---

# roles/app/tasks/main.yml

# Places the production app config in /srv/app/<env>/

# The env files are rendered from group_vars (secrets come from the encrypted

# vault.yml), so there is nothing to fill in by hand anymore

- name: Ensure /srv/app exists

  ansible.builtin.file:

    path: /srv/app

    state: directory

    owner: "{{ deploy_user }}"

    group: "{{ deploy_user }}"

    mode: "0750"

  tags: [app]

- name: Ensure the per-environment app directories exist

  ansible.builtin.file:

    path: "/srv/app/{{ item }}"

    state: directory

    owner: "{{ deploy_user }}"

    group: "{{ deploy_user }}"

    mode: "0750"

  loop: "{{ app_environments }}"

  tags: [app]

- name: Install the production compose file

  ansible.builtin.copy:

    src: docker-compose.production.yml

    dest: "/srv/app/{{ app_env }}/docker-compose.yml"

    owner: "{{ deploy_user }}"

    group: "{{ deploy_user }}"

    mode: "0640"

  tags: [app]

# The valkey image drops to its own unprivileged user, so this file has to be

# readable by it. valkey.conf holds no secrets (no password), so 0644 is fine

- name: Install the valkey configuration

  ansible.builtin.copy:

    src: valkey.conf

    dest: "/srv/app/{{ app_env }}/valkey.conf"

    owner: "{{ deploy_user }}"

    group: "{{ deploy_user }}"

    mode: "0644"

  tags: [app]

- name: Install the Vector configuration

  ansible.builtin.copy:

    src: vector.yaml

    dest: "/srv/app/{{ app_env }}/vector.yaml"

    owner: "{{ deploy_user }}"

    group: "{{ deploy_user }}"

    mode: "0640"

  tags: [app]

- name: Install the environment files

  ansible.builtin.template:

    src: "{{ item.src }}"

    dest: "/srv/app/{{ app_env }}/{{ item.dest }}"

    owner: "{{ deploy_user }}"

    group: "{{ deploy_user }}"

    mode: "0600"

  loop:

    - { src: env.j2, dest: .env }

    - { src: env.production.j2, dest: .env.production }

  loop_control:

    label: "{{ item.dest }}"

  tags: [app]