todo-hetzner/ansible/playbooks/deploy-app.yml

---
- name: Deploy todo application
  hosts: all
  gather_facts: false
  become: true
  pre_tasks:
    - name: Validate required deployment configuration
      block:
        - name: Assert required deployment variables
          ansible.builtin.assert:
            that:
              - app_db_password | default('', true) | length > 0
              - app_image | default('', true) | length > 0
            fail_msg: "Required deployment configuration is missing or invalid for {{ inventory_hostname }}."
            quiet: true
      any_errors_fatal: true
  roles:
    - app
  tasks:
    - name: Pull application image
      ansible.builtin.command:
        argv:
          - podman
          - pull
          - "{{ app_image }}"
      become_user: "{{ app_user }}"
      environment:
        XDG_RUNTIME_DIR: "/run/user/{{ app_user_uid }}"
      register: app_pull
      changed_when: "'Copying blob' in app_pull.stdout or 'Writing manifest' in app_pull.stdout"

    - name: Reload application user services
      ansible.builtin.command:
        argv: [systemctl, --user, daemon-reload]
      become_user: "{{ app_user }}"
      environment:
        XDG_RUNTIME_DIR: "/run/user/{{ app_user_uid }}"
      changed_when: false

    - name: Restart application
      ansible.builtin.command:
        argv: [systemctl, --user, restart, app-todo.service]
      become_user: "{{ app_user }}"
      environment:
        XDG_RUNTIME_DIR: "/run/user/{{ app_user_uid }}"
      changed_when: true

    - name: Wait for application health endpoint
      ansible.builtin.uri:
        url: "http://127.0.0.1:{{ app_port }}/healthz"
        status_code: 200
      register: app_health
      retries: 12
      delay: 2
      until: app_health.status == 200