asxpi/iac

Sergei Poljanski 59415515a1 docs: restic backups, XMPP and Xray on services, Fossils retired

Describe the new roles, how to list and restore restic snapshots, and
that the restic password must be kept outside the servers.

Assisted-by: Claude:opus-5-5

2026-11-12 21:03:10 +04:00

3.2 KiB

Raw Blame History

Ansible

site.yaml is the desired state of both servers and is applied by the deploy pipeline on every push to main. The playbooks under playbooks/ are host bootstrap and are run by hand.

Running

echo '<vault password>' > .vault_pass && chmod 600 .vault_pass

ansible-playbook site.yaml --check --diff       # dry run, over WireGuard
ansible-playbook site.yaml                      # apply
ansible-playbook site.yaml --tags forgejo       # one role

On NixOS: nix shell nixpkgs#ansible -c ansible-playbook ….

Templates that carry secrets are never shown in --diff output.

Inventories

inventory/hosts.yaml: default. Connects as root to the WireGuard addresses.
inventory/ci.yaml: used by the pipeline. Connects as deploy over the private network, reaching asxpio-services through asxpio-ops.

known_hosts pins both servers' SSH host keys for the pipeline.

Variables

inventory/
├── group_vars/all/
│   ├── network.yaml         # VPC and WireGuard addresses
│   ├── paths.yaml           # /opt
│   ├── s3.yaml              # object storage buckets and s3fs mounts
│   ├── wireguard.yaml       # WireGuard peers
│   └── vault.yaml           # encrypted secrets
├── group_vars/ops_servers/
│   ├── traefik.yaml         # traefik_version
│   └── forgejo.yaml         # forgejo_version, domain and aliases
├── group_vars/services_servers/
│   ├── forgejo_runner.yaml  # runner version, labels' nix image
│   └── minecraft.yaml
└── host_vars/               # per-host addresses, SSH and s3fs settings

Compose files without variables are plain files under roles/<role>/files/; edit the image tag there.

Roles in site.yaml

base, traefik, crawler_alert, forgejo, forgejo_runner, sillytavern, minecraft, minecraft_fossils (retired, keeps it stopped), xmpp, xray, restic_backup. Service roles go through docker_service, which writes the files, runs docker compose up -d, restarts on a config change and waits for the service to answer.

crawler_alert installs a copy of traefik-crawlers-statistics; update roles/crawler_alert/files/ from there.

Bootstrap playbooks

Playbook	Purpose
`01-wireguard-setup.yaml`	WireGuard hub on asxpio-ops, peer on asxpio-services, client configs
`02-ssh-hardening.yaml`	restrict SSH to WireGuard and the private network
`03-setup-s3fs.yaml`	s3fs mounts on asxpio-services (off on asxpio-ops)
`04-add-user-zerrtika.yaml`	add a user to running servers
`05-swap.yaml`	2 GB swapfile on asxpio-ops

Always dry-run these first with --check --diff.

03-setup-s3fs.yaml rewrites /etc/s3fs/.passwd-s3fs, which the backup script on asxpio-ops also reads.
On asxpio-services the WireGuard interface is named asxpio-services, not wg0. Check 01-wireguard-setup.yaml against the host before re-running it there.

Runner notes

The nix-latest label runs nixos/nix:<forgejo_runner_nix_version> with a nix-store-<version> volume over /nix. To bump it: change the variable, let the pipeline apply it, then remove the old volume.

3.2 KiB Raw Blame History