Ensure .env is rotated

[PhillypHenning]

During one of the runs the Docker container was stopped, the .env was updated but a missing env var caused the next install to fail to start. Then each run after wasn't getting an updated .env file and would attempt to stop the docker service but would his the same missing env issue when doing so.

Instance ps command:

ubuntu@ip-172-31-71-135:~$ sudo docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES

Workflow failure log:

  TASK [Stop and cleanup Docker] *************************************************
  Tuesday 04 November 2025  22:33:28 +0000 (0:00:00.027)       0:00:06.528 ****** 
  fatal: [98.92.74.231]: FAILED! => {"changed": true, "cmd": ["docker", "compose", "--project-directory", "/home/ubuntu/cascade-mcp", "down", "--remove-orphans", "--rmi", "all", "--volumes"], "delta": "0:00:00.105977", "end": "2025-11-04 22:33:29.187924", "msg": "non-zero return code", "rc": 1, "start": "2025-11-04 22:33:29.081947", "stderr": "time=\"2025-11-04T22:33:29Z\" level=warning msg=\"The \\\"PORT\\\" variable is not set. Defaulting to a blank string.\"\ntime=\"2025-11-04T22:33:29Z\" level=warning msg=\"The \\\"PORT\\\" variable is not set. Defaulting to a blank string.\"\ninvalid proto: ", "stderr_lines": ["time=\"2025-11-04T22:33:29Z\" level=warning msg=\"The \\\"PORT\\\" variable is not set. Defaulting to a blank string.\"", "time=\"2025-11-04T22:33:29Z\" level=warning msg=\"The \\\"PORT\\\" variable is not set. Defaulting to a blank string.\"", "invalid proto: "], "stdout": "", "stdout_lines": []}

The .env file should be rotated near the beginning of every Ansible run. Users should be confident that whatever the latest .env file is will be used in their latest deployment.

[LeoDiazL]

We reached a specific error, and it makes sense to make the code more resilient, but there are a lot of variables to consider.

First of all, the workaround for this would be

• Set docker_full_cleanup and docker_repo_app_directory to false.
• Run the action, code cloning should happen before doing the docker-compose up.
• Set docker_full_cleanup and docker_repo_app_directory to the previous value.

Why it's failing...

• We are doing a docker compose down - The reason why we are not stopping all of the running containers is because our deployment works by doing a docker compose up. The edge case here would be that the user build and deployed a container manually, and that shouldn't be stopped. If we ignore that premise, then we can stop the containers one by one with the docker command instead.
• Cloning the repo with running applications is possible, but not ideal, and not enabling the first option ensures containers are shut down before doing so. After the repo is cloned, we are executing docker compose --project-directory {{ app_install_root }}/{{ app_repo_name }} up --detach --build --force-recreate

Solution...

We need to revisit the whole deployment path for the Docker part. Perhaps even remove the BitOps image pull and go straight into IaC code.

Details...

We are executing the Ansible playbooks in the following order - See code here
The first step is the one that blocks everything,

• docker_cleanup
• ec2_cleanup
• clone_repo
• efs
• cloudwatch
• docker

we could rescue that failed command by doing a for loop to get the container ids and run a docker stop for each container. Or parse the docker compose file to get the names of the containers.