ilia
0a937fd1b4
All checks were successful
CI / skip-ci-check (push) Successful in 1m23s
CI / lint-and-test (push) Successful in 1m27s
CI / ansible-validation (push) Successful in 2m59s
CI / secret-scanning (push) Successful in 1m24s
CI / dependency-scan (push) Successful in 1m29s
CI / sast-scan (push) Successful in 2m41s
CI / license-check (push) Successful in 1m27s
CI / vault-check (push) Successful in 2m29s
CI / playbook-test (push) Successful in 2m38s
CI / container-scan (push) Successful in 1m56s
CI / sonar-analysis (push) Successful in 2m33s
CI / workflow-summary (push) Successful in 1m21s
## Summary Improves deployment reliability for app projects and adds support for mirrormatch deployment with Prisma/Next.js requirements. ## Changes ### Core Improvements (affects all app projects) 1. **Deploy Script (`deploy_app.sh.j2`)** - Fixed clone logic to handle non-git directories gracefully - Preserves `.env.*` files during repository clone - Uses temporary directory for initial clone to avoid permission issues - Added `sudo` to systemctl restart commands (appuser needs sudo for service management) 2. **Environment Template (`env.j2`)** - Removed comment lines to prevent `xargs` errors when sourcing env files - Cleaner, more reliable env file format 3. **App Setup Role (`app_setup/tasks/main.yml`)** - Added initial deploy task to run deploy script during first configure - Ensures app is fully deployed before systemd service starts 4. **Configure Playbook (`configure_app.yml`)** - Fixed migrate command precedence: checks `env_def.backend_migrate_cmd` first - Allows per-environment override of migrate commands (e.g., `db:push` for dev/qa) ### Mirrormatch-Specific Configuration - Added `mirrormatch` project definition with dev/qa/prod environments - Configured `backend_migrate_cmd: "npm run db:push"` for dev/qa (no shadow DB needed) - Added `backend_seed_cmd` support for dev/qa environments - Configured NextAuth v5 environment variables (`AUTH_TRUST_HOST`) ### Documentation - Updated `docs/guides/app_stack_proxmox.md` with: - Project-specific configuration examples - Environment file naming notes - Command precedence documentation ## Impact Analysis ### ✅ Backward Compatible - **pote**: No impact (uses separate `pote` role) - **punimTagFE/BE**: Will benefit from improved deploy script, no breaking changes - **mirrormatch**: Uses new features, fully supported ### Project-Specific Configs (isolated) All mirrormatch-specific settings are in `app_projects.mirrormatch` and don't affect other projects: - `backend_migrate_cmd: "npm run db:push"` (per-environment) - `backend_seed_cmd: "npm run db:seed"` (per-environment) - `AUTH_TRUST_HOST: "true"` (in env_vars) ## Testing - ✅ Mirrormatch dev environment successfully deployed - ✅ Service starts correctly after deployment - ✅ Environment variables loaded properly - ✅ Database schema pushed and seeded ## Related Fixes deployment issues encountered during mirrormatch setup: - Non-git directory handling - Env file preservation during clone - Service restart permissions - Prisma migrate vs db:push workflow Reviewed-on: #5
74 lines
2.8 KiB
YAML
74 lines
2.8 KiB
YAML
---
|
|
# Example vault values for Proxmox app projects.
|
|
#
|
|
# Copy required keys into your encrypted vault:
|
|
# make edit-group-vault
|
|
#
|
|
# Never commit real secrets unencrypted.
|
|
|
|
# Proxmox API
|
|
vault_proxmox_host: "10.0.10.201"
|
|
vault_proxmox_user: "root@pam"
|
|
vault_proxmox_node: "pve"
|
|
vault_proxmox_password: "CHANGE_ME"
|
|
|
|
# Optional token auth (recommended if you use it)
|
|
# vault_proxmox_token_id: "root@pam!ansible"
|
|
# vault_proxmox_token: "CHANGE_ME"
|
|
|
|
# SSH public key for appuser (workstation key)
|
|
vault_ssh_public_key: "ssh-ed25519 AAAA... you@example"
|
|
|
|
# LXC create bootstrap password (often required by Proxmox)
|
|
vault_lxc_root_password: "CHANGE_ME"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# POTE (python/venv + cron) secrets
|
|
# -----------------------------------------------------------------------------
|
|
# Private key used for cloning from Gitea (deploy key). Store as a multi-line block.
|
|
vault_pote_git_ssh_key: |
|
|
-----BEGIN OPENSSH PRIVATE KEY-----
|
|
CHANGE_ME
|
|
-----END OPENSSH PRIVATE KEY-----
|
|
|
|
# Environment-specific DB passwords (used by roles/pote)
|
|
vault_pote_db_password_dev: "CHANGE_ME"
|
|
vault_pote_db_password_qa: "CHANGE_ME"
|
|
vault_pote_db_password_prod: "CHANGE_ME"
|
|
|
|
# SMTP password for reports
|
|
vault_pote_smtp_password: "CHANGE_ME"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Mirrormatch (Prisma/Node backend) secrets
|
|
# -----------------------------------------------------------------------------
|
|
# Optional deploy key for private repo access
|
|
vault_mirrormatch_git_ssh_key: |
|
|
-----BEGIN OPENSSH PRIVATE KEY-----
|
|
CHANGE_ME
|
|
-----END OPENSSH PRIVATE KEY-----
|
|
|
|
# Per-environment database URLs (use external Postgres VM/cluster)
|
|
vault_mirrormatch_database_url_dev: "postgresql://mm_dev_user:CHANGE_ME@10.0.10.181:5432/mirrormatch_dev"
|
|
vault_mirrormatch_database_url_qa: "postgresql://mm_qa_user:CHANGE_ME@10.0.10.181:5432/mirrormatch_qa"
|
|
vault_mirrormatch_database_url_prod: "postgresql://mm_prod_user:CHANGE_ME@10.0.10.181:5432/mirrormatch_prod"
|
|
|
|
# Optional shadow DB URLs if your Prisma workflow needs them
|
|
vault_mirrormatch_shadow_database_url_dev: "postgresql://mm_dev_shadow:CHANGE_ME@10.0.10.181:5432/mirrormatch_dev_shadow"
|
|
vault_mirrormatch_shadow_database_url_qa: "postgresql://mm_qa_shadow:CHANGE_ME@10.0.10.181:5432/mirrormatch_qa_shadow"
|
|
vault_mirrormatch_shadow_database_url_prod: "postgresql://mm_prod_shadow:CHANGE_ME@10.0.10.181:5432/mirrormatch_prod_shadow"
|
|
|
|
# NEXTAUTH secrets per env
|
|
vault_mirrormatch_nextauth_secret_dev: "CHANGE_ME"
|
|
vault_mirrormatch_nextauth_secret_qa: "CHANGE_ME"
|
|
vault_mirrormatch_nextauth_secret_prod: "CHANGE_ME"
|
|
|
|
# SMTP (prod)
|
|
vault_mirrormatch_smtp_host: "smtp.example.com"
|
|
vault_mirrormatch_smtp_port: "587"
|
|
vault_mirrormatch_smtp_user: "smtp-user"
|
|
vault_mirrormatch_smtp_password: "CHANGE_ME"
|
|
vault_mirrormatch_smtp_from: "MirrorMatch <noreply@mirrormatch.com>"
|
|
|
|
|