D10.5 Swarm Secrets & Configs 🔐

tasks:

  # ── Δημιουργία Swarm secret ───────────────
  - name: "🔐 PostgreSQL password secret"
    community.docker.docker_secret:
      name:  pg_password
      data:  "{{ vault_postgres_pass }}"
      state: present
    delegate_to: manager-01
    no_log:      true

  - name: "🔐 App secret key"
    community.docker.docker_secret:
      name:  app_secret_key
      data:  "{{ vault_app_secret }}"
      state: present
    delegate_to: manager-01
    no_log:      true

  # ── Χρήση σε service ──────────────────────
  - name: "🚀 App service με secret"
    community.docker.docker_swarm_service:
      name:    myapp
      image:   "myapp:{{ app_version }}"
      state:   present
      replicas: 2
      secrets:
        - secret_name: app_secret_key
          filename:    /run/secrets/secret_key    # ← mount path
          uid:         "1000"
          gid:         "1000"
          mode:        0400

tasks:

  # ── Nginx config ───────────────────────────
  - name: "⚙️ Nginx config"
    community.docker.docker_config:
      name:  nginx_conf
      data:  "{{ lookup('template', 'templates/nginx.conf.j2') }}"
      state: present
    delegate_to: manager-01

  # ── Prometheus config ──────────────────────
  - name: "⚙️ Prometheus config"
    community.docker.docker_config:
      name:  prometheus_yml
      data:  "{{ lookup('template', 'templates/prometheus.yml.j2') }}"
      state: present
    delegate_to: manager-01

  # ── Χρήση config σε service ───────────────
  - name: "🌐 Nginx service με config"
    community.docker.docker_swarm_service:
      name:    nginx
      image:   "nginx:1.25-alpine"
      state:   present
      replicas: 3
      configs:
        - config_name: nginx_conf
          filename:    /etc/nginx/nginx.conf
          uid:         "101"
          gid:         "101"
          mode:        0444

tasks:

  # ── Νέο secret με suffix ──────────────────
  - name: "🔄 Rotate secret"
    community.docker.docker_secret:
      name:  "pg_password_v{{ secret_version }}"
      data:  "{{ vault_postgres_pass_new }}"
      state: present
    delegate_to: manager-01
    no_log:      true

  # ── Update service να χρησιμοποιεί νέο ───
  - name: "🔄 Update service με νέο secret"
    community.docker.docker_swarm_service:
      name:    postgres_app
      state:   present
      secrets:
        - secret_name: "pg_password_v{{ secret_version }}"
          filename:    /run/secrets/pg_password
    delegate_to: manager-01
    no_log:      true

  # ── Διαγραφή παλιού ───────────────────────
  - name: "🗑️ Remove old secret"
    community.docker.docker_secret:
      name:  "pg_password_v{{ (secret_version | int) - 1 }}"
      state: absent
    delegate_to: manager-01