From d118f52387971868565b95a26196376ab5e37d34 Mon Sep 17 00:00:00 2001
From: cole-maxwell1 <cole.n.maxwell99@gmail.com>
Date: Fri, 7 Aug 2026 09:58:15 -0500
Subject: [PATCH] ops(ansible): harden provisioning and restore automation

Fail before host changes when required deployment variables are missing.

Precreate the PostgreSQL temporary directory and escape Bash syntax during Jinja rendering.
---
 ansible/playbooks/deploy-app.yml            | 12 ++++++++++++
 ansible/playbooks/setup-node.yml            | 15 +++++++++++++++
 ansible/roles/postgres/tasks/main.yml       |  8 ++++++++
 ansible/roles/wal_g/templates/db-sync.sh.j2 |  2 ++
 4 files changed, 37 insertions(+)

diff --git a/ansible/playbooks/deploy-app.yml b/ansible/playbooks/deploy-app.yml
index fba56e0..020fe51 100644
--- a/ansible/playbooks/deploy-app.yml
+++ b/ansible/playbooks/deploy-app.yml
@@ -1,7 +1,19 @@
 ---
 - name: Deploy todo application
   hosts: all
+  gather_facts: false
   become: true
+  pre_tasks:
+    - name: Validate required deployment configuration
+      block:
+        - name: Assert required deployment variables
+          ansible.builtin.assert:
+            that:
+              - app_db_password | default('', true) | length > 0
+              - app_image | default('', true) | length > 0
+            fail_msg: "Required deployment configuration is missing or invalid for {{ inventory_hostname }}."
+            quiet: true
+      any_errors_fatal: true
   roles:
     - app
   tasks:
diff --git a/ansible/playbooks/setup-node.yml b/ansible/playbooks/setup-node.yml
index fb794c1..0cc0420 100644
--- a/ansible/playbooks/setup-node.yml
+++ b/ansible/playbooks/setup-node.yml
@@ -1,7 +1,22 @@
 ---
 - name: Configure todo nodes
   hosts: all
+  gather_facts: false
   become: true
+  pre_tasks:
+    - name: Validate required setup configuration
+      block:
+        - name: Assert required setup variables
+          ansible.builtin.assert:
+            that:
+              - app_db_password | default('', true) | length > 0
+              - wal_g_access_key | default('', true) | length > 0
+              - wal_g_secret_key | default('', true) | length > 0
+              - (deployment_environment | default('')) in ['prod', 'staging']
+              - (wal_g_s3_prefix | default('')) is match('^s3://.+/prod/?$')
+            fail_msg: "Required setup configuration is missing or invalid for {{ inventory_hostname }}."
+            quiet: true
+      any_errors_fatal: true
   roles:
     - common
     - postgres
diff --git a/ansible/roles/postgres/tasks/main.yml b/ansible/roles/postgres/tasks/main.yml
index 4d0e81a..144571f 100644
--- a/ansible/roles/postgres/tasks/main.yml
+++ b/ansible/roles/postgres/tasks/main.yml
@@ -1,4 +1,12 @@
 ---
+- name: Create PostgreSQL Ansible temporary directory
+  ansible.builtin.file:
+    path: /var/lib/pgsql/.ansible/tmp
+    state: directory
+    owner: postgres
+    group: postgres
+    mode: "0700"
+
 - name: Initialize PostgreSQL data directory
   ansible.builtin.command:
     argv: [postgresql-setup, --initdb]
diff --git a/ansible/roles/wal_g/templates/db-sync.sh.j2 b/ansible/roles/wal_g/templates/db-sync.sh.j2
index 25f87ba..4f95887 100644
--- a/ansible/roles/wal_g/templates/db-sync.sh.j2
+++ b/ansible/roles/wal_g/templates/db-sync.sh.j2
@@ -17,7 +17,9 @@ systemctl stop "$POSTGRES_SERVICE"
 
 shopt -s dotglob nullglob
 contents=("$PGDATA"/*)
+{% raw %}
 if (( ${#contents[@]} > 0 )); then
+{% endraw %}
   rm -rf --one-file-system -- "${contents[@]}"
 fi