Ansible for Sovereign Cloud — Geopatriation and Data Residency Automation

# inventory/sovereign-regions.yml
all:
  children:
    eu_region:
      hosts:
        eu-web-01: { ansible_host: 10.1.1.10, region: eu-west-1 }
        eu-db-01: { ansible_host: 10.1.2.10, region: eu-west-1 }
      vars:
        data_residency: EU
        compliance_frameworks: [gdpr, eu_ai_act]
        cloud_provider: sovereign_eu
        encryption_standard: AES-256-GCM

    us_region:
      hosts:
        us-web-01: { ansible_host: 10.2.1.10, region: us-east-1 }
        us-db-01: { ansible_host: 10.2.2.10, region: us-east-1 }
      vars:
        data_residency: US
        compliance_frameworks: [hipaa, fedramp]

    apac_region:
      hosts:
        ap-web-01: { ansible_host: 10.3.1.10, region: ap-southeast-1 }
        ap-db-01: { ansible_host: 10.3.2.10, region: ap-southeast-1 }
      vars:
        data_residency: APAC
        compliance_frameworks: [pdpa, pipl]

---
- name: Enforce data residency controls
  hosts: all
  become: true
  tasks:
    - name: Verify host is in correct region
      ansible.builtin.assert:
        that:
          - region is defined
          - data_residency is defined
        fail_msg: "Host {{ inventory_hostname }} missing region/data_residency tags"

    - name: Configure DNS to resolve only within region
      ansible.builtin.template:
        src: resolv.conf.j2
        dest: /etc/resolv.conf
      vars:
        dns_servers: "{{ regional_dns[data_residency] }}"

    - name: Block outbound traffic to non-compliant regions
      ansible.builtin.iptables:
        chain: OUTPUT
        destination: "{{ item }}"
        jump: DROP
        comment: "Block traffic to {{ item }} — data residency"
      loop: "{{ blocked_ip_ranges[data_residency] | default([]) }}"
      when: strict_residency | default(false)

    - name: Configure application data residency
      ansible.builtin.template:
        src: data-residency.yml.j2
        dest: /etc/myapp/data-residency.yml
      notify: Restart application

{# templates/data-residency.yml.j2 #}
data_residency:
  region: {{ data_residency }}
  allowed_regions:
{% for region in allowed_data_regions[data_residency] %}
    - {{ region }}
{% endfor %}
  encryption:
    at_rest: {{ encryption_standard }}
    in_transit: TLS-1.3
    key_management: local
  backup:
    destination: {{ backup_regions[data_residency] }}
    cross_region: false
  logging:
    destination: local
    export_allowed: false

- name: Deploy sovereign database
  hosts: "{{ target_region }}_region:&*db*"
  become: true
  vars:
    pg_version: 16

  tasks:
    - name: Install PostgreSQL
      ansible.builtin.package:
        name: "postgresql-{{ pg_version }}"
        state: present

    - name: Configure data directory in local storage
      ansible.builtin.lineinfile:
        path: "/etc/postgresql/{{ pg_version }}/main/postgresql.conf"
        regexp: "^data_directory"
        line: "data_directory = '/data/{{ data_residency | lower }}/postgresql'"

    - name: Restrict connections to same region
      ansible.builtin.template:
        src: pg_hba_sovereign.conf.j2
        dest: "/etc/postgresql/{{ pg_version }}/main/pg_hba.conf"
      notify: Reload PostgreSQL

    - name: Enable TDE (Transparent Data Encryption)
      ansible.builtin.lineinfile:
        path: "/etc/postgresql/{{ pg_version }}/main/postgresql.conf"
        line: "{{ item }}"
      loop:
        - "ssl = on"
        - "ssl_cert_file = '/etc/ssl/certs/{{ data_residency | lower }}-server.crt'"
        - "ssl_key_file = '/etc/ssl/private/{{ data_residency | lower }}-server.key'"
        - "ssl_min_protocol_version = 'TLSv1.3'"
      notify: Restart PostgreSQL

    - name: Configure backup to same-region storage only
      ansible.builtin.cron:
        name: "Sovereign backup"
        hour: "2"
        minute: "0"
        job: >
          pg_dump -Fc myapp |
          aws s3 cp - s3://{{ sovereign_backup_bucket[data_residency] }}/$(date +%Y%m%d).dump
          --region {{ region }}
          --endpoint-url {{ sovereign_s3_endpoint[data_residency] | default('') }}

- name: Deploy application across sovereign regions
  hosts: all:&*web*
  become: true
  serial: "{{ serial_per_region | default('100%') }}"

  tasks:
    - name: Deploy region-specific configuration
      ansible.builtin.template:
        src: app-config.yml.j2
        dest: /opt/myapp/config.yml
      vars:
        api_endpoint: "{{ regional_api[data_residency] }}"
        cdn_endpoint: "{{ regional_cdn[data_residency] }}"
        storage_endpoint: "{{ regional_storage[data_residency] }}"

    - name: Deploy application
      ansible.builtin.copy:
        src: "releases/myapp-{{ app_version }}.tar.gz"
        dest: /opt/myapp/
      notify: Restart application

    - name: Configure regional TLS certificate
      ansible.builtin.copy:
        src: "certs/{{ data_residency | lower }}/{{ inventory_hostname }}.pem"
        dest: /etc/ssl/certs/app.pem
        mode: "0644"

    - name: Verify application serves from correct region
      ansible.builtin.uri:
        url: "http://localhost:8080/api/health"
      register: health
      failed_when: health.json.region != data_residency

  handlers:
    - name: Restart application
      ansible.builtin.systemd:
        name: myapp
        state: restarted

- name: Sovereign compliance audit
  hosts: all
  become: true
  tasks:
    - name: Check data residency compliance
      ansible.builtin.set_fact:
        compliance_results: []

    - name: Verify no cross-region network connections
      ansible.builtin.shell: |
        ss -tnp | grep ESTAB | awk '{print $5}' | cut -d: -f1 | sort -u
      register: active_connections
      changed_when: false

    - name: Flag non-compliant connections
      ansible.builtin.set_fact:
        compliance_results: "{{ compliance_results + [item + ' is outside ' + data_residency] }}"
      loop: "{{ active_connections.stdout_lines }}"
      when: item not in allowed_ips[data_residency] | default([])

    - name: Verify encryption at rest
      ansible.builtin.command: >
        cryptsetup status {{ data_volume | default('data') }}
      register: encryption_status
      changed_when: false
      failed_when: "'active' not in encryption_status.stdout"

    - name: Verify local key management
      ansible.builtin.stat:
        path: /etc/ssl/private/data-encryption.key
      register: local_key

    - name: Check backup destinations
      ansible.builtin.shell: |
        crontab -l | grep -E 's3|backup|rsync' | grep -v '{{ data_residency | lower }}'
      register: bad_backups
      changed_when: false
      failed_when: bad_backups.stdout | length > 0

    - name: Generate compliance report
      ansible.builtin.template:
        src: sovereign-compliance.j2
        dest: "/tmp/sovereign-audit-{{ inventory_hostname }}.json"
      delegate_to: localhost

# vars/sovereign-providers.yml
sovereign_providers:
  EU:
    compute: OVHcloud, IONOS, Scaleway, T-Systems
    storage: OVHcloud Object Storage
    kubernetes: Gardener (SAP)
    dns: regional EU resolvers
  Germany:
    compute: T-Systems Sovereign Cloud, IONOS
    certification: C5, BSI
  France:
    compute: OVHcloud, Scaleway, 3DS Outscale
    certification: SecNumCloud
  India:
    compute: Yotta, CtrlS, NxtGen
    certification: MeitY empanelment