ansible: delete the duplicated vars files, move globals to group_vars/all

Three files existed only as second copies of things group_vars/all already auto-loads, and 34 playbooks named them in vars_files: - which outranks group_vars, so the copies won. The day someone edited one and not the other, those plays would silently keep the stale value. infra_vars.yml was already drifting: group_vars/all/main.yml had grown age_backup_recipient and backup_pull_public_key that it lacked. infra_vars.yml - a strict subset of group_vars/all/main.yml infra_secrets.yml - decrypts byte-identical to group_vars/all/vault.yml infra_secrets.yml.example - documented Uptime Kuma credentials as the reason the file exists, which stopped being true Deleted, along with 62 vars_files entries across 34 playbooks (12 of which named ../../group_vars/all/main.yml directly - same defect, a vars_files entry duplicating an auto-loaded file at higher precedence than the file itself). Checked before touching anything: infra_secrets.yml was listed LAST in 10 plays, after services_config.yml, so removal would flip precedence if the two shared a key. They share none, and neither does services_config.yml with group_vars/all/main.yml, so the removal is provably inert. services_config.yml was the last one standing. It held four unrelated things: caddy_sites_dir - an identical copy of roles/caddy_site/defaults/. Deleted; the role default is now the only one. *.tailscale_hostname (x3) - a THIRD copy of each box's identity, which inventory.ini already holds as ansible_host. Deleted. Edge plays now read hostvars['<host>'].ansible_host - verified an edge play resolves that with nothing loaded and the other host in no play. Three copies of one name is how bitcoin_rpc_host ended up labelled "knots_box" while pointing at fulcrum-box. subdomains, ntfy topic, - genuinely global: their readers span managed, headscale namespace monitoring, vpn_control and edge, so no single group covers them. Moved to group_vars/all/main.yml where they auto-load. The ntfy_topic and headscale_namespace indirection through service_settings collapses to the global name. the four cross-host ports - the only entries with a real justification. Left in place; they move in the next commit. Also dead, all Uptime Kuma residue or duplication: phoenixd_monitor_name, forgejo_runner healthcheck_timeout_seconds/retries, fulcrum_tailscale_hostname, and bitcoin_knots_version - the last being a v-prefixed copy of bitcoin_knots_version_short that nothing read, two hand-maintained copies of one version string. Corrected a false comment: services_config.yml claimed the uptime_kuma subdomain "no longer resolves to anything". It resolves to 164.92.239.72 and answers HTTP 302, and 11 playbooks still template it. Same wrong premise as PLAN_3. Verification: all 37 playbooks' --list-tasks output is byte-identical before and after. A probe resolving all 22 values services_config.yml used to supply returns 21 identical and one intended deletion (caddy_sites_dir, now role-only - confirmed the role still resolves it: "Ensure Caddy sites-enabled directory exists" comes back ok against the real path). memos check-diff identical before and after. Syntax passes on every playbook. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-13 20:58:46 +02:00 · 2026-09-13 20:58:46 +02:00 · 954b683c71
commit 954b683c71
parent 0f03c503c8
53 changed files with 82 additions and 403 deletions
--- a/ansible/services/bitcoin-knots/deploy_bitcoin_knots_playbook.yml
+++ b/ansible/services/bitcoin-knots/deploy_bitcoin_knots_playbook.yml
@ -10,9 +10,7 @@
  hosts: bitcoin
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
  vars:
    # Preserves the push URL this check has been reporting to. The role knows
    # nothing about Uptime Kuma — this is just "a URL that accepts a ping".
@ -24,7 +22,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
  tasks:
    - name: Expose Bitcoin P2P through a socket proxy
@ -34,7 +31,7 @@
        socket_proxy_name: bitcoin-p2p
        socket_proxy_description: "Bitcoin P2P"
        socket_proxy_listen_port: "{{ service_settings.bitcoin.p2p_port }}"
-        socket_proxy_upstream_host: "{{ service_settings.bitcoin.tailscale_hostname }}"
+        socket_proxy_upstream_host: "{{ hostvars['knots_box_local'].ansible_host }}"
        socket_proxy_documentation: "https://github.com/bitcoin/bitcoin"
        socket_proxy_free_bind: true
        socket_proxy_timeout_stop_sec: 5
--- a/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml
+++ b/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml
@ -11,9 +11,7 @@
  hosts: bitcoin
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
  vars:
    # Preserves the push URL this check reports to. The role knows nothing about
    # Uptime Kuma — this is just "a URL that accepts a ping".
@ -25,9 +23,7 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
  tasks:
    - name: Publish the DATUM Gateway dashboard through Caddy
      ansible.builtin.include_role:
@ -35,7 +31,7 @@
      vars:
        caddy_site_name: datum-gateway
        caddy_site_domain: "{{ subdomains.datum_gateway }}.{{ root_domain }}"
-        caddy_site_upstream: "{{ service_settings.datum_gateway.tailscale_hostname }}:{{ service_settings.datum_gateway.api_port }}"
+        caddy_site_upstream: "{{ hostvars['knots_box_local'].ansible_host }}:{{ service_settings.datum_gateway.api_port }}"
        caddy_site_resolvers: "100.100.100.100"
        caddy_site_basic_auth:
          - user: "{{ datum_dashboard_username }}"
@ -52,7 +48,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
  tasks:
    - name: Expose the DATUM Stratum port through a socket proxy
@ -62,7 +57,7 @@
        socket_proxy_name: datum-stratum
        socket_proxy_description: "DATUM Stratum"
        socket_proxy_listen_port: "{{ service_settings.datum_gateway.stratum_port }}"
-        socket_proxy_upstream_host: "{{ service_settings.datum_gateway.tailscale_hostname }}"
+        socket_proxy_upstream_host: "{{ hostvars['knots_box_local'].ansible_host }}"
        # Matches the UFW comment already on the edge host; the derived default
        # would say "DATUM Stratum" and rewrite the rule.
        socket_proxy_ufw_comment: "DATUM Gateway Stratum public access"
--- a/ansible/services/forgejo-runner/deploy_forgejo_runner_playbook.yml
+++ b/ansible/services/forgejo-runner/deploy_forgejo_runner_playbook.yml
@ -3,9 +3,7 @@
  hosts: ci_runner
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
  vars:
    # Preserves the push URL this host has been reporting to all along, so the
    # move to a role changes no behaviour. The role itself knows nothing about
--- a/ansible/services/forgejo/deploy_forgejo_playbook.yml
+++ b/ansible/services/forgejo/deploy_forgejo_playbook.yml
@ -2,9 +2,7 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./forgejo_vars.yml
  vars:
    forgejo_subdomain: "{{ subdomains.forgejo }}"
--- a/ansible/services/forgejo/forgejo_vars.yml
+++ b/ansible/services/forgejo/forgejo_vars.yml
@ -9,7 +9,7 @@ forgejo_url: "https://codeberg.org/forgejo/forgejo/releases/download/v{{ forgejo
 forgejo_bin_path: "/usr/local/bin/forgejo"
 forgejo_user: "git"

-# (caddy_sites_dir and subdomain now in services_config.yml)
+# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)

 # Remote access
 remote_host_name: "{{ groups['edge'] | first }}"
--- a/ansible/services/forgejo/setup_backup_forgejo.yml
+++ b/ansible/services/forgejo/setup_backup_forgejo.yml
@ -9,7 +9,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../group_vars/all/main.yml
    - ./forgejo_vars.yml

  tasks:
--- a/ansible/services/fulcrum/deploy_fulcrum_playbook.yml
+++ b/ansible/services/fulcrum/deploy_fulcrum_playbook.yml
@ -6,9 +6,7 @@
  hosts: electrum
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
  vars:
    # Preserves the push URL this check has been configured with. The role knows
    # nothing about Uptime Kuma — this is just "a URL that accepts a ping".
@ -20,7 +18,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
  tasks:
    - name: Expose Fulcrum SSL through a socket proxy
@ -30,4 +27,4 @@
        socket_proxy_name: fulcrum-ssl
        socket_proxy_description: "Fulcrum SSL"
        socket_proxy_listen_port: "{{ service_settings.fulcrum.ssl_port }}"
-        socket_proxy_upstream_host: "{{ service_settings.fulcrum.tailscale_hostname }}"
+        socket_proxy_upstream_host: "{{ hostvars['fulcrum_box_local'].ansible_host }}"
--- a/ansible/services/headscale/deploy_headscale_playbook.yml
+++ b/ansible/services/headscale/deploy_headscale_playbook.yml
@ -2,15 +2,12 @@
  hosts: vpn_control
  become: no
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./headscale_vars.yml
  vars:
    headscale_subdomain: "{{ subdomains.headscale }}"
    headscale_domain: "{{ headscale_subdomain }}.{{ root_domain }}"
    headscale_base_domain: "tailnet.{{ root_domain }}"
-    headscale_namespace: "{{ service_settings.headscale.namespace }}"
    uptime_kuma_api_url: "https://{{ subdomains.uptime_kuma }}.{{ root_domain }}"

  tasks:
--- a/ansible/services/headscale/headscale_vars.yml
+++ b/ansible/services/headscale/headscale_vars.yml
@ -1,5 +1,5 @@
 # Headscale service configuration
-# (subdomain and caddy_sites_dir now in services_config.yml)
+# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)

 headscale_port: 8080
 headscale_grpc_port: 50443
@ -10,7 +10,7 @@ headscale_version: "0.26.1"
 # Data directory
 headscale_data_dir: /var/lib/headscale

-# Namespace now configured in services_config.yml under service_settings.headscale.namespace
+# Namespace is headscale_namespace in group_vars/all/main.yml

 # Remote access
 remote_host_name: "{{ groups['vpn_control'] | first }}"
--- a/ansible/services/headscale/setup_backup_headscale.yml
+++ b/ansible/services/headscale/setup_backup_headscale.yml
@ -3,7 +3,6 @@
  hosts: vpn_control
  become: yes
  vars_files:
-    - ../../group_vars/all/main.yml
    - ./headscale_vars.yml

  tasks:
--- a/ansible/services/lnbits/deploy_lnbits_playbook.yml
+++ b/ansible/services/lnbits/deploy_lnbits_playbook.yml
@ -2,9 +2,7 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./lnbits_vars.yml
  vars:
    lnbits_subdomain: "{{ subdomains.lnbits }}"
--- a/ansible/services/lnbits/lnbits_vars.yml
+++ b/ansible/services/lnbits/lnbits_vars.yml
@ -3,7 +3,7 @@ lnbits_dir: /opt/lnbits
 lnbits_data_dir: "{{ lnbits_dir }}/data"
 lnbits_port: 8765

-# (caddy_sites_dir and subdomain now in services_config.yml)
+# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)

 # Remote access
 remote_host_name: "{{ groups['edge'] | first }}"
--- a/ansible/services/lnbits/setup_backup_lnbits.yml
+++ b/ansible/services/lnbits/setup_backup_lnbits.yml
@ -9,7 +9,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../group_vars/all/main.yml
    - ./lnbits_vars.yml

  tasks:
--- a/ansible/services/memos/deploy_memos_playbook.yml
+++ b/ansible/services/memos/deploy_memos_playbook.yml
@ -2,9 +2,7 @@
  hosts: memos
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./memos_vars.yml
  vars:
    memos_subdomain: "{{ subdomains.memos }}"
@ -160,9 +158,7 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./memos_vars.yml
  vars:
    memos_subdomain: "{{ subdomains.memos }}"
--- a/ansible/services/memos/memos_vars.yml
+++ b/ansible/services/memos/memos_vars.yml
@ -12,7 +12,7 @@ memos_url: "https://github.com/usememos/memos/releases/download/v{{ memos_versio
 memos_tailscale_hostname: "memos-box"
 memos_tailscale_ip: "100.64.0.4"

-# (caddy_sites_dir and subdomain in services_config.yml)
+# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)

 # Remote access (for backup from lapy via Tailscale)

--- a/ansible/services/memos/setup_backup_memos.yml
+++ b/ansible/services/memos/setup_backup_memos.yml
@ -7,7 +7,6 @@
  hosts: memos
  become: yes
  vars_files:
-    - ../../group_vars/all/main.yml
    - ./memos_vars.yml

  tasks:
--- a/ansible/services/mempool/deploy_mempool_playbook.yml
+++ b/ansible/services/mempool/deploy_mempool_playbook.yml
@ -3,9 +3,7 @@
  hosts: mempool
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
  vars:
    # Preserves the three push URLs these checks have been reporting to all
    # along, so the move to a role changes no behaviour. The role knows nothing
@ -22,7 +20,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
  vars:
    mempool_domain: "{{ subdomains.mempool }}.{{ root_domain }}"
--- a/ansible/services/ntfy-emergency-app/deploy_ntfy_emergency_app_playbook.yml
+++ b/ansible/services/ntfy-emergency-app/deploy_ntfy_emergency_app_playbook.yml
@ -2,8 +2,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
-    - ../../infra_secrets.yml
    - ../../services_config.yml
    - ./ntfy_emergency_app_vars.yml
  vars:
--- a/ansible/services/ntfy-emergency-app/ntfy_emergency_app_vars.yml
+++ b/ansible/services/ntfy-emergency-app/ntfy_emergency_app_vars.yml
@ -2,7 +2,7 @@
 ntfy_emergency_app_dir: /opt/ntfy-emergency-app
 ntfy_emergency_app_port: 3000

-# (caddy_sites_dir and subdomain now in services_config.yml)
+# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)

 # ntfy configuration
 ntfy_emergency_app_topic: "emergencia"
--- a/ansible/services/ntfy/deploy_ntfy_playbook.yml
+++ b/ansible/services/ntfy/deploy_ntfy_playbook.yml
@ -2,8 +2,6 @@
  hosts: monitoring
  become: yes
  vars_files:
-    - ../../infra_vars.yml
-    - ../../infra_secrets.yml
    - ../../services_config.yml
    - ./ntfy_vars.yml
  vars:
--- a/ansible/services/ntfy/ntfy_vars.yml
+++ b/ansible/services/ntfy/ntfy_vars.yml
@ -1,3 +1,3 @@
 ntfy_port: 6674

-# ntfy_topic now lives in services_config.yml under service_settings.ntfy.topic
+# ntfy_topic lives in group_vars/all/main.yml
--- a/ansible/services/ntfy/setup_ntfy_uptime_kuma_notification.yml
+++ b/ansible/services/ntfy/setup_ntfy_uptime_kuma_notification.yml
@ -15,14 +15,11 @@
  hosts: monitoring
  become: no
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./ntfy_vars.yml

  vars:
    ntfy_subdomain: "{{ subdomains.ntfy }}"
-    ntfy_topic: "{{ service_settings.ntfy.topic }}"
    uptime_kuma_subdomain: "{{ subdomains.uptime_kuma }}"
    ntfy_domain: "{{ ntfy_subdomain }}.{{ root_domain }}"
    ntfy_server_url: "https://{{ ntfy_domain }}"
--- a/ansible/services/personal-blog/deploy_personal_blog_playbook.yml
+++ b/ansible/services/personal-blog/deploy_personal_blog_playbook.yml
@ -2,9 +2,7 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./personal_blog_vars.yml
  vars:
    personal_blog_subdomain: "{{ subdomains.personal_blog }}"
--- a/ansible/services/personal-blog/setup_deploy_alias_lapy.yml
+++ b/ansible/services/personal-blog/setup_deploy_alias_lapy.yml
@ -2,7 +2,6 @@
  hosts: control
  gather_facts: no
  vars_files:
-    - ../../infra_vars.yml
    - ./personal_blog_vars.yml
  vars:
    bashrc_path: "{{ lookup('env', 'HOME') }}/.bashrc"
--- a/ansible/services/phoenixd/deploy_phoenixd_playbook.yml
+++ b/ansible/services/phoenixd/deploy_phoenixd_playbook.yml
@ -5,9 +5,7 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
  vars:
    # phoenixd's health check has never reported anywhere since the Uptime Kuma
    # decommissioning — its systemd Environment= was left empty. Leaving it empty
--- a/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml
+++ b/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml
@ -2,9 +2,7 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./vaultwarden_vars.yml
  vars:
    vaultwarden_subdomain: "{{ subdomains.vaultwarden }}"
--- a/ansible/services/vaultwarden/disable_vaultwarden_sign_ups_playbook.yml
+++ b/ansible/services/vaultwarden/disable_vaultwarden_sign_ups_playbook.yml
@ -2,7 +2,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ./vaultwarden_vars.yml

  tasks:
--- a/ansible/services/vaultwarden/setup_backup_vaultwarden.yml
+++ b/ansible/services/vaultwarden/setup_backup_vaultwarden.yml
@ -6,7 +6,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../group_vars/all/main.yml
    - ./vaultwarden_vars.yml

  tasks:
--- a/ansible/services/vaultwarden/vaultwarden_vars.yml
+++ b/ansible/services/vaultwarden/vaultwarden_vars.yml
@ -3,7 +3,7 @@ vaultwarden_dir: /opt/vaultwarden
 vaultwarden_data_dir: "{{ vaultwarden_dir }}/data"
 vaultwarden_port: 8222

-# (caddy_sites_dir and subdomain now in services_config.yml)
+# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)

 # Remote access
 remote_host_name: "{{ groups['edge'] | first }}"