Infisical no longer needs pinning

Reviewed-on: #52

.ansible-lint

@@ -0,0 +1,4 @@
+strict: true
+use_default_rules: true
+skip_list:
+  - args[module]

.github/workflows/infra.yaml

@@ -29,13 +29,14 @@ jobs:
           apt update
           apt install -y python3-pip
           pip3 install -r requirements.txt
-          ansible-galaxy collection install community.general community.docker infisical.vault --force
+          ansible-galaxy collection install -r requirements.yml --force
+
+      - name: Run ansible-lint
+        uses: ansible/ansible-lint@v6
 
       - name: Check playbooks
         run: |
-          for file in $(find . -wholename "*/infra/*playbook.yaml" -type f); do
+          ansible-playbook --inventory ./inventory --syntax-check infra/**/*playbook.yaml
-            ansible-playbook --inventory ./inventory --syntax-check "$file"
-          done
 
       - name: Get changed playbooks
         id: files
@@ -75,7 +76,6 @@ jobs:
           SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
           INFISICAL_ENCRYPTION_KEY: ${{ secrets.INFISICAL_ENCRYPTION_KEY }}
           INFISICAL_AUTH_SECRET: ${{ secrets.INFISICAL_AUTH_SECRET }}
-          INFISICAL_MONGO_PASSWORD: ${{ secrets.INFISICAL_MONGO_PASSWORD }}
           INFISICAL_TOKEN: ${{ secrets.INFISICAL_TOKEN }}
           INFISICAL_URL: https://secrets.koval.net
         run: ansible-playbook --inventory ./inventory ${{ steps.playbooks.outputs.to_run }} -vv

infra/music/music/docker-compose.yml

@@ -49,4 +49,4 @@ services:
     volumes:
       - /mnt/nvme/filebrowser:/config
       - /mnt/media/downloads:/srv/downloads
-      - /mnt/media/music:/srv/music
+      - /mnt/media/music:/srv/music

infra/photos/immich/docker-compose.yml

@@ -4,7 +4,7 @@ services:
   immich-server:
     container_name: immich_server
     image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
-    command: [ "start.sh", "immich" ]
+    command: ["start.sh", "immich"]
     volumes:
       - ${UPLOAD_LOCATION}:/usr/src/app/upload
     env_file:
@@ -22,7 +22,7 @@ services:
     # extends:
     #   file: hwaccel.yml
     #   service: hwaccel
-    command: [ "start.sh", "microservices" ]
+    command: ["start.sh", "microservices"]
     volumes:
       - ${UPLOAD_LOCATION}:/usr/src/app/upload
     env_file:
@@ -48,7 +48,7 @@ services:
 
   database:
     container_name: immich_postgres
-    image: tensorchord/pgvecto-rs:pg14-v0.1.11
+    image: tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
     env_file:
       - .env
     environment:

infra/samba/samba/config.yml

@@ -15,12 +15,12 @@ global:
   - "force group = debian"
 
 share:
-  - name: kvkbackups 
+  - name: kvkbackups
     comment: KVK Backups
     path: /samba/kvkbackups
     validusers: kvk
     writelist: kvk
-    browsable: yes
+    browsable: true
-    readonly: no
+    readonly: false
-    guestok: no
+    guestok: false
-    veto: no
+    veto: false

infra/secrets/0000_proxmox_playbook.yaml

@@ -9,7 +9,7 @@
     api_token_secret: "{{ lookup('ansible.builtin.env', 'PROXMOX_TOKEN_SECRET') }}"
     ssh_public: "{{ lookup('ansible.builtin.env', 'SSH_PUBLIC') }}"
     vmname: "{{ inventory_hostname | regex_replace('^([^\\.]+)\\..+$', '\\1') }}"
-    node: pve
+    node: pve2
   module_defaults:
     community.general.proxmox_kvm:
       api_user: "{{ api_user }}"
@@ -91,7 +91,6 @@
         cores: 4
         memory: 4096
         cpu: x86-64-v3,flags=+spec-ctrl;+aes
-
     - name: Retart VM
       community.general.proxmox_kvm:
         state: restarted

infra/secrets/0001_initialise_playbook.yaml

@@ -39,4 +39,4 @@
         fstype: ext4
         opts: rw,errors=remount-ro,x-systemd.growfs
         state: mounted
-      become: true
+      become: true

infra/secrets/0002_docker_playbook.yaml

@@ -5,6 +5,7 @@
     - name: Wait for connection
       ansible.builtin.wait_for_connection:
         timeout: 300
+
     - name: Install dependencies
       ansible.builtin.apt:
         update_cache: true

infra/secrets/0003_infiscal_playbook.yaml

@@ -16,7 +16,6 @@
         src: "./{{ app }}"
         dest: "$HOME"
         mode: "0744"
-
     - name: Replace Encryption Key secret
       ansible.builtin.replace:
         path: "$HOME/{{ app }}/.env"
@@ -27,11 +26,6 @@
         path: "$HOME/{{ app }}/.env"
         regexp: "AUTH_SECRET_VALUE"
         replace: "{{ lookup('ansible.builtin.env', 'INFISICAL_AUTH_SECRET') }}"
-    - name: Replace Mongo Password secret
-      ansible.builtin.replace:
-        path: "$HOME/{{ app }}/.env"
-        regexp: "MONGO_PASSWORD_VALUE"
-        replace: "{{ lookup('ansible.builtin.env', 'INFISICAL_MONGO_PASSWORD') }}"
     - name: Replace SMTP Password secret
       ansible.builtin.replace:
         path: "$HOME/{{ app }}/.env"

infra/secrets/infisical/.env

@@ -8,19 +8,17 @@ ENCRYPTION_KEY=ENCRYPTION_KEY_VALUE
 # THIS IS A SAMPLE AUTH_SECRET KEY AND SHOULD NEVER BE USED FOR PRODUCTION
 AUTH_SECRET=AUTH_SECRET_VALUE
 
-# MongoDB
+# Postgres creds
-# Backend will connect to the MongoDB instance at connection string MONGO_URL which can either be a ref
+POSTGRES_PASSWORD=infisical
-# to the MongoDB container instance or Mongo Cloud
+POSTGRES_USER=infisical
+POSTGRES_DB=infisical
+
 # Required
-MONGO_URL=mongodb://root:MONGO_PASSWORD_VALUE@mongo:27017/?authSource=admin
+DB_CONNECTION_URI=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
 
 # Redis
 REDIS_URL=redis://redis:6379
 
-# Optional credentials for MongoDB container instance and Mongo-Express
-MONGO_USERNAME=root
-MONGO_PASSWORD=MONGO_PASSWORD_VALUE
-
 # Website URL
 # Required
 SITE_URL=https://secrets.koval.net
@@ -70,4 +68,4 @@ CLIENT_SECRET_GITLAB_LOGIN=
 
 # Other
 INVITE_ONLY_SIGNUP=true
-TELEMETRY_ENABLED=false
+TELEMETRY_ENABLED=false

infra/secrets/infisical/docker-compose.yml

@@ -1,11 +1,26 @@
 version: "3"
 
 services:
+  db-migration:
+    depends_on:
+      db:
+        condition: service_healthy
+    image: infisical/infisical:latest-postgres
+    env_file: .env
+    command: npm run migration:latest
+    pull_policy: always
+
   backend:
     restart: unless-stopped
     depends_on:
-      - mongo
+      db:
-    image: infisical/infisical:latest
+        condition: service_healthy
+      redis:
+        condition: service_started
+      db-migration:
+        condition: service_completed_successfully
+    image: infisical/infisical:latest-postgres
+    pull_policy: always
     env_file: .env
     ports:
       - 80:8080
@@ -20,14 +35,16 @@ services:
     ports:
       - 6379:6379
     volumes:
-      - /mnt/nvme/redis-data:/data
+      - /mnt/nvme/redis_data:/data
 
-  mongo:
+  db:
-    image: mongo
+    image: postgres:14-alpine
     restart: always
     env_file: .env
-    environment:
-      - MONGO_INITDB_ROOT_USERNAME=${MONGO_USERNAME}
-      - MONGO_INITDB_ROOT_PASSWORD=${MONGO_PASSWORD}
     volumes:
-      - /mnt/nvme/mongo-data:/data/db
+      - /mnt/nvme/pg_data:/var/lib/postgresql/data
+    healthcheck:
+      test: "pg_isready --username=${POSTGRES_USER} && psql --username=${POSTGRES_USER} --list"
+      interval: 5s
+      timeout: 10s
+      retries: 10

requirements.yml

@@ -0,0 +1,4 @@
+collections:
+  - name: community.general
+  - name: community.docker
+  - name: infisical.vault