mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-11 13:17:07 +00:00
Single atomic landing for three back-to-back role-meta refactor requirements
(see docs/requirements/008-role-meta-layout.md, 009-per-role-networks-and-ports.md,
010-role-meta-runafter-lifecycle-migration.md).
req-008 — role meta layout
* Move every role's metadata under meta/<topic>.yml with file-root
convention (no wrapping key matching the basename):
- schema/main.yml + config/main.yml.credentials → meta/schema.yml
- users/main.yml → meta/users.yml
- config/main.yml.server → meta/server.yml
- config/main.yml.rbac → meta/rbac.yml
- config/main.yml.compose.services + every other top-level key
of config/main.yml inlined under <entity>.<key>
→ meta/services.yml
- config/main.yml.compose.volumes → meta/volumes.yml
* Drop the legacy schema/, users/, config/ directories from every role.
* meta/schema.yml: support nested credential keys, optional `default:`
field (Jinja literal, not rendered/validated/regenerated), implicit
`algorithm: plain`.
* Materialised paths drop the `compose.` prefix:
compose.services.<e>.<…> → services.<e>.<…>
compose.volumes.<k> → volumes.<k>
<former-top-level>.<…> → services.<entity_name>.<former-top-level>.<…>
* Update every Python consumer (utils/cache, utils/manager, utils/applications,
plugins/lookup, plugins/filter, cli/*) plus every Jinja template, vars/*.yml
and task file to the new paths.
* No legacy fallback. Repository-wide grep for `compose.services.` /
`compose.volumes.` / `schema/main.yml` / `users/main.yml` / `config/main.yml`
is empty outside docs/requirements/ and tasks/utils/migrate_meta_layout.py.
* Add tests/lint/repository/test_role_meta_layout.py guarding against the
old paths returning, and an explicit lint guard that meta/variants.yml
files do not carry a `compose:` wrapper.
req-009 — per-role networks/ports
* Move group_vars/all/08_networks.yml.defaults_networks.local.<role>.{subnet,
dns_resolver} into roles/<role>/meta/server.yml.networks.local.{subnet,
dns_resolver}.
* Delete group_vars/all/09_ports.yml entirely; ports now live on the
service entity that exposes them at
roles/<role>/meta/services.yml.<entity>.ports.{inter,local,public}.
* Rename + int-cast every former top-level `services.<entity>.port`
field to `services.<entity>.ports.inter` (single int).
* Always-category-keyed maps for ports.local / ports.public; relay
spans use {start, end} integers.
* Add PORT_BANDS map to group_vars/all/08_networks.yml — single source
of truth for the per-<scope>.<category> band ranges, consumed by both
the new CLI helpers and the lint test.
* New CLI helpers (cli meta ports suggest, cli meta networks suggest)
walk the live role tree gap-first then increment-fallback, with
deterministic output and non-zero exit on capacity overflow.
* cli create role consumes both helpers when scaffolding a new role.
* Lint extensions: bare-int port shape rejection, host-bound port
collision check (single ints + relay span integers, inter excluded),
band-membership check with documented allow-list for the legacy
web-app-bigbluebutton.bigbluebutton.local.http: 48087 entry.
req-010 — run_after / lifecycle migration
* Move galaxy_info.run_after and galaxy_info.lifecycle out of
meta/main.yml into meta/services.yml.<primary_entity>.{run_after,
lifecycle}; <primary_entity> is the value returned by
get_entity_name(role_name).
* For multi-entity roles whose primary entity has no compose service
(web-app-bluesky → bluesky, web-app-matrix → matrix, desk/dev/drv/
gen roles), create a dedicated metadata-only top-level entry under
<primary_entity>.
* Introduce utils/roles/meta_lookup.py with get_role_run_after /
get_role_lifecycle that resolve <primary_entity> once and read from
meta/services.yml; degrade gracefully when meta/services.yml is
absent OR the field is absent; raise MetaServicesShapeError when the
file exists but is malformed.
* Update every consumer (utils/service_registry, utils/invokable,
cli/meta/applications/resolution/run_after/__main__, cli/meta/roles/
lifecycle_filter/__main__, cli/meta/applications/resolution/combined,
cli/build/{tree,graph,role_include}, cli/deploy/development/{common,
init,deps,deploy}, plugins/filter/canonical_domains_map, etc.) to
use the helper.
* Lint guards: no run_after/lifecycle in meta/main.yml; lifecycle
values restricted to {planned,pre-alpha,alpha,beta,stable,deprecated};
run_after/lifecycle never on a non-primary entity; empty run_after
lists rejected.
Also folded into this change set
* services_disabler now writes `services.<svc>.{enabled,shared}` into
host_vars instead of the old `compose.services.<svc>.{...}` path; the
discover/find pair walks meta/services.yml and only treats entries
carrying enabled/shared/provides as provider declarations (so
metadata-only entries from req-010 do not create spurious provider
rows).
* service_registry skips `run_after` deps whose target was filtered
out via SERVICES_DISABLED instead of failing the whole load.
* cli/mirror/resolver and cli/create/inventory/mirror_overrides emit/
consume the new applications.<role>.services.<svc>.image shape
(mirror.md updated to match).
* utils/domains/list.build_applications_from_roles now reads
meta/server.yml directly (it had been silently returning {} since
config/main.yml stopped existing).
* utils/roles/resource_validation.filter_roles_by_min_storage reads
meta/services.yml.<entity>.min_storage instead of the legacy
compose.services path.
* web-app-bluesky pre-clones the social-app build context BEFORE
sys-svc-compose so the build context is on disk by the time
sys-stk-front-proxy/tasks/main.yml flushes the docker build handler.
* 4 meta/variants.yml files (svc-ai-ollama, web-app-phpmyadmin,
web-app-wordpress, web-app-keycloak) lose their `compose: services:`
wrapper so deep-merge over meta/services.yml lands on the new
file-root shape.
Validation
* Unit tests: 1571 passed.
* Lint tests: 50 passed.
* Integration tests: 161 passed (1 skipped).
* Full-cycle fresh-purged-apps deploy succeeded for the 8-app validation
set: web-app-{nextcloud,wordpress,yourls,bigbluebutton,bluesky,gitea,
discourse,mattermost}.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
196 lines
6.3 KiB
Python
196 lines
6.3 KiB
Python
# lookup_plugins/database.py
|
|
from __future__ import annotations
|
|
|
|
from typing import Any, Dict, List, Optional
|
|
|
|
from ansible.errors import AnsibleError
|
|
from ansible.plugins.lookup import LookupBase
|
|
|
|
from utils.applications.config import get
|
|
from utils.database_service import (
|
|
get_database_service_config,
|
|
resolve_database_service_key,
|
|
)
|
|
from utils.entity_name_utils import get_entity_name
|
|
from utils.cache.applications import get_merged_applications
|
|
|
|
|
|
class LookupModule(LookupBase):
|
|
"""
|
|
Resolve database values for a given database_consumer_id.
|
|
|
|
API (STRICT):
|
|
- {{ lookup('database', database_consumer_id) }}
|
|
- {{ lookup('database', database_consumer_id, 'url_full') }}
|
|
|
|
Notes:
|
|
- want-path is optional and MUST be the second positional argument if used
|
|
- kwarg want= is NOT supported (use positional want-path)
|
|
"""
|
|
|
|
def run(
|
|
self,
|
|
terms: List[Any],
|
|
variables: Optional[Dict[str, Any]] = None,
|
|
**kwargs: Any,
|
|
) -> List[Any]:
|
|
terms = terms or []
|
|
if len(terms) not in (1, 2):
|
|
raise AnsibleError("database: requires database_consumer_id [, want_path]")
|
|
|
|
# STRICT: do not support legacy want= kwarg at all
|
|
if "want" in kwargs and str(kwargs.get("want") or "").strip():
|
|
raise AnsibleError(
|
|
"database: kwarg 'want=' is not supported; use positional want_path "
|
|
"like lookup('database', <id>, 'url_full')"
|
|
)
|
|
|
|
consumer_id = str(terms[0]).strip()
|
|
if not consumer_id:
|
|
raise AnsibleError("database: database_consumer_id must not be empty")
|
|
|
|
# STRICT positional want-path (optional)
|
|
want = str(terms[1]).strip() if len(terms) == 2 else ""
|
|
if not want:
|
|
want = "all"
|
|
|
|
vars_ = variables or self._templar.available_variables
|
|
applications = get_merged_applications(
|
|
variables=vars_,
|
|
roles_dir=kwargs.get("roles_dir"),
|
|
templar=getattr(self, "_templar", None),
|
|
)
|
|
path_instances = self._require_var(vars_, "DIR_COMPOSITIONS")
|
|
|
|
consumer_entity = get_entity_name(consumer_id)
|
|
|
|
try:
|
|
dbtype = resolve_database_service_key(applications, consumer_id)
|
|
except ValueError as exc:
|
|
raise AnsibleError(f"database: {exc}") from exc
|
|
|
|
database_service = get_database_service_config(applications, consumer_id)
|
|
enabled = bool(database_service.get("enabled", False))
|
|
shared = bool(database_service.get("shared", False))
|
|
|
|
# If no direct database service is configured: keep behavior similar to the
|
|
# historical empty-value lookup payload.
|
|
if not dbtype:
|
|
resolved = {
|
|
"id": "",
|
|
"enabled": enabled,
|
|
"shared": shared,
|
|
"type": "",
|
|
"name": consumer_entity,
|
|
"instance": "",
|
|
"host": "",
|
|
"container": "",
|
|
"username": consumer_entity,
|
|
"password": "",
|
|
"port": "",
|
|
"env": "",
|
|
"url_jdbc": "",
|
|
"url_full": "",
|
|
"volume": "",
|
|
"image": "",
|
|
"version": "",
|
|
"reach_host": "127.0.0.1",
|
|
}
|
|
return [resolved if want == "all" else resolved.get(want, "")]
|
|
|
|
# Central/shared DB if shared==True
|
|
central_enabled = shared
|
|
db_id = f"svc-db-{dbtype}"
|
|
|
|
central_name = get(
|
|
applications,
|
|
db_id,
|
|
f"services.{dbtype}.name",
|
|
strict=False,
|
|
default="",
|
|
skip_missing_app=True,
|
|
)
|
|
central_name = (str(central_name) if central_name is not None else "").strip()
|
|
|
|
name = consumer_entity
|
|
instance = central_name if central_enabled else name
|
|
host = central_name if central_enabled else "database"
|
|
container = dbtype if central_enabled else f"{consumer_entity}-database"
|
|
username = consumer_entity
|
|
|
|
password = get(
|
|
applications,
|
|
consumer_id,
|
|
"credentials.database_password",
|
|
strict=False,
|
|
default="",
|
|
)
|
|
|
|
# Per req-009 the database port lives on the database role itself at
|
|
# `applications.svc-db-<type>.services.<type>.ports.local.database`.
|
|
port = get(
|
|
applications,
|
|
db_id,
|
|
f"services.{dbtype}.ports.local.database",
|
|
strict=False,
|
|
default="",
|
|
skip_missing_app=True,
|
|
)
|
|
|
|
default_version = get(
|
|
applications,
|
|
db_id,
|
|
f"services.{dbtype}.version",
|
|
strict=False,
|
|
default="",
|
|
skip_missing_app=True,
|
|
)
|
|
|
|
version = get(
|
|
applications,
|
|
consumer_id,
|
|
f"services.{dbtype}.version",
|
|
strict=False,
|
|
default=default_version,
|
|
)
|
|
|
|
# env path without compose dict
|
|
env_dir = f"{path_instances}{get_entity_name(consumer_id)}/.env/"
|
|
env = f"{env_dir}{dbtype}.env"
|
|
|
|
jdbc_scheme = dbtype if dbtype == "mariadb" else "postgresql"
|
|
url_jdbc = f"jdbc:{jdbc_scheme}://{host}:{port}/{name}"
|
|
url_full = f"{dbtype}://{username}:{password}@{host}:{port}/{name}"
|
|
|
|
volume_prefix = f"{consumer_entity}_" if not central_enabled else ""
|
|
volume = f"{volume_prefix}{host}"
|
|
|
|
resolved = {
|
|
"id": db_id,
|
|
"enabled": enabled,
|
|
"shared": shared,
|
|
"type": dbtype,
|
|
"name": name,
|
|
"instance": instance,
|
|
"host": host,
|
|
"container": container,
|
|
"username": username,
|
|
"password": password,
|
|
"port": port,
|
|
"env": env,
|
|
"url_jdbc": url_jdbc,
|
|
"url_full": url_full,
|
|
"volume": volume,
|
|
"image": dbtype,
|
|
"version": version,
|
|
"reach_host": "127.0.0.1",
|
|
}
|
|
|
|
return [resolved if want == "all" else resolved.get(want, "")]
|
|
|
|
@staticmethod
|
|
def _require_var(vars_: Dict[str, Any], key: str) -> Any:
|
|
if key not in vars_:
|
|
raise AnsibleError(f"database: required variable '{key}' is not set")
|
|
return vars_[key]
|