Logan Cusano
6140dd7b9c
docker-compose.prod.yml: compose merges `ports` by appending, so the prod override left the base file's 8888:8000 and 3000:3000 in place next to the 127.0.0.1-scoped ones. Each container tried to bind its port twice and the second bind failed with "address already in use", so c2-core and frontend could never start. It also meant the localhost-only binding never applied — both ports were published on every interface. Marked both `!override`, the same way mosquitto already used `!reset`. infra/ansible: - add the missing "Reload Caddy" handler; the Deploy Caddyfile task notified a handler that did not exist, which aborts the play - guard mkswap/swapon on whether /swapfile is already active, so a second run does not fail on "mounted" / "Device or resource busy" - git task now updates instead of clone-once, otherwise a re-run redeploys whatever code was on the VM at first clone - vault.yml.example: correct the registry token comment to read-only scope Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
97 lines
2.7 KiB
YAML
97 lines
2.7 KiB
YAML
---
|
|
# Full first-time setup: waits for the VM's startup.sh to finish installing
|
|
# Docker, then deploys the stack. Safe to re-run — all tasks are idempotent.
|
|
#
|
|
# Usage:
|
|
# ansible-playbook -i inventory.ini site.yml --ask-vault-pass
|
|
|
|
- name: Bootstrap + deploy DRB server
|
|
hosts: drb
|
|
become: true
|
|
vars_files:
|
|
- vault.yml
|
|
|
|
pre_tasks:
|
|
- name: Install rsync
|
|
apt:
|
|
name: rsync
|
|
state: present
|
|
update_cache: false
|
|
|
|
- name: Wait for Docker (startup.sh runs async on first boot)
|
|
command: docker info
|
|
register: _docker
|
|
until: _docker.rc == 0
|
|
retries: 30
|
|
delay: 10
|
|
changed_when: false
|
|
|
|
- name: Create 2 GB swap file
|
|
command: fallocate -l 2G /swapfile
|
|
args:
|
|
creates: /swapfile
|
|
|
|
- name: Set swap file permissions
|
|
file:
|
|
path: /swapfile
|
|
mode: "0600"
|
|
|
|
# mkswap refuses to touch a file that is already active as swap, so a
|
|
# re-run would fail here without this guard. The swap file survives
|
|
# reboots via the fstab entry below, so on any second run it IS active.
|
|
- name: Check whether the swap file is already active
|
|
command: swapon --show=NAME --noheadings
|
|
register: _active_swaps
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Format swap file
|
|
command: mkswap /swapfile
|
|
when: "'/swapfile' not in _active_swaps.stdout"
|
|
register: _mkswap
|
|
changed_when: _mkswap.rc == 0
|
|
|
|
# Guarded by the same check as mkswap above. The stderr test alone was not
|
|
# enough: an already-active swap file reports "Device or resource busy",
|
|
# not "already", so the original failed_when never matched it.
|
|
- name: Enable swap
|
|
command: swapon /swapfile
|
|
when: "'/swapfile' not in _active_swaps.stdout"
|
|
register: _swapon
|
|
failed_when: >
|
|
_swapon.rc is defined and _swapon.rc != 0
|
|
and 'already' not in _swapon.stderr
|
|
and 'busy' not in _swapon.stderr
|
|
changed_when: _swapon.rc is defined and _swapon.rc == 0
|
|
|
|
- name: Persist swap in fstab
|
|
lineinfile:
|
|
path: /etc/fstab
|
|
line: "/swapfile none swap sw 0 0"
|
|
state: present
|
|
|
|
- name: Set swappiness to 10 (use swap only under pressure)
|
|
sysctl:
|
|
name: vm.swappiness
|
|
value: "10"
|
|
sysctl_set: true
|
|
state: present
|
|
reload: true
|
|
|
|
- name: Add deploy user to docker group
|
|
user:
|
|
name: "{{ ssh_user }}"
|
|
groups: docker
|
|
append: true
|
|
|
|
- name: Create app directory
|
|
file:
|
|
path: "{{ app_dir }}"
|
|
state: directory
|
|
owner: "{{ ssh_user }}"
|
|
group: "{{ ssh_user }}"
|
|
mode: "0755"
|
|
|
|
roles:
|
|
- deploy
|