asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ansible: asxpio-services is managed by NixOS

Browse source 
With asxpio-services described in nixos/, Ansible only has asxpio-ops
left. Drop the runner, SillyTavern and Minecraft roles, the services
host from both inventories, and the WireGuard client play.

The s3fs role and playbook go as well: the mounts were switched off on
asxpio-ops, and on asxpio-services nothing read them. The credentials
file the role once wrote on asxpio-ops stays, because the backup script
there reads it.

site.yaml against asxpio-ops still changes nothing.

Assisted-by: Claude:fable-5-2
This commit is contained in:
Sergei Poljanski 2026-11-12 17:00:59 +04:00
commit c8e8212b48
30 changed files with 50 additions and 945 deletions
Download patch file Download diff file Expand all files Collapse all files

73
README.md
View file

@ -1,8 +1,8 @@
# asxp.io infrastructure
Two Hetzner Cloud servers, described by Terraform and configured by
Ansible. Pushing to `main` deploys: a Forgejo Actions workflow applies
`ansible/site.yaml` to both servers.
Two Hetzner Cloud servers, described by Terraform. asxpio-services runs
NixOS (`nixos/`); asxpio-ops runs Debian configured by Ansible
(`ansible/`). Pushing to `main` deploys both through Forgejo Actions.
## Servers
@ -17,21 +17,19 @@ Both are reachable for administration only over WireGuard
## Layout
- `terraform/`: servers, network, firewalls, object storage buckets.
- `ansible/site.yaml`: everything the pipeline manages (see below).
- `ansible/playbooks/`: host bootstrap, run by hand.
- `.forgejo/workflows/deploy.yaml`: the pipeline.
- `nixos/`: the whole asxpio-services system as a flake.
- `ansible/site.yaml`: everything managed on asxpio-ops.
- `ansible/playbooks/`: asxpio-ops bootstrap, run by hand.
- `.forgejo/workflows/`: `nixos.yaml` and `deploy.yaml`, the pipelines.
## What the pipeline manages
## What is managed where
| Role | Host | What |
|------|------|------|
| `base` | both | unattended upgrades, fail2ban, journal size cap, Docker daemon config, weekly image prune |
| `traefik` | ops | reverse proxy, TLS, dashboard on WireGuard |
| `crawler_alert` | ops | daily and weekly crawler report timers |
| `forgejo` | ops | Forgejo at git.asxp.io (git.czsk.it is an alias), SSH passthrough |
| `forgejo_runner` | services | Actions runner and its job labels |
| `sillytavern` | services | SillyTavern on the WireGuard address |
| `minecraft`, `minecraft_fossils` | services | game servers, daily restart timer |
| What | Host | Where |
|------|------|-------|
| OS, users, SSH, WireGuard, firewall | services | `nixos/` |
| CI runner, Minecraft (Paper, Fossils), SillyTavern | services | `nixos/hosts/asxpio-services/` |
| baseline (upgrades, fail2ban, journal, Docker config) | ops | role `base` |
| Traefik, Forgejo, crawler-alert | ops | roles `traefik`, `forgejo`, `crawler_alert` |
Not managed here: the app stacks on asxpio-ops (asxpio, datacenterbingo,
blog, czsk, vhpbot, storage). Each deploys from its own repository into
@ -39,37 +37,24 @@ blog, czsk, vhpbot, storage). Each deploys from its own repository into
## Changing something
1. Edit the role or variable, for example an image tag in
`ansible/inventory/group_vars/` or a compose file under
`ansible/roles/<role>/files/`.
2. Push a branch. The pipeline does a dry run against production.
3. Merge to `main`. The pipeline dry-runs again, then applies.
Edit, push a branch, merge to `main`.
A run with nothing to change touches nothing and restarts nothing.
- A branch push builds the NixOS system and dry-runs Ansible against
asxpio-ops.
- `main` then switches asxpio-services to the new system and applies
Ansible to asxpio-ops.
Things to know:
- **Game servers** are saved and stopped with a 120 s timeout before a
compose change recreates them.
- **The runner** executes the pipeline. A change to it recreates the
container mid-job: the change lands, that job is reported as failed,
and the next run confirms it.
- **Forgejo** restarts on a config change; the job log may pause for a
few seconds.
To run it yourself, over WireGuard:
```sh
cd ansible
ansible-playbook site.yaml --check --diff # dry run
ansible-playbook site.yaml --tags traefik # one service
```
A run with nothing to change restarts nothing. A change to the CI
runner restarts the runner under its own job: the change lands, that
job is reported as failed, and the next run confirms it. Details are in
`nixos/README.md` and `ansible/README.md`.
## Secrets
Nothing secret is stored in the clear. Service secrets live in
Nothing secret is stored in the clear. asxpio-services secrets are in
`nixos/secrets/`, encrypted with sops; asxpio-ops secrets are in
`ansible/inventory/group_vars/all/vault.yaml`, encrypted with Ansible
Vault. The pipeline needs two repository secrets:
Vault. The pipelines need two repository secrets:
- `ANSIBLE_VAULT_PASSWORD`: decrypts the vault.
- `SSH_DEPLOY_KEY`: private key of user `deploy` on both servers.
@ -78,6 +63,6 @@ Locally, put the vault password in `ansible/.vault_pass` (ignored by git).
## Bootstrap (by hand)
`ansible/playbooks/` holds what is done once per host or can lock you
out: WireGuard, SSH hardening, s3fs mounts, swap, user creation.
See `ansible/README.md`.
`ansible/playbooks/` holds what is done once on asxpio-ops or can lock
you out: WireGuard, SSH hardening, swap, user creation. Installing or
reinstalling asxpio-services is in `nixos/README.md`.