Changed how all docker images have their version set to use the compose repo

ansible/inventories/proxmox.yml

@@ -0,0 +1,10 @@
+proxmox:
+  hosts:
+    pve-goose:
+      ansible_host: 192.168.7.240
+    pve-duck:
+      ansible_host: 192.168.7.241
+
+  vars:
+    ansible_user: "ansible"
+    ansible_ssh_private_key_file: "/home/nick/.ssh/infra_ansible_key"

ansible/plays/machine_setup/domain-watchdog.yml

@@ -24,21 +24,28 @@
 
     - name: Deploy Domain Watchdog
       vars:
+        # Keep this path: compose prefixes named volumes (database_data etc.)
+        # with the directory name, so moving it orphans the existing data.
         domain_watchdog_dir: /opt/domain-watchdog
+        # Branch of AtlasHorizon/compose to deploy from; override with
+        # `-e compose_branch=<branch>` to test unmerged changes.
+        compose_branch: main
       block:
-        - name: Clone domain-watchdog repo
-          ansible.builtin.git:
-            repo: https://github.com/maelgangloff/domain-watchdog.git
-            dest: "{{ domain_watchdog_dir }}"
-            version: master
-            update: yes
-
         - name: Create public/content directory
           ansible.builtin.file:
             path: "{{ domain_watchdog_dir }}/public/content"
             state: directory
             mode: "0755"
 
+        # force: true so changes in the compose repo are picked up on reruns;
+        # it only reports changed when the content differs.
+        - name: Download docker-compose.yml
+          ansible.builtin.get_url:
+            url: "https://git.atlashorizon.net/AtlasHorizon/compose/raw/branch/{{ compose_branch }}/domain-watchdog/docker-compose.yml"
+            dest: "{{ domain_watchdog_dir }}/docker-compose.yml"
+            mode: "0644"
+            force: true
+
         # Pulled from Infisical, not generated/persisted to disk. Run this
         # playbook as `infisical run -- ansible-playbook -i inventory ...`
         # with DOMAIN_WATCHDOG_POSTGRES_PASSWORD, DOMAIN_WATCHDOG_APP_SECRET,

ansible/plays/machine_setup/grist.yml

@@ -27,6 +27,9 @@
         grist_dir: /opt/grist
         grist_hostname: grist.atlashorizon.net
         grist_oidc_issuer_host: auth.atlashorizon.net
+        # Branch of AtlasHorizon/compose to deploy from; override with
+        # `-e compose_branch=<branch>` to test unmerged changes.
+        compose_branch: main
       block:
         - name: Create persist directory
           ansible.builtin.file:
@@ -34,11 +37,14 @@
             state: directory
             mode: "0755"
 
-        - name: Deploy docker-compose.yml
-          ansible.builtin.copy:
-            src: templates/grist-docker-compose.yml
+        # force: true so changes in the compose repo are picked up on reruns;
+        # it only reports changed when the content differs.
+        - name: Download docker-compose.yml
+          ansible.builtin.get_url:
+            url: "https://git.atlashorizon.net/AtlasHorizon/compose/raw/branch/{{ compose_branch }}/grist/docker-compose.yml"
             dest: "{{ grist_dir }}/docker-compose.yml"
             mode: "0644"
+            force: true
 
         # Pulled from Infisical, not generated/persisted to disk. Run this
         # playbook as `infisical run -- ansible-playbook -i inventory ...`

ansible/plays/machine_setup/nametag.yml

@@ -24,21 +24,28 @@
 
     - name: Deploy Nametag
       vars:
+        # Keep this path: compose prefixes named volumes (postgres_data etc.)
+        # with the directory name, so moving it orphans the existing data.
         nametag_dir: /opt/nametag
+        # Branch of AtlasHorizon/compose to deploy from; override with
+        # `-e compose_branch=<branch>` to test unmerged changes.
+        compose_branch: main
       block:
-        - name: Clone nametag repo
-          ansible.builtin.git:
-            repo: https://github.com/mattogodoy/nametag.git
-            dest: "{{ nametag_dir }}"
-            version: master
-            update: yes
-
         - name: Create backups directory
           ansible.builtin.file:
             path: "{{ nametag_dir }}/backups"
             state: directory
             mode: "0755"
 
+        # force: true so changes in the compose repo are picked up on reruns;
+        # it only reports changed when the content differs.
+        - name: Download docker-compose.yml
+          ansible.builtin.get_url:
+            url: "https://git.atlashorizon.net/AtlasHorizon/compose/raw/branch/{{ compose_branch }}/nametag/docker-compose.yml"
+            dest: "{{ nametag_dir }}/docker-compose.yml"
+            mode: "0644"
+            force: true
+
         # Pulled from Infisical, not generated/persisted to disk. Run this
         # playbook as `infisical run -- ansible-playbook -i inventory ...`
         # with NAMETAG_DB_PASSWORD, NAMETAG_NEXTAUTH_SECRET,

ansible/plays/machine_setup/templates/omnivore.env.j2

@@ -1,72 +0,0 @@
-# Managed by Ansible (omnivore.yml) - generated secrets persist in
-# ansible/plays/machine_setup/credentials/omnivore/ on the control node.
-
-# Postgres & Migrate
-
-POSTGRES_USER=postgres
-POSTGRES_PASSWORD={{ omnivore_postgres_password }}
-POSTGRES_DB=omnivore
-PGPASSWORD={{ omnivore_postgres_password }}
-PG_REPLICATION=false
-
-PG_HOST=postgres
-PG_PASSWORD={{ omnivore_pg_password }}
-PG_DB=omnivore
-PG_USER=app_user
-PG_PORT=5432
-PG_POOL_MAX=20
-
-# API
-
-API_ENV=local
-IMAGE_PROXY_SECRET={{ omnivore_image_proxy_secret }}
-JWT_SECRET={{ omnivore_jwt_secret }}
-SSO_JWT_SECRET={{ omnivore_sso_jwt_secret }}
-GATEWAY_URL=http://api:8080/api
-CONTENT_FETCH_URL=http://content-fetch:8080/?token={{ omnivore_verification_token }}
-GCS_USE_LOCAL_HOST=true
-GCS_UPLOAD_BUCKET=omnivore
-AUTO_VERIFY=true
-# Minio credentials are hardcoded in docker-compose.yml for the minio and
-# createbuckets services, so these must match those literal values.
-AWS_ACCESS_KEY_ID=minio
-AWS_SECRET_ACCESS_KEY=miniominio
-AWS_REGION=us-east-1
-CONTENT_FETCH_QUEUE_ENABLED=true
-
-IMAGE_PROXY_URL=http://{{ ansible_host }}:7070
-CLIENT_URL=http://{{ ansible_host }}:3000
-LOCAL_MINIO_URL=http://{{ ansible_host }}:1010
-
-# Redis
-REDIS_URL=redis://redis:6379/0
-
-# Mail
-WATCHER_API_KEY={{ omnivore_mail_watcher_key }}
-LOCAL_EMAIL_DOMAIN=domain.tld
-# SNS_ARN=arn_of_sns #for if you use SES and SNS for Email.
-
-# Web
-APP_ENV=prod
-BASE_URL=http://{{ ansible_host }}:3000
-SERVER_BASE_URL=http://{{ ansible_host }}:4000
-HIGHLIGHTS_BASE_URL=http://{{ ansible_host }}:3000
-# USE_DISCOVER_AI=true
-# OPENAI_API_KEY=<OPENAI_API_KEY>
-
-# Content Fetch
-VERIFICATION_TOKEN={{ omnivore_verification_token }}
-REST_BACKEND_ENDPOINT=http://api:8080/api
-SKIP_UPLOAD_ORIGINAL=true
-
-# Minio
-MINIO_ACCESS_KEY=minio
-MINIO_SECRET_KEY=miniominio
-AWS_S3_ENDPOINT_URL=http://minio:9000
-
-# Export
-EXPORT_QUEUE_NAME=omnivore-backend-queue
-
-# Youtube
-YOUTUBE_TRANSCRIPT_PROMPT=Reformat the supplied transcript data adding formatting, puncuation, and paragraphs, but do not summarize or change the content. Format the output as markdown.
-YOUTUBE_MAXIMUM_VIDEO_DURATION_TRANSCRIPT=1801