idk

2026-09-08 03:36:17 +00:00
1 parent 1c70d34cf3
commit 6c10631a6a
@@ -0,0 +1,86 @@
+---
+- name: Set up Grist
+  hosts: grist
+  become: yes
+  tasks:
+    - name: default_packages
+      ansible.builtin.include_tasks: ../../templates/default_packages.yml
+
+    - name: create_user
+      ansible.builtin.include_tasks: ../../templates/create_user.yml
+      vars:
+        username: nick
+        github_user: Chewbaccalakis
+
+    - name: Install Docker
+      ansible.builtin.include_tasks: ../../templates/install_docker.yml
+
+    - name: Add nick to docker group
+      ansible.builtin.user:
+        name: nick
+        groups:
+          - docker
+        append: true
+
+    - name: Deploy Grist
+      vars:
+        grist_dir: /opt/grist
+        grist_hostname: grist.atlashorizon.net
+        grist_oidc_issuer_host: auth.atlashorizon.net
+      block:
+        - name: Create persist directory
+          ansible.builtin.file:
+            path: "{{ grist_dir }}/persist"
+            state: directory
+            mode: "0755"
+
+        - name: Deploy docker-compose.yml
+          ansible.builtin.copy:
+            src: templates/grist-docker-compose.yml
+            dest: "{{ grist_dir }}/docker-compose.yml"
+            mode: "0644"
+
+        # Pulled from Infisical, not generated/persisted to disk. Run this
+        # playbook as `infisical run -- ansible-playbook -i inventory ...`
+        # with GRIST_SESSION_SECRET, GRIST_OIDC_IDP_CLIENT_ID, and
+        # GRIST_OIDC_IDP_CLIENT_SECRET secrets set in the workspace.
+        #
+        # The OIDC client must be registered in Authelia with redirect URI
+        # https://grist.atlashorizon.net/oauth2/callback.
+        - name: Read secrets from environment (populated by `infisical run`)
+          ansible.builtin.set_fact:
+            grist_session_secret: "{{ lookup('ansible.builtin.env', 'GRIST_SESSION_SECRET') }}"
+            grist_oidc_client_id: "{{ lookup('ansible.builtin.env', 'GRIST_OIDC_IDP_CLIENT_ID') }}"
+            grist_oidc_client_secret: "{{ lookup('ansible.builtin.env', 'GRIST_OIDC_IDP_CLIENT_SECRET') }}"
+          no_log: true
+
+        - name: Verify required secrets were provided
+          ansible.builtin.assert:
+            that:
+              - grist_session_secret | length >= 32
+              - grist_oidc_client_id | length > 0
+              - grist_oidc_client_secret | length > 0
+            fail_msg: >-
+              GRIST_SESSION_SECRET (>=32 chars), GRIST_OIDC_IDP_CLIENT_ID, and
+              GRIST_OIDC_IDP_CLIENT_SECRET must be set. Run this playbook via
+              `infisical run -- ansible-playbook -i inventory ...` with those
+              secrets defined in the workspace.
+
+        - name: Deploy .env file (docker compose variable substitution)
+          ansible.builtin.template:
+            src: templates/grist.env.j2
+            dest: "{{ grist_dir }}/.env"
+            mode: "0600"
+
+        - name: Pull prebuilt Grist image
+          ansible.builtin.command:
+            cmd: docker compose pull
+            chdir: "{{ grist_dir }}"
+          changed_when: false
+
+        - name: Start Grist via docker compose
+          ansible.builtin.command:
+            cmd: docker compose up -d
+            chdir: "{{ grist_dir }}"
+          register: grist_compose_up
+          changed_when: "'Started' in grist_compose_up.stderr or 'Created' in grist_compose_up.stderr"