Sergei Poljanski
5e009c4a47
All checks were successful
deploy / ansible (push) Successful in 7m22s
The ejabberd certificate (asxp.io, conference., xmpp.) was issued by hand and expires 2027-01-28 with nothing renewing it. Traefik now obtains it alongside the sites' certificates, through a router that only exists to request it, and a systemd path unit on ops pushes it to services whenever acme.json changes, with a daily run as fallback. The push uses its own SSH key, accepted from ops' VPC address only and forced to xmpp-cert-install, which checks the certificate is valid for another day and matches its key before replacing server.pem and reloading ejabberd. Two alerts: the sync hasn't succeeded for two days, or ejabberd serves an older certificate than Traefik holds for six hours. The existing expiry alert already covers port 5223. Assisted-by: Claude:opus-5-5
21 lines
934 B
YAML
21 lines
934 B
YAML
---
|
|
# Compose and settings are managed here. The secrets and keys stay on the
|
|
# host as data, like a game world, and are covered by the restic backup:
|
|
# state/secrets.env ejabberd secrets
|
|
# state/certs/server.pem TLS certificate (asxp.io, conference., xmpp.), issued by
|
|
# Traefik on ops and pushed by role xmpp_cert_sync
|
|
# state/apushd/ push settings and VAPID key
|
|
# state/tackygram/{env,key} gateway credentials and master key
|
|
# Data: volumes xmpp_database, xmpp_tackygram.
|
|
- name: Deploy XMPP
|
|
ansible.builtin.include_role:
|
|
name: docker_service
|
|
vars:
|
|
service_name: xmpp
|
|
service_base_path: "{{ services_base_path }}/xmpp"
|
|
service_directories:
|
|
- { path: state, mode: "0700" }
|
|
service_templates:
|
|
- { src: docker-compose.yml.j2, dest: docker-compose.yml }
|
|
- { src: settings.env.j2, dest: settings.env }
|
|
health_check_port: 5222
|