Lab07

.github/workflows/ansible-deploy.yml

@@ -0,0 +1,119 @@
+name: Ansible Deployment
+
+on:
+  push:
+    branches:
+      - master
+      - main
+    paths:
+      - "ansible/**"
+      - "!ansible/docs/**"
+      - ".github/workflows/ansible-deploy.yml"
+  pull_request:
+    branches:
+      - master
+      - main
+    paths:
+      - "ansible/**"
+      - "!ansible/docs/**"
+      - ".github/workflows/ansible-deploy.yml"
+
+concurrency:
+  group: ansible-deploy-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Ansible Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install Ansible toolchain
+        run: |
+          pip install ansible ansible-lint
+          ansible-galaxy collection install -r ansible/requirements.yml
+
+      - name: Run ansible-lint
+        working-directory: ansible
+        run: ansible-lint playbooks/*.yml
+
+  deploy:
+    name: Deploy Application
+    needs: lint
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install Ansible toolchain
+        run: |
+          pip install ansible
+          ansible-galaxy collection install -r ansible/requirements.yml
+
+      - name: Configure SSH access
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+          ssh-keyscan -H "${{ secrets.VM_HOST }}" >> ~/.ssh/known_hosts
+
+      - name: Create runtime inventory
+        run: |
+          cat > /tmp/hosts.ini <<EOF
+          [webservers]
+          ci-target ansible_host=${{ secrets.VM_HOST }} ansible_user=${{ secrets.VM_USER }} ansible_ssh_private_key_file=~/.ssh/id_rsa
+
+          [webservers:vars]
+          ansible_python_interpreter=/usr/bin/python3
+          EOF
+
+      - name: Deploy with Ansible
+        env:
+          ANSIBLE_VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
+        working-directory: ansible
+        run: |
+          set -e
+
+          VAULT_ARGS=""
+          if [ -f group_vars/all.yml ]; then
+            if [ -z "$ANSIBLE_VAULT_PASSWORD" ]; then
+              echo "group_vars/all.yml exists but ANSIBLE_VAULT_PASSWORD is empty"
+              exit 1
+            fi
+            echo "$ANSIBLE_VAULT_PASSWORD" > /tmp/vault_pass
+            VAULT_ARGS="--vault-password-file /tmp/vault_pass"
+          fi
+
+          ansible-playbook playbooks/deploy.yml \
+            -i /tmp/hosts.ini \
+            $VAULT_ARGS \
+            -e "dockerhub_username=$DOCKERHUB_USERNAME" \
+            -e "dockerhub_password=$DOCKERHUB_PASSWORD"
+
+          rm -f /tmp/vault_pass
+
+      - name: Verify deployment
+        run: |
+          sleep 10
+          curl -f "http://${{ secrets.VM_HOST }}:5000/" >/dev/null
+          curl -f "http://${{ secrets.VM_HOST }}:5000/health" >/dev/null

.gitignore

@@ -32,3 +32,15 @@ pulumi/venv/
 *.jks
 *.json
 credentials
+
+# Ansible
+*.retry
+.vault_pass
+ansible/group_vars/all.yml
+ansible/group_vars/*.bak
+ansible/inventory/*.pyc
+__pycache__/
+
+# Monitoring
+monitoring/.env
+!monitoring/grafana/dashboards/lab07-logs-dashboard.json

Lab-1/app_python/app.py

@@ -1,17 +1,82 @@
 from __future__ import annotations
 
+import json
 import logging
 import os
 import platform
 import socket
+import time
 from datetime import datetime, timezone
 
 from dotenv import load_dotenv
-from flask import Flask, jsonify, request
+from flask import Flask, g, jsonify, request
 from flask_swagger_ui import get_swaggerui_blueprint
 
 app = Flask(__name__)
 
+
+class JSONFormatter(logging.Formatter):
+    def format(self, record: logging.LogRecord) -> str:
+        payload: dict[str, object] = {
+            'timestamp': datetime.fromtimestamp(
+                record.created,
+                timezone.utc
+            ).isoformat(timespec='milliseconds').replace('+00:00', 'Z'),
+            'level': record.levelname,
+            'logger': record.name,
+            'message': record.getMessage(),
+        }
+
+        extra_fields = (
+            'event',
+            'method',
+            'path',
+            'status_code',
+            'client_ip',
+            'user_agent',
+            'duration_ms',
+            'host',
+            'port',
+            'debug',
+        )
+
+        for field in extra_fields:
+            if hasattr(record, field):
+                payload[field] = getattr(record, field)
+
+        if record.exc_info:
+            payload['exception'] = self.formatException(record.exc_info)
+
+        return json.dumps(payload, ensure_ascii=True)
+
+
+def configure_logging() -> logging.Logger:
+    handler = logging.StreamHandler()
+    handler.setFormatter(JSONFormatter())
+
+    root_logger = logging.getLogger()
+    root_logger.handlers.clear()
+    root_logger.addHandler(handler)
+    root_logger.setLevel(logging.INFO)
+
+    # Route Flask internals through the same root logger.
+    app.logger.handlers.clear()
+    app.logger.propagate = True
+
+    return logging.getLogger('devops-info-service')
+
+
+def _iso_utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat(timespec='milliseconds').replace('+00:00', 'Z')
+
+
+def get_client_ip() -> str:
+    client_ip = request.headers.get('X-Forwarded-For', request.remote_addr or '')
+    if ',' in client_ip:
+        return client_ip.split(',')[0].strip()
+    return client_ip
+
+
 # conf
 load_dotenv()
 HOST = os.getenv('HOST', '0.0.0.0')
@@ -21,13 +86,17 @@
 # start time
 START_TIME = datetime.now(timezone.utc)
 
-# Logging
-logging.basicConfig(
-    level=logging.INFO,
-    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'
+# logging
+logger = configure_logging()
+logger.info(
+    'Application starting',
+    extra={
+        'event': 'startup',
+        'host': HOST,
+        'port': PORT,
+        'debug': DEBUG,
+    }
 )
-logger = logging.getLogger(__name__)
-logger.info('Application starting...')
 
 # swagger info
 SWAGGER_URL = '/docs'
@@ -41,10 +110,6 @@
 app.register_blueprint(swaggerui_blueprint, url_prefix=SWAGGER_URL)
 
 
-def _iso_utc_now() -> str:
-    return datetime.now(timezone.utc).isoformat(timespec='milliseconds').replace('+00:00', 'Z')
-
-
 def get_uptime() -> dict:
     delta = datetime.now(timezone.utc) - START_TIME
     seconds = int(delta.total_seconds())
@@ -81,12 +146,8 @@ def get_system_info() -> dict:
 
 
 def get_request_info() -> dict:
-    client_ip = request.headers.get('X-Forwarded-For', request.remote_addr or '')
-    if ',' in client_ip:
-        client_ip = client_ip.split(',')[0].strip()
-
     return {
-        'client_ip': client_ip,
+        'client_ip': get_client_ip(),
         'user_agent': request.headers.get('User-Agent', ''),
         'method': request.method,
         'path': request.path
@@ -110,7 +171,8 @@ def get_endpoints() -> list[dict]:
         {'path': '/health', 'method': 'GET', 'description': 'Health check'}
     ]
 
-#API
+
+# API
 OPENAPI_SPEC = {
     'openapi': '3.0.3',
     'info': {
@@ -145,7 +207,42 @@ def get_endpoints() -> list[dict]:
 
 @app.before_request
 def log_request() -> None:
-    logger.debug('Request: %s %s', request.method, request.path)
+    g.request_started_at = time.perf_counter()
+    logger.info(
+        'Incoming request',
+        extra={
+            'event': 'request_start',
+            'method': request.method,
+            'path': request.path,
+            'client_ip': get_client_ip(),
+            'user_agent': request.headers.get('User-Agent', ''),
+        }
+    )
+
+
+@app.after_request
+def log_response(response):
+    started_at = getattr(g, 'request_started_at', None)
+    duration_ms = None
+    if started_at is not None:
+        duration_ms = round((time.perf_counter() - started_at) * 1000, 2)
+
+    log_extra: dict[str, object] = {
+        'event': 'request_end',
+        'method': request.method,
+        'path': request.path,
+        'status_code': response.status_code,
+        'client_ip': get_client_ip(),
+    }
+    if duration_ms is not None:
+        log_extra['duration_ms'] = duration_ms
+
+    logger.log(
+        logging.ERROR if response.status_code >= 500 else logging.INFO,
+        'Request completed',
+        extra=log_extra
+    )
+    return response
 
 
 @app.route('/')
@@ -185,6 +282,16 @@ def swagger_json():
 
 @app.errorhandler(404)
 def not_found(error):
+    logger.warning(
+        'Endpoint not found',
+        extra={
+            'event': 'http_404',
+            'method': request.method,
+            'path': request.path,
+            'client_ip': get_client_ip(),
+            'status_code': 404,
+        }
+    )
     return jsonify({
         'error': 'Not Found',
         'message': 'Endpoint does not exist'
@@ -193,6 +300,27 @@ def not_found(error):
 
 @app.errorhandler(500)
 def internal_error(error):
+    original_error = getattr(error, 'original_exception', None)
+    extra = {
+        'event': 'http_500',
+        'method': request.method,
+        'path': request.path,
+        'client_ip': get_client_ip(),
+        'status_code': 500,
+    }
+
+    if original_error is not None:
+        logger.exception(
+            'Unhandled application exception',
+            exc_info=(type(original_error), original_error, original_error.__traceback__),
+            extra=extra
+        )
+    else:
+        logger.error(
+            'Internal server error',
+            extra=extra
+        )
+
     return jsonify({
         'error': 'Internal Server Error',
         'message': 'An unexpected error occurred'

README.md

@@ -3,6 +3,7 @@
 [![Labs](https://img.shields.io/badge/Labs-18-blue)](#labs)
 [![Exam](https://img.shields.io/badge/Exam-Optional-green)](#exam-alternative)
 [![Duration](https://img.shields.io/badge/Duration-18%20Weeks-lightgrey)](#course-roadmap)
+[![Ansible Deployment](https://github.com/Linktur/DevOps-Core-Course/actions/workflows/ansible-deploy.yml/badge.svg)](https://github.com/Linktur/DevOps-Core-Course/actions/workflows/ansible-deploy.yml)
 
 Master **production-grade DevOps practices** through hands-on labs. Build, containerize, deploy, monitor, and scale applications using industry-standard tools.
 

ansible/.ansible-lint

@@ -0,0 +1,4 @@
+---
+skip_list:
+  - key-order
+  - var-naming

ansible/ansible.cfg

@@ -0,0 +1,12 @@
+[defaults]
+inventory = inventory/hosts.ini
+roles_path = roles
+host_key_checking = False
+remote_user = ubuntu
+retry_files_enabled = False
+interpreter_python = auto_silent
+
+[privilege_escalation]
+become = True
+become_method = sudo
+become_user = root