govandLetta Code
ec09b49282
Deploy PDS / deploy (push) Canceled after 0s
Three backup types: pre-update (Watchtower lifecycle hook), pre-deploy (Ansible task), and periodic (systemd timer). All uploads go to OVH S3 via rclone. Backs up SQLite DBs, pds.env, and Caddy config. 👾 Generated with [Letta Code](https://letta.com) Co-Authored-By: Letta Code <noreply@letta.com>
120 lines
3.7 KiB
YAML
120 lines
3.7 KiB
YAML
---
|
|
- name: Deploy PDS
|
|
hosts: pds
|
|
become: yes
|
|
vars_files:
|
|
- vars/main.yml
|
|
vars:
|
|
pds_data_dir: /pds
|
|
pds_image_tag: "0.4"
|
|
pds_blob_upload_limit: 104857600
|
|
pds_rate_limits_enabled: true
|
|
pds_invite_required: true
|
|
pds_backup_period: 24h
|
|
pds_backup_s3_bucket: atprotopds-backup
|
|
pds_backup_s3_region: bhs
|
|
pds_backup_s3_endpoint: https://s3.bhs.io.cloud.ovh.net
|
|
pds_backup_s3_access_key: "{{ pds_blobstore_s3_access_key }}"
|
|
pds_backup_s3_secret_key: "{{ pds_blobstore_s3_secret_key }}"
|
|
|
|
tasks:
|
|
- name: Run PDS installer (first time only)
|
|
shell: >-
|
|
echo "n" | bash <(curl -fsSL
|
|
https://raw.githubusercontent.com/bluesky-social/pds/main/installer.sh)
|
|
{{ pds_data_dir }} {{ pds_hostname }} {{ pds_admin_email }}
|
|
args:
|
|
creates: "{{ pds_data_dir }}/account.sqlite"
|
|
executable: /bin/bash
|
|
|
|
- name: Read existing secrets from pds.env
|
|
shell: grep -E '^(PDS_JWT_SECRET|PDS_ADMIN_PASSWORD|PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX)=' {{ pds_data_dir }}/pds.env
|
|
register: existing_secrets
|
|
changed_when: false
|
|
|
|
- name: Set secret facts
|
|
set_fact:
|
|
pds_jwt_secret: "{{ existing_secrets.stdout_lines | select('match', '^PDS_JWT_SECRET=') | first | regex_replace('^PDS_JWT_SECRET=', '') }}"
|
|
pds_admin_password: "{{ existing_secrets.stdout_lines | select('match', '^PDS_ADMIN_PASSWORD=') | first | regex_replace('^PDS_ADMIN_PASSWORD=', '') }}"
|
|
pds_plc_rotation_key: "{{ existing_secrets.stdout_lines | select('match', '^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=') | first | regex_replace('^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=', '') }}"
|
|
|
|
- name: Install rclone
|
|
apt:
|
|
name: rclone
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Create rclone config directory
|
|
file:
|
|
path: /etc/rclone
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Deploy rclone config
|
|
template:
|
|
src: templates/rclone.conf.j2
|
|
dest: /etc/rclone/rclone.conf
|
|
mode: "0600"
|
|
notify: apply changes
|
|
|
|
- name: Deploy backup script
|
|
template:
|
|
src: templates/backup.sh.j2
|
|
dest: /usr/local/bin/backup.sh
|
|
mode: "0755"
|
|
notify: apply changes
|
|
|
|
- name: Deploy backup service
|
|
template:
|
|
src: templates/backup.service.j2
|
|
dest: /etc/systemd/system/pds-backup.service
|
|
mode: "0644"
|
|
|
|
- name: Deploy backup timer
|
|
template:
|
|
src: templates/backup.timer.j2
|
|
dest: /etc/systemd/system/pds-backup.timer
|
|
mode: "0644"
|
|
|
|
- name: Enable backup timer
|
|
systemd:
|
|
name: pds-backup.timer
|
|
enabled: yes
|
|
state: started
|
|
daemon_reload: yes
|
|
|
|
- name: Pre-deploy backup
|
|
shell: /usr/local/bin/backup.sh predeploy
|
|
when: existing_secrets.stdout_lines | length > 0
|
|
|
|
- name: Deploy pds.env
|
|
template:
|
|
src: templates/pds.env.j2
|
|
dest: "{{ pds_data_dir }}/pds.env"
|
|
mode: "0600"
|
|
notify: apply changes
|
|
|
|
- name: Deploy compose.yaml
|
|
template:
|
|
src: templates/compose.yaml.j2
|
|
dest: "{{ pds_data_dir }}/compose.yaml"
|
|
mode: "0644"
|
|
notify: apply changes
|
|
|
|
- name: Deploy Caddyfile
|
|
template:
|
|
src: templates/Caddyfile.j2
|
|
dest: "{{ pds_data_dir }}/caddy/etc/caddy/Caddyfile"
|
|
mode: "0644"
|
|
notify: apply changes
|
|
|
|
- name: Download pdsadmin
|
|
get_url:
|
|
url: https://raw.githubusercontent.com/bluesky-social/pds/main/pdsadmin.sh
|
|
dest: /usr/local/bin/pdsadmin
|
|
mode: "0755"
|
|
|
|
handlers:
|
|
- name: apply changes
|
|
shell: cd {{ pds_data_dir }} && docker compose up -d && docker restart caddy
|