Fix tags and ensure processes cleanup (#46)

Author: Ndpnt

CHANGELOG.md

@@ -2,10 +2,23 @@
 
 All changes that impact users of this module are documented in this file, in the [Common Changelog](https://common-changelog.org) format with some additional specifications defined in the CONTRIBUTING file. This codebase adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## Unreleased
+## Unreleased [patch]
+
+_Full changeset and discussions: [#46](https://github.com/OpenTermsArchive/deployment/pull/46)._
+
+> Development of this release was supported by the [French Ministry for Foreign Affairs](https://www.diplomatie.gouv.fr/fr/politique-etrangere-de-la-france/diplomatie-numerique/) through its ministerial [State Startups incubator](https://beta.gouv.fr/startups/open-terms-archive.html) under the aegis of the Ambassador for Digital Affairs.
+
+### Fixed
+
+- Ensure configuration changes are taken into account on restart
+- Make refined playbook execution work with the `start`, `stop` and `restart` tags
 
 ## 2.0.1 - 2024-06-04
 
+_Full changeset and discussions: [#45](https://github.com/OpenTermsArchive/deployment/pull/45)._
+
+> Development of this release was supported by the [French Ministry for Foreign Affairs](https://www.diplomatie.gouv.fr/fr/politique-etrangere-de-la-france/diplomatie-numerique/) through its ministerial [State Startups incubator](https://beta.gouv.fr/startups/open-terms-archive.html) under the aegis of the Ambassador for Digital Affairs.
+
 ### Fixed
 
 - Set up the Git-based databases at the proper locations

README.md

@@ -82,6 +82,10 @@ all:
       ota_directory: demo
 ```
 
+#### Changes on a existing deployment
+
+If the `ota_source_repository` is changed on an existing target, the application has to be [stopped](#playbook-execution-refinement) before the new configuration is deployed.
+
 - ### PM2 Configuration File — `pm2.config.cjs`
 
 **This file is mandatory**

playbooks/deploy.yml

@@ -2,6 +2,16 @@
 - name: Deploy Open Terms Archive applications
   hosts: all
   tasks:
+    - name: Install common required packages
+      ansible.builtin.include_role:
+        name: common
+        apply:
+          become: true
+
+    - name: Setup GitHub bot SSH key
+      ansible.builtin.include_role:
+        name: github
+
     - name: Load OTA applications configs
       tags: [always]
       ansible.builtin.include_role:
@@ -98,9 +108,10 @@
       ansible.builtin.include_role:
         name: ota/apps
 
-    - name: Start OTA applications
+    - name: Manage OTA applications processes
       ansible.builtin.include_role:
         name: pm2/manage
+      tags: [stop, start, restart]
 
     - name: Configure NGINX
       ansible.builtin.include_role:

roles/chromium/meta/main.yml

@@ -1,21 +1,21 @@
 ---
 - name: Install Chromium — Debian
+  when: ansible_distribution == 'Debian'
   ansible.builtin.apt:
     pkg:
       - chromium
     update_cache: true
     state: latest
-  when: ansible_distribution == 'Debian'
 
 - name: Install Chromium — Ubuntu
+  when: ansible_distribution == 'Ubuntu'
   ansible.builtin.apt:
     pkg:
       - chromium-browser
     update_cache: true
     state: latest
-  when: ansible_distribution == 'Ubuntu'
 
 # See https://github.com/puppeteer/puppeteer/blob/main/docs/troubleshooting.md#recommended-enable-user-namespace-cloning
 - name: Enable user namespace cloning to allow running Chromium in a sandbox
-  ansible.builtin.command: sysctl -w kernel.unprivileged_userns_clone=1
   when: ansible_facts['architecture'] != 'aarch64'
+  ansible.builtin.command: sysctl -w kernel.unprivileged_userns_clone=1

roles/chromium/tasks/main.yml

@@ -6,13 +6,13 @@
   delegate_to: localhost
 
 - name: Add GitHub Bot SSH key
+  when: github_bot_private_key_file.stat.exists
   ansible.builtin.copy:
     src: "{{ inventory_dir }}/github-bot-private-key"
     dest: /home/{{ ansible_user }}/.ssh/ota-github-bot-key
     owner: "{{ ansible_user }}"
     group: "{{ ansible_user }}"
     mode: "600"
-  when: github_bot_private_key_file.stat.exists
 
 - name: Add GitHub SSH key to known_hosts
   ansible.builtin.known_hosts: