.github/workflows/deploy-on-merge.yml

@@ -8,75 +8,174 @@ on:
       - 'terraform/**'
 
 # Requires these repository secrets:
-#   TAILSCALE_CLIENT_ID  — Tailscale OAuth client ID (federated identity)
+#   TAILSCALE_AUTHKEY  — Tailscale auth key for mesh access
-#   TAILSCALE_AUDIENCE   — Tailscale federated identity audience
 #   SSH_PRIVATE_KEY    — SSH key authorized on target hosts
 #   AGE_SECRET_KEY     — age private key for SOPS decryption
 
 jobs:
-  discover:
-    name: Discover hosts
-    runs-on: ubuntu-latest
-    outputs:
-      hosts: ${{ steps.discover.outputs.hosts }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Read hosts from inventory
-        id: discover
-        run: |
-          HOSTS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk '{print $1}' | jq -R . | jq -cs .)
-          echo "hosts=$HOSTS" >> "$GITHUB_OUTPUT"
-
   deploy:
-    needs: discover
+    name: Deploy
-    name: Deploy → ${{ matrix.host }}
     runs-on: ubuntu-latest
     environment: production
-    permissions:
-      id-token: write
-    strategy:
-      matrix:
-        host: ${{ fromJson(needs.discover.outputs.hosts) }}
-      fail-fast: false
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Determine deploy scope from changed files
+        id: scope
+        run: |
+          # Get files changed in this push
+          CHANGED=$(git diff --name-only HEAD~1 HEAD)
+          echo "Changed files:"
+          echo "$CHANGED"
+          echo ""
+
+          HOSTS=""
+          DEPLOY_ALL=false
+
+          while IFS= read -r file; do
+            [ -z "$file" ] && continue
+            case "$file" in
+
+              # --- Roles that target ALL hosts → full fleet deploy ---
+              ansible/roles/common/*|ansible/roles/dotfiles/*|ansible/roles/node_exporter/*)
+                DEPLOY_ALL=true ;;
+
+              # --- Playbook, inventory, or requirements → full fleet ---
+              ansible/deploy.yml|ansible/inventory/hosts.ini|ansible/requirements.yml)
+                DEPLOY_ALL=true ;;
+
+              # --- host_vars → that specific host ---
+              ansible/inventory/host_vars/helsinki-a.yml)   HOSTS="$HOSTS helsinki-a" ;;
+              ansible/inventory/host_vars/london-b.yml)     HOSTS="$HOSTS london-b" ;;
+              ansible/inventory/host_vars/london-a.yml)     HOSTS="$HOSTS london-a" ;;
+              ansible/inventory/host_vars/nuremberg-a.yml)  HOSTS="$HOSTS nuremberg-a" ;;
+              ansible/inventory/host_vars/copenhagen-a.yml) HOSTS="$HOSTS copenhagen-a" ;;
+              ansible/inventory/host_vars/copenhagen-c.yml) HOSTS="$HOSTS copenhagen-c" ;;
+
+              # --- Roles → mapped hosts ---
+              ansible/roles/caddy/*|ansible/roles/status_page/*)
+                HOSTS="$HOSTS helsinki-a" ;;
+              ansible/roles/docker/*)
+                HOSTS="$HOSTS helsinki-a london-b nuremberg-a copenhagen-a" ;;
+              ansible/roles/docker_services/*)
+                HOSTS="$HOSTS helsinki-a london-b nuremberg-a copenhagen-a" ;;
+              ansible/roles/media_stack/*|ansible/roles/backup/*)
+                HOSTS="$HOSTS london-b" ;;
+              ansible/roles/firewall_alpine/*)
+                HOSTS="$HOSTS nuremberg-a" ;;
+              ansible/roles/systemd_exporter/*)
+                HOSTS="$HOSTS london-b copenhagen-a" ;;
+              ansible/roles/systemd_services/*)
+                HOSTS="$HOSTS helsinki-a copenhagen-a" ;;
+              ansible/roles/zfs/*)
+                HOSTS="$HOSTS london-a london-b" ;;
+
+              # --- Services → mapped hosts ---
+              # helsinki-a services
+              ansible/services/caddy/*|ansible/services/status-page/*)
+                HOSTS="$HOSTS helsinki-a" ;;
+              ansible/services/authelia/*|ansible/services/forgejo/*|ansible/services/bitwarden/*)
+                HOSTS="$HOSTS helsinki-a" ;;
+              ansible/services/thiswebsitedoesnotexist/*)
+                HOSTS="$HOSTS helsinki-a" ;;
+
+              # london-a services (monitoring)
+              ansible/services/prometheus/*|ansible/services/grafana/*)
+                HOSTS="$HOSTS london-a" ;;
+
+              # london-b services (media/storage)
+              ansible/services/nextcloud-aio/*|ansible/services/jellyseerr/*)
+                HOSTS="$HOSTS london-b" ;;
+              ansible/services/navidrome/*|ansible/services/slskd/*|ansible/services/miniflux/*)
+                HOSTS="$HOSTS london-b" ;;
+              ansible/services/smartctl-exporter/*|ansible/services/plex-exporter/*)
+                HOSTS="$HOSTS london-b" ;;
+              ansible/services/transmission/*|ansible/services/radarr/*|ansible/services/prowlarr/*)
+                HOSTS="$HOSTS london-b" ;;
+              ansible/services/lidarr/*|ansible/services/readarr/*|ansible/services/whisparr/*)
+                HOSTS="$HOSTS london-b" ;;
+              ansible/services/samba/*|ansible/services/vsftpd/*)
+                HOSTS="$HOSTS london-b" ;;
+
+              # nuremberg-a services (mail)
+              ansible/services/poste-io/*)
+                HOSTS="$HOSTS nuremberg-a" ;;
+
+              # copenhagen-a services (gaming)
+              ansible/services/minecraft/*|ansible/services/mangos-*)
+                HOSTS="$HOSTS copenhagen-a" ;;
+
+              # --- Unmapped ansible paths → full fleet as safety fallback ---
+              ansible/*)
+                echo "⚠️  Unmapped path: $file — deploying to all"
+                DEPLOY_ALL=true ;;
+
+              # Non-ansible files (docs, Makefile, etc.) → skip
+              *) ;;
+            esac
+          done <<< "$CHANGED"
+
+          if [ "$DEPLOY_ALL" = "true" ] || [ -z "$HOSTS" ]; then
+            echo "Deploy scope: ALL hosts"
+            echo "limit=" >> "$GITHUB_OUTPUT"
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          else
+            UNIQUE=$(echo "$HOSTS" | tr ' ' '\n' | grep -v '^$' | sort -u | tr '\n' ',' | sed 's/,$//')
+            echo "Deploy scope: --limit $UNIQUE"
+            echo "limit=$UNIQUE" >> "$GITHUB_OUTPUT"
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Set up Tailscale
-        uses: tailscale/github-action@v4
+        if: steps.scope.outputs.skip != 'true'
+        uses: tailscale/github-action@v3
         with:
-          oauth-client-id: ${{ secrets.TAILSCALE_CLIENT_ID }}
+          authkey: ${{ secrets.TAILSCALE_AUTHKEY }}
-          audience: ${{ secrets.TAILSCALE_AUDIENCE }}
-          tags: tag:ci
 
       - name: Set up SSH key
+        if: steps.scope.outputs.skip != 'true'
         run: |
           mkdir -p ~/.ssh
           echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
-          IPS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk -F'ansible_host=' '{print $2}' | awk '{print $1}' | tr '\n' ' ')
+          ssh-keyscan -H 100.67.6.27 100.84.65.101 100.122.219.41 100.117.235.28 100.89.206.60 100.115.45.53 >> ~/.ssh/known_hosts 2>/dev/null || true
-          ssh-keyscan -H $IPS >> ~/.ssh/known_hosts 2>/dev/null || true
 
       - name: Install tools
+        if: steps.scope.outputs.skip != 'true'
         run: |
           pip install ansible
           wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
           sudo dpkg -i /tmp/sops.deb
 
       - name: Install Ansible collections
+        if: steps.scope.outputs.skip != 'true'
         run: ansible-galaxy install -r ansible/requirements.yml
 
       - name: Decrypt secrets
+        if: steps.scope.outputs.skip != 'true'
         env:
           SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
         run: |
+          # Decrypt all .enc. files to their plaintext counterparts
           find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
             out="${f/.enc/}"
             sops -d "$f" > "$out"
+            echo "Decrypted: $f -> $out"
           done
 
       - name: Run playbook
+        if: steps.scope.outputs.skip != 'true'
         working-directory: ansible/
         env:
           ANSIBLE_HOST_KEY_CHECKING: "false"
-        run: ansible-playbook deploy.yml --limit "${{ matrix.host }}"
+        run: |
+          LIMIT="${{ steps.scope.outputs.limit }}"
+          if [ -n "$LIMIT" ]; then
+            echo "🎯 Deploying with --limit $LIMIT"
+            ansible-playbook deploy.yml --limit "$LIMIT"
+          else
+            echo "🌐 Deploying to all hosts"
+            ansible-playbook deploy.yml
+          fi

.github/workflows/deploy.yml

@@ -18,60 +18,29 @@ on:
         default: true
 
 # Requires these repository secrets:
-#   TAILSCALE_CLIENT_ID  — Tailscale OAuth client ID (federated identity)
+#   TAILSCALE_AUTHKEY  — Tailscale auth key for mesh access
-#   TAILSCALE_AUDIENCE   — Tailscale federated identity audience
 #   SSH_PRIVATE_KEY    — SSH key authorized on target hosts
 #   AGE_SECRET_KEY     — age private key for SOPS decryption
 
 jobs:
-  prepare:
-    name: Prepare matrix
-    runs-on: ubuntu-latest
-    outputs:
-      hosts: ${{ steps.prepare.outputs.hosts }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Build host matrix
-        id: prepare
-        run: |
-          ALL_HOSTS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk '{print $1}' | jq -R . | jq -cs .)
-          TARGET="${{ inputs.target }}"
-          if [ "$TARGET" = "all" ]; then
-            echo "hosts=$ALL_HOSTS" >> "$GITHUB_OUTPUT"
-          else
-            JSON=$(echo "$TARGET" | tr ',' '\n' | tr -d ' ' | grep -v '^$' | jq -R . | jq -cs .)
-            echo "hosts=$JSON" >> "$GITHUB_OUTPUT"
-          fi
-
   deploy:
-    needs: prepare
+    name: Deploy to ${{ inputs.target }}
-    name: Deploy ${{ inputs.playbook }} → ${{ matrix.host }}
     runs-on: ubuntu-latest
     environment: production  # requires manual approval in repo settings
-    permissions:
-      id-token: write
-    strategy:
-      matrix:
-        host: ${{ fromJson(needs.prepare.outputs.hosts) }}
-      fail-fast: false
     steps:
       - uses: actions/checkout@v4
 
       - name: Set up Tailscale
-        uses: tailscale/github-action@v4
+        uses: tailscale/github-action@v3
         with:
-          oauth-client-id: ${{ secrets.TAILSCALE_CLIENT_ID }}
+          authkey: ${{ secrets.TAILSCALE_AUTHKEY }}
-          audience: ${{ secrets.TAILSCALE_AUDIENCE }}
-          tags: tag:ci
 
       - name: Set up SSH key
         run: |
           mkdir -p ~/.ssh
           echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
-          IPS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk -F'ansible_host=' '{print $2}' | awk '{print $1}' | tr '\n' ' ')
+          ssh-keyscan -H 100.67.6.27 100.84.65.101 100.122.219.41 100.117.235.28 100.89.206.60 100.115.45.53 >> ~/.ssh/known_hosts 2>/dev/null || true
-          ssh-keyscan -H $IPS >> ~/.ssh/known_hosts 2>/dev/null || true
 
       - name: Install tools
         run: |
@@ -86,9 +55,11 @@ jobs:
         env:
           SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
         run: |
+          # Decrypt all .enc. files to their plaintext counterparts
           find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
             out="${f/.enc/}"
             sops -d "$f" > "$out"
+            echo "Decrypted: $f -> $out"
           done
 
       - name: Run playbook
@@ -97,13 +68,17 @@ jobs:
           ANSIBLE_HOST_KEY_CHECKING: "false"
         run: |
           PLAYBOOK="${{ inputs.playbook }}"
+          # Normalize: strip prefix/suffix, then re-add as needed
           PLAYBOOK="${PLAYBOOK#playbooks/}"
           PLAYBOOK="${PLAYBOOK%.yml}.yml"
           if [ "$PLAYBOOK" != "deploy.yml" ]; then
             PLAYBOOK="playbooks/$PLAYBOOK"
           fi
 
-          ARGS="--limit ${{ matrix.host }}"
+          ARGS=""
+          if [ "${{ inputs.target }}" != "all" ]; then
+            ARGS="--limit ${{ inputs.target }}"
+          fi
           if [ "${{ inputs.dry_run }}" = "true" ]; then
             ARGS="$ARGS --check --diff"
           fi

ansible/services/grafana/dashboards/living-room-display.json

@@ -74,7 +74,7 @@
         "textMode": "auto",
         "wideLayout": true
       },
-            "pluginVersion": "12.4.2",
+      "pluginVersion": "12.1.0",
       "targets": [
         {
           "datasource": {
@@ -98,28 +98,16 @@
       },
       "fieldConfig": {
         "defaults": {
-                    "color": {
+          "custom": {
-                        "mode": "thresholds"
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
             },
-                    "mappings": [],
+            "scaleDistribution": {
-                    "thresholds": {
+              "type": "linear"
-                        "mode": "absolute",
+            }
-                        "steps": [
-                            {
-                                "color": "green",
-                                "value": 0
-                            },
-                            {
-                                "color": "yellow",
-                                "value": 1000
-                            },
-                            {
-                                "color": "red",
-                                "value": 2000
           }
-                        ]
-                    },
-                    "unit": "watt"
         },
         "overrides": []
       },
@@ -129,36 +117,72 @@
         "x": 5,
         "y": 0
       },
-            "id": 14,
+      "id": 8,
       "options": {
-                "colorMode": "value",
+        "calculate": false,
-                "graphMode": "none",
+        "calculation": {
-                "justifyMode": "auto",
+          "yBuckets": {
-                "orientation": "auto",
+            "mode": "size",
-                "percentChangeColorMode": "standard",
+            "scale": {
-                "reduceOptions": {
+              "type": "linear"
-                    "calcs": [
-                        "lastNotNull"
-                    ],
-                    "fields": "",
-                    "values": false
             },
-                "showPercentChange": false,
+            "value": ""
-                "textMode": "auto",
+          }
-                "wideLayout": true
         },
-            "pluginVersion": "12.4.2",
+        "cellGap": 0,
+        "color": {
+          "exponent": 0.5,
+          "fill": "dark-orange",
+          "max": 80,
+          "min": 35,
+          "mode": "scheme",
+          "reverse": false,
+          "scale": "exponential",
+          "scheme": "RdYlGn",
+          "steps": 3
+        },
+        "exemplars": {
+          "color": "rgba(255,0,255,0.7)"
+        },
+        "filterValues": {
+          "le": 1e-09
+        },
+        "legend": {
+          "show": false
+        },
+        "rowsFrame": {
+          "layout": "auto"
+        },
+        "tooltip": {
+          "mode": "single",
+          "showColorScale": false,
+          "yHistogram": false
+        },
+        "yAxis": {
+          "axisLabel": "Temp",
+          "axisPlacement": "left",
+          "decimals": 1,
+          "max": "100",
+          "min": 0,
+          "reverse": false,
+          "unit": "celsius"
+        }
+      },
+      "pluginVersion": "12.1.0",
       "targets": [
         {
           "editorMode": "code",
-                    "expr": "octopus_electricity_demand_watts",
+          "exemplar": false,
-                    "legendFormat": "__auto",
+          "expr": "sum(smartctl_device_temperature) by (device)",
+          "instant": false,
+          "interval": "10m",
+          "legendFormat": "{{device}}",
           "range": true,
           "refId": "A"
         }
       ],
-            "title": "Watts",
+      "title": "Drive Temperature",
-            "type": "stat"
+      "type": "heatmap"
     },
     {
       "datasource": {
@@ -204,14 +228,13 @@
           "fields": "",
           "values": false
         },
-                "sort": "desc",
         "tooltip": {
           "hideZeros": false,
           "mode": "single",
           "sort": "none"
         }
       },
-            "pluginVersion": "12.4.2",
+      "pluginVersion": "12.1.0",
       "targets": [
         {
           "editorMode": "code",
@@ -227,6 +250,7 @@
           },
           "editorMode": "code",
           "expr": "node_filesystem_size_bytes{server=\"london-b\",mountpoint=\"/hdd\"} - node_filesystem_avail_bytes{server=\"london-b\",mountpoint=\"/hdd\"}",
+          "hide": false,
           "legendFormat": "Used",
           "range": true,
           "refId": "B"
@@ -286,7 +310,7 @@
         "textMode": "name",
         "wideLayout": true
       },
-            "pluginVersion": "12.4.2",
+      "pluginVersion": "12.1.0",
       "targets": [
         {
           "editorMode": "code",
@@ -305,6 +329,7 @@
           "editorMode": "code",
           "exemplar": false,
           "expr": "node_zfs_zpool_state{server=\"london-b\",zpool=\"hdd\", state=\"degraded\"} > 0",
+          "hide": false,
           "instant": true,
           "legendFormat": "Degraded",
           "range": false,
@@ -318,6 +343,7 @@
           "editorMode": "code",
           "exemplar": false,
           "expr": "node_zfs_zpool_state{server=\"london-b\",zpool=\"hdd\", state=\"faulted\"} > 0",
+          "hide": false,
           "instant": true,
           "legendFormat": "Faulted",
           "range": false,
@@ -331,6 +357,7 @@
           "editorMode": "code",
           "exemplar": false,
           "expr": "node_zfs_zpool_state{server=\"london-b\",zpool=\"hdd\", state=\"offline\"} > 0",
+          "hide": false,
           "instant": true,
           "legendFormat": "Offline",
           "range": false,
@@ -344,6 +371,7 @@
           "editorMode": "code",
           "exemplar": false,
           "expr": "node_zfs_zpool_state{server=\"london-b\",zpool=\"hdd\", state=\"removed\"} > 0",
+          "hide": false,
           "instant": true,
           "legendFormat": "Removed",
           "range": false,
@@ -357,6 +385,7 @@
           "editorMode": "code",
           "exemplar": false,
           "expr": "node_zfs_zpool_state{server=\"london-b\",zpool=\"hdd\", state=\"suspended\"} > 0",
+          "hide": false,
           "instant": true,
           "legendFormat": "Suspended",
           "range": false,
@@ -370,6 +399,7 @@
           "editorMode": "code",
           "exemplar": false,
           "expr": "node_zfs_zpool_state{server=\"london-b\",zpool=\"hdd\", state=\"unavail\"} > 0",
+          "hide": false,
           "instant": true,
           "legendFormat": "Unavailable",
           "range": false,
@@ -448,7 +478,7 @@
         "textMode": "auto",
         "wideLayout": true
       },
-            "pluginVersion": "12.4.2",
+      "pluginVersion": "12.1.0",
       "targets": [
         {
           "datasource": {
@@ -473,19 +503,38 @@
       "fieldConfig": {
         "defaults": {
           "color": {
-                        "mode": "thresholds"
+            "mode": "continuous-RdYlGr"
           },
+          "custom": {
+            "axisPlacement": "auto",
+            "fillOpacity": 70,
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineWidth": 0,
+            "spanNulls": false
+          },
+          "decimals": 0,
           "mappings": [],
+          "max": 1,
+          "min": 0,
+          "noValue": "0",
           "thresholds": {
             "mode": "absolute",
             "steps": [
               {
                 "color": "green",
                 "value": 0
+              },
+              {
+                "color": "red",
+                "value": 80
               }
             ]
-                    },
+          }
-                    "unit": "currencyGBP"
         },
         "overrides": []
       },
@@ -495,36 +544,36 @@
         "x": 5,
         "y": 5
       },
-            "id": 15,
+      "id": 11,
       "options": {
-                "colorMode": "value",
+        "alignValue": "left",
-                "graphMode": "none",
+        "legend": {
-                "justifyMode": "auto",
+          "displayMode": "list",
-                "orientation": "auto",
+          "placement": "bottom",
-                "percentChangeColorMode": "standard",
+          "showLegend": true
-                "reduceOptions": {
-                    "calcs": [
-                        "lastNotNull"
-                    ],
-                    "fields": "",
-                    "values": false
         },
-                "showPercentChange": false,
+        "mergeValues": false,
-                "textMode": "auto",
+        "rowHeight": 0.9,
-                "wideLayout": true
+        "showValue": "auto",
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
       },
-            "pluginVersion": "12.4.2",
+      "pluginVersion": "12.1.0",
       "targets": [
         {
           "editorMode": "code",
-                    "expr": "octopus_account_balance_pence / 100 * -1",
+          "expr": "smartctl_device_smart_status",
-                    "legendFormat": "__auto",
+          "interval": "10m",
+          "legendFormat": "{{device}}",
           "range": true,
           "refId": "A"
         }
       ],
-            "title": "Octopus Account Bill",
+      "title": "Drive Health",
-            "type": "stat"
+      "type": "state-timeline"
     },
     {
       "datasource": {
@@ -575,7 +624,7 @@
         "textMode": "auto",
         "wideLayout": true
       },
-            "pluginVersion": "12.4.2",
+      "pluginVersion": "12.1.0",
       "targets": [
         {
           "datasource": {
@@ -641,7 +690,7 @@
         "textMode": "auto",
         "wideLayout": true
       },
-            "pluginVersion": "12.4.2",
+      "pluginVersion": "12.1.0",
       "targets": [
         {
           "datasource": {
@@ -674,9 +723,6 @@
               "type": "auto"
             },
             "filterable": false,
-                        "footer": {
-                            "reducers": []
-                        },
             "inspect": false
           },
           "mappings": [
@@ -775,9 +821,17 @@
       "id": 12,
       "options": {
         "cellHeight": "sm",
+        "footer": {
+          "countRows": false,
+          "fields": "",
+          "reducer": [
+            "sum"
+          ],
+          "show": false
+        },
         "showHeader": true
       },
-            "pluginVersion": "12.4.2",
+      "pluginVersion": "12.1.0",
       "targets": [
         {
           "disableTextWrap": false,
@@ -916,7 +970,7 @@
         "textMode": "auto",
         "wideLayout": true
       },
-            "pluginVersion": "12.4.2",
+      "pluginVersion": "12.1.0",
       "targets": [
         {
           "disableTextWrap": false,
@@ -939,7 +993,7 @@
   ],
   "preload": false,
   "refresh": "30s",
-    "schemaVersion": 42,
+  "schemaVersion": 41,
   "tags": [],
   "templating": {
     "list": []
@@ -953,7 +1007,5 @@
   },
   "timezone": "browser",
   "title": "Living Room Display",
-    "uid": "a68bd259-c836-4fad-b33e-98f1a52a5eb9",
+  "uid": "a68bd259-c836-4fad-b33e-98f1a52a5eb9"
-    "version": 19,
-    "weekStart": ""
 }