tommy
c9aac20e73
Ansible-managed (inline-compose, file-provider router, host :8099), idempotent (changed=0). PBS-backed pg_dump (daily, keep 14) with verified round-trip restore; ntfy 'garage' reminder probe (.190); Diun repo-watch for new tags; Homepage tile+widget. Secrets via ansible-vault / /etc env files / HOMEPAGE_VAR — none in repo. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
51 lines
2.6 KiB
Markdown
51 lines
2.6 KiB
Markdown
# LubeLogger — deployment source of truth
|
|
|
|
Vehicle & small-engine maintenance tracker. **Host:** docker-node01 (.186).
|
|
Postgres 18 backend (tables in the `app` schema). In-app auth ENABLED (root user).
|
|
|
|
## Routing (file provider)
|
|
Published on the host at `:8099`; Traefik on node01 routes `lubelogger.goattw.net`
|
|
→ `http://192.168.99.186:8099` via `dynamic_conf.yml` (see `traefik-router.dynamic_conf.yml`).
|
|
Edge chain: TLS (letsencrypt) → CrowdSec (global) → Authelia (`authelia-auth@file`,
|
|
`two_factor` off-LAN / bypass on-LAN). LubeLogger's own auth gates the LAN/`:8099` path.
|
|
|
|
## Deploy (Ansible, idempotent)
|
|
Playbook `deploy-lubelogger.yml` (runs from `~/ansible` on ansible-control):
|
|
```
|
|
ansible-playbook playbooks/deploy-lubelogger.yml
|
|
```
|
|
Inline-compose house style: `copy:` the compose + `community.docker.docker_compose_v2`.
|
|
DB password is sourced from ansible-vault (`vault_lubelogger_db_password`) — never inline.
|
|
Second converge is `changed=0`.
|
|
|
|
## Backup (PBS)
|
|
`lubelogger-backup.{sh,service,timer}` on node01 — daily 03:30, `pg_dump` → PBS
|
|
(`rust-usb`, host/lubelogger), prune `--keep-daily 14`. PBS creds live in
|
|
`/etc/lubelogger-backup.env` (root:600, NOT in git). Restore verified via full
|
|
PBS round-trip into a throwaway postgres:18 (live↔restored row-count parity).
|
|
NOTE: the `lubelogger-data`/`lubelogger-keys` volumes (uploads, config, the ROOT USER
|
|
credential, ASP.NET keyring) are a SEPARATE layer — covered by docker-volume-backup
|
|
(`stop-during-backup` labels already set). pg_dump captures Postgres data only.
|
|
|
|
## Reminders → ntfy
|
|
`lubelogger-reminders-probe.{sh}` + units on ansible-control (.190) — daily 07:30.
|
|
Reads `/api/vehicle/info` (Basic auth, creds in `/etc/lubelogger-reminders.env`,
|
|
root:600, NOT in git), posts a digest to ntfy topic **garage** only when something is
|
|
due/overdue. Subscribe to the `garage` topic in your ntfy app to receive it.
|
|
|
|
## Diun
|
|
App carries `diun.watch_repo=true` + semver `include_tags` so a new release tag pings
|
|
the existing Diun→HA-webhook pipeline. DB (`postgres:18`) is watched by default (digest).
|
|
|
|
## Homepage
|
|
Tile + `lubelogger` widget under "AI & Productivity" in
|
|
`observability/homepage/services.yaml` (live) — widget password via
|
|
`HOMEPAGE_VAR_LUBELOGGER_PASSWORD` (observability/.env, not a git repo). See
|
|
`homepage-tile.yaml`.
|
|
|
|
## Secrets (none in this repo)
|
|
- DB password: ansible-vault (`~/ansible`), and Postgres volume (already initialized).
|
|
- PBS token: `/etc/lubelogger-backup.env` (reuses vaultwarden token — a dedicated
|
|
`lubelogger-backup` PBS token would be cleaner; needs PBS root to create).
|
|
- Admin/basic-auth password: `/etc/lubelogger-reminders.env` + `observability/.env`.
|