Compare commits

...

7 Commits

Author SHA1 Message Date
Gleb Koval ef780275e7
Infisical no longer needs pinning
Infrastructure / Check and run Ansbile playbooks (pull_request) Failing after 3m30s Details
2024-03-29 16:24:22 +00:00
Gleb Koval 87df3eb334
Merge branch 'main' into cleanup-playbooks 2024-03-29 16:23:17 +00:00
Gleb Koval 9f51ce02d6 Fix #50: Remove custom network *completely* from Infisical docker-compose (#52)
Infrastructure / Check and run Ansbile playbooks (push) Successful in 3m14s Details
Reviewed-on: #52
2024-03-29 15:57:07 +00:00
Gleb Koval 719640a98d Fix #50: Trigger all secrets playbooks (#51)
Infrastructure / Check and run Ansbile playbooks (push) Failing after 5m46s Details
Keep forgetting this :/

Reviewed-on: #51
2024-03-29 15:48:14 +00:00
Gleb Koval 20b72f085f Secrets VM: v2 (#50)
Infrastructure / Check and run Ansbile playbooks (push) Failing after 4m34s Details
Closes #44. We'll do a manual migration for stability and simplicity.

Reviewed-on: #50
2024-03-29 15:24:57 +00:00
Gleb Koval da90d463de Fix Infisical Gitea Actions (#43)
Infrastructure / Check and run Ansbile playbooks (push) Successful in 2m6s Details
For some reason secrets are failing: https://git.koval.net/cyclane/kovalhome/actions/runs/193

Reviewed-on: #43
2024-03-01 00:37:04 +00:00
Gleb Koval 68259cb3cf Upgrade Immich to 1.95 (#42)
Infrastructure / Check and run Ansbile playbooks (push) Failing after 2m4s Details
And again...

https://github.com/immich-app/immich/releases/tag/v1.95.0

Reviewed-on: #42
2024-02-29 22:53:28 +00:00
7 changed files with 36 additions and 28 deletions

View File

@ -76,7 +76,6 @@ jobs:
SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }} SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
INFISICAL_ENCRYPTION_KEY: ${{ secrets.INFISICAL_ENCRYPTION_KEY }} INFISICAL_ENCRYPTION_KEY: ${{ secrets.INFISICAL_ENCRYPTION_KEY }}
INFISICAL_AUTH_SECRET: ${{ secrets.INFISICAL_AUTH_SECRET }} INFISICAL_AUTH_SECRET: ${{ secrets.INFISICAL_AUTH_SECRET }}
INFISICAL_MONGO_PASSWORD: ${{ secrets.INFISICAL_MONGO_PASSWORD }}
INFISICAL_TOKEN: ${{ secrets.INFISICAL_TOKEN }} INFISICAL_TOKEN: ${{ secrets.INFISICAL_TOKEN }}
INFISICAL_URL: https://secrets.koval.net INFISICAL_URL: https://secrets.koval.net
run: ansible-playbook --inventory ./inventory ${{ steps.playbooks.outputs.to_run }} -vv run: ansible-playbook --inventory ./inventory ${{ steps.playbooks.outputs.to_run }} -vv

View File

@ -48,7 +48,7 @@ services:
database: database:
container_name: immich_postgres container_name: immich_postgres
image: tensorchord/pgvecto-rs:pg14-v0.1.11 image: tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
env_file: env_file:
- .env - .env
environment: environment:

View File

@ -9,7 +9,7 @@
api_token_secret: "{{ lookup('ansible.builtin.env', 'PROXMOX_TOKEN_SECRET') }}" api_token_secret: "{{ lookup('ansible.builtin.env', 'PROXMOX_TOKEN_SECRET') }}"
ssh_public: "{{ lookup('ansible.builtin.env', 'SSH_PUBLIC') }}" ssh_public: "{{ lookup('ansible.builtin.env', 'SSH_PUBLIC') }}"
vmname: "{{ inventory_hostname | regex_replace('^([^\\.]+)\\..+$', '\\1') }}" vmname: "{{ inventory_hostname | regex_replace('^([^\\.]+)\\..+$', '\\1') }}"
node: pve node: pve2
module_defaults: module_defaults:
community.general.proxmox_kvm: community.general.proxmox_kvm:
api_user: "{{ api_user }}" api_user: "{{ api_user }}"
@ -91,7 +91,6 @@
cores: 4 cores: 4
memory: 4096 memory: 4096
cpu: x86-64-v3,flags=+spec-ctrl;+aes cpu: x86-64-v3,flags=+spec-ctrl;+aes
- name: Retart VM - name: Retart VM
community.general.proxmox_kvm: community.general.proxmox_kvm:
state: restarted state: restarted

View File

@ -5,6 +5,7 @@
- name: Wait for connection - name: Wait for connection
ansible.builtin.wait_for_connection: ansible.builtin.wait_for_connection:
timeout: 300 timeout: 300
- name: Install dependencies - name: Install dependencies
ansible.builtin.apt: ansible.builtin.apt:
update_cache: true update_cache: true

View File

@ -16,7 +16,6 @@
src: "./{{ app }}" src: "./{{ app }}"
dest: "$HOME" dest: "$HOME"
mode: "0744" mode: "0744"
- name: Replace Encryption Key secret - name: Replace Encryption Key secret
ansible.builtin.replace: ansible.builtin.replace:
path: "$HOME/{{ app }}/.env" path: "$HOME/{{ app }}/.env"
@ -27,11 +26,6 @@
path: "$HOME/{{ app }}/.env" path: "$HOME/{{ app }}/.env"
regexp: "AUTH_SECRET_VALUE" regexp: "AUTH_SECRET_VALUE"
replace: "{{ lookup('ansible.builtin.env', 'INFISICAL_AUTH_SECRET') }}" replace: "{{ lookup('ansible.builtin.env', 'INFISICAL_AUTH_SECRET') }}"
- name: Replace Mongo Password secret
ansible.builtin.replace:
path: "$HOME/{{ app }}/.env"
regexp: "MONGO_PASSWORD_VALUE"
replace: "{{ lookup('ansible.builtin.env', 'INFISICAL_MONGO_PASSWORD') }}"
- name: Replace SMTP Password secret - name: Replace SMTP Password secret
ansible.builtin.replace: ansible.builtin.replace:
path: "$HOME/{{ app }}/.env" path: "$HOME/{{ app }}/.env"

View File

@ -8,19 +8,17 @@ ENCRYPTION_KEY=ENCRYPTION_KEY_VALUE
# THIS IS A SAMPLE AUTH_SECRET KEY AND SHOULD NEVER BE USED FOR PRODUCTION # THIS IS A SAMPLE AUTH_SECRET KEY AND SHOULD NEVER BE USED FOR PRODUCTION
AUTH_SECRET=AUTH_SECRET_VALUE AUTH_SECRET=AUTH_SECRET_VALUE
# MongoDB # Postgres creds
# Backend will connect to the MongoDB instance at connection string MONGO_URL which can either be a ref POSTGRES_PASSWORD=infisical
# to the MongoDB container instance or Mongo Cloud POSTGRES_USER=infisical
POSTGRES_DB=infisical
# Required # Required
MONGO_URL=mongodb://root:MONGO_PASSWORD_VALUE@mongo:27017/?authSource=admin DB_CONNECTION_URI=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
# Redis # Redis
REDIS_URL=redis://redis:6379 REDIS_URL=redis://redis:6379
# Optional credentials for MongoDB container instance and Mongo-Express
MONGO_USERNAME=root
MONGO_PASSWORD=MONGO_PASSWORD_VALUE
# Website URL # Website URL
# Required # Required
SITE_URL=https://secrets.koval.net SITE_URL=https://secrets.koval.net

View File

@ -1,11 +1,26 @@
version: "3" version: "3"
services: services:
db-migration:
depends_on:
db:
condition: service_healthy
image: infisical/infisical:latest-postgres
env_file: .env
command: npm run migration:latest
pull_policy: always
backend: backend:
restart: unless-stopped restart: unless-stopped
depends_on: depends_on:
- mongo db:
image: infisical/infisical:latest condition: service_healthy
redis:
condition: service_started
db-migration:
condition: service_completed_successfully
image: infisical/infisical:latest-postgres
pull_policy: always
env_file: .env env_file: .env
ports: ports:
- 80:8080 - 80:8080
@ -20,14 +35,16 @@ services:
ports: ports:
- 6379:6379 - 6379:6379
volumes: volumes:
- /mnt/nvme/redis-data:/data - /mnt/nvme/redis_data:/data
mongo: db:
image: mongo image: postgres:14-alpine
restart: always restart: always
env_file: .env env_file: .env
environment:
- MONGO_INITDB_ROOT_USERNAME=${MONGO_USERNAME}
- MONGO_INITDB_ROOT_PASSWORD=${MONGO_PASSWORD}
volumes: volumes:
- /mnt/nvme/mongo-data:/data/db - /mnt/nvme/pg_data:/var/lib/postgresql/data
healthcheck:
test: "pg_isready --username=${POSTGRES_USER} && psql --username=${POSTGRES_USER} --list"
interval: 5s
timeout: 10s
retries: 10