Add deploy role

ansible/roles/deploy/defaults/main.yml

@@ -0,0 +1,15 @@
+---
+deploy_envars:
+  - LARD_CONN_STRING:
+  - STINFO_CONN_STRING:
+
+deploy_files:
+  - src: lard_ingestion.service
+    dest: /etc/systemd/system
+    mode: "0664"
+  - src: "{{ playbook_dir }}/../target/release/lard_ingestion"
+    dest: /usr/local/bin
+    mode: "0755"
+  - src: "{{ playbook_dir }}/../ingestion/resources"
+    dest: /usr/local/bin
+    mode: "0755"

ansible/roles/deploy/files/lard_ingestion.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=lard ingestion service
+
+[Service]
+User=lard
+Group=lard
+WorkingDirectory=/usr/local/bin
+ExecStart=/usr/local/bin/lard_ingestion lard
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/deploy/tasks/main.yml

@@ -0,0 +1,45 @@
+---
+- name: Create lard group
+  ansible.builtin.group:
+    name: lard
+    state: present
+
+- name: Create lard user
+  ansible.builtin.user:
+    name: lard
+    groups: lard
+    shell: /sbin/nologin
+    append: true
+    state: present
+    create_home: false
+
+# TODO: should we deploy in non root user?
+- name: Copy files to server
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: "{{ item.mode }}"
+    owner: root
+    group: root
+  become: true
+  loop: "{{ deploy_files }}"
+
+- name: Import environment variables # noqa: command-instead-of-module
+  ansible.builtin.command: systemctl import-environment LARD_CONN_STRING STINFO_CONN_STRING
+  # TODO: ansible docs say that 'environment:' is "not a recommended way to pass in confidential data."
+  environment: "{{ deploy_envars }}"
+  become: true
+  changed_when: false
+
+- name: Start LARD ingestion service
+  ansible.builtin.systemd:
+    daemon_reload: true
+    name: lard_ingestion
+    state: restarted
+    enabled: true
+  become: true
+
+- name: Unset environment variables # noqa: command-instead-of-module
+  ansible.builtin.command: systemctl unset-environment LARD_CONN_STRING STINFO_CONN_STRING
+  become: true
+  changed_when: false