luke/ansible-roles/pleroma, branch mainAnsible roles for nth.io infrastructure
https://src.nth.io/luke/ansible-roles/atom?h=main2026-07-31T19:31:51Zpleroma/otp: proxy to 127.0.0.1 instead of localhost2026-07-31T19:31:51ZLuke Hoerstenluke@hoersten.org2026-07-31T19:31:51Zurn:sha1:24f089781c548ad6e4c9e5b3c364e37b8a8a59bb
nginx expands localhost to [::1] too, but the endpoint binds only
127.0.0.1, so every request burned a refused ipv6 connect first and
flooded the error log.
pleroma/build: install elixir from apt2026-07-31T01:24:28ZLuke Hoerstenluke@hoersten.org2026-07-31T01:24:28Zurn:sha1:ad68d4cdc2424c5bb03b05faae831b3992e49279
26.04 ships elixir 1.18.3, the exact version the role pinned from
upstream zips, so the download/unarchive tasks and version vars go
away. Resolves the TODO waiting on this release.
build roles: create build_work_dir and redirect caches per-role2026-07-26T21:46:21ZLuke Hoerstenluke@hoersten.org2026-07-26T21:46:21Zurn:sha1:0dfd81ca1696053b366a39cab02e54205a09fb20
Each build role now creates build_work_dir itself and sets its own toolchain's
cache env (GOPATH/GOCACHE/GOMODCACHE, CARGO_HOME, npm cache, MIX/HEX) on its
build tasks, so the roles are self-contained instead of relying on a play-level
environment and pre_task.
build roles: stage checkouts + artifacts under build_work_dir2026-07-26T21:05:40ZLuke Hoerstenluke@hoersten.org2026-07-26T21:05:40Zurn:sha1:a173d5c8f149b4dde505fd4ab5257fb4cbc6911e
Move every build role's working dir off /tmp (the SD card) to {{build_work_dir}},
which the playbook points at the SSD on the build host. nostr and pleroma stage
their artifacts inside their own build dirs so the shared work dir can't collide,
while preserving the archive top-level names (relayer, release) that the server
roles depend on.
Only run pleroma migrate on version change or first install2026-04-26T01:04:39ZLuke Hoerstenluke@hoersten.org2026-04-26T01:04:39Zurn:sha1:ad2215ee82a87f11c23a7b50c7cc09de9bb7c802Build all roles from source with versioned artifacts2026-04-26T00:54:49ZLuke Hoerstenluke@hoersten.org2026-04-26T00:54:49Zurn:sha1:6a8cb5f10557733f1521035d57a191b12832d634
- Add pleroma/build role to compile from source (OTP binaries no longer published)
- Install Elixir 1.18.3 manually on Ubuntu Noble (ships 1.14, needs 1.15+)
- Standardize all build roles to produce versioned .tar.gz artifacts
- Add version defaults to all server roles (bin, dendrite, nostr/relayer)
- Switch server roles from get_url to unarchive for .tar.gz installs
- Add build_srv_dir variable to all build roles
- Deploy pleroma styles.json so custom FE themes appear in picker
- Fix pleroma OTP install: version check, root ownership, auto-cleanup old releases
- Fix pleroma config: log level :warn -> :warning, remove availableStyles
- Add wait_for grafana readiness before dashboard install
- Set minecraft ops changed_when: false
Harden role security: file permissions, service binding, no_log, strict defaults2026-04-06T02:19:55ZLuke Hoerstenluke@hoersten.org2026-04-06T02:19:55Zurn:sha1:06b69bd8def0aae07d3fb565d19193be1a8dfe20
- Add no_log: true to tasks that handle passwords/secrets
- Tighten config file permissions (0644 -> 0600/0640 where appropriate)
- Bind pleroma to 127.0.0.1 instead of 0.0.0.0
- Tighten ergo unix socket mode 0777 -> 0770
- Remove weak defaults; roles now fail explicitly if required vars not set
Added soju role.2026-03-28T18:42:08ZLuke Hoerstenluke@hoersten.org2026-03-28T18:42:08Zurn:sha1:45da5bca82200af63b0ee16479b267eb209386f3Version updates and fixed excessive logging on web server.2025-01-04T01:36:28ZLuke Hoerstenluke@hoersten.org2025-01-04T01:36:28Zurn:sha1:b180fe427c44da015874dbf86c326f6e6bcd0aa8Lots of updates and fixes for Ubuntu 24.04 Noble.2024-10-07T20:25:37ZLuke Hoerstenluke@hoersten.org2024-10-07T20:25:37Zurn:sha1:27739609362360b2bf533f5a59106ce52c8d4b9f