Lab06

.github/workflows/ansible-deploy.yml

@@ -0,0 +1,95 @@
+name: Ansible Deployment
+
+on:
+  push:
+    branches: [ lab06, master ]
+    paths:
+      - 'ansible/**'
+      - '.github/workflows/ansible-deploy.yml'
+  pull_request:
+    branches: [ lab06, master ]
+    paths:
+      - 'ansible/**'
+      - '.github/workflows/ansible-deploy.yml'
+
+jobs:
+  lint:
+    name: Ansible Lint
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install Ansible + ansible-lint
+        run: |
+          python -m pip install --upgrade pip
+          pip install ansible ansible-lint
+
+      - name: Install Ansible collections
+        run: |
+          ansible-galaxy collection install -r ansible/requirements.yml
+
+      - name: Run ansible-lint
+        run: |
+          cd ansible
+          ansible-lint -p playbooks/*.yml roles
+
+  deploy:
+    name: Deploy Application
+    needs: lint
+
+    runs-on: [self-hosted, linux]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python venv
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 -m venv .venv
+          . .venv/bin/activate
+          python -m pip install --upgrade pip
+          python -m pip install ansible ansible-lint
+
+      - name: Install Ansible collections
+        shell: bash
+        run: |
+          set -euo pipefail
+          . .venv/bin/activate
+          ansible-galaxy collection install -r ansible/requirements.yml
+
+      - name: Deploy with Ansible
+        shell: bash
+        env:
+          ANSIBLE_VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
+        run: |
+          set -euo pipefail
+          . .venv/bin/activate
+          export ANSIBLE_CONFIG="$GITHUB_WORKSPACE/ansible/ansible.cfg"
+          cd ansible
+
+          if [[ -n "${ANSIBLE_VAULT_PASSWORD:-}" ]]; then
+            trap 'rm -f /tmp/vault_pass' EXIT
+            printf '%s' "${ANSIBLE_VAULT_PASSWORD}" > /tmp/vault_pass
+            ansible-playbook -i inventory/hosts.ini playbooks/deploy.yml --vault-password-file /tmp/vault_pass
+          else
+            ansible-playbook -i inventory/hosts.ini playbooks/deploy.yml
+          fi
+
+      - name: Verify deployment
+        shell: bash
+        env:
+          VM_HOST: ${{ secrets.VM_HOST }}
+        run: |
+          set -euo pipefail
+          HOST="${VM_HOST:-127.0.0.1}"
+          curl --retry 10 --retry-delay 3 --retry-connrefused -fsS "http://${HOST}:8000/health"
+          curl --retry 10 --retry-delay 3 --retry-connrefused -fsS "http://${HOST}:8000/"

.gitignore

@@ -1,5 +1,9 @@
 test
 .env
+.venv
+actions-runner/
+_work/
+.runner/
 key.json
 # --- Ansible ---
 *.retry

.vagrant/machines/default/virtualbox/action_set_name

@@ -0,0 +1 @@
+1773325600

.vagrant/machines/default/virtualbox/creator_uid

@@ -0,0 +1 @@
+0

.vagrant/machines/default/virtualbox/id

@@ -0,0 +1 @@
+5f4a1e02-46c6-4dcd-817a-01783b29dfd2

.vagrant/machines/default/virtualbox/index_uuid

@@ -0,0 +1 @@
+41695340a0c0459bb1ec1e9674b9fcae

.vagrant/rgloader/loader.rb

@@ -0,0 +1,12 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+# This file loads the proper rgloader/loader.rb file that comes packaged
+# with Vagrant so that encoded files can properly run with Vagrant.
+
+if ENV["VAGRANT_INSTALLER_EMBEDDED_DIR"]
+  require File.expand_path(
+    "rgloader/loader", ENV["VAGRANT_INSTALLER_EMBEDDED_DIR"])
+else
+  raise "Encoded files can't be read outside of the Vagrant installer."
+end

Vagrantfile

@@ -2,14 +2,15 @@ Vagrant.configure("2") do |config|
   config.vm.box = "ubuntu/jammy64"
   config.vm.hostname = "lab05"
 
-  # ВАЖНО: отключаем шаринг папки проекта в VM
-  # (часто ломается из-за кириллицы/пробелов в пути + нам не нужен репозиторий в VM)
+  # Disable project folder sharing inside the VM.
+  # This avoids common Windows path issues (spaces, Cyrillic characters)
+  # and is not needed for this lab workflow.
   config.vm.synced_folder ".", "/vagrant", disabled: true
 
-  # Пробрасываем порты на Windows-хост
-  # host_ip "0.0.0.0" нужно, чтобы WSL мог подключиться к проброшенному порту через IP Windows-хоста.
+  # Forward ports to the Windows host.
+  # host_ip "0.0.0.0" lets WSL2 reach the forwarded ports through the host.
   config.vm.network "forwarded_port", guest: 22, host: 2222, host_ip: "0.0.0.0", id: "ssh", auto_correct: true
-  config.vm.network "forwarded_port", guest: 5000, host: 5000, host_ip: "0.0.0.0", id: "app", auto_correct: true
+  config.vm.network "forwarded_port", guest: 8000, host: 8000, host_ip: "0.0.0.0", id: "app", auto_correct: true
 
   config.ssh.insert_key = true
 

ansible/.ansible-lint

@@ -0,0 +1,3 @@
+skip_list:
+  - key-order
+  - var-naming[no-role-prefix]

ansible/README.md

@@ -1,8 +1,19 @@
-# Lab05 — Ansible
+# Lab05/Lab06 — Ansible
 
 See:
 - `labs/lab05.md` — assignment
 - `ansible/docs/LAB05.md` — report template
+- `labs/lab06.md` — assignment
+- `ansible/docs/LAB06.md` — report
+- `ansible/docs/LOCAL_VALIDATION_WINDOWS.md` — Windows + WSL2 local validation guide
+
+## Workflow badge
+
+After creating your GitHub repository, replace `OWNER/REPO` in the snippet below:
+
+```md
+[![Ansible Deployment](https://github.com/OWNER/REPO/actions/workflows/ansible-deploy.yml/badge.svg)](https://github.com/OWNER/REPO/actions/workflows/ansible-deploy.yml)
+```
 
 ## Quick start
 
@@ -19,6 +30,22 @@ ansible all -m ping
 ansible-playbook playbooks/provision.yml
 ansible-playbook playbooks/provision.yml
 
-# Deploy the application (uses Ansible Vault)
-ansible-playbook playbooks/deploy.yml --ask-vault-pass
+# Deploy the application with Docker Compose
+ansible-playbook playbooks/deploy.yml
+
+# Useful tag examples (Lab06)
+ansible-playbook playbooks/provision.yml --list-tags
+ansible-playbook playbooks/provision.yml --tags "docker_install"
+ansible-playbook playbooks/provision.yml --skip-tags "common"
+ansible-playbook playbooks/deploy.yml --tags "web_app"
+
+# Wipe only (double-gated: variable + tag)
+ansible-playbook playbooks/deploy.yml -e "web_app_wipe=true" --tags web_app_wipe
 ```
+
+## CI/CD (GitHub Actions)
+
+Workflow file: `.github/workflows/ansible-deploy.yml`.
+
+For Vagrant/VirtualBox setups behind NAT, prefer a **self-hosted Linux runner** on the same machine
+where you run Ansible (for example, WSL2 Ubuntu). This avoids inbound SSH exposure and stays free.