counterweight
85040d5f67
watchtower is being destroyed. Removed from [vps], with its host_vars, its push token, and the six Gatus endpoints that referenced it (liveness, disk, two systemd services, the ntfy DNS record and the ntfy HTTP check). ntfy went with it - it ran nowhere else - so services/ntfy is deleted, subdomains.ntfy and ntfy_topic are gone from group_vars, and the ntfy playbook is out of site.yml. ntfy_topic already had no readers: the three infra/4xx plays that used it were deleted when their checks were superseded. Two things this exposed. services/ntfy/deploy_ntfy_playbook.yml was pointing at the WRONG MACHINE. It said `hosts: observability`, which resolves to the host `monitoring` (64.226.70.190) - but ntfy ran on watchtower, and ntfy.contrapeso.xyz pointed there. Running it would have installed ntfy on the new VPS. Moot now, but it is the same stale-identity failure as the rest: the group meant watchtower when the play was written, and nobody revisited it when the group changed. Watchtower was in [vps] and NO role group at all, while running caddy, ntfy and Uptime Kuma - nothing in the repo managed any of it. More seriously: ntfy-emergency-app on vipy (avisame.contrapeso.xyz) sends its notifications to https://ntfy.contrapeso.xyz, topic "emergencia". Destroying watchtower breaks it, and it is an EMERGENCY notifier - it would fail silently at exactly the moment it matters. That is NOT resolved here, deliberately: standing ntfy up elsewhere, pointing at ntfy.sh, or retiring the app are all decisions, not cleanups. What this change does is make the break impossible to miss. The URL was derived from subdomains.ntfy, so deleting that would have turned it into an undefined variable buried in a template. It is now an explicit ntfy_service_url in the app's own vars, still holding the old value, with the three options written above it. The ntfy credentials stay in the vault because that app still needs them - the vault was restored from HEAD and only watchtower's push token removed, rather than re-handling the plaintext. Verified: no reference to watchtower or its IP anywhere in the repo; Gatus down from 91 to 85 endpoints, 85 UP, 0 DOWN. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
62 lines
2.6 KiB
YAML
62 lines
2.6 KiB
YAML
- name: Deploy ntfy-emergency-app with Docker Compose and configure Caddy reverse proxy
|
|
hosts: edge
|
|
become: yes
|
|
vars_files:
|
|
- ./ntfy_emergency_app_vars.yml
|
|
vars:
|
|
ntfy_emergency_app_subdomain: "{{ subdomains.ntfy_emergency_app }}"
|
|
ntfy_emergency_app_domain: "{{ ntfy_emergency_app_subdomain }}.{{ root_domain }}"
|
|
# ⚠ UNRESOLVED: this app sends its notifications to an ntfy server, and the
|
|
# server it points at ran on watchtower, which is being destroyed. This was
|
|
# derived from subdomains.ntfy, which is now gone with it.
|
|
#
|
|
# Until an ntfy server exists again this URL is dead, and the app fails
|
|
# silently at exactly the moment it matters - it is an EMERGENCY notifier.
|
|
# Three ways out, none of them automatic:
|
|
# * stand ntfy up somewhere else (the monitoring VPS, or vipy)
|
|
# * point this at the public ntfy.sh
|
|
# * retire the app
|
|
ntfy_emergency_app_ntfy_url: "{{ ntfy_service_url }}"
|
|
ntfy_emergency_app_ntfy_user: "{{ ntfy_username | default('') }}"
|
|
ntfy_emergency_app_ntfy_password: "{{ ntfy_password | default('') }}"
|
|
|
|
tasks:
|
|
- name: Create ntfy-emergency-app directory
|
|
file:
|
|
path: "{{ ntfy_emergency_app_dir }}"
|
|
state: directory
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: '0755'
|
|
|
|
- name: Create docker-compose.yml for ntfy-emergency-app
|
|
copy:
|
|
dest: "{{ ntfy_emergency_app_dir }}/docker-compose.yml"
|
|
content: |
|
|
version: "3"
|
|
services:
|
|
ntfy-emergency-app:
|
|
image: ghcr.io/pmartincalvo/ntfy-emergency-app:latest
|
|
container_name: ntfy-emergency-app
|
|
restart: unless-stopped
|
|
ports:
|
|
- "{{ ntfy_emergency_app_port }}:3000"
|
|
environment:
|
|
NTFY_TOPIC: "{{ ntfy_emergency_app_topic }}"
|
|
NTFY_URL: "{{ ntfy_emergency_app_ntfy_url }}"
|
|
NTFY_USER: "{{ ntfy_emergency_app_ntfy_user }}"
|
|
NTFY_PASSWORD: "{{ ntfy_emergency_app_ntfy_password }}"
|
|
UI_MESSAGE: "{{ ntfy_emergency_app_ui_message }}"
|
|
|
|
- name: Deploy ntfy-emergency-app container with docker compose
|
|
command: docker compose up -d
|
|
args:
|
|
chdir: "{{ ntfy_emergency_app_dir }}"
|
|
|
|
- name: Publish ntfy-emergency-app through Caddy
|
|
ansible.builtin.include_role:
|
|
name: caddy_site
|
|
vars:
|
|
caddy_site_name: ntfy-emergency-app
|
|
caddy_site_domain: "{{ ntfy_emergency_app_domain }}"
|
|
caddy_site_upstream: "localhost:{{ ntfy_emergency_app_port }}"
|