---
- include_tasks: utils/once/flag.yml
- name: "🐳 Pre-compose web-enabled staging (services dir + social-app + login-broker)"
block:
- name: "✅ Ensure social-app services directory exists"
ansible.builtin.file:
path: "{{ BLUESKY_SOCIAL_APP_DIR | dirname }}"
state: directory
mode: "0755"
- name: "⬇️ Clone social-app build context (pre-compose)"
ansible.builtin.include_tasks: "01_social_app.yml"
- name: "🎬 Stage login-broker build context (pre-compose)"
ansible.builtin.include_tasks: "02_login_broker.yml"
when: BLUESKY_WEB_ENABLED | bool
- name: "▶️ Execute PDS routines"
ansible.builtin.include_tasks: "03_pds.yml"
- name: "🧹 Heal oauth2-proxy cfg bind-mount (if it became a directory in a prior deploy)"
ansible.builtin.script: "{{ role_path }}/files/shell/heal_sso_proxy_cfg.sh"
environment:
SSO_PROXY_CFG_PATH: "{{ [lookup('container', application_id, 'directories.volumes'), sso_proxy_instance.config_file] | path_join }}"
SSO_PROXY_CONTAINER: "{{ (application_id | entity_name) ~ '-' ~ sso_proxy_instance.service }}"
loop: "{{ lookup('sso', application_id, 'proxy_instances') }}"
loop_control:
loop_var: sso_proxy_instance
label: "{{ sso_proxy_instance.service }}"
changed_when: false
- name: "📂 include sys-stk-backend role"
include_role:
name: sys-stk-backend
vars:
compose_handlers_flush: false
- name: "🛡️ Refuse a pinned PDS that is older than its data"
ansible.builtin.include_tasks: "utils/pds_guard.yml"
when: IS_STACK_HOST | bool
- name: "🧱 Rebuild the stack when the pre-compose staging changed a build context"
ansible.builtin.debug:
msg: "Pre-compose build context changed for {{ application_id }}"
changed_when: true
notify:
- compose-build
- compose-up
when: >-
(BLUESKY_WEB_ENABLED | bool
and (bluesky_social_app_clone is changed
or bluesky_social_app_theme is changed
or bluesky_social_app_design_patches is changed
or bluesky_social_app_title_module is changed
or bluesky_social_app_title_patches is changed
or bluesky_social_app_logotype is changed
or bluesky_login_broker_copy is changed))
or bluesky_pdsadmin_download is changed
- name: "📂 Re-own the compose handler topics before the flush"
ansible.builtin.include_role:
name: sys-svc-compose
tasks_from: none.yml
handlers_from: main
- name: "🚿 Flush the compose handlers while they still point at '{{ application_id }}'"
meta: flush_handlers
- name: "📂 Include front proxy for {{ BLUESKY_API_DOMAIN }}:{{ BLUESKY_API_PORT }}"
include_role:
name: sys-stk-front-proxy
vars:
domain: "{{ BLUESKY_API_DOMAIN }}"
http_port: "{{ BLUESKY_API_PORT }}"
webserver_proxy_service_key: "{{ 'pds' if IS_SWARM_MODE else (application_id | entity_name) }}"
proxy_internal_port: "{{ lookup('config', application_id, 'services.api.ports.internal.http') if IS_SWARM_MODE else '' }}"
- name: "📂 Front proxy {{ BLUESKY_WEB_DOMAIN }} (broker if oauth2, else social-app)"
include_role:
name: sys-stk-front-proxy
vars:
domain: "{{ BLUESKY_WEB_DOMAIN }}"
http_port: "{{ BLUESKY_BROKER_PORT if (lookup('config', application_id, 'services.sso.enabled') | bool) else BLUESKY_WEB_PORT }}"
webserver_extra_configuration: "{{ BLUESKY_FRONT_PROXY_CONTENT }}"
webserver_proxy_service_key: >-
{{
(BLUESKY_BROKER_SERVICE if (lookup('config', application_id, 'services.sso.enabled') | bool) else 'web')
if IS_SWARM_MODE else (application_id | entity_name)
}}
proxy_internal_port: >-
{{
(lookup('config', application_id, 'services.broker.ports.internal.http')
if (lookup('config', application_id, 'services.sso.enabled') | bool)
else lookup('config', application_id, 'services.web.ports.internal.http'))
if IS_SWARM_MODE else ''
}}
when: BLUESKY_WEB_ENABLED | bool
- name: "📂 Front proxy for {{ BLUESKY_VIEW_DOMAIN_FINAL }}:{{ BLUESKY_VIEW_PORT }}"
include_role:
name: sys-stk-front-proxy
vars:
domain: "{{ BLUESKY_VIEW_DOMAIN_FINAL }}"
http_port: "{{ BLUESKY_VIEW_PORT }}"
webserver_proxy_service_key: "{{ 'view' if IS_SWARM_MODE else (application_id | entity_name) }}"
proxy_internal_port: "{{ lookup('config', application_id, 'services.view.ports.internal.http') if IS_SWARM_MODE else '' }}"
when: BLUESKY_VIEW_ENABLED | bool
- name: "📁 Create native PDS administrator (oauth2 disabled, no broker auto-provision)"
ansible.builtin.include_tasks: "04_native_admin.yml"
when:
- BLUESKY_WEB_ENABLED | bool
- not (lookup('config', application_id, 'services.sso.enabled') | bool)
- name: "🌐 DNS for Bluesky"
include_tasks: "05_dns.yml"
when: DNS_PROVIDER | lower == 'cloudflare'
- name: 🔍 Resolve the redirect mappings now (before include_role)
set_fact:
BLUESKY_REDIRECT_DOMAIN_MAPPINGS: >-
{{
( (BLUESKY_WEB_ENABLED | bool) | ternary([], [ {'source': BLUESKY_WEB_DOMAIN, 'target': BLUESKY_API_DOMAIN } ]) )
+ ( (BLUESKY_VIEW_ENABLED | bool) | ternary([], [ {'source': BLUESKY_VIEW_DOMAIN_LOCAL, 'target': BLUESKY_API_DOMAIN } ]) )
}}
- name: "🛠️ Redirect deactivated BlueSky Services to {{ BLUESKY_API_DOMAIN }}"
include_tasks: "utils/load/app.yml"
vars:
load_app_id: "web-opt-rdr-domains"
web_opt_rdr_domains_mappings: "{{ BLUESKY_REDIRECT_DOMAIN_MAPPINGS }}"
web_opt_rdr_domains_logout_enabled: true
- name: "🚿 Flush handlers for '{{ role_name }}'"
meta: flush_handlers
