feat: Add paperclip-docker Ansible role for RTX 3090

Deploy Paperclip AI with PostgreSQL, nginx reverse proxy, and Cloudflare SSL/TLS on illuminations.wdw-labs.cloud. Configured for local_trusted mode (LAN-only, no auth) with host networking and auto-generated secrets. Stack: PostgreSQL 16 + Paperclip + nginx + certbot Hostname: muppet-vision.wdw-labs.cloud vLLM endpoint: localhost:8000 (DeepSeek-R1-32B Q4)
2026-09-27 16:47:04 -05:00
1 parent 8778a3bbb0
commit f701ad823f
@@ -0,0 +1,136 @@
+---
+- name: Install Docker SDK for Python
+  apt:
+    name: python3-docker
+    state: present
+  become: yes
+
+- name: Download latest docker-compose from GitHub
+  shell: |
+    curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+    chmod +x /usr/local/bin/docker-compose
+  become: yes
+
+- name: Verify docker-compose installation
+  shell: /usr/local/bin/docker-compose --version
+  register: compose_version
+  become: yes
+
+- name: Show docker-compose version
+  debug:
+    msg: "{{ compose_version.stdout }}"
+
+- name: Create paperclip directories
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0755'
+    owner: root
+    group: root
+  loop:
+    - "{{ paperclip_base_path }}"
+    - "{{ paperclip_data_dir }}"
+    - "{{ paperclip_certs_dir }}"
+    - "{{ paperclip_base_path }}/pgdata"
+  become: yes
+
+- name: Generate BETTER_AUTH_SECRET
+  shell: openssl rand -hex 24
+  register: better_auth_secret
+  changed_when: false
+  no_log: yes
+
+- name: Generate PAPERCLIP_AGENT_JWT_SECRET
+  shell: openssl rand -hex 24
+  register: paperclip_jwt_secret
+  changed_when: false
+  no_log: yes
+
+- name: Write secrets and configuration to .env
+  copy:
+    content: |
+      # Authentication secrets (auto-generated during deployment)
+      BETTER_AUTH_SECRET={{ better_auth_secret.stdout }}
+      PAPERCLIP_AGENT_JWT_SECRET={{ paperclip_jwt_secret.stdout }}
+      
+      # Infrastructure configuration
+      CLOUDFLARE_API_TOKEN={{ vault_cloudflare_api_token }}
+      CERTBOT_EMAIL={{ certbot_email }}
+      PAPERCLIP_DOMAIN={{ paperclip_domain }}
+      VLLM_ENDPOINT={{ vllm_endpoint }}
+    dest: "{{ paperclip_base_path }}/.env"
+    mode: '0600'
+    owner: root
+    group: root
+  become: yes
+  no_log: yes
+
+- name: Template docker-compose.yml
+  template:
+    src: docker-compose.yml.j2
+    dest: "{{ paperclip_base_path }}/docker-compose.yml"
+    mode: '0644'
+    owner: root
+    group: root
+  become: yes
+  notify: Restart paperclip stack
+
+- name: Template nginx config
+  template:
+    src: nginx.conf.j2
+    dest: "{{ paperclip_base_path }}/nginx.conf"
+    mode: '0644'
+    owner: root
+    group: root
+  become: yes
+  notify: Reload nginx
+
+- name: Template certbot init script
+  template:
+    src: certbot-init.sh.j2
+    dest: "{{ paperclip_base_path }}/certbot-init.sh"
+    mode: '0755'
+    owner: root
+    group: root
+  become: yes
+
+- name: Stop and remove old containers
+  shell: |
+    cd {{ paperclip_base_path }}
+    /usr/local/bin/docker-compose down -v --remove-orphans 2>/dev/null || true
+  become: yes
+  ignore_errors: yes
+
+- name: Deploy docker compose stack
+  shell: |
+    cd {{ paperclip_base_path }}
+    /usr/local/bin/docker-compose up -d
+  become: yes
+  register: compose_result
+
+- name: Wait for Paperclip to be ready
+  uri:
+    url: "http://localhost:{{ paperclip_port }}/health"
+    status_code: 200
+  register: result
+  until: result.status == 200
+  retries: 30
+  delay: 5
+  ignore_errors: yes
+
+- name: Wait for nginx to be ready
+  uri:
+    url: "https://{{ paperclip_domain }}/"
+    validate_certs: no
+    status_code: [200, 301, 302]
+  register: result
+  until: result.status in [200, 301, 302]
+  retries: 30
+  delay: 5
+  ignore_errors: yes
+
+- name: Verify Paperclip is accessible via https
+  debug:
+    msg: "Paperclip is accessible at https://{{ paperclip_domain }}"
+  when: result.status is defined and result.status in [200, 301, 302]
+