counterweight
3711421af5
The four ports were the only entries in services_config.yml with a real
justification: each is read twice, by the role that deploys the service on its
own box AND by a socket-proxy or Caddy play that runs on the EDGE host and
publishes it. A role default is invisible to that second play.
But the shape was wrong in two ways. The file had to be named in vars_files: by
30 plays - opt-in configuration that someone will eventually forget - and five
role defaults silently interpolated service_settings.*, so bitcoin_knots,
fulcrum, datum_gateway and mempool were not self-contained: using any of them
without that one vars_file entry broke it.
Each port now lives in host_vars/<owning box>/main.yml:
host_vars/knots_box_local/main.yml bitcoin_p2p_port, datum_gateway_api_port,
datum_gateway_stratum_port
host_vars/fulcrum_box_local/main.yml fulcrum_ssl_port
host_vars/mempool_box_local/main.yml mempool_frontend_port
host_vars auto-loads and outranks role defaults, so the owning role picks the
value up with no vars_files at all, and the edge play reads the same single
definition as hostvars['<host>'].<name>. The role defaults keep the protocol
standard (8333, 50002, ...) so each role still works standalone, with the live
deployment's value in host_vars winning.
Also fixed a fourth copy of an inventory identity: the mempool Caddy play had
"mempool-box:{{ ... }}" hardcoded in the upstream. It now derives the host from
hostvars['mempool_box_local'].ansible_host, so inventory is the only place any
box's name is written down.
services_config.yml is deleted, with 25 more vars_files entries across 19
playbooks. Between this and the previous commit, 87 vars_files entries are gone
and every variable in the repo now comes from group_vars/all, host_vars,
inventory, a role default, or that service's own *_vars.yml.
Verification: an edge-host probe resolves all eight ports and hostnames to
byte-identical values to the ones services_config.yml used to supply. Each
owning host resolves its own port through host_vars. All 37 playbooks'
--list-tasks output is unchanged. The four edge plays that consume these values
all check-diff changed=0 - the socket-proxy and Caddy units on vipy are
byte-identical, which is the direct proof the rewiring landed on the same
values. fulcrum and datum-gateway check-diff exactly as before (ok=28/changed=1
and ok=15/changed=1, both the known timer re-arm).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| defaults | ||
| tasks | ||
| templates | ||
| README.md | ||
mempool
Deploys the Mempool block explorer as a three-container
Docker Compose stack — MariaDB, backend, frontend — on mempool-box, and keeps a
health check on each.
Converted from deploy_mempool_playbook.yml (745 lines) under Plan 6. The
playbook is now 37 lines: this role, plus a second play that publishes the
frontend through Caddy on the edge host.
Phases
docker.yml |
Docker engine: repo, key, packages, service |
deploy.yml |
directories, docker-compose.yml, pull, up, wait-for-healthy |
healthcheck.yml |
three check scripts, three services, three timers |
Three health checks, not one
Mempool is three moving parts and knowing which one is down is the point, so
each gets its own check, unit and timer, driven by the mempool_healthchecks
list:
| checks | |
|---|---|
mariadb |
docker inspect health status of mempool-db |
backend |
GET /api/v1/backend-info |
frontend |
GET / |
Each records its answer in its exit code, which systemd keeps:
systemctl is-failed mempool-backend-healthcheck.service. Reporting elsewhere
is one field per check, push_url, and is the plug-in point for whatever
monitoring exists. Empty means check, exit honestly, report nowhere. The URLs
are credentials, so callers pass them from the vault.
Nothing here is specific to a monitoring product. The embedded Python that
created monitors over the Uptime Kuma API, the /tmp credentials file, the
push-URL file read back and parsed, and three systemd Environment= rewrites
are gone.
MariaDB owns its own data directory
{{ mempool_mysql_dir }} is bind-mounted into the container, which runs as uid
999 and must create files there. The playbook this replaced declared
owner: "{{ ansible_user }}" (1000) on it, which had drifted from reality ever
since the containers were created — unnoticed, because the playbook had not been
run since.
That was not academic. The first real run of this role pulled a newer
mariadb:10.11 and recreated mempool-db; had the chown still been in place,
MariaDB would have come back to a directory it could not write. The role now
ensures the directory exists and leaves ownership to the container.
mempool_frontend_port lives in services_config.yml
Two hosts need it: this role deploys the frontend on mempool-box, and the Caddy
play proxies to it from the edge host. A role default is invisible to the second
play, so the value lives in service_settings.mempool.frontend_port and the role
default derives from it.
Expect changed=2 on a converged host
Pull Mempool images and Deploy Mempool containers with docker compose are
bare command: tasks with no changed_when, so they always report changed.
That is the idempotent floor, not drift. Everything else reports ok.
mariadb:10.11 is a moving tag, so a run can pull a newer patch release and
recreate the database container. Pin it if that is not what you want.