# Deployment

This project uses Ansible + SOPS(age) to deploy the infrastructure.

## Install

Ansible

```bash
pipx install --include-deps ansible
pipx inject ansible boto3 botocore
ansible-galaxy collection install amazon.aws community.docker community.sops
```

AWS Session Manager plugin

```bash
brew install --cask session-manager-plugin
```

The Labs application servers are reached through SSH over AWS Systems Manager,
not through a bastion host. Before running a Labs playbook locally, provide
valid AWS credentials, the EC2 region, and the project-scoped SSH private key:

```bash
export AWS_PROFILE=your-aws-profile
export AWS_REGION=us-west-2
export ANSIBLE_PRIVATE_KEY_FILE="$HOME/.ssh/tidb-labs-deploy"
```

The matching public key must already be installed for the `ubuntu` user on the
current instances and by Launch Template User Data for replacement instances.

Age

```bash
apt install age
```

To install sops, refer to [sops documentation](https://github.com/getsops/sops/releases/tag/v3.11.0).

If you need age keys, please contact @di.wang

## Usage

### Bootstrap Machine

```bash
make bootstrap_machine
```

### Deploy Monitoring Stack

```bash
make deploy_monitoring
```

### Deploy Metabase

```bash
make deploy_metabase
```

### Deploy Labs Service

```bash
make deploy_labs_service
```

Before a production deployment, verify SSM-backed SSH connectivity without
changing the service:

```bash
ansible -i inventory/ lab_servers -m ping
ansible-playbook -i inventory/ playbooks/labs_service.yml --syntax-check
```

The Labs playbook always pulls the current image tags and recreates the stack.
`make deploy_labs_service` performs a rolling update: it validates both hosts,
deploys one host at a time, waits for both load-balancer target groups to report
the host healthy, and checks the public health endpoint between hosts.

### Deploy Labs From GitHub Actions

The `Deploy TiDB Labs` workflow is manual-only and deploys only from `main`.
Its `Production` environment requires these secrets:

- `TIDB_LABS_DEPLOY_SSH_PRIVATE_KEY`
- `SOPS_AGE_KEYS`

It also requires these environment variables:

- `AWS_DEPLOY_ROLE_ARN`
- `AWS_REGION`

AWS authentication uses GitHub OIDC. Do not store AWS access keys in GitHub.