Erich Blume
a2f1e06224
Makes indri the canonical **heph** hub for the hub-and-spoke task/context system, deployed as a self-updating LaunchAgent managed by Ansible. Other devices (gilbert) attach as offline-capable spokes.
## What's here
- **`ansible/roles/heph`** (tag `heph`) — bootstrap `cargo install hephd` (only if absent; `--self-update` keeps it current after), version-pinned `heph-pwa` checkout served via `--web-root`, launchagent `mcquack.eblume.heph`:
```
hephd --mode server --http-addr 0.0.0.0:8787 --db … --web-root …
--oidc-issuer …/o/heph/ --oidc-audience heph
--self-update --self-update-interval-secs 600
```
`~/.cargo/bin` is on the agent `PATH` so self-update's `cargo install` works.
- **Caddy** — `heph.ops.eblu.me → localhost:8787` (TLS for the PWA secure context).
- **Authentik** — new `heph` **public device-code** OIDC app + `default-device-code-flow` bound to the default brand's `flow_device_code` (verified live: brand `authentik-default`, field currently unset → additive).
- **Docs** — `services/hephaestus.md` (Path-A seeding runbook + spoke caveat), `indri.md`, changelog fragment.
## Three features requested
- **Autoupdate** — 10-min interval (`--self-update-interval-secs 600`).
- **PWA** — `--web-root` (confirmed shipped in v1.2.0).
- **Spoke** — gilbert reconfig documented (post-merge step).
## Deploy plan (not done yet — awaiting review)
1. Seed from gilbert (Path A): `heph daemon stop` → copy `heph.db` → `DELETE FROM meta WHERE key='origin'`.
2. Sync Authentik `apps`/blueprint; verify blueprint status via API (not just logs).
3. `provision-indri --tags heph,caddy` from this branch.
4. Point gilbert at the hub + `heph auth login`.
## Known follow-ups (heph-side, tracked in the Hephaestus project)
- `heph daemon` can't bake hub/spoke config or pass `--self-update-interval-secs` → worked around by the ansible plist.
- Path-A seeding lacks a clean `hephd --owner-id`/seed command → manual `meta.origin` reset for now.
- Self-update moves hephd ahead of the ansible-pinned PWA shell over time (drift; tolerated by the SW cache, revisit on next release).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: #369
82 lines
3 KiB
YAML
82 lines
3 KiB
YAML
---
|
|
# hephaestus hub (server mode) on indri.
|
|
#
|
|
# DATA SEEDING (one-time, Path A — do this BEFORE the first provision so the hub
|
|
# adopts gilbert's existing data instead of being born empty):
|
|
#
|
|
# 1. On the seed device (gilbert): heph daemon stop
|
|
# 2. Copy its store to indri: scp ~/.local/share/heph/heph.db \
|
|
# indri:~/.local/share/heph/heph.db
|
|
# 3. On indri, give the hub its OWN device origin (keeps gilbert's owner_id +
|
|
# data; hephd regenerates a fresh origin on next start when it is missing):
|
|
# sqlite3 ~/.local/share/heph/heph.db "DELETE FROM meta WHERE key='origin';"
|
|
# 4. Run this role (installs hephd, stages the PWA, loads the launchagent).
|
|
#
|
|
# hephd auto-creates an empty store on first start if none exists, so seeding is
|
|
# optional — skip it only if you intend a fresh, empty hub.
|
|
|
|
- name: Ensure heph data directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ heph_data_dir }}"
|
|
state: directory
|
|
mode: '0700'
|
|
|
|
- name: Check for installed hephd binary
|
|
ansible.builtin.stat:
|
|
path: "{{ heph_binary }}"
|
|
register: heph_binary_stat
|
|
|
|
# Bootstrap install only when hephd is absent. Thereafter hephd's own
|
|
# --self-update keeps it current; ansible must not fight (or downgrade) it.
|
|
# This builds from source and can take several minutes on a cold cargo cache.
|
|
- name: Bootstrap-install heph + hephd from the forge ({{ heph_version }})
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
{{ heph_bin_dir }}/cargo install --locked
|
|
--git {{ heph_repo_url }}
|
|
--tag {{ heph_version }}
|
|
heph hephd
|
|
environment:
|
|
PATH: "{{ heph_bin_dir }}:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin"
|
|
RUSTUP_TOOLCHAIN: "{{ heph_rust_toolchain }}"
|
|
when: not heph_binary_stat.stat.exists
|
|
changed_when: true
|
|
notify: Restart heph
|
|
|
|
# Checkout provides the PWA shell at {{ heph_web_root }} (heph-pwa/ subdir),
|
|
# served directly by hephd. Static files are read from disk per request, so a
|
|
# version bump needs no restart; the service worker (CACHE = "heph-pwa-vN")
|
|
# evicts stale assets on next load.
|
|
- name: Ensure heph cache parent directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ heph_pwa_src_dir | dirname }}"
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Stage heph-pwa source at {{ heph_version }}
|
|
ansible.builtin.git:
|
|
repo: "{{ heph_repo_url }}"
|
|
dest: "{{ heph_pwa_src_dir }}"
|
|
version: "{{ heph_version }}"
|
|
depth: 1
|
|
single_branch: true
|
|
force: true
|
|
|
|
- name: Deploy heph LaunchAgent plist
|
|
ansible.builtin.template:
|
|
src: heph.plist.j2
|
|
dest: ~/Library/LaunchAgents/mcquack.eblume.heph.plist
|
|
mode: '0644'
|
|
notify: Restart heph
|
|
|
|
- name: Check if heph LaunchAgent is loaded
|
|
ansible.builtin.command: launchctl list mcquack.eblume.heph
|
|
register: heph_launchctl_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Load heph LaunchAgent if not loaded
|
|
ansible.builtin.command: launchctl load ~/Library/LaunchAgents/mcquack.eblume.heph.plist
|
|
when: heph_launchctl_check.rc != 0
|
|
changed_when: true
|
|
failed_when: false
|