mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-10-31 19:11:03 +00:00
Rasmus "Pez" Wejlgaard
7683f8c7ea
* Install Grafana Alloy from Ansible (PESO-158) copenhagen-a came back from its Proxmox repave with no Alloy at all, so it's been unmonitored since. Nothing in this repo installs Alloy — every host got it from Grafana's onboarding one-liner, and the common role only bolted on a resilience drop-in if the unit already happened to exist. A rebuild silently loses monitoring. New alloy role owns the whole thing: the Grafana apt repo, the package, the config, the credentials drop-in and the resilience override. Runs on every host, so this can't happen again on the next repave. Moved the resilience drop-in out of common into the role that owns Alloy. The rendered config is byte-identical to what's on the hosts today apart from the managed-by header, so the only effect on the healthy hosts is one restart. * Pin Alloy to 1.19.2-1 and add the Grafana Cloud key to SOPS Adding the apt repo means the fleet is upgradable for the first time, so pin the version explicitly rather than letting copenhagen-a come up five minor versions ahead of everyone else. All six hosts land on 1.19.2-1. Checked the 1.14 -> 1.19 changelog against what we actually run. Nothing breaking touches the bootstrap config or the fleet pipelines; the only entry that lands anywhere near us is 1.18.0 giving otelcol.receiver.otlp upstream default timeouts, which affects the Caddy tracing pipeline on helsinki-a and sets no timeouts explicitly today.
74 lines
1.7 KiB
YAML
74 lines
1.7 KiB
YAML
---
|
|
# deploy.yml — One-command host rebuild
|
|
#
|
|
# Rebuilds a host from bare metal to fully configured using repo state.
|
|
# Assumes: SSH access via Tailscale, root user, host is in inventory.
|
|
#
|
|
# Usage:
|
|
# Full fleet: ansible-playbook deploy.yml
|
|
# Single host: ansible-playbook deploy.yml --limit helsinki-a
|
|
# Dry run: ansible-playbook deploy.yml --check --diff
|
|
# Services only (skip baseline): ansible-playbook deploy.yml --tags services
|
|
#
|
|
# Prerequisites:
|
|
# - Target host has SSH access via Tailscale
|
|
# - Target host has a base OS installed (Debian)
|
|
# - ansible-galaxy install -r requirements.yml
|
|
|
|
- name: Common baseline
|
|
hosts: all
|
|
tags: [common, baseline]
|
|
roles:
|
|
- role: common
|
|
- role: dotfiles
|
|
|
|
- name: Grafana Alloy
|
|
hosts: all
|
|
tags: [common, baseline, alloy]
|
|
roles:
|
|
- role: alloy
|
|
|
|
- name: Docker engine
|
|
hosts: docker_hosts
|
|
tags: [docker]
|
|
roles:
|
|
- role: docker
|
|
|
|
- name: Caddy + status page (helsinki-a)
|
|
hosts: helsinki-a
|
|
tags: [services, caddy, status_page]
|
|
roles:
|
|
- role: caddy
|
|
- role: status_page
|
|
- role: systemd_services
|
|
|
|
- name: Docker services
|
|
hosts: docker_hosts
|
|
tags: [services, docker_services]
|
|
roles:
|
|
- role: docker_services
|
|
|
|
- name: Mail — poste.io (nuremberg-a)
|
|
hosts: nuremberg-a
|
|
tags: [services, mail]
|
|
roles:
|
|
- role: docker_services
|
|
|
|
- name: Media stack + backups (london-b)
|
|
hosts: london-b
|
|
tags: [services, london-b]
|
|
roles:
|
|
- role: media_stack
|
|
- role: backup
|
|
|
|
- name: Proxmox VE (london-a, copenhagen-a)
|
|
hosts: proxmox_hosts
|
|
tags: [services, proxmox]
|
|
roles:
|
|
- role: proxmox_ve
|
|
|
|
- name: ZFS scrub scheduling
|
|
hosts: zfs_hosts
|
|
tags: [services, zfs]
|
|
roles:
|
|
- role: zfs
|