Sergei Poljanski
c8e8212b48
With asxpio-services described in nixos/, Ansible only has asxpio-ops left. Drop the runner, SillyTavern and Minecraft roles, the services host from both inventories, and the WireGuard client play. The s3fs role and playbook go as well: the mounts were switched off on asxpio-ops, and on asxpio-services nothing read them. The credentials file the role once wrote on asxpio-ops stays, because the backup script there reads it. site.yaml against asxpio-ops still changes nothing. Assisted-by: Claude:fable-5-2
68 lines
2.6 KiB
Markdown
68 lines
2.6 KiB
Markdown
# asxp.io infrastructure
|
|
|
|
Two Hetzner Cloud servers, described by Terraform. asxpio-services runs
|
|
NixOS (`nixos/`); asxpio-ops runs Debian configured by Ansible
|
|
(`ansible/`). Pushing to `main` deploys both through Forgejo Actions.
|
|
|
|
## Servers
|
|
|
|
| Server | Size | Runs |
|
|
|--------|------|------|
|
|
| asxpio-ops | 2 vCPU, 4 GB | Traefik, Forgejo, crawler-alert; app stacks deployed from their own repos |
|
|
| asxpio-services | 8 vCPU, 16 GB | Forgejo Actions runner, Minecraft (Paper and Fossils), SillyTavern |
|
|
|
|
Both are reachable for administration only over WireGuard
|
|
(10.20.0.0/24) or the private network (10.10.0.0/20).
|
|
|
|
## Layout
|
|
|
|
- `terraform/`: servers, network, firewalls, object storage buckets.
|
|
- `nixos/`: the whole asxpio-services system as a flake.
|
|
- `ansible/site.yaml`: everything managed on asxpio-ops.
|
|
- `ansible/playbooks/`: asxpio-ops bootstrap, run by hand.
|
|
- `.forgejo/workflows/`: `nixos.yaml` and `deploy.yaml`, the pipelines.
|
|
|
|
## What is managed where
|
|
|
|
| What | Host | Where |
|
|
|------|------|-------|
|
|
| OS, users, SSH, WireGuard, firewall | services | `nixos/` |
|
|
| CI runner, Minecraft (Paper, Fossils), SillyTavern | services | `nixos/hosts/asxpio-services/` |
|
|
| baseline (upgrades, fail2ban, journal, Docker config) | ops | role `base` |
|
|
| Traefik, Forgejo, crawler-alert | ops | roles `traefik`, `forgejo`, `crawler_alert` |
|
|
|
|
Not managed here: the app stacks on asxpio-ops (asxpio, datacenterbingo,
|
|
blog, czsk, vhpbot, storage). Each deploys from its own repository into
|
|
`/opt/<app>`.
|
|
|
|
## Changing something
|
|
|
|
Edit, push a branch, merge to `main`.
|
|
|
|
- A branch push builds the NixOS system and dry-runs Ansible against
|
|
asxpio-ops.
|
|
- `main` then switches asxpio-services to the new system and applies
|
|
Ansible to asxpio-ops.
|
|
|
|
A run with nothing to change restarts nothing. A change to the CI
|
|
runner restarts the runner under its own job: the change lands, that
|
|
job is reported as failed, and the next run confirms it. Details are in
|
|
`nixos/README.md` and `ansible/README.md`.
|
|
|
|
## Secrets
|
|
|
|
Nothing secret is stored in the clear. asxpio-services secrets are in
|
|
`nixos/secrets/`, encrypted with sops; asxpio-ops secrets are in
|
|
`ansible/inventory/group_vars/all/vault.yaml`, encrypted with Ansible
|
|
Vault. The pipelines need two repository secrets:
|
|
|
|
- `ANSIBLE_VAULT_PASSWORD`: decrypts the vault.
|
|
- `SSH_DEPLOY_KEY`: private key of user `deploy` on both servers.
|
|
|
|
Locally, put the vault password in `ansible/.vault_pass` (ignored by git).
|
|
|
|
## Bootstrap (by hand)
|
|
|
|
`ansible/playbooks/` holds what is done once on asxpio-ops or can lock
|
|
you out: WireGuard, SSH hardening, swap, user creation. Installing or
|
|
reinstalling asxpio-services is in `nixos/README.md`.
|