ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
86 lines
2.8 KiB
YAML
86 lines
2.8 KiB
YAML
---
|
|
# rn-platform-01: Docker Engine, directory structure, rendered compose file + env files,
|
|
# Postgres tuning overlay, reverse proxy config, and the systemd unit that runs it all.
|
|
# Docker TLS material and the host firewall are separate roles (docker-tls, firewall) run
|
|
# before this one in site.yml — this role assumes both are already in place.
|
|
|
|
- name: Install Docker Engine
|
|
ansible.builtin.import_tasks: "{{ role_path }}/../common/tasks/docker-engine.yml"
|
|
|
|
- name: Create data/config directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: root
|
|
group: docker
|
|
mode: "0750"
|
|
loop:
|
|
- "{{ rootnode_data_root }}/postgres"
|
|
- "{{ rootnode_data_root }}/backups"
|
|
- /opt/rootnode/platform
|
|
- /opt/rootnode/platform/postgresql.conf.d
|
|
- /etc/rootnode/provisioner-config
|
|
|
|
- name: Deploy Postgres tuning overlay
|
|
ansible.builtin.copy:
|
|
src: "{{ role_path }}/../../../docker/postgres/postgresql.conf.d/00-rootnode-baseline.conf"
|
|
dest: /opt/rootnode/platform/postgresql.conf.d/00-rootnode-baseline.conf
|
|
mode: "0644"
|
|
notify: restart rootnode-platform
|
|
|
|
- name: Deploy provisioner-config overlay ({{ env }})
|
|
ansible.builtin.copy:
|
|
src: "{{ role_path }}/../../../../environments/{{ env }}/provisioner-config/"
|
|
dest: /etc/rootnode/provisioner-config/
|
|
mode: "0644"
|
|
notify: restart rootnode-platform
|
|
|
|
- name: Deploy per-service env files (from Ansible Vault-backed variables — see group_vars)
|
|
ansible.builtin.template:
|
|
src: "{{ item }}.env.j2"
|
|
dest: "/etc/rootnode/{{ item }}.env"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
loop:
|
|
- platform
|
|
- provisioner
|
|
- gateway
|
|
- postgres
|
|
notify: restart rootnode-platform
|
|
|
|
- name: Render production docker-compose.yml
|
|
ansible.builtin.template:
|
|
src: "{{ role_path }}/../../../docker/platform/docker-compose.production.yml"
|
|
dest: /opt/rootnode/platform/docker-compose.yml
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
notify: restart rootnode-platform
|
|
|
|
- name: Render Caddyfile
|
|
ansible.builtin.template:
|
|
src: "{{ role_path }}/../../../docker/platform/Caddyfile.j2"
|
|
dest: /opt/rootnode/platform/Caddyfile
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: restart rootnode-platform
|
|
|
|
- name: Deploy systemd unit
|
|
ansible.builtin.template:
|
|
src: rootnode-platform.service.j2
|
|
dest: /etc/systemd/system/rootnode-platform.service
|
|
mode: "0644"
|
|
notify: restart rootnode-platform
|
|
|
|
# The `backup` role (applied after this one in site.yml) deploys the backup script and cron —
|
|
# kept separate since it also has to run correctly on a host that ISN'T freshly deployed.
|
|
|
|
- name: Enable and start rootnode-platform
|
|
ansible.builtin.systemd:
|
|
name: rootnode-platform
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|