mirror of https://github.com/RWejlgaard/pez-infra.git synced 2026-05-06 04:14:43 +00:00

History

Rasmus Wejlgaard 4f2145415b Document undocumented services on london-a Audit of london-a rc.conf found several services running but not captured in host_vars or docs: cloudflared, InfluxDB, Redis, PostgreSQL, and libvirtd. - InfluxDB: only _internal db, completely unused - Redis: empty keyspace, unused - PostgreSQL: has pez_vps db from a dead project, needs data review - libvirtd: zero VMs, related to same dead project - cloudflared: running tunnel 168eccae, config now captured Also documented the weekly ZFS scrub cron (Sundays at noon) which is in root's crontab but not ansible-managed. Ref: PESO-101		2026-03-30 20:39:24 +00:00
..
dotfiles	remove pr-test.yml	2026-03-28 13:11:34 +00:00
group_vars/all	initial commit	2026-03-28 12:39:41 +00:00
inventory	Document undocumented services on london-a	2026-03-30 20:39:24 +00:00
playbooks	Add ZFS management role: scrub scheduling and pool monitoring (#18 )	2026-03-29 19:12:42 +01:00
roles	fix: remove docker-compose-v2 before installing docker-compose-plugin	2026-03-30 18:08:50 +00:00
scripts	Capture london-b media stack and systemd services (#19 )	2026-03-29 19:13:48 +01:00
services	Document undocumented services on london-a	2026-03-30 20:39:24 +00:00
.yamllint	ignore all SOPS-encrypted files in yamllint	2026-03-28 18:50:08 +00:00
ansible.cfg	initial commit	2026-03-28 12:39:41 +00:00
deploy.yml	Capture london-b media stack and systemd services (#19 )	2026-03-29 19:13:48 +01:00
Makefile	initial commit	2026-03-28 12:39:41 +00:00
README.md	initial commit	2026-03-28 12:39:41 +00:00
requirements.yml	initial commit	2026-03-28 12:39:41 +00:00

README.md

Ansible — Deploy & Maintain

One-command deploy playbook for rebuilding hosts from repo state.

Quick Start

cd ansible/

# Install dependencies
make deps

# Dry run — see what would change
make deploy-check

# Deploy everything
make deploy

# Deploy a single host
make deploy-host HOST=helsinki-a

Playbooks

Playbook	Purpose	Usage
`deploy.yml`	Full host rebuild from repo	`make deploy` or `--limit <host>`
`playbooks/update-all.yml`	OS package updates (all hosts)	`make update-all`
`playbooks/update-linux.yml`	Linux-only updates (apt + apk)	`make update-linux`
`playbooks/update-freebsd.yml`	FreeBSD-only updates (pkg)	`make update-freebsd`
`playbooks/docker-status.yml`	Show running containers	`make docker-status`
`playbooks/reboot.yml`	Safe reboot with pre-flight	`make reboot HOST=<host>`

Deploy Stages

The deploy playbook runs in stages, each independently taggable:

common — Baseline packages, SSH hardening, fish shell
docker — Docker engine on container hosts
node-exporter — Prometheus monitoring agent on all hosts
services — Per-host service deployment:
- helsinki-a: Caddy reverse proxy
- london-b: Docker Compose services (Nextcloud, Jellyseer, etc.)
- nuremberg-a: poste.io mail
- copenhagen-a: Minecraft + MaNGOS systemd services
- london-a: Prometheus + Grafana (FreeBSD)
verify — Post-deploy health check

Run a single stage: ansible-playbook deploy.yml --tags docker

Roles

Role	Description
`common`	Base packages, SSH hardening, fish shell
`docker`	Docker engine install and setup
`docker-services`	Deploy compose files from `services/`
`dotfiles`	Shell config from `dotfiles/`
`caddy`	Caddy reverse proxy (helsinki-a)
`node-exporter`	Prometheus node_exporter
`systemd-services`	Custom systemd units from `services/`

Inventory

Hosts are grouped by OS and role. All use Tailscale IPs, SSH as root. Per-host variables in inventory/host_vars/<hostname>.yml.

Safety Notes

london-b: Reboot playbook requires interactive confirmation (critical storage)
copenhagen-a: Reboot includes netplan pre-flight check (static IP verification)
All playbooks use ignore_unreachable: true for fleet operations
--check --diff is your friend — always dry-run first on production