Erich Blume
adf6f4fbe9
## Summary
- Add PostgreSQL 18 as a new service at `pg.tail8d86e.ts.net:5432`
- Add Miniflux RSS/Atom feed reader at `feed.tail8d86e.ts.net`
- Both services managed via homebrew/brew services
- Pulumi ACL tags added (tag:pg, tag:feed)
- Alloy log collection configured for both services
- Zettelkasten documentation updated
## Manual Setup Required
Before running ansible, the following steps are needed on indri:
### 1. Apply Pulumi tags
```bash
mise run tailnet-up
```
Then apply tags to indri in Tailscale admin console.
### 2. Create 1Password entries
- miniflux PostgreSQL user password
- miniflux admin password (for first run)
### 3. Set PostgreSQL user password (after ansible installs postgres)
```bash
ssh indri '/opt/homebrew/opt/postgresql@18/bin/psql -c "ALTER USER miniflux PASSWORD '\''your-password'\'';"'
```
### 4. Create password files on indri
```bash
ssh indri 'echo "your-db-password" > ~/.miniflux-db-password && chmod 600 ~/.miniflux-db-password'
ssh indri 'echo "your-admin-password" > ~/.miniflux-admin-password && chmod 600 ~/.miniflux-admin-password'
```
### 5. Create ~/.pgpass for borgmatic
```bash
ssh indri 'echo "localhost:5432:miniflux:miniflux:YOUR_PASSWORD" > ~/.pgpass && chmod 600 ~/.pgpass'
```
### 6. Run ansible with first-run admin creation
```bash
mise run provision-indri -- -e miniflux_create_admin=1
```
### 7. Update borgmatic config
Add to `~/.config/borgmatic/config.yaml` on indri:
```yaml
postgresql_databases:
- name: miniflux
hostname: localhost
port: 5432
username: miniflux
```
### 8. Cleanup after first run
```bash
ssh indri 'rm ~/.miniflux-admin-password'
```
## Test plan
- [ ] Run `mise run tailnet-up` and verify Pulumi changes
- [ ] Apply tags to indri in Tailscale admin
- [ ] Run `mise run provision-indri -- --check --diff` for dry run
- [ ] Run `mise run provision-indri -- -e miniflux_create_admin=1`
- [ ] Approve services in Tailscale admin
- [ ] Verify PostgreSQL: `ssh indri '/opt/homebrew/opt/postgresql@18/bin/pg_isready'`
- [ ] Verify Miniflux: `curl https://feed.tail8d86e.ts.net/healthcheck`
- [ ] Run `mise run indri-services-check`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/16
103 lines
3.1 KiB
YAML
103 lines
3.1 KiB
YAML
---
|
|
- name: Configure indri
|
|
hosts: indri
|
|
|
|
# Fetch all 1Password credentials upfront to minimize prompts
|
|
# Each role also fetches its own credentials (with 'when: <var> is not defined')
|
|
# so they still work when running with --tags
|
|
# Tags ensure pre_tasks only run when relevant roles are included
|
|
pre_tasks:
|
|
- name: Fetch PostgreSQL superuser password
|
|
ansible.builtin.command:
|
|
cmd: op --vault vg6xf6vvfmoh5hqjjhlhbeoaie item get guxu3j7ajhjyey6xxl2ovsl2ui --fields password --reveal
|
|
delegate_to: localhost
|
|
register: _pg_superuser_pw
|
|
changed_when: false
|
|
no_log: true
|
|
tags: [postgresql]
|
|
|
|
- name: Set PostgreSQL superuser password fact
|
|
ansible.builtin.set_fact:
|
|
pg_superuser_password: "{{ _pg_superuser_pw.stdout }}"
|
|
no_log: true
|
|
tags: [postgresql]
|
|
|
|
- name: Fetch PostgreSQL alloy user password
|
|
ansible.builtin.command:
|
|
cmd: op --vault vg6xf6vvfmoh5hqjjhlhbeoaie item get guxu3j7ajhjyey6xxl2ovsl2ui --fields alloy-user-pw --reveal
|
|
delegate_to: localhost
|
|
register: _pg_alloy_pw
|
|
changed_when: false
|
|
no_log: true
|
|
tags: [alloy, postgresql]
|
|
|
|
- name: Set PostgreSQL alloy password fact
|
|
ansible.builtin.set_fact:
|
|
alloy_postgres_password: "{{ _pg_alloy_pw.stdout }}"
|
|
no_log: true
|
|
tags: [alloy, postgresql]
|
|
|
|
- name: Fetch miniflux database password
|
|
ansible.builtin.command:
|
|
cmd: op --vault vg6xf6vvfmoh5hqjjhlhbeoaie item get ns6wylqiuqgczpo7gq2akaxbti --fields password --reveal
|
|
delegate_to: localhost
|
|
register: _miniflux_db_pw
|
|
changed_when: false
|
|
no_log: true
|
|
tags: [miniflux, postgresql]
|
|
|
|
- name: Set miniflux passwords fact
|
|
ansible.builtin.set_fact:
|
|
miniflux_db_password: "{{ _miniflux_db_pw.stdout }}"
|
|
no_log: true
|
|
tags: [miniflux, postgresql]
|
|
|
|
- name: Fetch borgmatic database password
|
|
ansible.builtin.command:
|
|
cmd: op --vault vg6xf6vvfmoh5hqjjhlhbeoaie item get mw2bv5we7woicjza7hc6s44yvy --fields db-password --reveal
|
|
delegate_to: localhost
|
|
register: _borgmatic_db_pw
|
|
changed_when: false
|
|
no_log: true
|
|
tags: [postgresql]
|
|
|
|
- name: Build PostgreSQL user password lookup
|
|
ansible.builtin.set_fact:
|
|
pg_user_passwords:
|
|
miniflux: "{{ _miniflux_db_pw.stdout }}"
|
|
borgmatic: "{{ _borgmatic_db_pw.stdout }}"
|
|
alloy: "{{ _pg_alloy_pw.stdout }}"
|
|
no_log: true
|
|
tags: [postgresql]
|
|
|
|
roles:
|
|
- role: loki
|
|
tags: loki
|
|
- role: alloy
|
|
tags: alloy
|
|
- role: prometheus
|
|
tags: prometheus
|
|
- role: grafana
|
|
tags: grafana
|
|
- role: transmission
|
|
tags: transmission
|
|
- role: transmission_metrics
|
|
tags: transmission_metrics
|
|
- role: kiwix
|
|
tags: kiwix
|
|
- role: borgmatic
|
|
tags: borgmatic
|
|
- role: forgejo
|
|
tags: forgejo
|
|
- role: devpi
|
|
tags: devpi
|
|
- role: devpi_metrics
|
|
tags: devpi_metrics
|
|
- role: plex_metrics
|
|
tags: plex_metrics
|
|
- role: postgresql
|
|
tags: postgresql
|
|
- role: miniflux
|
|
tags: miniflux
|
|
- role: tailscale_serve
|
|
tags: tailscale-serve
|