Logan Cusano
6140dd7b9c
docker-compose.prod.yml: compose merges `ports` by appending, so the prod override left the base file's 8888:8000 and 3000:3000 in place next to the 127.0.0.1-scoped ones. Each container tried to bind its port twice and the second bind failed with "address already in use", so c2-core and frontend could never start. It also meant the localhost-only binding never applied — both ports were published on every interface. Marked both `!override`, the same way mosquitto already used `!reset`. infra/ansible: - add the missing "Reload Caddy" handler; the Deploy Caddyfile task notified a handler that did not exist, which aborts the play - guard mkswap/swapon on whether /swapfile is already active, so a second run does not fail on "mounted" / "Device or resource busy" - git task now updates instead of clone-once, otherwise a re-run redeploys whatever code was on the VM at first clone - vault.yml.example: correct the registry token comment to read-only scope Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
48 lines
3.0 KiB
Plaintext
48 lines
3.0 KiB
Plaintext
# Template for your Ansible Vault secrets file.
|
|
# Copy to vault.yml, fill in values, then encrypt:
|
|
# ansible-vault encrypt vault.yml
|
|
# Edit later with:
|
|
# ansible-vault edit vault.yml
|
|
|
|
# ── MQTT ─────────────────────────────────────────────────────────────────────
|
|
vault_mqtt_c2_user: drb-c2-core
|
|
vault_mqtt_c2_pass: "CHANGE_ME"
|
|
vault_mqtt_node_user: drb-node
|
|
vault_mqtt_node_pass: "CHANGE_ME"
|
|
|
|
# ── C2 Core ───────────────────────────────────────────────────────────────────
|
|
vault_service_key: "" # openssl rand -hex 32
|
|
vault_node_api_key: "" # openssl rand -hex 32
|
|
vault_openai_api_key: ""
|
|
vault_google_maps_api_key: ""
|
|
vault_gemini_api_key: ""
|
|
vault_gcs_bucket: "your-gcs-bucket-name"
|
|
vault_firestore_database: "c2-server"
|
|
|
|
# ── Gitea Container Registry ──────────────────────────────────────────────────
|
|
vault_registry_host: "git.vpn.cusano.net"
|
|
vault_registry_user: "logan"
|
|
vault_registry_token: "" # Gitea access token, READ-ONLY package scope.
|
|
# The VM only pulls (roles/deploy/tasks/main.yml:62-72);
|
|
# nothing here pushes. Pushing is CI's job and uses a
|
|
# separate write-scoped token (BUILD_TOKEN in Gitea
|
|
# repo secrets). Keep them separate: this token sits on
|
|
# an internet-facing VM, and a write-scoped one there
|
|
# would let an attacker publish a poisoned image that
|
|
# every future deploy and edge node would install.
|
|
vault_registry: "git.vpn.cusano.net/logan" # full image prefix
|
|
|
|
# ── Discord Bot ───────────────────────────────────────────────────────────────
|
|
vault_discord_token: ""
|
|
|
|
# ── Frontend (Firebase) ───────────────────────────────────────────────────────
|
|
vault_firebase_api_key: ""
|
|
vault_firebase_auth_domain: ""
|
|
vault_firebase_project_id: ""
|
|
vault_firebase_storage_bucket: ""
|
|
vault_firebase_messaging_sender_id: ""
|
|
vault_firebase_app_id: ""
|
|
|
|
# No GCP key needed — the VM uses Application Default Credentials via the
|
|
# GCE metadata server. Terraform grants the required IAM roles at apply time.
|