counterweight
5447e03d1f
prd-arbret was folded into vipy. arbret itself (app, worker, Postgres, timers, its backup dump) is deployed by its owner's own repo; this repo owns the shared host's side of it. arbret_handoff.md documents the split, the Gatus push API and the backup contract. - services/arbret: arbret.com -> localhost:3100, www redirects to the apex, port 4117 allowed on tailscale0 only, /opt/backups/arbret pre-created to the contract so the pull job is green before the first dump. - headscale ACL: framie may reach prd-vipy:4117. - vipy: arbret-server, arbret-worker and postgresql in the unit checks. - 402: DNS and HTTP checks for arbret.com, www, and /api/health with [BODY].status == ok. Entries may now name an fqdn outside root_domain and add conditions. - 403: probes arbret-analytics (hourly, 130m window) and arbret-beancount (daily, 26h), pushing with the dedicated arbret token. - backups: pull from backup-pull@prd-vipy:/opt/backups/arbret/, and a backup-dump_arbret endpoint. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
95 lines
5.8 KiB
YAML
95 lines
5.8 KiB
YAML
---
|
|
# Everything, in the order it has to happen.
|
|
#
|
|
# This file is a TABLE OF CONTENTS, not a second source of truth. It says what
|
|
# runs and in what order. It does NOT say which hosts get what — that stays on
|
|
# the `hosts:` line inside each playbook, exactly where it is today. Nothing
|
|
# moves; this file only makes the set readable in one place.
|
|
#
|
|
# What runs on a host? ansible-playbook site.yml --limit <host> --list-hosts
|
|
# Who gets thing Y? the `hosts:` line in Y's own playbook
|
|
# What is a host? ansible-inventory --graph
|
|
#
|
|
# Run a slice with --limit, or run one playbook directly as before. Nothing here
|
|
# changes how any individual playbook behaves.
|
|
|
|
# ── Baseline: every managed machine ─────────────────────────────────────────
|
|
- import_playbook: infra/01_user_and_access_setup_playbook.yml
|
|
- import_playbook: infra/02_firewall_and_fail2ban_playbook.yml
|
|
- import_playbook: infra/900_install_rsync.yml
|
|
- import_playbook: infra/920_join_headscale_mesh.yml
|
|
# Idempotent and kept permanently: guarantees a rebuilt or restored host cannot
|
|
# quietly bring the Uptime-Kuma-era monitoring back.
|
|
- import_playbook: infra/409_remove_legacy_monitoring.yml
|
|
|
|
# ── Monitoring ──────────────────────────────────────────────────────────────
|
|
# Gatus first: the three plays below register endpoints with it, and registering
|
|
# against a host that is not serving yet would simply fail.
|
|
- import_playbook: services/gatus/deploy_gatus_playbook.yml
|
|
# The Signal transport for Gatus alerts. Shares a docker network with Gatus and
|
|
# publishes no ports - the API has no authentication. Needs a one-time manual
|
|
# device link; see roles/signal_api/README.md.
|
|
- import_playbook: services/signal-api/deploy_signal_api_playbook.yml
|
|
- import_playbook: infra/400_host_monitoring.yml
|
|
- import_playbook: infra/401_service_monitoring.yml
|
|
- import_playbook: infra/402_public_monitoring.yml
|
|
# Registers where the per-service probes report. The probes themselves are
|
|
# deployed by each service's own playbook further down; the endpoints must exist
|
|
# before the first push arrives.
|
|
- import_playbook: infra/403_service_probe_registration.yml
|
|
# 910_docker says `hosts: managed`, but only 5 of 11 managed hosts have or need
|
|
# Docker. Left out until it has a [docker] group — see the note in PLAN_7.
|
|
|
|
# ── The hypervisor ──────────────────────────────────────────────────────────
|
|
- import_playbook: infra/nodito/31_proxmox_community_repos_playbook.yml
|
|
- import_playbook: infra/nodito/32_zfs_pool_setup_playbook.yml
|
|
- import_playbook: infra/nodito/34_nut_ups_setup_playbook.yml
|
|
|
|
# ── Reverse proxy, before anything that registers a vhost ───────────────────
|
|
- import_playbook: services/caddy_playbook.yml
|
|
|
|
# ── Services ────────────────────────────────────────────────────────────────
|
|
- import_playbook: services/bitcoin-knots/deploy_bitcoin_knots_playbook.yml
|
|
- import_playbook: services/fulcrum/deploy_fulcrum_playbook.yml
|
|
- import_playbook: services/datum-gateway/deploy_datum_gateway_playbook.yml
|
|
- import_playbook: services/mempool/deploy_mempool_playbook.yml
|
|
- import_playbook: services/monero/deploy_monero_playbook.yml
|
|
- import_playbook: services/xmrblocks/deploy_xmrblocks_playbook.yml
|
|
- import_playbook: services/memos/deploy_memos_playbook.yml
|
|
- import_playbook: services/navidrome/deploy_navidrome_playbook.yml
|
|
- import_playbook: services/jar-lid-archive/deploy_jar_lid_archive_playbook.yml
|
|
- import_playbook: services/forgejo-runner/deploy_forgejo_runner_playbook.yml
|
|
- import_playbook: services/phoenixd/deploy_phoenixd_playbook.yml
|
|
- import_playbook: services/headscale/deploy_headscale_playbook.yml
|
|
- import_playbook: services/vaultwarden/deploy_vaultwarden_playbook.yml
|
|
- import_playbook: services/forgejo/deploy_forgejo_playbook.yml
|
|
- import_playbook: services/lnbits/deploy_lnbits_playbook.yml
|
|
- import_playbook: services/personal-blog/deploy_personal_blog_playbook.yml
|
|
- import_playbook: services/arbret/deploy_arbret_edge_playbook.yml
|
|
|
|
# ── Backups: each source dumps itself, the box pulls ────────────────────────
|
|
- import_playbook: services/headscale/setup_backup_headscale.yml
|
|
- import_playbook: services/vaultwarden/setup_backup_vaultwarden.yml
|
|
- import_playbook: services/forgejo/setup_backup_forgejo.yml
|
|
- import_playbook: services/lnbits/setup_backup_lnbits.yml
|
|
- import_playbook: services/memos/setup_backup_memos.yml
|
|
- import_playbook: services/jar-lid-archive/setup_backup_jar_lid_archive.yml
|
|
- import_playbook: playbooks/backups.yml
|
|
|
|
# Deliberately not here. Every playbook in the repo is either imported above or
|
|
# listed below, so this file accounts for all of them:
|
|
#
|
|
# infra/910_docker_playbook.yml says `hosts: managed`, but Docker is on 5
|
|
# of 11 managed hosts and those 5 are exactly
|
|
# the ones that need it. Running it would
|
|
# install Docker on the Bitcoin node and the
|
|
# hypervisor. Needs a [docker] group first.
|
|
#
|
|
# infra/nodito/30_proxmox_bootstrap one-shot: bare-metal bootstrap, run once
|
|
# infra/nodito/33_..._cloud_template one-shot: builds the VM template
|
|
#
|
|
#
|
|
# services/vaultwarden/disable_ deliberate manual actions, not convergence
|
|
# vaultwarden_sign_ups_playbook.yml
|
|
# services/personal-blog/setup_
|
|
# deploy_alias_lapy.yml
|