twirre/ansible-domo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

binary deployment of twirre.me rust rewrite

Browse Source
This commit is contained in:
Twirre Meulenbelt
2026-06-28 10:08:18 +02:00
parent b44ff6f808
commit 0b65db0e50
8 changed files with 320 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
README.md
View File

@@ -11,7 +11,8 @@ Portable Ansible provisioning for Twirre infrastructure. The current layout uses
- A dedicated `backupagent` user for rsync-based backups with restricted SSH settings and passwordless `sudo /usr/bin/rsync`
- Docker from distro packages
- Bun installed to `/opt/bun` with `/usr/local/bin/bun`
- Two Bun app services: `twirre.io` and `twirre.me`
- The `twirre.io` Bun app service
- The `twirre.me` Rust binary service from a GitHub Release asset
- Gitea and Docker Mailserver as Compose stacks under `/srv`
- nginx virtual hosts for the retained public domains
- apt-based certbot with ACME webroot support
@@ -43,7 +44,7 @@ Update the inventory and variables first, especially:
- `inventory/hosts.yml`
- `group_vars/all/main.yml`
- `group_vars/all/vault.yml`
- repository URLs and domains for the Bun apps
- repository URLs, release versions, and domains for the app services
- `backupagent.authorized_keys`
Run a syntax check:
@@ -61,7 +62,7 @@ uv run ansible-playbook site.yml --ask-vault-pass
## Result
- `twirre.io`: Bun source checkout in `/srv/twirre/twirre.io`; runtime config in `/etc/twirre-io/app.env`; data in `/var/lib/twirre-io/app.sqlite3`, public files in `/var/lib/twirre-io/files`, and hidden files in `/var/lib/twirre-io/hfiles`; systemd unit `twirre_io.service`.
- `twirre.me`: Bun source checkout in `/srv/twirre/twirre.me`; runtime config in `/etc/twirre-me/app.env`; data directory reserved at `/var/lib/twirre-me`; systemd unit `twirre_me.service`.
- `twirre.me`: Rust release archive downloaded from GitHub Releases into `/opt/twirre-me/releases/<version>/`; `/opt/twirre-me/current` points at the selected version; runtime config in `/etc/twirre-me/app.env`; data directory reserved at `/var/lib/twirre-me`; systemd unit `twirre_me.service`.
- `Gitea`: Docker Compose stack in `/srv/gitea/compose.yaml`; persistent application data in `/srv/gitea/data`; systemd unit `gitea-compose.service`; public HTTP behind nginx at `git.twirre.io`, SSH on port `2222`.
- `Mailserver`: Docker Compose stack in `/srv/mail/compose.yaml` with environment in `/srv/mail/mailserver.env`; mail data, state, logs, and docker-mailserver config under `/srv/mail/docker-data/dms/`; Let's Encrypt certificates mounted from `/etc/letsencrypt`; systemd unit `mailserver-compose.service`.
- `lagrange.meulenbelt.nl`: static placeholder site rooted at `/srv/lagrange`.
@@ -71,6 +72,7 @@ uv run ansible-playbook site.yml --ask-vault-pass
## Notes
- nginx falls back to snakeoil certificates until a matching ACME certificate already exists on disk.
- `twirre.me` deploys the version declared in `binary_apps`; update `version` after publishing a matching GitHub Release asset and checksum.
- A run with `certbot_manage_certificates: true` requests certificates during that playbook run. If DNS and HTTP reachability are correct, issuance happens immediately.
- `mailserver` starts only after its live Let's Encrypt certificate exists on disk, so the same run that issues `mail.twirre.io` can also bring up Docker Mailserver.
- ACME issuance is disabled by default through `certbot_manage_certificates: false` so the first provisioning run can complete before DNS and public reachability are finalized.