tanshu
1f06e32854
The playbook pulls the tag from the registry, creates the data root owned by the app user, runs the container with its config baked into the image, waits for health, then verifies the data directory as the app user so a permissions mistake surfaces at deploy time. Caddy is pointed at the app with a stable marker, so a temporary hostname can be checked beside the live site and the cutover is one invocation with the retire flags set.
92 lines
2.3 KiB
YAML
92 lines
2.3 KiB
YAML
---
|
|
- name: Pull the app image
|
|
docker_image:
|
|
name: "{{ image_name }}"
|
|
tag: "{{ image_tag }}"
|
|
source: pull
|
|
force_source: yes
|
|
|
|
- name: Ensure the app root exists
|
|
file:
|
|
path: "{{ app_root }}"
|
|
state: directory
|
|
owner: "{{ app_uid }}"
|
|
group: "{{ app_gid }}"
|
|
mode: "0750"
|
|
|
|
- name: Ensure the data directory exists
|
|
file:
|
|
path: "{{ app_root }}/data"
|
|
state: directory
|
|
owner: "{{ app_uid }}"
|
|
group: "{{ app_gid }}"
|
|
mode: "0750"
|
|
|
|
- name: Look for the untracked site.env
|
|
stat:
|
|
path: "{{ app_root }}/site.env"
|
|
register: menu_site_env
|
|
|
|
- name: Warn when the admin has no password yet
|
|
debug:
|
|
msg: >-
|
|
{{ app_root }}/site.env is missing, so the admin is disabled: the public
|
|
menu still serves. Run scripts/provision-site-env.sh {{ app_root }} on
|
|
this host, then re-run this playbook.
|
|
when: not menu_site_env.stat.exists
|
|
|
|
- name: Run the menu app
|
|
docker_container:
|
|
name: "{{ docker_container }}"
|
|
image: "{{ image_name }}:{{ image_tag }}"
|
|
state: started
|
|
restart_policy: unless-stopped
|
|
user: "{{ app_uid }}:{{ app_gid }}"
|
|
env:
|
|
MENU_ROOT: /data
|
|
MENU_SITE_CONFIG: "/app/config/{{ site }}.site.json"
|
|
SECURE_COOKIES: "true"
|
|
LOG_LEVEL: info
|
|
PORT: "3000"
|
|
volumes:
|
|
- "{{ app_root }}:/data"
|
|
networks:
|
|
- name: "{{ docker_network }}"
|
|
|
|
- name: Wait for the app to answer
|
|
uri:
|
|
url: "http://{{ docker_container }}:3000/healthz"
|
|
status_code: 200
|
|
register: menu_health
|
|
retries: 10
|
|
delay: 2
|
|
until: menu_health.status == 200
|
|
changed_when: false
|
|
|
|
- name: Check the data directory for integrity problems
|
|
# Reads the same directory the container writes, as the same user, so a
|
|
# permissions mistake shows up here rather than at 8pm service.
|
|
command:
|
|
argv:
|
|
- docker
|
|
- run
|
|
- --rm
|
|
- --user
|
|
- "{{ app_uid }}:{{ app_gid }}"
|
|
- -e
|
|
- MENU_ROOT=/data
|
|
- -e
|
|
- "MENU_SITE_CONFIG=/app/config/{{ site }}.site.json"
|
|
- --entrypoint
|
|
- node
|
|
- "{{ image_name }}:{{ image_tag }}"
|
|
- src/cli/verify.ts
|
|
register: menu_verify
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Report integrity problems
|
|
debug:
|
|
msg: "{{ menu_verify.stdout_lines | default([]) }}"
|
|
when: menu_verify.rc != 0
|