b000a132ac
Additions-only. provision-sa-wellness-prod.yml creates the sa-wellness-prod LXC with docker (Semaphore provisions prod). deploy-sa-wellness.yml promotes an immutable vX.Y.Z registry image: requires version arg (rollback = prior tag), runs PostgreSQL + one-time migrations, runs the non-root API, verifies /healthz + /readyz 200. Secrets (REGISTRY_*, SA_DB_PASSWORD, SA_JWT_SIGNING_KEY, SA_CORS_ORIGINS) injected by Semaphore from Infisical, never committed.
60 lines
2.8 KiB
YAML
60 lines
2.8 KiB
YAML
---
|
|
# Provision the sa-wellness PRODUCTION LXC (Gate 3, Semaphore-run, one-time).
|
|
# Additions-only to sam/semaphore.git /playbook. Semaphore provisions PROD (not dev/staging).
|
|
# After this runs once, playbook/deploy-sa-wellness.yml deploys/rolls versioned images into it.
|
|
#
|
|
# Optional extra-vars:
|
|
# node: proxmox node to create the LXC on (default pve4)
|
|
# vmid: prod VMID (default 130 — 1xx range; pick the lowest free if taken)
|
|
# ip: static CIDR (default 192.168.122.130/24)
|
|
#
|
|
# Run: -e "vmid=130 ip=192.168.122.130/24"
|
|
|
|
- name: Provision sa-wellness-prod LXC
|
|
hosts: "{{ node | default('pve4') }}"
|
|
gather_facts: false
|
|
vars:
|
|
vmid: "{{ vmid | default('130') }}"
|
|
ctip: "{{ ip | default('192.168.122.130/24') }}"
|
|
ctname: "sa-wellness-prod"
|
|
template: "local:vztmpl/debian-12-standard_12.12-1_amd64.tar.zst"
|
|
tasks:
|
|
- name: Create the prod LXC if absent (nesting for docker, onboot, tagged)
|
|
ansible.builtin.shell: |
|
|
set -e
|
|
if [ -n "$(pct list | awk '$0 ~ /{{ ctname }}/ {print $1}')" ]; then
|
|
echo "exists"; exit 0
|
|
fi
|
|
pct create {{ vmid }} {{ template }} \
|
|
--hostname {{ ctname }} \
|
|
--cores 2 --memory 2048 --swap 512 \
|
|
--rootfs local-lvm:16 \
|
|
--net0 name=eth0,bridge=vmbr0,ip={{ ctip }},gw=192.168.122.1,type=veth \
|
|
--nameserver 192.168.122.1 \
|
|
--features nesting=1,keyctl=1 --unprivileged 1 \
|
|
--onboot 1 --tags 'sa-wellness;production;docker;api' --start 1
|
|
sleep 8
|
|
register: create_out
|
|
changed_when: "'exists' not in create_out.stdout"
|
|
|
|
- name: Install docker inside the prod LXC (idempotent)
|
|
ansible.builtin.shell: |
|
|
pct exec {{ vmid }} -- bash -lc '
|
|
command -v docker >/dev/null 2>&1 && exit 0
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update -qq && apt-get install -y -qq ca-certificates curl gnupg
|
|
install -m0755 -d /etc/apt/keyrings
|
|
curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
|
|
chmod a+r /etc/apt/keyrings/docker.gpg
|
|
. /etc/os-release
|
|
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $VERSION_CODENAME stable" > /etc/apt/sources.list.d/docker.list
|
|
apt-get update -qq && apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin
|
|
mkdir -p /etc/docker
|
|
echo "{\"insecure-registries\":[\"192.168.122.103:3000\"]}" > /etc/docker/daemon.json
|
|
systemctl restart docker'
|
|
changed_when: false
|
|
|
|
- name: Report
|
|
ansible.builtin.debug:
|
|
msg: "Provisioned {{ ctname }} (VMID {{ vmid }}, {{ ctip }}). Next: run deploy-sa-wellness.yml -e version=vX.Y.Z"
|