add tracearr

playbooks/deploy-tracearr.yml

@@ -0,0 +1,106 @@
+---
+# Playbook: deploy-tracearr.yml
+#
+# But:
+# - Copier le docker-compose.yml Tracearr sur le LXC
+# - Generer les secrets si absents
+# - Demarrer la stack Tracearr
+# - Verifier que le port 3000 repond
+#
+# Les secrets sont crees directement sur le LXC.
+# Ils ne sont pas stockes dans Git.
+
+- name: Deploy Tracearr stack
+  hosts: tracearr_servers
+  become: true
+  gather_facts: false
+
+  vars:
+    stack_name: tracearr
+    stack_path: /opt/stacks/tracearr
+
+  tasks:
+    - name: Create stack directory
+      file:
+        path: "{{ stack_path }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0750"
+
+    - name: Create secrets directory
+      file:
+        path: "{{ stack_path }}/secrets"
+        state: directory
+        owner: root
+        group: root
+        mode: "0700"
+
+    - name: Copy Docker Compose file
+      copy:
+        src: "{{ playbook_dir }}/../services/tracearr/docker-compose.yml"
+        dest: "{{ stack_path }}/docker-compose.yml"
+        owner: root
+        group: root
+        mode: "0644"
+
+    - name: Generate Tracearr secrets if missing
+      shell: |
+        set -e
+        umask 077
+
+        if [ ! -s "{{ stack_path }}/secrets/db_password" ]; then
+          openssl rand -hex 32 > "{{ stack_path }}/secrets/db_password"
+        fi
+
+        if [ ! -s "{{ stack_path }}/secrets/jwt_secret" ]; then
+          openssl rand -hex 32 > "{{ stack_path }}/secrets/jwt_secret"
+        fi
+
+        if [ ! -s "{{ stack_path }}/secrets/cookie_secret" ]; then
+          openssl rand -hex 32 > "{{ stack_path }}/secrets/cookie_secret"
+        fi
+
+        if [ ! -s "{{ stack_path }}/secrets/better_auth_secret" ]; then
+          openssl rand -hex 32 > "{{ stack_path }}/secrets/better_auth_secret"
+        fi
+
+        if [ ! -s "{{ stack_path }}/secrets/database_url" ]; then
+          DB_PASSWORD="$(cat "{{ stack_path }}/secrets/db_password")"
+          printf "postgres://tracearr:%s@timescale:5432/tracearr" "$DB_PASSWORD" > "{{ stack_path }}/secrets/database_url"
+        fi
+
+        chown -R root:root "{{ stack_path }}/secrets"
+        chmod 700 "{{ stack_path }}/secrets"
+        chmod 644 "{{ stack_path }}/secrets/"*
+      args:
+        executable: /bin/bash
+      no_log: true
+      changed_when: true
+
+    - name: Pull Tracearr stack images
+      command: docker compose pull
+      args:
+        chdir: "{{ stack_path }}"
+
+    - name: Start Tracearr stack
+      command: docker compose up -d
+      args:
+        chdir: "{{ stack_path }}"
+
+    - name: Wait for Tracearr port
+      wait_for:
+        host: 127.0.0.1
+        port: 3000
+        timeout: 180
+
+    - name: Show Tracearr containers
+      command: docker compose ps
+      args:
+        chdir: "{{ stack_path }}"
+      register: compose_ps
+      changed_when: false
+
+    - name: Show compose status
+      debug:
+        var: compose_ps.stdout_lines