rblundon
881e2e24a8
nginx-proxy (new role): - Shared nginx + certbot under /opt/nginx, replacing the copies that lived inside the Paperclip compose project - Apps publish via tasks_from: add_vhost (cert marker -> issue cert -> write vhost -> nginx -t -> reload); a vhost that fails nginx -t is rolled back - Certs issued one per domain via Cloudflare DNS challenge; domains registered as marker files in cert-domains/; optional LE staging - Stock nginx.conf plus conf.d (directory mounts, not single-file mounts); catch-all server drops unknown Host/SNI - Containers renamed to nginx and certbot hermes_docker (new role): - Official Hermes image, host networking, gateway and dashboard bound to loopback and published through nginx-proxy - Dashboard login via basic-auth provider, secrets from the vault - Main model set from hermes_model (fantasmic endpoint, key from vault); config.yaml overrides are merged from a 0600 staged file that is removed afterwards, so the key never appears in a command line - Data dir owner-only (HERMES_HOME_MODE=0700) paperclip-docker: - Remove nginx, certbot and docker-compose download tasks; deploy with community.docker.docker_compose_v2 (idempotent, remove_orphans) - Stop passing the Cloudflare token and certbot email to the Paperclip container via env_file - Bind Postgres to 127.0.0.1 (host networking exposed it on all interfaces); stop chowning pgdata, which the postgres image owns - Handler recreates the paperclip service so .env changes apply - Domain m-v.wdw-labs.cloud -> cranium-command.wdw-labs.cloud Playbooks: - Add day1_deploy_nginx_proxy.yml and day1_deploy_hermes_docker.yml - deploy_paperclip_stack.yml: run nginx-proxy before paperclip-docker, CLI-based container checks (no Docker SDK dependency) - Remove deploy-hermes.yml Host vars: add nginx_proxy_certbot_email and nginx_proxy_certbot_staging (staging stays on until the switch to real certs).
83 lines
2.9 KiB
YAML
83 lines
2.9 KiB
YAML
---
|
|
- name: Deploy Paperclip stack (behind the shared nginx-proxy)
|
|
hosts: illuminations
|
|
become: true
|
|
vars_files:
|
|
- "{{ playbook_dir }}/../group_vars/all/vars"
|
|
- "{{ playbook_dir }}/../group_vars/all/vault"
|
|
|
|
roles:
|
|
- docker-host
|
|
- nginx-proxy # must come before paperclip-docker (it publishes its vhost through it)
|
|
- paperclip-docker
|
|
|
|
post_tasks:
|
|
# CLI-based on purpose: community.docker.docker_container_info needs the
|
|
# Docker SDK for Python, which the paperclip-docker role no longer installs.
|
|
- name: Verify stack containers are running
|
|
ansible.builtin.command: "docker inspect -f '{% raw %}{{.State.Running}}{% endraw %}' {{ item }}"
|
|
register: container_status
|
|
loop:
|
|
- paperclip-db
|
|
- paperclip
|
|
- nginx
|
|
- certbot
|
|
changed_when: false
|
|
failed_when: container_status.rc != 0 or container_status.stdout | trim != 'true'
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
|
|
- name: Verify Docker is available
|
|
ansible.builtin.command: docker --version
|
|
register: docker_version
|
|
changed_when: false
|
|
|
|
- name: Show Docker version
|
|
ansible.builtin.debug:
|
|
msg: "Docker version: {{ docker_version.stdout }}"
|
|
|
|
- name: Verify docker-compose plugin is available
|
|
ansible.builtin.command: docker compose version
|
|
register: compose_version
|
|
changed_when: false
|
|
ignore_errors: true
|
|
|
|
- name: Show docker-compose version
|
|
ansible.builtin.debug:
|
|
msg: "Docker Compose version: {{ compose_version.stdout | default('docker-compose plugin not found') }}"
|
|
|
|
- name: Display deployment summary
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
Paperclip stack deployed successfully!
|
|
|
|
Access points:
|
|
- HTTPS: https://{{ paperclip_domain }}
|
|
- HTTP (redirects to HTTPS): http://{{ paperclip_domain }}
|
|
|
|
Services:
|
|
- Paperclip: {{ paperclip_host }}:{{ paperclip_port }}
|
|
- nginx (shared reverse proxy): 0.0.0.0:443 / 0.0.0.0:80, config in {{ nginx_proxy_conf_dir }}
|
|
- certbot: Running certificate renewal checks
|
|
|
|
Data location:
|
|
- {{ paperclip_base_path }}/data
|
|
|
|
Certificates:
|
|
- {{ nginx_proxy_certs_dir }}/live/{{ paperclip_domain }}/
|
|
|
|
vLLM endpoint:
|
|
- {{ vllm_endpoint }}
|
|
|
|
OpenCode configuration:
|
|
- Config: {{ paperclip_base_path }}/.config/opencode/opencode.jsonc
|
|
- Model: Gemma-4-26B (AWQ)
|
|
- Endpoint: {{ vllm_endpoint }}/v1
|
|
|
|
Next steps:
|
|
1. Verify DNS resolution for {{ paperclip_domain }}
|
|
2. Visit https://{{ paperclip_domain }} to access Paperclip
|
|
3. OpenCode should auto-initialize with vLLM at {{ vllm_endpoint }}
|
|
4. Run day1_deploy_hermes_docker.yml (publishes its dashboard through the same nginx)
|
|
5. Configure agents and skills
|