rblundon
881e2e24a8
nginx-proxy (new role): - Shared nginx + certbot under /opt/nginx, replacing the copies that lived inside the Paperclip compose project - Apps publish via tasks_from: add_vhost (cert marker -> issue cert -> write vhost -> nginx -t -> reload); a vhost that fails nginx -t is rolled back - Certs issued one per domain via Cloudflare DNS challenge; domains registered as marker files in cert-domains/; optional LE staging - Stock nginx.conf plus conf.d (directory mounts, not single-file mounts); catch-all server drops unknown Host/SNI - Containers renamed to nginx and certbot hermes_docker (new role): - Official Hermes image, host networking, gateway and dashboard bound to loopback and published through nginx-proxy - Dashboard login via basic-auth provider, secrets from the vault - Main model set from hermes_model (fantasmic endpoint, key from vault); config.yaml overrides are merged from a 0600 staged file that is removed afterwards, so the key never appears in a command line - Data dir owner-only (HERMES_HOME_MODE=0700) paperclip-docker: - Remove nginx, certbot and docker-compose download tasks; deploy with community.docker.docker_compose_v2 (idempotent, remove_orphans) - Stop passing the Cloudflare token and certbot email to the Paperclip container via env_file - Bind Postgres to 127.0.0.1 (host networking exposed it on all interfaces); stop chowning pgdata, which the postgres image owns - Handler recreates the paperclip service so .env changes apply - Domain m-v.wdw-labs.cloud -> cranium-command.wdw-labs.cloud Playbooks: - Add day1_deploy_nginx_proxy.yml and day1_deploy_hermes_docker.yml - deploy_paperclip_stack.yml: run nginx-proxy before paperclip-docker, CLI-based container checks (no Docker SDK dependency) - Remove deploy-hermes.yml Host vars: add nginx_proxy_certbot_email and nginx_proxy_certbot_staging (staging stays on until the switch to real certs).
41 lines
954 B
Python
41 lines
954 B
Python
"""Deep-merge overrides (a JSON file, path in argv[1]) into config.yaml.
|
|
|
|
Run inside the hermes container as the hermes user. Only keys present in the
|
|
overrides are touched. Prints CHANGED when the file was rewritten.
|
|
"""
|
|
import json
|
|
import os
|
|
import sys
|
|
|
|
import yaml
|
|
|
|
PATH = "/opt/data/config.yaml"
|
|
with open(sys.argv[1]) as fh:
|
|
overrides = json.load(fh)
|
|
|
|
if os.path.exists(PATH):
|
|
with open(PATH) as fh:
|
|
current = yaml.safe_load(fh) or {}
|
|
else:
|
|
current = {}
|
|
|
|
|
|
def merge(dst, src):
|
|
changed = False
|
|
for key, val in src.items():
|
|
if isinstance(val, dict) and isinstance(dst.get(key), dict):
|
|
changed |= merge(dst[key], val)
|
|
elif dst.get(key) != val:
|
|
dst[key] = val
|
|
changed = True
|
|
return changed
|
|
|
|
|
|
if merge(current, overrides):
|
|
with open(PATH, "w") as fh:
|
|
yaml.safe_dump(current, fh, sort_keys=False)
|
|
print("CHANGED")
|
|
else:
|
|
print("UNCHANGED")
|
|
sys.exit(0)
|