chore: sync staging workspace

deployment/ansible/roles/application/tasks/deploy.yml

@@ -0,0 +1,69 @@
+---
+- name: Deploy application stack
+  community.docker.docker_compose_v2:
+    project_src: "{{ application_stack_dest }}"
+    state: present
+    pull: always
+    recreate: "{{ application_compose_recreate }}"
+    remove_orphans: "{{ application_remove_orphans | bool }}"
+  register: application_compose_result
+
+- name: Wait for application container to report Up
+  shell: |
+    docker compose -f {{ application_stack_dest }}/docker-compose.yml ps app | grep -Eiq "Up|running"
+  register: application_app_running
+  changed_when: false
+  until: application_app_running.rc == 0
+  retries: "{{ ((application_wait_timeout | int) + (application_wait_interval | int) - 1) // (application_wait_interval | int) }}"
+  delay: "{{ application_wait_interval | int }}"
+  when: application_compose_result.changed
+
+- name: Ensure app container is running before migrations
+  shell: |
+    docker compose -f {{ application_stack_dest }}/docker-compose.yml ps app | grep -Eiq "Up|running"
+  args:
+    executable: /bin/bash
+  register: application_app_container_running
+  changed_when: false
+  failed_when: false
+  when: application_compose_result.changed
+
+- name: Run database migrations
+  shell: |
+    docker compose -f {{ application_stack_dest }}/docker-compose.yml exec -T app {{ application_migration_command }}
+  args:
+    executable: /bin/bash
+  register: application_migration_result
+  changed_when: true
+  failed_when: false
+  ignore_errors: yes
+  when:
+    - application_run_migrations
+    - application_compose_result.changed
+    - application_app_container_running.rc == 0
+
+- name: Collect application container status
+  shell: docker compose -f {{ application_stack_dest }}/docker-compose.yml ps
+  register: application_ps
+  changed_when: false
+  ignore_errors: yes
+
+- name: Perform application health check
+  uri:
+    url: "{{ application_healthcheck_url }}"
+    method: GET
+    validate_certs: no
+    status_code: [200, 404, 502, 503]
+    timeout: 10
+  register: application_healthcheck_result
+  ignore_errors: yes
+  when:
+    - application_healthcheck_url | length > 0
+    - application_compose_result.changed
+
+- name: Set application role summary facts
+  set_fact:
+    application_stack_changed: "{{ application_compose_result.changed | default(false) }}"
+    application_health_output: "{{ application_ps.stdout | default('') }}"
+    application_healthcheck_status: "{{ application_healthcheck_result.status | default('unknown') }}"
+    application_migration_stdout: "{{ application_migration_result.stdout | default('') }}"

deployment/ansible/roles/application/tasks/main.yml

@@ -0,0 +1,7 @@
+---
+- name: Synchronize application stack files
+  include_tasks: sync.yml
+  when: application_sync_files | bool
+
+- name: Deploy application stack
+  include_tasks: deploy.yml

deployment/ansible/roles/application/tasks/sync.yml

@@ -0,0 +1,94 @@
+---
+- name: Ensure application stack destination directory exists
+  file:
+    path: "{{ application_stack_dest }}"
+    state: directory
+    mode: '0755'
+
+- name: Check if vault file exists locally
+  stat:
+    path: "{{ application_vault_file }}"
+  delegate_to: localhost
+  register: application_vault_stat
+  become: no
+
+- name: Optionally load application secrets from vault
+  include_vars:
+    file: "{{ application_vault_file }}"
+  when: application_vault_stat.stat.exists
+  no_log: yes
+  delegate_to: localhost
+  become: no
+
+- name: Check if PostgreSQL .env exists on target host
+  stat:
+    path: "{{ stacks_base_path }}/postgresql/.env"
+  register: application_postgres_env_file
+  changed_when: false
+
+- name: Extract PostgreSQL password from .env file
+  shell: "grep '^POSTGRES_PASSWORD=' {{ stacks_base_path }}/postgresql/.env 2>/dev/null | cut -d'=' -f2- || echo ''"
+  register: application_postgres_password
+  changed_when: false
+  failed_when: false
+  when: application_postgres_env_file.stat.exists
+  no_log: yes
+
+- name: Determine application database password
+  set_fact:
+    application_db_password: >-
+      {{ (application_postgres_env_file.stat.exists and application_postgres_password.stdout != '') |
+         ternary(application_postgres_password.stdout,
+                 vault_db_root_password | default(lookup('password', '/dev/null length=32 chars=ascii_letters,digits,punctuation'))) }}
+  no_log: yes
+
+- name: Determine application redis password
+  set_fact:
+    application_redis_password: "{{ vault_redis_password | default(lookup('password', '/dev/null length=32 chars=ascii_letters,digits,punctuation')) }}"
+  no_log: yes
+
+- name: Check if application docker-compose source exists locally
+  stat:
+    path: "{{ application_stack_src }}/docker-compose.yml"
+  delegate_to: localhost
+  register: application_compose_src
+  become: no
+
+- name: Copy application docker-compose to target host
+  copy:
+    src: "{{ application_stack_src }}/docker-compose.yml"
+    dest: "{{ application_stack_dest }}/docker-compose.yml"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: '0644'
+  when: application_compose_src.stat.exists
+
+- name: Check if nginx configuration exists locally
+  stat:
+    path: "{{ application_stack_src }}/nginx"
+  delegate_to: localhost
+  register: application_nginx_src
+  become: no
+
+- name: Synchronize nginx configuration
+  copy:
+    src: "{{ application_stack_src }}/nginx/"
+    dest: "{{ application_stack_dest }}/nginx/"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: '0644'
+  when: application_nginx_src.stat.exists
+
+- name: Render application environment file
+  template:
+    src: "{{ application_env_template }}"
+    dest: "{{ application_stack_dest }}/.env"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: '0600'
+  vars:
+    db_password: "{{ application_db_password }}"
+    db_user: "{{ db_user | default(db_user_default) }}"
+    db_name: "{{ db_name | default(db_name_default) }}"
+    redis_password: "{{ application_redis_password }}"
+    app_domain: "{{ app_domain }}"