stuff

02_vps_core_services_setup.md

@@ -117,6 +117,7 @@ Checklist
 
 Checklist:
 - [ ] You can see both the system healthcheck and disk usage check for all VPSs in the uptime kuma UI.
+- [ ] The checks are all green after ~30 min.
 
 ## Vaultwarden
 
@@ -150,6 +151,12 @@ Vaultwarden is a credentials manager.
 * Stop Vaultwarden.
 * Overwrite the data folder with one of the backups.
 * Start it up again.
+* Be careful! The restoring of a backup doesn't include the signup behaviour. If you deployed a new instance and restored a backup, you still need to manually repeat as described above the disabling of the sign ups.
+
+Checklist
+- [ ] The service is reachable at the URL
+- [ ] You have stored the admin creds properly
+- [ ] You can't create another user at the /signup path
 
 ## Forgejo
 
@@ -168,6 +175,28 @@ Forgejo is a git server.
 * You can tweak more settings from that point on.
 * SSH cloning should work out of the box (after you've set up your SSH pub key in Forgejo, that is).
 
+### Set up backups to Lapy
+
+* Make sure rsync is available on the host and on Lapy.
+* Ensure GPG is configured with a recipient in your inventory (the backup script requires `gpg_recipient` to be set).
+* Run the backup playbook: `ansible-playbook -i inventory.ini services/forgejo/setup_backup_forgejo_to_lapy.yml`.
+* A first backup process gets executed and then a cronjob is set up to refresh backups periodically. The script backs up both the data and config directories. Backups are GPG encrypted for safety. Note that the Forgejo service is stopped during backup to ensure consistency.
+
+### Restoring to a previous state
+
+* Stop Forgejo.
+* Decrypt the backup: `gpg --decrypt forgejo-backup-YYYY-MM-DD.tar.gz.gpg | tar -xzf -`
+* Overwrite the data and config directories with the restored backup.
+* Ensure that files in `/var/lib/foregejo/` are owned by the right user.
+* Start Forgejo again.
+* You may need to refresh ssh pub key so your old SSH driven git remotes work. Go to site administration, dashboard, and run task `Update the ".ssh/authorized_keys" file with Forgejo SSH keys.`.
+
+Checklist:
+- [ ] Forgejo is accessible at the FQDN
+- [ ] You have stored the admin credentials properly
+- [ ] The backup script runs fine
+- [ ] SSH cloning works after setting up your SSH pub key
+
 
 ## LNBits
 
@@ -175,7 +204,7 @@ LNBits is a Lightning Network wallet and accounts system.
 
 ### Deploy
 
-* Decide what subdomain you want to serve LNBits on and add it to `services/lnbits/lnbits_vars.yml` on the `lnbits_subdomain`.
+* Decide what subdomain you want to serve LNBits on and add it to `ansible/services_config.yml` under `lnbits`.
     * Note that you will have to add a DNS entry to point to the VPS public IP.
 * Run the deployment playbook: `ansible-playbook -i inventory.ini services/lnbits/deploy_lnbits_playbook.yml`.
 
@@ -265,3 +294,31 @@ Headscale is a self-hosted Tailscale control server that allows you to create yo
 * View users: `headscale users list`
 * Generate new pre-auth keys: `headscale preauthkeys create --user counter-net --reusable`
 * Remove a device: `headscale nodes delete --identifier <node-id>`
+
+## Personal Blog
+
+Personal Blog is a static site served by Caddy's file server.
+
+### Deploy
+
+* Decide what subdomain you want to serve the personal blog on and add it to `ansible/services_config.yml` under `personal_blog`.
+    * Note that you will have to add a DNS entry to point to the VPS public IP.
+* Run the deployment playbook: `ansible-playbook -i inventory.ini services/personal-blog/deploy_personal_blog_playbook.yml`.
+* The playbook will:
+    * Create the web root directory at `/var/www/pablohere.contrapeso.xyz` (or your configured domain)
+    * Set up Caddy configuration with file_server directive
+    * Create an Uptime Kuma monitor for the site
+    * Configure proper permissions for deployment
+
+### Set up deployment alias on Lapy
+
+* Run the deployment alias setup playbook: `ansible-playbook -i inventory.ini services/personal-blog/setup_deploy_alias_lapy.yml`.
+* This creates a `deploy-personal-blog` alias in your `.bashrc` that allows you to deploy your static site from `~/pablohere/public/` to the server.
+* Source your `.bashrc` or open a new terminal to use the alias: `source ~/.bashrc`
+* Deploy your site by running: `deploy-personal-blog`
+    * The alias copies files via scp to a temporary location, then moves them with sudo to the web root and fixes permissions.
+
+Checklist:
+- [ ] Personal blog is accessible at the FQDN
+- [ ] Uptime Kuma monitor for the blog is showing as healthy
+- [ ] Deployment alias is working and you can successfully deploy files