Murat ÖZDEMİR
27f4f83f73
Ansible roles: - act_runner/defaults: set act_runner_name to inventory_hostname (was hardcoded to iklim-test-app); added vault_gitea_runner_token to vault.yml - prod/group_vars/all: restructured from flat files to all/ directory; added act_runner_labels override (prod-runner,ubuntu-24.04,hostname); added storagebox_managed_directories; added swarm_manager_ip and other prod-specific vars - prod/roles/db_stack: prod-specific db_node tasks using StorageBox paths (/mnt/storagebox/db/...) instead of local paths - docker/tasks: split firewalld loop into all-nodes (Swarm ports) and app-only (80/443) tasks - swarm/tasks: added --advertise-addr private_ip to join commands for correct multi-homed node advertisement - hardening/tasks: corrected firewalld drop zone configuration - node_dirs/tasks: added /opt/iklimco/vault/data for Vault Raft volume - db_stack/tasks/app_node: updated stale comment (removed pg-proxy reference) - db_stack/templates: removed pg-proxy and mongo-proxy service blocks - test/host_vars/iklim-app-01: added act_runner_name override to preserve existing test runner registration Roadmap and setup docs: - roadmap/03-infra-stack-changes: added replicas:0 for etcd/postgresql/ mongodb/pg-proxy/mongo-proxy in prod overlay; updated placement table; fixed grafana/data mkdir (auto-created by Ansible); translated Turkish note to English - roadmap/08-deploy-pipeline-update: updated stale "remains idle" note for standalone etcd (now disabled with replicas:0) - roadmap/01-swarm-init-multinode: consistency fixes - setup/06: added Outputs section and etcd firewall port documentation - setup/07: removed prometheus/data from StorageBox acceptance criteria; replaced manual StorageBox mkdir section with Ansible auto-creation note; updated prod README section with full bootstrap instructions and vault docs; added act_runner_labels prod policy - setup/08: extensive rewrite — aligned with Patroni etcd overlay DNS, corrected hcloud_firewall.app reference, updated all StorageBox paths from /prod/db/ to /db/ - setup/09: removed prometheus/data from acceptance criteria; updated runner label policy (removed docker/swarm-manager labels); added acceptance criterion for disabled services absent from docker service ls Terraform: - prod/firewall.tf: added missing DB subnet mutual rules (etcd, Patroni) - prod/outputs.tf: added prod_floating_ip and prod_private_ips outputs - prod/servers.tf: aligned placement group and naming - prod/variables.tf: corrected variable descriptions - prod/terraform.tfvars.example: updated defaults - terraform/hetzner/README.md: new comprehensive README covering both test and prod environments with firewall tables and inventory instructions ansible/README.md: expanded prod section with inventory groups, bootstrap run order, runner label policy, and vault variable documentation
77 lines
2.5 KiB
YAML
77 lines
2.5 KiB
YAML
---
|
||
- name: Check if Swarm is initialized
|
||
ansible.builtin.shell: !unsafe "docker info --format '{{.Swarm.LocalNodeState}}'"
|
||
register: swarm_status
|
||
changed_when: false
|
||
|
||
# 1. İlk Manager'ın (Leader) başlatılması
|
||
- name: Initialize Docker Swarm (Leader)
|
||
ansible.builtin.shell: >
|
||
docker swarm init
|
||
--advertise-addr {{ private_ip }}
|
||
when:
|
||
- inventory_hostname == groups['app'][0]
|
||
- swarm_status.stdout != 'active'
|
||
register: swarm_init_result
|
||
|
||
# 2. Join Token'ların alınması (Sadece Leader üzerinden)
|
||
- name: Get Swarm Manager Join Token
|
||
ansible.builtin.shell: docker swarm join-token manager -q
|
||
register: manager_token
|
||
delegate_to: "{{ groups['app'][0] }}"
|
||
when: inventory_hostname == groups['app'][0]
|
||
changed_when: false
|
||
|
||
- name: Get Swarm Worker Join Token
|
||
ansible.builtin.shell: docker swarm join-token worker -q
|
||
register: worker_token
|
||
delegate_to: "{{ groups['app'][0] }}"
|
||
when: inventory_hostname == groups['app'][0]
|
||
changed_when: false
|
||
|
||
# 3. Diğer App sunucularının Manager olarak katılması (Prod HA için)
|
||
- name: Join Swarm as Manager
|
||
ansible.builtin.shell: >
|
||
docker swarm join
|
||
--token {{ hostvars[groups['app'][0]]['manager_token']['stdout'] }}
|
||
--advertise-addr {{ private_ip }}
|
||
{{ swarm_manager_ip }}:2377
|
||
when:
|
||
- inventory_hostname in groups['app']
|
||
- inventory_hostname != groups['app'][0]
|
||
- swarm_status.stdout != 'active'
|
||
|
||
# 4. DB sunucularının Worker olarak katılması
|
||
- name: Join Swarm as Worker
|
||
ansible.builtin.shell: >
|
||
docker swarm join
|
||
--token {{ hostvars[groups['app'][0]]['worker_token']['stdout'] }}
|
||
--advertise-addr {{ private_ip }}
|
||
{{ swarm_manager_ip }}:2377
|
||
when:
|
||
- inventory_hostname in groups['db']
|
||
- swarm_status.stdout != 'active'
|
||
|
||
# 5. Overlay Network oluşturulması (Sadece bir kez Leader üzerinden)
|
||
- name: Create iklimco-net overlay network
|
||
community.docker.docker_network:
|
||
name: iklimco-net
|
||
driver: overlay
|
||
attachable: yes
|
||
state: present
|
||
delegate_to: "{{ groups['app'][0] }}"
|
||
run_once: true
|
||
|
||
# 6. Node Etiketleri (Labels)
|
||
- name: Label App nodes (service)
|
||
ansible.builtin.shell: docker node update --label-add type=service {{ inventory_hostname }}
|
||
delegate_to: "{{ groups['app'][0] }}"
|
||
when: inventory_hostname in groups['app']
|
||
changed_when: false
|
||
|
||
- name: Label DB nodes (db)
|
||
ansible.builtin.shell: docker node update --label-add role=db {{ inventory_hostname }}
|
||
delegate_to: "{{ groups['app'][0] }}"
|
||
when: inventory_hostname in groups['db']
|
||
changed_when: false
|