updates

inventory/group_vars/all.yml

@@ -14,3 +14,57 @@ ufw_allowed_tcp_ports:
 # Docker
 docker_users:
   - "{{ admin_user }}"
+
+# Tianji monitoring
+tianji_server_url: https://tianji.aimloperations.com
+tianji_workspace_id: cm7w8087y020lddswyhamadj2
+tianji_install_script_url: "https://tianji.aimloperations.com/serverStatus/{{ tianji_workspace_id }}/install.sh?url={{ tianji_server_url }}"
+
+# ---------------------------------------------------------------------------
+# App deployment (Phase 2)
+# ---------------------------------------------------------------------------
+git_base_url: "ssh://git@git.aimloperations.com:30009"
+
+# Where app checkouts and per-app env files live on each target host.
+apps_base_dir: /opt/apps
+apps_env_dir: "{{ apps_base_dir }}/env"      # persistent .env files, never in git
+apps_src_dir: "{{ apps_base_dir }}/src"      # git checkouts
+
+# Control-node directory holding per-app .env secrets, pushed to hosts at
+# deploy time. Layout: <secrets_dir>/<app>/<app>_<env>.env  (never in git).
+secrets_dir: "{{ lookup('ansible.builtin.env', 'HOME') }}/Documents/secrets"
+
+# Static site document root base (dta_webapp writes build output here).
+web_static_root: /var/www
+
+# Catalog of deployable apps. host_apps (per host_vars) references these by name.
+app_catalog:
+  company_site:
+    type: django
+    repo: "{{ git_base_url }}/ai_ml_operations/company_site.git"
+    default_branch: master
+    compose_file: docker-compose.prod.yml
+    web_service: web
+    migrate_cmd: "uv run python manage.py migrate --noinput"
+  dta_service:
+    type: django
+    repo: "{{ git_base_url }}/Ditch_The_Agent/dta_service.git"
+    default_branch: main
+    compose_file: docker-compose.prod.yml
+    web_service: web
+    migrate_cmd: "uv run python manage.py migrate --noinput"
+  dta_webapp:
+    type: node-static
+    repo: "{{ git_base_url }}/Ditch_The_Agent/dta_webapp.git"
+    default_branch: main
+    # package.json lives in this subdir of the checkout (npm runs here).
+    subdir: ditch-the-agent
+    # Document root served by nginx and written by `npm run build:<env>`.
+    # {env} is replaced with the entry's env (beta/prod).
+    webroot_pattern: "/var/www/{env}.app.ditchtheagent/html"
+    # deploy runs `npm ci` then `npm run build:<env>`; that script writes to
+    # {{ web_static_root }}/<env>_dta_webapp (beta/prod), served by web-static.
+
+# Deploy filter vars. CI passes these; manual runs may leave them undefined
+# to (re)deploy every app listed in the host's host_apps.
+# app: <name>   app_env: beta|prod   app_ref: <git sha or branch, default master>

inventory/host_vars/adama.yml

@@ -0,0 +1,13 @@
+---
+# Django services run active/active here and on roslin (shared external DB).
+# dta_webapp static also runs active/active (built into /var/www, served by
+# the web-static nginx container). Ports MUST match roslin so NPM can balance.
+# Each entry is one workload: django -> compose project <name>_<env> on port;
+# node-static -> /var/www/<env>_dta_webapp served on port.
+host_apps:
+  - { name: company_site, env: prod, port: 8000 }
+  - { name: company_site, env: beta, port: 8010 }
+  - { name: dta_service, env: prod, port: 8001 }
+  - { name: dta_service, env: beta, port: 8011 }
+  - { name: dta_webapp, env: prod, port: 8080 }
+  - { name: dta_webapp, env: beta, port: 8081 }

inventory/host_vars/ai-server-4080.yml

@@ -0,0 +1,16 @@
+---
+# ai-server-4080 — control node + Gitea act runner. Update IP with:
+#   ip -4 addr show scope global
+ansible_host: 10.0.0.128
+
+ansible_control_node: true
+act_runner_enabled: true
+
+# This host's pre-existing ~/.ssh/id_ed25519 is a personal key WITH a passphrase,
+# which hangs the (non-BatchMode) gitea access probe. Use a dedicated,
+# passphrase-less deploy key here instead.
+gitea_key_path: "/home/{{ admin_user }}/.ssh/gitea_deploy"
+
+# company_site prod runs here for side testing.
+host_apps:
+  - { name: company_site, env: prod, port: 8000 }

inventory/host_vars/desktop.yml

@@ -1,6 +0,0 @@
----
-# Update with this machine's LAN IP: ip -4 addr show scope global
-ansible_host: 10.0.0.1  # FIXME: set your desktop IP
-
-ansible_control_node: true
-act_runner_enabled: true

inventory/host_vars/roslin.yml

@@ -0,0 +1,10 @@
+---
+# Mirrors adama for active/active. Ports MUST match adama so NPM upstreams
+# can balance adama:PORT and roslin:PORT for the same workload.
+host_apps:
+  - { name: company_site, env: prod, port: 8000 }
+  - { name: company_site, env: beta, port: 8010 }
+  - { name: dta_service, env: prod, port: 8001 }
+  - { name: dta_service, env: beta, port: 8011 }
+  - { name: dta_webapp, env: prod, port: 8080 }
+  - { name: dta_webapp, env: beta, port: 8081 }

inventory/hosts.yml

@@ -7,4 +7,5 @@ all:
           ansible_host: 10.0.0.77
         roslin:
           ansible_host: 10.0.0.176
-        desktop:
+        ai-server-4080:
+          ansible_host: 10.0.0.128