luke/ansible-roles/nostr, branch mainAnsible roles for nth.io infrastructure
https://src.nth.io/luke/ansible-roles/atom?h=main2026-07-31T19:31:51Zinstall from the 26.04 archive instead of third-party sources2026-07-31T19:31:51ZLuke Hoerstenluke@hoersten.org2026-07-31T19:31:51Zurn:sha1:846782c44c1c65e7b755de76fd50d86fc7c9636e
- rpi-base: log2ram from the archive, drop the azlux repo (which still
pointed at debian buster)
- aws-s3-backup: apt awscli (v2) instead of pip v1; drop boto3, nothing
used it
- scrypted, koreader-sync: docker.io and docker-compose-v2 instead of
the docker.com repo pinned to noble; the docker-ce removal lives in
cleanup-third-party.yaml since the packages collide on files
- miniflux: the archive package with a dbconfig preseed; drops the
github binary download and the bundled unit
- prometheus/client: note the nginx and postgres exporters are in apt
- dendrite/build, nostr/build: unversioned golang-go instead of pinned
golang-1.21-go and a hand symlink that shadowed the real go
relayer, soju: order services after postgresql at boot2026-07-30T23:19:08ZLuke Hoerstenluke@hoersten.org2026-07-30T23:19:08Zurn:sha1:6f573b9d12e6fa2f6a7dbebb41ccfbbd966c82e7
relayer had Requires= without After=, which does not order startup;
soju's packaged unit has no postgres ordering at all, so both raced
the postgres socket at boot and stayed failed. Adds After= to the
relayer unit and a systemd drop-in for soju.
dendrite, relayer: percent-encode db passwords in connection urls2026-07-30T23:19:08ZLuke Hoerstenluke@hoersten.org2026-07-30T23:19:08Zurn:sha1:00e966edfe45e594e8491bda3a235b7a7964f759
Passwords containing '/' are invalid unencoded in a url authority and
break Go's url.Parse (invalid port after host). Latent until a restart
forced a config re-read. jinja urlencode leaves '/' unescaped, hence
the extra replace.
build roles: create build_work_dir and redirect caches per-role2026-07-26T21:46:21ZLuke Hoerstenluke@hoersten.org2026-07-26T21:46:21Zurn:sha1:0dfd81ca1696053b366a39cab02e54205a09fb20
Each build role now creates build_work_dir itself and sets its own toolchain's
cache env (GOPATH/GOCACHE/GOMODCACHE, CARGO_HOME, npm cache, MIX/HEX) on its
build tasks, so the roles are self-contained instead of relying on a play-level
environment and pre_task.
build roles: force real tarballs for single-file artifacts2026-07-26T21:31:56ZLuke Hoerstenluke@hoersten.org2026-07-26T21:31:56Zurn:sha1:28c1fc8ea39f0fdb244f08f386ed81a2c68c0f5c
community.general.archive (>=10) compresses a lone file into a bare .gz instead
of a tarball, so the mattertimesync/bin/nostr artifacts failed the server-side
unarchive. Set force_archive: true so the archive module emits a real
single-member .tar.gz, consistent with the multi-file dendrite/pleroma builds.
build roles: stage checkouts + artifacts under build_work_dir2026-07-26T21:05:40ZLuke Hoerstenluke@hoersten.org2026-07-26T21:05:40Zurn:sha1:a173d5c8f149b4dde505fd4ab5257fb4cbc6911e
Move every build role's working dir off /tmp (the SD card) to {{build_work_dir}},
which the playbook points at the SSD on the build host. nostr and pleroma stage
their artifacts inside their own build dirs so the shared work dir can't collide,
while preserving the archive top-level names (relayer, release) that the server
roles depend on.
Build all roles from source with versioned artifacts2026-04-26T00:54:49ZLuke Hoerstenluke@hoersten.org2026-04-26T00:54:49Zurn:sha1:6a8cb5f10557733f1521035d57a191b12832d634
- Add pleroma/build role to compile from source (OTP binaries no longer published)
- Install Elixir 1.18.3 manually on Ubuntu Noble (ships 1.14, needs 1.15+)
- Standardize all build roles to produce versioned .tar.gz artifacts
- Add version defaults to all server roles (bin, dendrite, nostr/relayer)
- Switch server roles from get_url to unarchive for .tar.gz installs
- Add build_srv_dir variable to all build roles
- Deploy pleroma styles.json so custom FE themes appear in picker
- Fix pleroma OTP install: version check, root ownership, auto-cleanup old releases
- Fix pleroma config: log level :warn -> :warning, remove availableStyles
- Add wait_for grafana readiness before dashboard install
- Set minecraft ops changed_when: false
Add no_log to nostr relayer DB schema task2026-04-06T02:24:22ZLuke Hoerstenluke@hoersten.org2026-04-06T02:24:22Zurn:sha1:121f23c67f10a0ea3e8bff476f46fdec13112696Harden role security: file permissions, service binding, no_log, strict defaults2026-04-06T02:19:55ZLuke Hoerstenluke@hoersten.org2026-04-06T02:19:55Zurn:sha1:06b69bd8def0aae07d3fb565d19193be1a8dfe20
- Add no_log: true to tasks that handle passwords/secrets
- Tighten config file permissions (0644 -> 0600/0640 where appropriate)
- Bind pleroma to 127.0.0.1 instead of 0.0.0.0
- Tighten ergo unix socket mode 0777 -> 0770
- Remove weak defaults; roles now fail explicitly if required vars not set
Update versions and fix nginx logging.2026-03-26T02:42:49ZLuke Hoerstenluke@hoersten.org2026-03-26T02:42:49Zurn:sha1:58d4444b06de49587417791bb06a4fe1aeda571d