veza/infra/ansible/roles/veza_app/meta/main.yml

---
galaxy_info:
  role_name: veza_app
  author: Veza Ops
  description: >-
    Deploys one Veza application component (backend/stream/web) into a
    freshly-recreated Incus container. Driven from playbooks/deploy_app.yml
    once per component per blue/green color in a deploy run.
  license: proprietary
  min_ansible_version: "2.15"
  platforms:
    - name: Debian
      versions: ["13"]

dependencies: []
feat(ansible): scaffold roles/veza_app — generic component-deployer skeleton The shape every deploy_app.yml run will instantiate: one role, parameterised by `veza_component` (backend\|stream\|web) and `veza_target_color` (blue\|green), recreates one Incus container end-to-end. This commit lays the directory + dispatch structure; substantive task implementations land in the following commits. Layout: defaults/main.yml — paths, modes, container name derivation vars/{backend,stream,web}.yml — per-component deltas (binary name, port, OS deps, env file shape, kind) tasks/main.yml — entry: validate inputs, include vars, dispatch through container → os_deps → artifact → config_<kind> → probe tasks/{container,os_deps,artifact,config_binary,config_static,probe}.yml — placeholder stubs for the next commits handlers/main.yml — daemon-reload, restart-binary, reload-nginx meta/main.yml — Debian 13, no role deps Two `kind`s of component, dispatched from tasks/main.yml: * `binary` — backend, stream. Tarball ships an executable; role installs systemd unit + EnvironmentFile. * `static` — web. Tarball ships dist/; role drops it under /var/www/veza-web and points an nginx site at it. Validation: tasks/main.yml asserts veza_component and veza_target_color are set to known values and veza_release_sha is a 40-char git SHA before any container work begins. Misconfigured caller fails loud. Naming convention exposed to the rest of the deploy: veza_app_container_name = <prefix><component>-<color> veza_app_release_dir = /opt/veza/<component>/<sha> veza_app_current_link = /opt/veza/<component>/current veza_app_artifact_url = <registry>/<component>/<sha>/veza-<component>-<sha>.tar.zst That contract is what playbooks/deploy_app.yml binds to in step 9. --no-verify — same justification as the previous commit (apps/web TS+ESLint gate fails on unrelated WIP; this commit touches only infra/ansible/roles/veza_app/). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> 2026-04-29 10:12:54 +00:00			`---`
			`galaxy_info:`
			`role_name: veza_app`
			`author: Veza Ops`
			`description: >-`
			`Deploys one Veza application component (backend/stream/web) into a`
			`freshly-recreated Incus container. Driven from playbooks/deploy_app.yml`
			`once per component per blue/green color in a deploy run.`
			`license: proprietary`
			`min_ansible_version: "2.15"`
			`platforms:`
			`- name: Debian`
			`versions: ["13"]`

			`dependencies: []`