From 9ee7e9732434ebf50119971ab6e189ea8b47f9fd Mon Sep 17 00:00:00 2001 From: gov Date: Fri, 31 Jul 2026 18:01:10 -0400 Subject: [PATCH] feat: template pds.env with Ansible-managed config MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reads installer-generated secrets from pds.env and re-templates it with config from vars/main.yml (S3, SMTP, blob limits, etc.). Secrets are preserved across runs; only config changes trigger a restart. 👾 Generated with [Letta Code](https://letta.com) Co-Authored-By: Letta Code --- playbook.yml | 26 ++++++++++++++++++++++++++ templates/pds.env.j2 | 35 +++++++++++++++++++++++++++++++++++ vars/main.yml.example | 16 ++++++++++++++++ 3 files changed, 77 insertions(+) create mode 100644 templates/pds.env.j2 diff --git a/playbook.yml b/playbook.yml index fe0a3de..49085c3 100644 --- a/playbook.yml +++ b/playbook.yml @@ -1,8 +1,15 @@ --- - name: Deploy PDS hosts: pds + become: yes vars_files: - vars/main.yml + vars: + pds_data_dir: /pds + pds_image_tag: "0.4" + pds_blob_upload_limit: 104857600 + pds_rate_limits_enabled: true + pds_invite_required: true tasks: - name: Run PDS installer (first time only) @@ -12,6 +19,25 @@ {{ pds_data_dir }} {{ pds_hostname }} {{ pds_admin_email }} args: creates: "{{ pds_data_dir }}/account.sqlite" + executable: /bin/bash + + - name: Read existing secrets from pds.env + shell: grep -E '^(PDS_JWT_SECRET|PDS_ADMIN_PASSWORD|PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX)=' {{ pds_data_dir }}/pds.env + register: existing_secrets + changed_when: false + + - name: Set secret facts + set_fact: + pds_jwt_secret: "{{ existing_secrets.stdout_lines | select('match', '^PDS_JWT_SECRET=') | first | regex_replace('^PDS_JWT_SECRET=', '') }}" + pds_admin_password: "{{ existing_secrets.stdout_lines | select('match', '^PDS_ADMIN_PASSWORD=') | first | regex_replace('^PDS_ADMIN_PASSWORD=', '') }}" + pds_plc_rotation_key: "{{ existing_secrets.stdout_lines | select('match', '^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=') | first | regex_replace('^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=', '') }}" + + - name: Deploy pds.env + template: + src: templates/pds.env.j2 + dest: "{{ pds_data_dir }}/pds.env" + mode: "0600" + notify: apply changes - name: Deploy compose.yaml template: diff --git a/templates/pds.env.j2 b/templates/pds.env.j2 new file mode 100644 index 0000000..a462a1f --- /dev/null +++ b/templates/pds.env.j2 @@ -0,0 +1,35 @@ +PDS_HOSTNAME={{ pds_hostname }} +PDS_JWT_SECRET={{ pds_jwt_secret }} +PDS_ADMIN_PASSWORD={{ pds_admin_password }} +PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX={{ pds_plc_rotation_key }} +PDS_DATA_DIRECTORY={{ pds_data_dir }} +{% if pds_blobstore_type is defined and pds_blobstore_type == "s3" %} +PDS_BLOBSTORE_S3_BUCKET={{ pds_blobstore_s3_bucket }} +PDS_BLOBSTORE_S3_REGION={{ pds_blobstore_s3_region }} +{% if pds_blobstore_s3_endpoint is defined %} +PDS_BLOBSTORE_S3_ENDPOINT={{ pds_blobstore_s3_endpoint }} +{% endif %} +{% if pds_blobstore_s3_force_path_style is defined %} +PDS_BLOBSTORE_S3_FORCE_PATH_STYLE={{ pds_blobstore_s3_force_path_style | lower }} +{% endif %} +PDS_BLOBSTORE_S3_ACCESS_KEY_ID={{ pds_blobstore_s3_access_key }} +PDS_BLOBSTORE_S3_SECRET_ACCESS_KEY={{ pds_blobstore_s3_secret_key }} +{% else %} +PDS_BLOBSTORE_DISK_LOCATION={{ pds_data_dir }}/blocks +{% endif %} +PDS_BLOB_UPLOAD_LIMIT={{ pds_blob_upload_limit }} +PDS_DID_PLC_URL=https://plc.directory +PDS_BSKY_APP_VIEW_URL=https://api.bsky.app +PDS_BSKY_APP_VIEW_DID=did:web:api.bsky.app +PDS_REPORT_SERVICE_URL=https://mod.bsky.app +PDS_REPORT_SERVICE_DID=did:plc:ar7c4by46qjdydhdevvrndac +PDS_CRAWLERS=https://bsky.network +LOG_ENABLED=true +PDS_RATE_LIMITS_ENABLED={{ pds_rate_limits_enabled | lower }} +PDS_INVITE_REQUIRED={{ pds_invite_required | lower }} +{% if pds_email_smtp_url is defined %} +PDS_EMAIL_SMTP_URL={{ pds_email_smtp_url }} +{% endif %} +{% if pds_email_from_address is defined %} +PDS_EMAIL_FROM_ADDRESS={{ pds_email_from_address }} +{% endif %} diff --git a/vars/main.yml.example b/vars/main.yml.example index 2d31663..5c2e363 100644 --- a/vars/main.yml.example +++ b/vars/main.yml.example @@ -6,3 +6,19 @@ pds_admin_email: admin@example.com # pds_data_dir must be /pds — the installer enforces this pds_data_dir: /pds pds_image_tag: "0.4" +pds_blob_upload_limit: 104857600 +pds_rate_limits_enabled: true +pds_invite_required: true + +# S3 blob storage (uncomment to use instead of disk) +# pds_blobstore_type: s3 +# pds_blobstore_s3_bucket: my-pds-blobs +# pds_blobstore_s3_region: us-east-1 +# pds_blobstore_s3_endpoint: https://s3.example.com # omit for AWS S3 +# pds_blobstore_s3_force_path_style: true +# pds_blobstore_s3_access_key: CHANGE_ME +# pds_blobstore_s3_secret_key: CHANGE_ME + +# Email (uncomment to enable email verification) +# pds_email_smtp_url: smtps://username:password@smtp.example.com/ +# pds_email_from_address: admin@example.com