Add roles/searxng (compose + JSON-enabled settings), gate with searxng_stack
on ai-server-4080, open UFW 8088/tcp from the LAN. Port 8088 avoids the
dta_webapp :8080 clash; chat_backend must use SEARXNG_BASE_URL=http://10.0.0.128:8088.
## Summary
- Fail when `--app` / `--env` match no `host_apps` row (was silent no-op)
- Fail when `--app` missing from `app_catalog`
Prevents "deploy succeeded" that only refreshed web-static nginx while skipping Django — what happened on [chat_backend run 205](https://git.aimloperations.com/ai_ml_operations/chat_backend/actions/runs/205) before `chat_backend` was registered on master.
## Test plan
- [ ] `./scripts/deploy.sh --app does_not_exist --env prod` should fail with catalog message
- [ ] `./scripts/deploy.sh --app chat_backend --env prod` should proceed with Django once catalog/host_apps presentReviewed-on: #6
Add app_catalog entry, host_apps on adama/roslin/ai-server-4080 (prod :8082),
and document ports/NPM backends for the CRA static frontend.Reviewed-on: #4
## Summary
- Register `scha` in `app_catalog` and `host_apps` on adama, roslin, and ai-server-4080 (prod port **8002**; beta **8012** reserved).
- Update `IMPLEMENTATION.md` ports, apps, Postgres, and NPM tables so every app lists beta + prod.
- Include `scha` in `deploy.sh` help.
Part A (dockerize / CI in the `scha` repo) is tracked separately in [scha#19](ai_ml_operations/scha#19).
## Test plan
- [ ] Confirm inventory YAML loads: `ansible-inventory --list` shows `scha` under each host
- [ ] After Part A merges + `~/Documents/secrets/scha/scha_prod.env` exists: dry-run `./scripts/deploy.sh --app scha --env prod --check`
- [ ] Create DB `scha` on shared Postgres (`10.0.0.230`) and point NPM at `adama:8002` + `roslin:8002` (+ optional `ai-server-4080:8002`)
Reviewed-on: #3
## Summary
Implements #1: Gitea Act workflow that fast-forward pulls `~/Documents/repos/server-infra` on the self-hosted runner whenever `master` changes.
- Adds `.gitea/workflows/sync-checkout.yml`
- Triggers on direct push to `master` and on merged PRs targeting `master`
- Refuses to pull if the working tree is dirty
- Documents the workflow in `IMPLEMENTATION.md`
## Test plan
- [ ] Merge PR → workflow runs on self-hosted runner
- [ ] Runner checkout at `/home/westfarn/Documents/repos/server-infra` advances to latest `master` commit
- [ ] Dirty working tree on runner causes workflow to fail (no silent overwrite)
- [ ] Direct push to `master` also triggers sync
Closes#1
Reviewed-on: #2
ai-server-4080 runs dta_service active/active with adama and roslin.
Disable beta_dta_wsgi/prod_dta_wsgi so port 8001/8011 are free for compose.
Co-authored-by: Cursor <cursoragent@cursor.com>
westfarn
