ansible-mln/prod/playbook-prod.yml

---
- name: Installation et configuration du frontend et backend
  hosts: prod-uber
  become: true
  gather_facts: true

  vars:
      ssl_dir: "{{ docker_dir }}/certs"
      ssl_domain: mln-uber.club

  tasks:
      - name: Update apt cache
        apt:
            update_cache: yes
            cache_valid_time: 3600

      - name: Install required packages
        apt:
            name:
                - apt-transport-https
                - ca-certificates
                - curl
                - gnupg
                - acl
            state: present
        tags: docker

      - name: Create directory for Docker GPG key
        file:
            path: /etc/apt/keyrings
            state: directory
            mode: "0755"
        tags: docker

      - name: Add Docker GPG key
        apt_key:
            url: https://download.docker.com/linux/ubuntu/gpg
            keyring: /etc/apt/keyrings/docker.gpg
            state: present
        tags: docker

      - name: Get system architecture
        command: dpkg --print-architecture
        register: system_arch
        changed_when: false

      - name: Get Ubuntu codename
        command: lsb_release -cs
        register: ubuntu_codename
        changed_when: false

      - name: Add Docker repository
        apt_repository:
            repo: "deb [arch={{ system_arch.stdout }} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ubuntu_codename.stdout }} stable"
            state: present
            filename: docker
        tags: docker

      - name: Update apt cache after adding repo
        apt:
            update_cache: yes
        tags: docker

      - name: Install Docker packages
        apt:
            name:
                - docker-ce
                - docker-ce-cli
                - containerd.io
                - docker-buildx-plugin
                - docker-compose-plugin
            state: present
        tags: docker

      - name: Ensure Docker service is started and enabled
        systemd:
            name: docker
            state: started
            enabled: yes
        tags: docker

      - name: Create docker group
        group:
            name: "{{ docker_group }}"
            state: present
        tags: docker

      - name: Create docker user
        user:
            name: "{{ docker_user }}"
            group: "{{ docker_group }}"
            groups: docker
            append: yes
            shell: /bin/bash
            create_home: yes
            state: present
        tags: docker

      - name: Add ansible user to docker group
        user:
            name: "{{ ansible_user }}"
            groups: docker
            append: yes
        when: ansible_user is defined
        tags: docker

      - name: Verify Docker installation
        command: docker --version
        register: docker_version
        changed_when: false
        tags: docker

      - name: Verify Docker Compose installation
        command: docker compose version
        register: compose_version
        changed_when: false
        tags: docker

      - name: Display versions
        debug:
            msg:
                - "{{ docker_version.stdout }}"
                - "{{ compose_version.stdout }}"
        tags: docker

      - name: Copy Docker project
        ansible.builtin.copy:
            src: "{{ compose_project_dir }}"
            dest: "{{ docker_dir }}/"
            owner: "{{ docker_user }}"
            group: "{{ docker_group }}"
            mode: "0755"

      - name: Ensure parent directory has correct permissions
        ansible.builtin.file:
            path: "{{ docker_dir }}"
            state: directory
            owner: "{{ docker_user }}"
            group: "{{ docker_group }}"
            mode: "0755"
        tags: project

      - name: Set correct permissions for Docker files
        ansible.builtin.file:
            path: "{{ docker_dir }}"
            owner: "{{ docker_user }}"
            group: "{{ docker_group }}"
            recurse: yes
        tags: project

      - name: Set permissions for .env file
        ansible.builtin.file:
            path: "{{ docker_dir }}/.env.example"
            owner: "{{ docker_user }}"
            group: "{{ docker_group }}"
            mode: "0640"
        tags: project
        ignore_errors: yes

      - name: Set permissions for lbtelegram.env file
        ansible.builtin.file:
            path: "{{ docker_dir }}/.env.lbtelegram"
            owner: "{{ docker_user }}"
            group: "{{ docker_group }}"
            mode: "0640"
        tags: project
        ignore_errors: yes

      - name: Create certs folder
        ansible.builtin.file:
            path: "{{ docker_dir }}/certs"
            state: directory
            owner: "{{ docker_user }}"
            group: "{{ docker_group }}"
            mode: "0750"
        tags: [certs]

      - name: Générer la clé privée RSA 2048
        community.crypto.openssl_privatekey:
          path: "{{ ssl_dir }}/privkey.pem"
          type: RSA
          size: 2048
          mode: "0600"
        tags: [certs]

      - name: Générer la CSR pour le certificat auto-signé
        community.crypto.openssl_csr:
          path: "{{ ssl_dir }}/selfsigned.csr"
          privatekey_path: "{{ ssl_dir }}/privkey.pem"
          common_name: "{{ ssl_domain }}"
        tags: [certs]

      - name: Générer le certificat auto-signé
        community.crypto.x509_certificate:
          path: "{{ ssl_dir }}/fullchain.pem"
          privatekey_path: "{{ ssl_dir }}/privkey.pem"
          csr_path: "{{ ssl_dir }}/selfsigned.csr"
          provider: selfsigned
          selfsigned_not_after: "+3650d"
          mode: "0644"
        tags: [certs]