deploy.yml

# Ansible AWS Deployment with using Docker
---
- name: AWS EC2 Deployment
  hosts: localhost
  connection: local
  gather_facts: false
  tasks:
    # Set Python Intepreter
    - set_fact:
        ansible_python_interpreter: /usr/bin/python3
    # AWS Setup
    - name: Setting up the Security Group for new instance
      amazon.aws.ec2_group:
          name: Ansible_Security_Group_AWS
          description: Allowing Traffic on port 22 and 80
          region: eu-central-1
          rules:
           - proto: tcp
             from_port: 443
             to_port: 443
             cidr_ip: 0.0.0.0/0

           - proto: tcp
             from_port: 80
             to_port: 80
             cidr_ip: 0.0.0.0/0

           - proto: tcp
             from_port: 22
             to_port: 22
             cidr_ip: 0.0.0.0/0

           - proto: icmp
             from_port: -1
             to_port: -1
             cidr_ip: 0.0.0.0/0
          rules_egress:
           - proto: all
             cidr_ip: 0.0.0.0/0
          vpc_id: vpc-8d1f84e7

    - name: Create EC2 Instance
      amazon.aws.ec2:
        instance_type: t2.micro
        instance_tags:
          Name: AWS-Ansible
        image: ami-05f7491af5eef733a
        region: eu-central-1
        group: Ansible_Security_Group_AWS
        count: 1
        key_name: aws_instance_Ansible
        vpc_subnet_id: subnet-656de129
        wait: yes
        monitoring: yes
        assign_public_ip: yes
        aws_access_key: "{{ lookup('env', 'AWS_ACCESS_KEY') }}"
        aws_secret_key: "{{ lookup('env', 'AWS_SECRET_KEY') }}"
      register: ec2

    - name: Add new instance to host group
      add_host:
        hostname: "{{ item.public_ip }}"
        groupname: launched
        ansible_instance_id: "{{ item.id }}"
        ansible_region: "{{ item.region }}"
      loop: "{{ ec2.instances }}"

    - name: Wait for SSH to come up
      wait_for:
        host: "{{ item.public_dns_name }}"
        port: 22
        delay: 30
        timeout: 180
        state: started
      with_items: "{{ ec2.instances }}"

    - name: Setup SSH Key File
      copy:
        dest: ./ssh-key.pem
        content: "{{ lookup('env', 'SSH_PRIVATE_KEY') }}"
    # Just for security purposes - recommended by AWS
    - name: Change permissions of private key
      ansible.builtin.file:
        path: ./ssh-key.pem
        mode: '0400'
# Launch App
- name: Launch Application on EC2 Instance
  hosts: launched
  become: yes
  remote_user: ubuntu
  connection: ssh
  vars:
    ansible_ssh_private_key_file: ./ssh-key.pem
    backend_image_name:           "the-bug-busters/spotify-playlist-backend"
    cloudflare_api_key:           "{{ lookup('env', 'CLOUDFLARE_API_KEY') }}"
    cloudflare_api_token:         "{{ lookup('env', 'CLOUDFLARE_API_TOKEN') }}"
    # cloudflare_ca_server:         "{{ lookup('env', 'CLOUDFLARE_CA_SERVER') }}"
    cloudflare_email:             "{{ lookup('env', 'CLOUDFLARE_EMAIL') }}"
    docker_compose_file:          ./docker-compose.yml
    docker_compose_version:       "v2.0.1"
    docker_username:              "{{ lookup('env', 'DOCKER_USERNAME') }}"
    docker_token:                 "{{ lookup('env', 'DOCKER_TOKEN') }}"
    domain:                       "{{ lookup('env', 'DOMAIN')}}"
    image_name:                   "{{ lookup('env', 'IMAGE_NAME')}}"
    traefik_api_user:             "{{ lookup('env', 'TRAEFIK_USERNAME')}}"
    traefik_api_password:         "{{ lookup('env', 'TRAEFIK_PASSWORD')}}"
    traefik_api_url:              "traefik.yaman.pro"
    traefik_dir:                  "/var/www/traefik"
    spotify_client_id:            "{{ lookup('env', 'SPOTIFY_CLIENT_ID')}}"
    spotify_client_secret:        "{{ lookup('env', 'SPOTIFY_CLIENT_SECRET')}}"
    user:                         "ubuntu"
    group:                        "docker"
  gather_facts: false
  tasks:
    - name: Show IP address
      debug:
        msg: "{{ ansible_host }}"

    - name: Update apt cache
      apt: update_cache=yes cache_valid_time=3600

    - name: Upgrade all apt packages
      apt: upgrade=dist

    - name: Install dependencies
      apt:
        name: "{{ packages }}"
        state: present
        update_cache: yes
      vars:
        packages:
        - apt-transport-https
        - ca-certificates
        - curl
        - software-properties-common
        - gnupg-agent
        - apache2-utils

    - name: Add an apt signing key for Docker
      apt_key:
        url: https://download.docker.com/linux/ubuntu/gpg
        state: present

    - name: Add apt repository for stable version
      apt_repository:
        repo: deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable
        state: present

    - name: Install Docker
      apt:
        name: "{{ packages }}"
        state: present
        update_cache: yes
      vars:
        packages:
        - docker-ce
        - docker-ce-cli
        - containerd.io

    - name: Install pip3
      apt:
        name: python3-pip
        state: present

    - name: Install Docker Module from PyPI with pip3
      pip:
        name: docker
        executable: pip3

    - name: Add {{ user }} to docker group
      user:
        name: "ubuntu"
        group: docker
      register: add_user_docker_group

    - name: Start docker service
      service:
        name: "docker"
        state: started

    - name: Login to ghcr.io (GitHub Package Registry)
      community.docker.docker_login:
        registry_url: ghcr.io
        username: "{{ docker_username }}"
        password: "{{ docker_token }}"
      register: login_results

    - name: Check if ghcr.io login was successful
      debug:
        var: login_results.login_result.Status

    - name: Create an A record to point to the Traefik dashboard
      community.general.cloudflare_dns:
        zone: "{{ domain }}"
        record: traefik
        type: A
        proxied: yes
        solo: true
        value: "{{ ansible_host }}"
        account_email: "{{ cloudflare_email }}"
        account_api_key: "{{ cloudflare_api_key }}"
        api_token: "{{ cloudflare_api_token }}"
      register: record    

    - name: Create an A record to point to the web app
      community.general.cloudflare_dns:
        zone: "{{ domain }}"
        record: dhbw
        type: A
        proxied: yes
        solo: true
        value: "{{ ansible_host }}"
        account_email: "{{ cloudflare_email }}"
        account_api_key: "{{ cloudflare_api_key }}"
        api_token: "{{ cloudflare_api_token }}"
      register: record

    - name: Create an A record to point to the API
      community.general.cloudflare_dns:
        zone: "{{ domain }}"
        record: dhbw-api
        type: A
        proxied: yes
        solo: true
        value: "{{ ansible_host }}"
        account_email: "{{ cloudflare_email }}"
        account_api_key: "{{ cloudflare_api_key }}"
        api_token: "{{ cloudflare_api_token }}"
      register: record

    - name: Create a network
      docker_network:
        name: web

    - name: Ensures traefik dir exists
      file:
        path: "{{ traefik_dir }}"
        state: directory
        owner: "{{ user }}"
        group: "{{ group }}"

    - name: Ensures acme.json file exists
      file:
        path: "{{ traefik_dir }}/acme.json"
        state: touch
        mode: 0600

    - name: Adding traefik.yml file
      template:
        src: traefik.yml.j2
        dest: "{{ traefik_dir }}/traefik.yml"
        mode: 0600
      vars:
        acme_domain:    "{{ domain }}"
        acme_email:     "{{ cloudflare_email }}"
        acme_provider:  "cloudflare"

    - name: Generate auth string with user and encoded password for Treafik
      shell: echo $(htpasswd -nb "{{ traefik_api_user | string }}" "{{ traefik_api_password | string }}")
      register: auth_string

    - name: Deploy and start Traefik
      community.docker.docker_container:
        name: traefik
        # Repository name must be lowercase for using GitHub Package Registry (ghcr)
        image: traefik:2.2
        networks:
          - name: web
        restart_policy: unless-stopped
        recreate: true
        ports:
          - "80:80"
          - "443:443"
        volumes:
          - "{{ traefik_dir }}/traefik.yml:/etc/traefik/traefik.yml"
          - "{{ traefik_dir }}/acme.json:/acme.json"
          - "/var/run/docker.sock:/var/run/docker.sock"
        labels:
          traefik.enable: "true"
          # Dashboard
          traefik.http.routers.traefik.rule: "Host(`{{ traefik_api_url }}`)"
          traefik.http.routers.traefik.entrypoints: "websecure"
          traefik.http.routers.traefik.tls: "true"
          traefik.http.routers.traefik.service: "api@internal"
          traefik.http.routers.traefik.middlewares: "traefik-auth"
          traefik.http.middlewares.traefik-auth.basicauth.users: "{{ auth_string.stdout }}"
        env:
          CF_API_EMAIL: "{{ cloudflare_email | string }}"
          CF_API_KEY: "{{ cloudflare_api_key | string }}"
        state: started
      register: docker_info

    - name: Deploy Backend Service as Docker Container
      community.docker.docker_container:
        name: spotify-playlist-backend
        # Repository name must be lowercase for using GitHub Package Registry (ghcr)
        image: ghcr.io/{{ backend_image_name | lower }}:main
        networks:
          - name: web
        state: started
        labels:
          traefik.enable: "true"
          # HTTP
          traefik.http.routers.spotify-playlist-backend.entrypoints: "websecure"
          traefik.http.routers.spotify-playlist-backend.rule: "Host(`dhbw-api.yaman.pro`)"
          traefik.http.routers.spotify-playlist-backend.tls.certresolver: "cloudflare"
          # traefik.http.services.spotify-playlist-app.loadbalancer.server.port: "80"
        env:
          SPOTIFY_CLIENT_ID: "{{ spotify_client_id | string }}"
          SPOTIFY_CLIENT_SECRET: "{{ spotify_client_secret | string }}"
      register: docker_info_backend_deployment

    - name: Deploy Application as Docker Container
      community.docker.docker_container:
        name: spotify-playlist-app
        # Repository name must be lowercase for using GitHub Package Registry (ghcr)
        image: ghcr.io/{{ image_name | lower }}:main
        networks:
          - name: web
        state: started
        labels:
          traefik.enable: "true"
          # HTTP
          traefik.http.routers.spotify-playlist-app.entrypoints: "websecure"
          traefik.http.routers.spotify-playlist-app.rule: "Host(`dhbw.yaman.pro`)"
          traefik.http.routers.spotify-playlist-app.tls.certresolver: "cloudflare"
          # traefik.http.services.spotify-playlist-app.loadbalancer.server.port: "80"
      register: docker_info_app_deployment