second commit

ansible/roles/python_runtime/tasks/main.yml

@@ -0,0 +1,93 @@
+---
+- name: Systembenutzer fuer die Jumphost-App anlegen
+  ansible.builtin.group:
+    name: "{{ jumphost_app_group }}"
+    system: true
+
+- name: Systembenutzer anlegen (kein Login-Shell, kein Home mit Zugriff fuer andere)
+  ansible.builtin.user:
+    name: "{{ jumphost_app_user }}"
+    group: "{{ jumphost_app_group }}"
+    system: true
+    shell: /usr/sbin/nologin
+    home: "{{ jumphost_home }}"
+    create_home: false
+
+- name: Python 3 + venv-Paket installieren
+  ansible.builtin.apt:
+    name:
+      - python3
+      - python3-venv
+      - python3-pip
+    state: present
+    update_cache: true
+
+- name: Verzeichnisse anlegen
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ jumphost_app_user }}"
+    group: "{{ jumphost_app_group }}"
+    mode: "0750"
+  loop:
+    - "{{ jumphost_home }}"
+    - "{{ jumphost_data_dir }}"
+    - "{{ jumphost_data_dir }}/recordings"
+    - /run/jumphost
+    - /var/log/jumphost
+
+- name: Alten Anwendungscode entfernen (sauberes Redeploy)
+  ansible.builtin.file:
+    path: "{{ jumphost_home }}/{{ item }}"
+    state: absent
+  loop:
+    - app
+    - static
+    - templates
+
+- name: Anwendungscode kopieren
+  # Bewusst ueber ansible.builtin.copy statt ansible.posix.synchronize, damit
+  # das Playbook ohne zusaetzliche Collection auskommt und auch ohne rsync
+  # auf Control-Node/Zielsystem funktioniert (Konzept-Anspruch: minimale
+  # externe Abhaengigkeiten fuer den Deploy-Pfad selbst).
+  ansible.builtin.copy:
+    src: "{{ jumphost_repo_src }}/{{ item }}/"
+    dest: "{{ jumphost_home }}/{{ item }}/"
+    owner: "{{ jumphost_app_user }}"
+    group: "{{ jumphost_app_group }}"
+  loop:
+    - app
+    - static
+    - templates
+  notify: restart jumphost-app
+
+- name: requirements.txt kopieren
+  ansible.builtin.copy:
+    src: "{{ jumphost_repo_src }}/requirements.txt"
+    dest: "{{ jumphost_home }}/requirements.txt"
+    owner: "{{ jumphost_app_user }}"
+    group: "{{ jumphost_app_group }}"
+  notify: restart jumphost-app
+
+- name: Dateirechte auf Anwendungscode setzen
+  ansible.builtin.file:
+    path: "{{ jumphost_home }}"
+    state: directory
+    owner: "{{ jumphost_app_user }}"
+    group: "{{ jumphost_app_group }}"
+    recurse: true
+
+- name: Virtualenv anlegen
+  ansible.builtin.command:
+    cmd: "python3 -m venv {{ jumphost_venv }}"
+    creates: "{{ jumphost_venv }}/bin/python"
+  become: true
+  become_user: "{{ jumphost_app_user }}"
+
+- name: Python-Abhaengigkeiten installieren
+  ansible.builtin.pip:
+    requirements: "{{ jumphost_home }}/requirements.txt"
+    virtualenv: "{{ jumphost_venv }}"
+  become: true
+  become_user: "{{ jumphost_app_user }}"
+  notify: restart jumphost-app