--- - name: Deploy PDS hosts: pds become: yes vars_files: - vars/main.yml vars: pds_data_dir: /pds pds_image_tag: "0.4" pds_blob_upload_limit: 314572800 pds_rate_limits_enabled: true pds_invite_required: true pds_backup_period: 24h pds_backup_s3_bucket: atprotopds-backup pds_backup_s3_region: bhs pds_backup_s3_endpoint: https://s3.bhs.io.cloud.ovh.net pds_backup_s3_access_key: "{{ pds_blobstore_s3_access_key }}" pds_backup_s3_secret_key: "{{ pds_blobstore_s3_secret_key }}" pds_grafana_image_tag: "13.1.1" tasks: - name: Run PDS installer (first time only) shell: >- echo "n" | bash <(curl -fsSL https://raw.githubusercontent.com/bluesky-social/pds/main/installer.sh) {{ pds_data_dir }} {{ pds_hostname }} {{ pds_admin_email }} args: creates: "{{ pds_data_dir }}/account.sqlite" executable: /bin/bash - name: Read existing secrets from pds.env shell: grep -E '^(PDS_JWT_SECRET|PDS_ADMIN_PASSWORD|PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX)=' {{ pds_data_dir }}/pds.env register: existing_secrets changed_when: false - name: Set secret facts set_fact: pds_jwt_secret: "{{ existing_secrets.stdout_lines | select('match', '^PDS_JWT_SECRET=') | first | regex_replace('^PDS_JWT_SECRET=', '') }}" pds_admin_password: "{{ existing_secrets.stdout_lines | select('match', '^PDS_ADMIN_PASSWORD=') | first | regex_replace('^PDS_ADMIN_PASSWORD=', '') }}" pds_plc_rotation_key: "{{ existing_secrets.stdout_lines | select('match', '^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=') | first | regex_replace('^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=', '') }}" - name: Install rclone apt: name: rclone state: present update_cache: yes - name: Create rclone config directory file: path: /etc/rclone state: directory mode: "0755" - name: Deploy rclone config template: src: templates/rclone.conf.j2 dest: /etc/rclone/rclone.conf mode: "0600" notify: apply changes - name: Deploy backup script template: src: templates/backup.sh.j2 dest: /usr/local/bin/backup.sh mode: "0755" notify: apply changes - name: Deploy backup service template: src: templates/backup.service.j2 dest: /etc/systemd/system/pds-backup.service mode: "0644" - name: Deploy backup timer template: src: templates/backup.timer.j2 dest: /etc/systemd/system/pds-backup.timer mode: "0644" - name: Enable backup timer systemd: name: pds-backup.timer enabled: yes state: started daemon_reload: yes - name: Pre-deploy backup shell: /usr/local/bin/backup.sh predeploy when: existing_secrets.stdout_lines | length > 0 - name: Deploy pds.env template: src: templates/pds.env.j2 dest: "{{ pds_data_dir }}/pds.env" mode: "0600" notify: apply changes - name: Deploy compose.yaml template: src: templates/compose.yaml.j2 dest: "{{ pds_data_dir }}/compose.yaml" mode: "0644" notify: apply changes - name: Deploy Caddyfile template: src: templates/Caddyfile.j2 dest: "{{ pds_data_dir }}/caddy/etc/caddy/Caddyfile" mode: "0644" notify: apply changes - name: Download pdsadmin get_url: url: https://raw.githubusercontent.com/bluesky-social/pds/main/pdsadmin.sh dest: /usr/local/bin/pdsadmin mode: "0755" - name: Flush handlers meta: flush_handlers - name: PDS Health check uri: url: "https://{{ pds_hostname }}/xrpc/_health" method: GET status_code: 200 retries: 3 delay: 5 - name: Check backup timer is active command: systemctl is-active pds-backup.timer changed_when: false - name: Check last backup run succeeded shell: systemctl show pds-backup.service -p ExecMainStatus --value register: pds_backup_exit_code changed_when: false failed_when: pds_backup_exit_code.stdout != "0" # ── Monitoring stack (telemetry) ────────────────────────────── # Deploys Prometheus + Grafana + node_exporter when pds_telemetry_enabled is true. # All services bind to 127.0.0.1 — access via SSH tunnel: # ssh -L 3001:localhost:3001 sysadmin@ # Then open http://localhost:3001 (admin/admin, change on first login) - name: Create monitoring directories file: path: "{{ item }}" state: directory mode: "0755" loop: - "{{ pds_data_dir }}/monitoring" - "{{ pds_data_dir }}/monitoring/grafana/provisioning/datasources" - "{{ pds_data_dir }}/monitoring/grafana/provisioning/dashboards" - "{{ pds_data_dir }}/monitoring/dashboards" when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool - name: Deploy monitoring compose template: src: templates/monitoring-compose.yaml.j2 dest: "{{ pds_data_dir }}/monitoring/compose.yaml" mode: "0644" when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool notify: restart monitoring - name: Deploy Prometheus config template: src: templates/prometheus.yml.j2 dest: "{{ pds_data_dir }}/monitoring/prometheus.yml" mode: "0644" when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool notify: restart monitoring - name: Deploy Grafana datasource provisioning template: src: templates/grafana-datasources.yml.j2 dest: "{{ pds_data_dir }}/monitoring/grafana/provisioning/datasources/prometheus.yml" mode: "0644" when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool notify: restart monitoring - name: Deploy Grafana dashboard provisioning template: src: templates/grafana-dashboards.yml.j2 dest: "{{ pds_data_dir }}/monitoring/grafana/provisioning/dashboards/pds.yml" mode: "0644" when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool notify: restart monitoring - name: Download PDS Overview dashboard get_url: url: https://raw.githubusercontent.com/bluesky-social/pds/main/monitoring/dashboards/pds-overview.json dest: "{{ pds_data_dir }}/monitoring/dashboards/pds-overview.json" mode: "0644" when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool notify: restart monitoring - name: Start monitoring stack shell: cd {{ pds_data_dir }}/monitoring && docker compose up -d when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool handlers: - name: apply changes shell: cd {{ pds_data_dir }} && docker compose up -d && docker restart caddy - name: restart monitoring shell: cd {{ pds_data_dir }}/monitoring && docker compose up -d --force-recreate