From fb779abd06fd17c46b4ae19a64bb116c81566072 Mon Sep 17 00:00:00 2001
From: DerLinkman <derlinkman@gmail.com>
Date: Sat, 18 Jul 2026 00:08:03 +0200
Subject: [PATCH] Add hawser role and playbook for stack upgrades

---
 playbooks/upgrade-hawser.yml                 | 18 ++++++++++++
 roles/hawser/defaults/main.yml               | 15 ++++++++++
 roles/hawser/handlers/main.yml               |  2 ++
 roles/hawser/tasks/main.yml                  |  2 ++
 roles/hawser/tasks/update-stack.yml          | 31 ++++++++++++++++++++
 roles/hawser/templates/docker-compose.yml.j2 | 17 +++++++++++
 6 files changed, 85 insertions(+)
 create mode 100644 playbooks/upgrade-hawser.yml
 create mode 100644 roles/hawser/defaults/main.yml
 create mode 100644 roles/hawser/handlers/main.yml
 create mode 100644 roles/hawser/tasks/main.yml
 create mode 100644 roles/hawser/tasks/update-stack.yml
 create mode 100644 roles/hawser/templates/docker-compose.yml.j2

diff --git a/playbooks/upgrade-hawser.yml b/playbooks/upgrade-hawser.yml
new file mode 100644
index 0000000..1d0e955
--- /dev/null
+++ b/playbooks/upgrade-hawser.yml
@@ -0,0 +1,18 @@
+- hosts: all
+  user: admin
+  become: true
+  tasks:
+    - name: Verify if system is Debian
+      debug:
+        msg: "This playbook is running on a Debian system."
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Stop playbook if system is not Debian
+      fail:
+        msg: "This playbook only supports Debian."
+      when: ansible_facts['os_family'] != "Debian"
+
+    - name: Include hawser role
+      import_role:
+        name: hawser
+      when: ansible_facts['os_family'] == "Debian"
\ No newline at end of file
diff --git a/roles/hawser/defaults/main.yml b/roles/hawser/defaults/main.yml
new file mode 100644
index 0000000..b465b5b
--- /dev/null
+++ b/roles/hawser/defaults/main.yml
@@ -0,0 +1,15 @@
+# Name des Docker Compose Projekts
+hawser_project_name: hawser
+
+# Verzeichnis, in dem die Compose-Datei auf den Zielsystemen liegt
+hawser_compose_dir: /opt/hawser
+
+# Freigegebener Port des Hawser-Agents
+hawser_port: "2376"
+
+# Name des externen Docker Volumes für die Stack-Dateien
+hawser_stacks_volume: hawser_stacks
+
+# ALLOW_INSECURE_NO_AUTH=true erlaubt Standard-Mode ohne Token auf nicht-loopback Adressen.
+# Nur setzen, wenn das Netzwerk durch andere Maßnahmen abgesichert ist.
+hawser_allow_insecure_no_auth: true
diff --git a/roles/hawser/handlers/main.yml b/roles/hawser/handlers/main.yml
new file mode 100644
index 0000000..3f76be8
--- /dev/null
+++ b/roles/hawser/handlers/main.yml
@@ -0,0 +1,2 @@
+---
+# Keine Handler erforderlich – docker compose up -d ersetzt laufende Container eigenständig
diff --git a/roles/hawser/tasks/main.yml b/roles/hawser/tasks/main.yml
new file mode 100644
index 0000000..94c60dd
--- /dev/null
+++ b/roles/hawser/tasks/main.yml
@@ -0,0 +1,2 @@
+- name: Update Hawser Docker stack
+  ansible.builtin.import_tasks: update-stack.yml
diff --git a/roles/hawser/tasks/update-stack.yml b/roles/hawser/tasks/update-stack.yml
new file mode 100644
index 0000000..0b80c9f
--- /dev/null
+++ b/roles/hawser/tasks/update-stack.yml
@@ -0,0 +1,31 @@
+- name: Gather Docker host information
+  community.docker.docker_host_info:
+  register: hawser_docker_info
+  ignore_errors: true
+
+- name: Check if Hawser compose file is present
+  ansible.builtin.stat:
+    path: "{{ hawser_compose_dir }}/docker-compose.yml"
+  register: hawser_compose_file
+  when: hawser_docker_info is not failed
+
+- name: Deploy Hawser compose file from template
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ hawser_compose_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+    mode: "0640"
+  when:
+    - hawser_docker_info is not failed
+    - hawser_compose_file.stat.exists
+
+- name: Pull latest images and recreate Hawser stack
+  community.docker.docker_compose_v2:
+    project_src: "{{ hawser_compose_dir }}"
+    project_name: "{{ hawser_project_name }}"
+    state: present
+    pull: always
+  when:
+    - hawser_docker_info is not failed
+    - hawser_compose_file.stat.exists
diff --git a/roles/hawser/templates/docker-compose.yml.j2 b/roles/hawser/templates/docker-compose.yml.j2
new file mode 100644
index 0000000..27bc2c1
--- /dev/null
+++ b/roles/hawser/templates/docker-compose.yml.j2
@@ -0,0 +1,17 @@
+services:
+  hawser:
+    container_name: hawser
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - {{ hawser_stacks_volume }}:/data/stacks
+    ports:
+      - "{{ hawser_port }}:2376"
+    environment:
+      - ALLOW_INSECURE_NO_AUTH={{ hawser_allow_insecure_no_auth | string | lower }}
+    image: ghcr.io/finsys/hawser:latest
+    restart: always
+
+volumes:
+  {{ hawser_stacks_volume }}:
+    external: true
+    name: {{ hawser_stacks_volume }}