even more logging

.ansible-lint

@@ -1,4 +0,0 @@
-strict: true
-use_default_rules: true
-skip_list:
-  - args[module]

.github/workflows/infra.yaml

@@ -11,8 +11,8 @@ on:
       - main
 
 env:
-  DEPLOY: ${{ github.ref == 'refs/heads/main' && ((startsWith(github.event.head_commit.message, '[deploy-all]') && 'all') || ('some')) || 'none' }}
-  # DEPLOY: all
+  # DEPLOY: ${{ github.ref == 'refs/heads/main' && ((startsWith(github.event.head_commit.message, '[deploy-all]') && 'all') || ('some')) || 'none' }}
+  DEPLOY: all
 
 jobs:
   ansible-playbooks:
@@ -29,14 +29,13 @@ jobs:
           apt update
           apt install -y python3-pip
           pip3 install -r requirements.txt
-          ansible-galaxy collection install -r requirements.yml --force
-
-      - name: Run ansible-lint
-        uses: ansible/ansible-lint@v6
+          ansible-galaxy collection install community.general infisical.vault
 
       - name: Check playbooks
         run: |
-          ansible-playbook --inventory ./inventory --syntax-check infra/**/*playbook.yaml
+          for file in $(find . -wholename "*/infra/*playbook.yaml" -type f); do
+            ansible-playbook --inventory ./inventory --syntax-check "$file"
+          done
 
       - name: Get changed playbooks
         id: files
@@ -76,6 +75,11 @@ jobs:
           SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
           INFISICAL_ENCRYPTION_KEY: ${{ secrets.INFISICAL_ENCRYPTION_KEY }}
           INFISICAL_AUTH_SECRET: ${{ secrets.INFISICAL_AUTH_SECRET }}
+          INFISICAL_MONGO_PASSWORD: ${{ secrets.INFISICAL_MONGO_PASSWORD }}
           INFISICAL_TOKEN: ${{ secrets.INFISICAL_TOKEN }}
           INFISICAL_URL: https://secrets.koval.net
-        run: ansible-playbook --inventory ./inventory ${{ steps.playbooks.outputs.to_run }} -vv
+        run: |
+          echo $INFISICAL_URL
+          echo $INFISICAL_TOKEN | base64
+          sed -i "s/site_url=url/site_url=url, debug=True/g" /root/.ansible/collections/ansible_collections/infisical/vault/plugins/lookup/read_secrets.py
+          ansible-playbook --inventory ./inventory ./infra/photos/0003_immich_playbook.yaml -vvvvv

infra/cloud/0000_proxmox_playbook.yaml

@@ -36,7 +36,7 @@
       community.general.proxmox_kvm:
         clone: "{{ node }}-debian-12"
         storage: nvme
-      notify: Initial boot
+      register: create
     - name: Wait for status
       community.general.proxmox_kvm:
         state: current
@@ -65,8 +65,21 @@
           ipconfig0: ip=dhcp,ip6=auto
           ipconfig1: ip=dhcp
 
-    - name: Force all notified handlers to run
-      ansible.builtin.meta: flush_handlers
+    # Initial boot
+    # For some reason debian cloud images don't use
+    # cloud-init for networking on first boot (cloud-init files
+    # are regenerated AFTER networking starts). But we need the
+    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
+    - name: Initial boot
+      when: create.changed is true
+      block:
+        - name: Start
+          community.general.proxmox_kvm:
+            state: started
+          register: start
+        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
+          ansible.builtin.wait_for:
+            timeout: 90
 
     # VM Configuration
     - name: Resize root disk
@@ -95,18 +108,3 @@
       community.general.proxmox_kvm:
         state: restarted
         timeout: 60
-  handlers:
-    # Initial boot
-    # For some reason debian cloud images don't use
-    # cloud-init for networking on first boot (cloud-init files
-    # are regenerated AFTER networking starts). But we need the
-    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
-    - name: Initial boot
-      block:
-        - name: Start
-          community.general.proxmox_kvm:
-            state: started
-          register: start
-        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
-          ansible.builtin.wait_for:
-            timeout: 90

infra/cloud/0002_docker_playbook.yaml

@@ -1,4 +1,4 @@
-- name: Install docker
+- name: Install software
   hosts: cloud
   gather_facts: false
   tasks:

infra/cloud/0003_00_cleanup_script_deploy_playbook.yaml

@@ -1,13 +0,0 @@
-- name: Cleanup old ~/nextcloud directory
-  hosts: cloud
-  gather_facts: false
-  vars:
-    app: nextcloud
-  tasks:
-    - name: Wait for connection
-      ansible.builtin.wait_for_connection:
-        timeout: 300
-    - name: Delete nextcloud directory
-      ansible.builtin.file:
-        path: "$HOME/{{ app }}"
-        state: absent

infra/cloud/0003_nextcloud_playbook.yaml

@@ -2,29 +2,21 @@
   hosts: cloud
   gather_facts: false
   vars:
-    container: nextcloud-aio-mastercontainer
+    app: nextcloud
   tasks:
     - name: Wait for connection
       ansible.builtin.wait_for_connection:
         timeout: 300
-    - name: Deploy master container
-      community.docker.docker_container:
-        image: nextcloud/all-in-one:latest
-        recreate: true
-        state: started
-        restart_policy: unless-stopped
-        init: true
-        name: "{{ container }}"
-        published_ports:
-          - 8080:8080
-        env:
-          NEXTCLOUD_UPLOAD_LIMIT: 16G
-          NEXTCLOUD_MAX_TIME: "7200"
-          NEXTCLOUD_ADDITIONAL_APKS: imagemagick ffmpeg
-          APACHE_PORT: "11000"
-          APACHE_IP_BINDING: "0.0.0.0"
-          TZ: Europe/London
-          AIO_DISABLE_BACKUP_SECTION: "true"
-        volumes:
-          - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
-          - /var/run/docker.sock:/var/run/docker.sock:ro
+    - name: Get user
+      ansible.builtin.user:
+        name: debian
+      register: user
+    - name: Copy project
+      ansible.builtin.copy:
+        src: "./{{ app }}"
+        dest: "{{ user.home }}"
+        mode: "0744"
+    - name: Re-deploy
+      ansible.builtin.command: bash all-in-one.sh
+      args:
+        chdir: "{{ user.home }}/{{ app }}"

infra/cloud/0004_decommission_immich_playbook.yaml

@@ -0,0 +1,71 @@
+- name: Decommission Immich
+  hosts: cloud
+  gather_facts: false
+  vars:
+    app: immich
+    api_user: "{{ lookup('ansible.builtin.env', 'PROXMOX_USER') }}"
+    api_host: "{{ lookup('ansible.builtin.env', 'PROXMOX_HOST' ) }}"
+    api_token_id: "{{ lookup('ansible.builtin.env', 'PROXMOX_TOKEN_ID') }}"
+    api_token_secret: "{{ lookup('ansible.builtin.env', 'PROXMOX_TOKEN_SECRET') }}"
+    vmname: "{{ inventory_hostname | regex_replace('^([^\\.]+)\\..+$', '\\1') }}"
+    node: pve
+  module_defaults:
+    community.general.proxmox_kvm:
+      api_user: "{{ api_user }}"
+      api_host: "{{ api_host }}"
+      api_token_id: "{{ api_token_id }}"
+      api_token_secret: "{{ api_token_secret }}"
+      name: "{{ vmname }}"
+      node: "{{ node }}"
+    community.general.proxmox_disk:
+      api_user: "{{ api_user }}"
+      api_host: "{{ api_host }}"
+      api_token_id: "{{ api_token_id }}"
+      api_token_secret: "{{ api_token_secret }}"
+      name: "{{ vmname }}"
+  tasks:
+    - name: Wait for connection
+      ansible.builtin.wait_for_connection:
+        timeout: 300
+    - name: Get user
+      ansible.builtin.user:
+        name: debian
+      register: user
+    - name: Docker compose down
+      ansible.builtin.command: docker compose down
+      args:
+        chdir: "{{ user.home }}/{{ app }}"
+      ignore_errors: true
+    - name: Remove docker volumes
+      ansible.builtin.command: docker compose down --volumes
+      args:
+        chdir: "{{ user.home }}/{{ app }}"
+      ignore_errors: true
+    - name: Remove config directory
+      ansible.builtin.file:
+        path: "{{ user.home }}/{{ app }}"
+        state: absent
+
+    - name: Destroy media disk
+      community.general.proxmox_disk:
+        disk: scsi2
+        state: absent
+      delegate_to: localhost
+    - name: Remove media mount
+      ansible.posix.mount:
+        src: /dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:2-part1
+        path: /mnt/media
+        fstype: ext4
+        opts: rw,errors=remount-ro,x-systemd.growfs
+        state: absent
+      become: true
+    - name: Remove media directory
+      ansible.builtin.file:
+        path: /mnt/media
+        state: absent
+      become: true
+    - name: Restart VM
+      community.general.proxmox_kvm:
+        state: restarted
+        timeout: 60
+      delegate_to: localhost

infra/cloud/nextcloud/all-in-one.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+docker stop nextcloud-aio-mastercontainer || true
+docker rm nextcloud-aio-mastercontainer || true
+
+docker run \
+--init \
+--sig-proxy=false \
+--name nextcloud-aio-mastercontainer \
+--restart unless-stopped \
+--publish 8080:8080 \
+--env NEXTCLOUD_UPLOAD_LIMIT=16G \
+--env NEXTCLOUD_MAX_TIME=7200 \
+--env NEXTCLOUD_ADDITIONAL_APKS="imagemagick ffmpeg" \
+--env APACHE_PORT=11000 \
+--env APACHE_IP_BINDING=0.0.0.0 \
+--env TZ=Europe/London \
+--env AIO_DISABLE_BACKUP_SECTION=true \
+--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
+--volume /var/run/docker.sock:/var/run/docker.sock:ro \
+-d nextcloud/all-in-one:latest

infra/music/0000_proxmox_playbook.yaml

@@ -36,7 +36,7 @@
       community.general.proxmox_kvm:
         clone: "{{ node }}-debian-12"
         storage: nvme
-      notify: Initial boot
+      register: create
     - name: Wait for status
       community.general.proxmox_kvm:
         state: current
@@ -65,8 +65,21 @@
           ipconfig0: ip=dhcp,ip6=auto
           ipconfig1: ip=dhcp
 
-    - name: Force all notified handlers to run
-      ansible.builtin.meta: flush_handlers
+    # Initial boot
+    # For some reason debian cloud images don't use
+    # cloud-init for networking on first boot (cloud-init files
+    # are regenerated AFTER networking starts). But we need the
+    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
+    - name: Initial boot
+      when: create.changed is true
+      block:
+        - name: Start
+          community.general.proxmox_kvm:
+            state: started
+          register: start
+        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
+          ansible.builtin.wait_for:
+            timeout: 90
 
     # VM Configuration
     - name: Resize root disk
@@ -101,18 +114,3 @@
       community.general.proxmox_kvm:
         state: restarted
         timeout: 60
-  handlers:
-    # Initial boot
-    # For some reason debian cloud images don't use
-    # cloud-init for networking on first boot (cloud-init files
-    # are regenerated AFTER networking starts). But we need the
-    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
-    - name: Initial boot
-      block:
-        - name: Start
-          community.general.proxmox_kvm:
-            state: started
-          register: start
-        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
-          ansible.builtin.wait_for:
-            timeout: 90

infra/music/0002_docker_playbook.yaml

@@ -1,4 +1,4 @@
-- name: Install docker
+- name: Install software
   hosts: music
   gather_facts: false
   tasks:

infra/music/0003_music_playbook.yaml

@@ -7,39 +7,46 @@
     - name: Wait for connection
       ansible.builtin.wait_for_connection:
         timeout: 300
+    - name: Get user
+      ansible.builtin.user:
+        name: debian
+      register: user
     - name: Docker compose down
-      community.docker.docker_compose_v2:
-        project_src: "$HOME/{{ app }}"
-        state: absent
+      ansible.builtin.command: docker compose down
+      args:
+        chdir: "{{ user.home }}/{{ app }}"
+      ignore_errors: true
     - name: Copy project
       ansible.builtin.copy:
         src: "./{{ app }}"
-        dest: "$HOME"
+        dest: "{{ user.home }}"
         mode: "0744"
+
     - name: Replace LastFM API key secret
       ansible.builtin.replace:
-        path: "$HOME/{{ app }}/.env"
+        path: "{{ user.home }}/{{ app }}/.env"
         regexp: "LASTFM_APIKEY_VALUE"
         replace: "{{ lookup('infisical.vault.read_secrets', env_slug='prod', path='/music', secret_name='LASTFM_APIKEY')['value'] }}"
     - name: Replace LastFM secret
       ansible.builtin.replace:
-        path: "$HOME/{{ app }}/.env"
+        path: "{{ user.home }}/{{ app }}/.env"
         regexp: "LASTFM_SECRET_VALUE"
         replace: "{{ lookup('infisical.vault.read_secrets', env_slug='prod', path='/music', secret_name='LASTFM_SECRET')['value'] }}"
     - name: Replace Mongo Password secret
       ansible.builtin.replace:
-        path: "$HOME/{{ app }}/.env"
+        path: "{{ user.home }}/{{ app }}/.env"
         regexp: "SPOTIFY_ID_VALUE"
         replace: "{{ lookup('infisical.vault.read_secrets', env_slug='prod', path='/music', secret_name='SPOTIFY_ID')['value'] }}"
     - name: Replace SMTP Password secret
       ansible.builtin.replace:
-        path: "$HOME/{{ app }}/.env"
+        path: "{{ user.home }}/{{ app }}/.env"
         regexp: "SPOTIFY_SECRET_VALUE"
         replace: "{{ lookup('infisical.vault.read_secrets', env_slug='prod', path='/music', secret_name='SPOTIFY_SECRET')['value'] }}"
 
-    - name: Docker compose up
-      community.docker.docker_compose_v2:
-        project_src: "$HOME/{{ app }}"
+    - name: Docker compose up -d
+      ansible.builtin.command: docker compose up -d
+      args:
+        chdir: "{{ user.home }}/{{ app }}"
 
     - name: Update data permissions
       ansible.builtin.file:

infra/music/music/docker-compose.yml

@@ -49,4 +49,4 @@ services:
     volumes:
       - /mnt/nvme/filebrowser:/config
       - /mnt/media/downloads:/srv/downloads
-      - /mnt/media/music:/srv/music
+      - /mnt/media/music:/srv/music

infra/photos/0000_proxmox_playbook.yaml

@@ -36,7 +36,7 @@
       community.general.proxmox_kvm:
         clone: "{{ node }}-debian-12"
         storage: nvme
-      notify: Initial boot
+      register: create
     - name: Wait for status
       community.general.proxmox_kvm:
         state: current
@@ -65,8 +65,21 @@
           ipconfig0: ip=dhcp,ip6=auto
           ipconfig1: ip=dhcp
 
-    - name: Force all notified handlers to run
-      ansible.builtin.meta: flush_handlers
+    # Initial boot
+    # For some reason debian cloud images don't use
+    # cloud-init for networking on first boot (cloud-init files
+    # are regenerated AFTER networking starts). But we need the
+    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
+    - name: Initial boot
+      when: create.changed is true
+      block:
+        - name: Start
+          community.general.proxmox_kvm:
+            state: started
+          register: start
+        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
+          ansible.builtin.wait_for:
+            timeout: 90
 
     # VM Configuration
     - name: Resize root disk
@@ -101,18 +114,3 @@
       community.general.proxmox_kvm:
         state: restarted
         timeout: 60
-  handlers:
-    # Initial boot
-    # For some reason debian cloud images don't use
-    # cloud-init for networking on first boot (cloud-init files
-    # are regenerated AFTER networking starts). But we need the
-    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
-    - name: Initial boot
-      block:
-        - name: Start
-          community.general.proxmox_kvm:
-            state: started
-          register: start
-        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
-          ansible.builtin.wait_for:
-            timeout: 90

infra/photos/0002_docker_playbook.yaml

@@ -1,4 +1,4 @@
-- name: Install docker
+- name: Install software
   hosts: photos
   gather_facts: false
   tasks:

infra/photos/0003_immich_playbook.yaml

@@ -7,25 +7,32 @@
     - name: Wait for connection
       ansible.builtin.wait_for_connection:
         timeout: 300
+    - name: Get user
+      ansible.builtin.user:
+        name: debian
+      register: user
+
     - name: Docker compose down
-      community.docker.docker_compose_v2:
-        project_src: "$HOME/{{ app }}"
-        state: absent
+      ansible.builtin.command: docker compose down
+      args:
+        chdir: "{{ user.home }}/{{ app }}"
+      ignore_errors: true
     - name: Copy project
       ansible.builtin.copy:
         src: "./{{ app }}"
-        dest: "$HOME"
+        dest: "{{ user.home }}"
         mode: "0744"
     - name: Replace Typesense secret
       ansible.builtin.replace:
-        path: "$HOME/{{ app }}/.env"
+        path: "{{ user.home }}/{{ app }}/.env"
         regexp: "TYPESENSE_API_KEY_VALUE"
         replace: "{{ lookup('infisical.vault.read_secrets', env_slug='prod', path='/photos', secret_name='TYPESENSE_API_KEY')['value'] }}"
     - name: Replace DB secret
       ansible.builtin.replace:
-        path: "$HOME/{{ app }}/.env"
+        path: "{{ user.home }}/{{ app }}/.env"
         regexp: "DB_PASSWORD_VALUE"
         replace: "{{ lookup('infisical.vault.read_secrets', env_slug='prod', path='/photos', secret_name='DB_PASSWORD')['value'] }}"
     - name: Docker compose up -d
-      community.docker.docker_compose_v2:
-        project_src: "$HOME/{{ app }}"
+      ansible.builtin.command: docker compose up -d
+      args:
+        chdir: "{{ user.home }}/{{ app }}"

infra/samba/0000_proxmox_playbook.yaml

@@ -36,7 +36,7 @@
       community.general.proxmox_kvm:
         clone: "{{ node }}-debian-12"
         storage: nvme
-      notify: Initial boot
+      register: create
     - name: Wait for status
       community.general.proxmox_kvm:
         state: current
@@ -65,8 +65,21 @@
           ipconfig0: ip=dhcp,ip6=auto
           ipconfig1: ip=dhcp
 
-    - name: Force all notified handlers to run
-      ansible.builtin.meta: flush_handlers
+    # Initial boot
+    # For some reason debian cloud images don't use
+    # cloud-init for networking on first boot (cloud-init files
+    # are regenerated AFTER networking starts). But we need the
+    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
+    - name: Initial boot
+      when: create.changed is true
+      block:
+        - name: Start
+          community.general.proxmox_kvm:
+            state: started
+          register: start
+        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
+          ansible.builtin.wait_for:
+            timeout: 90
 
     # VM Configuration
     - name: Resize root disk
@@ -100,18 +113,3 @@
       community.general.proxmox_kvm:
         state: restarted
         timeout: 60
-  handlers:
-    # Initial boot
-    # For some reason debian cloud images don't use
-    # cloud-init for networking on first boot (cloud-init files
-    # are regenerated AFTER networking starts). But we need the
-    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
-    - name: Initial boot
-      block:
-        - name: Start
-          community.general.proxmox_kvm:
-            state: started
-          register: start
-        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
-          ansible.builtin.wait_for:
-            timeout: 90

infra/samba/0002_docker_playbook.yaml

@@ -1,4 +1,4 @@
-- name: Install docker
+- name: Install software
   hosts: samba
   gather_facts: false
   tasks:

infra/samba/0003_samba_playbook.yaml

@@ -7,25 +7,32 @@
     - name: Wait for connection
       ansible.builtin.wait_for_connection:
         timeout: 300
+    - name: Get user
+      ansible.builtin.user:
+        name: debian
+      register: user
+
     - name: Docker compose down
-      community.docker.docker_compose_v2:
-        project_src: "$HOME/{{ app }}"
-        state: absent
+      ansible.builtin.command: docker compose down
+      args:
+        chdir: "{{ user.home }}/{{ app }}"
+      ignore_errors: true
     - name: Copy project
       ansible.builtin.copy:
         src: "./{{ app }}"
-        dest: "$HOME"
+        dest: "{{ user.home }}"
         mode: "0744"
 
     - name: Replace KVK Password secret
       ansible.builtin.replace:
-        path: "$HOME/{{ app }}/config.yml"
+        path: "{{ user.home }}/{{ app }}/config.yml"
         regexp: "KVK_PASSWORD"
         replace: "{{ lookup('infisical.vault.read_secrets', env_slug='prod', path='/samba', secret_name='KVK_PASSWORD')['value'] }}"
 
-    - name: Docker compose up
-      community.docker.docker_compose_v2:
-        project_src: "$HOME/{{ app }}"
+    - name: Docker compose up -d
+      ansible.builtin.command: docker compose up -d
+      args:
+        chdir: "{{ user.home }}/{{ app }}"
 
     - name: Update samba permissions
       ansible.builtin.file:

infra/samba/samba/config.yml

@@ -15,12 +15,12 @@ global:
   - "force group = debian"
 
 share:
-  - name: kvkbackups
+  - name: kvkbackups 
     comment: KVK Backups
     path: /samba/kvkbackups
     validusers: kvk
     writelist: kvk
-    browsable: true
-    readonly: false
-    guestok: false
-    veto: false
+    browsable: yes
+    readonly: no
+    guestok: no
+    veto: no

infra/secrets/0000_proxmox_playbook.yaml

@@ -9,7 +9,7 @@
     api_token_secret: "{{ lookup('ansible.builtin.env', 'PROXMOX_TOKEN_SECRET') }}"
     ssh_public: "{{ lookup('ansible.builtin.env', 'SSH_PUBLIC') }}"
     vmname: "{{ inventory_hostname | regex_replace('^([^\\.]+)\\..+$', '\\1') }}"
-    node: pve2
+    node: pve
   module_defaults:
     community.general.proxmox_kvm:
       api_user: "{{ api_user }}"
@@ -36,7 +36,7 @@
       community.general.proxmox_kvm:
         clone: "{{ node }}-debian-12"
         storage: nvme
-      notify: Initial boot
+      register: create
     - name: Wait for status
       community.general.proxmox_kvm:
         state: current
@@ -65,8 +65,21 @@
           ipconfig0: ip=dhcp,ip6=auto
           ipconfig1: ip=dhcp
 
-    - name: Force all notified handlers to run
-      ansible.builtin.meta: flush_handlers
+    # Initial boot
+    # For some reason debian cloud images don't use
+    # cloud-init for networking on first boot (cloud-init files
+    # are regenerated AFTER networking starts). But we need the
+    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
+    - name: Initial boot
+      when: create.changed is true
+      block:
+        - name: Start
+          community.general.proxmox_kvm:
+            state: started
+          register: start
+        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
+          ansible.builtin.wait_for:
+            timeout: 90
 
     # VM Configuration
     - name: Resize root disk
@@ -91,22 +104,8 @@
         cores: 4
         memory: 4096
         cpu: x86-64-v3,flags=+spec-ctrl;+aes
+
     - name: Retart VM
       community.general.proxmox_kvm:
         state: restarted
         timeout: 60
-  handlers:
-    # Initial boot
-    # For some reason debian cloud images don't use
-    # cloud-init for networking on first boot (cloud-init files
-    # are regenerated AFTER networking starts). But we need the
-    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
-    - name: Initial boot
-      block:
-        - name: Start
-          community.general.proxmox_kvm:
-            state: started
-          register: start
-        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
-          ansible.builtin.wait_for:
-            timeout: 90

infra/secrets/0001_initialise_playbook.yaml

@@ -39,4 +39,4 @@
         fstype: ext4
         opts: rw,errors=remount-ro,x-systemd.growfs
         state: mounted
-      become: true
+      become: true

infra/secrets/0002_docker_playbook.yaml

@@ -1,11 +1,10 @@
-- name: Install docker
+- name: Install software
   hosts: secrets
   gather_facts: false
   tasks:
     - name: Wait for connection
       ansible.builtin.wait_for_connection:
         timeout: 300
-
     - name: Install dependencies
       ansible.builtin.apt:
         update_cache: true

infra/secrets/0003_infiscal_playbook.yaml

@@ -7,31 +7,43 @@
     - name: Wait for connection
       ansible.builtin.wait_for_connection:
         timeout: 300
+    - name: Get user
+      ansible.builtin.user:
+        name: debian
+      register: user
     - name: Docker compose down
-      community.docker.docker_compose_v2:
-        project_src: "$HOME/{{ app }}"
-        state: absent
+      ansible.builtin.command: docker compose down
+      args:
+        chdir: "{{ user.home }}/{{ app }}"
+      ignore_errors: true
     - name: Copy project
       ansible.builtin.copy:
         src: "./{{ app }}"
-        dest: "$HOME"
+        dest: "{{ user.home }}"
         mode: "0744"
+
     - name: Replace Encryption Key secret
       ansible.builtin.replace:
-        path: "$HOME/{{ app }}/.env"
+        path: "{{ user.home }}/{{ app }}/.env"
         regexp: "ENCRYPTION_KEY_VALUE"
         replace: "{{ lookup('ansible.builtin.env', 'INFISICAL_ENCRYPTION_KEY') }}"
     - name: Replace Auth secret
       ansible.builtin.replace:
-        path: "$HOME/{{ app }}/.env"
+        path: "{{ user.home }}/{{ app }}/.env"
         regexp: "AUTH_SECRET_VALUE"
         replace: "{{ lookup('ansible.builtin.env', 'INFISICAL_AUTH_SECRET') }}"
+    - name: Replace Mongo Password secret
+      ansible.builtin.replace:
+        path: "{{ user.home }}/{{ app }}/.env"
+        regexp: "MONGO_PASSWORD_VALUE"
+        replace: "{{ lookup('ansible.builtin.env', 'INFISICAL_MONGO_PASSWORD') }}"
     - name: Replace SMTP Password secret
       ansible.builtin.replace:
-        path: "$HOME/{{ app }}/.env"
+        path: "{{ user.home }}/{{ app }}/.env"
         regexp: "SMTP_PASSWORD_VALUE"
         replace: "{{ lookup('ansible.builtin.env', 'SMTP_PASSWORD') }}"
 
     - name: Docker compose up -d
-      community.docker.docker_compose_v2:
-        project_src: "$HOME/{{ app }}"
+      ansible.builtin.command: docker compose up -d
+      args:
+        chdir: "{{ user.home }}/{{ app }}"

infra/secrets/infisical/.env

@@ -8,17 +8,19 @@ ENCRYPTION_KEY=ENCRYPTION_KEY_VALUE
 # THIS IS A SAMPLE AUTH_SECRET KEY AND SHOULD NEVER BE USED FOR PRODUCTION
 AUTH_SECRET=AUTH_SECRET_VALUE
 
-# Postgres creds
-POSTGRES_PASSWORD=infisical
-POSTGRES_USER=infisical
-POSTGRES_DB=infisical
-
+# MongoDB
+# Backend will connect to the MongoDB instance at connection string MONGO_URL which can either be a ref
+# to the MongoDB container instance or Mongo Cloud
 # Required
-DB_CONNECTION_URI=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
+MONGO_URL=mongodb://root:MONGO_PASSWORD_VALUE@mongo:27017/?authSource=admin
 
 # Redis
 REDIS_URL=redis://redis:6379
 
+# Optional credentials for MongoDB container instance and Mongo-Express
+MONGO_USERNAME=root
+MONGO_PASSWORD=MONGO_PASSWORD_VALUE
+
 # Website URL
 # Required
 SITE_URL=https://secrets.koval.net
@@ -68,4 +70,4 @@ CLIENT_SECRET_GITLAB_LOGIN=
 
 # Other
 INVITE_ONLY_SIGNUP=true
-TELEMETRY_ENABLED=false
+TELEMETRY_ENABLED=false

infra/secrets/infisical/docker-compose.yml

@@ -1,26 +1,11 @@
 version: "3"
 
 services:
-  db-migration:
-    depends_on:
-      db:
-        condition: service_healthy
-    image: infisical/infisical:latest-postgres
-    env_file: .env
-    command: npm run migration:latest
-    pull_policy: always
-
   backend:
     restart: unless-stopped
     depends_on:
-      db:
-        condition: service_healthy
-      redis:
-        condition: service_started
-      db-migration:
-        condition: service_completed_successfully
-    image: infisical/infisical:latest-postgres
-    pull_policy: always
+      - mongo
+    image: infisical/infisical:latest
     env_file: .env
     ports:
       - 80:8080
@@ -35,16 +20,14 @@ services:
     ports:
       - 6379:6379
     volumes:
-      - /mnt/nvme/redis_data:/data
+      - /mnt/nvme/redis-data:/data
 
-  db:
-    image: postgres:14-alpine
+  mongo:
+    image: mongo
     restart: always
     env_file: .env
+    environment:
+      - MONGO_INITDB_ROOT_USERNAME=${MONGO_USERNAME}
+      - MONGO_INITDB_ROOT_PASSWORD=${MONGO_PASSWORD}
     volumes:
-      - /mnt/nvme/pg_data:/var/lib/postgresql/data
-    healthcheck:
-      test: "pg_isready --username=${POSTGRES_USER} && psql --username=${POSTGRES_USER} --list"
-      interval: 5s
-      timeout: 10s
-      retries: 10
+      - /mnt/nvme/mongo-data:/data/db

requirements.yml

@@ -1,4 +0,0 @@
-collections:
-  - name: community.general
-  - name: community.docker
-  - name: infisical.vault