diff --git a/ansible/host_vars/monitoring/main.yml b/ansible/host_vars/monitoring/main.yml deleted file mode 100644 index 2ef805d..0000000 --- a/ansible/host_vars/monitoring/main.yml +++ /dev/null @@ -1,12 +0,0 @@ ---- - -# Systemd services deployed on this host, monitored every 5 minutes. -# -# The fact lives with the machine rather than in a central map, for the same -# reason the cross-host ports do: "what runs here" is a property of the host, -# and a central list is one more thing to forget to update when a service moves. -# -# Only units WE deploy belong here. Distro units (ssh, cron) have their own -# supervision and would be noise. -monitored_services: - - caddy diff --git a/ansible/host_vars/spacey/main.yml b/ansible/host_vars/spacey/main.yml index a50d116..b5249e6 100644 --- a/ansible/host_vars/spacey/main.yml +++ b/ansible/host_vars/spacey/main.yml @@ -11,3 +11,10 @@ monitored_services: - headscale - caddy + +# Gatus moved onto this host in the 2026-10-17 rebuild (the `monitoring` droplet +# is gone). Headscale already listens on 0.0.0.0:8080, so Gatus takes 8081. +# Host vars rather than role defaults: the Caddy vhost play in +# services/gatus/deploy_gatus_playbook.yml does not load the role and reads +# this same variable. +gatus_port: 8081 diff --git a/ansible/infra/402_public_monitoring.yml b/ansible/infra/402_public_monitoring.yml index 5aec9c0..a6dfa63 100644 --- a/ansible/infra/402_public_monitoring.yml +++ b/ansible/infra/402_public_monitoring.yml @@ -21,7 +21,7 @@ # then left behind when the machine moved, so the check asserts against # ansible_host - if a box is renumbered, inventory is the one edit. dns_records: - - {sub: "{{ subdomains.gatus }}", host: monitoring} + - {sub: "{{ subdomains.gatus }}", host: spacey} - {sub: "{{ subdomains.headscale }}", host: spacey} - {sub: "{{ subdomains.vaultwarden }}", host: vipy} - {sub: "{{ subdomains.forgejo }}", host: vipy} diff --git a/ansible/inventory.ini b/ansible/inventory.ini index f5964ab..64d0e96 100644 --- a/ansible/inventory.ini +++ b/ansible/inventory.ini @@ -1,7 +1,6 @@ [vps] -vipy ansible_host=167.172.107.33 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua -spacey ansible_host=64.227.112.128 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua -monitoring ansible_host=64.226.70.190 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua +vipy ansible_host=167.172.98.204 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua +spacey ansible_host=46.101.250.26 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua [nodito_host] nodito ansible_host=192.168.1.139 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua @@ -11,9 +10,9 @@ nodito ansible_host=192.168.1.139 ansible_user=counterweight ansible_port=22 ans knots_box_local ansible_host=knots-box lan_ip=192.168.1.135 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua fulcrum_box_local ansible_host=fulcrum-box lan_ip=192.168.1.140 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua mempool_box_local ansible_host=mempool-box lan_ip=192.168.1.142 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua -memos_box_local ansible_host=memos-box lan_ip=192.168.1.145 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua +memos_box_local ansible_host=memos-box lan_ip=192.168.1.130 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua forgejo_runner_local ansible_host=forgejo-runner-box lan_ip=192.168.1.132 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua -arbret_staging_local ansible_host=arbret-staging-box lan_ip=192.168.1.147 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua +arbret_staging_local ansible_host=arbret-staging-box lan_ip=192.168.1.145 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua small_backups_local ansible_host=small-backups-box lan_ip=192.168.1.131 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua monerod_box_local ansible_host=monerod-box lan_ip=192.168.1.146 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua # lan_ip read off nodito's ARP table for the VM's own MAC (bc:24:11:89:fc:1f), @@ -30,18 +29,13 @@ jar_lid_staging_local ansible_host=jar-lid-archive-staging-box lan_ip=192.168.1. [lapy] localhost ansible_connection=local ansible_user=counterweight -[arbret] -prd-arbret ansible_host=167.99.242.62 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua - [edge] vipy -# The group is `observability`, NOT `monitoring` — there is a HOST named -# `monitoring` on line 5, and a group with the same name makes `hosts: monitoring` -# ambiguous. Ansible resolved it to the host and warned: -# [WARNING]: Found both group and host with same name: monitoring +# Gatus and its Signal transport. Shares spacey with headscale since the +# 2026-10-17 rebuild; the separate `monitoring` droplet is gone. [observability] -monitoring +spacey [vpn_control] spacey @@ -78,7 +72,7 @@ forgejo_runner_local localhost # Every machine Ansible may configure as a server. -# Deliberately EXCLUDES [control] (your laptop) and [arbret]. +# Deliberately EXCLUDES [control] (your laptop). [managed:children] vps nodito_host diff --git a/ansible/services/headscale/templates/acl.json.j2 b/ansible/services/headscale/templates/acl.json.j2 index bc60624..2362a1f 100644 --- a/ansible/services/headscale/templates/acl.json.j2 +++ b/ansible/services/headscale/templates/acl.json.j2 @@ -46,12 +46,7 @@ "tag:jar-lid-archive-staging-box:8000", "tag:monerod-box:18089", "tag:monerod-box:8081", - "tag:arbret-staging-box:80", - "tag:stalwart-box:25", - "tag:stalwart-box:465", - "tag:stalwart-box:993", - "tag:stalwart-box:4190", - "tag:stalwart-box:8080" + "tag:arbret-staging-box:80" ], "src": [ "tag:prd-vipy" @@ -80,10 +75,8 @@ { "action": "accept", "dst": [ - "tag:prd-arbret:22", "tag:prd-vipy:22", "tag:memos-box:22", - "tag:stalwart-box:22", "tag:jar-lid-archive-staging-box:22" ], "src": [ @@ -125,20 +118,11 @@ "tag:nodito": [ "{{ headscale_namespace }}@" ], - "tag:prd-arbret": [ - "{{ headscale_namespace }}@" - ], - "tag:prd-monitoring": [ - "{{ headscale_namespace }}@" - ], "tag:prd-vipy": [ "{{ headscale_namespace }}@" ], "tag:small-backups-box": [ "{{ headscale_namespace }}@" - ], - "tag:stalwart-box": [ - "{{ headscale_namespace }}@" ] } }