2026-01-13 21:12:24 -08:00
|
|
|
---
|
|
|
|
|
- name: Configure indri
|
|
|
|
|
hosts: indri
|
2026-01-16 12:30:20 -08:00
|
|
|
|
2026-01-20 09:04:47 -08:00
|
|
|
# Fetch 1Password credentials upfront to minimize prompts
|
2026-01-16 12:30:20 -08:00
|
|
|
# Each role also fetches its own credentials (with 'when: <var> is not defined')
|
|
|
|
|
# so they still work when running with --tags
|
|
|
|
|
pre_tasks:
|
|
|
|
|
- name: Fetch borgmatic database password
|
|
|
|
|
ansible.builtin.command:
|
2026-02-08 10:52:43 -08:00
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/mw2bv5we7woicjza7hc6s44yvy/db-password"
|
2026-01-16 12:30:20 -08:00
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _borgmatic_db_pw
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
2026-01-16 14:41:36 -08:00
|
|
|
check_mode: false
|
2026-01-20 09:04:47 -08:00
|
|
|
tags: [borgmatic]
|
2026-01-16 12:30:20 -08:00
|
|
|
|
2026-01-20 09:04:47 -08:00
|
|
|
- name: Set borgmatic database password fact
|
2026-01-16 12:30:20 -08:00
|
|
|
ansible.builtin.set_fact:
|
2026-01-20 09:04:47 -08:00
|
|
|
borgmatic_db_password: "{{ _borgmatic_db_pw.stdout }}"
|
2026-01-16 12:30:20 -08:00
|
|
|
no_log: true
|
2026-01-20 09:04:47 -08:00
|
|
|
tags: [borgmatic]
|
2026-01-16 12:30:20 -08:00
|
|
|
|
2026-02-10 12:47:02 -08:00
|
|
|
- name: Fetch BorgBase SSH private key
|
|
|
|
|
ansible.builtin.command:
|
|
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/noiobufntsxyzageu7mvlp2nbe/ssh-private-key"
|
|
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _borgbase_ssh_key
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
|
|
|
|
check_mode: false
|
|
|
|
|
tags: [borgmatic]
|
|
|
|
|
|
|
|
|
|
- name: Set BorgBase SSH key fact
|
|
|
|
|
ansible.builtin.set_fact:
|
|
|
|
|
borgbase_ssh_private_key: "{{ _borgbase_ssh_key.stdout }}"
|
|
|
|
|
no_log: true
|
|
|
|
|
tags: [borgmatic]
|
|
|
|
|
|
2026-01-23 17:00:12 -08:00
|
|
|
# Forgejo secrets
|
|
|
|
|
- name: Fetch forgejo LFS JWT secret
|
|
|
|
|
ansible.builtin.command:
|
2026-02-08 10:52:43 -08:00
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/w3663ffnvkewbftncqxtcpeavy/lfs-jwt-secret"
|
2026-01-23 17:00:12 -08:00
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _forgejo_lfs_jwt
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
|
|
|
|
check_mode: false
|
|
|
|
|
tags: [forgejo]
|
|
|
|
|
|
|
|
|
|
- name: Fetch forgejo internal token
|
|
|
|
|
ansible.builtin.command:
|
2026-02-08 10:52:43 -08:00
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/w3663ffnvkewbftncqxtcpeavy/internal-token"
|
2026-01-23 17:00:12 -08:00
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _forgejo_internal_token
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
|
|
|
|
check_mode: false
|
|
|
|
|
tags: [forgejo]
|
|
|
|
|
|
|
|
|
|
- name: Fetch forgejo OAuth2 JWT secret
|
|
|
|
|
ansible.builtin.command:
|
2026-02-08 10:52:43 -08:00
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/w3663ffnvkewbftncqxtcpeavy/oauth2-jwt-secret"
|
2026-01-23 17:00:12 -08:00
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _forgejo_oauth2_jwt
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
|
|
|
|
check_mode: false
|
|
|
|
|
tags: [forgejo]
|
|
|
|
|
|
|
|
|
|
- name: Set forgejo secrets facts
|
|
|
|
|
ansible.builtin.set_fact:
|
|
|
|
|
forgejo_lfs_jwt_secret: "{{ _forgejo_lfs_jwt.stdout }}"
|
|
|
|
|
forgejo_internal_token: "{{ _forgejo_internal_token.stdout }}"
|
|
|
|
|
forgejo_oauth2_jwt_secret: "{{ _forgejo_oauth2_jwt.stdout }}"
|
|
|
|
|
no_log: true
|
|
|
|
|
tags: [forgejo]
|
|
|
|
|
|
2026-02-04 09:11:01 -08:00
|
|
|
# Forgejo Actions secrets (synced to Forgejo via API)
|
|
|
|
|
- name: Fetch Forgejo API token
|
|
|
|
|
ansible.builtin.command:
|
2026-02-08 10:52:43 -08:00
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/w3663ffnvkewbftncqxtcpeavy/api-token"
|
2026-02-04 09:11:01 -08:00
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _forgejo_api_token
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
|
|
|
|
check_mode: false
|
|
|
|
|
tags: [forgejo_actions_secrets]
|
|
|
|
|
|
|
|
|
|
- name: Fetch ArgoCD auth token for Forgejo Actions
|
|
|
|
|
ansible.builtin.command:
|
2026-02-08 10:52:43 -08:00
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/w3663ffnvkewbftncqxtcpeavy/argocd_token"
|
2026-02-04 09:11:01 -08:00
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _forgejo_argocd_token
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
|
|
|
|
check_mode: false
|
|
|
|
|
tags: [forgejo_actions_secrets]
|
|
|
|
|
|
2026-02-08 02:36:19 -08:00
|
|
|
- name: Fetch Fly.io deploy token for Forgejo Actions
|
|
|
|
|
ansible.builtin.command:
|
2026-02-08 10:52:43 -08:00
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/on5slfaygtdjrxmdwezyhfmqsq/deploy-token"
|
2026-02-08 02:36:19 -08:00
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _fly_deploy_token
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
|
|
|
|
check_mode: false
|
|
|
|
|
tags: [forgejo_actions_secrets]
|
|
|
|
|
|
2026-02-21 12:20:29 -08:00
|
|
|
- name: Fetch Zot CI API key for Forgejo Actions
|
|
|
|
|
ansible.builtin.command:
|
|
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/w3663ffnvkewbftncqxtcpeavy/zot-ci-api"
|
|
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _zot_ci_api_key
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
|
|
|
|
check_mode: false
|
|
|
|
|
tags: [forgejo_actions_secrets]
|
|
|
|
|
|
2026-02-04 09:11:01 -08:00
|
|
|
- name: Set Forgejo Actions secrets facts
|
|
|
|
|
ansible.builtin.set_fact:
|
|
|
|
|
forgejo_api_token: "{{ _forgejo_api_token.stdout }}"
|
|
|
|
|
forgejo_secret_argocd_token: "{{ _forgejo_argocd_token.stdout }}"
|
2026-02-08 10:52:43 -08:00
|
|
|
forgejo_secret_fly_deploy_token: "{{ _fly_deploy_token.stdout }}"
|
2026-02-21 12:20:29 -08:00
|
|
|
forgejo_secret_zot_ci_api_key: "{{ _zot_ci_api_key.stdout }}"
|
2026-02-04 09:11:01 -08:00
|
|
|
no_log: true
|
|
|
|
|
tags: [forgejo_actions_secrets]
|
|
|
|
|
|
2026-02-21 08:45:06 -08:00
|
|
|
# Zot OIDC client secret
|
|
|
|
|
- name: Fetch zot OIDC client secret
|
|
|
|
|
ansible.builtin.command:
|
|
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/oor7os5kapczgpbwv7obkca4y4/zot-client-secret"
|
|
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _zot_oidc_secret
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
|
|
|
|
check_mode: false
|
|
|
|
|
tags: [zot]
|
|
|
|
|
|
|
|
|
|
- name: Set zot OIDC client secret fact
|
|
|
|
|
ansible.builtin.set_fact:
|
|
|
|
|
zot_oidc_client_secret: "{{ _zot_oidc_secret.stdout }}"
|
|
|
|
|
no_log: true
|
|
|
|
|
tags: [zot]
|
|
|
|
|
|
2026-01-25 09:35:06 -08:00
|
|
|
# Caddy Gandi token for ACME DNS-01 challenges
|
|
|
|
|
- name: Fetch Gandi PAT for Caddy
|
|
|
|
|
ansible.builtin.command:
|
2026-02-08 10:52:43 -08:00
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/mco6ka3dc3rmw7zkg2dhia5d2m/pat"
|
2026-01-25 09:35:06 -08:00
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _caddy_gandi_token
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
|
|
|
|
check_mode: false
|
|
|
|
|
tags: [caddy]
|
|
|
|
|
|
|
|
|
|
- name: Set Caddy Gandi token fact
|
|
|
|
|
ansible.builtin.set_fact:
|
|
|
|
|
caddy_gandi_token: "{{ _caddy_gandi_token.stdout }}"
|
|
|
|
|
no_log: true
|
|
|
|
|
tags: [caddy]
|
|
|
|
|
|
2026-02-21 20:05:44 -08:00
|
|
|
# Jellyfin SSO client secret
|
|
|
|
|
- name: Fetch Jellyfin OIDC client secret
|
|
|
|
|
ansible.builtin.command:
|
|
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/oor7os5kapczgpbwv7obkca4y4/jellyfin-client-secret"
|
|
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _jellyfin_oidc_secret
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
|
|
|
|
check_mode: false
|
|
|
|
|
tags: [jellyfin]
|
|
|
|
|
|
|
|
|
|
- name: Set Jellyfin OIDC client secret fact
|
|
|
|
|
ansible.builtin.set_fact:
|
|
|
|
|
jellyfin_sso_client_secret: "{{ _jellyfin_oidc_secret.stdout }}"
|
|
|
|
|
no_log: true
|
|
|
|
|
tags: [jellyfin]
|
|
|
|
|
|
2026-01-30 16:57:26 -08:00
|
|
|
# Jellyfin API key for metrics collection
|
|
|
|
|
- name: Fetch Jellyfin API key
|
|
|
|
|
ansible.builtin.command:
|
2026-02-08 10:52:43 -08:00
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/ceywxkcd3z7najsy2nmmbs2vke/credential"
|
2026-01-30 16:57:26 -08:00
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _jellyfin_metrics_api_key
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
|
|
|
|
check_mode: false
|
|
|
|
|
tags: [jellyfin_metrics]
|
|
|
|
|
|
|
|
|
|
- name: Set Jellyfin API key fact
|
|
|
|
|
ansible.builtin.set_fact:
|
|
|
|
|
jellyfin_metrics_api_key: "{{ _jellyfin_metrics_api_key.stdout }}"
|
|
|
|
|
no_log: true
|
|
|
|
|
tags: [jellyfin_metrics]
|
|
|
|
|
|
2026-02-22 11:16:03 -08:00
|
|
|
# Forgejo API token for metrics collection
|
|
|
|
|
- name: Fetch Forgejo API token for metrics
|
|
|
|
|
ansible.builtin.command:
|
|
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/w3663ffnvkewbftncqxtcpeavy/api-token"
|
|
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _forgejo_metrics_api_token
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
|
|
|
|
check_mode: false
|
|
|
|
|
tags: [forgejo_metrics]
|
|
|
|
|
|
|
|
|
|
- name: Set Forgejo metrics API token fact
|
|
|
|
|
ansible.builtin.set_fact:
|
|
|
|
|
forgejo_metrics_api_key: "{{ _forgejo_metrics_api_token.stdout }}"
|
|
|
|
|
no_log: true
|
|
|
|
|
tags: [forgejo_metrics]
|
|
|
|
|
|
2026-04-29 13:38:36 -07:00
|
|
|
# Devpi root password (PyPI mirror admin)
|
|
|
|
|
- name: Fetch devpi root password
|
|
|
|
|
ansible.builtin.command:
|
|
|
|
|
cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/kyhzfifryqnuk7jeyibmmjvxxm/add more/root password"
|
|
|
|
|
delegate_to: localhost
|
|
|
|
|
register: _devpi_root_password
|
|
|
|
|
changed_when: false
|
|
|
|
|
no_log: true
|
|
|
|
|
check_mode: false
|
|
|
|
|
tags: [devpi]
|
|
|
|
|
|
|
|
|
|
- name: Set devpi root password fact
|
|
|
|
|
ansible.builtin.set_fact:
|
|
|
|
|
devpi_root_password: "{{ _devpi_root_password.stdout }}"
|
|
|
|
|
no_log: true
|
|
|
|
|
tags: [devpi]
|
|
|
|
|
|
2026-01-13 21:12:24 -08:00
|
|
|
roles:
|
2026-01-15 12:24:13 -08:00
|
|
|
- role: alloy
|
|
|
|
|
tags: alloy
|
2026-01-14 10:33:48 -08:00
|
|
|
- role: borgmatic
|
|
|
|
|
tags: borgmatic
|
2026-01-17 09:22:01 -08:00
|
|
|
- role: borgmatic_metrics
|
|
|
|
|
tags: borgmatic_metrics
|
2026-01-14 10:33:48 -08:00
|
|
|
- role: forgejo
|
|
|
|
|
tags: forgejo
|
2026-02-04 09:11:01 -08:00
|
|
|
- role: forgejo_actions_secrets
|
|
|
|
|
tags: forgejo_actions_secrets
|
2026-01-18 12:06:28 -08:00
|
|
|
- role: zot
|
|
|
|
|
tags: zot
|
|
|
|
|
- role: zot_metrics
|
|
|
|
|
tags: zot_metrics
|
2026-04-29 13:38:36 -07:00
|
|
|
- role: devpi
|
|
|
|
|
tags: devpi
|
2026-01-18 12:06:28 -08:00
|
|
|
- role: minikube
|
|
|
|
|
tags: minikube
|
|
|
|
|
- role: minikube_metrics
|
|
|
|
|
tags: minikube_metrics
|
2026-01-30 16:57:26 -08:00
|
|
|
- role: jellyfin
|
|
|
|
|
tags: jellyfin
|
|
|
|
|
- role: jellyfin_metrics
|
|
|
|
|
tags: jellyfin_metrics
|
2026-02-22 11:16:03 -08:00
|
|
|
- role: forgejo_metrics
|
|
|
|
|
tags: forgejo_metrics
|
C1: migrate cv + docs from minikube to indri-native (#342)
## Summary
Replace the cv (`cv.eblu.me`) and docs (`docs.eblu.me`) minikube Deployments with indri-native ansible roles. Caddy serves the extracted release tarballs directly via a new `kind: static` service-block — no daemon, no nginx pod, no ProxyGroup ingress on the request path. Mirrors the rationale of the recent devpi migration; part of the broader minikube wind-down.
## What's in this commit
- `ansible/roles/{cv,docs}` — sentinel-gated tarball download + extract into `~/{cv,docs}/content/`
- `ansible/roles/caddy/` — new `kind: static` branch in the Caddyfile template (encoded gzip, immutable cache headers for fingerprinted assets, optional `try_html` for Quartz-style clean URLs, optional per-path `download_paths` for the resume PDF's `Content-Disposition`)
- `ansible/playbooks/indri.yml` — wires `cv` and `docs` roles before `caddy`
- `service-versions.yaml` — both services flip to `type: ansible`. `docs.current-version` stays at `1.28.2` for this commit so `container-version-check` keeps passing while `containers/quartz/Dockerfile` still exists; it moves to the docs release tag in the cleanup commit
- `.forgejo/workflows/{cv-deploy,build-blumeops}.yaml` — deploy step now bumps `cv_version`/`docs_version` in the role defaults and pushes; running ansible + purging the Fly cache is manual from gilbert (matches devpi)
- Docs: `docs/how-to/operations/{cv,docs}-on-indri.md`, updated `docs/reference/services/{cv,docs}.md`, changelog fragment
## What is not in this commit
The dead artifacts. After PR review and successful cutover, a follow-up commit deletes:
- `argocd/apps/{cv,docs}.yaml` and `argocd/manifests/{cv,docs}/`
- `containers/cv/`, `containers/quartz/`
- `CONTAINER_TO_SERVICE['quartz']` mapping in `mise-tasks/container-version-check`
- bumps `docs.current-version` in `service-versions.yaml` to the release tag
## Cutover plan (manual, from gilbert, after review)
1. **Take down old:**
- Remove the cv and docs Applications: `argocd app delete cv --cascade && argocd app delete docs --cascade`
- Verify k8s namespaces gone: `kubectl --context=minikube-indri get ns | grep -E '^(cv|docs)\\b'` (should be empty)
- Verify tailnet MagicDNS no longer advertises the VIPs: `nslookup cv.tail8d86e.ts.net` and `nslookup docs.tail8d86e.ts.net` should both fail
2. **Bring up new:**
- `mise run provision-indri -- --tags cv,docs,caddy --check --diff` (already validated on branch)
- `mise run provision-indri -- --tags cv,docs,caddy`
- `fly ssh console -a blumeops-proxy -C "sh -c 'rm -rf /tmp/cache && nginx -s reload'"`
3. **Verify:** `mise run services-check` and the curl checks listed in `docs/how-to/operations/{cv,docs}-on-indri.md`
4. **Cleanup commit + merge.**
Total expected downtime: minutes (not the few-hour budget you authorized).
## Test plan
- [ ] `mise run provision-indri -- --tags cv,docs --check --diff` clean
- [ ] `mise run provision-indri -- --tags caddy --check --diff` shows only the cv + docs blocks changing as previewed in the PR thread
- [ ] After cutover: `cv.eblu.me`, `cv.ops.eblu.me`, `docs.eblu.me`, `docs.ops.eblu.me` all return 200
- [ ] `cv.eblu.me/resume.pdf` includes `Content-Disposition: attachment`
- [ ] A clean Quartz URL (e.g. `docs.eblu.me/explanation/agent-change-process`) resolves to the right page
- [ ] `mise run services-check` clean
- [ ] `mise run service-review --type ansible` shows cv and docs
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/342
2026-04-29 14:55:11 -07:00
|
|
|
- role: cv
|
|
|
|
|
tags: cv
|
|
|
|
|
- role: docs
|
|
|
|
|
tags: docs
|
Add hephaestus sync hub to indri (launchagent, PWA, device-code OIDC) (#369)
Makes indri the canonical **heph** hub for the hub-and-spoke task/context system, deployed as a self-updating LaunchAgent managed by Ansible. Other devices (gilbert) attach as offline-capable spokes.
## What's here
- **`ansible/roles/heph`** (tag `heph`) — bootstrap `cargo install hephd` (only if absent; `--self-update` keeps it current after), version-pinned `heph-pwa` checkout served via `--web-root`, launchagent `mcquack.eblume.heph`:
```
hephd --mode server --http-addr 0.0.0.0:8787 --db … --web-root …
--oidc-issuer …/o/heph/ --oidc-audience heph
--self-update --self-update-interval-secs 600
```
`~/.cargo/bin` is on the agent `PATH` so self-update's `cargo install` works.
- **Caddy** — `heph.ops.eblu.me → localhost:8787` (TLS for the PWA secure context).
- **Authentik** — new `heph` **public device-code** OIDC app + `default-device-code-flow` bound to the default brand's `flow_device_code` (verified live: brand `authentik-default`, field currently unset → additive).
- **Docs** — `services/hephaestus.md` (Path-A seeding runbook + spoke caveat), `indri.md`, changelog fragment.
## Three features requested
- **Autoupdate** — 10-min interval (`--self-update-interval-secs 600`).
- **PWA** — `--web-root` (confirmed shipped in v1.2.0).
- **Spoke** — gilbert reconfig documented (post-merge step).
## Deploy plan (not done yet — awaiting review)
1. Seed from gilbert (Path A): `heph daemon stop` → copy `heph.db` → `DELETE FROM meta WHERE key='origin'`.
2. Sync Authentik `apps`/blueprint; verify blueprint status via API (not just logs).
3. `provision-indri --tags heph,caddy` from this branch.
4. Point gilbert at the hub + `heph auth login`.
## Known follow-ups (heph-side, tracked in the Hephaestus project)
- `heph daemon` can't bake hub/spoke config or pass `--self-update-interval-secs` → worked around by the ansible plist.
- Path-A seeding lacks a clean `hephd --owner-id`/seed command → manual `meta.origin` reset for now.
- Self-update moves hephd ahead of the ansible-pinned PWA shell over time (drift; tolerated by the SW cache, revisit on next release).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/369
2026-06-05 06:46:58 -07:00
|
|
|
- role: heph
|
|
|
|
|
tags: heph
|
2026-01-25 09:35:06 -08:00
|
|
|
- role: caddy
|
|
|
|
|
tags: caddy
|