veza/infra/ansible/roles/veza_haproxy_switch/tasks/main.yml

# Atomic blue/green switch. The HAProxy template lives in
# roles/haproxy/templates/haproxy.cfg.j2 — it reads veza_active_color
# to render the right `backup` directives. We re-template, validate,
# atomic-swap, HUP.
#
# Block/rescue: any failure in the four-step sequence restores
# haproxy.cfg from the backup we capture before touching anything.
# That way, an invalid template or a HUP error never leaves HAProxy
# serving from a stale or broken cfg — it stays on whatever was
# active when the role started.
---
- name: Validate inputs
  ansible.builtin.assert:
    that:
      - veza_active_color in ['blue', 'green']
      - veza_release_sha | length == 40
      - veza_env in ['staging', 'prod']
    fail_msg: >-
      veza_haproxy_switch role requires veza_active_color (blue|green),
      veza_release_sha (40-char git SHA), and veza_env (staging|prod).
      Got: color={{ veza_active_color }} sha={{ veza_release_sha }}
      env={{ veza_env | default('UNSET') }}.
    quiet: true
  tags: [veza_haproxy_switch, always]

- name: Ensure veza state dir exists in HAProxy container
  ansible.builtin.file:
    path: "{{ haproxy_state_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0755"
  tags: [veza_haproxy_switch]

- name: Read currently-active color for THIS env (if any)
  ansible.builtin.slurp:
    src: "{{ haproxy_active_color_file }}"
  register: prior_color_raw
  failed_when: false
  changed_when: false
  tags: [veza_haproxy_switch]

- name: Resolve prior_active_color (default blue if no history)
  ansible.builtin.set_fact:
    prior_active_color: >-
      {{ (prior_color_raw.content | b64decode | trim) if prior_color_raw.content is defined
         else 'blue' }}
  tags: [veza_haproxy_switch]

# Read the OTHER env's active color too — the haproxy template renders
# both staging+prod simultaneously, so we need both values in scope.
- name: Read OTHER env's active color
  ansible.builtin.slurp:
    src: "/var/lib/veza/active-color-{{ 'prod' if veza_env == 'staging' else 'staging' }}"
  register: other_color_raw
  failed_when: false
  changed_when: false
  tags: [veza_haproxy_switch]

- name: Build haproxy_active_colors map (current state of every env)
  ansible.builtin.set_fact:
    haproxy_active_colors:
      staging: >-
        {%- if veza_env == 'staging' -%}
          {{ veza_active_color }}
        {%- elif other_color_raw.content is defined -%}
          {{ other_color_raw.content | b64decode | trim }}
        {%- else -%}
          blue
        {%- endif -%}
      prod: >-
        {%- if veza_env == 'prod' -%}
          {{ veza_active_color }}
        {%- elif other_color_raw.content is defined -%}
          {{ other_color_raw.content | b64decode | trim }}
        {%- else -%}
          blue
        {%- endif -%}
  tags: [veza_haproxy_switch]

- name: Switch sequence (block/rescue — restores cfg on any failure)
  block:
    - name: Backup current haproxy.cfg
      ansible.builtin.copy:
        src: "{{ haproxy_cfg_path }}"
        dest: "{{ haproxy_cfg_backup_path }}"
        remote_src: true
        mode: "0640"
      tags: [veza_haproxy_switch]

    - name: Render fresh haproxy.cfg with new active_color
      ansible.builtin.template:
        src: "{{ playbook_dir }}/../roles/haproxy/templates/haproxy.cfg.j2"
        dest: "{{ haproxy_cfg_new_path }}"
        owner: root
        group: haproxy
        mode: "0640"
        validate: "haproxy -f %s -c -q"
      vars:
        # Make absolutely sure the template sees the new color we are
        # switching to — set both names because the older template
        # used `veza_active_color` and a future revision might use
        # `haproxy_active_color`.
        haproxy_active_color: "{{ veza_active_color }}"
      tags: [veza_haproxy_switch]

    - name: Atomic swap — mv haproxy.cfg.new → haproxy.cfg
      ansible.builtin.command: mv -f "{{ haproxy_cfg_new_path }}" "{{ haproxy_cfg_path }}"
      changed_when: true
      tags: [veza_haproxy_switch]

    - name: HUP haproxy (graceful reload, no connection drop)
      ansible.builtin.systemd:
        name: haproxy
        state: reloaded
      tags: [veza_haproxy_switch]
  rescue:
    - name: Restore haproxy.cfg from backup
      ansible.builtin.command: mv -f "{{ haproxy_cfg_backup_path }}" "{{ haproxy_cfg_path }}"
      when: haproxy_cfg_backup_path is file or true  # always try; benign if backup missing
      changed_when: true
      tags: [veza_haproxy_switch]

    - name: HUP haproxy back to the prior config
      ansible.builtin.systemd:
        name: haproxy
        state: reloaded
      failed_when: false
      tags: [veza_haproxy_switch]

    - name: Report the failure
      ansible.builtin.fail:
        msg: >-
          HAProxy switch to color {{ veza_active_color }} (sha
          {{ veza_release_sha[:12] }}) failed — config rolled back
          to the prior state. HAProxy continues serving from
          {{ prior_active_color }}. Inspect the validate step's
          stderr in the playbook output above.

# Success path: persist new active color + history.
- name: Write new active color
  ansible.builtin.copy:
    dest: "{{ haproxy_active_color_file }}"
    content: "{{ veza_active_color }}\n"
    owner: root
    group: root
    mode: "0644"
  tags: [veza_haproxy_switch]

- name: Append to active-color history
  ansible.builtin.lineinfile:
    path: "{{ haproxy_active_color_history }}"
    line: "{{ ansible_date_time.iso8601 }} sha={{ veza_release_sha }} color={{ veza_active_color }} prior={{ prior_active_color }}"
    create: true
    insertbefore: BOF
    mode: "0644"
  tags: [veza_haproxy_switch]

- name: Prune history beyond keep limit
  ansible.builtin.shell: |
    set -e
    if [ -f "{{ haproxy_active_color_history }}" ]; then
      head -n {{ haproxy_active_color_history_keep }} "{{ haproxy_active_color_history }}" > "{{ haproxy_active_color_history }}.tmp"
      mv -f "{{ haproxy_active_color_history }}.tmp" "{{ haproxy_active_color_history }}"
    fi
  args:
    executable: /bin/bash
  changed_when: false
  tags: [veza_haproxy_switch]

- name: Drop the now-stale backup
  ansible.builtin.file:
    path: "{{ haproxy_cfg_backup_path }}"
    state: absent
  tags: [veza_haproxy_switch]