counterweight
85040d5f67
watchtower is being destroyed. Removed from [vps], with its host_vars, its push token, and the six Gatus endpoints that referenced it (liveness, disk, two systemd services, the ntfy DNS record and the ntfy HTTP check). ntfy went with it - it ran nowhere else - so services/ntfy is deleted, subdomains.ntfy and ntfy_topic are gone from group_vars, and the ntfy playbook is out of site.yml. ntfy_topic already had no readers: the three infra/4xx plays that used it were deleted when their checks were superseded. Two things this exposed. services/ntfy/deploy_ntfy_playbook.yml was pointing at the WRONG MACHINE. It said `hosts: observability`, which resolves to the host `monitoring` (64.226.70.190) - but ntfy ran on watchtower, and ntfy.contrapeso.xyz pointed there. Running it would have installed ntfy on the new VPS. Moot now, but it is the same stale-identity failure as the rest: the group meant watchtower when the play was written, and nobody revisited it when the group changed. Watchtower was in [vps] and NO role group at all, while running caddy, ntfy and Uptime Kuma - nothing in the repo managed any of it. More seriously: ntfy-emergency-app on vipy (avisame.contrapeso.xyz) sends its notifications to https://ntfy.contrapeso.xyz, topic "emergencia". Destroying watchtower breaks it, and it is an EMERGENCY notifier - it would fail silently at exactly the moment it matters. That is NOT resolved here, deliberately: standing ntfy up elsewhere, pointing at ntfy.sh, or retiring the app are all decisions, not cleanups. What this change does is make the break impossible to miss. The URL was derived from subdomains.ntfy, so deleting that would have turned it into an undefined variable buried in a template. It is now an explicit ntfy_service_url in the app's own vars, still holding the old value, with the three options written above it. The ntfy credentials stay in the vault because that app still needs them - the vault was restored from HEAD and only watchtower's push token removed, rather than re-handling the plaintext. Verified: no reference to watchtower or its IP anywhere in the repo; Gatus down from 91 to 85 endpoints, 85 UP, 0 DOWN. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
66 lines
3 KiB
YAML
66 lines
3 KiB
YAML
new_user: counterweight
|
|
ssh_port: 22
|
|
allow_ssh_from: "any"
|
|
root_domain: contrapeso.xyz
|
|
|
|
# Uptime Kuma was decommissioned on 2026-09-11. The monitoring blocks in the
|
|
# playbooks are kept deliberately — the check logic is meant to be rewired to
|
|
# whatever replaces it. This flag keeps them inert until then. See archive/uptime_kuma/.
|
|
|
|
# age recipient for all backup artefacts
|
|
age_backup_recipient: "age192wwdaseqej2ggwyp884gtm05c396anp7chr0vr8m47g50fahpyqr9fsza"
|
|
|
|
# Public key small-backups-box pulls with
|
|
# Authorised on each source host for an unprivileged, dedicated user only
|
|
backup_pull_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfIixKMhA9z+Nvyx6ToZIniC8aEgyiInRiboaTTemgX offsite-backup-pull"
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Subdomains. Global because the edge host proxies for services that live on
|
|
# other machines, so no single inventory group covers the readers. Combine with
|
|
# root_domain above to build an FQDN.
|
|
#
|
|
# Moved here from services_config.yml, which 30 plays had to remember to name in
|
|
# vars_files: - a file everyone must opt into is a file someone will forget.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
subdomains:
|
|
# Monitoring
|
|
gatus: status
|
|
|
|
# VPN infrastructure (spacey)
|
|
headscale: headscale
|
|
|
|
# Core services (vipy)
|
|
vaultwarden: vault
|
|
forgejo: forgejo
|
|
lnbits: wallet
|
|
|
|
# Secondary services (vipy)
|
|
ntfy_emergency_app: avisame
|
|
personal_blog: pablohere
|
|
|
|
# Memos (memos-box)
|
|
memos: memos
|
|
|
|
# Mempool block explorer (mempool-box, proxied via vipy)
|
|
mempool: mempool
|
|
|
|
# DATUM Gateway dashboard (knots-box, proxied via vipy)
|
|
datum_gateway: datum
|
|
|
|
# Read by plays across several groups, so global rather than group_vars/<group>.
|
|
headscale_namespace: counter-net
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Domains whose registration expiry is monitored (infra/402_public_monitoring).
|
|
#
|
|
# Registration renewal is a manual act at the registrar, and losing a domain is
|
|
# not recoverable in the way losing a host is - so these are checked daily and
|
|
# alarm with two weeks of runway.
|
|
#
|
|
# root_domain is the estate's own domain; the rest are domains we own that are
|
|
# served from it or from a host in the inventory.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
monitored_domains:
|
|
- "{{ root_domain }}"
|
|
- arbret.com
|