infra-pipeline.yaml

trigger:
  batch: true
  branches:
    include:
      - main
  paths:
    exclude:
      - ansible/hosts.yaml
      - kubernetes/*

pr:
  branches:
    include:
      - main
  paths:
    exclude:
      - ansible/hosts.yaml

resources:
  repositories:
    - repository: azuredevops-lib
      type: github
      ref: refs/heads/main
      name: bancey/azuredevops-lib
      endpoint: bancey

parameters:
  - name: local_environments
    type: object
    default:
      - name: wanda
        address: "wanda.heimelska.co.uk"
      - name: thanos
        address: "thanos.heimelska.co.uk"
      - name: gamora
        address: "gamora.heimelska.co.uk"
      - name: hela
        address: "hela.heimelska.co.uk"
      - name: loki
        address: "loki.heimelska.co.uk"
      - name: thor
        address: "thor.heimelska.co.uk"
  - name: terraform_deployments
    type: object
    default:
      - deployment: generate_ansible_inventory
        environment: prod
        component: inventory
        destroy: false
        deploy: true
        preStep:
          - task: AzureCLI@2
            displayName: Download GitHub Private Key
            condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
            inputs:
              azureSubscription: "MSDN Sub"
              scriptType: "bash"
              scriptLocation: "inlineScript"
              inlineScript: az keyvault secret download --name GitHub-Bot-Private-Key --vault-name bancey-vault --file $(System.DefaultWorkingDirectory)/private-key.pem
        dependsOn: []
      - deployment: prod_twingate
        environment: prod
        component: twingate
        destroy: false
        deploy: true
        dependsOn: []
      - deployment: prod_dns
        environment: prod
        component: dns
        destroy: false
        deploy: true
        localEnvironments:
          - thanos
          - gamora
        dependsOn:
          - prod_twingate
      - deployment: test_vpn_gateway
        environment: test
        component: cloud-vpn-gateway
        destroy: false
        deploy: true
        dependsOn: []
      - deployment: prod_vpn_gateway
        environment: prod
        component: cloud-vpn-gateway
        destroy: false
        deploy: true
        dependsOn:
          - test_vpn_gateway
      - deployment: test_gameserver
        environment: test
        component: game-server
        destroy: false
        deploy: true
        preStep:
          task: AzureCLI@2
          displayName: Start Stopped VMs
          condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
          inputs:
            azureSubscription: "MSDN Sub"
            scriptType: "bash"
            addSpnToEnvironment: true
            scriptLocation: "inlineScript"
            inlineScript: |
              ids=$( az vm list -g games-test-rg --query "[[?powerState!='VM running'].id]" -d -o tsv)
              if [ -z "$ids" ]; then
                echo "No VMs to start"
              else
                echo "Starting VMs: $ids"
                az vm start --ids $ids
              fi
              echo "##vso[task.setvariable variable=testStoppedIds;isOutput=true]$ids"
        postStep:
          task: AzureCLI@2
          displayName: Stop VMs
          condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
          inputs:
            azureSubscription: "MSDN Sub"
            scriptType: "bash"
            addSpnToEnvironment: true
            scriptLocation: "inlineScript"
            inlineScript: |
              if [ -z "$(testStoppedIds)" ]; then
                echo "No VMs to start"
              else
                echo "Stopping VMs: $(testStoppedIds)"
                az vm stop --ids $(testStoppedIds)
                az vm deallocate --ids $(testStoppedIds)
              fi
        dependsOn:
          - prod_twingate
      - deployment: prod_gameserver
        environment: prod
        component: game-server
        destroy: false
        deploy: true
        preStep:
          task: AzureCLI@2
          displayName: Start Stopped VMs
          condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
          inputs:
            azureSubscription: "MSDN Sub"
            scriptType: "bash"
            addSpnToEnvironment: true
            scriptLocation: "inlineScript"
            inlineScript: |
              ids=$( az vm list -g games-prod-rg --query "[[?powerState!='VM running'].id]" -d -o tsv)
              if [ -z "$ids" ]; then
                echo "No VMs to start"
              else
                echo "Starting VMs: $ids"
                az vm start --ids $ids
              fi
              echo "##vso[task.setvariable variable=prodStoppedIds]$ids"
        postStep:
          task: AzureCLI@2
          displayName: Stop VMs
          condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
          inputs:
            azureSubscription: "MSDN Sub"
            scriptType: "bash"
            addSpnToEnvironment: true
            scriptLocation: "inlineScript"
            inlineScript: |
              if [ -z "$(prodStoppedIds)" ]; then
                echo "No VMs to start"
              else
                echo "Stopping VMs: $(prodStoppedIds)"
                az vm stop --ids $(prodStoppedIds)
                az vm deallocate --ids $(prodStoppedIds)
              fi
        dependsOn:
          - prod_twingate
          - test_gameserver
      - deployment: wanda_virtual_machines
        environment: prod
        component: virtual-machines
        extraCommandArgs: -var "target_nodes=[\"wanda\"]"
        destroy: false
        deploy: true
        localEnvironments:
          - wanda
        dependsOn:
          - generate_ansible_inventory
      - deployment: tiny_virtual_machines
        environment: prod
        component: virtual-machines
        extraCommandArgs: -var "target_nodes=[\"hela\",\"loki\",\"thor\"]"
        destroy: false
        deploy: true
        localEnvironments:
          - hela
          - loki
          - thor
        dependsOn:
          - generate_ansible_inventory
  - name: ansible_deployments
    type: object
    default:
      - deployment: rpi_ansible
        environment: prod
        playbook: rpi-ha.yaml
        secrets:
          - keepalived-pass
          - Twingate-banceylab-connector-Refresh-Token
          - Twingate-banceylab-connector-Access-Token
          - Twingate-banceylab-connector-2-Refresh-Token
          - Twingate-banceylab-connector-2-Access-Token
        localEnvironments:
          - thanos
          - gamora
        dependsOn:
          - generate_ansible_inventory

variables:
  - name: agentImage
    value: ubuntu-latest
  - name: stateStorageAccount
    value: banceystatestor
  - name: serviceConnection
    value: "MSDN Sub"

stages:
  - template: stages/check-hosts-online.yaml@azuredevops-lib
    parameters:
      dependencies: prod_twingate
      keyVaultName: bancey-vault
      serviceKeySecretName: Twingate-AzureDevOps-SA-Key
      serviceConnection: $(serviceConnection)
      hosts: ${{ parameters.local_environments }}
  - ${{ each deployment in parameters.terraform_deployments }}:
      - stage: ${{ deployment.deployment }}
        ${{ if and(deployment.localEnvironments, gt(length(join('', deployment.dependsOn)), 0)) }}:
          dependsOn: ${{ split(format('{0},{1}', join(',', deployment.dependsOn), 'check_hosts_online'), ',') }}
        ${{ elseif deployment.localEnvironments }}:
          dependsOn: check_hosts_online
        ${{ else }}:
          dependsOn: ${{ deployment.dependsOn }}
        ${{ if deployment.localEnvironments }}:
          condition: and(succeeded(), eq(stageDependencies.check_hosts_online.outputs['check_hosts_online.checkOnline_${{ deployment.localEnvironments[0] }}.online'], 'true'))
        ${{ else }}: # yamllint disable-line rule:key-duplicates
          condition: succeeded()
        jobs:
          - job: TerraformPlanApply
            pool:
              vmImage: $(agentImage)
            steps:
              - ${{ if deployment.preStep }}:
                  - ${{ deployment.preStep }}
              - ${{ if deployment.localEnvironments }}:
                  - template: steps/twingate-connect.yaml@azuredevops-lib
                    parameters:
                      keyVaultName: bancey-vault
                      serviceKeySecretName: Twingate-AzureDevOps-SA-Key
                      serviceConnection: $(serviceConnection)
              - ${{ if eq(deployment.component, 'virtual-machines') }}:
                  - template: steps/ansible.yaml@azuredevops-lib
                    parameters:
                      serviceConnection: $(serviceConnection)
                      keyVaultName: bancey-vault
                      privateKeySecretName: Packer-Private-Key
              - template: steps/terraform.yaml@azuredevops-lib
                parameters:
                  backendStorageAccount: $(stateStorageAccount)
                  workingDirectory: $(System.DefaultWorkingDirectory)/terraform/components/${{ deployment.component }}
                  azureRmKey: tfstate/${{ deployment.deployment }}.tfstate
                  serviceConnection: $(serviceConnection)
                  variableFilePath: $(System.DefaultWorkingDirectory)/terraform/environments/${{ deployment.environment }}/${{ deployment.environment }}.tfvars
                  ${{ if ne(deployment.extraCommandArgs, '') }}:
                    extraCommandArgs: ${{ deployment.extraCommandArgs }}
                  runApply: ${{ and(eq(deployment.deploy, true), eq(variables['Build.SourceBranch'], 'refs/heads/main')) }}
                  runDestroy: ${{ and(eq(deployment.destroy, true), eq(variables['Build.SourceBranch'], 'refs/heads/main')) }}
              - ${{ if deployment.postStep }}:
                  - ${{ deployment.postStep }}
  - ${{ each ansible_deployment in parameters.ansible_deployments }}:
      - stage: ${{ ansible_deployment.deployment }}
        ${{ if and(ansible_deployment.localEnvironments, gt(length(join('', ansible_deployment.dependsOn)), 0)) }}:
          dependsOn: ${{ split(format('{0},{1}', join(',', ansible_deployment.dependsOn), 'check_hosts_online'), ',') }}
        ${{ elseif ansible_deployment.localEnvironments }}:
          dependsOn: check_hosts_online
        ${{ else }}:
          dependsOn: ${{ ansible_deployment.dependsOn }}
        ${{ if ansible_deployment.localEnvironments }}:
          condition: and(succeeded(), eq(stageDependencies.check_hosts_online.outputs['check_hosts_online.checkOnline_${{ ansible_deployment.localEnvironments[0] }}.online'], 'true'))
        ${{ else }}: # yamllint disable-line rule:key-duplicates
          condition: succeeded()
        jobs:
          - job: AnsibleCheckRun
            pool:
              vmImage: $(agentImage)
            steps:
              - template: steps/twingate-connect.yaml@azuredevops-lib
                parameters:
                  keyVaultName: bancey-vault
                  serviceKeySecretName: Twingate-AzureDevOps-SA-Key
                  serviceConnection: $(serviceConnection)
              - template: steps/ansible.yaml@azuredevops-lib
                parameters:
                  serviceConnection: $(serviceConnection)
                  keyVaultName: bancey-vault
                  privateKeySecretName: Packer-Private-Key
                  playbook: ${{ ansible_deployment.playbook }}
                  secrets: ${{ ansible_deployment.secrets }}
                  requirementsFile: ${{ ansible_deployment.requirementsFile }}