Add shared nginx-proxy role; deploy Hermes in Docker; rename Paperclip

nginx-proxy (new role): - Shared nginx + certbot under /opt/nginx, replacing the copies that lived inside the Paperclip compose project - Apps publish via tasks_from: add_vhost (cert marker -> issue cert -> write vhost -> nginx -t -> reload); a vhost that fails nginx -t is rolled back - Certs issued one per domain via Cloudflare DNS challenge; domains registered as marker files in cert-domains/; optional LE staging - Stock nginx.conf plus conf.d (directory mounts, not single-file mounts); catch-all server drops unknown Host/SNI - Containers renamed to nginx and certbot hermes_docker (new role): - Official Hermes image, host networking, gateway and dashboard bound to loopback and published through nginx-proxy - Dashboard login via basic-auth provider, secrets from the vault - Main model set from hermes_model (fantasmic endpoint, key from vault); config.yaml overrides are merged from a 0600 staged file that is removed afterwards, so the key never appears in a command line - Data dir owner-only (HERMES_HOME_MODE=0700) paperclip-docker: - Remove nginx, certbot and docker-compose download tasks; deploy with community.docker.docker_compose_v2 (idempotent, remove_orphans) - Stop passing the Cloudflare token and certbot email to the Paperclip container via env_file - Bind Postgres to 127.0.0.1 (host networking exposed it on all interfaces); stop chowning pgdata, which the postgres image owns - Handler recreates the paperclip service so .env changes apply - Domain m-v.wdw-labs.cloud -> cranium-command.wdw-labs.cloud Playbooks: - Add day1_deploy_nginx_proxy.yml and day1_deploy_hermes_docker.yml - deploy_paperclip_stack.yml: run nginx-proxy before paperclip-docker, CLI-based container checks (no Docker SDK dependency) - Remove deploy-hermes.yml Host vars: add nginx_proxy_certbot_email and nginx_proxy_certbot_staging (staging stays on until the switch to real certs).
2026-09-30 23:12:40 -05:00
1 parent 5b48536c32
commit 881e2e24a8
@@ -1,65 +0,0 @@
-#!/bin/sh
-set -e
-
-DOMAIN="${PAPERCLIP_DOMAIN}"
-CERT_PATH="/etc/letsencrypt/live/${DOMAIN}/fullchain.pem"
-EMAIL="${CERTBOT_EMAIL}"
-TOKEN="${CLOUDFLARE_API_TOKEN}"
-
-# Verify environment variables
-if [ -z "$DOMAIN" ]; then
-    echo "ERROR: PAPERCLIP_DOMAIN not set"
-    exit 1
-fi
-
-if [ -z "$EMAIL" ]; then
-    echo "ERROR: CERTBOT_EMAIL not set"
-    exit 1
-fi
-
-if [ -z "$TOKEN" ]; then
-    echo "ERROR: CLOUDFLARE_API_TOKEN not set"
-    exit 1
-fi
-
-# Check if certificate already exists
-if [ -f "$CERT_PATH" ]; then
-    echo "Certificate for $DOMAIN already exists at $CERT_PATH"
-    exit 0
-fi
-
-echo "Requesting certificate for $DOMAIN via Cloudflare DNS challenge..."
-
-# Create a temporary credentials file (more reliable than env var with certbot)
-CREDS_FILE="/tmp/cloudflare.ini"
-cat > "$CREDS_FILE" << EOF
-dns_cloudflare_api_token = ${TOKEN}
-EOF
-chmod 600 "$CREDS_FILE"
-
-# Request certificate with Cloudflare DNS plugin
-if certbot certonly \
-    --dns-cloudflare \
-    --dns-cloudflare-credentials "$CREDS_FILE" \
-    --agree-tos \
-    --no-eff-email \
-    --email "$EMAIL" \
-    --non-interactive \
-    -d "$DOMAIN"; then
-    echo "Certificate obtained successfully for $DOMAIN"
-else
-    echo "ERROR: Failed to obtain certificate for $DOMAIN"
-    rm -f "$CREDS_FILE"
-    exit 1
-fi
-
-# Clean up credentials file
-rm -f "$CREDS_FILE"
-
-# Verify certificate
-if [ -f "$CERT_PATH" ]; then
-    echo "Certificate verified at $CERT_PATH"
-else
-    echo "ERROR: Certificate not found at $CERT_PATH after successful certbot run"
-    exit 1
-fi
@@ -3,6 +3,8 @@ services:
    image: postgres:16-alpine
    container_name: paperclip-db
    network_mode: host
+    # network_mode: host would otherwise expose Postgres on every interface
+    command: ["postgres", "-c", "listen_addresses=127.0.0.1"]
    environment:
      POSTGRES_USER: paperclip
      POSTGRES_PASSWORD: paperclip
@@ -23,12 +25,12 @@ services:
    env_file:
      - {{ paperclip_base_path }}/.env
    environment:
-      HOST: "127.0.0.1"
+      HOST: {{ paperclip_listen_host }}
      PAPERCLIP_HOME: /paperclip
      PAPERCLIP_PORT: {{ paperclip_port }}
      PAPERCLIP_PUBLIC_URL: "https://{{ paperclip_domain }}"
      PAPERCLIP_DEPLOYMENT_MODE: "{{ paperclip_deployment_mode }}"
-      PAPERCLIP_DEPLOYMENT_EXPOSURE: "private"
+ #     PAPERCLIP_DEPLOYMENT_EXPOSURE: "private"
      PAPERCLIP_ALLOWED_HOSTNAMES: "{{ paperclip_allowed_hostnames }}"
      DATABASE_URL: "postgresql://paperclip:paperclip@localhost:5432/paperclip"
      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET}
@@ -50,43 +52,3 @@ services:
      timeout: 10s
      retries: 3
      start_period: 60s
-
-  certbot:
-    image: certbot/dns-cloudflare:latest
-    container_name: paperclip-certbot
-    volumes:
-      - {{ paperclip_certs_dir }}:/etc/letsencrypt
-      - {{ paperclip_base_path }}/certbot-init.sh:/certbot-init.sh:ro
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    environment:
-      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN}
-      CERTBOT_EMAIL: ${CERTBOT_EMAIL}
-      PAPERCLIP_DOMAIN: ${PAPERCLIP_DOMAIN}
-    entrypoint: /bin/sh
-    command:
-      - -c
-      - |
-        /certbot-init.sh && while true; do certbot renew --quiet; sleep 12h; done
-    restart: unless-stopped
-
-  nginx:
-    image: nginx:latest
-    container_name: paperclip-nginx
-    network_mode: host
-    volumes:
-      - {{ paperclip_base_path }}/nginx.conf:/etc/nginx/nginx.conf:ro
-      - {{ paperclip_certs_dir }}:/etc/nginx/certs:ro
-    depends_on:
-      - certbot
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:80/"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 30s
-
-volumes:
-  paperclip_data:
-    driver: local
-    
@@ -1,86 +0,0 @@
-user nginx;
-worker_processes auto;
-error_log /var/log/nginx/error.log warn;
-pid /var/run/nginx.pid;
-
-events {
-    worker_connections 1024;
-}
-
-http {
-    include /etc/nginx/mime.types;
-    default_type application/octet-stream;
-
-    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
-                    '$status $body_bytes_sent "$http_referer" '
-                    '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log /var/log/nginx/access.log main;
-
-    sendfile on;
-    tcp_nopush on;
-    tcp_nodelay on;
-    keepalive_timeout 65;
-    types_hash_max_size 2048;
-    client_max_body_size 100M;
-
-    # Redirect HTTP to HTTPS
-    server {
-        listen 80;
-        server_name {{ paperclip_domain }};
-        return 301 https://$server_name$request_uri;
-    }
-
-    # HTTPS server
-    server {
-        listen 443 ssl http2;
-        server_name {{ paperclip_domain }};
-
-        # SSL certificates from certbot
-        ssl_certificate /etc/nginx/certs/live/{{ paperclip_domain }}/fullchain.pem;
-        ssl_certificate_key /etc/nginx/certs/live/{{ paperclip_domain }}/privkey.pem;
-
-        # SSL configuration
-        ssl_protocols TLSv1.2 TLSv1.3;
-        ssl_ciphers HIGH:!aNULL:!MD5;
-        ssl_prefer_server_ciphers on;
-        ssl_session_cache shared:SSL:10m;
-        ssl_session_timeout 10m;
-
-        # Security headers
-        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-
-        location / {
-            proxy_pass http://127.0.0.1:{{ paperclip_port }};
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-Forwarded-Host $server_name;
-            proxy_set_header X-Forwarded-Port $server_port;
-
-            # WebSocket support
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-
-            # Timeouts
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 60s;
-            proxy_read_timeout 60s;
-
-            # Buffering
-            proxy_buffering off;
-            proxy_request_buffering off;
-        }
-
-        # Health check endpoint (no auth)
-        location /health {
-            proxy_pass http://127.0.0.1:{{ paperclip_port }}/health;
-            access_log off;
-        }
-    }
-}
@@ -2,7 +2,7 @@
  "vllm": {
    "type": "api",
    "key": "{{ vault_vllm_api_key }}"
-  }
+  },
  "fantasmic": {
    "type": "api",
    "key": "{{ vault_fantasmic_api_key }}"
@@ -1,9 +1,9 @@
 {
  "$schema": "https://opencode.ai/config.json",
  "provider": {
-    "vllm": {
+    "illuminations": {
      "npm": "@ai-sdk/openai-compatible",
-      "name": "vLLM (Local)",
+      "name": "illuminations",
      "models": {
        "gemma-4-26b": {
          "id": "Gemma-4-26B-A4B-it-AWQ",
@@ -11,9 +11,9 @@
        }
      },
      "options": {
-        "baseURL": "{{ vllm_endpoint }}/v1",
+        "baseURL": "{{ illuminations_endpoint }}/v1",
        "headers": {
-          "Authorization": "Bearer {{ vault_vllm_api_key }}"
+          "Authorization": "Bearer {env:ILLUMINATIONS_API_KEY}"
        }
      }
    }