ops(ansible): harden provisioning and restore automation

Fail before host changes when required deployment variables are missing.

Precreate the PostgreSQL temporary directory and escape Bash syntax during Jinja rendering.

ansible/playbooks/deploy-app.yml

@@ -1,7 +1,19 @@
 ---
 - name: Deploy todo application
   hosts: all
+  gather_facts: false
   become: true
+  pre_tasks:
+    - name: Validate required deployment configuration
+      block:
+        - name: Assert required deployment variables
+          ansible.builtin.assert:
+            that:
+              - app_db_password | default('', true) | length > 0
+              - app_image | default('', true) | length > 0
+            fail_msg: "Required deployment configuration is missing or invalid for {{ inventory_hostname }}."
+            quiet: true
+      any_errors_fatal: true
   roles:
     - app
   tasks:

ansible/playbooks/setup-node.yml

@@ -1,7 +1,22 @@
 ---
 - name: Configure todo nodes
   hosts: all
+  gather_facts: false
   become: true
+  pre_tasks:
+    - name: Validate required setup configuration
+      block:
+        - name: Assert required setup variables
+          ansible.builtin.assert:
+            that:
+              - app_db_password | default('', true) | length > 0
+              - wal_g_access_key | default('', true) | length > 0
+              - wal_g_secret_key | default('', true) | length > 0
+              - (deployment_environment | default('')) in ['prod', 'staging']
+              - (wal_g_s3_prefix | default('')) is match('^s3://.+/prod/?$')
+            fail_msg: "Required setup configuration is missing or invalid for {{ inventory_hostname }}."
+            quiet: true
+      any_errors_fatal: true
   roles:
     - common
     - postgres

ansible/roles/postgres/tasks/main.yml

@@ -1,4 +1,12 @@
 ---
+- name: Create PostgreSQL Ansible temporary directory
+  ansible.builtin.file:
+    path: /var/lib/pgsql/.ansible/tmp
+    state: directory
+    owner: postgres
+    group: postgres
+    mode: "0700"
+
 - name: Initialize PostgreSQL data directory
   ansible.builtin.command:
     argv: [postgresql-setup, --initdb]

ansible/roles/wal_g/templates/db-sync.sh.j2

@@ -17,7 +17,9 @@ systemctl stop "$POSTGRES_SERVICE"
 
 shopt -s dotglob nullglob
 contents=("$PGDATA"/*)
+{% raw %}
 if (( ${#contents[@]} > 0 )); then
+{% endraw %}
   rm -rf --one-file-system -- "${contents[@]}"
 fi