awoooi/infra/ansible/playbooks/110-devops.yml

---
# AWOOOI Ansible — 192.168.0.110 DevOps 金庫完整狀態描述
# 執行: ansible-playbook -i inventory/hosts.yml playbooks/110-devops.yml
#
# 預期狀態:
#   swap:         8GB (swap.img 3.8G + swap2.img 4G)
#   harbor:       running (docker compose, port 5000)
#   sentry:       running (docker compose, 0 restarting)
#   gitea:        running (port 3001)
#   langfuse:     running (port 3100)
#   bitan:        running docker (port 3003)
#   wooo-aiops:   running PM2 (port 3000)
#   runners:      5x GitHub Actions runners (systemd)
#   nginx:        harbor conf -> 127.0.0.1:5000
#   keepalived:   BACKUP priority 90 VIP:200

- name: "192.168.0.110 DevOps 金庫 — 預期狀態收斂"
  hosts: host_110
  become: true
  vars:
    ansible_become_pass: "{{ vault_sudo_password | default(omit) }}"

  tasks:
    # ========================================================================
    # Swap 檢查
    # ========================================================================
    - name: "Swap | 確認 swap.img 存在"
      ansible.builtin.stat:
        path: /swap.img
      register: swap1_stat
      tags: swap

    - name: "Swap | 確認 swap2.img 存在"
      ansible.builtin.stat:
        path: /swap2.img
      register: swap2_stat
      tags: swap

    - name: "Swap | 建立 swap2.img (若不存在)"
      ansible.builtin.command:
        cmd: "fallocate -l 4G /swap2.img"
        creates: /swap2.img
      when: not swap2_stat.stat.exists
      tags: swap

    - name: "Swap | 格式化 swap2.img (若剛建立)"
      ansible.builtin.command:
        cmd: "mkswap /swap2.img"
      changed_when: true
      when: not swap2_stat.stat.exists
      tags: swap

    - name: "Swap | 設定 swap2.img 權限"
      ansible.builtin.file:
        path: /swap2.img
        mode: "0600"
      tags: swap

    - name: "Swap | 加入 swap2.img 到 fstab"
      ansible.builtin.lineinfile:
        path: /etc/fstab
        line: "/swap2.img none swap sw 0 0"
        state: present
      tags: swap

    - name: "Swap | 啟用 swap"
      ansible.builtin.command:
        cmd: "swapon --all"
      changed_when: false
      tags: swap

    # ========================================================================
    # Docker 服務健康檢查
    # ========================================================================
    - name: "Docker | 確認 Harbor 容器運作中"
      ansible.builtin.command:
        cmd: "docker ps --filter name=harbor --filter status=running --format '{{ '{{' }}.Names{{ '}}' }}'"
      register: harbor_status
      changed_when: false
      tags: docker

    - name: "Docker | Harbor 狀態警告"
      ansible.builtin.debug:
        msg: "⚠️  Harbor 容器未完全運作，請手動檢查 /opt/harbor"
      when: harbor_status.stdout == ""
      tags: docker

    - name: "Docker | 確認 Gitea 容器運作中"
      ansible.builtin.command:
        cmd: "docker ps --filter name=gitea --filter status=running --format '{{ '{{' }}.Names{{ '}}' }}'"
      register: gitea_status
      changed_when: false
      tags: docker

    - name: "Docker | 確認 Sentry 無 restart 容器"
      ansible.builtin.command:
        cmd: "docker ps --filter status=restarting --filter name=sentry --format '{{ '{{' }}.Names{{ '}}' }}'"
      register: sentry_restarting
      changed_when: false
      tags: docker

    - name: "Docker | Sentry crash loop 警告"
      ansible.builtin.debug:
        msg: "⚠️  Sentry 容器 crash loop: {{ sentry_restarting.stdout }}"
      when: sentry_restarting.stdout != ""
      tags: docker

    # ========================================================================
    # bitan pharmacy Docker 服務
    # ========================================================================
    - name: "Bitan | 確認 bitan container 運作中"
      ansible.builtin.command:
        cmd: "docker ps --filter name=bitan --filter status=running --format '{{ '{{' }}.Names{{ '}}' }}'"
      register: bitan_status
      changed_when: false
      tags: bitan

    - name: "Bitan | 若停止則啟動"
      ansible.builtin.command:
        cmd: "docker compose up -d"
        chdir: /home/wooo/apps/bitan-pharmacy
      changed_when: true
      when: bitan_status.stdout == ""
      tags: bitan

    # ========================================================================
    # GitHub Runners
    # ========================================================================
    - name: "Runners | 確認 runner 服務狀態"
      ansible.builtin.systemd:
        name: "github-runner-{{ item }}"
      register: runner_status
      loop: "{{ range(1, github_runner_count + 1) | list }}"
      ignore_errors: true
      tags: runners

    # ========================================================================
    # keepalived
    # ========================================================================
    - name: "Keepalived | 確認服務運作中"
      ansible.builtin.systemd:
        name: keepalived
      register: keepalived_status
      tags: keepalived

    - name: "Keepalived | 警告：keepalived 未運作"
      ansible.builtin.debug:
        msg: "⚠️  keepalived 未運作，VIP 200 可能失效"
      when: keepalived_status.status.ActiveState != "active"
      tags: keepalived

    # ========================================================================
    # Nginx harbor conf 指向確認
    # ========================================================================
    - name: "Nginx | 確認 harbor nginx conf 存在"
      ansible.builtin.stat:
        path: /etc/nginx/sites-enabled/harbor.conf
      register: harbor_nginx
      tags: nginx

    - name: "Nginx | 確認 harbor conf 指向 :5000 (非 :5050)"
      ansible.builtin.command:
        cmd: "grep -c ':5050' /etc/nginx/sites-enabled/harbor.conf"
      register: harbor_conf_check
      changed_when: false
      failed_when: false
      when: harbor_nginx.stat.exists
      tags: nginx

    - name: "Nginx | 警告：harbor conf 仍指向 :5050"
      ansible.builtin.debug:
        msg: "⚠️  harbor nginx conf 仍有 :5050，請確認已修正為 :5000"
      when: harbor_nginx.stat.exists and harbor_conf_check.stdout != "0"
      tags: nginx