tommy
c9aac20e73
Ansible-managed (inline-compose, file-provider router, host :8099), idempotent (changed=0). PBS-backed pg_dump (daily, keep 14) with verified round-trip restore; ntfy 'garage' reminder probe (.190); Diun repo-watch for new tags; Homepage tile+widget. Secrets via ansible-vault / /etc env files / HOMEPAGE_VAR — none in repo. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
105 lines
3.7 KiB
YAML
105 lines
3.7 KiB
YAML
---
|
|
- name: Deploy LubeLogger on docker-node01
|
|
hosts: docker-node01
|
|
become: true
|
|
vars:
|
|
app_dir: /home/tommy/lubelogger
|
|
app_port: 8099
|
|
|
|
tasks:
|
|
- name: Create lubelogger directory
|
|
ansible.builtin.file:
|
|
path: "{{ app_dir }}"
|
|
state: directory
|
|
owner: tommy
|
|
group: tommy
|
|
mode: "0755"
|
|
|
|
- name: Write docker-compose.yml
|
|
ansible.builtin.copy:
|
|
dest: "{{ app_dir }}/docker-compose.yml"
|
|
owner: tommy
|
|
group: tommy
|
|
mode: "0644"
|
|
content: |
|
|
# lubelogger - Vehicle & small-engine maintenance tracker
|
|
# Host: docker-node01 (.186), Port: {{ app_port }}
|
|
# Traefik: lubelogger.goattw.net (Authelia protected, @file router -> :{{ app_port }})
|
|
# Backend: PostgreSQL 18 (tables live in the `app` schema).
|
|
# In-app auth is ENABLED (root user) - the published host port is safe.
|
|
# Do NOT lose the lubelogger-keys volume (ASP.NET DataProtection keyring).
|
|
|
|
services:
|
|
lubelogger:
|
|
image: ghcr.io/hargata/lubelogger:v1.6.8
|
|
container_name: lubelogger
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- lubelogger-db
|
|
ports:
|
|
- "{{ app_port }}:8080"
|
|
environment:
|
|
TZ: America/Chicago
|
|
LUBELOGGER_LOCALE_OVERRIDE: "en_US"
|
|
POSTGRES_CONNECTION: "Host=lubelogger-db:5432;Username=lubelogger;Password={{ vault_lubelogger_db_password }};Database=lubelogger;"
|
|
volumes:
|
|
- lubelogger-data:/App/data
|
|
- lubelogger-keys:/root/.aspnet/DataProtection-Keys
|
|
networks:
|
|
- lubelogger-int
|
|
labels:
|
|
- "docker-volume-backup.stop-during-backup=true"
|
|
# Diun watches by default (digest); watch_repo + semver filter
|
|
# so a NEW release tag (e.g. v1.6.9) pings the existing Diun->HA pipeline.
|
|
- "diun.enable=true"
|
|
- "diun.watch_repo=true"
|
|
- 'diun.include_tags=^v[0-9]+\.[0-9]+\.[0-9]+$'
|
|
|
|
lubelogger-db:
|
|
image: postgres:18
|
|
container_name: lubelogger-db
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: lubelogger
|
|
POSTGRES_PASSWORD: "{{ vault_lubelogger_db_password }}"
|
|
POSTGRES_DB: lubelogger
|
|
TZ: America/Chicago
|
|
volumes:
|
|
- lubelogger-db:/var/lib/postgresql
|
|
- /etc/localtime:/etc/localtime:ro
|
|
networks:
|
|
- lubelogger-int
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U lubelogger -d lubelogger"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
labels:
|
|
- "docker-volume-backup.stop-during-backup=true"
|
|
|
|
networks:
|
|
lubelogger-int:
|
|
driver: bridge
|
|
|
|
volumes:
|
|
lubelogger-data:
|
|
lubelogger-keys:
|
|
lubelogger-db:
|
|
|
|
- name: Remove stale .env (secret now sourced from ansible-vault)
|
|
ansible.builtin.file:
|
|
path: "{{ app_dir }}/.env"
|
|
state: absent
|
|
|
|
- name: Deploy lubelogger with docker compose
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ app_dir }}"
|
|
state: present
|
|
pull: missing
|
|
register: app_result
|
|
|
|
- name: Show deployment result
|
|
ansible.builtin.debug:
|
|
msg: "lubelogger is {{ 'running (changed)' if app_result.changed else 'already up (no-op)' }} on port {{ app_port }}"
|