removed supernote files, now runs on NAS

ansible/plays/machine_setup/supernote.yml

@@ -1,139 +0,0 @@
----
-- name: Set up Supernote Private Cloud
-  hosts: supernote
-  become: yes
-  tasks:
-    - name: default_packages
-      ansible.builtin.include_tasks: ../../templates/default_packages.yml
-
-    - name: create_user
-      ansible.builtin.include_tasks: ../../templates/create_user.yml
-      vars:
-        username: nick
-        github_user: Chewbaccalakis
-
-    - name: Install Docker
-      ansible.builtin.include_tasks: ../../templates/install_docker.yml
-
-    - name: Add nick to docker group
-      ansible.builtin.user:
-        name: nick
-        groups:
-          - docker
-        append: true
-
-    - name: Deploy Supernote Private Cloud
-      vars:
-        supernote_dir: /opt/supernote
-        # Branch of AtlasHorizon/compose to deploy from; override with
-        # `-e compose_branch=main` to test unreleased changes.
-        compose_branch: stable
-      block:
-        - name: Create data persistence directories
-          ansible.builtin.file:
-            path: "{{ supernote_dir }}/{{ item }}"
-            state: directory
-            mode: "0755"
-          loop:
-            - sndata/db_data
-            - sndata/config/mysql/conf.d
-            - sndata/redis_data
-            - sndata/recycle
-            - sndata/logs/cloud
-            - sndata/logs/app
-            - sndata/logs/web
-            - sndata/convert
-            - supernote_data
-
-        # Downloaded fresh each run so upstream schema changes apply on
-        # reruns, per Supernote's own upgrade instructions. docker-compose.yml
-        # comes from AtlasHorizon/compose instead (see supernote/README.md
-        # there) - the upstream file is missing the initdb mounts this
-        # playbook needs.
-        - name: Download Supernote database init script
-          ansible.builtin.get_url:
-            url: https://supernote-private-cloud.supernote.com/cloud/supernotedb.sql
-            dest: "{{ supernote_dir }}/supernotedb.sql"
-            mode: "0644"
-            force: yes
-
-        # force: true so changes in the compose repo are picked up on reruns;
-        # it only reports changed when the content differs.
-        - name: Download docker-compose.yml
-          ansible.builtin.get_url:
-            url: "https://git.atlashorizon.net/AtlasHorizon/compose/raw/branch/{{ compose_branch }}/supernote/docker-compose.yml"
-            dest: "{{ supernote_dir }}/docker-compose.yml"
-            mode: "0644"
-            force: true
-
-        # Pulled from Infisical, not generated/persisted to disk. Run this
-        # playbook as `infisical run -- ansible-playbook -i inventory ...`
-        # with SUPERNOTE_MYSQL_ROOT_PASSWORD, SUPERNOTE_MYSQL_PASSWORD,
-        # SUPERNOTE_REDIS_PASSWORD, SUPERNOTE_SMTP_SERVER, SUPERNOTE_SMTP_USER,
-        # and SUPERNOTE_SMTP_PASSWORD secrets set in the workspace.
-        # SUPERNOTE_SMTP_PORT (default 465) and SUPERNOTE_SMTP_ENCRYPTION
-        # (default ssl) are optional.
-        - name: Read secrets from environment (populated by `infisical run`)
-          ansible.builtin.set_fact:
-            supernote_mysql_root_password: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_MYSQL_ROOT_PASSWORD') }}"
-            supernote_mysql_password: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_MYSQL_PASSWORD') }}"
-            supernote_redis_password: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_REDIS_PASSWORD') }}"
-            supernote_smtp_server: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_SERVER') }}"
-            supernote_smtp_port: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_PORT') }}"
-            supernote_smtp_user: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_USER') }}"
-            supernote_smtp_password: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_PASSWORD') }}"
-            supernote_smtp_encryption: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_ENCRYPTION') }}"
-          no_log: true
-
-        - name: Verify required secrets were provided
-          ansible.builtin.assert:
-            that:
-              - supernote_mysql_root_password | length > 0
-              - supernote_mysql_password | length > 0
-              - supernote_redis_password | length > 0
-              - supernote_smtp_server | length > 0
-              - supernote_smtp_user | length > 0
-              - supernote_smtp_password | length > 0
-            fail_msg: >-
-              SUPERNOTE_MYSQL_ROOT_PASSWORD, SUPERNOTE_MYSQL_PASSWORD,
-              SUPERNOTE_REDIS_PASSWORD, SUPERNOTE_SMTP_SERVER,
-              SUPERNOTE_SMTP_USER, and SUPERNOTE_SMTP_PASSWORD must be set.
-              Run this playbook via `infisical run -- ansible-playbook -i
-              inventory ...` with those secrets defined in the workspace.
-
-        - name: Deploy .env file (docker compose variable substitution)
-          ansible.builtin.template:
-            src: templates/supernote.env.j2
-            dest: "{{ supernote_dir }}/.env"
-            mode: "0600"
-
-        - name: Deploy SMTP config init script
-          ansible.builtin.template:
-            src: templates/supernote-email-init.sql.j2
-            dest: "{{ supernote_dir }}/supernote-email-init.sql"
-            mode: "0600"
-
-        - name: Pull prebuilt Supernote images
-          ansible.builtin.command:
-            cmd: docker compose pull
-            chdir: "{{ supernote_dir }}"
-          changed_when: false
-
-        - name: Start Supernote Private Cloud via docker compose
-          ansible.builtin.command:
-            cmd: docker compose up -d
-            chdir: "{{ supernote_dir }}"
-          register: supernote_compose_up
-          changed_when: "'Started' in supernote_compose_up.stderr or 'Created' in supernote_compose_up.stderr"
-
-        # docker-entrypoint-initdb.d scripts only run once, against an empty
-        # database, so reruns wouldn't otherwise pick up SMTP changes made in
-        # Infisical. Re-applying here keeps Infisical the source of truth.
-        - name: Apply SMTP configuration to the database
-          ansible.builtin.shell:
-            cmd: >-
-              docker compose exec -T -e MYSQL_PWD="{{ supernote_mysql_root_password }}"
-              mariadb mysql -u root supernotedb < {{ supernote_dir }}/supernote-email-init.sql
-            chdir: "{{ supernote_dir }}"
-          changed_when: false
-          no_log: true

ansible/plays/machine_setup/templates/supernote-docker-compose.yml

@@ -1,101 +0,0 @@
-# Vendored from https://supernote-private-cloud.supernote.com/cloud/docker-compose.yml,
-# with two fixes applied:
-#   - the mariadb service is missing docker-entrypoint-initdb.d mounts in the
-#     upstream file, so supernotedb.sql would never actually load into a
-#     fresh database; added below.
-#   - a second init script (supernote-email-init.sql, rendered by Ansible
-#     from Infisical-sourced secrets) pre-seeds SMTP settings into
-#     u_email_config so registration/password-reset emails work without a
-#     manual trip through the web UI's "Email Settings" dialog.
-# supernote-service's DB_HOSTNAME/MYSQL_*/REDIS_* env vars are also inlined
-# directly here instead of upstream's separate .dbenv/env_file, since they're
-# just ${VAR} substitutions from the same .env used by mariadb/redis.
-services:
-  mariadb:
-    image: mariadb:10.6.24
-    container_name: mariadb
-    environment:
-      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
-      MYSQL_DATABASE: supernotedb
-      MYSQL_USER: ${MYSQL_USER}
-      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
-      TZ: ${TZ:-UTC}
-    command: --skip-name-resolve --bind-address=0.0.0.0
-    volumes:
-      - ./sndata/db_data:/var/lib/mysql
-      - ./sndata/config/mysql/conf.d:/etc/mysql/conf.d:ro
-      - ./supernotedb.sql:/docker-entrypoint-initdb.d/00-supernotedb.sql:ro
-      - ./supernote-email-init.sql:/docker-entrypoint-initdb.d/01-supernote-email-init.sql:ro
-      - /etc/localtime:/etc/localtime:ro
-    healthcheck:
-      test: ["CMD-SHELL", "mysqladmin ping -h localhost -u root -p$$MYSQL_ROOT_PASSWORD || exit 1"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-      start_period: 30s
-    restart: unless-stopped
-
-  redis:
-    image: redis:7.4.7
-    container_name: redis
-    environment:
-      TZ: ${TZ:-UTC}
-    command: ["redis-server", "--requirepass", "${REDIS_PASSWORD}"]
-    volumes:
-      - ./sndata/redis_data:/data
-      - /etc/localtime:/etc/localtime:ro
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 10s
-      timeout: 3s
-      retries: 3
-
-  notelib:
-    image: docker.io/supernote/notelib:6.9.3
-    container_name: notelib
-    environment:
-      TZ: ${TZ:-UTC}
-    volumes:
-      - /etc/localtime:/etc/localtime:ro
-    restart: unless-stopped
-
-  supernote-service:
-    image: docker.io/supernote/supernote-service:26.06.04
-    container_name: supernote-service
-    depends_on:
-      mariadb:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    ports:
-      - "19071:19071"
-      - "18072:18072"
-      - "${FRONTEND_PORT:-19072}:8080"
-      - "${DOMAIN_PORT:-8199}:8080"
-    environment:
-      EXTERNAL_PORT_BACKEND: "19071"
-      EXTERNAL_PORT_FRONTEND: ${FRONTEND_PORT:-19072}
-      EXTERNAL_PORT_DOMAIN: ${DOMAIN_PORT:-8199}
-      TZ: ${TZ:-UTC}
-      DB_HOSTNAME: mariadb
-      MYSQL_DATABASE: supernotedb
-      MYSQL_USER: ${MYSQL_USER}
-      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
-      REDIS_HOST: redis
-      REDIS_PORT: 6379
-      REDIS_PASSWORD: ${REDIS_PASSWORD}
-    volumes:
-      - ./sndata/recycle:/home/supernote/recycle
-      - ./supernote_data:/home/supernote/data
-      - ./sndata/logs/cloud:/home/supernote/cloud/logs
-      - ./sndata/logs/app:/home/supernote/logs
-      - ./sndata/logs/web:/var/log/nginx
-      - ./sndata/convert:/home/supernote/convert
-      - /etc/localtime:/etc/localtime:ro
-    restart: unless-stopped
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "10m"
-        max-file: "3"

ansible/plays/machine_setup/templates/supernote-email-init.sql.j2

@@ -1,30 +0,0 @@
--- Managed by Ansible (supernote.yml) - SMTP secrets sourced from Infisical
--- via `infisical run -- ansible-playbook ...`.
---
--- Mounted into the mariadb container's docker-entrypoint-initdb.d/ so it
--- seeds u_email_config on first boot, and re-applied by the playbook via
--- `docker compose exec` on every run so Infisical stays the source of truth.
---
--- u_email_config's schema/upsert key come from a third-party reverse
--- engineering of Supernote's supernotedb.sql (not officially documented) -
--- see https://github.com/liketheduck/supernote-private-cloud-docker. Verify
--- against Email Settings in the web UI if Supernote changes this schema.
-
-USE supernotedb;
-
-INSERT INTO u_email_config (smtp_server, port, user_name, password, encryption, flag)
-VALUES (
-  '{{ supernote_smtp_server }}',
-  '{{ supernote_smtp_port | default(465) }}',
-  '{{ supernote_smtp_user }}',
-  '{{ supernote_smtp_password }}',
-  '{{ supernote_smtp_encryption | default("ssl") }}',
-  'Y'
-)
-ON DUPLICATE KEY UPDATE
-  smtp_server='{{ supernote_smtp_server }}',
-  port='{{ supernote_smtp_port | default(465) }}',
-  user_name='{{ supernote_smtp_user }}',
-  password='{{ supernote_smtp_password }}',
-  encryption='{{ supernote_smtp_encryption | default("ssl") }}',
-  flag='Y';

ansible/plays/machine_setup/templates/supernote.env.j2

@@ -1,10 +0,0 @@
-# Managed by Ansible (supernote.yml) - secrets sourced from Infisical via
-# `infisical run -- ansible-playbook ...`.
-#
-# Consumed by docker compose for ${VAR} substitution in docker-compose.yml.
-
-MYSQL_ROOT_PASSWORD={{ supernote_mysql_root_password }}
-MYSQL_USER=supernote
-MYSQL_PASSWORD={{ supernote_mysql_password }}
-
-REDIS_PASSWORD={{ supernote_redis_password }}