From 532974634e436e9d16820dec42f9b97c57151f5c Mon Sep 17 00:00:00 2001 From: counterweight Date: Mon, 19 Oct 2026 22:10:23 +0200 Subject: [PATCH] playbooks: stop re-runs overwriting live config Three seeding tasks used copy without force: false, so every run replaced the real file with the starter one: - personal-blog: the placeholder index.html over the deployed site. - lnbits: .env.example over .env - a new AUTH_SECRET_KEY, logging every user out, and it would have clobbered a restored .env. - forgejo: a two-line app.ini stub over the real config, losing INTERNAL_TOKEN, the JWT secrets, the DB path and ROOT_URL. All three now seed a fresh install only. Found while restoring each from backup on 2026-10-17. Co-Authored-By: Claude Opus 5.5 (1M context) --- ansible/services/forgejo/deploy_forgejo_playbook.yml | 4 ++++ ansible/services/lnbits/deploy_lnbits_playbook.yml | 4 ++++ .../services/personal-blog/deploy_personal_blog_playbook.yml | 3 +++ 3 files changed, 11 insertions(+) diff --git a/ansible/services/forgejo/deploy_forgejo_playbook.yml b/ansible/services/forgejo/deploy_forgejo_playbook.yml index f908586..29009ca 100644 --- a/ansible/services/forgejo/deploy_forgejo_playbook.yml +++ b/ansible/services/forgejo/deploy_forgejo_playbook.yml @@ -66,6 +66,10 @@ owner: "{{ forgejo_user }}" group: "{{ forgejo_user }}" mode: '0644' + # Fresh install only: the web installer then writes the real config + # (INTERNAL_TOKEN, JWT secrets, DB path, ROOT_URL) into this file. + # Without force: false every re-run replaced it with this stub. + force: false - name: Download Forgejo systemd service file get_url: diff --git a/ansible/services/lnbits/deploy_lnbits_playbook.yml b/ansible/services/lnbits/deploy_lnbits_playbook.yml index 7b89f33..d0e1a77 100644 --- a/ansible/services/lnbits/deploy_lnbits_playbook.yml +++ b/ansible/services/lnbits/deploy_lnbits_playbook.yml @@ -85,6 +85,10 @@ owner: "{{ ansible_user }}" group: "{{ ansible_user }}" mode: '0644' + # Seed a fresh install only. Without this every re-run replaced the real + # .env (AUTH_SECRET_KEY and all) with the example, logging every user + # out - and would have clobbered a restored one. + force: false - name: Configure LNBits environment variables diff --git a/ansible/services/personal-blog/deploy_personal_blog_playbook.yml b/ansible/services/personal-blog/deploy_personal_blog_playbook.yml index 21d8b43..d3a9951 100644 --- a/ansible/services/personal-blog/deploy_personal_blog_playbook.yml +++ b/ansible/services/personal-blog/deploy_personal_blog_playbook.yml @@ -45,6 +45,9 @@ owner: "{{ ansible_user }}" group: www-data mode: '0664' + # Only on a fresh web root. Without this, every re-run (and site.yml) + # overwrote the real deployed index.html with the placeholder. + force: false - name: Publish the blog through Caddy ansible.builtin.include_role: