From 954b683c716bb03c0e0225bdaad57285519fff4f Mon Sep 17 00:00:00 2001 From: counterweight Date: Sun, 13 Sep 2026 20:58:46 +0200 Subject: [PATCH] ansible: delete the duplicated vars files, move globals to group_vars/all Three files existed only as second copies of things group_vars/all already auto-loads, and 34 playbooks named them in vars_files: - which outranks group_vars, so the copies won. The day someone edited one and not the other, those plays would silently keep the stale value. infra_vars.yml was already drifting: group_vars/all/main.yml had grown age_backup_recipient and backup_pull_public_key that it lacked. infra_vars.yml - a strict subset of group_vars/all/main.yml infra_secrets.yml - decrypts byte-identical to group_vars/all/vault.yml infra_secrets.yml.example - documented Uptime Kuma credentials as the reason the file exists, which stopped being true Deleted, along with 62 vars_files entries across 34 playbooks (12 of which named ../../group_vars/all/main.yml directly - same defect, a vars_files entry duplicating an auto-loaded file at higher precedence than the file itself). Checked before touching anything: infra_secrets.yml was listed LAST in 10 plays, after services_config.yml, so removal would flip precedence if the two shared a key. They share none, and neither does services_config.yml with group_vars/all/main.yml, so the removal is provably inert. services_config.yml was the last one standing. It held four unrelated things: caddy_sites_dir - an identical copy of roles/caddy_site/defaults/. Deleted; the role default is now the only one. *.tailscale_hostname (x3) - a THIRD copy of each box's identity, which inventory.ini already holds as ansible_host. Deleted. Edge plays now read hostvars[''].ansible_host - verified an edge play resolves that with nothing loaded and the other host in no play. Three copies of one name is how bitcoin_rpc_host ended up labelled "knots_box" while pointing at fulcrum-box. subdomains, ntfy topic, - genuinely global: their readers span managed, headscale namespace monitoring, vpn_control and edge, so no single group covers them. Moved to group_vars/all/main.yml where they auto-load. The ntfy_topic and headscale_namespace indirection through service_settings collapses to the global name. the four cross-host ports - the only entries with a real justification. Left in place; they move in the next commit. Also dead, all Uptime Kuma residue or duplication: phoenixd_monitor_name, forgejo_runner healthcheck_timeout_seconds/retries, fulcrum_tailscale_hostname, and bitcoin_knots_version - the last being a v-prefixed copy of bitcoin_knots_version_short that nothing read, two hand-maintained copies of one version string. Corrected a false comment: services_config.yml claimed the uptime_kuma subdomain "no longer resolves to anything". It resolves to 164.92.239.72 and answers HTTP 302, and 11 playbooks still template it. Same wrong premise as PLAN_3. Verification: all 37 playbooks' --list-tasks output is byte-identical before and after. A probe resolving all 22 values services_config.yml used to supply returns 21 identical and one intended deletion (caddy_sites_dir, now role-only - confirmed the role still resolves it: "Ensure Caddy sites-enabled directory exists" comes back ok against the real path). memos check-diff identical before and after. Syntax passes on every playbook. Co-Authored-By: Claude Opus 5 (1M context) --- ansible/group_vars/all/main.yml | 43 ++++ .../01_user_and_access_setup_playbook.yml | 2 - .../02_firewall_and_fail2ban_playbook.yml | 2 - ansible/infra/410_disk_usage_alerts.yml | 5 +- ansible/infra/420_system_healthcheck.yml | 5 +- ansible/infra/430_cpu_temp_alerts.yml | 3 - ansible/infra/900_install_rsync.yml | 2 - ansible/infra/920_join_headscale_mesh.yml | 2 - .../nodito/30_proxmox_bootstrap_playbook.yml | 2 - .../31_proxmox_community_repos_playbook.yml | 2 - .../nodito/32_zfs_pool_setup_playbook.yml | 4 - .../33_proxmox_debian_cloud_template.yml | 2 - .../nodito/34_nut_ups_setup_playbook.yml | 4 - ansible/infra_secrets.yml | 194 ------------------ ansible/infra_secrets.yml.example | 38 ---- ansible/infra_vars.yml | 9 - ansible/roles/bitcoin_knots/defaults/main.yml | 6 +- ansible/roles/caddy_site/defaults/main.yml | 3 +- ansible/roles/datum_gateway/defaults/main.yml | 2 +- .../roles/forgejo_runner/defaults/main.yml | 2 - ansible/roles/fulcrum/defaults/main.yml | 6 +- ansible/roles/mempool/defaults/main.yml | 4 +- ansible/roles/phoenixd/defaults/main.yml | 1 - .../deploy_bitcoin_knots_playbook.yml | 5 +- .../deploy_datum_gateway_playbook.yml | 9 +- .../deploy_forgejo_runner_playbook.yml | 2 - .../forgejo/deploy_forgejo_playbook.yml | 2 - ansible/services/forgejo/forgejo_vars.yml | 2 +- .../services/forgejo/setup_backup_forgejo.yml | 1 - .../fulcrum/deploy_fulcrum_playbook.yml | 5 +- .../headscale/deploy_headscale_playbook.yml | 3 - ansible/services/headscale/headscale_vars.yml | 4 +- .../headscale/setup_backup_headscale.yml | 1 - .../lnbits/deploy_lnbits_playbook.yml | 2 - ansible/services/lnbits/lnbits_vars.yml | 2 +- .../services/lnbits/setup_backup_lnbits.yml | 1 - .../services/memos/deploy_memos_playbook.yml | 4 - ansible/services/memos/memos_vars.yml | 2 +- ansible/services/memos/setup_backup_memos.yml | 1 - .../mempool/deploy_mempool_playbook.yml | 3 - .../deploy_ntfy_emergency_app_playbook.yml | 2 - .../ntfy_emergency_app_vars.yml | 2 +- .../services/ntfy/deploy_ntfy_playbook.yml | 2 - ansible/services/ntfy/ntfy_vars.yml | 2 +- .../setup_ntfy_uptime_kuma_notification.yml | 3 - .../deploy_personal_blog_playbook.yml | 2 - .../personal-blog/setup_deploy_alias_lapy.yml | 1 - .../phoenixd/deploy_phoenixd_playbook.yml | 2 - .../deploy_vaultwarden_playbook.yml | 2 - .../disable_vaultwarden_sign_ups_playbook.yml | 1 - .../vaultwarden/setup_backup_vaultwarden.yml | 1 - .../services/vaultwarden/vaultwarden_vars.yml | 2 +- ansible/services_config.yml | 71 ++----- 53 files changed, 82 insertions(+), 403 deletions(-) delete mode 100644 ansible/infra_secrets.yml delete mode 100644 ansible/infra_secrets.yml.example delete mode 100644 ansible/infra_vars.yml diff --git a/ansible/group_vars/all/main.yml b/ansible/group_vars/all/main.yml index 0be0162..1dc3541 100644 --- a/ansible/group_vars/all/main.yml +++ b/ansible/group_vars/all/main.yml @@ -14,3 +14,46 @@ age_backup_recipient: "age192wwdaseqej2ggwyp884gtm05c396anp7chr0vr8m47g50fahpyqr # Public key small-backups-box pulls with # Authorised on each source host for an unprivileged, dedicated user only backup_pull_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfIixKMhA9z+Nvyx6ToZIniC8aEgyiInRiboaTTemgX offsite-backup-pull" + + +# ───────────────────────────────────────────────────────────────────────────── +# Subdomains. Global because the edge host proxies for services that live on +# other machines, so no single inventory group covers the readers. Combine with +# root_domain above to build an FQDN. +# +# Moved here from services_config.yml, which 30 plays had to remember to name in +# vars_files: - a file everyone must opt into is a file someone will forget. +# ───────────────────────────────────────────────────────────────────────────── +subdomains: + # Monitoring (watchtower) + ntfy: ntfy + # Uptime Kuma IS still running and this subdomain DOES resolve + # (164.92.239.72, HTTP 302). Only the Ansible code and the vault credentials + # were retired. A comment here previously claimed the opposite. + uptime_kuma: uptime + + # VPN infrastructure (spacey) + headscale: headscale + + # Core services (vipy) + vaultwarden: vault + forgejo: forgejo + lnbits: wallet + + # Secondary services (vipy) + ntfy_emergency_app: avisame + personal_blog: pablohere + + # Memos (memos-box) + memos: memos + + # Mempool block explorer (mempool-box, proxied via vipy) + mempool: mempool + + # DATUM Gateway dashboard (knots-box, proxied via vipy) + datum_gateway: datum + +# Read by plays targeting managed, monitoring, vpn_control and edge - no one +# group covers them, so these are global rather than group_vars/. +ntfy_topic: alerts +headscale_namespace: counter-net diff --git a/ansible/infra/01_user_and_access_setup_playbook.yml b/ansible/infra/01_user_and_access_setup_playbook.yml index c6eed18..0e2c914 100644 --- a/ansible/infra/01_user_and_access_setup_playbook.yml +++ b/ansible/infra/01_user_and_access_setup_playbook.yml @@ -1,7 +1,5 @@ - name: Secure Debian hosts: managed - vars_files: - - ../infra_vars.yml become: true tasks: diff --git a/ansible/infra/02_firewall_and_fail2ban_playbook.yml b/ansible/infra/02_firewall_and_fail2ban_playbook.yml index 9f37c70..309db56 100644 --- a/ansible/infra/02_firewall_and_fail2ban_playbook.yml +++ b/ansible/infra/02_firewall_and_fail2ban_playbook.yml @@ -1,7 +1,5 @@ - name: Secure Debian hosts: managed - vars_files: - - ../infra_vars.yml become: true tasks: diff --git a/ansible/infra/410_disk_usage_alerts.yml b/ansible/infra/410_disk_usage_alerts.yml index dcd9bdc..85947d9 100644 --- a/ansible/infra/410_disk_usage_alerts.yml +++ b/ansible/infra/410_disk_usage_alerts.yml @@ -15,9 +15,7 @@ hosts: managed become: yes vars_files: - - ../infra_vars.yml - ../services_config.yml - - ../infra_secrets.yml vars: disk_usage_threshold_percent: 80 @@ -27,9 +25,8 @@ monitoring_script_path: "{{ monitoring_script_dir }}/disk_usage_monitor.sh" log_file: "{{ monitoring_script_dir }}/disk_usage_monitor.log" systemd_service_name: disk-usage-monitor - # Uptime Kuma configuration (auto-configured from services_config.yml and infra_secrets.yml) + # Uptime Kuma configuration (auto-configured from group_vars/all/) uptime_kuma_api_url: "https://{{ subdomains.uptime_kuma }}.{{ root_domain }}" - ntfy_topic: "{{ service_settings.ntfy.topic }}" tasks: - name: Validate Uptime Kuma configuration diff --git a/ansible/infra/420_system_healthcheck.yml b/ansible/infra/420_system_healthcheck.yml index 05532a7..a69b456 100644 --- a/ansible/infra/420_system_healthcheck.yml +++ b/ansible/infra/420_system_healthcheck.yml @@ -15,9 +15,7 @@ hosts: managed become: yes vars_files: - - ../infra_vars.yml - ../services_config.yml - - ../infra_secrets.yml vars: healthcheck_interval_seconds: 60 # Send healthcheck every 60 seconds (1 minute) @@ -27,9 +25,8 @@ monitoring_script_path: "{{ monitoring_script_dir }}/system_healthcheck.sh" log_file: "{{ monitoring_script_dir }}/system_healthcheck.log" systemd_service_name: system-healthcheck - # Uptime Kuma configuration (auto-configured from services_config.yml and infra_secrets.yml) + # Uptime Kuma configuration (auto-configured from group_vars/all/) uptime_kuma_api_url: "https://{{ subdomains.uptime_kuma }}.{{ root_domain }}" - ntfy_topic: "{{ service_settings.ntfy.topic }}" tasks: - name: Validate Uptime Kuma configuration diff --git a/ansible/infra/430_cpu_temp_alerts.yml b/ansible/infra/430_cpu_temp_alerts.yml index 5c9e855..048f216 100644 --- a/ansible/infra/430_cpu_temp_alerts.yml +++ b/ansible/infra/430_cpu_temp_alerts.yml @@ -15,9 +15,7 @@ hosts: hypervisor become: yes vars_files: - - ../infra_vars.yml - ../services_config.yml - - ../infra_secrets.yml vars: temp_threshold_celsius: 80 @@ -27,7 +25,6 @@ log_file: "{{ monitoring_script_dir }}/cpu_temp_monitor.log" systemd_service_name: nodito-cpu-temp-monitor uptime_kuma_api_url: "https://{{ subdomains.uptime_kuma }}.{{ root_domain }}" - ntfy_topic: "{{ service_settings.ntfy.topic }}" tasks: - name: Validate Uptime Kuma configuration diff --git a/ansible/infra/900_install_rsync.yml b/ansible/infra/900_install_rsync.yml index 6c6b10e..b690009 100644 --- a/ansible/infra/900_install_rsync.yml +++ b/ansible/infra/900_install_rsync.yml @@ -1,7 +1,5 @@ - name: Install rsync hosts: managed - vars_files: - - ../infra_vars.yml become: true tasks: diff --git a/ansible/infra/920_join_headscale_mesh.yml b/ansible/infra/920_join_headscale_mesh.yml index 5b5e4ce..3a8641c 100644 --- a/ansible/infra/920_join_headscale_mesh.yml +++ b/ansible/infra/920_join_headscale_mesh.yml @@ -2,13 +2,11 @@ hosts: managed become: yes vars_files: - - ../infra_vars.yml - ../services_config.yml vars: headscale_host_name: "spacey" headscale_subdomain: "{{ subdomains.headscale }}" headscale_domain: "https://{{ headscale_subdomain }}.{{ root_domain }}" - headscale_namespace: "{{ service_settings.headscale.namespace }}" tasks: - name: Set facts for headscale server connection diff --git a/ansible/infra/nodito/30_proxmox_bootstrap_playbook.yml b/ansible/infra/nodito/30_proxmox_bootstrap_playbook.yml index 86f693f..4edab06 100644 --- a/ansible/infra/nodito/30_proxmox_bootstrap_playbook.yml +++ b/ansible/infra/nodito/30_proxmox_bootstrap_playbook.yml @@ -1,8 +1,6 @@ - name: Bootstrap Nodito SSH Key Access hosts: hypervisor become: true - vars_files: - - ../infra_vars.yml tasks: - name: Install sudo package diff --git a/ansible/infra/nodito/31_proxmox_community_repos_playbook.yml b/ansible/infra/nodito/31_proxmox_community_repos_playbook.yml index 378a674..0fab184 100644 --- a/ansible/infra/nodito/31_proxmox_community_repos_playbook.yml +++ b/ansible/infra/nodito/31_proxmox_community_repos_playbook.yml @@ -1,8 +1,6 @@ - name: Switch Proxmox VE from Enterprise to Community Repositories hosts: hypervisor become: true - vars_files: - - ../infra_vars.yml tasks: - name: Check for deb822 sources format diff --git a/ansible/infra/nodito/32_zfs_pool_setup_playbook.yml b/ansible/infra/nodito/32_zfs_pool_setup_playbook.yml index 97e0cab..1aad2e7 100644 --- a/ansible/infra/nodito/32_zfs_pool_setup_playbook.yml +++ b/ansible/infra/nodito/32_zfs_pool_setup_playbook.yml @@ -1,8 +1,6 @@ - name: Setup ZFS RAID 1 Pool for Proxmox Storage hosts: hypervisor become: true - vars_files: - - ../infra_vars.yml tasks: - name: Verify Proxmox VE is running @@ -187,8 +185,6 @@ - name: Setup ZFS Pool Health Monitoring and Monthly Scrubs hosts: hypervisor become: true - vars_files: - - ../../infra_vars.yml vars: zfs_check_interval_seconds: 86400 # 24 hours diff --git a/ansible/infra/nodito/33_proxmox_debian_cloud_template.yml b/ansible/infra/nodito/33_proxmox_debian_cloud_template.yml index e2b1f5d..faf93a5 100644 --- a/ansible/infra/nodito/33_proxmox_debian_cloud_template.yml +++ b/ansible/infra/nodito/33_proxmox_debian_cloud_template.yml @@ -1,8 +1,6 @@ - name: Create Proxmox template from Debian cloud image (no VM clone) hosts: hypervisor become: true - vars_files: - - ../../infra_vars.yml vars: # Defaults (override via vars_files or --extra-vars as needed) diff --git a/ansible/infra/nodito/34_nut_ups_setup_playbook.yml b/ansible/infra/nodito/34_nut_ups_setup_playbook.yml index da1136f..8e188b6 100644 --- a/ansible/infra/nodito/34_nut_ups_setup_playbook.yml +++ b/ansible/infra/nodito/34_nut_ups_setup_playbook.yml @@ -1,8 +1,6 @@ - name: Setup NUT (Network UPS Tools) for CyberPower UPS hosts: hypervisor become: true - vars_files: - - ../../infra_vars.yml tasks: # ------------------------------------------------------------------ @@ -253,8 +251,6 @@ - name: Setup UPS Heartbeat Monitoring hosts: hypervisor become: true - vars_files: - - ../../infra_vars.yml vars: ups_heartbeat_interval_seconds: 60 diff --git a/ansible/infra_secrets.yml b/ansible/infra_secrets.yml deleted file mode 100644 index 567c768..0000000 --- a/ansible/infra_secrets.yml +++ /dev/null @@ -1,194 +0,0 @@ -$ANSIBLE_VAULT;1.1;AES256 -36353131353730316436313965366263666236396164323163376431623232313961323863633035 -6338333965643036666538303864376463623434326564660a396239633264353034653963366466 -66353130376366663730626331346235373935306434303462663763613763663131613335633430 -6335633535333166330a366232306230303033663931333734353636656132383034616336653235 -35636234306134376666666538386561663561626262396135313632393831363665646130643261 -65663137613530393162333838313962393934396135613064333564303666353634396266316135 -65346363663232626261643933353239663635343137646431623561653963363131303033623764 -34616339343835353765363962396665636335623066303062626463343733643137626265643366 -34653139616163666131333330376132343363306132653163343934353034353932383066373462 -31316664383938633361373839353762393838386636393564633430346334323734383430386663 -39313938383830373062336335303135396334323330316537303965653331323130323866663866 -38323462643633396531386632613961343835313931613933373963326465333836323935613436 -63346562313239623162333038663535656633323037363532373536616161303833626539366634 -35363462663539353366623732626237326465663436356630626335623334356465646439376461 -63653230343333613932646431383238373039653461306365326234303365373234613038343338 -30353937353734633631313765346662616138383462353864656264653534653239383936616437 -34313531383438613465626437313130326562316430366234326230303133356631363534396366 -64313732303837666537383161373865653162303034376533636264656564316530613738353435 -38353031616538346438336563336134643261366331623562663534643966306164306132646332 -31336539663131646232353633326637306637353239616331356337353761313763643933303838 -61636333663137623233323561306665666666363731383438373664363538613762393130646261 -66346335373437326536356330613962386662383031366536373635353438316664613362633966 -35393331613634653462323739343466313735376463643035326336396435656364356134626535 -32623036383737623631623332666264653964383939316465353765373132383230336334353463 -38303136356630653561333363306136363230383238666663373130663763336532323631663637 -32633263633835326662366237613639313431366433363730666666333961323036363533613236 -39343963613239333731336461393937633463303530643333626662316563313165613564386663 -34373636383231636461653862356332353161366331633036383837353434373865363139386235 -30323130343534386531666333343765373265626530373335633766353562356562326239336564 -62313033376330383563633138623838633132343130343262663030316435393835313762313564 -30393366393161663265303439383937333739396661393862356132343537616333623035653566 -64316333323733336135383637333739393931333461653731383863616138613234316161623765 -30343964623939663339633139383866336163613933363231303837646565626262303330363338 -64353931623366326666386637363866383761666232663866666438313535393434373933653139 -64636236306632613930363935353736393065353634653235303534316463653438646162663866 -63663839346162396262366563613131356161333137623966653039623436373466663163313938 -64636362383532303136316163306236333134346164376362363730363030643436356631306639 -31376131653162343338613830376466356363356238343436366232393062336433623238323864 -32376133346264383736396166343539363361623864613364613030623936396634616431386263 -35323632353334643466383933356236383432323162386532613535343932353531373065633732 -36626361313436613036363662376337613237353532366163656236323937316437613633383535 -39306334656532383063306332636538666462353836633366353932623962396131663532343364 -64393035303265336638343733366236373466343832333038633138306535303034386134653032 -62633532353462613664636333373461356434666130376332373762653966386238346463333939 -32386233326264666234353139643837636663633362626163356633396465643030383639663538 -31626331393161653038613438613735643364326565633362386331646231333539626133633739 -31336236663863376166636632363965343765666335633464613937653738313230356438313436 -39373936663363626337626164383237626164396337613430373035373339616266666264346164 -66386238373664386138636536616266353466666363383131616532323430663761633139626164 -33323936356565303332383463656533633935373564353461626139343265336334363433333138 -64363534363836666338366339636435366334383339663463376164613866333839366264666237 -35306231656536613138353663626166303366373761323866666436356438653764353431383430 -33323766643431303337323265646631373434393436333335666366306138356337343163336362 -39323131653734366561613864383266386131626164363361656534386363613565336532666162 -38333031656330306635313032343861653037323037616564323537666261316438303631616530 -35303238366338376363383764633865326530643736306634363436643330376432396535363932 -39646666333234326261373835646336663138366237346562396238326530356533326363373664 -38303634383036323232363934626562663864646239653066326565623635653535623137663065 -65376633356136333938623763396138376630636636376434333463313833386435633365623036 -30373937353433396264643231323832373963396437363562623639353764623063363733366165 -38613833353231333836373637626133323965316665313837653335386534326434363034653630 -38323335666466306665663262343737636564393934373338623130636362383564376434626533 -35623761396465333730626563633734373131373132343262653333343439623433313964623463 -33613639616636393563663331326535346131663832313861353434313965393164643538643437 -36363130363934623333666330353236386530626536616333303131396265386263363462356364 -38393864623461643831333731656566636532643338306361666335316265396430376432393730 -34633638636466313232376363306333356564393038323130313634386162333639366162623437 -66306234346430346537343338343064623131366337356262653130616464646336353136336234 -34623063336332666138303961333332326632326137366664306263666538616361316363323163 -38613431353762653139636365353031343465366138396161366538393833666236656264623132 -63313630633231613438613865613333343066376261326333623864636430643866656132353538 -65653731626464323930383636663364313437313531646462623163646630646664356335303764 -61313462623234303961356363386464333061306239643263333135653538313338383134343236 -63396461346438373830643031336165376563636530353836626436613561313536623130613663 -63383939663535326236313736613630313061323837346339353834313434393437383237633534 -65363334643238373864636530386434636565623131366433313562623933366633396565646565 -33626433373834633638656365363261643866343961663566333761306138383865316536303664 -35653463633336616438373732303938393032663961653262333134353762333433373039636638 -33366466336133383061373866323231663038373831386139613535376539393165363034303537 -35346638613137616666623362396564346464376133316262646339333936363961316161663332 -38303239356334633137316333363439303935346230613032643564353734643863636264316136 -39663131376638653138623838323739343064623430386166643962633363373335316239663339 -37633934393664346433316633353831373534653437623065363134626661323732656664633639 -32616539323931626130353836303533363232353066343666366263663565623862333062323237 -31393935313133333837626632346461356134376339633239396438336333376534353063633937 -61653230653666623935346134666130373934643438323464346239336430373635396165323738 -36613432356239323039386364643535346261373739363463373839373063346565616466663239 -33353165353631343730636531363565383363623839346434383737313136646330323461633665 -32376631663637353534636262666532643636366237383539346235383832313933336432363734 -35653866643136383934613261633439343831363234616438333530336437326562366536383834 -33343330316337323064386464656436333430643061663665306534386235336437643965393165 -61373038323539316161363731306334633833376532626537643164373638303438326637376630 -35343333343364326538333862643265336166396466373362326162303430383434626535336163 -31666662653261343631366165656131376462333063626134613466636637383936303933346362 -32386162323230666563353838613033393936386535646130613861356563633566393430313661 -37666561643361653630353262653234636232303534393661343834366562353864343638313134 -36656463653166393432646263626530316361643761646265613534643563306161333539633361 -33613830356238623962623739623437646635356334386637633035373262313539386662353732 -35666534663965333836396664316432633137363761623838356430316566383131363530316462 -62636235396136363538653836633133663465386139636339353664666634343238663861613437 -62656435363832623461363662643262323265353066376538306163376438303838373961303239 -63623066656532353933396534623637356362356231336361393534393465633565653132656130 -37363863666136643461383033653936383935333131343565643664386664326463663466633361 -36313638616533623431316361386539383434653866376363383630323632636237373666393561 -31313135303339633763303762653939386663393439646135656537303331366236396230303063 -32336336366533323936633166623434623365633163643461653966383563653533363335666638 -61313764656437613138663038386336336664396539373930373933326234636662653833656435 -61343962373935653238326265663164363561616435363134313634666331636431633133356563 -37326133363762383266353730343537373934653634366336316635653063313461303237633164 -61333231353135343666343461306161626432636331653962613334376439613265653437663333 -34623638313561356464356534343635653265633531323736386335656635303263636663323930 -39373462663438326366363433343735343234383735643363326339626135313564646432656330 -38653836653938383932643032616534363035366530336663653235366230353332636531653138 -63623537353165623037383361643937623466356464313931666430666632633866363232623230 -32353766383432613233313331356432326430383132616263656361613334383936643066326133 -30643935653662376433353039323836613239336265376663616336663264343331373236373237 -64326462626566386563623235633664653665356461316362663462343665303233313035366435 -32623465656138303161396233623661333238306334646663353263383437653461383366366466 -39303061363530373339623435613765313637616634313731666631653161623439323734383735 -65383666366330623338653561353032373231396431353466313335303935386136613566336331 -62326539383631636263353234393866333031643737663064383130313066396461663466623431 -38616364303439393432663035623138353264656635393633646363366538633262306466336564 -35623733613564323233303034636264336464373566303065383438366338643538666638643466 -63343130613461316465626237343235616536613838623930636136333131616437656631376564 -34366535383961656237333030376139353237343636306165646161323732646663376231393832 -61396263393561356438326237633634333533646638383865336164656465383166373236643063 -63643263303132656336333339623539663765333039396364643462396161366562626362343162 -34363936323230373839373734343332663664373634313364383062353130363362623937656139 -32653237643061646531623030646335383463333136366264363133303666663261343631663762 -36346432386465393765353763353265633837623165303634646137646564356237653336666331 -38376463376130353863636334353633313361313239373264333134333232353765346666326665 -65623333396165353334636532303537366566666130343366383964396365333461646566333431 -37303032643731346361393963303061363837373562393866353962333231623763623236323161 -39383538663837326663636166643864393733653764353536303433653563316339663438353838 -37616135373336326536333932636538336465323130626266613930393266633164636439663532 -37633264356661353836346462626538323631613539636631396436646139666538383838323437 -62663561356430336235343439633135326661653031653063363030326132336462336164373232 -31363131326334613361356461353934656364346666663762306161356463386332366562336630 -39326236656335363630363564316134623435343538386462663161396332366639363033383235 -35306434646330636137323939623565663939643161616336386633633133363963383739633434 -32336433663132363239356266653461633033623232346135353032353265343861316638643265 -66303932643235333764323239653430346132666136663133383935613962353235313336306136 -38373938376238313034346237373035383861613930323936663831346538313937343538663737 -62616139663634333636333635636364643966303565656265653634653437633233396138323831 -64313465643233663663303130653133626638313162356133316139333030663530313232626437 -35613439326639393032393962653933376636663934333764393064346465633637613836333933 -33646336653533666631656132623035323963623134653432363133646339346363336263323135 -34356233373965333362326132383762626436333365363731396134376664363465623362316366 -31623361376161393836623732613034643831363838663733386561313961373632643639666635 -37633061303235306437666337306236316331616330396632356266636137313833346366653031 -64366236306139363861323237396232336665633331326139373461353237336432373366333266 -32326565376464383937356562633730383961306535666464383364656137633662333662626366 -30653736646333333963656566326431376361666465363532393765393764633562626232643836 -32626261373835356634633461303664653362346231343030343433376364643664383464636666 -35323738366332306337616563646231663963353135623133613636666363396530643239626566 -35383330663138333631386363643032383161626439633437343934366635656433386163613663 -30623738656535396134363830626338353864356330613131623832363330633064376531303965 -35313036393031383035633035636165313363333564633938306166666639636436353733303662 -66653264356432383166333630646533313736366130666331306537393262363538313030646134 -38306363663932313230346664303531636639656339323062333739303239333861616533666132 -30353332303233323837346234336633646163643137636166633330633464663935653838313161 -37393533646139313236393234313763353533663638363031393764633862363938643838353937 -36613564353366663434633839303036343665313933326531353831396139613330316632613637 -37666432363330326232366664656462313336323866316633396533313638373462386365663332 -63626136396661353739633263363038326630623037353831323930346431666263333431643562 -39373133636465373064613664323335353236326562343966616439646565383934613462623363 -38613962386236356666643038303435376266656165336263653365353537666362616638636639 -34326262303930303237636339666563613663373863666339663135326661663866346264613734 -34353565613832323132343730396535656264376233356162353265623739613332333261393331 -33616230333033613766643264396633343535376461633330633064613662336532613163373962 -61343065373630383838306631633031656566343765333365373932373234313733396165623639 -65313731346632333235303463393039656232653163336161633265376434623466373361333865 -66323664343766306566663335656138323537656563383835653263323039656166613330613733 -38323064306365656561313163306439653937623536616435616431616133643466336362666330 -64303832343739383430626339663532653363626263393237343234666266323933316566343937 -32373335373237653265303638663331363838313961343936616639646438343633326461626363 -30653964646639663836636437653861343064393332306638363864326439626335373663653335 -33653230626337633863356534393466633162323734623135393931363339383163353466633031 -39343435616137373166376538633330386232333666316566336234373933613534666430353336 -33626637346337623132313833343430613832303932323739326537666531356630356137653963 -30623262373032353934353938346263396338336265393937336539386530343062623761646632 -39653035393535356630626164393464663738616239613166613364396539343039306538613230 -38636261633932643965323966346632616264343262643933346163656436326330336564623265 -30646561303563323937393533663066393733353638323332663736353766336664343265613733 -66643631633864386262343232636465613962386538366163613734386635303837636164383465 -35373331363864393934633563623662326632386534323436663634613030646563643035386539 -37323262646365633739626539346638383039643433343837363561303530376434336131353965 -32336133393139626232313933636136646264613338643238646431316566333662353837636232 -32623639636432333134643962313430623533333237343464383135643361336236396533653761 -66383165363539363938653130633630643865636663313665353839646462613334383266663563 -62333035626539383739656565633861363863333563656339353735336330333633633861643130 -35363062306165623861316639336237373434353437626461383931656531306134313264383664 -37353966616136326264376135373532653630393335336665343463323466353162 diff --git a/ansible/infra_secrets.yml.example b/ansible/infra_secrets.yml.example deleted file mode 100644 index c95234d..0000000 --- a/ansible/infra_secrets.yml.example +++ /dev/null @@ -1,38 +0,0 @@ -# Uptime Kuma login credentials -# Used by the disk monitoring playbook to create monitors automatically - - -# ntfy credentials -# Used for notification channel setup in Uptime Kuma - -ntfy_username: "your_ntfy_username" -ntfy_password: "your_ntfy_password" - -# headscale-ui credentials -# Used for HTTP basic authentication via Caddy -# Provide either: -# - headscale_ui_password: plain text password (will be hashed automatically) -# - headscale_ui_password_hash: pre-hashed bcrypt password (more secure, use caddy hash-password to generate) - -headscale_ui_username: "admin" -headscale_ui_password: "your_secure_password_here" -# headscale_ui_password_hash: "$2a$14$..." # Optional: pre-hashed password - -bitcoin_rpc_user: "bitcoinrpc" -bitcoin_rpc_password: "CHANGE_ME_TO_SECURE_PASSWORD" - -# Mempool MariaDB credentials -# Used by: services/mempool/deploy_mempool_playbook.yml -mariadb_mempool_password: "CHANGE_ME_TO_SECURE_PASSWORD" - -# Forgejo Runner registration token -# Used by: services/forgejo-runner/deploy_forgejo_runner_playbook.yml -# See: services/forgejo-runner/SETUP.md for how to obtain this token -forgejo_runner_registration_token: "YOUR_RUNNER_TOKEN_HERE" - -# DATUM Gateway secrets -# Used by: services/datum-gateway/deploy_datum_gateway_playbook.yml -datum_mining_address: "YOUR_BITCOIN_ADDRESS_FOR_BLOCK_REWARDS" -datum_gateway_admin_password: "CHANGE_ME_TO_SECURE_PASSWORD" -datum_dashboard_username: "admin" -datum_dashboard_password_hash: "$2a$14$..." # Generate with: caddy hash-password diff --git a/ansible/infra_vars.yml b/ansible/infra_vars.yml deleted file mode 100644 index 36d35f8..0000000 --- a/ansible/infra_vars.yml +++ /dev/null @@ -1,9 +0,0 @@ -new_user: counterweight -ssh_port: 22 -allow_ssh_from: "any" -root_domain: contrapeso.xyz - -# Uptime Kuma was decommissioned on 2026-09-11. The monitoring blocks in the -# playbooks are kept deliberately — the check logic is meant to be rewired to -# whatever replaces it. This flag keeps them inert until then. See archive/uptime_kuma/. -uptime_kuma_enabled: false diff --git a/ansible/roles/bitcoin_knots/defaults/main.yml b/ansible/roles/bitcoin_knots/defaults/main.yml index 29d5aa0..cd9d9c1 100644 --- a/ansible/roles/bitcoin_knots/defaults/main.yml +++ b/ansible/roles/bitcoin_knots/defaults/main.yml @@ -1,8 +1,10 @@ # Bitcoin Knots Configuration Variables # Version - REQUIRED: Specify exact version/tag to build -bitcoin_knots_version: "v29.2.knots20251110" # Must specify exact version/tag -bitcoin_knots_version_short: "29.2.knots20251110" # Version without 'v' prefix (for tarball URLs) +# The only version string. There used to be a second, v-prefixed copy +# (bitcoin_knots_version) that nothing read - two hand-maintained copies of one +# fact, with nothing keeping them in step. +bitcoin_knots_version_short: "29.2.knots20251110" # Directories bitcoin_knots_dir: /opt/bitcoin-knots diff --git a/ansible/roles/caddy_site/defaults/main.yml b/ansible/roles/caddy_site/defaults/main.yml index cafa3dc..0a59906 100644 --- a/ansible/roles/caddy_site/defaults/main.yml +++ b/ansible/roles/caddy_site/defaults/main.yml @@ -15,7 +15,8 @@ caddy_site_headers_up: {} # {"X-Forwarded-Host": "wallet.example.com"} # expression for the username silently passes through as literal text. caddy_site_basic_auth: [] # [{user: "{{ x_user }}", hash: "{{ x_hash }}"}] -# Placement. caddy_sites_dir comes from services_config.yml; this is the fallback. +# Placement. This is now the only definition of caddy_sites_dir - services_config.yml +# used to carry an identical copy, which was removed as redundant. caddy_sites_dir: /etc/caddy/sites-enabled # Rendered site files can carry credentials (basic_auth hashes), so --diff is diff --git a/ansible/roles/datum_gateway/defaults/main.yml b/ansible/roles/datum_gateway/defaults/main.yml index d3647ec..3a8cac4 100644 --- a/ansible/roles/datum_gateway/defaults/main.yml +++ b/ansible/roles/datum_gateway/defaults/main.yml @@ -31,7 +31,7 @@ datum_gateway_build_jobs: 4 # The gateway runs on the same host as Bitcoin Knots so localhost RPC works. # datum_bitcoin_rpc_url should include http:// and port. datum_bitcoin_rpc_url: "http://127.0.0.1:8332" -# Note: bitcoin_rpc_user and bitcoin_rpc_password come from infra_secrets.yml +# Note: bitcoin_rpc_user and bitcoin_rpc_password come from group_vars/all/vault.yml # Mining config datum_coinbase_tag_primary: "DATUM" diff --git a/ansible/roles/forgejo_runner/defaults/main.yml b/ansible/roles/forgejo_runner/defaults/main.yml index e0bac24..4a80d73 100644 --- a/ansible/roles/forgejo_runner/defaults/main.yml +++ b/ansible/roles/forgejo_runner/defaults/main.yml @@ -21,8 +21,6 @@ forgejo_instance_url: "https://forgejo.contrapeso.xyz" # systemd stores it, so `systemctl is-failed forgejo-runner-healthcheck.service` # answers the question with no monitoring system involved at all. healthcheck_interval_seconds: 60 -healthcheck_timeout_seconds: 90 -healthcheck_retries: 1 healthcheck_script_dir: /opt/forgejo-runner-healthcheck healthcheck_script_path: "{{ healthcheck_script_dir }}/forgejo_runner_healthcheck.sh" healthcheck_log_file: "{{ healthcheck_script_dir }}/forgejo_runner_healthcheck.log" diff --git a/ansible/roles/fulcrum/defaults/main.yml b/ansible/roles/fulcrum/defaults/main.yml index df213be..0d5c190 100644 --- a/ansible/roles/fulcrum/defaults/main.yml +++ b/ansible/roles/fulcrum/defaults/main.yml @@ -11,7 +11,7 @@ fulcrum_binary_path: /usr/local/bin/Fulcrum # Network - Bitcoin RPC connection # Bitcoin Knots is on a different host (knots_box_local) -# Using RPC user/password authentication (credentials from infra_secrets.yml) +# Using RPC user/password authentication (credentials from group_vars/all/vault.yml) # Addressed by Tailscale name, never a LAN IP. This was # bitcoin_rpc_host: "192.168.1.140" # IP of knots_box_local # but .140 is fulcrum-box ITSELF - knots-box is .135. The DHCP leases had @@ -21,7 +21,7 @@ fulcrum_binary_path: /usr/local/bin/Fulcrum # agree with it. bitcoin_rpc_host: "knots-box" bitcoin_rpc_port: 8332 # Bitcoin Knots RPC port -# Note: bitcoin_rpc_user and bitcoin_rpc_password are loaded from infra_secrets.yml +# Note: bitcoin_rpc_user and bitcoin_rpc_password are loaded from group_vars/all/vault.yml # Network - Fulcrum server fulcrum_tcp_port: 50001 @@ -42,8 +42,6 @@ fulcrum_ssl_cert_path: "{{ fulcrum_config_dir }}/fulcrum.crt" fulcrum_ssl_key_path: "{{ fulcrum_config_dir }}/fulcrum.key" fulcrum_ssl_cert_days: 3650 # 10 years validity for self-signed cert -# Port forwarding configuration (for public access via VPS) -fulcrum_tailscale_hostname: "{{ service_settings.fulcrum.tailscale_hostname }}" # Performance # db_mem will be calculated as 75% of available RAM automatically in playbook diff --git a/ansible/roles/mempool/defaults/main.yml b/ansible/roles/mempool/defaults/main.yml index d0e36b2..586b004 100644 --- a/ansible/roles/mempool/defaults/main.yml +++ b/ansible/roles/mempool/defaults/main.yml @@ -11,7 +11,7 @@ mempool_mysql_dir: "{{ mempool_dir }}/mysql" # Network - Bitcoin Core/Knots connection (via Tailnet Magic DNS) bitcoin_host: "knots-box" bitcoin_rpc_port: 8332 -# Note: bitcoin_rpc_user and bitcoin_rpc_password are loaded from infra_secrets.yml +# Note: bitcoin_rpc_user and bitcoin_rpc_password are loaded from group_vars/all/vault.yml # Network - Fulcrum Electrum server (via Tailnet Magic DNS) fulcrum_host: "fulcrum-box" @@ -30,7 +30,7 @@ mempool_backend_port: 8999 # MariaDB settings mariadb_database: "mempool" mariadb_user: "mempool" -# Note: mariadb_mempool_password is loaded from infra_secrets.yml +# Note: mariadb_mempool_password is loaded from group_vars/all/vault.yml diff --git a/ansible/roles/phoenixd/defaults/main.yml b/ansible/roles/phoenixd/defaults/main.yml index ea9c889..9fea220 100644 --- a/ansible/roles/phoenixd/defaults/main.yml +++ b/ansible/roles/phoenixd/defaults/main.yml @@ -35,7 +35,6 @@ phoenixd_http_bind_port: 9740 # Optional webhook for payment events. Leave empty to disable. phoenixd_webhook_url: "" -phoenixd_monitor_name: "Phoenixd" diff --git a/ansible/services/bitcoin-knots/deploy_bitcoin_knots_playbook.yml b/ansible/services/bitcoin-knots/deploy_bitcoin_knots_playbook.yml index bc073bd..709cb30 100644 --- a/ansible/services/bitcoin-knots/deploy_bitcoin_knots_playbook.yml +++ b/ansible/services/bitcoin-knots/deploy_bitcoin_knots_playbook.yml @@ -10,9 +10,7 @@ hosts: bitcoin become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml vars: # Preserves the push URL this check has been reporting to. The role knows # nothing about Uptime Kuma — this is just "a URL that accepts a ping". @@ -24,7 +22,6 @@ hosts: edge become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml tasks: - name: Expose Bitcoin P2P through a socket proxy @@ -34,7 +31,7 @@ socket_proxy_name: bitcoin-p2p socket_proxy_description: "Bitcoin P2P" socket_proxy_listen_port: "{{ service_settings.bitcoin.p2p_port }}" - socket_proxy_upstream_host: "{{ service_settings.bitcoin.tailscale_hostname }}" + socket_proxy_upstream_host: "{{ hostvars['knots_box_local'].ansible_host }}" socket_proxy_documentation: "https://github.com/bitcoin/bitcoin" socket_proxy_free_bind: true socket_proxy_timeout_stop_sec: 5 diff --git a/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml b/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml index 371f3fa..ebb9633 100644 --- a/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml +++ b/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml @@ -11,9 +11,7 @@ hosts: bitcoin become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml vars: # Preserves the push URL this check reports to. The role knows nothing about # Uptime Kuma — this is just "a URL that accepts a ping". @@ -25,9 +23,7 @@ hosts: edge become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml tasks: - name: Publish the DATUM Gateway dashboard through Caddy ansible.builtin.include_role: @@ -35,7 +31,7 @@ vars: caddy_site_name: datum-gateway caddy_site_domain: "{{ subdomains.datum_gateway }}.{{ root_domain }}" - caddy_site_upstream: "{{ service_settings.datum_gateway.tailscale_hostname }}:{{ service_settings.datum_gateway.api_port }}" + caddy_site_upstream: "{{ hostvars['knots_box_local'].ansible_host }}:{{ service_settings.datum_gateway.api_port }}" caddy_site_resolvers: "100.100.100.100" caddy_site_basic_auth: - user: "{{ datum_dashboard_username }}" @@ -52,7 +48,6 @@ hosts: edge become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml tasks: - name: Expose the DATUM Stratum port through a socket proxy @@ -62,7 +57,7 @@ socket_proxy_name: datum-stratum socket_proxy_description: "DATUM Stratum" socket_proxy_listen_port: "{{ service_settings.datum_gateway.stratum_port }}" - socket_proxy_upstream_host: "{{ service_settings.datum_gateway.tailscale_hostname }}" + socket_proxy_upstream_host: "{{ hostvars['knots_box_local'].ansible_host }}" # Matches the UFW comment already on the edge host; the derived default # would say "DATUM Stratum" and rewrite the rule. socket_proxy_ufw_comment: "DATUM Gateway Stratum public access" diff --git a/ansible/services/forgejo-runner/deploy_forgejo_runner_playbook.yml b/ansible/services/forgejo-runner/deploy_forgejo_runner_playbook.yml index 446cdff..9195087 100644 --- a/ansible/services/forgejo-runner/deploy_forgejo_runner_playbook.yml +++ b/ansible/services/forgejo-runner/deploy_forgejo_runner_playbook.yml @@ -3,9 +3,7 @@ hosts: ci_runner become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml vars: # Preserves the push URL this host has been reporting to all along, so the # move to a role changes no behaviour. The role itself knows nothing about diff --git a/ansible/services/forgejo/deploy_forgejo_playbook.yml b/ansible/services/forgejo/deploy_forgejo_playbook.yml index db78e95..a929d42 100644 --- a/ansible/services/forgejo/deploy_forgejo_playbook.yml +++ b/ansible/services/forgejo/deploy_forgejo_playbook.yml @@ -2,9 +2,7 @@ hosts: edge become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml - ./forgejo_vars.yml vars: forgejo_subdomain: "{{ subdomains.forgejo }}" diff --git a/ansible/services/forgejo/forgejo_vars.yml b/ansible/services/forgejo/forgejo_vars.yml index 9fb4cc9..7bba0ed 100644 --- a/ansible/services/forgejo/forgejo_vars.yml +++ b/ansible/services/forgejo/forgejo_vars.yml @@ -9,7 +9,7 @@ forgejo_url: "https://codeberg.org/forgejo/forgejo/releases/download/v{{ forgejo forgejo_bin_path: "/usr/local/bin/forgejo" forgejo_user: "git" -# (caddy_sites_dir and subdomain now in services_config.yml) +# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/) # Remote access remote_host_name: "{{ groups['edge'] | first }}" diff --git a/ansible/services/forgejo/setup_backup_forgejo.yml b/ansible/services/forgejo/setup_backup_forgejo.yml index d6aafef..ee1769b 100644 --- a/ansible/services/forgejo/setup_backup_forgejo.yml +++ b/ansible/services/forgejo/setup_backup_forgejo.yml @@ -9,7 +9,6 @@ hosts: edge become: yes vars_files: - - ../../group_vars/all/main.yml - ./forgejo_vars.yml tasks: diff --git a/ansible/services/fulcrum/deploy_fulcrum_playbook.yml b/ansible/services/fulcrum/deploy_fulcrum_playbook.yml index 6f5c55f..6b8e207 100644 --- a/ansible/services/fulcrum/deploy_fulcrum_playbook.yml +++ b/ansible/services/fulcrum/deploy_fulcrum_playbook.yml @@ -6,9 +6,7 @@ hosts: electrum become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml vars: # Preserves the push URL this check has been configured with. The role knows # nothing about Uptime Kuma — this is just "a URL that accepts a ping". @@ -20,7 +18,6 @@ hosts: edge become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml tasks: - name: Expose Fulcrum SSL through a socket proxy @@ -30,4 +27,4 @@ socket_proxy_name: fulcrum-ssl socket_proxy_description: "Fulcrum SSL" socket_proxy_listen_port: "{{ service_settings.fulcrum.ssl_port }}" - socket_proxy_upstream_host: "{{ service_settings.fulcrum.tailscale_hostname }}" + socket_proxy_upstream_host: "{{ hostvars['fulcrum_box_local'].ansible_host }}" diff --git a/ansible/services/headscale/deploy_headscale_playbook.yml b/ansible/services/headscale/deploy_headscale_playbook.yml index 527e4c2..4308b1e 100644 --- a/ansible/services/headscale/deploy_headscale_playbook.yml +++ b/ansible/services/headscale/deploy_headscale_playbook.yml @@ -2,15 +2,12 @@ hosts: vpn_control become: no vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml - ./headscale_vars.yml vars: headscale_subdomain: "{{ subdomains.headscale }}" headscale_domain: "{{ headscale_subdomain }}.{{ root_domain }}" headscale_base_domain: "tailnet.{{ root_domain }}" - headscale_namespace: "{{ service_settings.headscale.namespace }}" uptime_kuma_api_url: "https://{{ subdomains.uptime_kuma }}.{{ root_domain }}" tasks: diff --git a/ansible/services/headscale/headscale_vars.yml b/ansible/services/headscale/headscale_vars.yml index ab12a82..c3fb948 100644 --- a/ansible/services/headscale/headscale_vars.yml +++ b/ansible/services/headscale/headscale_vars.yml @@ -1,5 +1,5 @@ # Headscale service configuration -# (subdomain and caddy_sites_dir now in services_config.yml) +# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/) headscale_port: 8080 headscale_grpc_port: 50443 @@ -10,7 +10,7 @@ headscale_version: "0.26.1" # Data directory headscale_data_dir: /var/lib/headscale -# Namespace now configured in services_config.yml under service_settings.headscale.namespace +# Namespace is headscale_namespace in group_vars/all/main.yml # Remote access remote_host_name: "{{ groups['vpn_control'] | first }}" diff --git a/ansible/services/headscale/setup_backup_headscale.yml b/ansible/services/headscale/setup_backup_headscale.yml index 9c72d1d..5ae3ad1 100644 --- a/ansible/services/headscale/setup_backup_headscale.yml +++ b/ansible/services/headscale/setup_backup_headscale.yml @@ -3,7 +3,6 @@ hosts: vpn_control become: yes vars_files: - - ../../group_vars/all/main.yml - ./headscale_vars.yml tasks: diff --git a/ansible/services/lnbits/deploy_lnbits_playbook.yml b/ansible/services/lnbits/deploy_lnbits_playbook.yml index 65bdfbf..3aa7a95 100644 --- a/ansible/services/lnbits/deploy_lnbits_playbook.yml +++ b/ansible/services/lnbits/deploy_lnbits_playbook.yml @@ -2,9 +2,7 @@ hosts: edge become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml - ./lnbits_vars.yml vars: lnbits_subdomain: "{{ subdomains.lnbits }}" diff --git a/ansible/services/lnbits/lnbits_vars.yml b/ansible/services/lnbits/lnbits_vars.yml index e855d57..466ce78 100644 --- a/ansible/services/lnbits/lnbits_vars.yml +++ b/ansible/services/lnbits/lnbits_vars.yml @@ -3,7 +3,7 @@ lnbits_dir: /opt/lnbits lnbits_data_dir: "{{ lnbits_dir }}/data" lnbits_port: 8765 -# (caddy_sites_dir and subdomain now in services_config.yml) +# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/) # Remote access remote_host_name: "{{ groups['edge'] | first }}" diff --git a/ansible/services/lnbits/setup_backup_lnbits.yml b/ansible/services/lnbits/setup_backup_lnbits.yml index 46abf31..0c45b29 100644 --- a/ansible/services/lnbits/setup_backup_lnbits.yml +++ b/ansible/services/lnbits/setup_backup_lnbits.yml @@ -9,7 +9,6 @@ hosts: edge become: yes vars_files: - - ../../group_vars/all/main.yml - ./lnbits_vars.yml tasks: diff --git a/ansible/services/memos/deploy_memos_playbook.yml b/ansible/services/memos/deploy_memos_playbook.yml index 04e99cf..e078d84 100644 --- a/ansible/services/memos/deploy_memos_playbook.yml +++ b/ansible/services/memos/deploy_memos_playbook.yml @@ -2,9 +2,7 @@ hosts: memos become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml - ./memos_vars.yml vars: memos_subdomain: "{{ subdomains.memos }}" @@ -160,9 +158,7 @@ hosts: edge become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml - ./memos_vars.yml vars: memos_subdomain: "{{ subdomains.memos }}" diff --git a/ansible/services/memos/memos_vars.yml b/ansible/services/memos/memos_vars.yml index e1c42a3..94c6de7 100644 --- a/ansible/services/memos/memos_vars.yml +++ b/ansible/services/memos/memos_vars.yml @@ -12,7 +12,7 @@ memos_url: "https://github.com/usememos/memos/releases/download/v{{ memos_versio memos_tailscale_hostname: "memos-box" memos_tailscale_ip: "100.64.0.4" -# (caddy_sites_dir and subdomain in services_config.yml) +# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/) # Remote access (for backup from lapy via Tailscale) diff --git a/ansible/services/memos/setup_backup_memos.yml b/ansible/services/memos/setup_backup_memos.yml index 2131924..36b8cf6 100644 --- a/ansible/services/memos/setup_backup_memos.yml +++ b/ansible/services/memos/setup_backup_memos.yml @@ -7,7 +7,6 @@ hosts: memos become: yes vars_files: - - ../../group_vars/all/main.yml - ./memos_vars.yml tasks: diff --git a/ansible/services/mempool/deploy_mempool_playbook.yml b/ansible/services/mempool/deploy_mempool_playbook.yml index 0766da0..c2c8f4f 100644 --- a/ansible/services/mempool/deploy_mempool_playbook.yml +++ b/ansible/services/mempool/deploy_mempool_playbook.yml @@ -3,9 +3,7 @@ hosts: mempool become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml vars: # Preserves the three push URLs these checks have been reporting to all # along, so the move to a role changes no behaviour. The role knows nothing @@ -22,7 +20,6 @@ hosts: edge become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml vars: mempool_domain: "{{ subdomains.mempool }}.{{ root_domain }}" diff --git a/ansible/services/ntfy-emergency-app/deploy_ntfy_emergency_app_playbook.yml b/ansible/services/ntfy-emergency-app/deploy_ntfy_emergency_app_playbook.yml index 7379d5f..1b53732 100644 --- a/ansible/services/ntfy-emergency-app/deploy_ntfy_emergency_app_playbook.yml +++ b/ansible/services/ntfy-emergency-app/deploy_ntfy_emergency_app_playbook.yml @@ -2,8 +2,6 @@ hosts: edge become: yes vars_files: - - ../../infra_vars.yml - - ../../infra_secrets.yml - ../../services_config.yml - ./ntfy_emergency_app_vars.yml vars: diff --git a/ansible/services/ntfy-emergency-app/ntfy_emergency_app_vars.yml b/ansible/services/ntfy-emergency-app/ntfy_emergency_app_vars.yml index a3bb480..59ae5d6 100644 --- a/ansible/services/ntfy-emergency-app/ntfy_emergency_app_vars.yml +++ b/ansible/services/ntfy-emergency-app/ntfy_emergency_app_vars.yml @@ -2,7 +2,7 @@ ntfy_emergency_app_dir: /opt/ntfy-emergency-app ntfy_emergency_app_port: 3000 -# (caddy_sites_dir and subdomain now in services_config.yml) +# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/) # ntfy configuration ntfy_emergency_app_topic: "emergencia" diff --git a/ansible/services/ntfy/deploy_ntfy_playbook.yml b/ansible/services/ntfy/deploy_ntfy_playbook.yml index 61fafe1..d6253b5 100644 --- a/ansible/services/ntfy/deploy_ntfy_playbook.yml +++ b/ansible/services/ntfy/deploy_ntfy_playbook.yml @@ -2,8 +2,6 @@ hosts: monitoring become: yes vars_files: - - ../../infra_vars.yml - - ../../infra_secrets.yml - ../../services_config.yml - ./ntfy_vars.yml vars: diff --git a/ansible/services/ntfy/ntfy_vars.yml b/ansible/services/ntfy/ntfy_vars.yml index 5ebec37..ba51792 100644 --- a/ansible/services/ntfy/ntfy_vars.yml +++ b/ansible/services/ntfy/ntfy_vars.yml @@ -1,3 +1,3 @@ ntfy_port: 6674 -# ntfy_topic now lives in services_config.yml under service_settings.ntfy.topic \ No newline at end of file +# ntfy_topic lives in group_vars/all/main.yml \ No newline at end of file diff --git a/ansible/services/ntfy/setup_ntfy_uptime_kuma_notification.yml b/ansible/services/ntfy/setup_ntfy_uptime_kuma_notification.yml index 2d3d22a..861bfa5 100644 --- a/ansible/services/ntfy/setup_ntfy_uptime_kuma_notification.yml +++ b/ansible/services/ntfy/setup_ntfy_uptime_kuma_notification.yml @@ -15,14 +15,11 @@ hosts: monitoring become: no vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml - ./ntfy_vars.yml vars: ntfy_subdomain: "{{ subdomains.ntfy }}" - ntfy_topic: "{{ service_settings.ntfy.topic }}" uptime_kuma_subdomain: "{{ subdomains.uptime_kuma }}" ntfy_domain: "{{ ntfy_subdomain }}.{{ root_domain }}" ntfy_server_url: "https://{{ ntfy_domain }}" diff --git a/ansible/services/personal-blog/deploy_personal_blog_playbook.yml b/ansible/services/personal-blog/deploy_personal_blog_playbook.yml index 96d030f..968f423 100644 --- a/ansible/services/personal-blog/deploy_personal_blog_playbook.yml +++ b/ansible/services/personal-blog/deploy_personal_blog_playbook.yml @@ -2,9 +2,7 @@ hosts: edge become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml - ./personal_blog_vars.yml vars: personal_blog_subdomain: "{{ subdomains.personal_blog }}" diff --git a/ansible/services/personal-blog/setup_deploy_alias_lapy.yml b/ansible/services/personal-blog/setup_deploy_alias_lapy.yml index 99f9b34..bd9b715 100644 --- a/ansible/services/personal-blog/setup_deploy_alias_lapy.yml +++ b/ansible/services/personal-blog/setup_deploy_alias_lapy.yml @@ -2,7 +2,6 @@ hosts: control gather_facts: no vars_files: - - ../../infra_vars.yml - ./personal_blog_vars.yml vars: bashrc_path: "{{ lookup('env', 'HOME') }}/.bashrc" diff --git a/ansible/services/phoenixd/deploy_phoenixd_playbook.yml b/ansible/services/phoenixd/deploy_phoenixd_playbook.yml index 1e53ff0..45bea3c 100644 --- a/ansible/services/phoenixd/deploy_phoenixd_playbook.yml +++ b/ansible/services/phoenixd/deploy_phoenixd_playbook.yml @@ -5,9 +5,7 @@ hosts: edge become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml vars: # phoenixd's health check has never reported anywhere since the Uptime Kuma # decommissioning — its systemd Environment= was left empty. Leaving it empty diff --git a/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml b/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml index 74e87d8..987fe27 100644 --- a/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml +++ b/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml @@ -2,9 +2,7 @@ hosts: edge become: yes vars_files: - - ../../infra_vars.yml - ../../services_config.yml - - ../../infra_secrets.yml - ./vaultwarden_vars.yml vars: vaultwarden_subdomain: "{{ subdomains.vaultwarden }}" diff --git a/ansible/services/vaultwarden/disable_vaultwarden_sign_ups_playbook.yml b/ansible/services/vaultwarden/disable_vaultwarden_sign_ups_playbook.yml index eebb214..bccc2cd 100644 --- a/ansible/services/vaultwarden/disable_vaultwarden_sign_ups_playbook.yml +++ b/ansible/services/vaultwarden/disable_vaultwarden_sign_ups_playbook.yml @@ -2,7 +2,6 @@ hosts: edge become: yes vars_files: - - ../../infra_vars.yml - ./vaultwarden_vars.yml tasks: diff --git a/ansible/services/vaultwarden/setup_backup_vaultwarden.yml b/ansible/services/vaultwarden/setup_backup_vaultwarden.yml index 8430475..54fe147 100644 --- a/ansible/services/vaultwarden/setup_backup_vaultwarden.yml +++ b/ansible/services/vaultwarden/setup_backup_vaultwarden.yml @@ -6,7 +6,6 @@ hosts: edge become: yes vars_files: - - ../../group_vars/all/main.yml - ./vaultwarden_vars.yml tasks: diff --git a/ansible/services/vaultwarden/vaultwarden_vars.yml b/ansible/services/vaultwarden/vaultwarden_vars.yml index 0605d27..9edc2cd 100644 --- a/ansible/services/vaultwarden/vaultwarden_vars.yml +++ b/ansible/services/vaultwarden/vaultwarden_vars.yml @@ -3,7 +3,7 @@ vaultwarden_dir: /opt/vaultwarden vaultwarden_data_dir: "{{ vaultwarden_dir }}/data" vaultwarden_port: 8222 -# (caddy_sites_dir and subdomain now in services_config.yml) +# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/) # Remote access remote_host_name: "{{ groups['edge'] | first }}" diff --git a/ansible/services_config.yml b/ansible/services_config.yml index a6dc9c6..531b824 100644 --- a/ansible/services_config.yml +++ b/ansible/services_config.yml @@ -1,67 +1,24 @@ -# Centralized Services Configuration -# Subdomains and Caddy settings for all services - -# Edit these subdomains to match your preferences -subdomains: - # Monitoring Services (on watchtower) - ntfy: ntfy - # DEPRECATED 2026-09-11 — Uptime Kuma is decommissioned and this subdomain no - # longer resolves to anything. Kept only because the deprecated monitoring - # blocks still template it into uptime_kuma_api_url. See archive/uptime_kuma/. - uptime_kuma: uptime - - # VPN Infrastructure (on spacey) - headscale: headscale - - # Core Services (on vipy) - vaultwarden: vault - forgejo: forgejo - lnbits: wallet - - # Secondary Services (on vipy) - ntfy_emergency_app: avisame - personal_blog: pablohere - - # Memos (on memos-box) - memos: memos - - # Mempool Block Explorer (on mempool_box, proxied via vipy) - mempool: mempool - - # DATUM Gateway dashboard (on knots_box, proxied via vipy) - datum_gateway: datum - -# Caddy configuration -caddy_sites_dir: /etc/caddy/sites-enabled - -# Service-specific settings shared across playbooks +# Cross-host service settings. +# +# These exist because a value is needed by the service's own role on one host +# AND by a play that runs on the edge host. A role default is invisible to that +# second play, so it cannot live in roles//defaults/. +# +# Everything else that used to be here has moved: +# subdomains, ntfy topic, headscale namespace -> group_vars/all/main.yml +# caddy_sites_dir -> roles/caddy_site/defaults/ +# *.tailscale_hostname -> deleted; inventory already +# holds each box's identity as ansible_host, and an edge play reads it with +# hostvars[''].ansible_host. Three copies of one name is how +# bitcoin_rpc_host ended up labelled "knots_box" while pointing at +# fulcrum-box. service_settings: - ntfy: - topic: alerts - headscale: - namespace: counter-net mempool: - # The frontend port is needed in two places on two different hosts: the - # mempool role deploys it on mempool-box, and the Caddy play proxies to it - # from the edge host. A role default cannot serve the second play, so it - # lives here rather than in roles/mempool/defaults. frontend_port: 8080 bitcoin: - # The P2P port is needed on two hosts: the bitcoin_knots role deploys the - # node on knots-box, and the socket-proxy play publishes the port from the - # edge host. A role default cannot reach that second play. p2p_port: 8333 - tailscale_hostname: knots-box datum_gateway: - # Needed on two hosts: the datum_gateway role deploys on knots-box, while the - # Caddy play (dashboard) and the socket-proxy play (Stratum) both run on the - # edge host. A role default cannot reach either of those plays. api_port: 7152 stratum_port: 23334 - tailscale_hostname: knots-box fulcrum: - # Same shape as mempool: the fulcrum role deploys on fulcrum-box, and the - # socket-proxy play publishes the SSL port from the edge host. A role default - # is invisible to that second play. ssl_port: 50002 - tailscale_hostname: fulcrum-box