Application Deployment

---
# deploy.yml — symlink release management pattern
# Usage: ansible-playbook deploy.yml -e "version=20241201_143022"

- name: Deploy application release
  hosts: appservers
  become: true

  vars:
    deploy_dir: /var/www/app
    release_dir: "{{ deploy_dir }}/releases/{{ version }}"
    shared_dir: "{{ deploy_dir }}/shared"
    current_link: "{{ deploy_dir }}/current"
    keep_releases: 5    # prune everything older than the last 5 releases

  tasks:
    # Phase 1 — prepare the release directory
    - name: Create release directory
      ansible.builtin.file:
        path: "{{ release_dir }}"
        state: directory
        owner: "{{ app_user }}"
        mode: "0755"

    - name: Extract application archive to release directory
      ansible.builtin.unarchive:
        src: "{{ release_archive }}"   # e.g. dist/app-{{ version }}.tar.gz
        dest: "{{ release_dir }}"
        owner: "{{ app_user }}"
        remote_src: false

    # Phase 2 — link shared files (config, uploads, logs)
    - name: Link shared config directory into release
      ansible.builtin.file:
        src: "{{ shared_dir }}/config"
        dest: "{{ release_dir }}/config"
        state: link
        force: true

    - name: Link shared uploads directory into release
      ansible.builtin.file:
        src: "{{ shared_dir }}/uploads"
        dest: "{{ release_dir }}/public/uploads"
        state: link
        force: true

    # Phase 3 — run pre-release tasks (migrations, asset compilation)
    - name: Run database migrations
      ansible.builtin.command:
        cmd: python manage.py migrate --no-input
        chdir: "{{ release_dir }}"
      become_user: "{{ app_user }}"
      register: migration_result
      changed_when: "'No migrations to apply' not in migration_result.stdout"

    - name: Collect static assets
      ansible.builtin.command:
        cmd: python manage.py collectstatic --no-input
        chdir: "{{ release_dir }}"
      become_user: "{{ app_user }}"
      changed_when: true

    # Phase 4 — atomic cutover
    - name: Update current symlink to new release
      ansible.builtin.file:
        src: "{{ release_dir }}"
        dest: "{{ current_link }}"
        state: link
        force: true
      notify: Restart application

    # Phase 5 — force handler to run now, then health check
    - name: Flush handlers to restart service before health check
      ansible.builtin.meta: flush_handlers

    - name: Wait for application to become healthy
      ansible.builtin.uri:
        url: "http://{{ ansible_default_ipv4.address }}:{{ app_port }}/health"
        status_code: 200
      register: health
      retries: 10
      delay: 6
      until: health.status == 200

    # Phase 6 — clean up old releases
    - name: List all release directories
      ansible.builtin.find:
        paths: "{{ deploy_dir }}/releases"
        file_type: directory
        recurse: false
      register: releases_found

    - name: Remove releases beyond the keep_releases limit
      ansible.builtin.file:
        path: "{{ item.path }}"
        state: absent
      loop: >-
        {{ releases_found.files
           | sort(attribute='mtime')
           | list
           | reverse
           | list
           | skip(keep_releases | int) }}
      loop_control:
        label: "{{ item.path | basename }}"

  handlers:
    - name: Restart application
      ansible.builtin.service:
        name: "{{ app_service }}"
        state: restarted

  tasks:
    - name: Deploy with automatic rollback on failure
      block:
        - name: Extract application archive
          ansible.builtin.unarchive:
            src: "{{ release_archive }}"
            dest: "{{ release_dir }}"

        - name: Run database migrations
          ansible.builtin.command:
            cmd: python manage.py migrate --no-input
            chdir: "{{ release_dir }}"

        - name: Update current symlink
          ansible.builtin.file:
            src: "{{ release_dir }}"
            dest: "{{ current_link }}"
            state: link
            force: true
          notify: Restart application

        - name: Flush handlers and verify health
          ansible.builtin.meta: flush_handlers

        - name: Health check — new release must respond
          ansible.builtin.uri:
            url: "http://{{ ansible_default_ipv4.address }}:{{ app_port }}/health"
            status_code: 200
          retries: 5
          delay: 6
          until: health.status == 200
          register: health

      rescue:
        # Any task above failing triggers this section
        - name: Log rollback trigger
          ansible.builtin.debug:
            msg: "Deployment of {{ version }} failed — rolling back to previous release"

        - name: Find previous release
          ansible.builtin.find:
            paths: "{{ deploy_dir }}/releases"
            file_type: directory
            recurse: false
          register: all_releases

        - name: Restore previous release symlink
          ansible.builtin.file:
            src: >-
              {{ (all_releases.files
                  | sort(attribute='mtime')
                  | list)[-2].path }}
            dest: "{{ current_link }}"
            state: link
            force: true

        - name: Restart application on previous release
          ansible.builtin.service:
            name: "{{ app_service }}"
            state: restarted

        - name: Fail the play after rollback (surface the error clearly)
          ansible.builtin.fail:
            msg: "Deployment FAILED and ROLLED BACK. Check migration logs."

      always:
        - name: Record deployment result
          ansible.builtin.lineinfile:
            path: /var/log/deploy_history.log
            line: >-
              {{ ansible_date_time.iso8601 }} | {{ version }} |
              {{ 'SUCCESS' if ansible_failed_task is not defined else 'ROLLED BACK' }}
            create: true

---
- name: Rolling application deployment
  hosts: appservers
  become: true
  serial: 1               # one server at a time — adjust to "25%" for larger fleets
  max_fail_percentage: 0  # abort the entire rolling update if any server fails

  tasks:
    - name: Remove server from load balancer before deployment
      community.general.haproxy:
        state: disabled
        host: "{{ inventory_hostname }}"
        socket: /var/run/haproxy/admin.sock
        wait: true
        wait_interval: 5

    - name: Deploy new release (symlink pattern)
      ansible.builtin.include_tasks: tasks/deploy_release.yml
      # Contains the full symlink deployment sequence from above

    - name: Run smoke test against this server directly
      ansible.builtin.uri:
        url: "http://{{ ansible_default_ipv4.address }}:{{ app_port }}/health"
        status_code: 200
      retries: 5
      delay: 6
      until: smoke.status == 200
      register: smoke

    - name: Re-add server to load balancer after successful deployment
      community.general.haproxy:
        state: enabled
        host: "{{ inventory_hostname }}"
        socket: /var/run/haproxy/admin.sock
        wait: true

---
# blue_green_deploy.yml
# Phase 1 — deploy new version to green (inactive) environment
- name: Deploy to green environment
  hosts: green_servers
  become: true
  vars:
    version: "{{ new_version }}"
  tasks:
    - ansible.builtin.include_tasks: tasks/deploy_release.yml
    - name: Run full acceptance test suite against green
      ansible.builtin.uri:
        url: "http://{{ ansible_default_ipv4.address }}:{{ app_port }}/health"
        status_code: 200

# Phase 2 — switch load balancer from blue to green
- name: Cut over load balancer to green
  hosts: load_balancers
  become: true
  tasks:
    - name: Switch backend pool from blue to green
      ansible.builtin.template:
        src: haproxy.cfg.j2
        dest: /etc/haproxy/haproxy.cfg
        validate: haproxy -c -f %s
      vars:
        active_backend: green_servers
      notify: Reload HAProxy

    - name: Flush handlers to apply cutover immediately
      ansible.builtin.meta: flush_handlers

    - name: Verify green is now receiving traffic
      ansible.builtin.uri:
        url: "http://{{ lb_vip }}/health"
        status_code: 200

  handlers:
    - name: Reload HAProxy
      ansible.builtin.service:
        name: haproxy
        state: reloaded

# Rollback: switch back to blue (run with -e "rollback=true")
- name: Rollback to blue if needed
  hosts: load_balancers
  become: true
  when: rollback | default(false) | bool
  tasks:
    - name: Switch backend pool back to blue
      ansible.builtin.template:
        src: haproxy.cfg.j2
        dest: /etc/haproxy/haproxy.cfg
        validate: haproxy -c -f %s
      vars:
        active_backend: blue_servers
      notify: Reload HAProxy