157 lines
6.1 KiB
YAML
157 lines
6.1 KiB
YAML
---
|
|
- name: Provision Production DevOps Platform Toolkit
|
|
hosts: all
|
|
become: yes
|
|
vars_files:
|
|
- vars/vault.yml # Dynamically loads the encrypted secrets
|
|
vars:
|
|
server_timezone: "Europe/Amsterdam"
|
|
client_admin_user: "ansible"
|
|
ssh_port: "22"
|
|
client_domain: "lab.mhdio.com"
|
|
|
|
# Binding plaintext vars to encrypted vault values
|
|
client_admin_ssh_pub_key: "{{ vault_client_admin_ssh_pub_key }}"
|
|
ssl_notification_email: "{{ vault_ssl_notification_email }}"
|
|
|
|
roles:
|
|
# -----------------------------------------------------------------
|
|
# Foundation Stage (v0.1)
|
|
# -----------------------------------------------------------------
|
|
- role: ../../ansible/roles/base-server
|
|
- role: ../../ansible/roles/users
|
|
- role: ../../ansible/roles/ssh-hardening
|
|
- role: ../../ansible/roles/ufw
|
|
- role: ../../ansible/roles/docker
|
|
- role: ../../ansible/roles/nginx
|
|
# Run Certbot for primary domain (defaults to proxy_backend_port: 8080)
|
|
- role: ../../ansible/roles/certbot
|
|
- role: ../../ansible/roles/backup-client
|
|
|
|
# -----------------------------------------------------------------
|
|
# Delivery Stage: Dynamic CICD Platform (v0.3)
|
|
# -----------------------------------------------------------------
|
|
- role: ../../ansible/roles/cicd-platform
|
|
vars:
|
|
# Options: gitlab-saas, gitea-selfhosted, gitlab-ce
|
|
#cicd_provider: "gitlab-saas"
|
|
cicd_provider: "gitea-selfhosted"
|
|
|
|
tasks:
|
|
# -----------------------------------------------------------------
|
|
# 1. Deploy Hello World Application Stack
|
|
# -----------------------------------------------------------------
|
|
- name: Create destination folder for hello-world stack
|
|
ansible.builtin.file:
|
|
path: "/home/{{ client_admin_user }}/stacks/hello-world"
|
|
state: directory
|
|
owner: "{{ client_admin_user }}"
|
|
group: "{{ client_admin_user }}"
|
|
mode: '0755'
|
|
|
|
- name: Copy docker-compose.yml for hello-world
|
|
ansible.builtin.copy:
|
|
src: ../../stacks/applications/hello-world/docker-compose.yml
|
|
dest: "/home/{{ client_admin_user }}/stacks/hello-world/docker-compose.yml"
|
|
owner: "{{ client_admin_user }}"
|
|
group: "{{ client_admin_user }}"
|
|
mode: '0644'
|
|
|
|
- name: Start hello-world stack
|
|
ansible.builtin.command:
|
|
cmd: "docker compose up -d"
|
|
chdir: "/home/{{ client_admin_user }}/stacks/hello-world"
|
|
become: yes
|
|
become_user: "{{ client_admin_user }}"
|
|
changed_when: false
|
|
|
|
# -----------------------------------------------------------------
|
|
# 2. Deploy Monitoring Stack (Prometheus, Grafana, Node-Exporter)
|
|
# -----------------------------------------------------------------
|
|
- name: Create destination directory for monitoring stack
|
|
ansible.builtin.file:
|
|
path: "/home/{{ client_admin_user }}/stacks/monitoring/prometheus"
|
|
state: directory
|
|
owner: "{{ client_admin_user }}"
|
|
group: "{{ client_admin_user }}"
|
|
mode: '0755'
|
|
|
|
- name: Copy Prometheus configuration file
|
|
ansible.builtin.copy:
|
|
src: ../../stacks/monitoring/prometheus/prometheus.yml
|
|
dest: "/home/{{ client_admin_user }}/stacks/monitoring/prometheus/prometheus.yml"
|
|
owner: "{{ client_admin_user }}"
|
|
group: "{{ client_admin_user }}"
|
|
mode: '0644'
|
|
|
|
- name: Copy Monitoring docker-compose.yml file
|
|
ansible.builtin.copy:
|
|
src: ../../stacks/monitoring/docker-compose.yml
|
|
dest: "/home/{{ client_admin_user }}/stacks/monitoring/docker-compose.yml"
|
|
owner: "{{ client_admin_user }}"
|
|
group: "{{ client_admin_user }}"
|
|
mode: '0644'
|
|
|
|
- name: Launch Monitoring Stack via Docker Compose
|
|
ansible.builtin.command:
|
|
cmd: "docker compose up -d"
|
|
chdir: "/home/{{ client_admin_user }}/stacks/monitoring"
|
|
become: yes
|
|
become_user: "{{ client_admin_user }}"
|
|
changed_when: false
|
|
|
|
# -----------------------------------------------------------------
|
|
# 3. Deploy Logging Stack (Loki & Promtail)
|
|
# -----------------------------------------------------------------
|
|
- name: Create destination directories for logging stack
|
|
ansible.builtin.file:
|
|
path: "/home/{{ client_admin_user }}/stacks/logging/{{ item }}"
|
|
state: directory
|
|
owner: "{{ client_admin_user }}"
|
|
group: "{{ client_admin_user }}"
|
|
mode: '0755'
|
|
loop:
|
|
- "loki"
|
|
- "promtail"
|
|
|
|
- name: Copy Loki configuration file
|
|
ansible.builtin.copy:
|
|
src: ../../stacks/logging/loki/loki-config.yml
|
|
dest: "/home/{{ client_admin_user }}/stacks/logging/loki/loki-config.yml"
|
|
owner: "{{ client_admin_user }}"
|
|
group: "{{ client_admin_user }}"
|
|
mode: '0644'
|
|
|
|
- name: Copy Promtail configuration file
|
|
ansible.builtin.copy:
|
|
src: ../../stacks/logging/promtail/promtail-config.yml
|
|
dest: "/home/{{ client_admin_user }}/stacks/logging/promtail/promtail-config.yml"
|
|
owner: "{{ client_admin_user }}"
|
|
group: "{{ client_admin_user }}"
|
|
mode: '0644'
|
|
|
|
- name: Copy Logging docker-compose.yml file
|
|
ansible.builtin.copy:
|
|
src: ../../stacks/logging/docker-compose.yml
|
|
dest: "/home/{{ client_admin_user }}/stacks/logging/docker-compose.yml"
|
|
owner: "{{ client_admin_user }}"
|
|
group: "{{ client_admin_user }}"
|
|
mode: '0644'
|
|
|
|
- name: Launch Logging Stack via Docker Compose
|
|
ansible.builtin.command:
|
|
cmd: "docker compose up -d"
|
|
chdir: "/home/{{ client_admin_user }}/stacks/logging"
|
|
become: yes
|
|
become_user: "{{ client_admin_user }}"
|
|
changed_when: false
|
|
|
|
# -----------------------------------------------------------------
|
|
# 4. Dynamic SSL & Nginx Routing for Subdomain (Grafana)
|
|
# -----------------------------------------------------------------
|
|
- name: Trigger SSL Generation and Reverse Proxy for Monitoring Subdomain
|
|
ansible.builtin.include_role:
|
|
name: ../../ansible/roles/certbot
|
|
vars:
|
|
client_domain: "status.mhdio.com"
|
|
proxy_backend_port: "3000" # Target Grafana container port |