feature/app-deploy-lxc #28

Merged

mixel merged 8 commits from feature/app-deploy-lxc into main

2026-08-06 11:03:49 +00:00

mixel commented

2026-08-06 11:03:39 +00:00

Owner

No description provided.

mixel added 8 commits

2026-08-06 11:03:39 +00:00

Configure Forgejo Runner Podman registry mirror 38714c6dfa

refactor(opentofu): collapse per-LXC outputs into a single lxcs map 351d80933c

Replace the eight duplicated LXC output blocks with one map output
derived from the lxcs for_each instances. Update all call sites and
derive the Ansible inventory list from the map, so new LXCs no longer
need manual registration. Also remove the completed tower drive
implementation plan.

feat(opentofu): add shared apps LXC for personal projects b9a8963dd9

Create the apps LXC (CT 213, 192.168.178.244) on mini1 with Ceph
storage: 2 vCPU, 2 GiB RAM, 512 MiB swap, 16 GiB disk. Register it in
the Ansible inventory, HA prefer-minis placement, and nightly snapshot
backups (04:30, keep 14).

fix(ansible): make util roles check-mode safe on fresh hosts fd8420e5d0

Check mode simulates package installs and file writes, so on a host that
has never been provisioned the modules cannot find units, binaries, or
quadlet services and fail instead of reporting a dry-run. Guard those
tasks and handlers with check-mode awareness:

- firewall: re-stat ufw after the simulated install and only run the
  ufw rule block when the binary exists
- podman-host: only enable podman.socket and the auto-update timer
  outside check mode; only chmod podman-tui when the binary exists
- podman-quadlet: never stop, start, or restart services in check mode
  (unit files are never written there), with a defensive rc default

feat(tickets): deploy ticket-maschine-maltz on the apps LXC aa524fffa5

Add the tickets app (Rust backend + embedded SPA) and its PostgreSQL
with a new generic app-deploy toolchain on the shared apps LXC:

- util/app-deploy: host-agnostic Python deployer driven by
  /etc/app-deploy/apps.json. Deploys a digest-pinned image ref by
  pulling, retagging :latest, restarting the quadlet service, and
  verifying the health endpoint; keeps per-app history with rollback.
  Installs the deploy SSH key and performs the registry login.
- services/tickets: quadlets for app + postgres. Postgres 18.4 pins
  PGDATA to the bind-mounted host path because the image's default
  (and its anonymous-volume shadowing) would lose the database on
  every container recreation.
- site.yml playbook for tag_apps, host_vars for LAN-wide port 8080,
  assh entry, and encrypted vault with app secrets and deploy keypair.

The app was smoke-tested: login as the seeded admin works, the health
endpoint responds, and app-deploy deploy/rollback/history are
functional. Record rootless per-app podman as deferred work in
docs/TODO_apps.md.

ci: add deploy-app workflow for Forgejo auto-deploys d132c90c13

workflow_dispatch entry point that the app repos call via the Forgejo
dispatch API after publishing an image. Validates the app against a
whitelist and the image ref against a strict digest pattern (also
preventing shell injection), then SSHes to the target host with the
INFRA_DEPLOY_KEY secret and runs app-deploy.

ci: install ssh client in deploy-app workflow b2c33652d3

The runner job image (node:22-bookworm) does not ship openssh-client,
so the deployment step would fail before connecting.

chore(tickets): store Forgejo dispatch token in vault 6a29a3d68a

mixel merged commit 31e169529d into main

2026-08-06 11:03:49 +00:00

mixel referenced this pull request from a commit

2026-08-06 11:03:50 +00:00

Merge pull request 'feature/app-deploy-lxc' (#28) from feature/app-deploy-lxc into main

mixel deleted branch feature/app-deploy-lxc

2026-08-06 11:03:50 +00:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

mixel/infrastructure!28

No description provided.

Rows
Columns