Sergei Poljanski
63bd67a86d
Service changes were made by hand on the servers, which is how the repository drifted. Apply site.yaml from a workflow instead: every push dry-runs it against production, and a push to main applies it. Jobs run in containers on asxpio-services. asxpio-ops is reached over the private network; the services host is reached through asxpio-ops, because a container connecting to its own host arrives from a Docker bridge address that sshd and the firewall refuse. Host keys are pinned in known_hosts. Ansible comes from a pinned nixpkgs revision so every run uses the same version. Assisted-by: Claude:fable-5-2
24 lines
743 B
YAML
24 lines
743 B
YAML
---
|
|
# Inventory for the Forgejo Actions runner. Jobs run in containers on
|
|
# asxpio-services, so asxpio-ops is reached over the VPC. The services
|
|
# host itself is reached through asxpio-ops: a container talking to its
|
|
# own host arrives from a Docker bridge address, which sshd and the
|
|
# firewall both refuse.
|
|
|
|
all:
|
|
vars:
|
|
ansible_user: deploy
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
|
|
children:
|
|
asxpio:
|
|
children:
|
|
ops_servers:
|
|
hosts:
|
|
asxpio-ops:
|
|
ansible_host: "{{ vpc_ip }}"
|
|
services_servers:
|
|
hosts:
|
|
asxpio-services:
|
|
ansible_host: "{{ vpc_ip }}"
|
|
ansible_ssh_common_args: "-o ProxyJump=deploy@{{ asxpio_ops_vpc_ip }}"
|