eletrotupi / tcc/ commit / 86679dd

ansible: first draft

Pedro Lucas Porcellis porcellis@eletrotupi.com · 4 months ago 86679dd1e585488c3744a5531456068a708f0eb1 Browse files
Parents 63f2fd3
Changed files
8
Additions
+158
Deletions
0
ansible/inventory/group_vars/all.yml added+10
/dev/null → ansible/inventory/group_vars/all.yml
1 + 
# The deploy user to create
2 + 
deploy_user: deploy
3 +
4 + 
# The SSH public key that will be authorised for the deploy user
5 + 
deploy_ssh_pubkey_file: ~/.ssh/nexo_deploy_key.pub
6 +
7 + 
# App directories to create under /srv/app
8 + 
app_environments:
9 + 
  - production
10 + 
  - staging
ansible/inventory/hosts.yml added+6
/dev/null → ansible/inventory/hosts.yml
1 + 
all:
2 + 
  hosts:
3 + 
    vps:
4 + 
      ansible_host: 172.237.61.17
5 + 
      ansible_user: eletrotupi
6 + 
      ansible_ssh_private_key_file: ~/.ssh/id_ed25519
ansible/provision.yml added+36
/dev/null → ansible/provision.yml
1 + 
---
2 + 
# ansible/provision.yml
3 + 
# Run once to fully provision the VPS.
4 + 
#
5 + 
# Usage:
6 + 
#   ansible-playbook -i inventory/hosts.yml provision.yml --ask-become-pass
7 + 
#
8 + 
# What it does (in order):
9 + 
#   1. bootstrap  — adds baseline packages
10 + 
#   2. docker     — installs Docker Engine + Compose plugin
11 + 
#   3. appuser    — creates the deploy user, copies the SSH key
12 + 
#   4. directories — creates /srv/app/production
13 + 
#   5. TODO: Add nginx + compose here as well
14 +
15 + 
- name: Provision server
16 + 
  hosts: vps
17 + 
  become: yes
18 + 
  become_method: doas
19 +
20 + 
  roles:
21 + 
    - bootstrap
22 + 
    - docker
23 + 
    - appuser
24 + 
    - directories
25 +
26 + 
  post_tasks:
27 + 
    - name: Confirm deploy user can reach Docker
28 + 
      ansible.builtin.command: docker info
29 + 
      become_user: "{{ deploy_user }}"
30 + 
      changed_when: false
31 + 
      register: docker_check
32 +
33 + 
    - name: Show Docker status
34 + 
      ansible.builtin.debug:
35 + 
        msg: "Docker is reachable by {{ deploy_user }}"
36 + 
      when: docker_check.rc == 0
ansible/requirements.yml added+4
/dev/null → ansible/requirements.yml
1 + 
---
2 + 
collections:
3 + 
  - name: community.general   # apk module, and others
4 + 
  - name: ansible.posix       # authorized_key (and other stuff) modules
ansible/roles/appuser/tasks/main.yml added+24
/dev/null → ansible/roles/appuser/tasks/main.yml
1 + 
---
2 + 
# Creates the deploy user, authorises the deploy key
3 +
4 + 
- name: Create deploy group
5 + 
  ansible.builtin.group:
6 + 
    name: "{{ deploy_user }}"
7 + 
    state: present
8 +
9 + 
- name: Create deploy user
10 + 
  ansible.builtin.user:
11 + 
    name: "{{ deploy_user }}"
12 + 
    group: "{{ deploy_user }}"
13 + 
    groups: docker
14 + 
    append: yes
15 + 
    password: x # XXX: lazy, dumb password, replace with a encrypted vault
16 + 
    shell: /bin/bash
17 + 
    create_home: yes
18 + 
    state: present
19 +
20 + 
- name: Authorise deploy SSH public key
21 + 
  ansible.posix.authorized_key:
22 + 
    user: "{{ deploy_user }}"
23 + 
    state: present
24 + 
    key: "{{ lookup('file', deploy_ssh_pubkey_file) }}"
ansible/roles/bootstrap/tasks/main.yml added+18
/dev/null → ansible/roles/bootstrap/tasks/main.yml
1 + 
---
2 + 
# roles/bootstrap/tasks/main.yml
3 + 
# Minimal server packages for Alpine Linux.
4 +
5 + 
- name: Update apk cache
6 + 
  community.general.apk:
7 + 
    update_cache: yes
8 +
9 + 
- name: Install baseline packages
10 + 
  community.general.apk:
11 + 
    name:
12 + 
      - htop
13 + 
      - vim
14 + 
      - git
15 + 
      - bash
16 + 
      - docker
17 + 
      - uacme
18 + 
    state: present
ansible/roles/directories/tasks/main.yml added+42
/dev/null → ansible/roles/directories/tasks/main.yml
1 + 
---
2 + 
# Creates /srv/app/{production,staging} owned by the deploy user
3 +
4 + 
- name: Ensure /srv/app exists
5 + 
  ansible.builtin.file:
6 + 
    path: /srv/app
7 + 
    state: directory
8 + 
    owner: "{{ deploy_user }}"
9 + 
    group: "{{ deploy_user }}"
10 + 
    mode: "0750"
11 +
12 + 
- name: Create per-environment directories
13 + 
  ansible.builtin.file:
14 + 
    path: "/srv/app/{{ item }}"
15 + 
    state: directory
16 + 
    owner: "{{ deploy_user }}"
17 + 
    group: "{{ deploy_user }}"
18 + 
    mode: "0750"
19 + 
  loop: "{{ app_environments }}"
20 +
21 + 
- name: Add README so the directories aren't mysterious
22 + 
  ansible.builtin.copy:
23 + 
    dest: "/srv/app/{{ item }}/README"
24 + 
    owner: "{{ deploy_user }}"
25 + 
    group: "{{ deploy_user }}"
26 + 
    mode: "0640"
27 + 
    content: |
28 + 
      {{ item }} environment
29 + 
      ----------------------
30 + 
      docker-compose.yml  — compose file for this environment
31 + 
      .env.{{ item }}     — secrets
32 + 
      .env                — required by docker's arg variables
33 + 
      valkey.conf         — valkey config
34 + 
  loop: "{{ app_environments }}"
35 +
36 + 
- name: Ensure /srv/static exists for thesis
37 + 
  ansible.builtin.file:
38 + 
    path: /srv/static
39 + 
    state: directory
40 + 
    owner: "{{ deploy_user }}"
41 + 
    group: nginx
42 + 
    mode: "0750"
ansible/roles/docker/tasks/main.yml added+18
/dev/null → ansible/roles/docker/tasks/main.yml
1 + 
---
2 + 
# Installs Docker Engine + Compose plugin on Alpine Linux.
3 + 
- name: Update apk cache
4 + 
  community.general.apk:
5 + 
    update_cache: yes
6 +
7 + 
- name: Install Docker and Compose plugin
8 + 
  community.general.apk:
9 + 
    name:
10 + 
      - docker
11 + 
      - docker-cli-compose
12 + 
    state: present
13 +
14 + 
- name: Enable Docker service
15 + 
  ansible.builtin.service:
16 + 
    name: docker
17 + 
    enabled: yes
18 + 
    state: started