idk

2026-09-08 03:36:17 +00:00
1 parent 1c70d34cf3
commit 6c10631a6a
@@ -0,0 +1,88 @@
+---
+- name: Set up domain-watchdog
+  hosts: domain-watchdog
+  become: yes
+  tasks:
+    - name: default_packages
+      ansible.builtin.include_tasks: ../../templates/default_packages.yml
+
+    - name: create_user
+      ansible.builtin.include_tasks: ../../templates/create_user.yml
+      vars:
+        username: nick
+        github_user: Chewbaccalakis
+
+    - name: Install Docker
+      ansible.builtin.include_tasks: ../../templates/install_docker.yml
+
+    - name: Add nick to docker group
+      ansible.builtin.user:
+        name: nick
+        groups:
+          - docker
+        append: true
+
+    - name: Deploy Domain Watchdog
+      vars:
+        domain_watchdog_dir: /opt/domain-watchdog
+      block:
+        - name: Clone domain-watchdog repo
+          ansible.builtin.git:
+            repo: https://github.com/maelgangloff/domain-watchdog.git
+            dest: "{{ domain_watchdog_dir }}"
+            version: master
+            update: yes
+
+        - name: Create public/content directory
+          ansible.builtin.file:
+            path: "{{ domain_watchdog_dir }}/public/content"
+            state: directory
+            mode: "0755"
+
+        # Pulled from Infisical, not generated/persisted to disk. Run this
+        # playbook as `infisical run -- ansible-playbook -i inventory ...`
+        # with DOMAIN_WATCHDOG_POSTGRES_PASSWORD, DOMAIN_WATCHDOG_APP_SECRET,
+        # and DOMAIN_WATCHDOG_JWT_PASSPHRASE secrets set in the workspace.
+        - name: Read secrets from environment (populated by `infisical run`)
+          ansible.builtin.set_fact:
+            domain_watchdog_postgres_password: "{{ lookup('ansible.builtin.env', 'DOMAIN_WATCHDOG_POSTGRES_PASSWORD') }}"
+            domain_watchdog_app_secret: "{{ lookup('ansible.builtin.env', 'DOMAIN_WATCHDOG_APP_SECRET') }}"
+            domain_watchdog_jwt_passphrase: "{{ lookup('ansible.builtin.env', 'DOMAIN_WATCHDOG_JWT_PASSPHRASE') }}"
+          no_log: true
+
+        - name: Verify required secrets were provided
+          ansible.builtin.assert:
+            that:
+              - domain_watchdog_postgres_password | length > 0
+              - domain_watchdog_app_secret | length > 0
+              - domain_watchdog_jwt_passphrase | length > 0
+            fail_msg: >-
+              DOMAIN_WATCHDOG_POSTGRES_PASSWORD, DOMAIN_WATCHDOG_APP_SECRET, and
+              DOMAIN_WATCHDOG_JWT_PASSPHRASE must be set. Run this playbook via
+              `infisical run -- ansible-playbook -i inventory ...` with those
+              secrets defined in the workspace.
+
+        - name: Deploy .env file (docker compose variable substitution)
+          ansible.builtin.template:
+            src: templates/domain-watchdog.env.j2
+            dest: "{{ domain_watchdog_dir }}/.env"
+            mode: "0600"
+
+        - name: Deploy .env.local file (app secrets)
+          ansible.builtin.template:
+            src: templates/domain-watchdog.env.local.j2
+            dest: "{{ domain_watchdog_dir }}/.env.local"
+            mode: "0600"
+
+        - name: Pull prebuilt Domain Watchdog images
+          ansible.builtin.command:
+            cmd: docker compose pull
+            chdir: "{{ domain_watchdog_dir }}"
+          changed_when: false
+
+        - name: Start Domain Watchdog via docker compose
+          ansible.builtin.command:
+            cmd: docker compose up -d
+            chdir: "{{ domain_watchdog_dir }}"
+          register: domain_watchdog_compose_up
+          changed_when: "'Started' in domain_watchdog_compose_up.stderr or 'Created' in domain_watchdog_compose_up.stderr"