Erich Blume
14ca0160ba
## Summary Devpi was crash-looping under memory pressure on the minikube StatefulSet, breaking the Python toolchain across the repo (`mise run docs-mikado`, `prek`, every `uv pip install`). It moves to indri as a native LaunchAgent. ## What changed - **New ansible role** `ansible/roles/devpi/`: installs `devpi-server` + `devpi-web` into a uv-managed venv, initializes the server-dir on first run via 1Password root password, runs as a LaunchAgent (`mcquack.eblume.devpi`) bound to `127.0.0.1:3141`. Bootstraps from upstream PyPI (so devpi can install itself on a fresh box). - **Caddy**: `pypi.ops.eblu.me` now proxies to `http://localhost:3141`. - **Playbook**: `indri.yml` gains pre_tasks for the root password and the new role. - **service-versions.yaml**: devpi flipped from `type: argocd` to `type: ansible`. - **ArgoCD**: removed `apps/devpi.yaml` and `manifests/devpi/`. The in-cluster Application, namespace, and PVC have been deleted. - **Docs**: new how-to `docs/how-to/operations/devpi-on-indri.md`; `restart-indri.md` lists devpi in the LaunchAgent stop list. ## Already deployed (live on indri) - Service running: `launchctl list mcquack.eblume.devpi` → PID 53888 - `curl https://pypi.ops.eblu.me/+api` returns 200 ✅ - `mise run docs-mikado` works again ✅ - 1.0G of cached PyPI data was migrated from the PVC to `~erichblume/devpi/server-dir/` - Minikube namespace and PVC fully reclaimed ## Test plan - [ ] `mise run services-check` (after merge) - [ ] CI workflows that use devpi succeed - [ ] No regressions in tools that depend on `pypi.ops.eblu.me` (prek, uv-script tasks, dagger pipelines) ## Context This is the C1 prelude to a planned C2 chain (`mikado/retire-minikube-indri`) to retire minikube on indri entirely. Doing devpi as a standalone C1 was the right call because (a) it was urgent — it was breaking the toolchain — and (b) it shakes out the migration recipe before we commit to a multi-leaf chain. Reviewed-on: #341
71 lines
2.3 KiB
YAML
71 lines
2.3 KiB
YAML
---
|
|
# devpi role — devpi-server in a uv-managed venv, run via LaunchAgent.
|
|
# Replaces the prior minikube StatefulSet; see [[devpi-on-indri]].
|
|
#
|
|
# The root password is fetched in the indri.yml playbook pre_tasks and
|
|
# exposed as `devpi_root_password`.
|
|
|
|
- name: Ensure devpi home exists
|
|
ansible.builtin.file:
|
|
path: "{{ devpi_home }}"
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Ensure devpi server-dir exists
|
|
ansible.builtin.file:
|
|
path: "{{ devpi_server_dir }}"
|
|
state: directory
|
|
mode: '0700'
|
|
|
|
- name: Create devpi venv if missing
|
|
ansible.builtin.command:
|
|
cmd: "{{ devpi_uv_binary }} venv --python {{ devpi_python_version }} {{ devpi_venv }}"
|
|
creates: "{{ devpi_venv }}/bin/python"
|
|
|
|
- name: Install devpi-server and devpi-web into venv
|
|
# Always bootstrap from upstream PyPI — devpi is the index it would otherwise resolve through,
|
|
# and that's a circular dependency (devpi cannot install itself from itself).
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
{{ devpi_uv_binary }} pip install
|
|
--python {{ devpi_venv }}/bin/python
|
|
--index-url https://pypi.org/simple/
|
|
devpi-server=={{ devpi_server_version }}
|
|
devpi-web=={{ devpi_web_version }}
|
|
register: devpi_pip_install
|
|
changed_when: "'Installed' in devpi_pip_install.stdout or 'Uninstalled' in devpi_pip_install.stdout"
|
|
notify: Restart devpi
|
|
|
|
- name: Check if devpi server-dir is initialized
|
|
ansible.builtin.stat:
|
|
path: "{{ devpi_server_dir }}/.serverversion"
|
|
register: devpi_serverversion
|
|
|
|
- name: Initialize devpi server-dir
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
{{ devpi_init_binary }}
|
|
--serverdir {{ devpi_server_dir }}
|
|
--root-passwd {{ devpi_root_password }}
|
|
when: not devpi_serverversion.stat.exists
|
|
changed_when: true
|
|
no_log: true
|
|
|
|
- name: Deploy devpi LaunchAgent plist
|
|
ansible.builtin.template:
|
|
src: devpi.plist.j2
|
|
dest: ~/Library/LaunchAgents/mcquack.eblume.devpi.plist
|
|
mode: '0644'
|
|
notify: Restart devpi
|
|
|
|
- name: Check if devpi LaunchAgent is loaded
|
|
ansible.builtin.command: launchctl list mcquack.eblume.devpi
|
|
register: devpi_launchctl_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Load devpi LaunchAgent if not loaded
|
|
ansible.builtin.command: launchctl load ~/Library/LaunchAgents/mcquack.eblume.devpi.plist
|
|
when: devpi_launchctl_check.rc != 0
|
|
changed_when: true
|
|
failed_when: false
|