52 lines
2.4 KiB
YAML
52 lines
2.4 KiB
YAML
|
---
|
||
|
|
# Jar Lid Archive on its own box, published from the edge host.
|
||
|
|
#
|
||
|
|
# See roles/jar_lid_archive/README.md. Per-host values (domain, port, seed users,
|
||
|
|
# secrets) are in host_vars/<host>/, so a production host is a new inventory
|
||
|
|
# entry in [jar_lid_archive], not a new playbook.
|
||
|
|
- name: Deploy Jar Lid Archive
|
||
|
|
hosts: jar_lid_archive
|
||
|
|
become: yes
|
||
|
|
roles:
|
||
|
|
- jar_lid_archive
|
||
|
|
# "Does the app answer", as opposed to "are the containers up". /health/
|
||
|
|
# runs SELECT 1 and touches the bucket, and returns 503 if either fails.
|
||
|
|
- role: healthcheck
|
||
|
|
vars:
|
||
|
|
healthcheck_name: jar-lid-archive
|
||
|
|
healthcheck_description: "Jar Lid Archive /health/ (app, database and photo store)"
|
||
|
|
healthcheck_command: "curl -fsS --max-time 10 -o /dev/null http://127.0.0.1:{{ jar_lid_archive_port }}/health/"
|
||
|
|
healthcheck_push_url: "https://{{ subdomains.gatus }}.{{ root_domain }}/api/v1/endpoints/probe_{{ jar_lid_archive_instance }}/external"
|
||
|
|
healthcheck_push_token: "{{ gatus_push_tokens[inventory_hostname] }}"
|
||
|
|
|
||
|
|
- name: Publish Jar Lid Archive from the edge host
|
||
|
|
hosts: edge
|
||
|
|
become: yes
|
||
|
|
tasks:
|
||
|
|
# No basic auth: the one-off links (/links/...) are opened by people who have
|
||
|
|
# no account and no proxy credential. The app's own login guards the rest.
|
||
|
|
#
|
||
|
|
# Caddy sets X-Forwarded-Proto: https and overwrites any value the client
|
||
|
|
# sent, which is what lets the app trust it (DJANGO_BEHIND_TLS_PROXY).
|
||
|
|
#
|
||
|
|
# No request size limit is set, deliberately: Caddy has none by default, and
|
||
|
|
# phones upload multi-megabyte photos.
|
||
|
|
- name: Expose Jar Lid Archive over HTTPS
|
||
|
|
ansible.builtin.include_role:
|
||
|
|
name: caddy_site
|
||
|
|
vars:
|
||
|
|
caddy_site_name: "{{ hostvars[jla_host].jar_lid_archive_instance }}"
|
||
|
|
caddy_site_domain: "{{ hostvars[jla_host].jar_lid_archive_domain }}"
|
||
|
|
# Tailscale MagicDNS: the box has no public address.
|
||
|
|
caddy_site_upstream: "{{ hostvars[jla_host].ansible_host }}:{{ hostvars[jla_host].jar_lid_archive_port }}"
|
||
|
|
caddy_site_resolvers: "100.100.100.100"
|
||
|
|
loop: "{{ groups['jar_lid_archive'] }}"
|
||
|
|
# Not `item`: the role's own tasks loop, and would shadow it.
|
||
|
|
loop_control:
|
||
|
|
loop_var: jla_host
|
||
|
|
|
||
|
|
# The per-site validate cannot catch a conflict between sites.
|
||
|
|
- name: Validate the whole Caddyfile
|
||
|
|
ansible.builtin.command: caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
|
||
|
|
changed_when: false
|