.binary_name) }}"
|
|
|
|
- name: Ensure binary app group exists
|
|
ansible.builtin.group:
|
|
name: "{{ binary_app.deploy_group }}"
|
|
state: present
|
|
|
|
- name: Ensure binary app user exists
|
|
ansible.builtin.user:
|
|
name: "{{ binary_app.deploy_user }}"
|
|
group: "{{ binary_app.deploy_group }}"
|
|
system: true
|
|
shell: /usr/sbin/nologin
|
|
create_home: true
|
|
|
|
- name: Ensure binary app directories exist
|
|
ansible.builtin.file:
|
|
path: "{{ item.path }}"
|
|
state: directory
|
|
owner: "{{ item.owner }}"
|
|
group: "{{ item.group }}"
|
|
mode: "{{ item.mode }}"
|
|
loop:
|
|
- path: "{{ binary_app_install_root }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
- path: "{{ binary_app_install_root }}/releases"
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
- path: "{{ binary_app_release_dir }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
- path: "/var/lib/{{ binary_app.name }}"
|
|
owner: "{{ binary_app.deploy_user }}"
|
|
group: "{{ binary_app.deploy_group }}"
|
|
mode: "0755"
|
|
- path: "/etc/{{ binary_app.name }}"
|
|
owner: root
|
|
group: "{{ binary_app.deploy_group }}"
|
|
mode: "0750"
|
|
loop_control:
|
|
label: "{{ item.path }}"
|
|
|
|
- name: Ensure binary app extra directories exist
|
|
ansible.builtin.file:
|
|
path: "{{ item.path }}"
|
|
state: directory
|
|
owner: "{{ item.owner | default(binary_app.deploy_user) }}"
|
|
group: "{{ item.group | default(binary_app.deploy_group) }}"
|
|
mode: "{{ item.mode | default('0755') }}"
|
|
loop: "{{ binary_app.extra_directories | default([]) }}"
|
|
loop_control:
|
|
label: "{{ item.path }}"
|
|
|
|
- name: Remove legacy Bun deploy key
|
|
ansible.builtin.file:
|
|
path: "/etc/{{ binary_app.name }}/deploy_key"
|
|
state: absent
|
|
when: binary_app.remove_legacy_deploy_key | default(false) | bool
|
|
|
|
- name: Look up binary app GitHub release
|
|
ansible.builtin.uri:
|
|
url: "https://api.github.com/repos/{{ binary_app.github_repo }}/releases/tags/{{ binary_app.version }}"
|
|
headers: >-
|
|
{{
|
|
{
|
|
'Accept': 'application/vnd.github+json',
|
|
'X-GitHub-Api-Version': '2022-11-28'
|
|
}
|
|
| combine(
|
|
{'Authorization': 'Bearer ' ~ binary_app.github_token}
|
|
if (binary_app.github_token | default('') | length > 0)
|
|
else {}
|
|
)
|
|
}}
|
|
return_content: true
|
|
status_code: 200
|
|
register: binary_app_github_release
|
|
no_log: "{{ binary_app.github_token | default('') | length > 0 }}"
|
|
|
|
- name: Find binary app GitHub release assets
|
|
ansible.builtin.set_fact:
|
|
binary_app_asset_matches: "{{ binary_app_github_release.json.assets | selectattr('name', 'equalto', binary_app.asset_name) | list }}"
|
|
binary_app_checksum_asset_matches: "{{ binary_app_github_release.json.assets | selectattr('name', 'equalto', binary_app_checksum_asset_name) | list }}"
|
|
|
|
- name: Validate binary app GitHub release assets
|
|
ansible.builtin.assert:
|
|
that:
|
|
- binary_app_asset_matches | length == 1
|
|
- binary_app_checksum_asset_matches | length == 1
|
|
fail_msg: "Release {{ binary_app.version }} for {{ binary_app.github_repo }} must contain {{ binary_app.asset_name }} and {{ binary_app_checksum_asset_name }}."
|
|
|
|
- name: Set binary app GitHub release asset API URLs
|
|
ansible.builtin.set_fact:
|
|
binary_app_asset_api_url: "{{ binary_app_asset_matches[0].url }}"
|
|
binary_app_checksum_asset_api_url: "{{ binary_app_checksum_asset_matches[0].url }}"
|
|
|
|
- name: Download binary app checksum
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
[
|
|
'curl',
|
|
'--fail',
|
|
'--location',
|
|
'--silent',
|
|
'--show-error',
|
|
'--header',
|
|
'Accept: application/octet-stream',
|
|
'--header',
|
|
'X-GitHub-Api-Version: 2022-11-28'
|
|
]
|
|
+ (
|
|
['--header', 'Authorization: Bearer ' ~ binary_app.github_token]
|
|
if (binary_app.github_token | default('') | length > 0)
|
|
else []
|
|
)
|
|
+ [
|
|
'--output',
|
|
binary_app_release_dir ~ '/' ~ binary_app_checksum_asset_name,
|
|
binary_app_checksum_asset_api_url
|
|
]
|
|
}}
|
|
creates: "{{ binary_app_release_dir }}/{{ binary_app_checksum_asset_name }}"
|
|
no_log: "{{ binary_app.github_token | default('') | length > 0 }}"
|
|
|
|
- name: Ensure binary app checksum file permissions
|
|
ansible.builtin.file:
|
|
path: "{{ binary_app_release_dir }}/{{ binary_app_checksum_asset_name }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Download binary app release archive
|
|
ansible.builtin.command:
|
|
argv: >-
|
|
{{
|
|
[
|
|
'curl',
|
|
'--fail',
|
|
'--location',
|
|
'--silent',
|
|
'--show-error',
|
|
'--header',
|
|
'Accept: application/octet-stream',
|
|
'--header',
|
|
'X-GitHub-Api-Version: 2022-11-28'
|
|
]
|
|
+ (
|
|
['--header', 'Authorization: Bearer ' ~ binary_app.github_token]
|
|
if (binary_app.github_token | default('') | length > 0)
|
|
else []
|
|
)
|
|
+ [
|
|
'--output',
|
|
binary_app_release_dir ~ '/' ~ binary_app.asset_name,
|
|
binary_app_asset_api_url
|
|
]
|
|
}}
|
|
creates: "{{ binary_app_release_dir }}/{{ binary_app.asset_name }}"
|
|
register: binary_app_archive
|
|
no_log: "{{ binary_app.github_token | default('') | length > 0 }}"
|
|
|
|
- name: Ensure binary app release archive permissions
|
|
ansible.builtin.file:
|
|
path: "{{ binary_app_release_dir }}/{{ binary_app.asset_name }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Verify binary app release archive checksum
|
|
ansible.builtin.command:
|
|
argv:
|
|
- sha256sum
|
|
- -c
|
|
- "{{ binary_app_checksum_asset_name }}"
|
|
chdir: "{{ binary_app_release_dir }}"
|
|
changed_when: false
|
|
|
|
- name: Unpack binary app release archive
|
|
ansible.builtin.unarchive:
|
|
src: "{{ binary_app_release_dir }}/{{ binary_app.asset_name }}"
|
|
dest: "{{ binary_app_release_dir }}"
|
|
remote_src: true
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
creates: "{{ binary_app_release_dir }}/{{ binary_app_binary_path }}"
|
|
register: binary_app_unpack
|
|
|
|
- name: Ensure binary app executable permissions
|
|
ansible.builtin.file:
|
|
path: "{{ binary_app_release_dir }}/{{ binary_app_binary_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Point binary app current symlink at selected release
|
|
ansible.builtin.file:
|
|
src: "{{ binary_app_release_dir }}"
|
|
dest: "{{ binary_app_current_path }}"
|
|
state: link
|
|
force: true
|
|
register: binary_app_current
|
|
|
|
- name: Render binary app environment file
|
|
ansible.builtin.template:
|
|
src: binary-app.env.j2
|
|
dest: "/etc/{{ binary_app.name }}/app.env"
|
|
owner: root
|
|
group: "{{ binary_app.deploy_group }}"
|
|
mode: "0640"
|
|
register: binary_app_env
|
|
|
|
- name: Install binary app systemd unit
|
|
ansible.builtin.template:
|
|
src: binary-app.service.j2
|
|
dest: "/etc/systemd/system/{{ binary_app.service_name }}.service"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
register: binary_app_unit
|
|
|
|
- name: Reload systemd for binary app changes
|
|
ansible.builtin.systemd_service:
|
|
daemon_reload: true
|
|
when: binary_app_unit.changed
|
|
|
|
- name: Ensure binary app service is enabled and running
|
|
ansible.builtin.service:
|
|
name: "{{ binary_app.service_name }}"
|
|
state: >-
|
|
{{
|
|
'restarted'
|
|
if (
|
|
binary_app_archive.changed
|
|
or binary_app_unpack.changed
|
|
or binary_app_current.changed
|
|
or binary_app_env.changed
|
|
or binary_app_unit.changed
|
|
)
|
|
else 'started'
|
|
}}
|
|
enabled: true
|