idk

ansible/plays/machine_setup/templates/domain-watchdog.env.j2

@@ -0,0 +1,11 @@
+# Managed by Ansible (domain-watchdog.yml) - secrets sourced from Infisical
+# via `infisical run -- ansible-playbook ...`.
+#
+# Consumed by docker compose for variable substitution in docker-compose.yml.
+
+POSTGRES_VERSION=16
+POSTGRES_DB=app
+POSTGRES_USER=app
+POSTGRES_PASSWORD={{ domain_watchdog_postgres_password }}
+
+SERVER_NAME=:80

ansible/plays/machine_setup/templates/domain-watchdog.env.local.j2

@@ -0,0 +1,16 @@
+# Managed by Ansible (domain-watchdog.yml) - secrets sourced from Infisical
+# via `infisical run -- ansible-playbook ...`.
+#
+# Loaded into the app/worker containers via docker-compose.yml's env_file.
+
+APP_SECRET={{ domain_watchdog_app_secret }}
+JWT_PASSPHRASE={{ domain_watchdog_jwt_passphrase }}
+
+CORS_ALLOW_ORIGIN='^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$'
+
+MAILER_DSN=null://null
+MAILER_SENDER_NAME="Domain Watchdog"
+MAILER_SENDER_EMAIL=[email protected]
+
+REGISTRATION_ENABLED=true
+REGISTRATION_VERIFY_EMAIL=false

ansible/plays/machine_setup/templates/grist-docker-compose.yml

@@ -0,0 +1,12 @@
+# Managed by Ansible (grist.yml). Vendored here since grist-core has no
+# docker-compose.yml at its repo root (see docker-compose-examples/ upstream).
+services:
+  grist:
+    image: gristlabs/grist:latest
+    restart: unless-stopped
+    ports:
+      - "8484:8484"
+    volumes:
+      - ./persist:/persist
+    env_file:
+      - .env

ansible/plays/machine_setup/templates/grist.env.j2

@@ -0,0 +1,19 @@
+# Managed by Ansible (grist.yml) - secrets sourced from Infisical via
+# `infisical run -- ansible-playbook ...`.
+#
+# Consumed by docker compose for variable substitution in docker-compose.yml,
+# and loaded directly into the Grist container via env_file.
+
+APP_HOME_URL=https://{{ grist_hostname }}
+GRIST_IN_SERVICE=true
+GRIST_SESSION_SECRET={{ grist_session_secret }}
+
+# OIDC via Authelia - client must be registered there with redirect URI
+# https://{{ grist_hostname }}/oauth2/callback
+GRIST_OIDC_IDP_ISSUER=https://{{ grist_oidc_issuer_host }}
+GRIST_OIDC_IDP_CLIENT_ID={{ grist_oidc_client_id }}
+GRIST_OIDC_IDP_CLIENT_SECRET={{ grist_oidc_client_secret }}
+
+# Authelia's OIDC discovery doc doesn't advertise end_session_endpoint, so
+# Grist must be told not to call it on logout.
+GRIST_OIDC_IDP_SKIP_END_SESSION_ENDPOINT=true

ansible/plays/machine_setup/templates/nametag.env.j2

@@ -0,0 +1,24 @@
+# Managed by Ansible (nametag.yml) - secrets sourced from Infisical via
+# `infisical run -- ansible-playbook ...`.
+#
+# This file is loaded twice: docker compose reads it from the project
+# directory for ${VAR} substitution in docker-compose.yml, and the app
+# container also loads it directly via env_file.
+
+# Database
+DB_HOST=db
+DB_PORT=5432
+DB_NAME=nametag_db
+DB_USER=nametag
+DB_PASSWORD={{ nametag_db_password }}
+
+# Redis (rate limiting & caching)
+REDIS_PASSWORD={{ nametag_redis_password }}
+REDIS_URL=redis://:{{ nametag_redis_password }}@redis:6379
+
+# Application URL
+NEXTAUTH_URL=http://{{ ansible_host }}:3000
+NEXTAUTH_SECRET={{ nametag_nextauth_secret }}
+
+# Cron
+CRON_SECRET={{ nametag_cron_secret }}

ansible/plays/machine_setup/templates/omnivore.env.j2

@@ -0,0 +1,72 @@
+# Managed by Ansible (omnivore.yml) - generated secrets persist in
+# ansible/plays/machine_setup/credentials/omnivore/ on the control node.
+
+# Postgres & Migrate
+
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD={{ omnivore_postgres_password }}
+POSTGRES_DB=omnivore
+PGPASSWORD={{ omnivore_postgres_password }}
+PG_REPLICATION=false
+
+PG_HOST=postgres
+PG_PASSWORD={{ omnivore_pg_password }}
+PG_DB=omnivore
+PG_USER=app_user
+PG_PORT=5432
+PG_POOL_MAX=20
+
+# API
+
+API_ENV=local
+IMAGE_PROXY_SECRET={{ omnivore_image_proxy_secret }}
+JWT_SECRET={{ omnivore_jwt_secret }}
+SSO_JWT_SECRET={{ omnivore_sso_jwt_secret }}
+GATEWAY_URL=http://api:8080/api
+CONTENT_FETCH_URL=http://content-fetch:8080/?token={{ omnivore_verification_token }}
+GCS_USE_LOCAL_HOST=true
+GCS_UPLOAD_BUCKET=omnivore
+AUTO_VERIFY=true
+# Minio credentials are hardcoded in docker-compose.yml for the minio and
+# createbuckets services, so these must match those literal values.
+AWS_ACCESS_KEY_ID=minio
+AWS_SECRET_ACCESS_KEY=miniominio
+AWS_REGION=us-east-1
+CONTENT_FETCH_QUEUE_ENABLED=true
+
+IMAGE_PROXY_URL=http://{{ ansible_host }}:7070
+CLIENT_URL=http://{{ ansible_host }}:3000
+LOCAL_MINIO_URL=http://{{ ansible_host }}:1010
+
+# Redis
+REDIS_URL=redis://redis:6379/0
+
+# Mail
+WATCHER_API_KEY={{ omnivore_mail_watcher_key }}
+LOCAL_EMAIL_DOMAIN=domain.tld
+# SNS_ARN=arn_of_sns #for if you use SES and SNS for Email.
+
+# Web
+APP_ENV=prod
+BASE_URL=http://{{ ansible_host }}:3000
+SERVER_BASE_URL=http://{{ ansible_host }}:4000
+HIGHLIGHTS_BASE_URL=http://{{ ansible_host }}:3000
+# USE_DISCOVER_AI=true
+# OPENAI_API_KEY=<OPENAI_API_KEY>
+
+# Content Fetch
+VERIFICATION_TOKEN={{ omnivore_verification_token }}
+REST_BACKEND_ENDPOINT=http://api:8080/api
+SKIP_UPLOAD_ORIGINAL=true
+
+# Minio
+MINIO_ACCESS_KEY=minio
+MINIO_SECRET_KEY=miniominio
+AWS_S3_ENDPOINT_URL=http://minio:9000
+
+# Export
+EXPORT_QUEUE_NAME=omnivore-backend-queue
+
+# Youtube
+YOUTUBE_TRANSCRIPT_PROMPT=Reformat the supplied transcript data adding formatting, puncuation, and paragraphs, but do not summarize or change the content. Format the output as markdown.
+YOUTUBE_MAXIMUM_VIDEO_DURATION_TRANSCRIPT=1801

ansible/plays/machine_setup/templates/supernote-docker-compose.yml

@@ -0,0 +1,101 @@
+# Vendored from https://supernote-private-cloud.supernote.com/cloud/docker-compose.yml,
+# with two fixes applied:
+#   - the mariadb service is missing docker-entrypoint-initdb.d mounts in the
+#     upstream file, so supernotedb.sql would never actually load into a
+#     fresh database; added below.
+#   - a second init script (supernote-email-init.sql, rendered by Ansible
+#     from Infisical-sourced secrets) pre-seeds SMTP settings into
+#     u_email_config so registration/password-reset emails work without a
+#     manual trip through the web UI's "Email Settings" dialog.
+# supernote-service's DB_HOSTNAME/MYSQL_*/REDIS_* env vars are also inlined
+# directly here instead of upstream's separate .dbenv/env_file, since they're
+# just ${VAR} substitutions from the same .env used by mariadb/redis.
+services:
+  mariadb:
+    image: mariadb:10.6.24
+    container_name: mariadb
+    environment:
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
+      MYSQL_DATABASE: supernotedb
+      MYSQL_USER: ${MYSQL_USER}
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
+      TZ: ${TZ:-UTC}
+    command: --skip-name-resolve --bind-address=0.0.0.0
+    volumes:
+      - ./sndata/db_data:/var/lib/mysql
+      - ./sndata/config/mysql/conf.d:/etc/mysql/conf.d:ro
+      - ./supernotedb.sql:/docker-entrypoint-initdb.d/00-supernotedb.sql:ro
+      - ./supernote-email-init.sql:/docker-entrypoint-initdb.d/01-supernote-email-init.sql:ro
+      - /etc/localtime:/etc/localtime:ro
+    healthcheck:
+      test: ["CMD-SHELL", "mysqladmin ping -h localhost -u root -p$$MYSQL_ROOT_PASSWORD || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    restart: unless-stopped
+
+  redis:
+    image: redis:7.4.7
+    container_name: redis
+    environment:
+      TZ: ${TZ:-UTC}
+    command: ["redis-server", "--requirepass", "${REDIS_PASSWORD}"]
+    volumes:
+      - ./sndata/redis_data:/data
+      - /etc/localtime:/etc/localtime:ro
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 3s
+      retries: 3
+
+  notelib:
+    image: docker.io/supernote/notelib:6.9.3
+    container_name: notelib
+    environment:
+      TZ: ${TZ:-UTC}
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+    restart: unless-stopped
+
+  supernote-service:
+    image: docker.io/supernote/supernote-service:26.06.04
+    container_name: supernote-service
+    depends_on:
+      mariadb:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    ports:
+      - "19071:19071"
+      - "18072:18072"
+      - "${FRONTEND_PORT:-19072}:8080"
+      - "${DOMAIN_PORT:-8199}:8080"
+    environment:
+      EXTERNAL_PORT_BACKEND: "19071"
+      EXTERNAL_PORT_FRONTEND: ${FRONTEND_PORT:-19072}
+      EXTERNAL_PORT_DOMAIN: ${DOMAIN_PORT:-8199}
+      TZ: ${TZ:-UTC}
+      DB_HOSTNAME: mariadb
+      MYSQL_DATABASE: supernotedb
+      MYSQL_USER: ${MYSQL_USER}
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
+      REDIS_HOST: redis
+      REDIS_PORT: 6379
+      REDIS_PASSWORD: ${REDIS_PASSWORD}
+    volumes:
+      - ./sndata/recycle:/home/supernote/recycle
+      - ./supernote_data:/home/supernote/data
+      - ./sndata/logs/cloud:/home/supernote/cloud/logs
+      - ./sndata/logs/app:/home/supernote/logs
+      - ./sndata/logs/web:/var/log/nginx
+      - ./sndata/convert:/home/supernote/convert
+      - /etc/localtime:/etc/localtime:ro
+    restart: unless-stopped
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"

ansible/plays/machine_setup/templates/supernote-email-init.sql.j2

@@ -0,0 +1,30 @@
+-- Managed by Ansible (supernote.yml) - SMTP secrets sourced from Infisical
+-- via `infisical run -- ansible-playbook ...`.
+--
+-- Mounted into the mariadb container's docker-entrypoint-initdb.d/ so it
+-- seeds u_email_config on first boot, and re-applied by the playbook via
+-- `docker compose exec` on every run so Infisical stays the source of truth.
+--
+-- u_email_config's schema/upsert key come from a third-party reverse
+-- engineering of Supernote's supernotedb.sql (not officially documented) -
+-- see https://github.com/liketheduck/supernote-private-cloud-docker. Verify
+-- against Email Settings in the web UI if Supernote changes this schema.
+
+USE supernotedb;
+
+INSERT INTO u_email_config (smtp_server, port, user_name, password, encryption, flag)
+VALUES (
+  '{{ supernote_smtp_server }}',
+  '{{ supernote_smtp_port | default(465) }}',
+  '{{ supernote_smtp_user }}',
+  '{{ supernote_smtp_password }}',
+  '{{ supernote_smtp_encryption | default("ssl") }}',
+  'Y'
+)
+ON DUPLICATE KEY UPDATE
+  smtp_server='{{ supernote_smtp_server }}',
+  port='{{ supernote_smtp_port | default(465) }}',
+  user_name='{{ supernote_smtp_user }}',
+  password='{{ supernote_smtp_password }}',
+  encryption='{{ supernote_smtp_encryption | default("ssl") }}',
+  flag='Y';

ansible/plays/machine_setup/templates/supernote.env.j2

@@ -0,0 +1,10 @@
+# Managed by Ansible (supernote.yml) - secrets sourced from Infisical via
+# `infisical run -- ansible-playbook ...`.
+#
+# Consumed by docker compose for ${VAR} substitution in docker-compose.yml.
+
+MYSQL_ROOT_PASSWORD={{ supernote_mysql_root_password }}
+MYSQL_USER=supernote
+MYSQL_PASSWORD={{ supernote_mysql_password }}
+
+REDIS_PASSWORD={{ supernote_redis_password }}