Error Handling

# ignore_errors: true — continue the play even if this task fails
# Use ONLY when a failure is expected and explicitly handled below
- name: Stop application (may not be running on first deploy)
  ansible.builtin.service:
    name: myapp
    state: stopped
  ignore_errors: true              # app might not exist yet — that is fine

- name: Start fresh application deployment
  ansible.builtin.command:
    cmd: /usr/local/bin/deploy.sh
  # This task runs regardless of whether the stop task above succeeded

---
# failed_when — redefine what "failure" means for a specific task
# Use when the module's default failure detection doesn't match your intent

# grep exits 1 when no match found — not actually a failure in this context
- name: Check whether the app process is running
  ansible.builtin.command:
    cmd: pgrep -f myapp
  register: process_check
  failed_when: process_check.rc > 1    # rc=0: found, rc=1: not found (ok), rc>1: real error
  changed_when: false

# Custom failure condition based on output content
- name: Run database migration
  ansible.builtin.command:
    cmd: python manage.py migrate --no-input
  register: migration_result
  failed_when: >
    migration_result.rc != 0 or
    'ERROR' in migration_result.stderr

---
- name: Deploy application with rollback on failure
  hosts: appservers
  become: true

  tasks:
    - name: Run deployment with error handling
      block:
        # All tasks in block run sequentially
        - name: Back up current application
          ansible.builtin.copy:
            src: "{{ deploy_dir }}/current/"
            dest: "{{ deploy_dir }}/rollback_backup/"
            remote_src: true

        - name: Deploy new application version
          ansible.builtin.unarchive:
            src: "{{ release_archive }}"
            dest: "{{ deploy_dir }}/releases/{{ version }}"
            remote_src: false

        - name: Update current symlink to new release
          ansible.builtin.file:
            src: "{{ deploy_dir }}/releases/{{ version }}"
            dest: "{{ deploy_dir }}/current"
            state: link
            force: true

        - name: Run database migrations
          ansible.builtin.command:
            cmd: python manage.py migrate --no-input
            chdir: "{{ deploy_dir }}/current"
          register: migration_result

        - name: Restart application service
          ansible.builtin.service:
            name: myapp
            state: restarted

      rescue:
        # Only runs if ANY task in block fails
        - name: Log the deployment failure
          ansible.builtin.debug:
            msg: "Deployment failed! Rolling back to previous version."

        - name: Restore previous release symlink
          ansible.builtin.file:
            src: "{{ deploy_dir }}/rollback_backup/"
            dest: "{{ deploy_dir }}/current"
            state: link
            force: true

        - name: Restart application with previous version
          ansible.builtin.service:
            name: myapp
            state: restarted

        - name: Send failure notification
          ansible.builtin.uri:
            url: "{{ slack_webhook_url }}"
            method: POST
            body_format: json
            body:
              text: "Deployment of {{ version }} FAILED on {{ inventory_hostname }}"

      always:
        # Runs regardless of success or failure
        - name: Clean up temporary deployment files
          ansible.builtin.file:
            path: "{{ deploy_dir }}/tmp_deploy"
            state: absent

        - name: Record deployment outcome
          ansible.builtin.lineinfile:
            path: /var/log/deploy_history.log
            line: "{{ ansible_date_time.iso8601 }} — {{ version }} — {{ 'SUCCESS' if not ansible_failed_task else 'FAILED' }}"
            create: true

# Stop immediately if ANY host fails (zero tolerance)
- name: Apply critical security patches
  hosts: all
  become: true
  any_errors_fatal: true           # one failure = abort everything

  tasks:
    - name: Apply kernel security patch
      ansible.builtin.package:
        name: linux-image-generic
        state: latest

---
# Allow up to 20% of hosts to fail before aborting (rolling tolerance)
- name: Deploy application update
  hosts: webservers
  become: true
  serial: 5                        # process 5 hosts at a time
  max_fail_percentage: 20          # abort if more than 20% fail

  tasks:
    - name: Deploy new release
      ansible.builtin.unarchive:
        src: release.tar.gz
        dest: /var/www/app
        remote_src: false

# Wait for a service to become healthy after starting
- name: Wait for application to become available
  ansible.builtin.uri:
    url: "http://{{ ansible_default_ipv4.address }}:{{ app_port }}/health"
    status_code: 200
  register: health_response
  retries: 10          # try up to 10 times
  delay: 6             # wait 6 seconds between each attempt
  until: health_response.status == 200
  # Total wait time: up to 10 * 6 = 60 seconds

# Wait for a port to open after service start
- name: Wait for database port to be accepting connections
  ansible.builtin.wait_for:
    host: "{{ db_host }}"
    port: 5432
    timeout: 60        # wait up to 60 seconds total
    state: started

# Retry a flaky command
- name: Download release archive (retry on network failure)
  ansible.builtin.get_url:
    url: "{{ release_url }}"
    dest: /tmp/release.tar.gz
    checksum: "sha256:{{ release_checksum }}"
  register: download_result
  retries: 3
  delay: 10
  until: download_result is succeeded