D5.4 Registry στο Workflow 🔄

mkdir -p ~/ansible/roles/app_publish/tasks

cat > ~/ansible/roles/app_publish/tasks/main.yml << 'EOF'
---
# ============================================================
# App Publish Role
# Build → Tag → Push → Private Registry
# ============================================================

# ── Pre-checks ────────────────────────────────
- name: Verify app version defined
  ansible.builtin.assert:
    that:
      - app_version is defined
      - app_version | length > 0
    fail_msg: "❌ app_version is required!"

- name: Verify build directory exists
  ansible.builtin.stat:
    path: "{{ app_build_dir }}"
  register: build_dir_stat

- name: Assert build directory exists
  ansible.builtin.assert:
    that:
      - build_dir_stat.stat.exists
      - build_dir_stat.stat.isdir
    fail_msg: "❌ Build directory not found: {{ app_build_dir }}"

# ── Build ─────────────────────────────────────
- name: Build Docker image
  community.docker.docker_image:
    name:   "{{ app_name }}"
    tag:    "{{ app_version }}"
    source: build
    build:
      path:    "{{ app_build_dir }}"
      pull:    true
      nocache: "{{ docker_build_nocache | default(false) }}"
      args:
        APP_VERSION: "{{ app_version }}"
        BUILD_DATE:  "{{ ansible_facts['date_time']['date'] }}"
        GIT_COMMIT:  "{{ git_commit | default('unknown') }}"
  register: build_result

- name: Build result
  ansible.builtin.debug:
    msg: "✅ Built: {{ app_name }}:{{ app_version }} ({{ build_result.image.Id[:12] }})"

# ── Tag ───────────────────────────────────────
- name: Tag image για registry
  community.docker.docker_image:
    name:       "{{ app_name }}:{{ app_version }}"
    repository: "{{ registry_hostname }}:{{ registry_ext_port }}/{{ app_name }}"
    tag:        "{{ item }}"
    source:     local
  loop:
    - "{{ app_version }}"
    - latest
  loop_control:
    label: "{{ registry_hostname }}:{{ registry_ext_port }}/{{ app_name }}:{{ item }}"

# ── Login ─────────────────────────────────────
- name: Login στο private registry
  community.docker.docker_login:
    registry_url: "https://{{ registry_hostname }}:{{ registry_ext_port }}"
    username:     "{{ registry_deploy_user }}"
    password:     "{{ vault_registry_user_pass }}"
    tls_verify:   false
  no_log: true
  register: reg_login

# ── Push ──────────────────────────────────────
- name: Push image στο registry
  community.docker.docker_image:
    name:       "{{ registry_hostname }}:{{ registry_ext_port }}/{{ app_name }}"
    tag:        "{{ item }}"
    source:     local
    push:       true
    tls_verify: false
  loop:
    - "{{ app_version }}"
    - latest
  loop_control:
    label: "{{ registry_hostname }}:{{ registry_ext_port }}/{{ app_name }}:{{ item }}"
  register: push_result

- name: Push result
  ansible.builtin.debug:
    msg: "✅ Pushed: {{ registry_hostname }}:{{ registry_ext_port }}/{{ app_name }}:{{ item }}"
  loop:
    - "{{ app_version }}"
    - latest

# ── Logout ────────────────────────────────────
- name: Logout από registry
  community.docker.docker_login:
    registry_url: "https://{{ registry_hostname }}:{{ registry_ext_port }}"
    username:     "{{ registry_deploy_user }}"
    state:        absent
  no_log: true

# ── Cleanup local build image ─────────────────
- name: Remove local build image
  community.docker.docker_image:
    name:         "{{ app_name }}"
    tag:          "{{ app_version }}"
    state:        absent
    force_absent: true
  when: docker_cleanup_after_push | default(true)
EOF

mkdir -p ~/ansible/roles/app_deploy/tasks

cat > ~/ansible/roles/app_deploy/tasks/main.yml << 'EOF'
---
# ============================================================
# App Deploy Role
# Pull from Registry → Deploy → Verify
# ============================================================

# ── Pre-deploy backup ─────────────────────────
- name: Get current container version
  community.docker.docker_container_info:
    name: "{{ app_name }}"
  register: current_container
  ignore_errors: true

- name: Save current version
  ansible.builtin.set_fact:
    previous_image: >-
      {{ current_container.container.Config.Image
         if current_container.exists
         else 'none' }}
  when: current_container is not failed

- name: Show current version
  ansible.builtin.debug:
    msg: "Current: {{ previous_image | default('none') }}"

# ── Trust registry certificate ────────────────
- name: Ensure registry cert directory exists
  ansible.builtin.file:
    path:  "/etc/docker/certs.d/{{ registry_hostname }}:{{ registry_ext_port }}"
    state: directory
    mode:  '0755'

- name: Fetch registry certificate
  ansible.builtin.command:
    cmd: >
      openssl s_client
      -connect {{ registry_hostname }}:{{ registry_ext_port }}
      -showcerts </dev/null 2>/dev/null
      | openssl x509 -outform PEM
  register:     registry_cert
  changed_when: false
  ignore_errors: true

- name: Install registry certificate
  ansible.builtin.copy:
    content: "{{ registry_cert.stdout }}"
    dest:    "/etc/docker/certs.d/{{ registry_hostname }}:{{ registry_ext_port }}/ca.crt"
    mode:    '0644'
  when: not registry_cert.failed

# ── Login ─────────────────────────────────────
- name: Login στο registry
  community.docker.docker_login:
    registry_url: "https://{{ registry_hostname }}:{{ registry_ext_port }}"
    username:     "{{ registry_deploy_user }}"
    password:     "{{ vault_registry_user_pass }}"
    tls_verify:   false
  no_log: true

# ── Pull new image ────────────────────────────
- name: Pull new image
  community.docker.docker_image:
    name:         "{{ registry_hostname }}:{{ registry_ext_port }}/{{ app_name }}"
    tag:          "{{ app_version }}"
    source:       pull
    force_source: true
    tls_verify:   false
  register: pull_result

- name: Pull result
  ansible.builtin.debug:
    msg: "✅ Pulled: {{ registry_hostname }}:{{ registry_ext_port }}/{{ app_name }}:{{ app_version }}"

# ── Logout ────────────────────────────────────
- name: Logout από registry
  community.docker.docker_login:
    registry_url: "https://{{ registry_hostname }}:{{ registry_ext_port }}"
    username:     "{{ registry_deploy_user }}"
    state:        absent
  no_log: true

# ── Stop old container ────────────────────────
- name: Stop old container
  community.docker.docker_container:
    name:  "{{ app_name }}"
    state: stopped
  when:
    - current_container is not failed
    - current_container.exists
  ignore_errors: true

# ── Deploy new container ──────────────────────
- name: Deploy new container
  community.docker.docker_container:
    name:           "{{ app_name }}"
    image:          "{{ registry_hostname }}:{{ registry_ext_port }}/{{ app_name }}:{{ app_version }}"
    state:          started
    restart_policy: unless-stopped
    recreate:       true
    ports:          "{{ app_ports | default([]) }}"
    env:            "{{ app_env_vars | default({}) }}"
    volumes:        "{{ app_volumes | default([]) }}"
    networks:       "{{ app_networks | default([]) }}"
    memory:         "{{ app_memory  | default('256m') }}"
    cpus:           "{{ app_cpus    | default('0.5') }}"
    labels:
      app:         "{{ app_name }}"
      version:     "{{ app_version }}"
      deployed-at: "{{ ansible_facts['date_time']['iso8601'] }}"
      deployed-by: ansible
    log_driver: json-file
    log_options:
      max-size: "10m"
      max-file: "3"
    healthcheck:
      test:         "{{ app_healthcheck | default(['CMD-SHELL', 'exit 0']) }}"
      interval:     30s
      timeout:      10s
      retries:      3
      start_period: 30s
  no_log: "{{ app_env_vars is defined and app_env_vars | length > 0 }}"
  register: deploy_result

# ── Wait for healthy ──────────────────────────
- name: Wait for container to be healthy
  community.docker.docker_container_info:
    name: "{{ app_name }}"
  register: health_check
  until: >
    health_check.container is defined and
    health_check.container.State.Running == true and
    (health_check.container.State.Health is not defined or
     health_check.container.State.Health.Status in ['healthy', 'starting'])
  retries: 12
  delay:   5

# ── Verify HTTP ───────────────────────────────
- name: HTTP health check
  ansible.builtin.uri:
    url:         "{{ app_health_url | default('http://localhost/health') }}"
    status_code: 200
    timeout:     30
  register:      http_check
  retries:       5
  delay:         5
  ignore_errors: true

# ── Rollback αν failed ────────────────────────
- name: Rollback αν deploy failed
  community.docker.docker_container:
    name:     "{{ app_name }}"
    image:    "{{ previous_image }}"
    state:    started
    recreate: true
  when:
    - http_check.failed
    - previous_image is defined
    - previous_image != 'none'
  register: rollback_result

- name: Rollback notification
  ansible.builtin.debug:
    msg: "⚠️ ROLLBACK to {{ previous_image }}!"
  when:
    - http_check.failed
    - rollback_result is not skipped

# ── Cleanup old images ────────────────────────
- name: Remove dangling images
  community.docker.docker_prune:
    images:         true
    images_filters:
      dangling: true
  when: not http_check.failed

# ── Deploy report ─────────────────────────────
- name: Deploy report
  ansible.builtin.debug:
    msg:
      - "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
      - "{{ '✅ DEPLOY OK' if not http_check.failed else '❌ DEPLOY FAILED — ROLLED BACK' }}"
      - "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
      - "App    : {{ app_name }}"
      - "Version: {{ app_version }}"
      - "Host   : {{ inventory_hostname }}"
      - "Status : {{ health_check.container.State.Status }}"
      - "HTTP   : {{ '✅ OK' if not http_check.failed else '❌ Failed' }}"
      - "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
EOF

cat > ~/ansible/playbooks/registry-workflow.yml << 'EOF'
---
# ============================================================
# Full Registry Workflow
# Build → Push → Deploy
# Χρήση: ansible-playbook registry-workflow.yml
#         -e "workflow=build_push" -e "app_version=2.0.0"
#     ή: -e "workflow=deploy"     -e "app_version=2.0.0"
#     ή: -e "workflow=full"       -e "app_version=2.0.0"
# ============================================================

# ════════════════════════════════════════════
# PLAY 1: BUILD & PUSH (στον controller)
# ════════════════════════════════════════════
- name: Build & Push Application Image
  hosts: "{{ build_host | default('localhost') }}"
  become: false
  gather_facts: true

  vars:
    workflow:            "{{ workflow | default('full') }}"
    app_name:            myapp
    app_version:         "{{ app_version | default('1.0.0') }}"
    app_build_dir:       "/opt/{{ app_name }}/src"
    registry_hostname:   nextcloud
    registry_ext_port:   443
    registry_deploy_user: deploy

  tasks:

    - name: Build & Push info
      ansible.builtin.debug:
        msg:
          - "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          - "Phase: BUILD & PUSH"
          - "App  : {{ app_name }}:{{ app_version }}"
          - "Registry: {{ registry_hostname }}:{{ registry_ext_port }}"
          - "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
      tags: always

    - name: Build & Push image
      ansible.builtin.import_role:
        name: app_publish
      when: workflow in ['build_push', 'full']
      tags: [build, push]

# ════════════════════════════════════════════
# PLAY 2: DEPLOY (στους servers)
# ════════════════════════════════════════════
- name: Deploy Application
  hosts: "{{ target | default('all_managed') }}"
  become: true
  gather_facts: true
  serial: "{{ deploy_serial | default(1) }}"    # ← rolling update!

  vars:
    workflow:            "{{ workflow | default('full') }}"
    app_name:            myapp
    app_version:         "{{ app_version | default('1.0.0') }}"
    registry_hostname:   nextcloud
    registry_ext_port:   443
    registry_deploy_user: deploy

    # ── App configuration ─────────────────────
    app_ports:
      - "8080:8080"

    app_env_vars:
      NODE_ENV:    production
      APP_VERSION: "{{ app_version }}"
      PORT:        "8080"

    app_volumes:
      - "{{ app_name }}_data:/app/data"

    app_networks:
      - name: app_network

    app_memory: "256m"
    app_cpus:   "0.5"

    app_healthcheck:
      - CMD-SHELL
      - "wget -q -O /dev/null http://localhost:8080/health || exit 1"

    app_health_url: "http://localhost:8080/health"

  pre_tasks:

    - name: Deploy info
      ansible.builtin.debug:
        msg:
          - "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          - "Phase: DEPLOY"
          - "Host : {{ inventory_hostname }}"
          - "App  : {{ app_name }}:{{ app_version }}"
          - "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
      tags: always

    - name: Create app network
      community.docker.docker_network:
        name:  app_network
        state: present
      tags: setup

    - name: Create app volume
      community.docker.docker_volume:
        name:  "{{ app_name }}_data"
        state: present
      tags: setup

  tasks:

    - name: Deploy application
      ansible.builtin.import_role:
        name: app_deploy
      when: workflow in ['deploy', 'full']
      tags: deploy

  post_tasks:

    - name: Final status
      ansible.builtin.command:
        cmd: "docker ps --filter name={{ app_name }} --format '{{ '{{' }}.Names{{ '}}' }}\t{{ '{{' }}.Status{{ '}}' }}\t{{ '{{' }}.Image{{ '}}' }}'"
      register:     final_status
      changed_when: false
      tags: always

    - name: Show final status
      ansible.builtin.debug:
        msg: "{{ final_status.stdout_lines }}"
      tags: always

# ════════════════════════════════════════════
# PLAY 3: VERIFY ALL
# ════════════════════════════════════════════
- name: Verify All Deployments
  hosts: "{{ target | default('all_managed') }}"
  become: true
  gather_facts: false

  vars:
    app_name:    myapp
    app_version: "{{ app_version | default('1.0.0') }}"

  tasks:

    - name: Verify all servers
      ansible.builtin.uri:
        url:         "http://localhost:8080/health"
        status_code: 200
      register:      verify_check
      ignore_errors: true
      tags: verify

    - name: Final verification report
      ansible.builtin.debug:
        msg:
          - "╔══════════════════════════════════════╗"
          - "║   DEPLOYMENT VERIFICATION            ║"
          - "╠══════════════════════════════════════╣"
          - "║ Host   : {{ inventory_hostname }}"
          - "║ App    : {{ app_name }}:{{ app_version }}"
          - "║ Status : {{ '✅ OK' if not verify_check.failed else '❌ FAILED' }}"
          - "╚══════════════════════════════════════╝"
      tags: always
EOF

# ── Full workflow (build + push + deploy) ──────
ansible-playbook playbooks/registry-workflow.yml \
    --limit nextcloud \
    -e "workflow=full" \
    -e "app_version=2.0.0" \
    -v

# ── Μόνο build & push ─────────────────────────
ansible-playbook playbooks/registry-workflow.yml \
    -e "workflow=build_push" \
    -e "app_version=2.0.0" \
    --tags "build,push"

# ── Μόνο deploy ───────────────────────────────
ansible-playbook playbooks/registry-workflow.yml \
    --limit nextcloud \
    -e "workflow=deploy" \
    -e "app_version=2.0.0" \
    --tags deploy

# ── Rolling update (serial=1) ─────────────────
ansible-playbook playbooks/registry-workflow.yml \
    -e "workflow=full" \
    -e "app_version=2.0.0" \
    -e "deploy_serial=1"

# ── Dry run ───────────────────────────────────
ansible-playbook playbooks/registry-workflow.yml \
    --limit nextcloud \
    -e "workflow=deploy" \
    -e "app_version=2.0.0" \
    --check --diff