multica deployment

ansible/roles/multica_docker/tasks/preflight.yml

@@ -0,0 +1,88 @@
+---
+- name: Assert layout and hostnames
+  ansible.builtin.assert:
+    that:
+      - multica_layout in ['single', 'split']
+      - caddy_tls_mode in ['acme_http', 'cloudflare_dns', 'internal']
+      - multica_layout == 'split' or (multica_domain | length) > 0
+      - multica_layout == 'single' or ((multica_app_domain | length) > 0 and (multica_api_domain | length) > 0)
+    fail_msg: >-
+      Set multica_domain (layout=single) or multica_app_domain + multica_api_domain (layout=split),
+      and use a valid caddy_tls_mode.
+
+- name: Assert required secrets are provided
+  ansible.builtin.assert:
+    that:
+      - (multica_jwt_secret | length) >= 32
+      - (multica_postgres_password | length) >= 16
+      - (multica_vcs_secret_key | length) >= 16
+      - caddy_tls_mode != 'cloudflare_dns' or (caddy_cloudflare_api_token | length) > 0
+    fail_msg: >-
+      Missing secrets. Define vault_multica_jwt_secret (>=32 chars), vault_multica_postgres_password (>=16),
+      vault_multica_vcs_secret_key (>=16) and, for cloudflare_dns, vault_cloudflare_api_token.
+      Generate with: openssl rand -hex 32
+    quiet: true
+
+- name: Check Docker Compose v2 is available
+  ansible.builtin.command: docker compose version
+  register: _multica_compose_ver
+  changed_when: false
+
+- name: Ensure git is installed
+  ansible.builtin.package:
+    name: git
+    state: present
+
+# ── Port checks (skipped when our own stack already holds the ports) ──
+- name: Look for an existing Multica deployment
+  ansible.builtin.stat:
+    path: "{{ multica_install_dir }}/{{ _multica_compose_file }}"
+  register: _multica_compose_stat
+
+- name: List running Multica containers
+  ansible.builtin.command:
+    cmd: "docker compose -p {{ multica_compose_project }} -f {{ _multica_compose_file }} ps -q"
+    chdir: "{{ multica_install_dir }}"
+  register: _multica_ps
+  changed_when: false
+  when: _multica_compose_stat.stat.exists
+
+- name: Check for a running Caddy container
+  ansible.builtin.command: "docker ps -q --filter name=^{{ caddy_container_name }}$"
+  register: _caddy_ps
+  changed_when: false
+
+- name: Ensure Multica ports are free on first deploy
+  when: not (_multica_compose_stat.stat.exists and ((_multica_ps.stdout | default('')) | length) > 0)
+  block:
+    - name: Wait for 3000/8080 to be unused
+      ansible.builtin.wait_for:
+        host: 127.0.0.1
+        port: "{{ item }}"
+        state: stopped
+        timeout: 3
+      loop:
+        - "{{ _multica_frontend_port }}"
+        - "{{ _multica_backend_port }}"
+  rescue:
+    - name: Fail with hint
+      ansible.builtin.fail:
+        msg: "Port 3000 or 8080 is already in use on the target host and Multica is not running. Free it before deploying."
+
+- name: Ensure Caddy ports are free on first deploy
+  when: (_caddy_ps.stdout | length) == 0
+  block:
+    - name: Wait for Caddy HTTP/HTTPS ports to be unused
+      ansible.builtin.wait_for:
+        host: 127.0.0.1
+        port: "{{ item }}"
+        state: stopped
+        timeout: 3
+      loop: "{{ [caddy_http_port, caddy_https_port] | map('int') | list }}"
+  rescue:
+    - name: Fail with hint
+      ansible.builtin.fail:
+        msg: >-
+          Port {{ caddy_http_port }} or {{ caddy_https_port }} is already in use on the target host
+          (another reverse proxy such as nginx?). Set caddy_http_port / caddy_https_port to free ports,
+          or deploy Caddy on a different host.