Erich Blume
a2f1e06224
Makes indri the canonical **heph** hub for the hub-and-spoke task/context system, deployed as a self-updating LaunchAgent managed by Ansible. Other devices (gilbert) attach as offline-capable spokes.
## What's here
- **`ansible/roles/heph`** (tag `heph`) — bootstrap `cargo install hephd` (only if absent; `--self-update` keeps it current after), version-pinned `heph-pwa` checkout served via `--web-root`, launchagent `mcquack.eblume.heph`:
```
hephd --mode server --http-addr 0.0.0.0:8787 --db … --web-root …
--oidc-issuer …/o/heph/ --oidc-audience heph
--self-update --self-update-interval-secs 600
```
`~/.cargo/bin` is on the agent `PATH` so self-update's `cargo install` works.
- **Caddy** — `heph.ops.eblu.me → localhost:8787` (TLS for the PWA secure context).
- **Authentik** — new `heph` **public device-code** OIDC app + `default-device-code-flow` bound to the default brand's `flow_device_code` (verified live: brand `authentik-default`, field currently unset → additive).
- **Docs** — `services/hephaestus.md` (Path-A seeding runbook + spoke caveat), `indri.md`, changelog fragment.
## Three features requested
- **Autoupdate** — 10-min interval (`--self-update-interval-secs 600`).
- **PWA** — `--web-root` (confirmed shipped in v1.2.0).
- **Spoke** — gilbert reconfig documented (post-merge step).
## Deploy plan (not done yet — awaiting review)
1. Seed from gilbert (Path A): `heph daemon stop` → copy `heph.db` → `DELETE FROM meta WHERE key='origin'`.
2. Sync Authentik `apps`/blueprint; verify blueprint status via API (not just logs).
3. `provision-indri --tags heph,caddy` from this branch.
4. Point gilbert at the hub + `heph auth login`.
## Known follow-ups (heph-side, tracked in the Hephaestus project)
- `heph daemon` can't bake hub/spoke config or pass `--self-update-interval-secs` → worked around by the ansible plist.
- Path-A seeding lacks a clean `hephd --owner-id`/seed command → manual `meta.origin` reset for now.
- Self-update moves hephd ahead of the ansible-pinned PWA shell over time (drift; tolerated by the SW cache, revisit on next release).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: #369
49 lines
2.3 KiB
YAML
49 lines
2.3 KiB
YAML
---
|
|
# hephaestus hub — the canonical heph replica (server mode) on indri.
|
|
# Other devices (e.g. gilbert) are spokes that sync against this hub.
|
|
# See [[set-up-sync-hub]] and [[host-heph-pwa]] in the hephaestus repo.
|
|
|
|
# Pinned release used for the initial `cargo install` and the PWA shell.
|
|
# After bootstrap, hephd's own --self-update keeps the binary current; this
|
|
# pin only governs the first install and the bundled PWA shell version.
|
|
heph_version: v1.2.0
|
|
|
|
# Anonymous public HTTPS clone — matches hephd's INSTALL_GIT_URL so the initial
|
|
# install and unattended self-update build from the same source (no ssh-agent).
|
|
heph_repo_url: https://forge.eblu.me/eblume/hephaestus.git
|
|
|
|
heph_bin_dir: /Users/erichblume/.cargo/bin
|
|
heph_binary: "{{ heph_bin_dir }}/hephd"
|
|
|
|
# rustc/cargo here are rustup shims. The bare (non-mise) environment that the
|
|
# launchagent and ansible run in falls back to rustup's *default* toolchain,
|
|
# which can lag behind heph's rust-version floor (Cargo.toml: 1.89). Pin the
|
|
# channel explicitly so both the bootstrap build and unattended self-update
|
|
# always use a current toolchain regardless of the host's rustup default.
|
|
heph_rust_toolchain: stable
|
|
|
|
heph_data_dir: /Users/erichblume/.local/share/heph
|
|
heph_db: "{{ heph_data_dir }}/heph.db"
|
|
heph_socket: "{{ heph_data_dir }}/hephd.sock"
|
|
heph_log_dir: /Users/erichblume/Library/Logs
|
|
|
|
# Version-pinned source checkout; the PWA static shell is served directly from
|
|
# its heph-pwa/ subdir (no copy), keeping shell and hub in lockstep at heph_version.
|
|
heph_pwa_src_dir: /Users/erichblume/.cache/heph-pwa-src
|
|
heph_web_root: "{{ heph_pwa_src_dir }}/heph-pwa"
|
|
|
|
# Hub listens on all interfaces so tailnet spokes can reach it directly
|
|
# (http://indri.tail8d86e.ts.net:8787) and Caddy can proxy heph.ops.eblu.me.
|
|
# Access is gated by Authentik OIDC regardless — tailnet reachability is not
|
|
# enough (this is the owner's most sensitive data).
|
|
heph_http_addr: 0.0.0.0:8787
|
|
heph_port: 8787
|
|
heph_external_url: https://heph.ops.eblu.me
|
|
|
|
# Authentik OIDC — issuer + audience together turn hub auth on. The audience is
|
|
# the device-code client id (see argocd/manifests/authentik heph blueprint).
|
|
heph_oidc_issuer: https://authentik.ops.eblu.me/application/o/heph/
|
|
heph_oidc_audience: heph
|
|
|
|
# Self-update poll interval (seconds). 10 minutes.
|
|
heph_self_update_interval_secs: 600
|