320 lines
9.4 KiB
YAML
320 lines
9.4 KiB
YAML
---
|
|
- name: Installation et configuration du frontend et backend
|
|
hosts: uber-stup
|
|
become: true
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
- name: Update and upgrade
|
|
ansible.builtin.apt:
|
|
update_cache: yes
|
|
cache_valid_time: 3600
|
|
upgrade: "dist"
|
|
|
|
- name: install basic dependencies
|
|
ansible.builtin.apt:
|
|
name:
|
|
- curl
|
|
- wget
|
|
- tar
|
|
- rsync
|
|
- acl
|
|
- nginx
|
|
- certbot
|
|
- python3-certbot-nginx
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Download Go 1.23.0 tarball
|
|
ansible.builtin.get_url:
|
|
url: https://dl.google.com/go/go1.23.0.linux-amd64.tar.gz
|
|
dest: /tmp/go1.23.0.linux-amd64.tar.gz
|
|
mode: "0644"
|
|
|
|
- name: Extract Go 1.23.0
|
|
ansible.builtin.unarchive:
|
|
src: /tmp/go1.23.0.linux-amd64.tar.gz
|
|
dest: /usr/local
|
|
remote_src: yes
|
|
|
|
- name: Ensure Go 1.23 is in PATH for all users
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/profile.d/go.sh
|
|
line: "export PATH=/usr/local/go/bin:$PATH"
|
|
create: yes
|
|
state: present
|
|
mode: "0644"
|
|
|
|
- name: Check Go versions
|
|
ansible.builtin.shell: |
|
|
echo "Go: $(go version)"
|
|
register: versions_check
|
|
changed_when: false
|
|
failed_when: versions_check.rc != 0
|
|
|
|
- name: Display all versions
|
|
ansible.builtin.debug:
|
|
msg: "{{ versions_check.stdout_lines }}"
|
|
|
|
# ============================================
|
|
# FRONTEND
|
|
# ============================================
|
|
|
|
- name: Create /var/www if not exists
|
|
ansible.builtin.file:
|
|
path: /var/www
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Créer l'utilisateur de déploiement s'il n'existe pas
|
|
ansible.builtin.user:
|
|
name: "{{ user_deploy }}"
|
|
shell: /bin/bash
|
|
create_home: yes
|
|
state: present
|
|
|
|
- name: Ensure /home/{{ user_deploy }} exists with correct permissions
|
|
ansible.builtin.file:
|
|
path: "/home/{{ user_deploy }}"
|
|
state: directory
|
|
owner: "{{ user_deploy }}"
|
|
group: "{{ user_deploy }}"
|
|
mode: "0755"
|
|
|
|
# ============================================
|
|
# BACKEND
|
|
# ============================================
|
|
|
|
- name: Create backend directory with deploy user ownership
|
|
ansible.builtin.file:
|
|
path: "{{ backend_dir }}"
|
|
state: directory
|
|
owner: "{{ user_deploy }}"
|
|
group: "{{ user_deploy }}"
|
|
mode: "0755"
|
|
|
|
- name: Synchroniser le backend Go
|
|
ansible.builtin.synchronize:
|
|
src: ../backend/gestion/
|
|
dest: "{{ backend_dir }}/"
|
|
rsync_opts:
|
|
- "--exclude=.git"
|
|
- "--exclude=.gitignore"
|
|
- "--exclude=docker-compose.yml"
|
|
- "--exclude=.env"
|
|
- "--no-owner"
|
|
- "--no-group"
|
|
delete: yes
|
|
recursive: yes
|
|
tags: backend
|
|
|
|
- name: Fix backend ownership after rsync (rsync tourne en root)
|
|
ansible.builtin.file:
|
|
path: "{{ backend_dir }}"
|
|
owner: "{{ user_deploy }}"
|
|
group: "{{ user_deploy }}"
|
|
recurse: yes
|
|
tags: backend
|
|
|
|
- name: Remove old binary if owned by another user
|
|
ansible.builtin.file:
|
|
path: "{{ backend_dir }}/main"
|
|
state: absent
|
|
tags: backend
|
|
|
|
- name: Compile backend as deploy user
|
|
become_user: "{{ user_deploy }}"
|
|
ansible.builtin.shell: |
|
|
export PATH=/usr/local/go/bin:$PATH
|
|
go mod tidy
|
|
go build -o main .
|
|
args:
|
|
chdir: "{{ backend_dir }}"
|
|
executable: /bin/bash
|
|
tags: backend
|
|
|
|
- name: Set ownership to www-data for runtime
|
|
ansible.builtin.file:
|
|
path: "{{ backend_dir }}"
|
|
owner: "{{ user_web }}"
|
|
group: "{{ user_web }}"
|
|
mode: "0755"
|
|
recurse: yes
|
|
tags: backend
|
|
|
|
- name: Set executable permission on backend binary
|
|
ansible.builtin.file:
|
|
path: "{{ backend_binary }}"
|
|
owner: "{{ user_web }}"
|
|
group: "{{ user_web }}"
|
|
mode: "0755"
|
|
tags: backend
|
|
|
|
# ============================================
|
|
# SYSTEMD SERVICES
|
|
# ============================================
|
|
|
|
- name: Create systemd service for backend
|
|
ansible.builtin.template:
|
|
src: ./templates/backend.service.j2
|
|
dest: /etc/systemd/system/backend.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
tags: backend
|
|
|
|
- name: Reload systemd daemon
|
|
ansible.builtin.systemd:
|
|
daemon_reload: yes
|
|
tags: backend
|
|
|
|
- name: Enable and restart backend service
|
|
ansible.builtin.systemd:
|
|
name: backend
|
|
enabled: yes
|
|
state: restarted
|
|
tags: backend
|
|
|
|
- name: Wait for backend to be ready
|
|
ansible.builtin.wait_for:
|
|
port: "{{ backend_local_port }}"
|
|
delay: 2
|
|
timeout: 30
|
|
tags: backend
|
|
|
|
- name: Display service status
|
|
ansible.builtin.shell: |
|
|
echo "=== Backend Service ==="
|
|
systemctl status backend --no-pager || true
|
|
register: service_status
|
|
changed_when: false
|
|
tags: backend
|
|
|
|
- name: Show service status
|
|
ansible.builtin.debug:
|
|
msg: "{{ service_status.stdout_lines }}"
|
|
tags: backend
|
|
|
|
- name: Configuration UFW
|
|
ansible.builtin.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop:
|
|
- "{{ backend_port }}"
|
|
- 80
|
|
- 22
|
|
|
|
- name: Activation du firewall
|
|
ansible.builtin.ufw:
|
|
state: enabled
|
|
|
|
- name: Vérifier si un certificat existe déjà
|
|
ansible.builtin.stat:
|
|
path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
|
register: cert_file
|
|
tags: [certbot]
|
|
|
|
- name: Déployer la configuration Nginx HTTP
|
|
ansible.builtin.template:
|
|
src: templates/nginx.conf.j2
|
|
dest: /etc/nginx/sites-available/api
|
|
vars:
|
|
ssl_enabled: false
|
|
tags: [certbot]
|
|
|
|
- name: Activation du site Nginx
|
|
ansible.builtin.file:
|
|
src: /etc/nginx/sites-available/api
|
|
dest: /etc/nginx/sites-enabled/api
|
|
state: link
|
|
force: yes
|
|
tags: [certbot]
|
|
|
|
- name: Suppression du site par défaut
|
|
ansible.builtin.file:
|
|
path: /etc/nginx/sites-enabled/default
|
|
state: absent
|
|
tags: [certbot]
|
|
|
|
- name: Test de la configuration Nginx
|
|
ansible.builtin.command: nginx -t
|
|
changed_when: false
|
|
tags: [certbot]
|
|
|
|
- name: Redémarrage de Nginx
|
|
ansible.builtin.systemd:
|
|
name: nginx
|
|
state: restarted
|
|
enabled: yes
|
|
tags: [certbot]
|
|
|
|
# ============================================================
|
|
# Certificat SSL Let's Encrypt
|
|
# ============================================================
|
|
|
|
- name: Générer le certificat SSL avec Certbot
|
|
ansible.builtin.command: >
|
|
certbot certonly --nginx
|
|
-d {{ domain_name }}
|
|
--non-interactive
|
|
--agree-tos
|
|
--email admin@{{ domain_name }}
|
|
when: not cert_file.stat.exists
|
|
tags: [certbot]
|
|
|
|
# ============================================================
|
|
# Nginx - reconfiguration HTTPS après certificat
|
|
# ============================================================
|
|
- name: Vérifier la présence du certificat
|
|
ansible.builtin.stat:
|
|
path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
|
register: cert_file_after
|
|
tags: [nginx]
|
|
|
|
- name: Déployer la configuration Nginx HTTPS
|
|
ansible.builtin.template:
|
|
src: templates/nginx.conf.j2
|
|
dest: /etc/nginx/sites-available/api
|
|
vars:
|
|
ssl_enabled: true
|
|
when: cert_file_after.stat.exists
|
|
notify: Restart nginx
|
|
tags: [nginx]
|
|
|
|
- name: Test de la configuration Nginx finale
|
|
ansible.builtin.command: nginx -t
|
|
changed_when: false
|
|
tags: [nginx]
|
|
|
|
- name: Redémarrage de Nginx avec SSL
|
|
ansible.builtin.systemd:
|
|
name: nginx
|
|
state: restarted
|
|
when: cert_file_after.stat.exists
|
|
tags: [nginx]
|
|
|
|
- name: Vérifier le renouvellement automatique
|
|
ansible.builtin.command: certbot renew --dry-run
|
|
register: certbot_renew
|
|
changed_when: false
|
|
failed_when: false
|
|
tags: [certbot]
|
|
|
|
- name: Afficher le statut du renouvellement
|
|
ansible.builtin.debug:
|
|
msg: "{{ certbot_renew.stdout_lines }}"
|
|
tags: [certbot]
|
|
|
|
handlers:
|
|
- name: Reload systemd
|
|
ansible.builtin.systemd:
|
|
daemon_reload: yes
|
|
|
|
- name: Restart nginx
|
|
ansible.builtin.systemd:
|
|
name: nginx
|
|
state: restarted
|