stuff

ansible/services/forgejo/forgejo_vars.yml

@@ -15,3 +15,7 @@ forgejo_user: "git"
 remote_host: "{{ groups['vipy'][0] }}"
 remote_user: "{{ hostvars[remote_host]['ansible_user'] }}"
 remote_key_file: "{{ hostvars[remote_host]['ansible_ssh_private_key_file'] | default('') }}"
+
+# Local backup
+local_backup_dir: "{{ lookup('env', 'HOME') }}/forgejo-backups"
+backup_script_path: "{{ lookup('env', 'HOME') }}/.local/bin/forgejo_backup.sh"

ansible/services/forgejo/setup_backup_forgejo_to_lapy.yml

@@ -0,0 +1,86 @@
+---
+- name: Configure local backup for Forgejo from remote
+  hosts: lapy
+  gather_facts: no
+  vars_files:
+    - ../../infra_vars.yml
+    - ./forgejo_vars.yml
+  vars:
+    remote_data_path: "{{ forgejo_data_dir }}"
+    remote_config_path: "{{ forgejo_config_dir }}"
+    forgejo_service_name: "forgejo"
+    gpg_recipient: "{{ hostvars['localhost']['gpg_recipient'] | default('') }}"
+    gpg_key_id: "{{ hostvars['localhost']['gpg_key_id'] | default('') }}"
+
+  tasks:
+    - name: Debug Forgejo backup vars
+      debug:
+        msg:
+          - "remote_host={{ remote_host }}"
+          - "remote_user={{ remote_user }}"
+          - "remote_data_path='{{ remote_data_path }}'"
+          - "remote_config_path='{{ remote_config_path }}'"
+          - "local_backup_dir={{ local_backup_dir }}"
+          - "gpg_recipient={{ gpg_recipient }}"
+          - "gpg_key_id={{ gpg_key_id }}"
+
+    - name: Ensure local backup directory exists
+      ansible.builtin.file:
+        path: "{{ local_backup_dir }}"
+        state: directory
+        mode: "0755"
+
+    - name: Ensure ~/.local/bin exists
+      ansible.builtin.file:
+        path: "{{ lookup('env', 'HOME') }}/.local/bin"
+        state: directory
+        mode: "0755"
+
+    - name: Create Forgejo backup script
+      ansible.builtin.copy:
+        dest: "{{ backup_script_path }}"
+        mode: "0750"
+        content: |
+          #!/bin/bash
+          set -euo pipefail
+
+          if [ -z "{{ gpg_recipient }}" ]; then
+            echo "GPG recipient is not configured. Aborting."
+            exit 1
+          fi
+
+          TIMESTAMP=$(date +'%Y-%m-%d')
+          ENCRYPTED_BACKUP="{{ local_backup_dir }}/forgejo-backup-$TIMESTAMP.tar.gz.gpg"
+
+          {% if remote_key_file %}
+          SSH_CMD="ssh -i {{ remote_key_file }} -p {{ hostvars[remote_host]['ansible_port'] | default(22) }}"
+          {% else %}
+          SSH_CMD="ssh -p {{ hostvars[remote_host]['ansible_port'] | default(22) }}"
+          {% endif %}
+
+          echo "Stopping Forgejo service..."
+          $SSH_CMD {{ remote_user }}@{{ remote_host }} "sudo systemctl stop {{ forgejo_service_name }}"
+
+          echo "Creating encrypted backup archive..."
+          $SSH_CMD {{ remote_user }}@{{ remote_host }} "sudo tar -czf - {{ remote_data_path }} {{ remote_config_path }}" | \
+          gpg --batch --yes --encrypt --recipient "{{ gpg_recipient }}" --output "$ENCRYPTED_BACKUP"
+
+          echo "Starting Forgejo service..."
+          $SSH_CMD {{ remote_user }}@{{ remote_host }} "sudo systemctl start {{ forgejo_service_name }}"
+
+          echo "Rotating old backups..."
+          find "{{ local_backup_dir }}" -name "forgejo-backup-*.tar.gz.gpg" -mtime +13 -delete
+
+          echo "Backup completed successfully"
+
+    - name: Ensure cronjob for Forgejo backup exists
+      ansible.builtin.cron:
+        name: "Forgejo backup"
+        user: "{{ lookup('env', 'USER') }}"
+        job: "{{ backup_script_path }}"
+        minute: 5
+        hour: "9,12,15,18"
+
+    - name: Run Forgejo backup script to create initial backup
+      ansible.builtin.command: "{{ backup_script_path }}"
+

ansible/services/headscale/deploy_headscale_playbook.yml

@@ -11,6 +11,7 @@
     caddy_sites_dir: "{{ caddy_sites_dir }}"
     headscale_domain: "{{ headscale_subdomain }}.{{ root_domain }}"
     headscale_base_domain: "tailnet.{{ root_domain }}"
+    headscale_namespace: "{{ service_settings.headscale.namespace }}"
     uptime_kuma_api_url: "https://{{ subdomains.uptime_kuma }}.{{ root_domain }}"
 
   tasks:

ansible/services/headscale/headscale_vars.yml

@@ -7,12 +7,11 @@ headscale_grpc_port: 50443
 # Version
 headscale_version: "0.26.1"
 
-# Namespace for devices (users in headscale terminology)
-headscale_namespace: counter-net
-
 # Data directory
 headscale_data_dir: /var/lib/headscale
 
+# Namespace now configured in services_config.yml under service_settings.headscale.namespace
+
 # Remote access
 remote_host: "{{ groups['spacey'][0] }}"
 remote_user: "{{ hostvars[remote_host]['ansible_user'] }}"

ansible/services/ntfy-emergency-app/deploy_ntfy_emergency_app_playbook.yml

@@ -3,12 +3,17 @@
   become: yes
   vars_files:
     - ../../infra_vars.yml
+    - ../../infra_secrets.yml
     - ../../services_config.yml
     - ./ntfy_emergency_app_vars.yml
   vars:
     ntfy_emergency_app_subdomain: "{{ subdomains.ntfy_emergency_app }}"
     caddy_sites_dir: "{{ caddy_sites_dir }}"
     ntfy_emergency_app_domain: "{{ ntfy_emergency_app_subdomain }}.{{ root_domain }}"
+    ntfy_service_domain: "{{ subdomains.ntfy }}.{{ root_domain }}"
+    ntfy_emergency_app_ntfy_url: "https://{{ ntfy_service_domain }}"
+    ntfy_emergency_app_ntfy_user: "{{ ntfy_username | default('') }}"
+    ntfy_emergency_app_ntfy_password: "{{ ntfy_password | default('') }}"
 
   tasks:
     - name: Create ntfy-emergency-app directory

ansible/services/ntfy-emergency-app/ntfy_emergency_app_vars.yml

@@ -6,9 +6,6 @@ ntfy_emergency_app_port: 3000
 
 # ntfy configuration
 ntfy_emergency_app_topic: "emergencia"
-ntfy_emergency_app_ntfy_url: "https://ntfy.contrapeso.xyz"
-ntfy_emergency_app_ntfy_user: "counterweight"
-ntfy_emergency_app_ntfy_password: "superntfyme"
 ntfy_emergency_app_ui_message: "Leave Pablo a message, he will respond as soon as possible"
 
 # Remote access

ansible/services/ntfy/ntfy_vars.yml

@@ -1,2 +1,3 @@
 ntfy_port: 6674
-ntfy_topic: alerts  # Topic for Uptime Kuma notifications
+
+# ntfy_topic now lives in services_config.yml under service_settings.ntfy.topic

ansible/services/ntfy/setup_ntfy_uptime_kuma_notification.yml

@@ -6,10 +6,10 @@
     - ../../services_config.yml
     - ../../infra_secrets.yml
     - ./ntfy_vars.yml
-    - ../uptime_kuma/uptime_kuma_vars.yml
 
   vars:
     ntfy_subdomain: "{{ subdomains.ntfy }}"
+    ntfy_topic: "{{ service_settings.ntfy.topic }}"
     uptime_kuma_subdomain: "{{ subdomains.uptime_kuma }}"
     ntfy_domain: "{{ ntfy_subdomain }}.{{ root_domain }}"
     ntfy_server_url: "https://{{ ntfy_domain }}"

ansible/services/personal-blog/deploy_personal_blog_playbook.yml

@@ -1,105 +0,0 @@
-- name: Deploy personal blog static site
-  hosts: vipy
-  become: yes
-  vars_files:
-    - ../../infra_vars.yml
-    - ../../services_config.yml
-    - ./personal_blog_vars.yml
-  vars:
-    personal_blog_subdomain: "{{ subdomains.personal_blog }}"
-    caddy_sites_dir: "{{ caddy_sites_dir }}"
-    personal_blog_domain: "{{ personal_blog_subdomain }}.{{ root_domain }}"
-
-  tasks:
-    - name: Install git
-      apt:
-        name: git
-        state: present
-
-    - name: Create source directory for blog
-      file:
-        path: "{{ personal_blog_source_dir }}"
-        state: directory
-        owner: root
-        group: root
-        mode: '0755'
-
-    - name: Create webroot directory
-      file:
-        path: "{{ personal_blog_webroot }}"
-        state: directory
-        owner: www-data
-        group: www-data
-        mode: '0755'
-
-    - name: Clone blog repository with token authentication
-      git:
-        repo: "https://{{ personal_blog_git_username }}:{{ lookup('env', 'PERSONAL_BLOG_DEPLOY_TOKEN') }}@forgejo.contrapeso.xyz/counterweight/pablohere.git"
-        dest: "{{ personal_blog_source_dir }}"
-        version: master
-        force: yes
-      become_user: root
-
-    - name: Copy static files to webroot
-      shell: |
-        rsync -av --delete {{ personal_blog_source_dir }}/{{ personal_blog_source_folder }}/ {{ personal_blog_webroot }}/
-      args:
-        creates: "{{ personal_blog_webroot }}/index.html"
-
-    - name: Set ownership and permissions for webroot
-      file:
-        path: "{{ personal_blog_webroot }}"
-        owner: www-data
-        group: www-data
-        recurse: yes
-        state: directory
-
-    - name: Ensure Caddy sites-enabled directory exists
-      file:
-        path: "{{ caddy_sites_dir }}"
-        state: directory
-        owner: root
-        group: root
-        mode: '0755'
-
-    - name: Ensure Caddyfile includes import directive for sites-enabled
-      lineinfile:
-        path: /etc/caddy/Caddyfile
-        line: 'import sites-enabled/*'
-        insertafter: EOF
-        state: present
-        backup: yes
-
-    - name: Create Caddy static site configuration
-      copy:
-        dest: "{{ caddy_sites_dir }}/personal-blog.conf"
-        content: |
-          {{ personal_blog_domain }} {
-              root * {{ personal_blog_webroot }}
-              file_server
-          }
-        owner: root
-        group: root
-        mode: '0644'
-
-    - name: Reload Caddy to apply new config
-      command: systemctl reload caddy
-
-    - name: Create update script for blog
-      copy:
-        dest: /usr/local/bin/update-personal-blog.sh
-        content: |
-          #!/bin/bash
-          cd {{ personal_blog_source_dir }}
-          git pull https://{{ personal_blog_git_username }}:${PERSONAL_BLOG_DEPLOY_TOKEN}@forgejo.contrapeso.xyz/counterweight/pablohere.git master
-          rsync -av --delete {{ personal_blog_source_dir }}/{{ personal_blog_source_folder }}/ {{ personal_blog_webroot }}/
-          chown -R www-data:www-data {{ personal_blog_webroot }}
-        owner: root
-        group: root
-        mode: '0755'
-
-    - name: Add cron job to update blog every hour
-      cron:
-        name: "Update personal blog"
-        job: "0 * * * * PERSONAL_BLOG_DEPLOY_TOKEN={{ lookup('env', 'PERSONAL_BLOG_DEPLOY_TOKEN') }} /usr/local/bin/update-personal-blog.sh"
-        user: root

ansible/services/personal-blog/personal_blog_vars.yml

@@ -1,6 +0,0 @@
-# (caddy_sites_dir and subdomain now in services_config.yml)
-personal_blog_git_repo: https://forgejo.contrapeso.xyz/counterweight/pablohere.git
-personal_blog_git_username: counterweight
-personal_blog_source_dir: /opt/personal-blog
-personal_blog_webroot: /var/www/pablohere.contrapeso.xyz
-personal_blog_source_folder: public