History

ilia 69a39e5e5b Add POTE app project support and improve IP conflict detection (#3 )

## Summary

This PR adds comprehensive support for deploying the **POTE** application project via Ansible, along with improvements to IP conflict detection and a new app stack provisioning system for Proxmox-managed LXC containers.

## Key Features

### 🆕 New Roles
- **`roles/pote`**: Python/venv deployment role for POTE (PostgreSQL, cron jobs, Alembic migrations)
- **`roles/app_setup`**: Generic app deployment role (Node.js/systemd)
- **`roles/base_os`**: Base OS hardening role

### 🛡️ Safety Improvements
- IP uniqueness validation within projects
- Proxmox-side IP conflict detection
- Enhanced error messages for IP conflicts

### 📦 New Playbooks
- `playbooks/app/site.yml`: End-to-end app stack deployment
- `playbooks/app/provision_vms.yml`: Proxmox guest provisioning
- `playbooks/app/configure_app.yml`: OS + application configuration

## Security
- ✅ All secrets stored in encrypted vault.yml
- ✅ Deploy keys excluded via .gitignore
- ✅ No plaintext secrets committed

## Testing
- ✅ POTE successfully deployed to dev/qa/prod environments
- ✅ All components validated (Git, PostgreSQL, cron, migrations)

Co-authored-by: ilia <ilia@levkin.ca>
Reviewed-on: #3

2026-01-01 11:19:54 -05:00

defaults

Add POTE app project support and improve IP conflict detection (#3 )

2026-01-01 11:19:54 -05:00

handlers

Add POTE app project support and improve IP conflict detection (#3 )

2026-01-01 11:19:54 -05:00

tasks

Add POTE app project support and improve IP conflict detection (#3 )

2026-01-01 11:19:54 -05:00

README.md

Add POTE app project support and improve IP conflict detection (#3 )

2026-01-01 11:19:54 -05:00

README.md

`base_os`

Baseline OS configuration for app guests:

Installs required packages (git/curl/nodejs/npm/ufw/openssh-server/etc.)
Creates deployment user (default appuser) with passwordless sudo
Adds your authorized SSH key
Configures UFW to allow SSH + backend/frontend ports

Variables

See defaults/main.yml. Common inputs in the app stack:

appuser_name, appuser_groups, appuser_shell
appuser_ssh_public_key (usually {{ vault_ssh_public_key }})
components.backend, components.frontend (enable/disable firewall rules per component)
app_backend_port, app_frontend_port

This role is used by playbooks/app/configure_app.yml after provisioning.