Sergei Poljanski
5e009c4a47
All checks were successful
deploy / ansible (push) Successful in 7m22s
The ejabberd certificate (asxp.io, conference., xmpp.) was issued by hand and expires 2027-01-28 with nothing renewing it. Traefik now obtains it alongside the sites' certificates, through a router that only exists to request it, and a systemd path unit on ops pushes it to services whenever acme.json changes, with a daily run as fallback. The push uses its own SSH key, accepted from ops' VPC address only and forced to xmpp-cert-install, which checks the certificate is valid for another day and matches its key before replacing server.pem and reloading ejabberd. Two alerts: the sync hasn't succeeded for two days, or ejabberd serves an older certificate than Traefik holds for six hours. The existing expiry alert already covers port 5223. Assisted-by: Claude:opus-5-5
74 lines
2 KiB
YAML
74 lines
2 KiB
YAML
---
|
|
# Everything the deploy pipeline manages. Idempotent: a run with nothing
|
|
# to change touches nothing and restarts nothing.
|
|
#
|
|
# ansible-playbook site.yaml --check --diff # dry run
|
|
# ansible-playbook site.yaml --tags traefik # one service
|
|
#
|
|
# Host bootstrap (WireGuard, SSH hardening, s3fs, swap) is in playbooks/
|
|
# and is run by hand.
|
|
|
|
- name: Host baseline
|
|
hosts: asxpio
|
|
become: true
|
|
roles:
|
|
- { role: base, tags: [base] }
|
|
|
|
- name: Monitoring agents
|
|
hosts: asxpio
|
|
become: true
|
|
roles:
|
|
- { role: monitoring_agent, tags: [monitoring_agent, monitoring] }
|
|
|
|
- name: asxpio-ops services
|
|
hosts: ops_servers
|
|
become: true
|
|
roles:
|
|
- { role: traefik, tags: [traefik] }
|
|
- { role: xmpp_cert_sync, tags: [xmpp_cert_sync, xmpp] }
|
|
- { role: crawler_alert, tags: [crawler_alert] }
|
|
- { role: monitoring, tags: [monitoring] }
|
|
|
|
- name: asxpio-services services
|
|
hosts: services_servers
|
|
become: true
|
|
roles:
|
|
- { role: sillytavern, tags: [sillytavern] }
|
|
- { role: minecraft, tags: [minecraft] }
|
|
- { role: xmpp, tags: [xmpp] }
|
|
- { role: acme_forward, tags: [acme_forward, xmpp] }
|
|
- { role: xray, tags: [xray] }
|
|
|
|
# Late: restarting Forgejo briefly cuts the runner off from its job log
|
|
- name: Forgejo
|
|
hosts: ops_servers
|
|
become: true
|
|
roles:
|
|
- { role: forgejo, tags: [forgejo] }
|
|
|
|
- name: Backups
|
|
hosts: asxpio
|
|
become: true
|
|
roles:
|
|
- { role: restic_backup, tags: [restic] }
|
|
|
|
- name: another-im/interop runner
|
|
hosts: services_servers
|
|
become: true
|
|
roles:
|
|
- { role: forgejo_runner_interop, tags: [forgejo_runner_interop] }
|
|
|
|
- name: Bucket replica
|
|
hosts: services_servers
|
|
become: true
|
|
roles:
|
|
- { role: s3_replicate, tags: [s3_replicate] }
|
|
|
|
# Last: when the pipeline changes the runner it recreates the container
|
|
# that is running the pipeline. Everything else is done by then; that job
|
|
# ends as failed and the next run confirms the result.
|
|
- name: Forgejo runner
|
|
hosts: services_servers
|
|
become: true
|
|
roles:
|
|
- { role: forgejo_runner, tags: [forgejo_runner] }
|