michaelschiemer/deployment/ansible/playbooks/deploy-image.yml

---
- name: Deploy Docker Image to Application Stack
  hosts: "{{ deployment_hosts | default('production') }}"
  gather_facts: yes
  become: no

  vars:
    # Application code directory (where docker-compose files are located)
    application_code_dest: "/home/deploy/michaelschiemer/current"
    application_compose_suffix: >-
      {%- if deployment_environment == 'staging' -%}
        staging.yml
      {%- else -%}
        production.yml
      {%- endif -%}
    # Image to deploy (can be overridden via -e image_tag=...)
    image_tag: "{{ image_tag | default('latest') }}"
    docker_registry: "{{ docker_registry | default('registry.michaelschiemer.de') }}"
    app_name_default: "framework"
    # Deployment environment (staging or production)
    deployment_environment: "{{ deployment_environment | default('production') }}"

  tasks:
    - name: Check if vault file exists locally
      stat:
        path: "{{ playbook_dir }}/../secrets/{{ deployment_environment }}.vault.yml"
      delegate_to: localhost
      register: vault_file_stat
      become: no

    - name: Load secrets from vault file if exists
      include_vars:
        file: "{{ playbook_dir }}/../secrets/{{ deployment_environment }}.vault.yml"
      when: vault_file_stat.stat.exists
      no_log: yes
      ignore_errors: yes
      delegate_to: localhost
      become: no

    - name: Set app_name from provided value or default
      ansible.builtin.set_fact:
        app_name: "{{ app_name if (app_name is defined and app_name != '') else app_name_default }}"

    - name: Set deploy_image from registry, app_name and tag
      ansible.builtin.set_fact:
        deploy_image: "{{ docker_registry }}/{{ app_name }}:{{ image_tag }}"

    - name: Set database and MinIO variables from vault or defaults
      ansible.builtin.set_fact:
        db_username: "{{ db_username | default(vault_db_user | default('postgres')) }}"
        db_password: "{{ db_password | default(vault_db_password | default('')) }}"
        minio_root_user: "{{ minio_root_user | default(vault_minio_root_user | default('minioadmin')) }}"
        minio_root_password: "{{ minio_root_password | default(vault_minio_root_password | default('')) }}"
        secrets_dir: "{{ secrets_dir | default('./secrets') }}"
      no_log: yes

    - name: Determine Docker registry password from vault or extra vars
      ansible.builtin.set_fact:
        registry_password: >-
          {%- if docker_registry_password is defined and docker_registry_password | string | trim != '' -%}
            {{ docker_registry_password }}
          {%- elif vault_docker_registry_password is defined and vault_docker_registry_password | string | trim != '' -%}
            {{ vault_docker_registry_password }}
          {%- else -%}
            {{ '' }}
          {%- endif -%}
      no_log: yes

    - name: Check if registry is accessible
      ansible.builtin.uri:
        url: "https://{{ docker_registry }}/v2/"
        method: GET
        status_code: [200, 401]
        timeout: 5
        validate_certs: no
      register: registry_check
      ignore_errors: yes
      delegate_to: "{{ inventory_hostname }}"
      become: no

    - name: Set registry accessible flag
      ansible.builtin.set_fact:
        registry_accessible: >-
          {%- if registry_check.status is defined and registry_check.status | int in [200, 401] -%}
            true
          {%- else -%}
            false
          {%- endif -%}

    - name: Login to Docker registry
      community.docker.docker_login:
        registry_url: "{{ docker_registry }}"
        username: "{{ docker_registry_username | default('admin') }}"
        password: "{{ registry_password }}"
      when: 
        - registry_password | string | trim != ''
        - registry_accessible | bool
      no_log: yes
      ignore_errors: yes
      register: docker_login_result

    - name: Pull Docker image
      community.docker.docker_image:
        name: "{{ deploy_image }}"
        source: pull
        pull: true
      when: registry_accessible is defined and registry_accessible | bool
      register: image_pull_result
      ignore_errors: yes
      failed_when: false

    - name: Verify image exists locally
      community.docker.docker_image_info:
        name: "{{ deploy_image }}"
      register: image_info
      failed_when: image_info.failed | default(false)

    - name: Update docker-compose file with new image tag
      ansible.builtin.replace:
        path: "{{ application_code_dest }}/docker-compose.{{ application_compose_suffix }}"
        regexp: '^(\s+image:\s+)({{ docker_registry }}/{{ app_name }}:)(.*)$'
        replace: '\1\2{{ image_tag }}'
      register: compose_update_result
      failed_when: false
      changed_when: compose_update_result.changed | default(false)

    - name: Update docker-compose file with new image (alternative pattern)
      ansible.builtin.replace:
        path: "{{ application_code_dest }}/docker-compose.{{ application_compose_suffix }}"
        regexp: 'image:\s+{{ docker_registry }}/{{ app_name }}:.*'
        replace: 'image: {{ deploy_image }}'
      register: compose_update_alt
      when: compose_update_result.changed == false
      failed_when: false
      changed_when: compose_update_alt.changed | default(false)

    - name: Ensure Docker networks exist
      community.docker.docker_network:
        name: "{{ item }}"
        state: present
      loop:
        - traefik-public
        - app-internal
      ignore_errors: yes

    - name: Check if .env file exists
      stat:
        path: "{{ application_code_dest }}/.env"
      register: env_file_exists

    - name: Create minimal .env file if it doesn't exist
      copy:
        dest: "{{ application_code_dest }}/.env"
        content: |
          # Minimal .env file for Docker Compose
          # This file should be properly configured by the application setup playbook
          DB_USERNAME={{ db_username | default('postgres') }}
          DB_PASSWORD={{ db_password | default('') }}
          MINIO_ROOT_USER={{ minio_root_user | default('minioadmin') }}
          MINIO_ROOT_PASSWORD={{ minio_root_password | default('') }}
          SECRETS_DIR={{ secrets_dir | default('./secrets') }}
        mode: '0600'
      when: not env_file_exists.stat.exists
      become: yes

    - name: Deploy application stack with new image
      shell: |
        cd {{ application_code_dest }}
        docker compose -f docker-compose.base.yml -f docker-compose.{{ application_compose_suffix }} up -d --pull missing --force-recreate --remove-orphans
      register: compose_deploy_result
      changed_when: true
      environment:
        DB_USERNAME: "{{ db_username | default('postgres') }}"
        DB_PASSWORD: "{{ db_password | default('') }}"
        MINIO_ROOT_USER: "{{ minio_root_user | default('minioadmin') }}"
        MINIO_ROOT_PASSWORD: "{{ minio_root_password | default('') }}"
        SECRETS_DIR: "{{ secrets_dir | default('./secrets') }}"

    - name: Wait for containers to start
      ansible.builtin.pause:
        seconds: 15

    - name: Check container status
      shell: |
        cd {{ application_code_dest }}
        docker compose -f docker-compose.base.yml -f docker-compose.{{ application_compose_suffix }} ps
      register: container_status
      changed_when: false

    - name: Display deployment summary
      ansible.builtin.debug:
        msg: |
          ========================================
          Image Deployment Summary
          ========================================
          Image: {{ deploy_image }}
          Tag: {{ image_tag }}
          Environment: {{ deployment_environment }}
          Stack: {{ application_code_dest }}
          Status: SUCCESS
          ========================================
          
          Container Status:
          {{ container_status.stdout | default('Not available') }}
          ========================================