rblundon
881e2e24a8
nginx-proxy (new role): - Shared nginx + certbot under /opt/nginx, replacing the copies that lived inside the Paperclip compose project - Apps publish via tasks_from: add_vhost (cert marker -> issue cert -> write vhost -> nginx -t -> reload); a vhost that fails nginx -t is rolled back - Certs issued one per domain via Cloudflare DNS challenge; domains registered as marker files in cert-domains/; optional LE staging - Stock nginx.conf plus conf.d (directory mounts, not single-file mounts); catch-all server drops unknown Host/SNI - Containers renamed to nginx and certbot hermes_docker (new role): - Official Hermes image, host networking, gateway and dashboard bound to loopback and published through nginx-proxy - Dashboard login via basic-auth provider, secrets from the vault - Main model set from hermes_model (fantasmic endpoint, key from vault); config.yaml overrides are merged from a 0600 staged file that is removed afterwards, so the key never appears in a command line - Data dir owner-only (HERMES_HOME_MODE=0700) paperclip-docker: - Remove nginx, certbot and docker-compose download tasks; deploy with community.docker.docker_compose_v2 (idempotent, remove_orphans) - Stop passing the Cloudflare token and certbot email to the Paperclip container via env_file - Bind Postgres to 127.0.0.1 (host networking exposed it on all interfaces); stop chowning pgdata, which the postgres image owns - Handler recreates the paperclip service so .env changes apply - Domain m-v.wdw-labs.cloud -> cranium-command.wdw-labs.cloud Playbooks: - Add day1_deploy_nginx_proxy.yml and day1_deploy_hermes_docker.yml - deploy_paperclip_stack.yml: run nginx-proxy before paperclip-docker, CLI-based container checks (no Docker SDK dependency) - Remove deploy-hermes.yml Host vars: add nginx_proxy_certbot_email and nginx_proxy_certbot_staging (staging stays on until the switch to real certs).
32 lines
1.6 KiB
YAML
32 lines
1.6 KiB
YAML
---
|
|
# Paperclip deployment paths and configuration
|
|
paperclip_base_path: /opt/paperclip
|
|
paperclip_data_dir: "{{ paperclip_base_path }}/data"
|
|
paperclip_port: 3100
|
|
paperclip_domain: cranium-command.wdw-labs.cloud
|
|
paperclip_host: cranium-command.wdw-labs.cloud
|
|
# paperclip_listen_host: 127.0.0.1 # Bootstrap local deployment
|
|
paperclip_listen_host: 0.0.0.0 # Switch to this host after CEO is functional on local model
|
|
|
|
# Paperclip allowed hostnames (space or comma-separated)
|
|
# Includes: domain name, localhost (for internal/local access), and client IP
|
|
paperclip_allowed_hostnames: "{{ paperclip_domain }} localhost 192.168.10.50"
|
|
|
|
# Deployment mode: authenticated (requires login) or local_trusted (no auth, trusted network)
|
|
# paperclip_deployment_mode: "local_trusted" # Bootstrap local deployment
|
|
paperclip_deployment_mode: "authenticated" # Switch to this model after CEO is functional on local model
|
|
|
|
# TLS / reverse proxy are handled by the nginx-proxy role (/opt/nginx).
|
|
# Set nginx_proxy_certbot_email in host_vars; run day1_deploy_nginx_proxy.yml first.
|
|
|
|
# Inference endpoints (vLLM or remote OpenAI-compatible)
|
|
illuminations_endpoint: "http://illuminations:8000"
|
|
fantasmic_endpoint: "http://fantasmic.wdw-labs.cloud:8000"
|
|
wishes_endpoint: "http://wishes.wdw-labs.cloud:8000"
|
|
|
|
# NOTE: Secrets come from the ansible vault and are written to .env (mode 0600):
|
|
# vault_better_auth_secret, vault_paperclip_agent_jwt_secret,
|
|
# vault_illuminations_api_key, vault_fantasmic_api_key
|
|
# Everything in .env is passed into the Paperclip container (env_file), so only
|
|
# put values here that Paperclip itself should be able to read.
|