Sergei Poljanski
4865efd078
All checks were successful
deploy / ansible (push) Successful in 6m25s
The XMPP certificate covers xmpp.asxp.io and conference.asxp.io, which point at asxpio-services, so Let's Encrypt validates them there. A small nginx on port 80 passes /.well-known/acme-challenge/ over the VPC to Traefik, which holds all certificates, and answers 404 to the rest. Assisted-by: Claude:opus-5-5
73 lines
2 KiB
YAML
73 lines
2 KiB
YAML
---
|
|
# Everything the deploy pipeline manages. Idempotent: a run with nothing
|
|
# to change touches nothing and restarts nothing.
|
|
#
|
|
# ansible-playbook site.yaml --check --diff # dry run
|
|
# ansible-playbook site.yaml --tags traefik # one service
|
|
#
|
|
# Host bootstrap (WireGuard, SSH hardening, s3fs, swap) is in playbooks/
|
|
# and is run by hand.
|
|
|
|
- name: Host baseline
|
|
hosts: asxpio
|
|
become: true
|
|
roles:
|
|
- { role: base, tags: [base] }
|
|
|
|
- name: Monitoring agents
|
|
hosts: asxpio
|
|
become: true
|
|
roles:
|
|
- { role: monitoring_agent, tags: [monitoring_agent, monitoring] }
|
|
|
|
- name: asxpio-ops services
|
|
hosts: ops_servers
|
|
become: true
|
|
roles:
|
|
- { role: traefik, tags: [traefik] }
|
|
- { role: crawler_alert, tags: [crawler_alert] }
|
|
- { role: monitoring, tags: [monitoring] }
|
|
|
|
- name: asxpio-services services
|
|
hosts: services_servers
|
|
become: true
|
|
roles:
|
|
- { role: sillytavern, tags: [sillytavern] }
|
|
- { role: minecraft, tags: [minecraft] }
|
|
- { role: xmpp, tags: [xmpp] }
|
|
- { role: acme_forward, tags: [acme_forward, xmpp] }
|
|
- { role: xray, tags: [xray] }
|
|
|
|
# Late: restarting Forgejo briefly cuts the runner off from its job log
|
|
- name: Forgejo
|
|
hosts: ops_servers
|
|
become: true
|
|
roles:
|
|
- { role: forgejo, tags: [forgejo] }
|
|
|
|
- name: Backups
|
|
hosts: asxpio
|
|
become: true
|
|
roles:
|
|
- { role: restic_backup, tags: [restic] }
|
|
|
|
- name: another-im/interop runner
|
|
hosts: services_servers
|
|
become: true
|
|
roles:
|
|
- { role: forgejo_runner_interop, tags: [forgejo_runner_interop] }
|
|
|
|
- name: Bucket replica
|
|
hosts: services_servers
|
|
become: true
|
|
roles:
|
|
- { role: s3_replicate, tags: [s3_replicate] }
|
|
|
|
# Last: when the pipeline changes the runner it recreates the container
|
|
# that is running the pipeline. Everything else is done by then; that job
|
|
# ends as failed and the next run confirms the result.
|
|
- name: Forgejo runner
|
|
hosts: services_servers
|
|
become: true
|
|
roles:
|
|
- { role: forgejo_runner, tags: [forgejo_runner] }
|