Compare commits

...

3 commits

Author SHA1 Message Date
1c6784eade
fix: replace tailscale authkey use with oauth (#76)
Some checks are pending
Deploy (on merge) / Discover hosts (push) Waiting to run
Deploy (on merge) / Deploy → (push) Blocked by required conditions
2026-04-26 17:30:15 +01:00
e9fbd41cb4
fix: deploy using a matrix (#75) 2026-04-26 14:35:12 +01:00
10bb940f87
fix: update living room dashboard (#74) 2026-04-26 14:09:09 +01:00
3 changed files with 1022 additions and 1148 deletions

View file

@ -8,174 +8,75 @@ on:
- 'terraform/**'
# Requires these repository secrets:
# TAILSCALE_AUTHKEY — Tailscale auth key for mesh access
# TAILSCALE_CLIENT_ID — Tailscale OAuth client ID (federated identity)
# TAILSCALE_AUDIENCE — Tailscale federated identity audience
# SSH_PRIVATE_KEY — SSH key authorized on target hosts
# AGE_SECRET_KEY — age private key for SOPS decryption
jobs:
deploy:
name: Deploy
discover:
name: Discover hosts
runs-on: ubuntu-latest
environment: production
outputs:
hosts: ${{ steps.discover.outputs.hosts }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 2
- name: Determine deploy scope from changed files
id: scope
- name: Read hosts from inventory
id: discover
run: |
# Get files changed in this push
CHANGED=$(git diff --name-only HEAD~1 HEAD)
echo "Changed files:"
echo "$CHANGED"
echo ""
HOSTS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk '{print $1}' | jq -R . | jq -cs .)
echo "hosts=$HOSTS" >> "$GITHUB_OUTPUT"
HOSTS=""
DEPLOY_ALL=false
while IFS= read -r file; do
[ -z "$file" ] && continue
case "$file" in
# --- Roles that target ALL hosts → full fleet deploy ---
ansible/roles/common/*|ansible/roles/dotfiles/*|ansible/roles/node_exporter/*)
DEPLOY_ALL=true ;;
# --- Playbook, inventory, or requirements → full fleet ---
ansible/deploy.yml|ansible/inventory/hosts.ini|ansible/requirements.yml)
DEPLOY_ALL=true ;;
# --- host_vars → that specific host ---
ansible/inventory/host_vars/helsinki-a.yml) HOSTS="$HOSTS helsinki-a" ;;
ansible/inventory/host_vars/london-b.yml) HOSTS="$HOSTS london-b" ;;
ansible/inventory/host_vars/london-a.yml) HOSTS="$HOSTS london-a" ;;
ansible/inventory/host_vars/nuremberg-a.yml) HOSTS="$HOSTS nuremberg-a" ;;
ansible/inventory/host_vars/copenhagen-a.yml) HOSTS="$HOSTS copenhagen-a" ;;
ansible/inventory/host_vars/copenhagen-c.yml) HOSTS="$HOSTS copenhagen-c" ;;
# --- Roles → mapped hosts ---
ansible/roles/caddy/*|ansible/roles/status_page/*)
HOSTS="$HOSTS helsinki-a" ;;
ansible/roles/docker/*)
HOSTS="$HOSTS helsinki-a london-b nuremberg-a copenhagen-a" ;;
ansible/roles/docker_services/*)
HOSTS="$HOSTS helsinki-a london-b nuremberg-a copenhagen-a" ;;
ansible/roles/media_stack/*|ansible/roles/backup/*)
HOSTS="$HOSTS london-b" ;;
ansible/roles/firewall_alpine/*)
HOSTS="$HOSTS nuremberg-a" ;;
ansible/roles/systemd_exporter/*)
HOSTS="$HOSTS london-b copenhagen-a" ;;
ansible/roles/systemd_services/*)
HOSTS="$HOSTS helsinki-a copenhagen-a" ;;
ansible/roles/zfs/*)
HOSTS="$HOSTS london-a london-b" ;;
# --- Services → mapped hosts ---
# helsinki-a services
ansible/services/caddy/*|ansible/services/status-page/*)
HOSTS="$HOSTS helsinki-a" ;;
ansible/services/authelia/*|ansible/services/forgejo/*|ansible/services/bitwarden/*)
HOSTS="$HOSTS helsinki-a" ;;
ansible/services/thiswebsitedoesnotexist/*)
HOSTS="$HOSTS helsinki-a" ;;
# london-a services (monitoring)
ansible/services/prometheus/*|ansible/services/grafana/*)
HOSTS="$HOSTS london-a" ;;
# london-b services (media/storage)
ansible/services/nextcloud-aio/*|ansible/services/jellyseerr/*)
HOSTS="$HOSTS london-b" ;;
ansible/services/navidrome/*|ansible/services/slskd/*|ansible/services/miniflux/*)
HOSTS="$HOSTS london-b" ;;
ansible/services/smartctl-exporter/*|ansible/services/plex-exporter/*)
HOSTS="$HOSTS london-b" ;;
ansible/services/transmission/*|ansible/services/radarr/*|ansible/services/prowlarr/*)
HOSTS="$HOSTS london-b" ;;
ansible/services/lidarr/*|ansible/services/readarr/*|ansible/services/whisparr/*)
HOSTS="$HOSTS london-b" ;;
ansible/services/samba/*|ansible/services/vsftpd/*)
HOSTS="$HOSTS london-b" ;;
# nuremberg-a services (mail)
ansible/services/poste-io/*)
HOSTS="$HOSTS nuremberg-a" ;;
# copenhagen-a services (gaming)
ansible/services/minecraft/*|ansible/services/mangos-*)
HOSTS="$HOSTS copenhagen-a" ;;
# --- Unmapped ansible paths → full fleet as safety fallback ---
ansible/*)
echo "⚠️ Unmapped path: $file — deploying to all"
DEPLOY_ALL=true ;;
# Non-ansible files (docs, Makefile, etc.) → skip
*) ;;
esac
done <<< "$CHANGED"
if [ "$DEPLOY_ALL" = "true" ] || [ -z "$HOSTS" ]; then
echo "Deploy scope: ALL hosts"
echo "limit=" >> "$GITHUB_OUTPUT"
echo "skip=false" >> "$GITHUB_OUTPUT"
else
UNIQUE=$(echo "$HOSTS" | tr ' ' '\n' | grep -v '^$' | sort -u | tr '\n' ',' | sed 's/,$//')
echo "Deploy scope: --limit $UNIQUE"
echo "limit=$UNIQUE" >> "$GITHUB_OUTPUT"
echo "skip=false" >> "$GITHUB_OUTPUT"
fi
deploy:
needs: discover
name: Deploy → ${{ matrix.host }}
runs-on: ubuntu-latest
environment: production
permissions:
id-token: write
strategy:
matrix:
host: ${{ fromJson(needs.discover.outputs.hosts) }}
fail-fast: false
steps:
- uses: actions/checkout@v4
- name: Set up Tailscale
if: steps.scope.outputs.skip != 'true'
uses: tailscale/github-action@v3
uses: tailscale/github-action@v4
with:
authkey: ${{ secrets.TAILSCALE_AUTHKEY }}
oauth-client-id: ${{ secrets.TAILSCALE_CLIENT_ID }}
audience: ${{ secrets.TAILSCALE_AUDIENCE }}
tags: tag:ci
- name: Set up SSH key
if: steps.scope.outputs.skip != 'true'
run: |
mkdir -p ~/.ssh
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_ed25519
ssh-keyscan -H 100.67.6.27 100.84.65.101 100.122.219.41 100.117.235.28 100.89.206.60 100.115.45.53 >> ~/.ssh/known_hosts 2>/dev/null || true
IPS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk -F'ansible_host=' '{print $2}' | awk '{print $1}' | tr '\n' ' ')
ssh-keyscan -H $IPS >> ~/.ssh/known_hosts 2>/dev/null || true
- name: Install tools
if: steps.scope.outputs.skip != 'true'
run: |
pip install ansible
wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
sudo dpkg -i /tmp/sops.deb
- name: Install Ansible collections
if: steps.scope.outputs.skip != 'true'
run: ansible-galaxy install -r ansible/requirements.yml
- name: Decrypt secrets
if: steps.scope.outputs.skip != 'true'
env:
SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
run: |
# Decrypt all .enc. files to their plaintext counterparts
find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
out="${f/.enc/}"
sops -d "$f" > "$out"
echo "Decrypted: $f -> $out"
done
- name: Run playbook
if: steps.scope.outputs.skip != 'true'
working-directory: ansible/
env:
ANSIBLE_HOST_KEY_CHECKING: "false"
run: |
LIMIT="${{ steps.scope.outputs.limit }}"
if [ -n "$LIMIT" ]; then
echo "🎯 Deploying with --limit $LIMIT"
ansible-playbook deploy.yml --limit "$LIMIT"
else
echo "🌐 Deploying to all hosts"
ansible-playbook deploy.yml
fi
run: ansible-playbook deploy.yml --limit "${{ matrix.host }}"

View file

@ -18,29 +18,60 @@ on:
default: true
# Requires these repository secrets:
# TAILSCALE_AUTHKEY — Tailscale auth key for mesh access
# TAILSCALE_CLIENT_ID — Tailscale OAuth client ID (federated identity)
# TAILSCALE_AUDIENCE — Tailscale federated identity audience
# SSH_PRIVATE_KEY — SSH key authorized on target hosts
# AGE_SECRET_KEY — age private key for SOPS decryption
jobs:
prepare:
name: Prepare matrix
runs-on: ubuntu-latest
outputs:
hosts: ${{ steps.prepare.outputs.hosts }}
steps:
- uses: actions/checkout@v4
- name: Build host matrix
id: prepare
run: |
ALL_HOSTS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk '{print $1}' | jq -R . | jq -cs .)
TARGET="${{ inputs.target }}"
if [ "$TARGET" = "all" ]; then
echo "hosts=$ALL_HOSTS" >> "$GITHUB_OUTPUT"
else
JSON=$(echo "$TARGET" | tr ',' '\n' | tr -d ' ' | grep -v '^$' | jq -R . | jq -cs .)
echo "hosts=$JSON" >> "$GITHUB_OUTPUT"
fi
deploy:
name: Deploy to ${{ inputs.target }}
needs: prepare
name: Deploy ${{ inputs.playbook }} → ${{ matrix.host }}
runs-on: ubuntu-latest
environment: production # requires manual approval in repo settings
permissions:
id-token: write
strategy:
matrix:
host: ${{ fromJson(needs.prepare.outputs.hosts) }}
fail-fast: false
steps:
- uses: actions/checkout@v4
- name: Set up Tailscale
uses: tailscale/github-action@v3
uses: tailscale/github-action@v4
with:
authkey: ${{ secrets.TAILSCALE_AUTHKEY }}
oauth-client-id: ${{ secrets.TAILSCALE_CLIENT_ID }}
audience: ${{ secrets.TAILSCALE_AUDIENCE }}
tags: tag:ci
- name: Set up SSH key
run: |
mkdir -p ~/.ssh
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_ed25519
ssh-keyscan -H 100.67.6.27 100.84.65.101 100.122.219.41 100.117.235.28 100.89.206.60 100.115.45.53 >> ~/.ssh/known_hosts 2>/dev/null || true
IPS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk -F'ansible_host=' '{print $2}' | awk '{print $1}' | tr '\n' ' ')
ssh-keyscan -H $IPS >> ~/.ssh/known_hosts 2>/dev/null || true
- name: Install tools
run: |
@ -55,11 +86,9 @@ jobs:
env:
SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
run: |
# Decrypt all .enc. files to their plaintext counterparts
find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
out="${f/.enc/}"
sops -d "$f" > "$out"
echo "Decrypted: $f -> $out"
done
- name: Run playbook
@ -68,17 +97,13 @@ jobs:
ANSIBLE_HOST_KEY_CHECKING: "false"
run: |
PLAYBOOK="${{ inputs.playbook }}"
# Normalize: strip prefix/suffix, then re-add as needed
PLAYBOOK="${PLAYBOOK#playbooks/}"
PLAYBOOK="${PLAYBOOK%.yml}.yml"
if [ "$PLAYBOOK" != "deploy.yml" ]; then
PLAYBOOK="playbooks/$PLAYBOOK"
fi
ARGS=""
if [ "${{ inputs.target }}" != "all" ]; then
ARGS="--limit ${{ inputs.target }}"
fi
ARGS="--limit ${{ matrix.host }}"
if [ "${{ inputs.dry_run }}" = "true" ]; then
ARGS="$ARGS --check --diff"
fi

View file

@ -74,7 +74,7 @@
"textMode": "auto",
"wideLayout": true
},
"pluginVersion": "12.1.0",
"pluginVersion": "12.4.2",
"targets": [
{
"datasource": {
@ -98,16 +98,28 @@
},
"fieldConfig": {
"defaults": {
"custom": {
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
"color": {
"mode": "thresholds"
},
"scaleDistribution": {
"type": "linear"
}
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": 0
},
{
"color": "yellow",
"value": 1000
},
{
"color": "red",
"value": 2000
}
]
},
"unit": "watt"
},
"overrides": []
},
@ -117,72 +129,36 @@
"x": 5,
"y": 0
},
"id": 8,
"id": 14,
"options": {
"calculate": false,
"calculation": {
"yBuckets": {
"mode": "size",
"scale": {
"type": "linear"
"colorMode": "value",
"graphMode": "none",
"justifyMode": "auto",
"orientation": "auto",
"percentChangeColorMode": "standard",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"value": ""
}
"showPercentChange": false,
"textMode": "auto",
"wideLayout": true
},
"cellGap": 0,
"color": {
"exponent": 0.5,
"fill": "dark-orange",
"max": 80,
"min": 35,
"mode": "scheme",
"reverse": false,
"scale": "exponential",
"scheme": "RdYlGn",
"steps": 3
},
"exemplars": {
"color": "rgba(255,0,255,0.7)"
},
"filterValues": {
"le": 1e-09
},
"legend": {
"show": false
},
"rowsFrame": {
"layout": "auto"
},
"tooltip": {
"mode": "single",
"showColorScale": false,
"yHistogram": false
},
"yAxis": {
"axisLabel": "Temp",
"axisPlacement": "left",
"decimals": 1,
"max": "100",
"min": 0,
"reverse": false,
"unit": "celsius"
}
},
"pluginVersion": "12.1.0",
"pluginVersion": "12.4.2",
"targets": [
{
"editorMode": "code",
"exemplar": false,
"expr": "sum(smartctl_device_temperature) by (device)",
"instant": false,
"interval": "10m",
"legendFormat": "{{device}}",
"expr": "octopus_electricity_demand_watts",
"legendFormat": "__auto",
"range": true,
"refId": "A"
}
],
"title": "Drive Temperature",
"type": "heatmap"
"title": "Watts",
"type": "stat"
},
{
"datasource": {
@ -228,13 +204,14 @@
"fields": "",
"values": false
},
"sort": "desc",
"tooltip": {
"hideZeros": false,
"mode": "single",
"sort": "none"
}
},
"pluginVersion": "12.1.0",
"pluginVersion": "12.4.2",
"targets": [
{
"editorMode": "code",
@ -250,7 +227,6 @@
},
"editorMode": "code",
"expr": "node_filesystem_size_bytes{server=\"london-b\",mountpoint=\"/hdd\"} - node_filesystem_avail_bytes{server=\"london-b\",mountpoint=\"/hdd\"}",
"hide": false,
"legendFormat": "Used",
"range": true,
"refId": "B"
@ -310,7 +286,7 @@
"textMode": "name",
"wideLayout": true
},
"pluginVersion": "12.1.0",
"pluginVersion": "12.4.2",
"targets": [
{
"editorMode": "code",
@ -329,7 +305,6 @@
"editorMode": "code",
"exemplar": false,
"expr": "node_zfs_zpool_state{server=\"london-b\",zpool=\"hdd\", state=\"degraded\"} > 0",
"hide": false,
"instant": true,
"legendFormat": "Degraded",
"range": false,
@ -343,7 +318,6 @@
"editorMode": "code",
"exemplar": false,
"expr": "node_zfs_zpool_state{server=\"london-b\",zpool=\"hdd\", state=\"faulted\"} > 0",
"hide": false,
"instant": true,
"legendFormat": "Faulted",
"range": false,
@ -357,7 +331,6 @@
"editorMode": "code",
"exemplar": false,
"expr": "node_zfs_zpool_state{server=\"london-b\",zpool=\"hdd\", state=\"offline\"} > 0",
"hide": false,
"instant": true,
"legendFormat": "Offline",
"range": false,
@ -371,7 +344,6 @@
"editorMode": "code",
"exemplar": false,
"expr": "node_zfs_zpool_state{server=\"london-b\",zpool=\"hdd\", state=\"removed\"} > 0",
"hide": false,
"instant": true,
"legendFormat": "Removed",
"range": false,
@ -385,7 +357,6 @@
"editorMode": "code",
"exemplar": false,
"expr": "node_zfs_zpool_state{server=\"london-b\",zpool=\"hdd\", state=\"suspended\"} > 0",
"hide": false,
"instant": true,
"legendFormat": "Suspended",
"range": false,
@ -399,7 +370,6 @@
"editorMode": "code",
"exemplar": false,
"expr": "node_zfs_zpool_state{server=\"london-b\",zpool=\"hdd\", state=\"unavail\"} > 0",
"hide": false,
"instant": true,
"legendFormat": "Unavailable",
"range": false,
@ -478,7 +448,7 @@
"textMode": "auto",
"wideLayout": true
},
"pluginVersion": "12.1.0",
"pluginVersion": "12.4.2",
"targets": [
{
"datasource": {
@ -503,38 +473,19 @@
"fieldConfig": {
"defaults": {
"color": {
"mode": "continuous-RdYlGr"
"mode": "thresholds"
},
"custom": {
"axisPlacement": "auto",
"fillOpacity": 70,
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
},
"insertNulls": false,
"lineWidth": 0,
"spanNulls": false
},
"decimals": 0,
"mappings": [],
"max": 1,
"min": 0,
"noValue": "0",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": 0
},
{
"color": "red",
"value": 80
}
]
}
},
"unit": "currencyGBP"
},
"overrides": []
},
@ -544,36 +495,36 @@
"x": 5,
"y": 5
},
"id": 11,
"id": 15,
"options": {
"alignValue": "left",
"legend": {
"displayMode": "list",
"placement": "bottom",
"showLegend": true
"colorMode": "value",
"graphMode": "none",
"justifyMode": "auto",
"orientation": "auto",
"percentChangeColorMode": "standard",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"mergeValues": false,
"rowHeight": 0.9,
"showValue": "auto",
"tooltip": {
"hideZeros": false,
"mode": "single",
"sort": "none"
}
"showPercentChange": false,
"textMode": "auto",
"wideLayout": true
},
"pluginVersion": "12.1.0",
"pluginVersion": "12.4.2",
"targets": [
{
"editorMode": "code",
"expr": "smartctl_device_smart_status",
"interval": "10m",
"legendFormat": "{{device}}",
"expr": "octopus_account_balance_pence / 100 * -1",
"legendFormat": "__auto",
"range": true,
"refId": "A"
}
],
"title": "Drive Health",
"type": "state-timeline"
"title": "Octopus Account Bill",
"type": "stat"
},
{
"datasource": {
@ -624,7 +575,7 @@
"textMode": "auto",
"wideLayout": true
},
"pluginVersion": "12.1.0",
"pluginVersion": "12.4.2",
"targets": [
{
"datasource": {
@ -690,7 +641,7 @@
"textMode": "auto",
"wideLayout": true
},
"pluginVersion": "12.1.0",
"pluginVersion": "12.4.2",
"targets": [
{
"datasource": {
@ -723,6 +674,9 @@
"type": "auto"
},
"filterable": false,
"footer": {
"reducers": []
},
"inspect": false
},
"mappings": [
@ -821,17 +775,9 @@
"id": 12,
"options": {
"cellHeight": "sm",
"footer": {
"countRows": false,
"fields": "",
"reducer": [
"sum"
],
"show": false
},
"showHeader": true
},
"pluginVersion": "12.1.0",
"pluginVersion": "12.4.2",
"targets": [
{
"disableTextWrap": false,
@ -970,7 +916,7 @@
"textMode": "auto",
"wideLayout": true
},
"pluginVersion": "12.1.0",
"pluginVersion": "12.4.2",
"targets": [
{
"disableTextWrap": false,
@ -993,7 +939,7 @@
],
"preload": false,
"refresh": "30s",
"schemaVersion": 41,
"schemaVersion": 42,
"tags": [],
"templating": {
"list": []
@ -1007,5 +953,7 @@
},
"timezone": "browser",
"title": "Living Room Display",
"uid": "a68bd259-c836-4fad-b33e-98f1a52a5eb9"
"uid": "a68bd259-c836-4fad-b33e-98f1a52a5eb9",
"version": 19,
"weekStart": ""
}