updates

roles/app-deploy/tasks/django.yml

@@ -0,0 +1,88 @@
+---
+# Deploy one Django app+env as its own docker compose project.
+# Called per item with loop_var app_item = { name, env, port }.
+
+- name: "django[{{ app_item.name }}/{{ app_item.env }}] locals"
+  ansible.builtin.set_fact:
+    _spec: "{{ app_catalog[app_item.name] }}"
+    _src: "{{ apps_src_dir }}/{{ app_item.name }}_{{ app_item.env }}"
+    _envfile: "{{ apps_env_dir }}/{{ app_item.name }}_{{ app_item.env }}.env"
+    _secret_src: "{{ secrets_dir }}/{{ app_item.name }}/{{ app_item.name }}_{{ app_item.env }}.env"
+    _project: "{{ app_item.name }}_{{ app_item.env }}"
+    _ref: "{{ app_ref | default(app_catalog[app_item.name].default_branch) }}"
+
+- name: "django[{{ _project }}] ensure base dirs"
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ admin_user }}"
+    group: "{{ admin_user }}"
+    mode: "0750"
+  loop:
+    - "{{ apps_src_dir }}"
+    - "{{ apps_env_dir }}"
+
+- name: "django[{{ _project }}] check local secret exists"
+  ansible.builtin.stat:
+    path: "{{ _secret_src }}"
+  register: _secret_stat
+  delegate_to: localhost
+  become: false
+
+- name: "django[{{ _project }}] fail when local secret missing"
+  ansible.builtin.fail:
+    msg: >-
+      Missing local secret {{ _secret_src }} on the control node.
+      Create it (DATABASE_URL to the shared external Postgres, DJANGO_SECRET_KEY,
+      WEB_PORT={{ app_item.port }}, etc.) before deploying. It is never committed
+      to git.
+  when: not _secret_stat.stat.exists
+
+- name: "django[{{ _project }}] push secret to {{ _envfile }}"
+  ansible.builtin.copy:
+    src: "{{ _secret_src }}"
+    dest: "{{ _envfile }}"
+    owner: "{{ admin_user }}"
+    group: "{{ admin_user }}"
+    mode: "0600"
+
+- name: "django[{{ _project }}] checkout {{ _ref }}"
+  ansible.builtin.git:
+    repo: "{{ _spec.repo }}"
+    dest: "{{ _src }}"
+    version: "{{ _ref }}"
+    force: true
+    accept_hostkey: true
+  become: true
+  become_user: "{{ admin_user }}"
+
+- name: "django[{{ _project }}] install .env into checkout"
+  ansible.builtin.copy:
+    src: "{{ _envfile }}"
+    dest: "{{ _src }}/.env"
+    remote_src: true
+    owner: "{{ admin_user }}"
+    group: "{{ admin_user }}"
+    mode: "0600"
+
+- name: "django[{{ _project }}] build images"
+  ansible.builtin.command:
+    cmd: "docker compose -f {{ _spec.compose_file }} --env-file .env build"
+    chdir: "{{ _src }}"
+  environment:
+    COMPOSE_PROJECT_NAME: "{{ _project }}"
+    WEB_PORT: "{{ app_item.port }}"
+  become: true
+  become_user: "{{ admin_user }}"
+  changed_when: true
+
+- name: "django[{{ _project }}] start containers"
+  ansible.builtin.command:
+    cmd: "docker compose -f {{ _spec.compose_file }} --env-file .env up -d --remove-orphans"
+    chdir: "{{ _src }}"
+  environment:
+    COMPOSE_PROJECT_NAME: "{{ _project }}"
+    WEB_PORT: "{{ app_item.port }}"
+  become: true
+  become_user: "{{ admin_user }}"
+  changed_when: true

roles/app-deploy/tasks/main.yml

@@ -1,9 +1,56 @@
 ---
-# Stub — implement after company_site is dockerized.
-# Interim: can rsync/systemd like company_site/scripts/deploy.sh
+# Generic app deployment.
+#
+# CI passes: app=<name> app_env=<beta|prod> app_ref=<git sha>
+# Manual run with none of those redeploys every app in this host's host_apps
+# at branch master.
+#
+# host_apps (host_vars) lists what runs on THIS host; app_catalog (group_vars)
+# describes how each app is built.
 
-- name: App deploy not yet implemented
+- name: Classify catalog by type
+  ansible.builtin.set_fact:
+    django_names: "{{ app_catalog | dict2items | selectattr('value.type', 'equalto', 'django') | map(attribute='key') | list }}"
+    node_names: "{{ app_catalog | dict2items | selectattr('value.type', 'equalto', 'node-static') | map(attribute='key') | list }}"
+
+- name: Resolve deploy targets for {{ inventory_hostname }}
+  ansible.builtin.set_fact:
+    deploy_targets: >-
+      {{ (host_apps | default([]) | selectattr('name', 'equalto', app | default('')) | selectattr('env', 'equalto', app_env | default('')) | list)
+         if (app is defined and app_env is defined)
+         else (host_apps | default([])) }}
+
+- name: Show deploy targets
   ansible.builtin.debug:
-    msg: >-
-      app-deploy role is a stub. Set app_ref={{ app_ref | default('unset') }}.
-      Implement git pull / docker compose after dockerize ticket.
+    msg: "ref={{ app_ref | default('(per-app default branch)') }} targets={{ deploy_targets | map(attribute='name') | zip(deploy_targets | map(attribute='env')) | list }}"
+
+- name: Deploy Django (docker compose) apps
+  ansible.builtin.include_tasks: django.yml
+  loop: "{{ deploy_targets | selectattr('name', 'in', django_names) | list }}"
+  loop_control:
+    loop_var: app_item
+    label: "{{ app_item.name }}/{{ app_item.env }}"
+
+- name: Run Django migrations once (shared external DB)
+  ansible.builtin.command:
+    cmd: >-
+      docker compose -f {{ app_catalog[item.name].compose_file }} --env-file .env
+      exec -T {{ app_catalog[item.name].web_service }}
+      {{ app_catalog[item.name].migrate_cmd }}
+    chdir: "{{ apps_src_dir }}/{{ item.name }}_{{ item.env }}"
+  environment:
+    COMPOSE_PROJECT_NAME: "{{ item.name }}_{{ item.env }}"
+  loop: "{{ deploy_targets | selectattr('name', 'in', django_names) | list }}"
+  loop_control:
+    label: "{{ item.name }}/{{ item.env }}"
+  become: true
+  become_user: "{{ admin_user }}"
+  run_once: true
+  changed_when: true
+
+- name: Deploy node static apps
+  ansible.builtin.include_tasks: node_static.yml
+  loop: "{{ deploy_targets | selectattr('name', 'in', node_names) | list }}"
+  loop_control:
+    loop_var: app_item
+    label: "{{ app_item.name }}/{{ app_item.env }}"

roles/app-deploy/tasks/node_static.yml

@@ -0,0 +1,53 @@
+---
+# Build one node/vite static site into {{ web_static_root }}/<env>_<app>.
+# Called per item with loop_var app_item = { name, env, port }.
+# The app's own `npm run build:<env>` script is expected to output to
+# {{ web_static_root }}/<env>_dta_webapp.
+
+- name: "static[{{ app_item.name }}/{{ app_item.env }}] locals"
+  ansible.builtin.set_fact:
+    _spec: "{{ app_catalog[app_item.name] }}"
+    _src: "{{ apps_src_dir }}/{{ app_item.name }}_{{ app_item.env }}"
+    _webroot: "{{ (app_catalog[app_item.name].webroot_pattern | default(web_static_root ~ '/{env}_' ~ app_item.name)) | replace('{env}', app_item.env) }}"
+    _ref: "{{ app_ref | default(app_catalog[app_item.name].default_branch) }}"
+
+- name: "static[{{ app_item.name }}/{{ app_item.env }}] workdir"
+  ansible.builtin.set_fact:
+    _workdir: "{{ (_src ~ '/' ~ _spec.subdir) if (_spec.subdir | default('')) else _src }}"
+
+- name: "static[{{ app_item.name }}/{{ app_item.env }}] ensure dirs"
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ admin_user }}"
+    group: "{{ admin_user }}"
+    mode: "0755"
+  loop:
+    - "{{ apps_src_dir }}"
+    - "{{ _webroot }}"
+
+- name: "static[{{ app_item.name }}/{{ app_item.env }}] checkout {{ _ref }}"
+  ansible.builtin.git:
+    repo: "{{ _spec.repo }}"
+    dest: "{{ _src }}"
+    version: "{{ _ref }}"
+    force: true
+    accept_hostkey: true
+  become: true
+  become_user: "{{ admin_user }}"
+
+- name: "static[{{ app_item.name }}/{{ app_item.env }}] npm ci"
+  ansible.builtin.command:
+    cmd: npm ci
+    chdir: "{{ _workdir }}"
+  become: true
+  become_user: "{{ admin_user }}"
+  changed_when: true
+
+- name: "static[{{ app_item.name }}/{{ app_item.env }}] build ({{ app_item.env }})"
+  ansible.builtin.command:
+    cmd: "npm run build:{{ app_item.env }}"
+    chdir: "{{ _workdir }}"
+  become: true
+  become_user: "{{ admin_user }}"
+  changed_when: true