Fix prod compose port collision and make ansible deploy re-runnable

docker-compose.prod.yml: compose merges `ports` by appending, so the prod override left the base file's 8888:8000 and 3000:3000 in place next to the 127.0.0.1-scoped ones. Each container tried to bind its port twice and the second bind failed with "address already in use", so c2-core and frontend could never start. It also meant the localhost-only binding never applied — both ports were published on every interface. Marked both `!override`, the same way mosquitto already used `!reset`. infra/ansible: - add the missing "Reload Caddy" handler; the Deploy Caddyfile task notified a handler that did not exist, which aborts the play - guard mkswap/swapon on whether /swapfile is already active, so a second run does not fail on "mounted" / "Device or resource busy" - git task now updates instead of clone-once, otherwise a re-run redeploys whatever code was on the VM at first clone - vault.yml.example: correct the registry token comment to read-only scope Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-09 21:19:03 -04:00
parent 2e3fde2448
commit 6140dd7b9c
5 changed files with 56 additions and 7 deletions
@@ -22,7 +22,14 @@ vault_firestore_database: "c2-server"
 # ── Gitea Container Registry ──────────────────────────────────────────────────
 vault_registry_host: "git.vpn.cusano.net"
 vault_registry_user: "logan"
-vault_registry_token: ""                                   # Gitea access token with package:write scope
+vault_registry_token: ""                                   # Gitea access token, READ-ONLY package scope.
+                                                           # The VM only pulls (roles/deploy/tasks/main.yml:62-72);
+                                                           # nothing here pushes. Pushing is CI's job and uses a
+                                                           # separate write-scoped token (BUILD_TOKEN in Gitea
+                                                           # repo secrets). Keep them separate: this token sits on
+                                                           # an internet-facing VM, and a write-scoped one there
+                                                           # would let an attacker publish a poisoned image that
+                                                           # every future deploy and edge node would install.
 vault_registry: "git.vpn.cusano.net/logan"                # full image prefix

 # ── Discord Bot ───────────────────────────────────────────────────────────────