Fix deploy role

ansible/deploy.yml

@@ -3,5 +3,8 @@
   # Deploy on both VMs, only the primary is "active"
   hosts: servers
   remote_user: ubuntu
+  gather_facts: false
+  # All role tasks require root user
+  become: true
   roles:
     - role: deploy

ansible/roles/deploy/defaults/main.yml

@@ -1,12 +1,11 @@
 ---
-deploy_envars:
-  - LARD_CONN_STRING:
-  - STINFO_CONN_STRING:
-
 deploy_files:
   - src: lard_ingestion.service
     dest: /etc/systemd/system
     mode: "0664"
+  - src: var_file
+    dest: /etc/systemd/lard_ingestion.var
+    mode: "0664"
   - src: "{{ playbook_dir }}/../target/release/lard_ingestion"
     dest: /usr/local/bin
     mode: "0755"

ansible/roles/deploy/files/lard_ingestion.service

@@ -5,6 +5,7 @@ Description=lard ingestion service
 User=lard
 Group=lard
 WorkingDirectory=/usr/local/bin
+EnvironmentFile=/etc/systemd/lard_ingestion.var
 ExecStart=/usr/local/bin/lard_ingestion lard
 Restart=on-failure
 

ansible/roles/deploy/files/var_file

@@ -0,0 +1,14 @@
+$ANSIBLE_VAULT;1.1;AES256
+38313465366433613266313236363863393931333631613262636162666263376533343239333930
+6665366132356337303739303432323865616630623334310a656438393735393563353634306332
+30303436363866346564656336333331303334643065373736386665666465633834396334636566
+3637323936363239340a623664356532626661633766663166303264353533663232646635383632
+61353334326130373361323132393832613163306438393466313631313636623730666661363335
+39313161633434373464616636343334363136303833383634343133313463663830373331616364
+35323030343862323265653964316161393162616463343636656562396361663664306434616632
+61636330353565653131333632326534393765313365633930316234646236346434646233313838
+34323264316635336239353765636665316233363665386533663130653063343266333936616536
+66373137373436356532623339336365303937323632646265623339643935643735303263316666
+66346662333061623138323562303164363931356630316162323935646537663661396339353032
+61656433653239313935653330623937303334356262333338303239363330313330636538663136
+3564

ansible/roles/deploy/tasks/main.yml

@@ -22,25 +22,11 @@
     mode: "{{ item.mode }}"
     owner: root
     group: root
-  become: true
   loop: "{{ deploy_files }}"
 
-- name: Import environment variables # noqa: command-instead-of-module
-  ansible.builtin.command: systemctl import-environment LARD_CONN_STRING STINFO_CONN_STRING
-  # TODO: ansible docs say that 'environment:' is "not a recommended way to pass in confidential data."
-  environment: "{{ deploy_envars }}"
-  become: true
-  changed_when: false
-
 - name: Start LARD ingestion service
   ansible.builtin.systemd:
     daemon_reload: true
     name: lard_ingestion
     state: restarted
     enabled: true
-  become: true
-
-- name: Unset environment variables # noqa: command-instead-of-module
-  ansible.builtin.command: systemctl unset-environment LARD_CONN_STRING STINFO_CONN_STRING
-  become: true
-  changed_when: false