Logan Cusano
6140dd7b9c
docker-compose.prod.yml: compose merges `ports` by appending, so the prod override left the base file's 8888:8000 and 3000:3000 in place next to the 127.0.0.1-scoped ones. Each container tried to bind its port twice and the second bind failed with "address already in use", so c2-core and frontend could never start. It also meant the localhost-only binding never applied — both ports were published on every interface. Marked both `!override`, the same way mosquitto already used `!reset`. infra/ansible: - add the missing "Reload Caddy" handler; the Deploy Caddyfile task notified a handler that did not exist, which aborts the play - guard mkswap/swapon on whether /swapfile is already active, so a second run does not fail on "mounted" / "Device or resource busy" - git task now updates instead of clone-once, otherwise a re-run redeploys whatever code was on the VM at first clone - vault.yml.example: correct the registry token comment to read-only scope Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
85 lines
2.2 KiB
YAML
85 lines
2.2 KiB
YAML
---
|
|
# First-time setup: clone repo, write secrets, pull pre-built images and start stack.
|
|
# Images are built and pushed by Gitea CI — this role never builds on the VM.
|
|
|
|
# update: true (was false) — with update disabled, every re-run of this playbook
|
|
# redeployed the code that happened to be on the VM at first clone, so any fix
|
|
# pushed to main was invisible here and the only way to ship one was CI or a
|
|
# manual pull. force: true discards local edits made on the VM; the templated
|
|
# .env files and Caddyfile live outside git tracking, so nothing generated by
|
|
# this role is at risk.
|
|
- name: Clone or update repo
|
|
git:
|
|
repo: "{{ repo_url }}"
|
|
dest: "{{ app_dir }}"
|
|
version: main
|
|
update: true
|
|
force: true
|
|
become: false
|
|
|
|
- name: Set ownership of app directory
|
|
file:
|
|
path: "{{ app_dir }}"
|
|
state: directory
|
|
owner: "{{ ssh_user }}"
|
|
group: "{{ ssh_user }}"
|
|
recurse: true
|
|
|
|
- name: Template top-level .env (docker-compose MQTT creds + registry)
|
|
template:
|
|
src: root.env.j2
|
|
dest: "{{ app_dir }}/.env"
|
|
owner: "{{ ssh_user }}"
|
|
group: "{{ ssh_user }}"
|
|
mode: "0600"
|
|
|
|
- name: Template c2-core .env
|
|
template:
|
|
src: c2-core.env.j2
|
|
dest: "{{ app_dir }}/drb-c2-core/.env"
|
|
owner: "{{ ssh_user }}"
|
|
group: "{{ ssh_user }}"
|
|
mode: "0600"
|
|
|
|
- name: Template discord-bot .env
|
|
template:
|
|
src: discord-bot.env.j2
|
|
dest: "{{ app_dir }}/drb-server-discord-bot/.env"
|
|
owner: "{{ ssh_user }}"
|
|
group: "{{ ssh_user }}"
|
|
mode: "0600"
|
|
|
|
- name: Template frontend .env
|
|
template:
|
|
src: frontend.env.j2
|
|
dest: "{{ app_dir }}/drb-frontend/.env"
|
|
owner: "{{ ssh_user }}"
|
|
group: "{{ ssh_user }}"
|
|
mode: "0600"
|
|
|
|
- name: Deploy Caddyfile
|
|
template:
|
|
src: Caddyfile.j2
|
|
dest: /etc/caddy/Caddyfile
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Reload Caddy
|
|
|
|
- name: Log in to container registry
|
|
command: >
|
|
docker login {{ vault_registry_host }}
|
|
-u {{ vault_registry_user }}
|
|
-p {{ vault_registry_token }}
|
|
no_log: true
|
|
|
|
- name: Pull pre-built images and start stack
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ app_dir }}"
|
|
files:
|
|
- docker-compose.yml
|
|
- docker-compose.prod.yml
|
|
pull: always
|
|
build: never
|
|
state: present
|