multica deployment

ansible/group_vars/multica/vars.yml

@@ -0,0 +1,12 @@
+---
+# Single-origin layout: one hostname, Caddy routes /health, /ws, /api/daemon/ws to the backend
+multica_layout: single
+multica_domain: muppet-vision.wdw-labs.cloud
+
+# TLS: acme_http | cloudflare_dns | internal
+caddy_tls_mode: cloudflare_dns
+caddy_acme_email: "ryan.blundon@protonmail.com"
+
+# Pin for reproducible deploys (git tag + matching image tag)
+# multica_version: v0.4.5
+# multica_image_tag: v0.4.5

ansible/group_vars/multica/vault.yml.example

@@ -0,0 +1,8 @@
+---
+# Copy to vault.yml and encrypt:  ansible-vault encrypt group_vars/multica/vault.yml
+# Generate secrets with:  openssl rand -hex 32   (postgres: openssl rand -hex 16)
+vault_multica_jwt_secret: "CHANGEME"
+vault_multica_postgres_password: "CHANGEME"
+vault_multica_vcs_secret_key: "CHANGEME"
+vault_cloudflare_api_token: "CHANGEME"          # only for caddy_tls_mode: cloudflare_dns
+# vault_multica_resend_api_key: ""              # optional: email verification codes