From 3ccfe51727c35f7cef25216f0ae4d0701d9dabb9 Mon Sep 17 00:00:00 2001
From: EmlynK <emlyn.kinzett@codeenigma.com>
Date: Thu, 20 Jan 2022 10:13:40 +0000
Subject: [PATCH 01/11] Defer nightly backups, disable ASG processes during
 syncs and run syncs with backup (#94)

* Change location of nightly backup script and delegate the cron that runs it to the deploy server, if required (for ASGs).

* Set up nightly backup crons in separate files in /etc/cron.d

* Can't put site cron files in /etc/cron.d because the deploy user doesn't have perms.

* Try and add the ability to sync a site using a nightly backup instead of a fresh DB dump.

* Use Ansible modules to look up RDS host and to copy the nightly backup into place.

* Delegate PATH setup in db backup cron to localhost.

* Shell bad. Command good. But makes it convoluted. Oh well.

* Used wrong database name in source database copy.

* Try and disable the ReplaceUnhealthy auto scale process during syncs.

* Fix Drupal cron roles when deferring to deploy server.
---
 .../cron_database_backup-mysql/tasks/main.yml | 10 +++
 .../tasks/setup.yml                           | 18 ++++-
 roles/cron/cron_drupal7/tasks/main.yml        |  1 +
 roles/cron/cron_drupal8/tasks/main.yml        |  1 +
 .../database_sync-mysql/defaults/main.yml     |  9 +++
 .../database_sync-mysql/tasks/sync.yml        | 79 ++++++++++++++++++-
 6 files changed, 115 insertions(+), 3 deletions(-)

diff --git a/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/main.yml b/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/main.yml
index 04789df8..ffd14157 100644
--- a/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/main.yml
+++ b/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/main.yml
@@ -3,6 +3,16 @@
 # screwing the daily backup when using rolling db, we could
 # add a keep mechanism for backup scripts, like for the dumps themselves.
 # Nice to have more than anything.
+- name: Setup PATH in crontab.
+  cron:
+    name: PATH
+    env: true
+    job: "/usr/bin:/usr/local/bin:/bin:/home/{{ deploy_user }}/.bin"
+  delegate_to: localhost
+  when:
+    - drupal.defer is defined
+    - drupal.defer
+
 - include_tasks: setup.yml
   vars:
     database: database
diff --git a/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/setup.yml b/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/setup.yml
index bdc1534c..40b0c47e 100644
--- a/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/setup.yml
+++ b/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/setup.yml
@@ -25,12 +25,26 @@
 - name: Create backup script.
   template:
     src: "regular-backups.sh.j2"
-    dest: "/home/{{ deploy_user }}/{{ database.host }}-{{ database.original.database }}-regular-backups.sh"
+    dest: "/home/{{ deploy_user }}/shared/{{ project_name }}_{{ build_type }}/{{ database.host }}-{{ database.original.database }}-regular-backups.sh"
     mode: 0700
 
+- name: Define backup cron job command.
+  set_fact:
+    _backup_cron_job_command: "/bin/sh /home/{{ deploy_user }}/shared/{{ project_name }}_{{ build_type }}/{{ database.host }}-{{ database.original.database }}-regular-backups.sh"
+
+- name: Define backup cron job command if deferred (ASG).
+  set_fact:
+    _backup_cron_job_command: "cd {{ _ce_deploy_base_dir }} && {{ _ce_deploy_ansible_location }} {{ drupal.defer_target }} -m shell -a \"{{ _backup_cron_job_command }}\""
+  when:
+    - drupal.defer is defined
+    - drupal.defer
+    - drupal.defer_target is defined
+    - drupal.defer_target | length > 0
+
 - name: Setup regular backup for MySQL.
   cron:
     name: "cron_mysql_{{ database.host }}_{{ database.original.database }}"
     minute: "{{ _cron_mysql_backup_minute }}"
     hour: "{{ _cron_mysql_backup_hour }}"
-    job: "/bin/sh /home/{{ deploy_user }}/{{ database.host }}-{{ database.original.database }}-regular-backups.sh"
+    job: "{{ _backup_cron_job_command }}"
+  delegate_to: "{{ 'localhost' if drupal.defer else inventory_hostname }}"
diff --git a/roles/cron/cron_drupal7/tasks/main.yml b/roles/cron/cron_drupal7/tasks/main.yml
index d0cbfce9..75fa05c7 100644
--- a/roles/cron/cron_drupal7/tasks/main.yml
+++ b/roles/cron/cron_drupal7/tasks/main.yml
@@ -4,6 +4,7 @@
     name: PATH
     env: true
     job: "/usr/bin:/usr/local/bin:/bin:/home/{{ deploy_user }}/.bin"
+  delegate_to: localhost
   when:
     - drupal.defer is defined
     - drupal.defer
diff --git a/roles/cron/cron_drupal8/tasks/main.yml b/roles/cron/cron_drupal8/tasks/main.yml
index d0cbfce9..75fa05c7 100644
--- a/roles/cron/cron_drupal8/tasks/main.yml
+++ b/roles/cron/cron_drupal8/tasks/main.yml
@@ -4,6 +4,7 @@
     name: PATH
     env: true
     job: "/usr/bin:/usr/local/bin:/bin:/home/{{ deploy_user }}/.bin"
+  delegate_to: localhost
   when:
     - drupal.defer is defined
     - drupal.defer
diff --git a/roles/sync/database_sync/database_sync-mysql/defaults/main.yml b/roles/sync/database_sync/database_sync-mysql/defaults/main.yml
index c1d7b259..48e3e4a0 100644
--- a/roles/sync/database_sync/database_sync-mysql/defaults/main.yml
+++ b/roles/sync/database_sync/database_sync-mysql/defaults/main.yml
@@ -15,6 +15,13 @@ mysql_sync:
         type: fixed
         # For "rolling builds", so we can compute the database name.
         build_id: mybuildprod
+        # Whether or not use to create a fresh database backup or use a nightly one.
+        fresh_db: true
+        # Location where nightly backups are kept. This must match the value set for cron_mysql_backup.dumps_directory. Below is the default.
+        # This var is only used when fresh_db is set to "false".
+        dumps_directory: "/home/{{ deploy_user }}/shared/{{ project_name }}_{{ build_type }}/db_backups/mysql/regular"
+        # If the source is on an ASG, provide the ASG name here. Otherwise, leave empty.
+        asg: ""
       target:
         database: "{{ project_name }}_dev"
         credentials_file: "/home/{{ deploy_user }}/.mysql.creds"
@@ -25,3 +32,5 @@ mysql_sync:
         type: fixed
         # For "rolling builds", so we can compute the database name.
         build_id: mybuilddev
+        # If the target is on an ASG, provide the ASG name here. Otherwise, leave empty.
+        asg: ""
diff --git a/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml b/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
index 81e9b2ce..b8182bc3 100644
--- a/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
+++ b/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
@@ -1,4 +1,40 @@
 ---
+- name: Get database source host region.
+  amazon.aws.ec2_metadata_facts:
+  register: mysql_sync_source_database_host_info
+  delegate_to: "{{ database.source.host }}"
+  when:
+    - database.source.asg is defined
+    - database.source.asg | length > 0
+    - database.source.fresh_db is defined
+    - database.source.fresh_db
+
+# This task does not need a delegate_to because the hosts set in the sync playbook in the repo should be the target host.
+- name: Get database target host region.
+  amazon.aws.ec2_metadata_facts:
+  register: mysql_sync_target_database_host_info
+  when:
+    - database.target.asg is defined
+    - database.target.asg | length > 0
+
+- name: Disable ReplaceUnhealthy autoscale process on source ASG.
+  ansible.builtin.command: >
+    aws autoscaling suspend-processes --auto-scaling-group-name {{ database.source.asg }} --scaling-processes ReplaceUnhealthy --region {{ mysql_sync_source_database_host_info.ansible_facts.ansible_ec2_instance_identity_document_region }}
+  delegate_to: localhost
+  when:
+    - database.source.asg is defined
+    - database.source.asg | length > 0
+    - database.source.fresh_db is defined
+    - database.source.fresh_db
+
+- name: Disable ReplaceUnhealthy autoscale process on target ASG.
+  ansible.builtin.command: >
+    aws autoscaling suspend-processes --auto-scaling-group-name {{ database.target.asg }} --scaling-processes ReplaceUnhealthy --region {{ mysql_sync_target_database_host_info.ansible_facts.ansible_ec2_instance_identity_document_region }}
+  delegate_to: localhost
+  when:
+    - database.target.asg is defined
+    - database.target.asg | length > 0
+
 - name: Register remote dump name (from database).
   set_fact:
     mysql_sync_source_dump_path: "/tmp/{{ database.source.database }}.sql.bz2"
@@ -33,7 +69,30 @@
 - name: Take a dump from source database.
   shell: "mysqldump --defaults-extra-file={{ database.source.credentials_file }} {{ mysql_sync_source_database }} | bzip2 > {{ mysql_sync_source_dump_path }}"
   delegate_to: "{{ database.source.host }}"
-  when: not database.source.type == 'dump'
+  when:
+    - not database.source.type == 'dump'
+    - database.source.fresh_db
+
+- name: Find source database host.
+  ansible.builtin.command:
+    cmd: "grep 'host' {{ database.source.credentials_file }}"
+  register: mysql_host_info_grep
+  delegate_to: "{{ database.source.host }}"
+  when: not database.source.fresh_db
+
+- name: Register source database host.
+  set_fact:
+    mysql_sync_source_database_host: "{{ mysql_host_info_grep.stdout.split('=')[1] }}"
+  delegate_to: "{{ database.source.host }}"
+  when: not database.source.fresh_db
+
+- name: Copy a nightly backup for the source database.
+  ansible.builtin.copy:
+    src: "{{ database.source.dumps_directory }}/{{ mysql_sync_source_database_host }}/{{ database.source.database }}"
+    dest: "{{ mysql_sync_source_dump_path }}"
+    remote_src: true
+  delegate_to: "{{ database.source.host }}"
+  when: not database.source.fresh_db
 
 - name: Register tmp target dump name.
   set_fact:
@@ -95,3 +154,21 @@
     path: "{{ mysql_sync_target_dump_path }}"
     state: absent
   when: not database.target.type == 'dump'
+
+- name: Enable all autoscale processes on source ASG.
+  ansible.builtin.command: >
+    aws autoscaling resume-processes --auto-scaling-group-name {{ database.source.asg }} --region {{ mysql_sync_source_database_host_info.ansible_facts.ansible_ec2_instance_identity_document_region }}
+  delegate_to: localhost
+  when:
+    - database.source.asg is defined
+    - database.source.asg | length > 0
+    - database.source.fresh_db is defined
+    - database.source.fresh_db
+
+- name: Enable all autoscale processes on target ASG.
+  ansible.builtin.command: >
+    aws autoscaling resume-processes --auto-scaling-group-name {{ database.target.asg }} --region {{ mysql_sync_target_database_host_info.ansible_facts.ansible_ec2_instance_identity_document_region }}
+  delegate_to: localhost
+  when:
+    - database.target.asg is defined
+    - database.target.asg | length > 0

From a54c09cb0ce5b6889e672ba8ea741b71a3da034b Mon Sep 17 00:00:00 2001
From: Dionisio <dionisiofernandez83@gmail.com>
Date: Thu, 10 Mar 2022 14:16:13 +0100
Subject: [PATCH 02/11] Added deploy.yml examples for Drupal 9 and Localgov.
 Updated tests (#97)

---
 .github/workflows/ce-deploy-test.yml        | 22 ++++++++
 ce-dev/ansible/examples/drupal9/deploy.yml  | 55 +++++++++++++++++++
 ce-dev/ansible/examples/localgov/deploy.yml | 59 +++++++++++++++++++++
 3 files changed, 136 insertions(+)
 create mode 100644 ce-dev/ansible/examples/drupal9/deploy.yml
 create mode 100644 ce-dev/ansible/examples/localgov/deploy.yml

diff --git a/.github/workflows/ce-deploy-test.yml b/.github/workflows/ce-deploy-test.yml
index baa13347..141fc8e7 100644
--- a/.github/workflows/ce-deploy-test.yml
+++ b/.github/workflows/ce-deploy-test.yml
@@ -59,6 +59,28 @@ jobs:
           curl https://www.test.local
         shell: bash
 
+      - name: Run a test ce-dev deploy with Drupal 9
+        run: |
+          ce-dev create -p testnine -t drupal9 -d ~/testnine
+          cd ~/testnine
+          ce-dev init
+          ce-dev start
+          ce-dev provision
+          ce-dev deploy
+          curl https://www.testnine.local
+        shell: bash
+
+      - name: Run a test ce-dev deploy with Localgov
+        run: |
+          ce-dev create -p testlocalgov -t localgov -d ~/testlocalgov
+          cd ~/testlocalgov
+          ce-dev init
+          ce-dev start
+          ce-dev provision
+          ce-dev deploy
+          curl https://www.testlocalgov.local
+        shell: bash
+
       # Builds the table of contents for the docs
       - name: Documentation (build table of contents)
         if: ${{ github.event.pull_request.base.ref == '1.x' }}
diff --git a/ce-dev/ansible/examples/drupal9/deploy.yml b/ce-dev/ansible/examples/drupal9/deploy.yml
new file mode 100644
index 00000000..deeef9ee
--- /dev/null
+++ b/ce-dev/ansible/examples/drupal9/deploy.yml
@@ -0,0 +1,55 @@
+---
+# Template playbook for a local Drupal9 codebase.
+- hosts: deploy-web
+  vars:
+    - project_name: example
+    - project_type: drupal8
+    - webroot: web
+    - build_type: local
+    - _env_type: dev
+    - _domain_name: www.{{ project_name }}.local
+    # Path to your project root. This must match the "volume" set in the docker-compose template.
+    - deploy_path: /home/ce-dev/deploy/live.local
+    # This actually does not take any backup, but is needed to populate settings.php.
+    - mysql_backup:
+        handling: none
+        credentials_handling: static
+    # A list of Drupal sites (for multisites).
+    - drupal:
+        sites:
+          - folder: "default"
+            public_files: "sites/default/files"
+            install_command: "-y si"
+            # Toggle config import on/off. Disabled for initial passes.
+            config_import_command: ""
+            # config_import_command: "cim"
+            config_sync_directory: "config/sync"
+            sanitize_command: "sql-sanitize"
+            # Remove after initial pass, to avoid reinstalling Drupal.
+            force_install: yes
+            base_url: "https://{{ _domain_name }}"
+    # Composer command to run.
+    - composer:
+        command: install
+        no_dev: no
+        working_dir: "{{ deploy_path }}"
+        apcu_autoloader: no
+  pre_tasks:
+    # You can safely remove these steps once you have a working composer.json.
+    - name: Download composer file.
+      get_url:
+        url: https://raw.githubusercontent.com/drupal/recommended-project/9.3.x/composer.json
+        dest: "{{ deploy_path }}/composer.json"
+        force: no
+    - name: Install drush.
+      command:
+        cmd: composer require drush/drush:11.*
+        chdir: "{{ deploy_path }}"
+  roles:
+    - _init # Sets some variables the deploy scripts rely on.
+    - composer # Composer install step.
+    - database_backup # This is still needed to generate credentials.
+    - config_generate # Generates settings.php
+    #    - sync/database_sync # Grab database from a remote server.
+    - database_apply # Run drush updb and config import.
+    - _exit # Some common housekeeping.
\ No newline at end of file
diff --git a/ce-dev/ansible/examples/localgov/deploy.yml b/ce-dev/ansible/examples/localgov/deploy.yml
new file mode 100644
index 00000000..9844206b
--- /dev/null
+++ b/ce-dev/ansible/examples/localgov/deploy.yml
@@ -0,0 +1,59 @@
+---
+# Template playbook for a local localgov codebase.
+- hosts: deploy-web
+  vars:
+    - project_name: example
+    - project_type: drupal8
+    - webroot: web
+    - build_type: local
+    - _env_type: dev
+    - _domain_name: www.{{ project_name }}.local
+    # Path to your project root. This must match the "volume" set in the docker-compose template.
+    - deploy_path: /home/ce-dev/deploy/live.local
+    # This actually does not take any backup, but is needed to populate settings.php.
+    - mysql_backup:
+        handling: none
+        credentials_handling: static
+    # A list of Drupal sites (for multisites).
+    - drupal:
+        sites:
+          - folder: "default"
+            public_files: "sites/default/files"
+            install_command: "-y si localgov"
+            # Toggle config import on/off. Disabled for initial passes.
+            config_import_command: ""
+            # config_import_command: "cim"
+            config_sync_directory: "config/sync"
+            sanitize_command: "sql-sanitize"
+            # Remove after initial pass, to avoid reinstalling Drupal.
+            force_install: yes
+            base_url: "https://{{ _domain_name }}"
+    # Composer command to run.
+    - composer:
+        command: install
+        no_dev: no
+        working_dir: "{{ deploy_path }}"
+        apcu_autoloader: no
+  pre_tasks:
+    # You can safely remove these steps once you have a working composer.json.
+    - name: Download composer file.
+        get_url:
+          url: https://raw.githubusercontent.com/drupal/recommended-project/9.3.x/composer.json
+          dest: "{{ deploy_path }}/composer.json"
+          force: false
+    - name: Install drush.
+        command:
+          cmd: composer require drush/drush:11.*
+          chdir: "{{ deploy_path }}"
+    - name: Install localgov.
+        command:
+          cmd: composer require localgovdrupal/localgov
+          chdir: "{{ deploy_path }}"
+  roles:
+    - _init # Sets some variables the deploy scripts rely on.
+    - composer # Composer install step.
+    - database_backup # This is still needed to generate credentials.
+    - config_generate # Generates settings.php
+    #    - sync/database_sync # Grab database from a remote server.
+    - database_apply # Run drush updb and config import.
+    - _exit # Some common housekeeping.
\ No newline at end of file

From 223a3b5ecec42997d9e52de690cf7b8c5f9f19ab Mon Sep 17 00:00:00 2001
From: Greg Harvey <greg.harvey@gmail.com>
Date: Thu, 31 Mar 2022 12:43:36 +0200
Subject: [PATCH 03/11] Adding a new SimpleSAMLphp meta role. (#100)

---
 roles/_meta/deploy-simplesamlphp/README.md      |  9 +++++++++
 roles/_meta/deploy-simplesamlphp/tasks/main.yml | 17 +++++++++++++++++
 .../deploy_code-simplesamlphp/tasks/main.yml    |  1 +
 3 files changed, 27 insertions(+)
 create mode 100644 roles/_meta/deploy-simplesamlphp/README.md
 create mode 100644 roles/_meta/deploy-simplesamlphp/tasks/main.yml
 create mode 100644 roles/deploy_code/deploy_code-simplesamlphp/tasks/main.yml

diff --git a/roles/_meta/deploy-simplesamlphp/README.md b/roles/_meta/deploy-simplesamlphp/README.md
new file mode 100644
index 00000000..3d82e671
--- /dev/null
+++ b/roles/_meta/deploy-simplesamlphp/README.md
@@ -0,0 +1,9 @@
+# SimpleSAMLphp
+Role for deploying single SimpleSAMLphp instances. Do not use if you are deploying SimpleSAMLphp with another application like Drupal via composer.
+
+This role currently assumes all config is in the repository alongside composer.json and the special `SIMPLESAMLPHP_CONFIG_DIR` variable is passed in via the web server vhost to tell SimpleSAMLphp where the config is on the server. For vhost configuration in Nginx see ce-provision:
+
+* https://github.com/codeenigma/ce-provision/blob/1.x/roles/nginx
+
+<!--ROLEVARS-->
+<!--ENDROLEVARS-->
diff --git a/roles/_meta/deploy-simplesamlphp/tasks/main.yml b/roles/_meta/deploy-simplesamlphp/tasks/main.yml
new file mode 100644
index 00000000..7af28fa2
--- /dev/null
+++ b/roles/_meta/deploy-simplesamlphp/tasks/main.yml
@@ -0,0 +1,17 @@
+---
+# Default SimpleSAMLphp role. This is suitable for a standalone SimpleSAMLphp installation
+
+- ansible.builtin.import_role:
+    name: _init
+- ansible.builtin.import_role:
+    name: deploy_code
+- ansible.builtin.import_role:
+    name: composer
+- ansible.builtin.import_role:
+    name: database_backup
+- ansible.builtin.import_role:
+    name: live_symlink
+- ansible.builtin.import_role:
+    name: cache_clear/cache_clear-opcache
+- ansible.builtin.import_role:
+    name: _exit
diff --git a/roles/deploy_code/deploy_code-simplesamlphp/tasks/main.yml b/roles/deploy_code/deploy_code-simplesamlphp/tasks/main.yml
new file mode 100644
index 00000000..03c03856
--- /dev/null
+++ b/roles/deploy_code/deploy_code-simplesamlphp/tasks/main.yml
@@ -0,0 +1 @@
+# Nothing to do.
\ No newline at end of file

From 32843d53a625b68bc3a3f7a8cfcced5c90df3f49 Mon Sep 17 00:00:00 2001
From: Greg Harvey <greg.harvey@gmail.com>
Date: Wed, 13 Apr 2022 13:09:01 +0200
Subject: [PATCH 04/11] Allowing users to set cachetool version properly.
 (#102)

---
 roles/cli/cachetool/defaults/main.yml |  2 +-
 roles/cli/cachetool/tasks/main.yml    | 13 ++++++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/roles/cli/cachetool/defaults/main.yml b/roles/cli/cachetool/defaults/main.yml
index ad2c6711..5ec1b2d7 100644
--- a/roles/cli/cachetool/defaults/main.yml
+++ b/roles/cli/cachetool/defaults/main.yml
@@ -1,3 +1,3 @@
 ---
 cachetool:
-  version: 8.2.2
\ No newline at end of file
+  version: latest # # enter three-digit version number, e.g. "7.0.0", to install a specific version
\ No newline at end of file
diff --git a/roles/cli/cachetool/tasks/main.yml b/roles/cli/cachetool/tasks/main.yml
index 5a1969c6..aa27df04 100644
--- a/roles/cli/cachetool/tasks/main.yml
+++ b/roles/cli/cachetool/tasks/main.yml
@@ -13,7 +13,7 @@
   when:
     - deploy_operation == 'deploy'
 
-- name: Download cachetool installer.
+- name: Download latest cachetool installer.
   get_url:
     url: "http://gordalina.github.io/cachetool/downloads/cachetool.phar"
     dest: "{{ cachetool_bin }}"
@@ -21,3 +21,14 @@
   when:
     - deploy_operation == 'deploy'
     - not cachetool_global.stat.exists
+    - cachetool.version == 'latest'
+
+- name: "Download cachetool version {{ cachetool.version }} installer."
+  get_url:
+    url: "http://gordalina.github.io/cachetool/downloads/cachetool-{{ cachetool.version }}.phar"
+    dest: "{{ cachetool_bin }}"
+    mode: 0755
+  when:
+    - deploy_operation == 'deploy'
+    - not cachetool_global.stat.exists
+    - cachetool.version != 'latest'

From 91ea64efc91984ce88138857898b927b5ffd7b25 Mon Sep 17 00:00:00 2001
From: Greg Harvey <greg.harvey@gmail.com>
Date: Thu, 14 Apr 2022 17:13:09 +0200
Subject: [PATCH 05/11] Deploy ami pr 1.x (#106)

* Including an ami.yml for packing AMIs on build finale.

* New api_call role, focused on GitLab for now.

* Optionally trigger an infra build with an API call.
---
 roles/api_call/README.md            |  9 ++++++++
 roles/api_call/defaults/main.yml    | 13 +++++++++++
 roles/api_call/tasks/main.yml       | 35 +++++++++++++++++++++++++++++
 roles/deploy_code/defaults/main.yml | 21 +++++++++++++++++
 roles/deploy_code/tasks/cleanup.yml | 27 +++++++++++++++++-----
 roles/deploy_code/tasks/deploy.yml  | 10 ++++-----
 roles/deploy_code/tasks/main.yml    |  2 +-
 7 files changed, 105 insertions(+), 12 deletions(-)
 create mode 100644 roles/api_call/README.md
 create mode 100644 roles/api_call/defaults/main.yml
 create mode 100644 roles/api_call/tasks/main.yml

diff --git a/roles/api_call/README.md b/roles/api_call/README.md
new file mode 100644
index 00000000..83d1ab28
--- /dev/null
+++ b/roles/api_call/README.md
@@ -0,0 +1,9 @@
+# API call
+
+Making RESTful API calls to other platforms.
+
+<!--TOC-->
+<!--ENDTOC-->
+
+<!--ROLEVARS-->
+<!--ENDROLEVARS-->
diff --git a/roles/api_call/defaults/main.yml b/roles/api_call/defaults/main.yml
new file mode 100644
index 00000000..091342e8
--- /dev/null
+++ b/roles/api_call/defaults/main.yml
@@ -0,0 +1,13 @@
+---
+api_call:
+  type: gitlab
+  base_url: https://gitlab.example.com/api/v4/
+  path: projects # see documentation - https://docs.gitlab.com/ee/api/
+  method: GET
+  token: "" # empty means anonymous action
+  token_type: trigger # options are 'trigger' or 'personal'
+  variables: []
+  status_codes:
+    - 200
+    - 201
+    - 202
\ No newline at end of file
diff --git a/roles/api_call/tasks/main.yml b/roles/api_call/tasks/main.yml
new file mode 100644
index 00000000..c837df2d
--- /dev/null
+++ b/roles/api_call/tasks/main.yml
@@ -0,0 +1,35 @@
+---
+- name: Ensure variables are empty.
+  ansible.builtin.set_fact:
+    _api_call_variables: ""
+    _api_call_url: ""
+
+- name: Build HTML escaped variable string.
+  ansible.builtin.set_fact:
+    _api_call_variables: "{{ _api_call_variables + ('' if ansible_loop.first else '&') + 'variables' + item }}"
+  with_items: "{{ api_call.variables }}"
+  loop_control:
+    extended: true
+  when: api_call.variables | length > 0
+
+- name: Build anonymous API call URL.
+  ansible.builtin.set_fact:
+    _api_call_url: "{{ api_call.base_url }}{{ api_call.path }}?{{ _api_call_variables }}"
+  when: api_call.token | length == 0
+
+- name: Build token authenticated API call URL.
+  ansible.builtin.set_fact:
+    _api_call_url: "{{ api_call.base_url }}{{ api_call.path }}?{% if api_call.token_type == 'trigger' %}token={% else %}private_token={% endif %}{{ api_call.token }}&{{ _api_call_variables }}"
+  when: api_call.token | length > 0
+
+- name: Display URL to call.
+  ansible.builtin.debug:
+    msg: "{{ _api_call_url }}"
+
+- name: Make API call.
+  ansible.builtin.uri:
+    url: "{{ _api_call_url }}"
+    method: "{{ api_call.method }}"
+    return_content: true
+    status_code: "{{ api_call.status_codes }}"
+  register: _api_call_return
diff --git a/roles/deploy_code/defaults/main.yml b/roles/deploy_code/defaults/main.yml
index 19e45eee..d616bf08 100644
--- a/roles/deploy_code/defaults/main.yml
+++ b/roles/deploy_code/defaults/main.yml
@@ -21,3 +21,24 @@ deploy_code:
   # Path that you want to make sure has 755 permissions. Make sure to include the webroot WITHOUT the slash.
   perms_fix_path: ""
   # perms_fix_path: "www/sites/default"
+  # Trigger an API call to rebuild infra after a deploy, e.g. if you need to repack an AMI.
+  rebuild_infra: false
+  # Details of API call to trigger. See api_call role.
+  api_call:
+    type: gitlab
+    base_url: https://gitlab.example.com/api/v4/
+    path: projects/1/ref/main/trigger/pipeline
+    method: POST
+    token: asdf-1234
+    token_type: trigger
+    variables: []
+    # example build parameters
+    #  - "[ENV]=dev"
+    #  - "[PLAY]=myserver.yml"
+    #  - "[RESOURCE]=myserver-example-com"
+    #  - "[REGION]=eu-west-1"
+    #  - "[EXTRA_PARAMS]=--force"
+    status_codes:
+      - 200
+      - 201
+      - 202
diff --git a/roles/deploy_code/tasks/cleanup.yml b/roles/deploy_code/tasks/cleanup.yml
index dc72c752..4e648d25 100644
--- a/roles/deploy_code/tasks/cleanup.yml
+++ b/roles/deploy_code/tasks/cleanup.yml
@@ -1,13 +1,13 @@
 ---
 - name: Ensure codebase is writable.
-  shell:
+  ansible.builtin.shell:
     cmd: "if [ -d {{ deploy_path_prefix }}{{ item }} ]; then chmod -R 777 {{ deploy_path_prefix }}{{ item }}; fi"
   with_sequence: start={{ [previous_build_number | int - 50, 0] | max }}  end={{ [previous_build_number | int - deploy_code.keep, 0] | max }}
   become: true
   when: "www_user != deploy_user"
 
 - name: Ensure permissions are set on directory.
-  shell:
+  ansible.builtin.shell:
     cmd: "if [ -d {{ deploy_path_prefix }}{{ item }}/{{ deploy_code.perms_fix_path }} ]; then chmod 755 {{ deploy_path_prefix }}{{ item }}/{{ deploy_code.perms_fix_path }}; fi"
   with_sequence: start={{ [previous_build_number | int - 50, 0] | max }}  end={{ [previous_build_number | int - deploy_code.keep, 0] | max }}
   when:
@@ -15,13 +15,13 @@
     - deploy_code.perms_fix_path | length > 1
 
 - name: Delete codebases.
-  file:
+  ansible.builtin.file:
     name: "{{ deploy_path_prefix }}{{ item }}"
     state: absent
   with_sequence: start={{ [previous_build_number | int - 50, 0] | max }}  end={{ [previous_build_number | int - deploy_code.keep, 0] | max }}
 
 - name: Create a tarball of the deployed codebases.
-  command:
+  ansible.builtin.command:
     cmd: "tar -cvf /tmp/{{ project_name }}_{{ build_type }}.tar {{ deploy_base_path }}"
   when:
     - deploy_code.mount_sync is defined
@@ -29,7 +29,7 @@
   run_once: true
 
 - name: Create destination folder.
-  file:
+  ansible.builtin.file:
     path: "{{ deploy_code.mount_sync }}"
     state: directory
     mode: "0755"
@@ -39,9 +39,24 @@
   run_once: true
 
 - name: Move to final destination.
-  command:
+  ansible.builtin.command:
     cmd: "mv /tmp/{{ project_name }}_{{ build_type }}.tar {{ deploy_code.mount_sync }}/{{ project_name }}_{{ build_type }}.tar"
   when:
     - deploy_code.mount_sync is defined
     - deploy_code.mount_sync | length > 1
   run_once: true
+
+- name: Trigger an infrastructure rebuild.
+  ansible.builtin.include_role:
+    name: api_call
+  vars:
+    api_call:
+      type: "{{ deploy_code.api_call.type }}"
+      base_url: "{{ deploy_code.api_call.base_url }}"
+      path: "{{ deploy_code.api_call.path }}"
+      method: "{{ deploy_code.api_call.method }}"
+      token: "{{ deploy_code.api_call.token }}"
+      token_type: "{{ deploy_code.api_call.token_type }}"
+      variables: "{{ deploy_code.api_call.variables }}"
+      status_codes: "{{ deploy_code.api_call.status_codes }}"
+  when: deploy_code.rebuild_infra
diff --git a/roles/deploy_code/tasks/deploy.yml b/roles/deploy_code/tasks/deploy.yml
index 3693eb70..0d15425c 100644
--- a/roles/deploy_code/tasks/deploy.yml
+++ b/roles/deploy_code/tasks/deploy.yml
@@ -1,6 +1,6 @@
 ---
 - name: Copy project repository.
-  synchronize:
+  ansible.posix.synchronize:
     src: "{{ _ce_deploy_build_dir }}/"
     dest: "{{ deploy_path }}"
     archive: true
@@ -8,17 +8,17 @@
       - "--exclude=.git"
 
 - name: Ensure project repository is readable.
-  file:
+  ansible.builtin.file:
     path: "{{ deploy_path }}"
     state: directory
     mode: 0755
 
 - name: Project specific tasks.
-  include_role:
+  ansible.builtin.include_role:
     name: "deploy_code/deploy_code-{{ project_type }}"
 
 - name: Generate additional templates.
-  template:
+  ansible.builtin.template:
     src: "{{ template.src }}"
     dest: "{{ deploy_path }}/{{ template.dest }}"
   with_items: "{{ deploy_code.templates }}"
@@ -29,7 +29,7 @@
     - deploy_operation == 'deploy'
 
 - name: Create additional symlinks.
-  file:
+  ansible.builtin.file:
     src: "{{ link.src }}"
     dest: "{{ deploy_path }}/{{ link.dest }}"
     state: link
diff --git a/roles/deploy_code/tasks/main.yml b/roles/deploy_code/tasks/main.yml
index a8021dcf..f4bd05af 100644
--- a/roles/deploy_code/tasks/main.yml
+++ b/roles/deploy_code/tasks/main.yml
@@ -1,2 +1,2 @@
 ---
-- include_tasks: "{{ deploy_operation }}.yml"
+- ansible.builtin.include_tasks: "{{ deploy_operation }}.yml"

From 371b6b9d8b28a908facfe2d80779efd76cb64b40 Mon Sep 17 00:00:00 2001
From: Greg Harvey <greg.harvey@gmail.com>
Date: Wed, 20 Apr 2022 16:20:36 +0200
Subject: [PATCH 06/11] Making the MySQL dump command for routine back-ups less
 aggressive. (#104)

* Making the MySQL dump command for routine back-ups less aggressive.

* Making max_allowed_packets a variable we can set.

* Adding dump command to a re-usable central var.

* Renaming _init var so it's easier to distinguish in the code.
---
 roles/_init/defaults/main.yml                                | 1 +
 .../cron_database_backup-mysql/defaults/main.yml             | 1 +
 .../templates/regular-backups.sh.j2                          | 5 +++--
 .../database_backup/database_backup-mysql/defaults/main.yml  | 1 +
 .../database_backup-mysql/tasks/deploy-dump.yml              | 2 +-
 .../database_backup-mysql/tasks/deploy-rolling.yml           | 2 +-
 .../sync/database_sync/database_sync-mysql/defaults/main.yml | 1 +
 roles/sync/database_sync/database_sync-mysql/tasks/sync.yml  | 2 +-
 8 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/roles/_init/defaults/main.yml b/roles/_init/defaults/main.yml
index 06470a09..9821f131 100644
--- a/roles/_init/defaults/main.yml
+++ b/roles/_init/defaults/main.yml
@@ -2,6 +2,7 @@
 # Common defaults. Given the "_init" role is mandatory,
 # this will ensure defaults to other roles too.
 deploy_user: "deploy"
+_mysqldump_command: "mysqldump --max-allowed-packet=128M --single-transaction --skip-opt -e --quick --skip-disable-keys --skip-add-locks -C -a --add-drop-table"
 drupal:
   sites:
     - folder: "default"
diff --git a/roles/cron/cron_database_backup/cron_database_backup-mysql/defaults/main.yml b/roles/cron/cron_database_backup/cron_database_backup-mysql/defaults/main.yml
index c6c57269..29b8003b 100644
--- a/roles/cron/cron_database_backup/cron_database_backup-mysql/defaults/main.yml
+++ b/roles/cron/cron_database_backup/cron_database_backup-mysql/defaults/main.yml
@@ -2,3 +2,4 @@
 cron_mysql_backup:
   dumps_directory: "/home/{{ deploy_user }}/shared/{{ project_name }}_{{ build_type }}/db_backups/mysql/regular"
   keep: 10
+  mysqldump_command: "{{ _mysqldump_command }}" # set in _init but you can override here
diff --git a/roles/cron/cron_database_backup/cron_database_backup-mysql/templates/regular-backups.sh.j2 b/roles/cron/cron_database_backup/cron_database_backup-mysql/templates/regular-backups.sh.j2
index 901cfcf7..fb60cdea 100644
--- a/roles/cron/cron_database_backup/cron_database_backup-mysql/templates/regular-backups.sh.j2
+++ b/roles/cron/cron_database_backup/cron_database_backup-mysql/templates/regular-backups.sh.j2
@@ -10,7 +10,8 @@ TARBALL="$DB_NAME-$(date -Iseconds).sql.bz2"
 KEEP=$(({{ database.original.backup.keep | default(cron_mysql_backup.keep) }}+1))
 
 backup(){
-  mysqldump -u"$DBUSER" -p"$DBPASSWORD" -h"$DBHOST" "$CURRENT_DBNAME" | bzip2 > "$TARGET_DIR/$TARBALL"
+  {{ cron_mysql_backup.mysqldump_command }} \
+	    -u"$DBUSER" -p"$DBPASSWORD" -h"$DBHOST" "$CURRENT_DBNAME" | bzip2 > "$TARGET_DIR/$TARBALL"
   ln -sfn "$TARGET_DIR/$TARBALL" "$TARGET_DIR/$DB_NAME"
 }
 
@@ -23,4 +24,4 @@ cleanup(){
 }
 
 backup
-cleanup
\ No newline at end of file
+cleanup
diff --git a/roles/database_backup/database_backup-mysql/defaults/main.yml b/roles/database_backup/database_backup-mysql/defaults/main.yml
index 3ad97b6c..09f44ca3 100644
--- a/roles/database_backup/database_backup-mysql/defaults/main.yml
+++ b/roles/database_backup/database_backup-mysql/defaults/main.yml
@@ -2,6 +2,7 @@
 mysql_backup:
   handling: rolling
   dumps_directory: "/home/{{ deploy_user }}/shared/{{ project_name }}_{{ build_type }}/db_backups/mysql/build"
+  mysqldump_command: "{{ _mysqldump_command }}" # set in _init but you can override here
   # Number of dumps/db to keep. Note this is independant from the build codebases.
   keep: 10
   # This can be one of the following:
diff --git a/roles/database_backup/database_backup-mysql/tasks/deploy-dump.yml b/roles/database_backup/database_backup-mysql/tasks/deploy-dump.yml
index 4b470b89..57a46e2e 100644
--- a/roles/database_backup/database_backup-mysql/tasks/deploy-dump.yml
+++ b/roles/database_backup/database_backup-mysql/tasks/deploy-dump.yml
@@ -15,6 +15,6 @@
   run_once: true
 
 - name: Take a database dump.
-  shell: "mysqldump --defaults-extra-file={{ database.credentials_file }} {{ database.database }} | bzip2 > {{ mysql_backup.dumps_directory }}/{{ _mysql_host }}/{{ database.database }}-{{ previous_build_number }}.sql.bz2"
+  shell: "{{ mysql_backup.mysqldump_command }} --defaults-extra-file={{ database.credentials_file }} {{ database.database }} | bzip2 > {{ mysql_backup.dumps_directory }}/{{ _mysql_host }}/{{ database.database }}-{{ previous_build_number }}.sql.bz2"
   when: previous_build_number > 0
   run_once: true
diff --git a/roles/database_backup/database_backup-mysql/tasks/deploy-rolling.yml b/roles/database_backup/database_backup-mysql/tasks/deploy-rolling.yml
index fe32089a..cbade053 100644
--- a/roles/database_backup/database_backup-mysql/tasks/deploy-rolling.yml
+++ b/roles/database_backup/database_backup-mysql/tasks/deploy-rolling.yml
@@ -12,6 +12,6 @@
   run_once: true
 
 - name: Populate new database.
-  shell: "mysqldump --defaults-extra-file={{ database.credentials_file }} {{ _mysql_previous_build_database_name }} | mysql --defaults-extra-file={{ database.credentials_file }} {{ _mysql_build_database_name }}"
+  shell: "{{ mysql_backup.mysqldump_command }} --defaults-extra-file={{ database.credentials_file }} {{ _mysql_previous_build_database_name }} | mysql --defaults-extra-file={{ database.credentials_file }} {{ _mysql_build_database_name }}"
   when: previous_build_number > 0
   run_once: true
diff --git a/roles/sync/database_sync/database_sync-mysql/defaults/main.yml b/roles/sync/database_sync/database_sync-mysql/defaults/main.yml
index 48e3e4a0..008f0cf4 100644
--- a/roles/sync/database_sync/database_sync-mysql/defaults/main.yml
+++ b/roles/sync/database_sync/database_sync-mysql/defaults/main.yml
@@ -1,5 +1,6 @@
 ---
 mysql_sync:
+  mysqldump_command: "{{ _mysqldump_command }}" # set in _init but you can override here
   databases:
     - source:
         # Name of the database to take a dump from.
diff --git a/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml b/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
index b8182bc3..778092bc 100644
--- a/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
+++ b/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
@@ -67,7 +67,7 @@
   when: not database.source.type == 'rolling'
 
 - name: Take a dump from source database.
-  shell: "mysqldump --defaults-extra-file={{ database.source.credentials_file }} {{ mysql_sync_source_database }} | bzip2 > {{ mysql_sync_source_dump_path }}"
+  shell: "{{ mysql_sync.mysqldump_command }} --defaults-extra-file={{ database.source.credentials_file }} {{ mysql_sync_source_database }} | bzip2 > {{ mysql_sync_source_dump_path }}"
   delegate_to: "{{ database.source.host }}"
   when:
     - not database.source.type == 'dump'

From a9cc7adf64a8c7959f971df84df9e6172d0cf4c6 Mon Sep 17 00:00:00 2001
From: Greg Harvey <greg.harvey@gmail.com>
Date: Wed, 20 Apr 2022 18:18:47 +0200
Subject: [PATCH 07/11] Fix database backups pr 1.x (#109)

* Making the MySQL dump command for routine back-ups less aggressive.

* Making max_allowed_packets a variable we can set.

* Adding dump command to a re-usable central var.

* Renaming _init var so it's easier to distinguish in the code.

* Defaults file must be the first param for mysqldump.
---
 roles/_init/defaults/main.yml                                   | 2 +-
 .../cron_database_backup-mysql/defaults/main.yml                | 2 +-
 .../cron_database_backup-mysql/templates/regular-backups.sh.j2  | 2 +-
 roles/database_backup/database_backup-mysql/defaults/main.yml   | 2 +-
 .../database_backup/database_backup-mysql/tasks/deploy-dump.yml | 2 +-
 .../database_backup-mysql/tasks/deploy-rolling.yml              | 2 +-
 roles/sync/database_sync/database_sync-mysql/defaults/main.yml  | 2 +-
 roles/sync/database_sync/database_sync-mysql/tasks/sync.yml     | 2 +-
 8 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/roles/_init/defaults/main.yml b/roles/_init/defaults/main.yml
index 9821f131..c4d15b78 100644
--- a/roles/_init/defaults/main.yml
+++ b/roles/_init/defaults/main.yml
@@ -2,7 +2,7 @@
 # Common defaults. Given the "_init" role is mandatory,
 # this will ensure defaults to other roles too.
 deploy_user: "deploy"
-_mysqldump_command: "mysqldump --max-allowed-packet=128M --single-transaction --skip-opt -e --quick --skip-disable-keys --skip-add-locks -C -a --add-drop-table"
+_mysqldump_params: "--max-allowed-packet=128M --single-transaction --skip-opt -e --quick --skip-disable-keys --skip-add-locks -C -a --add-drop-table"
 drupal:
   sites:
     - folder: "default"
diff --git a/roles/cron/cron_database_backup/cron_database_backup-mysql/defaults/main.yml b/roles/cron/cron_database_backup/cron_database_backup-mysql/defaults/main.yml
index 29b8003b..f0c869f3 100644
--- a/roles/cron/cron_database_backup/cron_database_backup-mysql/defaults/main.yml
+++ b/roles/cron/cron_database_backup/cron_database_backup-mysql/defaults/main.yml
@@ -2,4 +2,4 @@
 cron_mysql_backup:
   dumps_directory: "/home/{{ deploy_user }}/shared/{{ project_name }}_{{ build_type }}/db_backups/mysql/regular"
   keep: 10
-  mysqldump_command: "{{ _mysqldump_command }}" # set in _init but you can override here
+  mysqldump_params: "{{ _mysqldump_params }}" # set in _init but you can override here
diff --git a/roles/cron/cron_database_backup/cron_database_backup-mysql/templates/regular-backups.sh.j2 b/roles/cron/cron_database_backup/cron_database_backup-mysql/templates/regular-backups.sh.j2
index fb60cdea..33c27a5a 100644
--- a/roles/cron/cron_database_backup/cron_database_backup-mysql/templates/regular-backups.sh.j2
+++ b/roles/cron/cron_database_backup/cron_database_backup-mysql/templates/regular-backups.sh.j2
@@ -10,7 +10,7 @@ TARBALL="$DB_NAME-$(date -Iseconds).sql.bz2"
 KEEP=$(({{ database.original.backup.keep | default(cron_mysql_backup.keep) }}+1))
 
 backup(){
-  {{ cron_mysql_backup.mysqldump_command }} \
+  mysqldump {{ cron_mysql_backup.mysqldump_params }} \
 	    -u"$DBUSER" -p"$DBPASSWORD" -h"$DBHOST" "$CURRENT_DBNAME" | bzip2 > "$TARGET_DIR/$TARBALL"
   ln -sfn "$TARGET_DIR/$TARBALL" "$TARGET_DIR/$DB_NAME"
 }
diff --git a/roles/database_backup/database_backup-mysql/defaults/main.yml b/roles/database_backup/database_backup-mysql/defaults/main.yml
index 09f44ca3..f7e070e9 100644
--- a/roles/database_backup/database_backup-mysql/defaults/main.yml
+++ b/roles/database_backup/database_backup-mysql/defaults/main.yml
@@ -2,7 +2,7 @@
 mysql_backup:
   handling: rolling
   dumps_directory: "/home/{{ deploy_user }}/shared/{{ project_name }}_{{ build_type }}/db_backups/mysql/build"
-  mysqldump_command: "{{ _mysqldump_command }}" # set in _init but you can override here
+  mysqldump_params: "{{ _mysqldump_params }}" # set in _init but you can override here
   # Number of dumps/db to keep. Note this is independant from the build codebases.
   keep: 10
   # This can be one of the following:
diff --git a/roles/database_backup/database_backup-mysql/tasks/deploy-dump.yml b/roles/database_backup/database_backup-mysql/tasks/deploy-dump.yml
index 57a46e2e..d06b1543 100644
--- a/roles/database_backup/database_backup-mysql/tasks/deploy-dump.yml
+++ b/roles/database_backup/database_backup-mysql/tasks/deploy-dump.yml
@@ -15,6 +15,6 @@
   run_once: true
 
 - name: Take a database dump.
-  shell: "{{ mysql_backup.mysqldump_command }} --defaults-extra-file={{ database.credentials_file }} {{ database.database }} | bzip2 > {{ mysql_backup.dumps_directory }}/{{ _mysql_host }}/{{ database.database }}-{{ previous_build_number }}.sql.bz2"
+  shell: "mysqldump --defaults-extra-file={{ database.credentials_file }} {{ mysql_backup.mysqldump_params }} {{ database.database }} | bzip2 > {{ mysql_backup.dumps_directory }}/{{ _mysql_host }}/{{ database.database }}-{{ previous_build_number }}.sql.bz2"
   when: previous_build_number > 0
   run_once: true
diff --git a/roles/database_backup/database_backup-mysql/tasks/deploy-rolling.yml b/roles/database_backup/database_backup-mysql/tasks/deploy-rolling.yml
index cbade053..1db841b0 100644
--- a/roles/database_backup/database_backup-mysql/tasks/deploy-rolling.yml
+++ b/roles/database_backup/database_backup-mysql/tasks/deploy-rolling.yml
@@ -12,6 +12,6 @@
   run_once: true
 
 - name: Populate new database.
-  shell: "{{ mysql_backup.mysqldump_command }} --defaults-extra-file={{ database.credentials_file }} {{ _mysql_previous_build_database_name }} | mysql --defaults-extra-file={{ database.credentials_file }} {{ _mysql_build_database_name }}"
+  shell: "mysqldump --defaults-extra-file={{ database.credentials_file }} {{ mysql_backup.mysqldump_params }} {{ _mysql_previous_build_database_name }} | mysql --defaults-extra-file={{ database.credentials_file }} {{ _mysql_build_database_name }}"
   when: previous_build_number > 0
   run_once: true
diff --git a/roles/sync/database_sync/database_sync-mysql/defaults/main.yml b/roles/sync/database_sync/database_sync-mysql/defaults/main.yml
index 008f0cf4..0ab99e98 100644
--- a/roles/sync/database_sync/database_sync-mysql/defaults/main.yml
+++ b/roles/sync/database_sync/database_sync-mysql/defaults/main.yml
@@ -1,6 +1,6 @@
 ---
 mysql_sync:
-  mysqldump_command: "{{ _mysqldump_command }}" # set in _init but you can override here
+  mysqldump_params: "{{ _mysqldump_params }}" # set in _init but you can override here
   databases:
     - source:
         # Name of the database to take a dump from.
diff --git a/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml b/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
index 778092bc..c3ff0b9e 100644
--- a/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
+++ b/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
@@ -67,7 +67,7 @@
   when: not database.source.type == 'rolling'
 
 - name: Take a dump from source database.
-  shell: "{{ mysql_sync.mysqldump_command }} --defaults-extra-file={{ database.source.credentials_file }} {{ mysql_sync_source_database }} | bzip2 > {{ mysql_sync_source_dump_path }}"
+  shell: "mysqldump --defaults-extra-file={{ database.source.credentials_file }} {{ mysql_sync.mysqldump_params }} {{ mysql_sync_source_database }} | bzip2 > {{ mysql_sync_source_dump_path }}"
   delegate_to: "{{ database.source.host }}"
   when:
     - not database.source.type == 'dump'

From 4c4c3ad1f9ecd25e25e9c2e5f79d4cb8108c9f34 Mon Sep 17 00:00:00 2001
From: EmlynK <emlyn.kinzett@codeenigma.com>
Date: Fri, 22 Apr 2022 10:28:11 +0100
Subject: [PATCH 08/11] Fix MySQL backup deferral. (#110)

---
 .../cron_database_backup-mysql/tasks/setup.yml                  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/setup.yml b/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/setup.yml
index 40b0c47e..d09fbbac 100644
--- a/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/setup.yml
+++ b/roles/cron/cron_database_backup/cron_database_backup-mysql/tasks/setup.yml
@@ -47,4 +47,4 @@
     minute: "{{ _cron_mysql_backup_minute }}"
     hour: "{{ _cron_mysql_backup_hour }}"
     job: "{{ _backup_cron_job_command }}"
-  delegate_to: "{{ 'localhost' if drupal.defer else inventory_hostname }}"
+  delegate_to: "{{ 'localhost' if drupal.defer is defined and drupal.defer else inventory_hostname }}"

From 029848d1163191087bd85f372973594b283aad17 Mon Sep 17 00:00:00 2001
From: EmlynK <emlyn.kinzett@codeenigma.com>
Date: Tue, 26 Apr 2022 11:30:31 +0100
Subject: [PATCH 09/11] Files recurse fix pr 1.x (#112)

* Don't recurse through site directory when setting permissions during config_generate step.

* Update drupal7 config_generate perms update task and use true/false instead of yes/no.
---
 .../config_generate/config_generate-drupal7/tasks/settings.yml | 3 +--
 .../config_generate/config_generate-drupal8/tasks/settings.yml | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/roles/config_generate/config_generate-drupal7/tasks/settings.yml b/roles/config_generate/config_generate-drupal7/tasks/settings.yml
index f82c9aa7..277899a0 100644
--- a/roles/config_generate/config_generate-drupal7/tasks/settings.yml
+++ b/roles/config_generate/config_generate-drupal7/tasks/settings.yml
@@ -15,9 +15,8 @@
   file:
     path: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
     state: directory
-    recurse: true
     mode: 0775
-  become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
+  become: "{{ false if www_user == deploy_user else true }}"
 
 - name: Generates settings.php file.
   template:
diff --git a/roles/config_generate/config_generate-drupal8/tasks/settings.yml b/roles/config_generate/config_generate-drupal8/tasks/settings.yml
index a9937d8e..70d9b113 100644
--- a/roles/config_generate/config_generate-drupal8/tasks/settings.yml
+++ b/roles/config_generate/config_generate-drupal8/tasks/settings.yml
@@ -19,9 +19,8 @@
   file:
     path: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
     state: directory
-    recurse: true
     mode: 0775
-  become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
+  become: "{{ false if www_user == deploy_user else true }}"
 
 - name: Generates settings.php file.
   template:

From b71fa83d6b4deda1daa4532c3a00e3835118cf4a Mon Sep 17 00:00:00 2001
From: EmlynK <emlyn.kinzett@codeenigma.com>
Date: Fri, 29 Apr 2022 11:52:28 +0100
Subject: [PATCH 10/11] Improve multisite support (#115)

* Pass -l option in drush commands to specify site name, which should match the site folder name.

* Move -l option in drush commands to the first option instead of the last.
---
 roles/cache_clear/cache_clear-drupal7/tasks/main.yml        | 2 +-
 roles/cache_clear/cache_clear-drupal8/tasks/main.yml        | 2 +-
 .../database_apply-drupal7/tasks/features.yml               | 4 ++--
 roles/database_apply/database_apply-drupal7/tasks/main.yml  | 4 ++--
 roles/database_apply/database_apply-drupal8/tasks/main.yml  | 6 +++---
 .../maintenance_mode-drupal-core/tasks/offline.yml          | 4 ++--
 .../maintenance_mode-drupal-core/tasks/online.yml           | 4 ++--
 .../admin_creds/admin_creds-drupal7/tasks/admin.yml         | 4 ++--
 .../admin_creds/admin_creds-drupal8/tasks/admin.yml         | 4 ++--
 roles/sanitize/sanitize-drupal8/tasks/main.yml              | 2 +-
 10 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/roles/cache_clear/cache_clear-drupal7/tasks/main.yml b/roles/cache_clear/cache_clear-drupal7/tasks/main.yml
index 1261ff4b..6f72b3a5 100644
--- a/roles/cache_clear/cache_clear-drupal7/tasks/main.yml
+++ b/roles/cache_clear/cache_clear-drupal7/tasks/main.yml
@@ -1,7 +1,7 @@
 ---
 - name: Clear Drupal 7 cache.
   command:
-    cmd: "{{ drush_bin }} -y cc all"
+    cmd: "{{ drush_bin }} -l {{ site.folder }} -y cc all"
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
   become_user: "{{ www_user }}"
diff --git a/roles/cache_clear/cache_clear-drupal8/tasks/main.yml b/roles/cache_clear/cache_clear-drupal8/tasks/main.yml
index cfd7fdd3..5b780086 100644
--- a/roles/cache_clear/cache_clear-drupal8/tasks/main.yml
+++ b/roles/cache_clear/cache_clear-drupal8/tasks/main.yml
@@ -1,7 +1,7 @@
 ---
 - name: Clear Drupal cache.
   command:
-    cmd: "{{ drush_bin }} -y cr"
+    cmd: "{{ drush_bin }} -l {{ site.folder }} -y cr"
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
   become_user: "{{ www_user }}"
diff --git a/roles/database_apply/database_apply-drupal7/tasks/features.yml b/roles/database_apply/database_apply-drupal7/tasks/features.yml
index 19d58e9b..edba46bf 100644
--- a/roles/database_apply/database_apply-drupal7/tasks/features.yml
+++ b/roles/database_apply/database_apply-drupal7/tasks/features.yml
@@ -1,8 +1,8 @@
 ---
 - name: Check if Features module is enabled.
-  shell: "cd {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }} && {{ drush_bin }} pm-info features | grep ':  enabled' | wc -l"
+  shell: "cd {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }} && {{ drush_bin }} -l {{ site.folder }} pm-info features | grep ':  enabled' | wc -l"
   register: features_enabled
 
 - name: Revert Drupal configuration from Features.
-  shell: "cd {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }} && {{ drush_bin }} -y {{ site.revert_features_command }}"
+  shell: "cd {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }} && {{ drush_bin }} -l {{ site.folder }} -y {{ site.revert_features_command }}"
   when: features_enabled.stdout == "1"
diff --git a/roles/database_apply/database_apply-drupal7/tasks/main.yml b/roles/database_apply/database_apply-drupal7/tasks/main.yml
index 048a1457..7c2201e2 100644
--- a/roles/database_apply/database_apply-drupal7/tasks/main.yml
+++ b/roles/database_apply/database_apply-drupal7/tasks/main.yml
@@ -2,7 +2,7 @@
 
 - name: Install Drupal.
   shell:
-    cmd: "{{ drush_bin }} -y si"
+    cmd: "{{ drush_bin }} -l {{ site.folder }} -y si"
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
   become_user: "{{ www_user }}"
@@ -21,7 +21,7 @@
 
 - name: Apply Drupal database updates.
   shell:
-    cmd: "{{ drush_bin }} -y updb"
+    cmd: "{{ drush_bin }} -l {{ site.folder }} -y updb"
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   with_items: "{{ drupal.sites }}"
   loop_control:
diff --git a/roles/database_apply/database_apply-drupal8/tasks/main.yml b/roles/database_apply/database_apply-drupal8/tasks/main.yml
index 5634faca..dc138585 100644
--- a/roles/database_apply/database_apply-drupal8/tasks/main.yml
+++ b/roles/database_apply/database_apply-drupal8/tasks/main.yml
@@ -15,7 +15,7 @@
 
 - name: Install Drupal.
   command:
-    cmd: "{{ drush_bin }} {{ site.install_command }}"
+    cmd: "{{ drush_bin }} -l {{ site.folder }} {{ site.install_command }}"
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
   become_user: "{{ www_user }}"
@@ -34,7 +34,7 @@
 
 - name: Apply Drupal database updates.
   command:
-    cmd: "{{ drush_bin }} -y updb"
+    cmd: "{{ drush_bin }} -l {{ site.folder }} -y updb"
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
   become_user: "{{ www_user }}"
@@ -44,7 +44,7 @@
 
 - name: Import configuration.
   command:
-    cmd: "{{ drush_bin }} -y {{ site.config_import_command }}"
+    cmd: "{{ drush_bin }} -l {{ site.folder }} -y {{ site.config_import_command }}"
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
   become_user: "{{ www_user }}"
diff --git a/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/offline.yml b/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/offline.yml
index 2872226a..cbe65b07 100644
--- a/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/offline.yml
+++ b/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/offline.yml
@@ -2,7 +2,7 @@
 # @todo this needs refactoring for multisite.
 - name: Enable maintenance mode.
   command:
-    cmd: "{{ drush_bin }} state:set system.maintenance_mode 1 --input-format=integer"
+    cmd: "{{ drush_bin }} -l {{ site.folder }} state:set system.maintenance_mode 1 --input-format=integer"
     chdir: "{{ live_symlink_dest }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
   become_user: "{{ www_user }}"
@@ -12,7 +12,7 @@
 
 - name: Enable maintenance mode D7.
   shell:
-    cmd: "{{ drush_bin }} vset maintenance_mode 1"
+    cmd: "{{ drush_bin }} -l {{ site.folder }} vset maintenance_mode 1"
     chdir: "{{ live_symlink_dest }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
   become_user: "{{ www_user }}"
diff --git a/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/online.yml b/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/online.yml
index 99057084..e6a9cbf5 100644
--- a/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/online.yml
+++ b/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/online.yml
@@ -1,7 +1,7 @@
 ---
 - name: Disable maintenance mode.
   command:
-    cmd: "{{ drush_bin }} state:set system.maintenance_mode 0 --input-format=integer"
+    cmd: "{{ drush_bin }} -l {{ site.folder }} state:set system.maintenance_mode 0 --input-format=integer"
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
   become_user: "{{ www_user }}"
@@ -10,7 +10,7 @@
 
 - name: Disable maintenance mode D7.
   shell:
-    cmd: "{{ drush_bin }} vset maintenance_mode 0"
+    cmd: "{{ drush_bin }} -l {{ site.folder }} vset maintenance_mode 0"
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
   become_user: "{{ www_user }}"
diff --git a/roles/sanitize/admin_creds/admin_creds-drupal7/tasks/admin.yml b/roles/sanitize/admin_creds/admin_creds-drupal7/tasks/admin.yml
index 98401c5c..c8d75bd7 100644
--- a/roles/sanitize/admin_creds/admin_creds-drupal7/tasks/admin.yml
+++ b/roles/sanitize/admin_creds/admin_creds-drupal7/tasks/admin.yml
@@ -6,6 +6,6 @@
     _admin_pwd: "{{ lookup('password', '/tmp/{{ project_name }}-{{ site.folder }}-{{ build_type }}-{{ build_number }}-pwd chars=ascii_letters') }}"
 
 - name: Reset admin username.
-  shell: "cd {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }} && {{ drush_bin }} sql-query \"UPDATE users SET name='{{ _admin_user }}' WHERE uid=1;\""
+  shell: "cd {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }} && {{ drush_bin }} -l {{ site.folder }} sql-query \"UPDATE users SET name='{{ _admin_user }}' WHERE uid=1;\""
 - name: Reset admin password.
-  shell: "cd {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }} && {{ drush_bin }} upwd {{ _admin_user }} --password='{{ _admin_pwd }}'"
\ No newline at end of file
+  shell: "cd {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }} && {{ drush_bin }} -l {{ site.folder }} upwd {{ _admin_user }} --password='{{ _admin_pwd }}'"
\ No newline at end of file
diff --git a/roles/sanitize/admin_creds/admin_creds-drupal8/tasks/admin.yml b/roles/sanitize/admin_creds/admin_creds-drupal8/tasks/admin.yml
index 0302308b..c2adafdf 100644
--- a/roles/sanitize/admin_creds/admin_creds-drupal8/tasks/admin.yml
+++ b/roles/sanitize/admin_creds/admin_creds-drupal8/tasks/admin.yml
@@ -4,14 +4,14 @@
 # Loading the user directly is akward, but at least means we don't bypass entity update.
 - name: Reset admin username.
   command:
-    cmd: "{{ drush_bin }} php-eval '$admin = \\Drupal\\user\\Entity\\User::load(1); $admin->setUsername(\"{{ admin_creds.username }}\");$admin->save();' "
+    cmd: "{{ drush_bin }} -l {{ site.folder }} php-eval '$admin = \\Drupal\\user\\Entity\\User::load(1); $admin->setUsername(\"{{ admin_creds.username }}\");$admin->save();' "
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   when:
     - admin_creds.username | length > 1
 
 - name: Reset admin password.
   command:
-    cmd: "{{ drush_bin }} php-eval '$admin = \\Drupal\\user\\Entity\\User::load(1); $admin->setPassword(\"{{ admin_creds.password }}\");$admin->save();' "
+    cmd: "{{ drush_bin }} -l {{ site.folder }} php-eval '$admin = \\Drupal\\user\\Entity\\User::load(1); $admin->setPassword(\"{{ admin_creds.password }}\");$admin->save();' "
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   when:
     - admin_creds.password | length > 1
diff --git a/roles/sanitize/sanitize-drupal8/tasks/main.yml b/roles/sanitize/sanitize-drupal8/tasks/main.yml
index 0a33f5a8..26675f27 100644
--- a/roles/sanitize/sanitize-drupal8/tasks/main.yml
+++ b/roles/sanitize/sanitize-drupal8/tasks/main.yml
@@ -1,7 +1,7 @@
 ---
 - name: Sanitize database.
   command:
-    cmd: "{{ drush_bin }} -y {{ site.sanitize_command }}"
+    cmd: "{{ drush_bin }} -l {{ site.folder }} -y {{ site.sanitize_command }}"
     chdir: "{{ live_symlink_dest }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
   become_user: "{{ www_user }}"

From e826a0980351fac18a8e4c3785bda3a621a5f297 Mon Sep 17 00:00:00 2001
From: gregharvey <greg.harvey@gmail.com>
Date: Mon, 23 May 2022 17:06:07 +0200
Subject: [PATCH 11/11] Making contents of deploy tar 'ownerless'.

---
 roles/deploy_code/tasks/cleanup.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/deploy_code/tasks/cleanup.yml b/roles/deploy_code/tasks/cleanup.yml
index 4e648d25..03530f22 100644
--- a/roles/deploy_code/tasks/cleanup.yml
+++ b/roles/deploy_code/tasks/cleanup.yml
@@ -22,7 +22,7 @@
 
 - name: Create a tarball of the deployed codebases.
   ansible.builtin.command:
-    cmd: "tar -cvf /tmp/{{ project_name }}_{{ build_type }}.tar {{ deploy_base_path }}"
+    cmd: "tar -cvf /tmp/{{ project_name }}_{{ build_type }}.tar --owner=0 --group=0 {{ deploy_base_path }}"
   when:
     - deploy_code.mount_sync is defined
     - deploy_code.mount_sync | length > 1