micro-ops

ansible stuff for microcosm infrastructure.

legacy/ has the old playbooks

hacking

• copy secrets.example.yml to secrets.yml and edit
• review top-level configs at inventory/group_vars/all.yml

hubble

atproto mirror / getRepo offload. hubble source

• main config: inventory/group_vars/hubble.yml
• per-host config in inventory/host_vars/
• playbook: playbooks/hubble.yml

ansible-playbook -e @secrets.yml playbooks/hubble.yml

# builds are skipped unless the source repo changed; to force:
ansible-playbook -e @secrets.yml -e force_build=1 playbooks/hubble.yml

# limit to one host:
ansible-playbook -e @secrets.yml -l bridgy-hubble playbooks/hubble.yml

# deps + build only
ansible-playbook -l hubble-pi-01 --tags build playbooks/hubble.yml

setting hubble_public_host gets nginx + certbot TLS going in front. hubble_extra_public_hosts (a list) adds more names for the same service on the same cert.

setting hubble_storage_device formats it as xfs (device msut be blank) and mounts it at hubble_storage_mount.

setting hubble_backup_enabled turns on periodic rocksdb backups pushed to object storage. the endpoint and credentials are per-host (host_vars), since each host has its own bucket; everything else has a group default. each host gets its own prefix within its bucket, named after its inventory name.

gateway

public reverse proxy to home hosts over tailnet. tls, rate limiting, smol cache. gateways run on different providers for whole-provider-outage redundancy, dns load-balanced.

• sites/upstreams: inventory/group_vars/gateway.yml
• per-site nginx: roles/gateway/templates/sites/
• playbook: playbooks/gateway.yml

ansible-playbook -e @secrets.yml playbooks/gateway.yml

# on a new host before committing to a letsencrypt rate-limited request
ansible-playbook -e @secrets.yml --skip-tags certs playbooks/gateway.yml

currently gateways each get their own certs with certbot, but we manage nginx tls config manually. unexpected validation requests are forwarded to the other gateway hosts.