deploy.yml

# Ansible playbook for deploying a Flask app

---
# Install system apt packages
- hosts: webservers
  become: yes
  become_method: sudo
  tasks:
  - name: update cache
    apt: name=python3-software-properties state=present update_cache=yes cache_valid_time=43200
  - name: install packages
    apt:
      name:
        - tree         # Optional
        - python3-pip
        - python3-dev
        - nginx
        - git
      state: present
      autoclean: yes
 
# Install the app, note: don't do these tasks with become sudo
- hosts: webservers
  tasks:
  - name: clone repo
    git:
      repo: 'https://github.com/{{ github_user }}/{{ app_name }}.git'
      dest: /home/{{ ansible_ssh_user }}/{{ app_name }}
      update: yes  # Does a git pull if the repo already exists
  - name: Install virtualenv via pip
    pip:
      name: virtualenv
      executable: pip3
    become: yes
    become_user: root
  - name: install modules in a virtualenv
    pip:
      requirements: /home/{{ ansible_ssh_user }}/{{ app_name }}/requirements.txt
      virtualenv: /home/{{ ansible_ssh_user }}/{{ app_name }}/env
      virtualenv_python: python3


# Securing the Application
- hosts: webservers
  become: yes
  become_method: sudo
  tasks:
  - name: Install the package "python-certbot-nginx"
    apt:
      name: python3-certbot-nginx
  - name: Run command openssl
    command: openssl req -new -newkey rsa:4096 -days 3650 -nodes -x509 -subj "/C=PL/ST=Poland/L=Warsaw/O=flaskans/CN=flaskans.com" -keyout localhost.key -out localhost.crt
  - name: Run command security
    command: cp /home/vagrant/localhost.crt /usr/local/share/ca-certificates/localhost.crt
  - name: Run command security
    command: update-ca-certificates


# Configure app systemd service and nginx
- hosts: webservers
  become: yes
  become_method: sudo
  tasks:
  - name: template systemd service config
    copy:
      src: .service
      dest: /etc/systemd/system/{{ app_name }}.service
  - name: start systemd app service
    systemd: name={{ app_name }}.service state=restarted enabled=yes
  - name: template nginx site config
    template:
      src: .nginx
      dest: /etc/nginx/sites-available/{{ app_name }}
  - name: remove default nginx site config
    file: path=/etc/nginx/sites-enabled/default state=absent
  # - command: mv /etc/nginx/sites-enabled/default /tmp/nginx.sites-enabled.default
  - name: enable nginx site
    file:
      src: /etc/nginx/sites-available/{{ app_name }}
      dest: /etc/nginx/sites-enabled/default
      state: link
      force: yes
  - name: restart nginx
    systemd: name=nginx state=restarted enabled=yes
  - name: open firewall for nginx
    ufw:
      rule: allow
      name: Nginx Full