36 lines
1.5 KiB
Markdown
36 lines
1.5 KiB
Markdown
# semaphore — SnS deployment playbooks
|
|
|
|
Ansible playbooks run by [Semaphore](http://192.168.122.99:3000) for deploying
|
|
services across SnS hosts. Source of truth is this Gitea repo (`sam/semaphore`);
|
|
Semaphore pulls from here.
|
|
|
|
## Layout
|
|
```
|
|
ansible.cfg # ansible defaults (inventory path, ssh opts)
|
|
inventory/hosts.yml # target hosts (racknerd1/2/3), mesh IPs
|
|
group_vars/all.yml # shared non-secret vars
|
|
playbooks/
|
|
ping.yml # connectivity check (run this first)
|
|
deploy-homarr.yml # Homarr dashboard on racknerd1
|
|
requirements.yml # ansible collections (community.docker)
|
|
```
|
|
|
|
## Semaphore setup (one-time)
|
|
1. **Key Store**: add the SSH private key Semaphore uses to reach target hosts.
|
|
Its public half must be in each target's `~/.ssh/authorized_keys`.
|
|
2. **Repository**: this repo — `git@gitea.snsnetlabs.com:sam/semaphore.git`
|
|
(SSH deploy key) or HTTPS + Gitea token.
|
|
3. **Inventory**: point at `inventory/hosts.yml`.
|
|
4. **Environment/Variable Group**: set `homarr_secret_encryption_key`
|
|
= `openssl rand -hex 32` (secret; do NOT commit).
|
|
5. **Task Templates**:
|
|
- `ping` -> playbook `playbooks/ping.yml`
|
|
- `homarr` -> playbook `playbooks/deploy-homarr.yml`, limit `racknerd1`
|
|
|
|
## Run order
|
|
Run `ping` first to confirm Semaphore can reach the target, then `homarr`.
|
|
|
|
## Notes
|
|
- Targets are reached over the NetBird mesh (Semaphore LXC is on the mesh).
|
|
- Secrets live in Semaphore's variable store, never in this repo.
|