deploy.yml

---
- hosts: $POSTGRES_HOST
  any_errors_fatal: true
  remote_user: admin
  become: yes
  gather_facts: no
  vars:
    ansible_ssh_extra_args: "-o StrictHostKeyChecking=no"
    ansible_python_interpreter: /usr/bin/python3
    postgres_database_host: "$POSTGRES_HOST"
    postgres_database_name: "{{ resource_prefix }}-database"
    postgres_database_username: "{{ resource_prefix }}-user"
    postgres_database_password: "$POSTGRES_PASSWORD"
    postgres_database_restore_source: "$POSTGRES_RESTORE_SOURCE"

  tasks:
    - name: Create database user
      postgresql_user:
        name: "{{ postgres_database_username }}"
        password: "{{ postgres_database_password }}"
        role_attr_flags: CREATEDB
      become: true
      become_user: postgres
      when:
        - postgres_database_name != ""
        - postgres_database_username != ""
        - postgres_database_password != ""

    - name: Create database
      postgresql_db:
        name: "{{ postgres_database_name }}"
        owner: "{{ postgres_database_username }}"
      become: true
      become_user: postgres
      when:
        - postgres_database_name != ""
        - postgres_database_username != ""
        - postgres_database_password != ""
      register: database_created

    # Required to avoid 'must be owner of schema public' errors on restore.
    - name: Set database public schema owner to created user
      postgresql_schema:
        database: "{{ postgres_database_name }}"
        name: public
        owner: "{{ postgres_database_username }}"
      become_user: postgres
      when: database_created.changed

    # Required to avoid 'must be owner of extension plpgsql' errors on restore.
    - name: Remove plpgsql extension from database
      postgresql_ext:
        db: "{{ postgres_database_name }}"
        name: plpgsql
        state: absent
      become_user: postgres
      when: database_created.changed

    - name: Restore database
      shell: /home/postgres_restore/bin/postgres_restore.sh
      environment:
        POSTGRES_RESTORE_SOURCE: "{{ postgres_database_restore_source }}"
        POSTGRES_HOST: "{{ postgres_database_host }}"
        POSTGRES_NAME: "{{ postgres_database_name }}"
        POSTGRES_USER: "{{ postgres_database_username }}"
        POSTGRES_PASSWORD: "{{ postgres_database_password }}"
      become_user: postgres_restore
      when:
        - postgres_database_restore_source != ""
        - stage != "production"
        - database_created.changed

- hosts: $MINIO_HOST
  any_errors_fatal: true
  remote_user: admin
  become: yes
  gather_facts: no
  vars:
    ansible_ssh_extra_args: "-o StrictHostKeyChecking=no"
    ansible_python_interpreter: /usr/bin/python3
    minio_host: "$MINIO_HOST"
    minio_bucket_name: "{{ resource_prefix }}-bucket"
    minio_access_key: "{{ resource_prefix }}-user"
    minio_secret_key: "$MINIO_SECRET_KEY"
    minio_restore_source: "$MINIO_RESTORE_SOURCE"

  tasks:
    - name: Add objectstore user policy definition
      copy:
        content: |
          {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Action": [
                  "s3:GetBucketLocation",
                  "s3:ListBucket",
                  "s3:ListBucketMultipartUploads"
                ],
                "Resource": [
                  "arn:aws:s3:::{{ minio_bucket_name }}"
                ],
                "Sid": ""
              },
              {
                "Effect": "Allow",
                "Action": [
                  "s3:AbortMultipartUpload",
                  "s3:DeleteObject",
                  "s3:GetObject",
                  "s3:ListMultipartUploadParts",
                  "s3:PutObject"
                ],
                "Resource": [
                  "arn:aws:s3:::{{ minio_bucket_name }}/*"
                ],
                "Sid": ""
              }
            ]
          }
        dest: /tmp/minio_policy_{{ minio_bucket_name }}.json
      when:
        - minio_bucket_name != ""
        - minio_access_key != ""
        - minio_secret_key != ""

    - name: Create objectstore user policy
      command: "mc admin policy add minio readwrite-{{ minio_bucket_name }} /tmp/minio_policy_{{ minio_bucket_name }}.json"
      when:
        - minio_bucket_name != ""
        - minio_access_key != ""
        - minio_secret_key != ""

    - name: Remove objectstore user policy definition
      file:
        state: absent
        path: "/tmp/minio_policy_{{ minio_bucket_name }}.json"
      when:
        - minio_bucket_name != ""
        - minio_access_key != ""
        - minio_secret_key != ""

    - name: Create objectstore user
      command: "mc admin user add minio {{ minio_access_key }} {{ minio_secret_key }} readwrite-{{ minio_bucket_name }}"
      when:
        - minio_bucket_name != ""
        - minio_access_key != ""
        - minio_secret_key != ""

    - name: List objectstore buckets
      command: mc ls minio
      register: minio_buckets

    - name: Create objectstore bucket
      command: "mc mb minio/{{ minio_bucket_name }}"
      when:
        - minio_bucket_name != ""
        - minio_access_key != ""
        - minio_secret_key != ""
        - "' ' ~ minio_bucket_name ~ '/' not in minio_buckets.stdout"
      register: bucket_created

    # This is set to enable unauthenticated download of all content contained in the bucket
    # via nginx proxy_pass directive.
    - name: Set bucket download policy
      command: "mc policy download minio/{{ minio_bucket_name }}"
      when:
        - minio_bucket_name != ""
        - minio_access_key != ""
        - minio_secret_key != ""

    - name: Restore objectstore bucket
      shell: /home/minio_restore/bin/minio_restore.sh
      become_user: minio_restore
      environment:
        MINIO_RESTORE_SOURCE: "{{ minio_restore_source }}"
        MINIO_BUCKET_NAME: "{{ minio_bucket_name }}"
        MINIO_HOST: "{{ minio_host }}"
        MINIO_ACCESS_KEY: "{{ minio_access_key }}"
        MINIO_SECRET_KEY: "{{ minio_secret_key }}"
      when:
        - minio_restore_source != ""
        - stage != "production"
        - bucket_created.changed

- hosts: $RABBITMQ_HOST
  any_errors_fatal: true
  remote_user: admin
  become: yes
  gather_facts: no
  vars:
    ansible_ssh_extra_args: "-o StrictHostKeyChecking=no"
    ansible_python_interpreter: /usr/bin/python3
    rabbitmq_vhost: "/{{ resource_prefix }}-vhost"
    rabbitmq_username: "{{ resource_prefix }}-user"
    rabbitmq_password: "$RABBITMQ_PASSWORD"

  tasks:
    - name: Create rabbitmq vhost
      rabbitmq_vhost:
        name: "{{ rabbitmq_vhost }}"
        state: present
      when:
        - rabbitmq_vhost != ""
        - rabbitmq_username != ""
        - rabbitmq_password != ""

    - name: Create rabbitmq user
      rabbitmq_user:
        user: "{{ rabbitmq_username }}"
        password: "{{ rabbitmq_password }}"
        permissions:
          - vhost: "{{ rabbitmq_vhost }}"
            configure_priv: .*
            read_priv: .*
            write_priv: .*
        state: present
      when:
        - rabbitmq_vhost != ""
        - rabbitmq_username != ""
        - rabbitmq_password != ""

- hosts: worker*:workersecondary*
  any_errors_fatal: true
  remote_user: admin
  become: yes
  gather_facts: no
  vars:
    ansible_ssh_extra_args: "-o StrictHostKeyChecking=no"
    ansible_python_interpreter: /usr/bin/python3

  tasks:
    - name: Create temporary deploy directory
      tempfile:
        state: directory
        suffix: deploy
      register: deploy_directory

    - name: Add docker compose file
      copy:
        src: "{{ compose_file }}"
        dest: "{{ deploy_directory.path }}/{{ compose_file }}"

    - name: Add environments file
      template:
        src: templates/env
        dest: "{{ deploy_directory.path }}/.env"

    - name: Pull all images
      shell: docker-compose -f {{ compose_file }} pull
      args:
        executable: /bin/bash
        chdir: "{{ deploy_directory.path }}"

    - name: Remove temporary deploy directory
      file:
        state: absent
        path: "{{ deploy_directory.path }}"

- hosts: manager0:managersecondary0
  any_errors_fatal: true
  remote_user: admin
  become: yes
  gather_facts: no
  vars:
    ansible_ssh_extra_args: "-o StrictHostKeyChecking=no"
    ansible_python_interpreter: /usr/bin/python3
    services_format_string: !unsafe "{{.Replicas}}"

  tasks:
    - name: Create temporary deploy directory
      tempfile:
        state: directory
        suffix: deploy
      register: deploy_directory

    - name: Add environments file
      template:
        src: templates/env
        dest: "{{ deploy_directory.path }}/.env"

    - name: Add docker compose file
      copy:
        src: "{{ compose_file }}"
        dest: "{{ deploy_directory.path }}/{{ compose_file }}"

    - name: Resolve service names
      shell: docker-compose --file {{ deploy_directory.path }}/{{ compose_file }} config --services
      register: service_names

    # Constrain services by generating a docker-compose.override.yml file.
    - name: Add docker compose overrides file
      template:
        src: templates/docker-compose.override.yml
        dest: "{{ deploy_directory.path }}/docker-compose.override.yml"

    - name: Deploy docker stack
      shell: docker stack deploy --with-registry-auth --prune --compose-file <(docker-compose --file {{ compose_file }} --file docker-compose.override.yml config) {{ resource_prefix }}
      args:
        executable: /bin/bash
        chdir: "{{ deploy_directory.path }}"

    - name: Wait for all stack services to have replicated tasks
      command: "docker stack services {{ resource_prefix }} --format '{{ services_format_string }}'"
      register: cmd_res
      retries: 30
      delay: 2
      until: cmd_res.stdout_lines | reject('search','^(?!0/1)') | list | count == 0

    - name: Remove temporary deploy directory
      file:
        state: absent
        path: "{{ deploy_directory.path }}"

- hosts: manager0
  any_errors_fatal: true
  remote_user: admin
  become: yes
  gather_facts: no
  vars:
    ansible_ssh_extra_args: "-o StrictHostKeyChecking=no"
    ansible_python_interpreter: /usr/bin/python3
    postdeploy_service: "$POSTDEPLOY_SERVICE"
    postdeploy_image: "$POSTDEPLOY_IMAGE-$CI_COMMIT_SHORT_SHA"
    postdeploy_command: "$POSTDEPLOY_COMMAND"

  tasks:
    - name: Resolve swarm node on which container is running for service in which post deploy command should be run
      shell: "sleep 10 && docker service ps {{ resource_prefix }}_{{ postdeploy_service }} --filter 'desired-state=running' | grep {{ postdeploy_image }} | awk '{ n=split($4,a,\"-\"); print a[n] }'"
      register: node_res
      retries: 5
      delay: 1
      until: node_res.stdout_lines | list | count == 1

    - name: Create temporary artifact directory on relevant swarm node
      tempfile:
        state: directory
        suffix: artifact
      delegate_to: "{{ node_res.stdout_lines[0] }}"
      register: artifact_directory
      when:
        - stage == "test"

    - name: Execute post deploy command in service container from relevant swarm node
      shell: "docker exec $(docker ps --filter name={{ resource_prefix }}_{{ postdeploy_service }} --format {{ '{{' }}.Names{{ '}}' }}) {{ postdeploy_command }}"
      delegate_to: "{{ node_res.stdout_lines[0] }}"
      register: post_deploy
      failed_when: "post_deploy.rc != 0 and stage != 'test'"

    - debug:
        var: post_deploy.stdout_lines

    - debug:
        var: post_deploy.stderr_lines

    - name: Copy test html report artifact in service container from relevant swarm node
      shell: "docker cp $(docker ps --filter name={{ resource_prefix }}_{{ postdeploy_service }} --format {{ '{{' }}.ID{{ '}}' }}):/opt/workspace/src/test_report.html {{ artifact_directory.path }}/test_report.html"
      delegate_to: "{{ node_res.stdout_lines[0] }}"
      ignore_errors: yes
      when:
        - stage == "test"

    - name: Copy test junit report artifact in service container from relevant swarm node
      shell: "docker cp $(docker ps --filter name={{ resource_prefix }}_{{ postdeploy_service }} --format {{ '{{' }}.ID{{ '}}' }}):/opt/workspace/src/junit.xml {{ artifact_directory.path }}/junit.xml"
      delegate_to: "{{ node_res.stdout_lines[0] }}"
      ignore_errors: yes
      when:
        - stage == "test"

    - name: Copy test html report artifact from swarm node to host
      fetch:
        src: "{{ artifact_directory.path }}/test_report.html"
        dest: test_report.html
        flat: yes
      delegate_to: "{{ node_res.stdout_lines[0] }}"
      ignore_errors: yes
      when:
        - stage == "test"

    - name: Copy test junit report artifact from swarm node to host
      fetch:
        src: "{{ artifact_directory.path }}/junit.xml"
        dest: junit.xml
        flat: yes
      delegate_to: "{{ node_res.stdout_lines[0] }}"
      ignore_errors: yes
      when:
        - stage == "test"

    - name: Raise error if tests failed.
      fail:
        msg: "Tests failed, see build artifacts for test reports."
      when: "post_deploy.rc != 0 and stage == 'test'"