Skip to content

Commit d9ff121

Browse files
GrotaxGrotax
committed
new webiste prod deploy
1 parent 9841b1d commit d9ff121

6 files changed

Lines changed: 98 additions & 141 deletions

File tree

‎README.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,21 @@ If you want to add a service host, place it in the dedicated service group in `h
5353
- `services_map` for the map stack (`batman`, `batctl`, `grafana_public`, `meshviewer`)
5454
- `services_web` for the web stack (`batman`, `batctl`, `website`, `firmware_release`, `firmware_selector`)
5555

56+
### Website deployment
57+
58+
The website role runs on `web-ffsh`. The main domain is served as a static site
59+
from `/var/www/web-static`; the beta domain remains at `/var/www/web-beta`.
60+
The previous WordPress files at `/var/www/web` and the PHP runtime are retained
61+
for rollback, but the main-domain vhost no longer serves them.
62+
63+
The Hugo repository's CI should build the site and deploy pushes to `main` only
64+
to beta, with production deployments restricted to version tags. Use separate
65+
SSH keys for the two destinations. Add their public keys to the Ansible Vault
66+
variables `vault_website_beta_deploy_public_key` and
67+
`vault_website_prod_deploy_public_key` in `group_vars/secrets.yml`; keep the
68+
matching private keys in the Hugo repository's CI secrets. The CI workflow is
69+
separate from this Ansible repository.
70+
5671
The standalone DNS host belongs to the `dns` group. The DNS play only installs
5772
node_exporter and bind_exporter; it does not manage the existing BIND service,
5873
zones, or listening addresses.

‎group_vars/secrets.yml‎

Lines changed: 26 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,27 @@
11
$ANSIBLE_VAULT;1.2;AES256;fastd_key
2-
64336137376336663336323131373233636138353362646638393732386563326136323465306639
3-
6561383436386463343731363635663764323266343930350a353438303533313836363836656430
4-
65653432366132396138343530336662316261656263346564353938623835653731356631366439
5-
3235383332646361610a616330666139653637356239643936376137623462313864616532363738
6-
65346532343666333638623338613137333961333762353737323636316361393236666330343061
7-
66383163653666383262666165633139383436643063653335666230393866653935383436646261
8-
66616235633839383539333531623834396163623232646532316634383137623064323534323562
9-
65636130653837646663393964623931316239616533306366363730353162366635376434343332
10-
36386438613532363865633531663564633663623263326362333332653666653132643033316339
11-
65633361393831663032643566613432613430376337366636666662333730656232333461396666
12-
37343731313163653531373333363634303230343138633965393538643566623266333030656534
13-
64643836623066653132313062313463383633363638353266666430343239373262386264333637
14-
35373238333835363564373062656666313662363639333934616337613364363338663435613230
15-
38336462613064336633373730303636373536356536303839663434643530656434323465623766
16-
37353136666162363735303664633462396663306234613161646166646537303937653433613034
17-
33616365663439626162656665316637356634643663343631626262393930653635396637366631
18-
37386233653733346261643238303230643236343761303537363130313333633435353834666234
19-
35666137353662666361643033616534656262633464346638303161323630363663346339326131
20-
66306637373963383261363865336638393132613436336566663036326538373834663139366235
21-
32653633393939386536626634356435303533646333396366396539316538653836646230323463
22-
6638
2+
66623338626636623361306163353237636232363038613432346536663430656234323463646432
3+
3866396231303831386566633339373336333663383230370a393239646266343361653532326663
4+
37643231306661663331336639383563626231326337323432383638393764636664616366663238
5+
3632656439646138310a386130626663616339646462623963656264336634386336386432396237
6+
64636661613965343439653734373436303335343765636636313466323165646130363135663764
7+
61373334633638663264376639323939646230363330346563383435646465303865646565636333
8+
61666533316130313262383732383135373531333961633730623730376237333131383534366664
9+
39656234333838373839623064366639306439333861366637396261356538613063633934643931
10+
31316330363566336235306638386661643434386534333836393133646165666131613930623832
11+
31306261323661323731393033613330646536363233383335613133613836376230613738623033
12+
31306162613162626664383666386330356137353238633430336338633633343665666530623533
13+
33363931346337376439366564626661393266373065303763333530313762366131373035376232
14+
62353566636465323433396665313063366463333063633362326330366239306231363964316437
15+
30323432316461616265306366313662373933343030646662393064343666373739323930633738
16+
65366365633234313365626436353134303563336333633834393238333964636566366630306366
17+
62333361623133383666326561333332363362393730623035663763633432336539663233643235
18+
62613333636139643935363936353337663266313537626665303937333930333265356135393436
19+
62643939376162663636303261343939643231616438643930316638306331623538633138353964
20+
32353133663037656365303862383937666134626132383864376564336262343734336437366234
21+
63366537626236643333663663663335323462646436616432663339343630633031336261633834
22+
35633236353263633666356132393761303366636166333537663539633964666130323938393139
23+
32373332383865616531333762333436356265356263646664623136376262326630333664646336
24+
62303832613938353633333562613633313530363037376638316666393331656135326466393965
25+
34383435636566623139333931626437393563643566363865613665316538626134333261333163
26+
37383531663333633030343436356166383339663866623833663334363833616463326132333835
27+
3531353863366538623664386562306266323339376139643036

‎group_vars/services_web.yml‎

Lines changed: 21 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,21 @@ website_vhosts:
22
- name: freifunk-suedholstein.de
33
aliases:
44
- www.freifunk-suedholstein.de
5-
root: /var/www/web
6-
index: index.php
7-
type: php
5+
root: /var/www/web-static
6+
owner: website-deploy
7+
group: www-data
8+
mode: "0755"
9+
index: index.html
10+
type: static
811
tls: true
912
redirect_http_to_https: true
10-
autoindex: true
13+
autoindex: false
1114
stats_proxy: http://127.0.0.1:9100/
1215
cors_enabled: true
1316
cors_allowed_origins:
1417
- localhost
1518
- www.freifunk-suedholstein.de
1619
- freifunk-suedholstein.de
17-
php_fpm_socket: /var/run/php/php8.3-fpm.sock
1820

1921
- name: firmware.freifunk-suedholstein.de
2022
aliases:
@@ -33,7 +35,7 @@ website_vhosts:
3335
root: /var/www/web-beta
3436
owner: beta-deploy
3537
group: www-data
36-
mode: "0775"
38+
mode: "0755"
3739
index: index.html
3840
type: static
3941
tls: true
@@ -42,17 +44,20 @@ website_vhosts:
4244
cors_enabled: false
4345
cors_allow_all: false
4446

45-
website_deploy_user:
46-
username: beta-deploy
47-
group: www-data
48-
groups:
49-
- www-data
50-
shell: /bin/bash
51-
web_root: /var/www/web-beta
52-
web_root_mode: "0775"
53-
ssh_key: "{{ vault_secrets.vault_website_beta_deploy_public_key | default('') }}"
47+
website_deploy_users:
48+
- username: beta-deploy
49+
group: www-data
50+
shell: /bin/bash
51+
web_root: /var/www/web-beta
52+
web_root_mode: "0755"
53+
ssh_key: "{{ vault_secrets.vault_website_beta_deploy_public_key | default('') }}"
54+
- username: website-deploy
55+
group: www-data
56+
shell: /bin/bash
57+
web_root: /var/www/web-static
58+
web_root_mode: "0755"
59+
ssh_key: "{{ vault_secrets.vault_website_prod_deploy_public_key | default('') }}"
5460

5561
website_nginx_sites_available_dir: /etc/nginx/sites-available
5662
website_nginx_sites_enabled_dir: /etc/nginx/sites-enabled
57-
website_php_fpm_socket: /var/run/php/php8.3-fpm.sock
5863
website_default_email: noc@freifunk-suedholstein.de

‎plan.md‎

Lines changed: 0 additions & 68 deletions
This file was deleted.

‎roles/website/defaults/main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,6 @@ website_default_tls: true
88
website_default_ssl_dhparam: /etc/nginx/dhparam.pem
99
website_default_email: noc@freifunk-suedholstein.de
1010
website_auto_issue_tls: false
11-
website_deploy_user: {}
11+
website_deploy_users: []
1212

1313
website_vhosts: []

‎roles/website/tasks/main.yml‎

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -8,57 +8,57 @@
88
- python3-certbot-nginx
99
state: present
1010

11-
- name: Ensure deployment user exists when configured
11+
- name: Ensure website deployment users exist
1212
ansible.builtin.user:
13-
name: "{{ website_deploy_user.username }}"
13+
name: "{{ deploy_user.username }}"
1414
state: present
1515
create_home: true
16-
shell: "{{ website_deploy_user.shell | default('/bin/bash') }}"
17-
group: "{{ website_deploy_user.group | default('www-data') }}"
18-
groups: "{{ website_deploy_user.groups | default(['www-data']) }}"
19-
append: true
20-
when:
21-
- website_deploy_user is defined
22-
- website_deploy_user.username is defined
23-
- website_deploy_user.username | length > 0
16+
shell: "{{ deploy_user.shell | default('/bin/bash') }}"
17+
group: "{{ deploy_user.group | default('www-data') }}"
18+
loop: "{{ website_deploy_users }}"
19+
loop_control:
20+
loop_var: deploy_user
21+
label: "{{ deploy_user.username }}"
2422

25-
- name: Ensure beta deployment directory exists and is writable
23+
- name: Ensure website deployment directories exist
2624
ansible.builtin.file:
27-
path: "{{ website_deploy_user.web_root }}"
25+
path: "{{ deploy_user.web_root }}"
2826
state: directory
29-
owner: "{{ website_deploy_user.username }}"
30-
group: "{{ website_deploy_user.group | default('www-data') }}"
31-
mode: "{{ website_deploy_user.web_root_mode | default('0775') }}"
32-
when:
33-
- website_deploy_user is defined
34-
- website_deploy_user.web_root is defined
35-
- website_deploy_user.web_root | length > 0
27+
owner: "{{ deploy_user.username }}"
28+
group: "{{ deploy_user.group | default('www-data') }}"
29+
mode: "{{ deploy_user.web_root_mode | default('0755') }}"
30+
loop: "{{ website_deploy_users }}"
31+
loop_control:
32+
loop_var: deploy_user
33+
label: "{{ deploy_user.web_root }}"
3634

37-
- name: Ensure beta deployment directory contents are writable for deploy user and web group
35+
- name: Ensure website deployment directory contents are owned by each deploy user
3836
ansible.builtin.file:
39-
path: "{{ website_deploy_user.web_root }}"
37+
path: "{{ deploy_user.web_root }}"
4038
state: directory
4139
recurse: true
42-
owner: "{{ website_deploy_user.username }}"
43-
group: "{{ website_deploy_user.group | default('www-data') }}"
44-
mode: "u=rwX,g=rwX,o=rX"
45-
when:
46-
- website_deploy_user is defined
47-
- website_deploy_user.web_root is defined
48-
- website_deploy_user.web_root | length > 0
40+
owner: "{{ deploy_user.username }}"
41+
group: "{{ deploy_user.group | default('www-data') }}"
42+
mode: "u=rwX,g=rX,o=rX"
43+
loop: "{{ website_deploy_users }}"
44+
loop_control:
45+
loop_var: deploy_user
46+
label: "{{ deploy_user.web_root }}"
4947

50-
- name: Install deploy SSH key for the deployment user
48+
- name: Install website deployment SSH keys
5149
ansible.posix.authorized_key:
52-
user: "{{ website_deploy_user.username }}"
50+
user: "{{ deploy_user.username }}"
5351
state: present
54-
key: "{{ website_deploy_user.ssh_key }}"
52+
key: "{{ deploy_user.ssh_key }}"
5553
exclusive: false
5654
manage_dir: true
55+
loop: "{{ website_deploy_users }}"
56+
loop_control:
57+
loop_var: deploy_user
58+
label: "{{ deploy_user.username }}"
5759
when:
58-
- website_deploy_user is defined
59-
- website_deploy_user.username is defined
60-
- website_deploy_user.ssh_key is defined
61-
- website_deploy_user.ssh_key | length > 0
60+
- deploy_user.ssh_key is defined
61+
- deploy_user.ssh_key | length > 0
6262

6363
- name: Ensure all website document roots exist
6464
ansible.builtin.file:

0 commit comments

Comments
 (0)