This commit is contained in:
gov committed
1 parent
82251b973f
commit
be08225aaf
9 files changed
+323
-7
No files matched your search
@@ -4,10 +4,11 @@ Ansible playbook for deploying a self-hosted [Bluesky PDS](https://github.com/bl
|
||||
|
||||
## What it deploys
|
||||
|
||||
- **PDS** — Bluesky Personal Data Server (`ghcr.io/bluesky-social/pds:0.4`)
|
||||
- **PDS** — Bluesky Personal Data Server (`ghcr.io/bluesky-social/pds:0.5`)
|
||||
- **Caddy** — Reverse proxy with automatic TLS via Let's Encrypt
|
||||
- **Watchtower** — Pulls new PDS image versions hourly and recreates containers
|
||||
- **PDS Backup Service** — rclone + systemd timer for periodic PDS backups to S3, plus Watchtower pre-update hook
|
||||
- **Monitoring** *(optional)* — Prometheus + Grafana + node_exporter stack with OpenTelemetry metrics and a pre-built PDS Overview dashboard
|
||||
|
||||
## Requirements
|
||||
|
||||
@@ -63,8 +64,8 @@ ansible-playbook playbook.yml
|
||||
| `pds_hostname` | yes | — | Public DNS name for the PDS |
|
||||
| `pds_admin_email` | yes | — | Admin contact email (used by Caddy for Let's Encrypt) |
|
||||
| `pds_data_dir` | no | `/pds` | Data directory (must be `/pds` — the installer enforces this) |
|
||||
| `pds_image_tag` | no | `0.4` | PDS Docker image tag |
|
||||
| `pds_blob_upload_limit` | no | `104857600` | Max blob upload size in bytes |
|
||||
| `pds_image_tag` | no | `0.5` | PDS Docker image tag |
|
||||
| `pds_blob_upload_limit` | no | `314572800` | Max blob upload size in bytes (300MB) |
|
||||
| `pds_rate_limits_enabled` | no | `true` | Enable rate limiting |
|
||||
| `pds_invite_required` | no | `true` | Require invite codes to create accounts |
|
||||
| `pds_blobstore_type` | no | `disk` | Blob storage backend (`disk` or `s3`) |
|
||||
@@ -77,6 +78,35 @@ ansible-playbook playbook.yml
|
||||
| `pds_email_smtp_url` | no | — | SMTP URL (with credentials) for email verification |
|
||||
| `pds_email_from_address` | no | — | From address for outgoing emails |
|
||||
|
||||
### Branding
|
||||
|
||||
All optional. Defaults to hostname + "PDS" with neutral colors. See the [PDS customization blog post](https://atproto.com/blog/pds-customization-and-metrics) for details.
|
||||
|
||||
| Variable | Default | Description |
|
||||
|---|---|---|
|
||||
| `pds_service_name` | hostname + " PDS" | Display name shown on auth screens and emails |
|
||||
| `pds_logo_url` | — | Logo URL (SVG recommended) |
|
||||
| `pds_primary_color` | — | Primary color for buttons, links, accents (hex, e.g. `#7c3aed`) |
|
||||
| `pds_error_color` | — | Error state color |
|
||||
| `pds_warning_color` | — | Warning state color |
|
||||
| `pds_info_color` | — | Info state color |
|
||||
| `pds_success_color` | — | Success state color |
|
||||
| `pds_home_url` | — | Home page link in footer |
|
||||
| `pds_terms_of_service_url` | — | Terms of service link in footer |
|
||||
| `pds_privacy_policy_url` | — | Privacy policy link in footer |
|
||||
| `pds_support_url` | — | Support link in footer |
|
||||
| `pds_background_light_url` | — | Background image for auth screens (light mode) |
|
||||
| `pds_background_dark_url` | — | Background image for auth screens (dark mode) |
|
||||
|
||||
### Telemetry & monitoring
|
||||
|
||||
Requires PDS image `0.5+` (telemetry added in `@atproto/pds` 0.5.26). When enabled, deploys Prometheus + Grafana + node_exporter alongside the PDS. All services bind to `127.0.0.1` — access via SSH tunnel.
|
||||
|
||||
| Variable | Default | Description |
|
||||
|---|---|---|
|
||||
| `pds_telemetry_enabled` | `false` | Enable OpenTelemetry + monitoring stack |
|
||||
| `pds_grafana_image_tag` | `13.1.1` | Grafana Docker image tag (pinned — no floating major tag) |
|
||||
|
||||
### Backup service
|
||||
|
||||
| Variable | Required | Default | Description |
|
||||
@@ -102,6 +132,28 @@ Three backup types, all uploaded to `s3://atprotopds-backup`:
|
||||
|
||||
Backups exclude `/pds/blocks` (blobs are already in S3). Each backup is a tarball named `{type}-YYYYMMDD-HHMMSS.tar.gz`.
|
||||
|
||||
## Monitoring
|
||||
|
||||
Set `pds_telemetry_enabled: true` in `vars/main.yml` to enable OpenTelemetry metrics and deploy the monitoring stack (Prometheus + Grafana + node_exporter). The PDS pushes metrics over OTLP to Prometheus, which receives them directly (no collector needed).
|
||||
|
||||
**Access Grafana via SSH tunnel:**
|
||||
|
||||
```bash
|
||||
ssh -L 3001:localhost:3001 sysadmin@your-server
|
||||
```
|
||||
|
||||
Then open `http://localhost:3001` and log in with `admin`/`admin` (change on first login). The PDS Overview dashboard is provisioned automatically in a folder named "PDS".
|
||||
|
||||
**Ports (all bound to 127.0.0.1):**
|
||||
|
||||
| Service | Port | Purpose |
|
||||
|---|---|---|
|
||||
| Grafana | 3001 | Dashboard UI |
|
||||
| Prometheus | 9090 | Metrics query API |
|
||||
| node_exporter | 9100 | Host metrics |
|
||||
|
||||
Prometheus retains 15 days of data by default. Data is stored in Docker volumes, not under `/pds`, so it's not included in PDS backups.
|
||||
|
||||
## Post-deploy
|
||||
|
||||
Check that the PDS is healthy:
|
||||
@@ -145,6 +197,9 @@ Auto-deploys on push to `main`. Set up these in Gitea repo settings (Settings >
|
||||
| `SERVER_IP` | Target server IP address |
|
||||
| `PDS_HOSTNAME` | Public DNS name for the PDS (e.g., `pds.example.com`) |
|
||||
| `PDS_ADMIN_EMAIL` | Admin contact email |
|
||||
| `PDS_TELEMETRY_ENABLED` | *(optional)* Set to `true` to enable telemetry + monitoring stack |
|
||||
| `PDS_SERVICE_NAME` | *(optional)* PDS display name for branding |
|
||||
| `PDS_PRIMARY_COLOR` | *(optional)* Primary color (hex) for branding |
|
||||
|
||||
**Secrets** (sensitive credentials):
|
||||
|
||||
|
||||
Reference in new issue
Block a user