atproto-pds-ansible/playbook.yml

---
- name: Deploy PDS
  hosts: pds
  become: yes
  vars_files:
    - vars/main.yml
  vars:
    pds_data_dir: /pds
    pds_image_tag: "0.4"
    pds_blob_upload_limit: 314572800
    pds_rate_limits_enabled: true
    pds_invite_required: true
    pds_backup_period: 24h
    pds_backup_s3_bucket: atprotopds-backup
    pds_backup_s3_region: bhs
    pds_backup_s3_endpoint: https://s3.bhs.io.cloud.ovh.net
    pds_backup_s3_access_key: "{{ pds_blobstore_s3_access_key }}"
    pds_backup_s3_secret_key: "{{ pds_blobstore_s3_secret_key }}"
    pds_grafana_image_tag: "13.1.1"

  tasks:
    - name: Run PDS installer (first time only)
      shell: >-
        echo "n" | bash <(curl -fsSL
        https://raw.githubusercontent.com/bluesky-social/pds/main/installer.sh)
        {{ pds_data_dir }} {{ pds_hostname }} {{ pds_admin_email }}
      args:
        creates: "{{ pds_data_dir }}/account.sqlite"
        executable: /bin/bash

    - name: Read existing secrets from pds.env
      shell: grep -E '^(PDS_JWT_SECRET|PDS_ADMIN_PASSWORD|PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX)=' {{ pds_data_dir }}/pds.env
      register: existing_secrets
      changed_when: false

    - name: Set secret facts
      set_fact:
        pds_jwt_secret: "{{ existing_secrets.stdout_lines | select('match', '^PDS_JWT_SECRET=') | first | regex_replace('^PDS_JWT_SECRET=', '') }}"
        pds_admin_password: "{{ existing_secrets.stdout_lines | select('match', '^PDS_ADMIN_PASSWORD=') | first | regex_replace('^PDS_ADMIN_PASSWORD=', '') }}"
        pds_plc_rotation_key: "{{ existing_secrets.stdout_lines | select('match', '^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=') | first | regex_replace('^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=', '') }}"

    - name: Install rclone
      apt:
        name: rclone
        state: present
        update_cache: yes

    - name: Create rclone config directory
      file:
        path: /etc/rclone
        state: directory
        mode: "0755"

    - name: Deploy rclone config
      template:
        src: templates/rclone.conf.j2
        dest: /etc/rclone/rclone.conf
        mode: "0600"
      notify: apply changes

    - name: Deploy backup script
      template:
        src: templates/backup.sh.j2
        dest: /usr/local/bin/backup.sh
        mode: "0755"
      notify: apply changes

    - name: Deploy backup service
      template:
        src: templates/backup.service.j2
        dest: /etc/systemd/system/pds-backup.service
        mode: "0644"

    - name: Deploy backup timer
      template:
        src: templates/backup.timer.j2
        dest: /etc/systemd/system/pds-backup.timer
        mode: "0644"

    - name: Enable backup timer
      systemd:
        name: pds-backup.timer
        enabled: yes
        state: started
        daemon_reload: yes

    - name: Pre-deploy backup
      shell: /usr/local/bin/backup.sh predeploy
      when: existing_secrets.stdout_lines | length > 0

    - name: Deploy pds.env
      template:
        src: templates/pds.env.j2
        dest: "{{ pds_data_dir }}/pds.env"
        mode: "0600"
      notify: apply changes

    - name: Deploy compose.yaml
      template:
        src: templates/compose.yaml.j2
        dest: "{{ pds_data_dir }}/compose.yaml"
        mode: "0644"
      notify: apply changes

    - name: Deploy Caddyfile
      template:
        src: templates/Caddyfile.j2
        dest: "{{ pds_data_dir }}/caddy/etc/caddy/Caddyfile"
        mode: "0644"
      notify: apply changes

    - name: Download pdsadmin
      get_url:
        url: https://raw.githubusercontent.com/bluesky-social/pds/main/pdsadmin.sh
        dest: /usr/local/bin/pdsadmin
        mode: "0755"

    - name: Flush handlers
      meta: flush_handlers

    - name: PDS Health check
      uri:
        url: "https://{{ pds_hostname }}/xrpc/_health"
        method: GET
        status_code: 200
      retries: 3
      delay: 5

    - name: Check backup timer is active
      command: systemctl is-active pds-backup.timer
      changed_when: false

    - name: Check last backup run succeeded
      shell: systemctl show pds-backup.service -p ExecMainStatus --value
      register: pds_backup_exit_code
      changed_when: false
      failed_when: pds_backup_exit_code.stdout != "0"

    # ── Monitoring stack (telemetry) ──────────────────────────────
    # Deploys Prometheus + Grafana + node_exporter when pds_telemetry_enabled is true.
    # All services bind to 127.0.0.1 — access via SSH tunnel:
    #   ssh -L 3001:localhost:3001 sysadmin@<server>
    # Then open http://localhost:3001 (admin/admin, change on first login)

    - name: Create monitoring directories
      file:
        path: "{{ item }}"
        state: directory
        mode: "0755"
      loop:
        - "{{ pds_data_dir }}/monitoring"
        - "{{ pds_data_dir }}/monitoring/grafana/provisioning/datasources"
        - "{{ pds_data_dir }}/monitoring/grafana/provisioning/dashboards"
        - "{{ pds_data_dir }}/monitoring/dashboards"
      when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool

    - name: Deploy monitoring compose
      template:
        src: templates/monitoring-compose.yaml.j2
        dest: "{{ pds_data_dir }}/monitoring/compose.yaml"
        mode: "0644"
      when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool
      notify: restart monitoring

    - name: Deploy Prometheus config
      template:
        src: templates/prometheus.yml.j2
        dest: "{{ pds_data_dir }}/monitoring/prometheus.yml"
        mode: "0644"
      when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool
      notify: restart monitoring

    - name: Deploy Grafana datasource provisioning
      template:
        src: templates/grafana-datasources.yml.j2
        dest: "{{ pds_data_dir }}/monitoring/grafana/provisioning/datasources/prometheus.yml"
        mode: "0644"
      when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool
      notify: restart monitoring

    - name: Deploy Grafana dashboard provisioning
      template:
        src: templates/grafana-dashboards.yml.j2
        dest: "{{ pds_data_dir }}/monitoring/grafana/provisioning/dashboards/pds.yml"
        mode: "0644"
      when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool
      notify: restart monitoring

    - name: Download PDS Overview dashboard
      get_url:
        url: https://raw.githubusercontent.com/bluesky-social/pds/main/monitoring/dashboards/pds-overview.json
        dest: "{{ pds_data_dir }}/monitoring/dashboards/pds-overview.json"
        mode: "0644"
      when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool
      notify: restart monitoring

    - name: Start monitoring stack
      shell: cd {{ pds_data_dir }}/monitoring && docker compose up -d
      when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool

  handlers:
    - name: apply changes
      shell: cd {{ pds_data_dir }} && docker compose up -d && docker restart caddy

    - name: restart monitoring
      shell: cd {{ pds_data_dir }}/monitoring && docker compose up -d --force-recreate