feat: implement lab06

.github/workflows/ansible-deploy.yml

@@ -0,0 +1,75 @@
+name: Ansible Deploy Python
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'ansible/playbooks/**'
+      - 'ansible/roles/**'
+      - '.github/workflows/ansible-deploy.yml'
+  pull_request:
+    branches: [master]
+    paths:
+      - 'ansible/**'
+      - '!ansible/docs/**'
+      - '.github/workflows/ansible-deploy.yml'
+
+jobs:
+  lint:
+    name: Ansible Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
+
+      - name: Install dependencies
+        run: pip install ansible ansible-lint
+
+      - name: Create vault password for lint
+        run: echo "empty" > ansible/.vault_pass
+
+      - name: Run ansible-lint
+        run: ansible-lint playbooks/*.yml
+        working-directory: ansible
+
+  deploy:
+    name: Deploy Python App
+    needs: lint
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
+
+      - name: Install Ansible
+        run: pip install ansible
+
+    #   - name: Setup SSH
+    #     run: |
+    #       mkdir -p ~/.ssh
+    #       echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
+    #       chmod 600 ~/.ssh/id_ed25519
+    #       ssh-keyscan -H ${{ secrets.VM_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+
+    #   - name: Create vault password file
+    #     run: echo "${{ secrets.ANSIBLE_VAULT_PASSWORD }}" > /tmp/vault_pass
+
+    #   - name: Run Ansible playbook
+    #     run: |
+    #       ansible-playbook playbooks/deploy_python.yml \
+    #         -i inventory/hosts.ini \
+    #         --vault-password-file /tmp/vault_pass
+    #     working-directory: ansible
+
+    #   - name: Verify deployment
+    #     run: |
+    #       sleep 10
+    #       curl -f http://${{ secrets.VM_HOST }}:5000/health
+
+    #   - name: Cleanup
+    #     if: always()
+    #     run: rm -f /tmp/vault_pass

ansible/ansible.cfg

@@ -9,4 +9,4 @@ vault_password_file = .vault_pass
 [privilege_escalation]
 become = True
 become_method = sudo
-become_user = root
+become_user = root

ansible/docs/LAB06.md

@@ -0,0 +1,78 @@
+# Lab 06
+
+## 1. Overview
+
+All roles refactored with blocks, docker replaced with docker-compose and Jinja2 templates.
+
+Technologies used: Ansible, docker-compose, Jinja2, GItHub Actions.
+
+## 2. Blocks & Tags
+
+### `common` role
+
+`block` installs packages, `rescue` forces cache update and `always` logs completition.
+
+Tags: packages.
+
+### `docker` role
+
+`block` installs docker related packages, `rescue` forces cache update and `always` ensures everything is installed.
+
+Tags: docker_install, docker_config.
+
+### `web_app` role
+
+`block` deploys app and `rescue` logs failure.
+
+Tags: web_app_wipe, web_app_deploy.
+
+### Example run
+
+```text
+$ ansible-playbook playbooks/provision.yml --tags "docker"
+PLAY RECAP
+lab05-server: ok=9  changed=0  (only docker tasks ran, common skipped)
+```
+
+## 3. Docker Compose Migration
+
+### Template structure
+
+Template includes app name, image name, ports, enviroment values and restart policy.
+
+### Role dependencies
+
+`web_app` role depends on `docker` role, since the last one installs essential packages.
+
+### Before/after comparison
+
+Before: manual docker-related calls (like pull, run, stop).
+After: `docker compose up -d --pull always` manages everything.
+
+## 4. Wipe Logic
+
+### Implementation
+
+`wipe.yml` task stops and remove container, removes docker-compose file, removes app directory, removes docker image and logs completition.
+
+### Variable + tag
+
+Controlled by variable `web_app_wipe` (default: `false`) and tag `web_app_wipe`.
+
+### Test results
+
+```text
+$ ansible-playbook playbooks/deploy_python.yml -e "web_app_wipe=true" --tags web_app_wipe
+TASK [web_app : Stop and remove containers]   changed
+TASK [web_app : Remove docker-compose file]   changed
+TASK [web_app : Remove app directory]         changed
+TASK [web_app : Remove Docker image]          changed
+TASK [web_app : Log wipe completion]          "Application devops-python wiped successfully"
+PLAY RECAP: ok=7  changed=4
+```
+
+## 5. CI/CD Integration
+
+### Workflow architecture
+
+Workflow should deploy app on push to `master` branch. Workflow has 2 jobs: lint and deploy. Workflow triggers only if ansible-related thing changed or workflow.

ansible/inventory/hosts.ini

@@ -2,4 +2,4 @@
 lab05-server ansible_host=84.252.129.211 ansible_user=ubuntu ansible_ssh_private_key_file=~/.ssh/id_rsa
 
 [webservers:vars]
-ansible_python_interpreter=/usr/bin/python3
+ansible_python_interpreter=/usr/bin/python3

ansible/playbooks/deploy.yml

@@ -4,4 +4,4 @@
   become: true
 
   roles:
-    - app_deploy
+    - web_app

ansible/playbooks/provision.yml

@@ -5,4 +5,4 @@
 
   roles:
     - common
-    - docker
+    - docker

ansible/playbooks/site.yml

@@ -1,3 +1,9 @@
 ---
-- import_playbook: provision.yml
-- import_playbook: deploy.yml
+- name: Full site setup
+  hosts: webservers
+  become: true
+
+  roles:
+    - common
+    - docker
+    - web_app

ansible/roles/common/defaults/main.yml

@@ -2,4 +2,4 @@ common_packages:
   - python3-pip
   - curl
   - git
-  - nano
+  - nano

ansible/roles/common/tasks/main.yml

@@ -1,10 +1,33 @@
 ---
-- name: Update apt cache
-  apt:
-    update_cache: yes
-    cache_valid_time: 3600
-
-- name: Install common packages
-  apt:
-    name: "{{ common_packages }}"
-    state: present
+- name: Install system packages
+  become: true
+  tags:
+    - packages
+  block:
+    - name: Update apt cache
+      ansible.builtin.apt:
+        update_cache: true
+        cache_valid_time: 3600
+
+    - name: Install common packages
+      ansible.builtin.apt:
+        name: "{{ common_packages }}"
+        state: present
+
+  rescue:
+    - name: Force update cache
+      ansible.builtin.apt:
+        update_cache: true
+        force: true
+
+    - name: Retry package installation
+      ansible.builtin.apt:
+        name: "{{ common_packages }}"
+        state: present
+
+  always:
+    - name: Log package setup completion
+      ansible.builtin.copy:
+        content: "Common packages provisioned at {{ ansible_date_time.iso8601 }}\n"
+        dest: /tmp/ansible_common_done.log
+        mode: '0644'

ansible/roles/docker/defaults/main.yml

@@ -7,4 +7,4 @@ docker_packages:
   - docker-buildx-plugin
   - docker-compose-plugin
 
-docker_repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
+docker_repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"

ansible/roles/docker/handlers/main.yml

@@ -1,5 +1,5 @@
 ---
-- name: restart docker
-  service:
+- name: Restart docker
+  ansible.builtin.service:
     name: docker
-    state: restarted
+    state: restarted