Files

T

tommy c9aac20e73 Add LubeLogger deployment (docker-node01)

Ansible-managed (inline-compose, file-provider router, host :8099), idempotent
(changed=0). PBS-backed pg_dump (daily, keep 14) with verified round-trip restore;
ntfy 'garage' reminder probe (.190); Diun repo-watch for new tags; Homepage
tile+widget. Secrets via ansible-vault / /etc env files / HOMEPAGE_VAR — none in repo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-02 15:14:20 -05:00

2.6 KiB

Raw Blame History

LubeLogger — deployment source of truth

Vehicle & small-engine maintenance tracker. Host: docker-node01 (.186). Postgres 18 backend (tables in the app schema). In-app auth ENABLED (root user).

Routing (file provider)

Published on the host at :8099; Traefik on node01 routes lubelogger.goattw.net → http://192.168.99.186:8099 via dynamic_conf.yml (see traefik-router.dynamic_conf.yml). Edge chain: TLS (letsencrypt) → CrowdSec (global) → Authelia (authelia-auth@file, two_factor off-LAN / bypass on-LAN). LubeLogger's own auth gates the LAN/:8099 path.

Deploy (Ansible, idempotent)

Playbook deploy-lubelogger.yml (runs from ~/ansible on ansible-control):

ansible-playbook playbooks/deploy-lubelogger.yml

Inline-compose house style: copy: the compose + community.docker.docker_compose_v2. DB password is sourced from ansible-vault (vault_lubelogger_db_password) — never inline. Second converge is changed=0.

Backup (PBS)

lubelogger-backup.{sh,service,timer} on node01 — daily 03:30, pg_dump → PBS (rust-usb, host/lubelogger), prune --keep-daily 14. PBS creds live in /etc/lubelogger-backup.env (root:600, NOT in git). Restore verified via full PBS round-trip into a throwaway postgres:18 (live↔restored row-count parity). NOTE: the lubelogger-data/lubelogger-keys volumes (uploads, config, the ROOT USER credential, ASP.NET keyring) are a SEPARATE layer — covered by docker-volume-backup (stop-during-backup labels already set). pg_dump captures Postgres data only.

Reminders → ntfy

lubelogger-reminders-probe.{sh} + units on ansible-control (.190) — daily 07:30. Reads /api/vehicle/info (Basic auth, creds in /etc/lubelogger-reminders.env, root:600, NOT in git), posts a digest to ntfy topic garage only when something is due/overdue. Subscribe to the garage topic in your ntfy app to receive it.

Diun

App carries diun.watch_repo=true + semver include_tags so a new release tag pings the existing Diun→HA-webhook pipeline. DB (postgres:18) is watched by default (digest).

Homepage

Tile + lubelogger widget under "AI & Productivity" in observability/homepage/services.yaml (live) — widget password via HOMEPAGE_VAR_LUBELOGGER_PASSWORD (observability/.env, not a git repo). See homepage-tile.yaml.

Secrets (none in this repo)

DB password: ansible-vault (~/ansible), and Postgres volume (already initialized).
PBS token: /etc/lubelogger-backup.env (reuses vaultwarden token — a dedicated lubelogger-backup PBS token would be cleaner; needs PBS root to create).
Admin/basic-auth password: /etc/lubelogger-reminders.env + observability/.env.

2.6 KiB Raw Blame History