counterweight
5447e03d1f
prd-arbret was folded into vipy. arbret itself (app, worker, Postgres, timers, its backup dump) is deployed by its owner's own repo; this repo owns the shared host's side of it. arbret_handoff.md documents the split, the Gatus push API and the backup contract. - services/arbret: arbret.com -> localhost:3100, www redirects to the apex, port 4117 allowed on tailscale0 only, /opt/backups/arbret pre-created to the contract so the pull job is green before the first dump. - headscale ACL: framie may reach prd-vipy:4117. - vipy: arbret-server, arbret-worker and postgresql in the unit checks. - 402: DNS and HTTP checks for arbret.com, www, and /api/health with [BODY].status == ok. Entries may now name an fqdn outside root_domain and add conditions. - 403: probes arbret-analytics (hourly, 130m window) and arbret-beancount (daily, 26h), pushing with the dedicated arbret token. - backups: pull from backup-pull@prd-vipy:/opt/backups/arbret/, and a backup-dump_arbret endpoint. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
59 lines
2.2 KiB
YAML
59 lines
2.2 KiB
YAML
---
|
|
# arbret's footprint on the edge host - and ONLY that.
|
|
#
|
|
# arbret itself (app, worker, Postgres, timers, its backup dump) is deployed by
|
|
# the arbret owner's own Ansible repo since prd-arbret was merged into vipy on
|
|
# 2026-10-17. This playbook owns the parts of the shared host that are ours:
|
|
# the public front door, the tailnet port, and the backup directory contract.
|
|
# See arbret_handoff.md at the repo root for the division of labour.
|
|
- name: Publish arbret on the edge host
|
|
hosts: edge
|
|
become: yes
|
|
vars:
|
|
# Local port the arbret app binds on 127.0.0.1, per the arbret owner.
|
|
arbret_port: 3100
|
|
arbret_domain: arbret.com
|
|
# Admin port reachable from the tailnet only (ACL in headscale's acl.json.j2).
|
|
arbret_tailnet_port: 4117
|
|
|
|
tasks:
|
|
- name: Publish arbret through Caddy
|
|
ansible.builtin.include_role:
|
|
name: caddy_site
|
|
vars:
|
|
caddy_site_name: arbret
|
|
caddy_site_domain: "{{ arbret_domain }}"
|
|
caddy_site_upstream: "localhost:{{ arbret_port }}"
|
|
|
|
- name: Redirect www to the apex
|
|
ansible.builtin.include_role:
|
|
name: caddy_site
|
|
vars:
|
|
caddy_site_name: arbret-www
|
|
caddy_site_domain: "www.{{ arbret_domain }}"
|
|
caddy_site_body: |
|
|
redir https://{{ arbret_domain }}{uri} permanent
|
|
|
|
# tailscale0 only. UFW's default-deny applies to the tailnet interface too,
|
|
# so the headscale ACL alone does not open it - and this must never be
|
|
# reachable on the public interface.
|
|
- name: Allow the arbret admin port from the tailnet
|
|
community.general.ufw:
|
|
rule: allow
|
|
interface: tailscale0
|
|
direction: in
|
|
port: "{{ arbret_tailnet_port | string }}"
|
|
proto: tcp
|
|
comment: "arbret admin, tailnet only"
|
|
|
|
# The backup contract directory (arbret_handoff.md section 3.3). The arbret
|
|
# repo creates it identically; creating it here too means small-backups-box
|
|
# can pull - an empty dir - before arbret's first dump, so one missing
|
|
# source does not turn the whole pull job red.
|
|
- name: Ensure the arbret backup directory exists
|
|
ansible.builtin.file:
|
|
path: /opt/backups/arbret
|
|
state: directory
|
|
owner: root
|
|
group: backup-pull
|
|
mode: "0750"
|