115 lines
3.6 KiB
YAML
115 lines
3.6 KiB
YAML
|
---
|
||
|
|
# Deliberately narrow maintenance path for the us4 WireGuard service. The
|
||
|
|
# Compose file and all private key material remain on the server; this playbook
|
||
|
|
# only pulls its declared immutable image and recreates the named service.
|
||
|
|
- name: Update and recreate the approved WireGuard service
|
||
|
|
hosts: wireguard
|
||
|
|
become: true
|
||
|
|
gather_facts: false
|
||
|
|
serial: 1
|
||
|
|
vars:
|
||
|
|
wireguard_maintenance_confirm: false
|
||
|
|
tasks:
|
||
|
|
- name: Require explicit WireGuard maintenance confirmation
|
||
|
|
ansible.builtin.assert:
|
||
|
|
that:
|
||
|
|
- wireguard_maintenance_confirm | bool
|
||
|
|
fail_msg: >-
|
||
|
|
This operation pulls the image declared in /opt/wireguard/compose.yml
|
||
|
|
and briefly recreates WireGuard. Set wireguard_maintenance_confirm=true
|
||
|
|
only during the approved maintenance window.
|
||
|
|
|
||
|
|
- name: Create the local WireGuard rollback directory
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: "{{ compose_project_dir }}/backups"
|
||
|
|
state: directory
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0700"
|
||
|
|
|
||
|
|
- name: Create a timestamp for the rollback archive
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv: [date, +%Y%m%dT%H%M%SZ]
|
||
|
|
changed_when: false
|
||
|
|
register: wireguard_backup_timestamp
|
||
|
|
|
||
|
|
- name: Create a protected local rollback archive of WireGuard configuration
|
||
|
|
ansible.builtin.shell:
|
||
|
|
cmd: >-
|
||
|
|
umask 077 && tar --create --gzip
|
||
|
|
--file={{ compose_project_dir }}/backups/config-{{ wireguard_backup_timestamp.stdout }}.tar.gz
|
||
|
|
--directory={{ compose_project_dir }} config
|
||
|
|
executable: /bin/bash
|
||
|
|
changed_when: true
|
||
|
|
|
||
|
|
- name: Verify the compose declaration uses an immutable image digest
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv:
|
||
|
|
- docker
|
||
|
|
- compose
|
||
|
|
- --project-directory
|
||
|
|
- "{{ compose_project_dir }}"
|
||
|
|
- config
|
||
|
|
changed_when: false
|
||
|
|
register: wireguard_compose_config
|
||
|
|
|
||
|
|
- name: Reject mutable WireGuard image declarations
|
||
|
|
ansible.builtin.assert:
|
||
|
|
that:
|
||
|
|
- "'@sha256:' in wireguard_compose_config.stdout"
|
||
|
|
fail_msg: >-
|
||
|
|
Pin the WireGuard image to an approved immutable digest before using
|
||
|
|
this maintenance playbook.
|
||
|
|
|
||
|
|
- name: Pull the declared WireGuard image
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv:
|
||
|
|
- docker
|
||
|
|
- compose
|
||
|
|
- --project-directory
|
||
|
|
- "{{ compose_project_dir }}"
|
||
|
|
- pull
|
||
|
|
- wireguard
|
||
|
|
changed_when: true
|
||
|
|
|
||
|
|
- name: Recreate the WireGuard container
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv:
|
||
|
|
- docker
|
||
|
|
- compose
|
||
|
|
- --project-directory
|
||
|
|
- "{{ compose_project_dir }}"
|
||
|
|
- up
|
||
|
|
- -d
|
||
|
|
- --no-deps
|
||
|
|
- --force-recreate
|
||
|
|
- wireguard
|
||
|
|
changed_when: true
|
||
|
|
|
||
|
|
- name: Verify WireGuard container state
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv:
|
||
|
|
- docker
|
||
|
|
- compose
|
||
|
|
- --project-directory
|
||
|
|
- "{{ compose_project_dir }}"
|
||
|
|
- ps
|
||
|
|
- --all
|
||
|
|
changed_when: false
|
||
|
|
register: wireguard_compose_ps
|
||
|
|
|
||
|
|
- name: Display WireGuard container state
|
||
|
|
ansible.builtin.debug:
|
||
|
|
var: wireguard_compose_ps.stdout_lines
|
||
|
|
|
||
|
|
- name: Run the deployed WireGuard health check
|
||
|
|
ansible.builtin.command:
|
||
|
|
argv: [/usr/local/lib/vps-health/run]
|
||
|
|
changed_when: false
|
||
|
|
register: wireguard_health_report
|
||
|
|
failed_when: wireguard_health_report.rc not in [0, 1]
|
||
|
|
|
||
|
|
- name: Display sanitized WireGuard health result
|
||
|
|
ansible.builtin.debug:
|
||
|
|
msg: "{{ wireguard_health_report.stdout | default(wireguard_health_report.stderr, true) }}"
|