chore: update
This commit is contained in:
@@ -0,0 +1,305 @@
|
||||
---
|
||||
- name: Installation et configuration du frontend et backend
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Update and upgrade
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
upgrade: "dist"
|
||||
|
||||
- name: install basic dependencies
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- curl
|
||||
- wget
|
||||
- tar
|
||||
- rsync
|
||||
- acl
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Download Go 1.23.0 tarball
|
||||
ansible.builtin.get_url:
|
||||
url: https://dl.google.com/go/go1.23.0.linux-amd64.tar.gz
|
||||
dest: /tmp/go1.23.0.linux-amd64.tar.gz
|
||||
mode: "0644"
|
||||
|
||||
- name: Extract Go 1.23.0
|
||||
ansible.builtin.unarchive:
|
||||
src: /tmp/go1.23.0.linux-amd64.tar.gz
|
||||
dest: /usr/local
|
||||
remote_src: yes
|
||||
|
||||
- name: Ensure Go 1.23 is in PATH for all users
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/profile.d/go.sh
|
||||
line: "export PATH=/usr/local/go/bin:$PATH"
|
||||
create: yes
|
||||
state: present
|
||||
mode: "0644"
|
||||
|
||||
- name: Check Go versions
|
||||
ansible.builtin.shell: |
|
||||
echo "Go: $(go version)"
|
||||
register: versions_check
|
||||
changed_when: false
|
||||
failed_when: versions_check.rc != 0
|
||||
|
||||
- name: Display all versions
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ versions_check.stdout_lines }}"
|
||||
|
||||
# ============================================
|
||||
# FRONTEND
|
||||
# ============================================
|
||||
|
||||
- name: Create /var/www if not exists
|
||||
ansible.builtin.file:
|
||||
path: /var/www
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
|
||||
- name: Créer l'utilisateur de déploiement s'il n'existe pas
|
||||
ansible.builtin.user:
|
||||
name: "{{ user_deploy }}"
|
||||
shell: /bin/bash
|
||||
create_home: yes
|
||||
state: present
|
||||
|
||||
- name: Ensure /home/{{ user_deploy }} exists with correct permissions
|
||||
ansible.builtin.file:
|
||||
path: "/home/{{ user_deploy }}"
|
||||
state: directory
|
||||
owner: "{{ user_deploy }}"
|
||||
group: "{{ user_deploy }}"
|
||||
mode: "0755"
|
||||
|
||||
# ============================================
|
||||
# BACKEND
|
||||
# ============================================
|
||||
|
||||
- name: Create backend directory with deploy user ownership
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_dir }}"
|
||||
state: directory
|
||||
owner: "{{ user_deploy }}"
|
||||
group: "{{ user_deploy }}"
|
||||
mode: "0755"
|
||||
tags: backend
|
||||
|
||||
- name: Synchroniser le backend Go
|
||||
ansible.builtin.synchronize:
|
||||
src: ../backend/gestion/
|
||||
dest: "{{ backend_dir }}/"
|
||||
rsync_opts:
|
||||
- "--exclude=.git"
|
||||
- "--exclude=.gitignore"
|
||||
- "--exclude=docker-compose.yml"
|
||||
- "--exclude=.env"
|
||||
- "--no-owner"
|
||||
- "--no-group"
|
||||
delete: yes
|
||||
recursive: yes
|
||||
tags: backend
|
||||
|
||||
- name: Compile backend as deploy user
|
||||
become_user: "{{ user_deploy }}"
|
||||
ansible.builtin.shell: |
|
||||
export PATH=/usr/local/go/bin:$PATH
|
||||
go mod tidy
|
||||
go build -o main .
|
||||
args:
|
||||
chdir: "{{ backend_dir }}"
|
||||
executable: /bin/bash
|
||||
tags: backend
|
||||
|
||||
- name: Set ownership to www-data for runtime
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_dir }}"
|
||||
owner: "{{ user_web }}"
|
||||
group: "{{ user_web }}"
|
||||
mode: "0755"
|
||||
recurse: yes
|
||||
tags: backend
|
||||
|
||||
- name: Set executable permission on backend binary
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_binary }}"
|
||||
owner: "{{ user_web }}"
|
||||
group: "{{ user_web }}"
|
||||
mode: "0755"
|
||||
tags: backend
|
||||
|
||||
# ============================================
|
||||
# SYSTEMD SERVICES
|
||||
# ============================================
|
||||
|
||||
- name: Create systemd service for backend
|
||||
ansible.builtin.template:
|
||||
src: ./templates/backend.service.j2
|
||||
dest: /etc/systemd/system/backend.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
tags: backend
|
||||
|
||||
- name: Reload systemd daemon
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: yes
|
||||
tags: backend
|
||||
|
||||
- name: Enable and restart backend service
|
||||
ansible.builtin.systemd:
|
||||
name: backend
|
||||
enabled: yes
|
||||
state: restarted
|
||||
tags: backend
|
||||
|
||||
- name: Wait for backend to be ready
|
||||
ansible.builtin.wait_for:
|
||||
port: "{{ backend_local_port }}"
|
||||
delay: 2
|
||||
timeout: 30
|
||||
tags: backend
|
||||
|
||||
- name: Display service status
|
||||
ansible.builtin.shell: |
|
||||
echo "=== Backend Service ==="
|
||||
systemctl status backend --no-pager || true
|
||||
register: service_status
|
||||
changed_when: false
|
||||
tags: backend
|
||||
|
||||
- name: Show service status
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ service_status.stdout_lines }}"
|
||||
|
||||
- name: Configuration UFW
|
||||
ansible.builtin.ufw:
|
||||
rule: allow
|
||||
port: "{{ item }}"
|
||||
proto: tcp
|
||||
loop:
|
||||
- "{{ backend_port }}"
|
||||
- 80
|
||||
- 22
|
||||
|
||||
- name: Activation du firewall
|
||||
ansible.builtin.ufw:
|
||||
state: enabled
|
||||
|
||||
- name: Vérifier si un certificat existe déjà
|
||||
ansible.builtin.stat:
|
||||
path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
||||
register: cert_file
|
||||
tags: [certbot]
|
||||
|
||||
- name: Déployer la configuration Nginx HTTP
|
||||
ansible.builtin.template:
|
||||
src: templates/nginx.conf.j2
|
||||
dest: /etc/nginx/sites-available/api
|
||||
vars:
|
||||
ssl_enabled: false
|
||||
tags: [certbot]
|
||||
|
||||
- name: Activation du site Nginx
|
||||
ansible.builtin.file:
|
||||
src: /etc/nginx/sites-available/api
|
||||
dest: /etc/nginx/sites-enabled/api
|
||||
state: link
|
||||
force: yes
|
||||
tags: [certbot]
|
||||
|
||||
- name: Suppression du site par défaut
|
||||
ansible.builtin.file:
|
||||
path: /etc/nginx/sites-enabled/default
|
||||
state: absent
|
||||
tags: [certbot]
|
||||
|
||||
- name: Test de la configuration Nginx
|
||||
ansible.builtin.command: nginx -t
|
||||
changed_when: false
|
||||
tags: [certbot]
|
||||
|
||||
- name: Redémarrage de Nginx
|
||||
ansible.builtin.systemd:
|
||||
name: nginx
|
||||
state: restarted
|
||||
enabled: yes
|
||||
tags: [certbot]
|
||||
|
||||
# ============================================================
|
||||
# Certificat SSL Let's Encrypt
|
||||
# ============================================================
|
||||
|
||||
- name: Générer le certificat SSL avec Certbot
|
||||
ansible.builtin.command: >
|
||||
certbot certonly --nginx
|
||||
-d {{ domain_name }}
|
||||
--non-interactive
|
||||
--agree-tos
|
||||
--email admin@{{ domain_name }}
|
||||
when: not cert_file.stat.exists
|
||||
tags: [certbot]
|
||||
|
||||
# ============================================================
|
||||
# Nginx - reconfiguration HTTPS après certificat
|
||||
# ============================================================
|
||||
- name: Vérifier la présence du certificat
|
||||
ansible.builtin.stat:
|
||||
path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
||||
register: cert_file_after
|
||||
tags: [nginx]
|
||||
|
||||
- name: Déployer la configuration Nginx HTTPS
|
||||
ansible.builtin.template:
|
||||
src: templates/nginx.conf.j2
|
||||
dest: /etc/nginx/sites-available/api
|
||||
vars:
|
||||
ssl_enabled: true
|
||||
when: cert_file_after.stat.exists
|
||||
notify: Restart nginx
|
||||
tags: [nginx]
|
||||
|
||||
- name: Test de la configuration Nginx finale
|
||||
ansible.builtin.command: nginx -t
|
||||
changed_when: false
|
||||
tags: [nginx]
|
||||
|
||||
- name: Redémarrage de Nginx avec SSL
|
||||
ansible.builtin.systemd:
|
||||
name: nginx
|
||||
state: restarted
|
||||
when: cert_file_after.stat.exists
|
||||
tags: [nginx]
|
||||
|
||||
- name: Vérifier le renouvellement automatique
|
||||
ansible.builtin.command: certbot renew --dry-run
|
||||
register: certbot_renew
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
tags: [certbot]
|
||||
|
||||
- name: Afficher le statut du renouvellement
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ certbot_renew.stdout_lines }}"
|
||||
tags: [certbot]
|
||||
|
||||
handlers:
|
||||
- name: Reload systemd
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: yes
|
||||
|
||||
- name: Restart nginx
|
||||
ansible.builtin.systemd:
|
||||
name: nginx
|
||||
state: restarted
|
||||
Reference in New Issue
Block a user