Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the working tree: monitoring stack, emergency access/bot, gyro allocator, grimmory, adguard, backup audit and the OpenCode agent definitions. Also ignore Python bytecode, local archives and Nix/direnv artifacts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71
2026-08-26 21:39:28 +03:00
parent 4bafa7d09e
commit c676be81ec
126 changed files with 10583 additions and 44 deletions
@@ -0,0 +1,88 @@
+---
+- name: Configure Grimmory reverse proxy on ru-vps
+  hosts: ru-vps
+  gather_facts: false
+  vars:
+    caddy_dir: /opt/services/ru-vps/caddy
+    caddyfile_path: /opt/services/ru-vps/caddy/Caddyfile
+    grimmory_domain: books.ada-dev.ru
+    grimmory_upstream: 192.168.1.34:6060
+  tasks:
+    - name: Ensure Caddy service directory exists
+      ansible.builtin.file:
+        path: "{{ caddy_dir }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Configure Grimmory Caddy site
+      ansible.builtin.blockinfile:
+        path: "{{ caddyfile_path }}"
+        create: true
+        owner: root
+        group: root
+        mode: "0644"
+        marker: "# {mark} ANSIBLE MANAGED GRIMMORY SITE"
+        block: |
+          {{ grimmory_domain }} {
+            @grimmory_opds_atom path /api/v1/opds /api/v1/opds/libraries /api/v1/opds/shelves /api/v1/opds/magic-shelves /api/v1/opds/authors /api/v1/opds/series /api/v1/opds/catalog /api/v1/opds/recent /api/v1/opds/surprise
+            handle @grimmory_opds_atom {
+              reverse_proxy {{ grimmory_upstream }} {
+                header_up Accept "application/atom+xml"
+                header_up Accept-Encoding identity
+                transport http {
+                  compression off
+                }
+              }
+            }
+
+            @grimmory_opds_search path /api/v1/opds/search.opds
+            handle @grimmory_opds_search {
+              reverse_proxy {{ grimmory_upstream }} {
+                header_up Accept "application/opensearchdescription+xml"
+                header_up Accept-Encoding identity
+                transport http {
+                  compression off
+                }
+              }
+            }
+
+            @grimmory_device_api path /api/koreader /api/koreader/* /api/v1/opds /api/v1/opds/*
+            handle @grimmory_device_api {
+              reverse_proxy {{ grimmory_upstream }} {
+                header_up Accept-Encoding identity
+                transport http {
+                  compression off
+                }
+              }
+            }
+
+            handle {
+              reverse_proxy {{ grimmory_upstream }}
+            }
+          }
+      register: grimmory_caddy_site
+
+    - name: Validate host Caddy config
+      ansible.builtin.command: caddy validate --config {{ caddyfile_path }}
+      changed_when: false
+
+    - name: Check Caddy container mounted config
+      ansible.builtin.command: docker exec caddy grep -F '@grimmory_device_api path /api/koreader' /etc/caddy/Caddyfile
+      register: grimmory_container_caddyfile
+      changed_when: false
+      failed_when: false
+
+    - name: Restart Caddy when config changed or bind mount is stale
+      ansible.builtin.command: docker restart caddy
+      when: grimmory_caddy_site.changed or grimmory_container_caddyfile.rc != 0
+
+    - name: Validate Caddy container config after restart
+      ansible.builtin.command: docker exec caddy caddy validate --config /etc/caddy/Caddyfile
+      changed_when: false
+
+    - name: Check Grimmory upstream from ru-vps
+      ansible.builtin.uri:
+        url: http://{{ grimmory_upstream }}/api/v1/healthcheck
+        status_code: 200