62 lines
1.8 KiB
YAML
62 lines
1.8 KiB
YAML
|
# backend_api role — runtime baseline for the Go API container.
|
||
|
|
# v1.0.9 W4 Day 19 — multi-instance scaffolding. Binary deploy is
|
||
|
|
# explicitly out of scope (Makefile + scp/incus push, NOT Ansible).
|
||
|
|
#
|
||
|
|
# What this role DOES :
|
||
|
|
# - creates the veza-api system user
|
||
|
|
# - lays down /opt/veza/backend-api + /etc/veza + /var/log/veza
|
||
|
|
# - renders a systemd unit pointing at the binary path
|
||
|
|
# - opens port 8080 (no firewall changes ; Incus bridge is
|
||
|
|
# trusted today)
|
||
|
|
#
|
||
|
|
# What this role does NOT do (deliberately) :
|
||
|
|
# - build / copy the Go binary
|
||
|
|
# - render .env (the secrets are managed by ansible-vault outside
|
||
|
|
# the role ; the env file path is referenced here)
|
||
|
|
# - run migrations
|
||
|
|
---
|
||
|
|
- name: Create veza-api system user
|
||
|
|
ansible.builtin.user:
|
||
|
|
name: "{{ backend_api_user }}"
|
||
|
|
system: true
|
||
|
|
shell: /usr/sbin/nologin
|
||
|
|
home: "{{ backend_api_install_dir }}"
|
||
|
|
create_home: true
|
||
|
|
tags: [backend_api, install]
|
||
|
|
|
||
|
|
- name: Ensure install + log directories
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: "{{ item }}"
|
||
|
|
state: directory
|
||
|
|
owner: "{{ backend_api_user }}"
|
||
|
|
group: "{{ backend_api_user }}"
|
||
|
|
mode: "0755"
|
||
|
|
loop:
|
||
|
|
- "{{ backend_api_install_dir }}"
|
||
|
|
- "{{ backend_api_log_dir }}"
|
||
|
|
tags: [backend_api, install]
|
||
|
|
|
||
|
|
- name: Ensure /etc/veza exists for the env file
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: /etc/veza
|
||
|
|
state: directory
|
||
|
|
owner: root
|
||
|
|
group: "{{ backend_api_user }}"
|
||
|
|
mode: "0750"
|
||
|
|
tags: [backend_api, config]
|
||
|
|
|
||
|
|
- name: Render systemd unit
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: veza-backend-api.service.j2
|
||
|
|
dest: /etc/systemd/system/veza-backend-api.service
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0644"
|
||
|
|
notify: Restart veza-backend-api
|
||
|
|
tags: [backend_api, service]
|
||
|
|
|
||
|
|
- name: Reload systemd daemon
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
daemon_reload: true
|
||
|
|
tags: [backend_api, service]
|