personal_infra/ansible/roles/jar_lid_archive/tasks/deploy.yml

---
- name: Assert the deployment is fully specified
  ansible.builtin.assert:
    that:
      - jar_lid_archive_domain | length > 0
      - jar_lid_archive_django_secret_key | length >= 50
      - jar_lid_archive_postgres_password | length > 0
      - jar_lid_archive_s3_secret_key | length > 0
    fail_msg: >-
      jar_lid_archive needs a domain and its three secrets from the vault. The
      app falls back to development defaults for every one of them, so an empty
      value here would not fail - it would deploy with a published secret key.
  no_log: true

- name: Create the deployment directory
  ansible.builtin.file:
    path: "{{ jar_lid_archive_dir }}"
    state: directory
    owner: root
    group: root
    mode: '0755'

# Existence only, no owner: the postgres and seaweedfs entrypoints chown their
# own data directories to the uid inside the container. Declaring an owner here
# would fight them on every run - the mempool MariaDB lesson.
- name: Ensure the data directories exist
  ansible.builtin.file:
    path: "{{ jar_lid_archive_dir }}/{{ item }}"
    state: directory
  loop:
    - postgres
    - seaweedfs

# diff: false, because --diff prints rendered content and this is all secrets.
- name: Write the compose environment file
  ansible.builtin.template:
    src: env.j2
    dest: "{{ jar_lid_archive_dir }}/.env"
    owner: root
    group: root
    mode: '0600'
  diff: false

- name: Write docker-compose.yml
  ansible.builtin.template:
    src: docker-compose.yml.j2
    dest: "{{ jar_lid_archive_dir }}/docker-compose.yml"
    owner: root
    group: root
    mode: '0644'

- name: Log in to the container registry
  ansible.builtin.command:
    cmd: "docker login {{ jar_lid_archive_registry }} -u {{ jar_lid_archive_registry_user }} --password-stdin"
    stdin: "{{ jar_lid_archive_registry_token }}"
  when: jar_lid_archive_registry_token | length > 0
  changed_when: false
  no_log: true

# Pulled on every run: staging follows :master. `up` below recreates `web` only
# when the pulled digest differs from the running one.
- name: Pull images
  ansible.builtin.command: docker compose pull --quiet
  args:
    chdir: "{{ jar_lid_archive_dir }}"
  changed_when: false

# --wait blocks until every service's healthcheck passes, and `web`'s is
# /health/, which itself checks the database and the bucket - so this task
# succeeding means the app actually serves, not merely that containers exist.
- name: Start the stack and wait for it to be healthy
  ansible.builtin.command: docker compose up -d --remove-orphans --wait --wait-timeout 300
  args:
    chdir: "{{ jar_lid_archive_dir }}"
  register: jar_lid_archive_up
  changed_when: jar_lid_archive_up.stderr is search('Created|Recreated|Started|Removed')

- name: Read the deployed version
  ansible.builtin.uri:
    url: "http://127.0.0.1:{{ jar_lid_archive_port }}/health/"
    return_content: true
  register: jar_lid_archive_health
  # Under --check the stack was never started, so there is nothing to ask.
  when: not ansible_check_mode

- name: Show the deployed version
  ansible.builtin.debug:
    msg: "{{ jar_lid_archive_health.json }}"
  when: not ansible_check_mode

# Used by the backup (services/jar-lid-archive/setup_backup_jar_lid_archive.yml).
# Lives here because what to dump is a fact about this stack's layout.
- name: Install the dump script
  ansible.builtin.template:
    src: dump.sh.j2
    dest: /usr/local/bin/jar-lid-archive-dump.sh
    owner: root
    group: root
    mode: '0755'
    validate: "bash -n %s"