From 3ccfe51727c35f7cef25216f0ae4d0701d9dabb9 Mon Sep 17 00:00:00 2001
From: EmlynK <emlyn.kinzett@codeenigma.com>
Date: Thu, 20 Jan 2022 10:13:40 +0000
Subject: [PATCH 1/7] Defer nightly backups, disable ASG processes during syncs
 and run syncs with backup (#94)

* Change location of nightly backup script and delegate the cron that runs it to the deploy server, if required (for ASGs).

* Set up nightly backup crons in separate files in /etc/cron.d

* Can't put site cron files in /etc/cron.d because the deploy user doesn't have perms.

* Try and add the ability to sync a site using a nightly backup instead of a fresh DB dump.

* Use Ansible modules to look up RDS host and to copy the nightly backup into place.

* Delegate PATH setup in db backup cron to localhost.

* Shell bad. Command good. But makes it convoluted. Oh well.

* Used wrong database name in source database copy.

* Try and disable the ReplaceUnhealthy auto scale process during syncs.

* Fix Drupal cron roles when deferring to deploy server.
---
 .../cron_database_backup-mysql/tasks/main.yml | 10 +++
 .../tasks/setup.yml                           | 18 ++++-
 roles/cron/cron_drupal7/tasks/main.yml        |  1 +
 roles/cron/cron_drupal8/tasks/main.yml        |  1 +
 .../database_sync-mysql/defaults/main.yml     |  9 +++
 .../database_sync-mysql/tasks/sync.yml        | 79 ++++++++++++++++++-
 6 files changed, 115 insertions(+), 3 deletions(-)

diff --git a/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/main.yml b/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/main.yml
index 04789df8..ffd14157 100644
--- a/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/main.yml
+++ b/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/main.yml
@@ -3,6 +3,16 @@
 # screwing the daily backup when using rolling db, we could
 # add a keep mechanism for backup scripts, like for the dumps themselves.
 # Nice to have more than anything.
+- name: Setup PATH in crontab.
+  cron:
+    name: PATH
+    env: true
+    job: "/usr/bin:/usr/local/bin:/bin:/home/{{ deploy_user }}/.bin"
+  delegate_to: localhost
+  when:
+    - drupal.defer is defined
+    - drupal.defer
+
 - include_tasks: setup.yml
   vars:
     database: database
diff --git a/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/setup.yml b/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/setup.yml
index bdc1534c..40b0c47e 100644
--- a/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/setup.yml
+++ b/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/setup.yml
@@ -25,12 +25,26 @@
 - name: Create backup script.
   template:
     src: "regular-backups.sh.j2"
-    dest: "/home/{{ deploy_user }}/{{ database.host }}-{{ database.original.database }}-regular-backups.sh"
+    dest: "/home/{{ deploy_user }}/shared/{{ project_name }}_{{ build_type }}/{{ database.host }}-{{ database.original.database }}-regular-backups.sh"
     mode: 0700
 
+- name: Define backup cron job command.
+  set_fact:
+    _backup_cron_job_command: "/bin/sh /home/{{ deploy_user }}/shared/{{ project_name }}_{{ build_type }}/{{ database.host }}-{{ database.original.database }}-regular-backups.sh"
+
+- name: Define backup cron job command if deferred (ASG).
+  set_fact:
+    _backup_cron_job_command: "cd {{ _ce_deploy_base_dir }} && {{ _ce_deploy_ansible_location }} {{ drupal.defer_target }} -m shell -a \"{{ _backup_cron_job_command }}\""
+  when:
+    - drupal.defer is defined
+    - drupal.defer
+    - drupal.defer_target is defined
+    - drupal.defer_target | length > 0
+
 - name: Setup regular backup for MySQL.
   cron:
     name: "cron_mysql_{{ database.host }}_{{ database.original.database }}"
     minute: "{{ _cron_mysql_backup_minute }}"
     hour: "{{ _cron_mysql_backup_hour }}"
-    job: "/bin/sh /home/{{ deploy_user }}/{{ database.host }}-{{ database.original.database }}-regular-backups.sh"
+    job: "{{ _backup_cron_job_command }}"
+  delegate_to: "{{ 'localhost' if drupal.defer else inventory_hostname }}"
diff --git a/roles/cron/cron_drupal7/tasks/main.yml b/roles/cron/cron_drupal7/tasks/main.yml
index d0cbfce9..75fa05c7 100644
--- a/roles/cron/cron_drupal7/tasks/main.yml
+++ b/roles/cron/cron_drupal7/tasks/main.yml
@@ -4,6 +4,7 @@
     name: PATH
     env: true
     job: "/usr/bin:/usr/local/bin:/bin:/home/{{ deploy_user }}/.bin"
+  delegate_to: localhost
   when:
     - drupal.defer is defined
     - drupal.defer
diff --git a/roles/cron/cron_drupal8/tasks/main.yml b/roles/cron/cron_drupal8/tasks/main.yml
index d0cbfce9..75fa05c7 100644
--- a/roles/cron/cron_drupal8/tasks/main.yml
+++ b/roles/cron/cron_drupal8/tasks/main.yml
@@ -4,6 +4,7 @@
     name: PATH
     env: true
     job: "/usr/bin:/usr/local/bin:/bin:/home/{{ deploy_user }}/.bin"
+  delegate_to: localhost
   when:
     - drupal.defer is defined
     - drupal.defer
diff --git a/roles/sync/database_sync/database_sync-mysql/defaults/main.yml b/roles/sync/database_sync/database_sync-mysql/defaults/main.yml
index c1d7b259..48e3e4a0 100644
--- a/roles/sync/database_sync/database_sync-mysql/defaults/main.yml
+++ b/roles/sync/database_sync/database_sync-mysql/defaults/main.yml
@@ -15,6 +15,13 @@ mysql_sync:
         type: fixed
         # For "rolling builds", so we can compute the database name.
         build_id: mybuildprod
+        # Whether or not use to create a fresh database backup or use a nightly one.
+        fresh_db: true
+        # Location where nightly backups are kept. This must match the value set for cron_mysql_backup.dumps_directory. Below is the default.
+        # This var is only used when fresh_db is set to "false".
+        dumps_directory: "/home/{{ deploy_user }}/shared/{{ project_name }}_{{ build_type }}/db_backups/mysql/regular"
+        # If the source is on an ASG, provide the ASG name here. Otherwise, leave empty.
+        asg: ""
       target:
         database: "{{ project_name }}_dev"
         credentials_file: "/home/{{ deploy_user }}/.mysql.creds"
@@ -25,3 +32,5 @@ mysql_sync:
         type: fixed
         # For "rolling builds", so we can compute the database name.
         build_id: mybuilddev
+        # If the target is on an ASG, provide the ASG name here. Otherwise, leave empty.
+        asg: ""
diff --git a/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml b/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
index 81e9b2ce..b8182bc3 100644
--- a/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
+++ b/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
@@ -1,4 +1,40 @@
 ---
+- name: Get database source host region.
+  amazon.aws.ec2_metadata_facts:
+  register: mysql_sync_source_database_host_info
+  delegate_to: "{{ database.source.host }}"
+  when:
+    - database.source.asg is defined
+    - database.source.asg | length > 0
+    - database.source.fresh_db is defined
+    - database.source.fresh_db
+
+# This task does not need a delegate_to because the hosts set in the sync playbook in the repo should be the target host.
+- name: Get database target host region.
+  amazon.aws.ec2_metadata_facts:
+  register: mysql_sync_target_database_host_info
+  when:
+    - database.target.asg is defined
+    - database.target.asg | length > 0
+
+- name: Disable ReplaceUnhealthy autoscale process on source ASG.
+  ansible.builtin.command: >
+    aws autoscaling suspend-processes --auto-scaling-group-name {{ database.source.asg }} --scaling-processes ReplaceUnhealthy --region {{ mysql_sync_source_database_host_info.ansible_facts.ansible_ec2_instance_identity_document_region }}
+  delegate_to: localhost
+  when:
+    - database.source.asg is defined
+    - database.source.asg | length > 0
+    - database.source.fresh_db is defined
+    - database.source.fresh_db
+
+- name: Disable ReplaceUnhealthy autoscale process on target ASG.
+  ansible.builtin.command: >
+    aws autoscaling suspend-processes --auto-scaling-group-name {{ database.target.asg }} --scaling-processes ReplaceUnhealthy --region {{ mysql_sync_target_database_host_info.ansible_facts.ansible_ec2_instance_identity_document_region }}
+  delegate_to: localhost
+  when:
+    - database.target.asg is defined
+    - database.target.asg | length > 0
+
 - name: Register remote dump name (from database).
   set_fact:
     mysql_sync_source_dump_path: "/tmp/{{ database.source.database }}.sql.bz2"
@@ -33,7 +69,30 @@
 - name: Take a dump from source database.
   shell: "mysqldump --defaults-extra-file={{ database.source.credentials_file }} {{ mysql_sync_source_database }} | bzip2 > {{ mysql_sync_source_dump_path }}"
   delegate_to: "{{ database.source.host }}"
-  when: not database.source.type == 'dump'
+  when:
+    - not database.source.type == 'dump'
+    - database.source.fresh_db
+
+- name: Find source database host.
+  ansible.builtin.command:
+    cmd: "grep 'host' {{ database.source.credentials_file }}"
+  register: mysql_host_info_grep
+  delegate_to: "{{ database.source.host }}"
+  when: not database.source.fresh_db
+
+- name: Register source database host.
+  set_fact:
+    mysql_sync_source_database_host: "{{ mysql_host_info_grep.stdout.split('=')[1] }}"
+  delegate_to: "{{ database.source.host }}"
+  when: not database.source.fresh_db
+
+- name: Copy a nightly backup for the source database.
+  ansible.builtin.copy:
+    src: "{{ database.source.dumps_directory }}/{{ mysql_sync_source_database_host }}/{{ database.source.database }}"
+    dest: "{{ mysql_sync_source_dump_path }}"
+    remote_src: true
+  delegate_to: "{{ database.source.host }}"
+  when: not database.source.fresh_db
 
 - name: Register tmp target dump name.
   set_fact:
@@ -95,3 +154,21 @@
     path: "{{ mysql_sync_target_dump_path }}"
     state: absent
   when: not database.target.type == 'dump'
+
+- name: Enable all autoscale processes on source ASG.
+  ansible.builtin.command: >
+    aws autoscaling resume-processes --auto-scaling-group-name {{ database.source.asg }} --region {{ mysql_sync_source_database_host_info.ansible_facts.ansible_ec2_instance_identity_document_region }}
+  delegate_to: localhost
+  when:
+    - database.source.asg is defined
+    - database.source.asg | length > 0
+    - database.source.fresh_db is defined
+    - database.source.fresh_db
+
+- name: Enable all autoscale processes on target ASG.
+  ansible.builtin.command: >
+    aws autoscaling resume-processes --auto-scaling-group-name {{ database.target.asg }} --region {{ mysql_sync_target_database_host_info.ansible_facts.ansible_ec2_instance_identity_document_region }}
+  delegate_to: localhost
+  when:
+    - database.target.asg is defined
+    - database.target.asg | length > 0

From a54c09cb0ce5b6889e672ba8ea741b71a3da034b Mon Sep 17 00:00:00 2001
From: Dionisio <dionisiofernandez83@gmail.com>
Date: Thu, 10 Mar 2022 14:16:13 +0100
Subject: [PATCH 2/7] Added deploy.yml examples for Drupal 9 and Localgov.
 Updated tests (#97)

---
 .github/workflows/ce-deploy-test.yml        | 22 ++++++++
 ce-dev/ansible/examples/drupal9/deploy.yml  | 55 +++++++++++++++++++
 ce-dev/ansible/examples/localgov/deploy.yml | 59 +++++++++++++++++++++
 3 files changed, 136 insertions(+)
 create mode 100644 ce-dev/ansible/examples/drupal9/deploy.yml
 create mode 100644 ce-dev/ansible/examples/localgov/deploy.yml

diff --git a/.github/workflows/ce-deploy-test.yml b/.github/workflows/ce-deploy-test.yml
index baa13347..141fc8e7 100644
--- a/.github/workflows/ce-deploy-test.yml
+++ b/.github/workflows/ce-deploy-test.yml
@@ -59,6 +59,28 @@ jobs:
           curl https://www.test.local
         shell: bash
 
+      - name: Run a test ce-dev deploy with Drupal 9
+        run: |
+          ce-dev create -p testnine -t drupal9 -d ~/testnine
+          cd ~/testnine
+          ce-dev init
+          ce-dev start
+          ce-dev provision
+          ce-dev deploy
+          curl https://www.testnine.local
+        shell: bash
+
+      - name: Run a test ce-dev deploy with Localgov
+        run: |
+          ce-dev create -p testlocalgov -t localgov -d ~/testlocalgov
+          cd ~/testlocalgov
+          ce-dev init
+          ce-dev start
+          ce-dev provision
+          ce-dev deploy
+          curl https://www.testlocalgov.local
+        shell: bash
+
       # Builds the table of contents for the docs
       - name: Documentation (build table of contents)
         if: ${{ github.event.pull_request.base.ref == '1.x' }}
diff --git a/ce-dev/ansible/examples/drupal9/deploy.yml b/ce-dev/ansible/examples/drupal9/deploy.yml
new file mode 100644
index 00000000..deeef9ee
--- /dev/null
+++ b/ce-dev/ansible/examples/drupal9/deploy.yml
@@ -0,0 +1,55 @@
+---
+# Template playbook for a local Drupal9 codebase.
+- hosts: deploy-web
+  vars:
+    - project_name: example
+    - project_type: drupal8
+    - webroot: web
+    - build_type: local
+    - _env_type: dev
+    - _domain_name: www.{{ project_name }}.local
+    # Path to your project root. This must match the "volume" set in the docker-compose template.
+    - deploy_path: /home/ce-dev/deploy/live.local
+    # This actually does not take any backup, but is needed to populate settings.php.
+    - mysql_backup:
+        handling: none
+        credentials_handling: static
+    # A list of Drupal sites (for multisites).
+    - drupal:
+        sites:
+          - folder: "default"
+            public_files: "sites/default/files"
+            install_command: "-y si"
+            # Toggle config import on/off. Disabled for initial passes.
+            config_import_command: ""
+            # config_import_command: "cim"
+            config_sync_directory: "config/sync"
+            sanitize_command: "sql-sanitize"
+            # Remove after initial pass, to avoid reinstalling Drupal.
+            force_install: yes
+            base_url: "https://{{ _domain_name }}"
+    # Composer command to run.
+    - composer:
+        command: install
+        no_dev: no
+        working_dir: "{{ deploy_path }}"
+        apcu_autoloader: no
+  pre_tasks:
+    # You can safely remove these steps once you have a working composer.json.
+    - name: Download composer file.
+      get_url:
+        url: https://raw.githubusercontent.com/drupal/recommended-project/9.3.x/composer.json
+        dest: "{{ deploy_path }}/composer.json"
+        force: no
+    - name: Install drush.
+      command:
+        cmd: composer require drush/drush:11.*
+        chdir: "{{ deploy_path }}"
+  roles:
+    - _init # Sets some variables the deploy scripts rely on.
+    - composer # Composer install step.
+    - database_backup # This is still needed to generate credentials.
+    - config_generate # Generates settings.php
+    #    - sync/database_sync # Grab database from a remote server.
+    - database_apply # Run drush updb and config import.
+    - _exit # Some common housekeeping.
\ No newline at end of file
diff --git a/ce-dev/ansible/examples/localgov/deploy.yml b/ce-dev/ansible/examples/localgov/deploy.yml
new file mode 100644
index 00000000..9844206b
--- /dev/null
+++ b/ce-dev/ansible/examples/localgov/deploy.yml
@@ -0,0 +1,59 @@
+---
+# Template playbook for a local localgov codebase.
+- hosts: deploy-web
+  vars:
+    - project_name: example
+    - project_type: drupal8
+    - webroot: web
+    - build_type: local
+    - _env_type: dev
+    - _domain_name: www.{{ project_name }}.local
+    # Path to your project root. This must match the "volume" set in the docker-compose template.
+    - deploy_path: /home/ce-dev/deploy/live.local
+    # This actually does not take any backup, but is needed to populate settings.php.
+    - mysql_backup:
+        handling: none
+        credentials_handling: static
+    # A list of Drupal sites (for multisites).
+    - drupal:
+        sites:
+          - folder: "default"
+            public_files: "sites/default/files"
+            install_command: "-y si localgov"
+            # Toggle config import on/off. Disabled for initial passes.
+            config_import_command: ""
+            # config_import_command: "cim"
+            config_sync_directory: "config/sync"
+            sanitize_command: "sql-sanitize"
+            # Remove after initial pass, to avoid reinstalling Drupal.
+            force_install: yes
+            base_url: "https://{{ _domain_name }}"
+    # Composer command to run.
+    - composer:
+        command: install
+        no_dev: no
+        working_dir: "{{ deploy_path }}"
+        apcu_autoloader: no
+  pre_tasks:
+    # You can safely remove these steps once you have a working composer.json.
+    - name: Download composer file.
+        get_url:
+          url: https://raw.githubusercontent.com/drupal/recommended-project/9.3.x/composer.json
+          dest: "{{ deploy_path }}/composer.json"
+          force: false
+    - name: Install drush.
+        command:
+          cmd: composer require drush/drush:11.*
+          chdir: "{{ deploy_path }}"
+    - name: Install localgov.
+        command:
+          cmd: composer require localgovdrupal/localgov
+          chdir: "{{ deploy_path }}"
+  roles:
+    - _init # Sets some variables the deploy scripts rely on.
+    - composer # Composer install step.
+    - database_backup # This is still needed to generate credentials.
+    - config_generate # Generates settings.php
+    #    - sync/database_sync # Grab database from a remote server.
+    - database_apply # Run drush updb and config import.
+    - _exit # Some common housekeeping.
\ No newline at end of file

From 223a3b5ecec42997d9e52de690cf7b8c5f9f19ab Mon Sep 17 00:00:00 2001
From: Greg Harvey <greg.harvey@gmail.com>
Date: Thu, 31 Mar 2022 12:43:36 +0200
Subject: [PATCH 3/7] Adding a new SimpleSAMLphp meta role. (#100)

---
 roles/_meta/deploy-simplesamlphp/README.md      |  9 +++++++++
 roles/_meta/deploy-simplesamlphp/tasks/main.yml | 17 +++++++++++++++++
 .../deploy_code-simplesamlphp/tasks/main.yml    |  1 +
 3 files changed, 27 insertions(+)
 create mode 100644 roles/_meta/deploy-simplesamlphp/README.md
 create mode 100644 roles/_meta/deploy-simplesamlphp/tasks/main.yml
 create mode 100644 roles/deploy_code/deploy_code-simplesamlphp/tasks/main.yml

diff --git a/roles/_meta/deploy-simplesamlphp/README.md b/roles/_meta/deploy-simplesamlphp/README.md
new file mode 100644
index 00000000..3d82e671
--- /dev/null
+++ b/roles/_meta/deploy-simplesamlphp/README.md
@@ -0,0 +1,9 @@
+# SimpleSAMLphp
+Role for deploying single SimpleSAMLphp instances. Do not use if you are deploying SimpleSAMLphp with another application like Drupal via composer.
+
+This role currently assumes all config is in the repository alongside composer.json and the special `SIMPLESAMLPHP_CONFIG_DIR` variable is passed in via the web server vhost to tell SimpleSAMLphp where the config is on the server. For vhost configuration in Nginx see ce-provision:
+
+* https://github.com/codeenigma/ce-provision/blob/1.x/roles/nginx
+
+<!--ROLEVARS-->
+<!--ENDROLEVARS-->
diff --git a/roles/_meta/deploy-simplesamlphp/tasks/main.yml b/roles/_meta/deploy-simplesamlphp/tasks/main.yml
new file mode 100644
index 00000000..7af28fa2
--- /dev/null
+++ b/roles/_meta/deploy-simplesamlphp/tasks/main.yml
@@ -0,0 +1,17 @@
+---
+# Default SimpleSAMLphp role. This is suitable for a standalone SimpleSAMLphp installation
+
+- ansible.builtin.import_role:
+    name: _init
+- ansible.builtin.import_role:
+    name: deploy_code
+- ansible.builtin.import_role:
+    name: composer
+- ansible.builtin.import_role:
+    name: database_backup
+- ansible.builtin.import_role:
+    name: live_symlink
+- ansible.builtin.import_role:
+    name: cache_clear/cache_clear-opcache
+- ansible.builtin.import_role:
+    name: _exit
diff --git a/roles/deploy_code/deploy_code-simplesamlphp/tasks/main.yml b/roles/deploy_code/deploy_code-simplesamlphp/tasks/main.yml
new file mode 100644
index 00000000..03c03856
--- /dev/null
+++ b/roles/deploy_code/deploy_code-simplesamlphp/tasks/main.yml
@@ -0,0 +1 @@
+# Nothing to do.
\ No newline at end of file

From 32843d53a625b68bc3a3f7a8cfcced5c90df3f49 Mon Sep 17 00:00:00 2001
From: Greg Harvey <greg.harvey@gmail.com>
Date: Wed, 13 Apr 2022 13:09:01 +0200
Subject: [PATCH 4/7] Allowing users to set cachetool version properly. (#102)

---
 roles/cli/cachetool/defaults/main.yml |  2 +-
 roles/cli/cachetool/tasks/main.yml    | 13 ++++++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/roles/cli/cachetool/defaults/main.yml b/roles/cli/cachetool/defaults/main.yml
index ad2c6711..5ec1b2d7 100644
--- a/roles/cli/cachetool/defaults/main.yml
+++ b/roles/cli/cachetool/defaults/main.yml
@@ -1,3 +1,3 @@
 ---
 cachetool:
-  version: 8.2.2
\ No newline at end of file
+  version: latest # # enter three-digit version number, e.g. "7.0.0", to install a specific version
\ No newline at end of file
diff --git a/roles/cli/cachetool/tasks/main.yml b/roles/cli/cachetool/tasks/main.yml
index 5a1969c6..aa27df04 100644
--- a/roles/cli/cachetool/tasks/main.yml
+++ b/roles/cli/cachetool/tasks/main.yml
@@ -13,7 +13,7 @@
   when:
     - deploy_operation == 'deploy'
 
-- name: Download cachetool installer.
+- name: Download latest cachetool installer.
   get_url:
     url: "http://gordalina.github.io/cachetool/downloads/cachetool.phar"
     dest: "{{ cachetool_bin }}"
@@ -21,3 +21,14 @@
   when:
     - deploy_operation == 'deploy'
     - not cachetool_global.stat.exists
+    - cachetool.version == 'latest'
+
+- name: "Download cachetool version {{ cachetool.version }} installer."
+  get_url:
+    url: "http://gordalina.github.io/cachetool/downloads/cachetool-{{ cachetool.version }}.phar"
+    dest: "{{ cachetool_bin }}"
+    mode: 0755
+  when:
+    - deploy_operation == 'deploy'
+    - not cachetool_global.stat.exists
+    - cachetool.version != 'latest'

From d1c285e31cadfd76a578f9700cafcea58e71f211 Mon Sep 17 00:00:00 2001
From: gregharvey <greg.harvey@gmail.com>
Date: Thu, 14 Apr 2022 10:45:38 +0200
Subject: [PATCH 5/7] Including an ami.yml for packing AMIs on build finale.

---
 roles/deploy_code/defaults/main.yml |  3 +++
 roles/deploy_code/tasks/ami.yml     |  1 +
 roles/deploy_code/tasks/cleanup.yml | 16 ++++++++++------
 roles/deploy_code/tasks/deploy.yml  | 10 +++++-----
 roles/deploy_code/tasks/main.yml    |  2 +-
 5 files changed, 20 insertions(+), 12 deletions(-)
 create mode 100644 roles/deploy_code/tasks/ami.yml

diff --git a/roles/deploy_code/defaults/main.yml b/roles/deploy_code/defaults/main.yml
index 19e45eee..59b4cff5 100644
--- a/roles/deploy_code/defaults/main.yml
+++ b/roles/deploy_code/defaults/main.yml
@@ -21,3 +21,6 @@ deploy_code:
   # Path that you want to make sure has 755 permissions. Make sure to include the webroot WITHOUT the slash.
   perms_fix_path: ""
   # perms_fix_path: "www/sites/default"
+  # Pack an AMI if this is AWS and we are deploying instances with the code built in.
+  # This goes with ce-provision's 'repack' operation for deploying autoscaling groups.
+  pack_ami: false
diff --git a/roles/deploy_code/tasks/ami.yml b/roles/deploy_code/tasks/ami.yml
new file mode 100644
index 00000000..ed97d539
--- /dev/null
+++ b/roles/deploy_code/tasks/ami.yml
@@ -0,0 +1 @@
+---
diff --git a/roles/deploy_code/tasks/cleanup.yml b/roles/deploy_code/tasks/cleanup.yml
index dc72c752..7932389c 100644
--- a/roles/deploy_code/tasks/cleanup.yml
+++ b/roles/deploy_code/tasks/cleanup.yml
@@ -1,13 +1,13 @@
 ---
 - name: Ensure codebase is writable.
-  shell:
+  ansible.builtin.shell:
     cmd: "if [ -d {{ deploy_path_prefix }}{{ item }} ]; then chmod -R 777 {{ deploy_path_prefix }}{{ item }}; fi"
   with_sequence: start={{ [previous_build_number | int - 50, 0] | max }}  end={{ [previous_build_number | int - deploy_code.keep, 0] | max }}
   become: true
   when: "www_user != deploy_user"
 
 - name: Ensure permissions are set on directory.
-  shell:
+  ansible.builtin.shell:
     cmd: "if [ -d {{ deploy_path_prefix }}{{ item }}/{{ deploy_code.perms_fix_path }} ]; then chmod 755 {{ deploy_path_prefix }}{{ item }}/{{ deploy_code.perms_fix_path }}; fi"
   with_sequence: start={{ [previous_build_number | int - 50, 0] | max }}  end={{ [previous_build_number | int - deploy_code.keep, 0] | max }}
   when:
@@ -15,13 +15,13 @@
     - deploy_code.perms_fix_path | length > 1
 
 - name: Delete codebases.
-  file:
+  ansible.builtin.file:
     name: "{{ deploy_path_prefix }}{{ item }}"
     state: absent
   with_sequence: start={{ [previous_build_number | int - 50, 0] | max }}  end={{ [previous_build_number | int - deploy_code.keep, 0] | max }}
 
 - name: Create a tarball of the deployed codebases.
-  command:
+  ansible.builtin.command:
     cmd: "tar -cvf /tmp/{{ project_name }}_{{ build_type }}.tar {{ deploy_base_path }}"
   when:
     - deploy_code.mount_sync is defined
@@ -29,7 +29,7 @@
   run_once: true
 
 - name: Create destination folder.
-  file:
+  ansible.builtin.file:
     path: "{{ deploy_code.mount_sync }}"
     state: directory
     mode: "0755"
@@ -39,9 +39,13 @@
   run_once: true
 
 - name: Move to final destination.
-  command:
+  ansible.builtin.command:
     cmd: "mv /tmp/{{ project_name }}_{{ build_type }}.tar {{ deploy_code.mount_sync }}/{{ project_name }}_{{ build_type }}.tar"
   when:
     - deploy_code.mount_sync is defined
     - deploy_code.mount_sync | length > 1
   run_once: true
+
+- name: Pack an AWS AMI.
+  ansible.builtin.include_tasks: "ami.yml"
+  when: deploy_code.pack_ami
diff --git a/roles/deploy_code/tasks/deploy.yml b/roles/deploy_code/tasks/deploy.yml
index 3693eb70..0d15425c 100644
--- a/roles/deploy_code/tasks/deploy.yml
+++ b/roles/deploy_code/tasks/deploy.yml
@@ -1,6 +1,6 @@
 ---
 - name: Copy project repository.
-  synchronize:
+  ansible.posix.synchronize:
     src: "{{ _ce_deploy_build_dir }}/"
     dest: "{{ deploy_path }}"
     archive: true
@@ -8,17 +8,17 @@
       - "--exclude=.git"
 
 - name: Ensure project repository is readable.
-  file:
+  ansible.builtin.file:
     path: "{{ deploy_path }}"
     state: directory
     mode: 0755
 
 - name: Project specific tasks.
-  include_role:
+  ansible.builtin.include_role:
     name: "deploy_code/deploy_code-{{ project_type }}"
 
 - name: Generate additional templates.
-  template:
+  ansible.builtin.template:
     src: "{{ template.src }}"
     dest: "{{ deploy_path }}/{{ template.dest }}"
   with_items: "{{ deploy_code.templates }}"
@@ -29,7 +29,7 @@
     - deploy_operation == 'deploy'
 
 - name: Create additional symlinks.
-  file:
+  ansible.builtin.file:
     src: "{{ link.src }}"
     dest: "{{ deploy_path }}/{{ link.dest }}"
     state: link
diff --git a/roles/deploy_code/tasks/main.yml b/roles/deploy_code/tasks/main.yml
index a8021dcf..f4bd05af 100644
--- a/roles/deploy_code/tasks/main.yml
+++ b/roles/deploy_code/tasks/main.yml
@@ -1,2 +1,2 @@
 ---
-- include_tasks: "{{ deploy_operation }}.yml"
+- ansible.builtin.include_tasks: "{{ deploy_operation }}.yml"

From 3f8c89ee822bcd53d023ad1385d6bbe86dc847c2 Mon Sep 17 00:00:00 2001
From: gregharvey <greg.harvey@gmail.com>
Date: Thu, 14 Apr 2022 16:24:11 +0200
Subject: [PATCH 6/7] New api_call role, focused on GitLab for now.

---
 roles/api_call/README.md         |  9 ++++++++
 roles/api_call/defaults/main.yml | 13 ++++++++++++
 roles/api_call/tasks/main.yml    | 35 ++++++++++++++++++++++++++++++++
 3 files changed, 57 insertions(+)
 create mode 100644 roles/api_call/README.md
 create mode 100644 roles/api_call/defaults/main.yml
 create mode 100644 roles/api_call/tasks/main.yml

diff --git a/roles/api_call/README.md b/roles/api_call/README.md
new file mode 100644
index 00000000..83d1ab28
--- /dev/null
+++ b/roles/api_call/README.md
@@ -0,0 +1,9 @@
+# API call
+
+Making RESTful API calls to other platforms.
+
+<!--TOC-->
+<!--ENDTOC-->
+
+<!--ROLEVARS-->
+<!--ENDROLEVARS-->
diff --git a/roles/api_call/defaults/main.yml b/roles/api_call/defaults/main.yml
new file mode 100644
index 00000000..091342e8
--- /dev/null
+++ b/roles/api_call/defaults/main.yml
@@ -0,0 +1,13 @@
+---
+api_call:
+  type: gitlab
+  base_url: https://gitlab.example.com/api/v4/
+  path: projects # see documentation - https://docs.gitlab.com/ee/api/
+  method: GET
+  token: "" # empty means anonymous action
+  token_type: trigger # options are 'trigger' or 'personal'
+  variables: []
+  status_codes:
+    - 200
+    - 201
+    - 202
\ No newline at end of file
diff --git a/roles/api_call/tasks/main.yml b/roles/api_call/tasks/main.yml
new file mode 100644
index 00000000..c837df2d
--- /dev/null
+++ b/roles/api_call/tasks/main.yml
@@ -0,0 +1,35 @@
+---
+- name: Ensure variables are empty.
+  ansible.builtin.set_fact:
+    _api_call_variables: ""
+    _api_call_url: ""
+
+- name: Build HTML escaped variable string.
+  ansible.builtin.set_fact:
+    _api_call_variables: "{{ _api_call_variables + ('' if ansible_loop.first else '&') + 'variables' + item }}"
+  with_items: "{{ api_call.variables }}"
+  loop_control:
+    extended: true
+  when: api_call.variables | length > 0
+
+- name: Build anonymous API call URL.
+  ansible.builtin.set_fact:
+    _api_call_url: "{{ api_call.base_url }}{{ api_call.path }}?{{ _api_call_variables }}"
+  when: api_call.token | length == 0
+
+- name: Build token authenticated API call URL.
+  ansible.builtin.set_fact:
+    _api_call_url: "{{ api_call.base_url }}{{ api_call.path }}?{% if api_call.token_type == 'trigger' %}token={% else %}private_token={% endif %}{{ api_call.token }}&{{ _api_call_variables }}"
+  when: api_call.token | length > 0
+
+- name: Display URL to call.
+  ansible.builtin.debug:
+    msg: "{{ _api_call_url }}"
+
+- name: Make API call.
+  ansible.builtin.uri:
+    url: "{{ _api_call_url }}"
+    method: "{{ api_call.method }}"
+    return_content: true
+    status_code: "{{ api_call.status_codes }}"
+  register: _api_call_return

From 54355568ff701af98514150227eb493ebe17636b Mon Sep 17 00:00:00 2001
From: gregharvey <greg.harvey@gmail.com>
Date: Thu, 14 Apr 2022 16:24:37 +0200
Subject: [PATCH 7/7] Optionally trigger an infra build with an API call.

---
 roles/deploy_code/defaults/main.yml | 24 +++++++++++++++++++++---
 roles/deploy_code/tasks/ami.yml     |  1 -
 roles/deploy_code/tasks/cleanup.yml | 17 ++++++++++++++---
 3 files changed, 35 insertions(+), 7 deletions(-)
 delete mode 100644 roles/deploy_code/tasks/ami.yml

diff --git a/roles/deploy_code/defaults/main.yml b/roles/deploy_code/defaults/main.yml
index 59b4cff5..d616bf08 100644
--- a/roles/deploy_code/defaults/main.yml
+++ b/roles/deploy_code/defaults/main.yml
@@ -21,6 +21,24 @@ deploy_code:
   # Path that you want to make sure has 755 permissions. Make sure to include the webroot WITHOUT the slash.
   perms_fix_path: ""
   # perms_fix_path: "www/sites/default"
-  # Pack an AMI if this is AWS and we are deploying instances with the code built in.
-  # This goes with ce-provision's 'repack' operation for deploying autoscaling groups.
-  pack_ami: false
+  # Trigger an API call to rebuild infra after a deploy, e.g. if you need to repack an AMI.
+  rebuild_infra: false
+  # Details of API call to trigger. See api_call role.
+  api_call:
+    type: gitlab
+    base_url: https://gitlab.example.com/api/v4/
+    path: projects/1/ref/main/trigger/pipeline
+    method: POST
+    token: asdf-1234
+    token_type: trigger
+    variables: []
+    # example build parameters
+    #  - "[ENV]=dev"
+    #  - "[PLAY]=myserver.yml"
+    #  - "[RESOURCE]=myserver-example-com"
+    #  - "[REGION]=eu-west-1"
+    #  - "[EXTRA_PARAMS]=--force"
+    status_codes:
+      - 200
+      - 201
+      - 202
diff --git a/roles/deploy_code/tasks/ami.yml b/roles/deploy_code/tasks/ami.yml
deleted file mode 100644
index ed97d539..00000000
--- a/roles/deploy_code/tasks/ami.yml
+++ /dev/null
@@ -1 +0,0 @@
----
diff --git a/roles/deploy_code/tasks/cleanup.yml b/roles/deploy_code/tasks/cleanup.yml
index 7932389c..4e648d25 100644
--- a/roles/deploy_code/tasks/cleanup.yml
+++ b/roles/deploy_code/tasks/cleanup.yml
@@ -46,6 +46,17 @@
     - deploy_code.mount_sync | length > 1
   run_once: true
 
-- name: Pack an AWS AMI.
-  ansible.builtin.include_tasks: "ami.yml"
-  when: deploy_code.pack_ami
+- name: Trigger an infrastructure rebuild.
+  ansible.builtin.include_role:
+    name: api_call
+  vars:
+    api_call:
+      type: "{{ deploy_code.api_call.type }}"
+      base_url: "{{ deploy_code.api_call.base_url }}"
+      path: "{{ deploy_code.api_call.path }}"
+      method: "{{ deploy_code.api_call.method }}"
+      token: "{{ deploy_code.api_call.token }}"
+      token_type: "{{ deploy_code.api_call.token_type }}"
+      variables: "{{ deploy_code.api_call.variables }}"
+      status_codes: "{{ deploy_code.api_call.status_codes }}"
+  when: deploy_code.rebuild_infra