Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 westfarn
|
5fb23229fb | ||
|
westfarn
|
d9d2dc246a |
@@ -0,0 +1,36 @@
|
||||
name: Sync runner checkout
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [master]
|
||||
pull_request:
|
||||
types: [closed]
|
||||
branches: [master]
|
||||
|
||||
jobs:
|
||||
sync:
|
||||
if: gitea.event_name == 'push' || gitea.event.pull_request.merged == true
|
||||
runs-on: self-hosted
|
||||
steps:
|
||||
- name: Pull latest server-infra
|
||||
run: |
|
||||
set -euo pipefail
|
||||
REPO="/home/westfarn/Documents/repos/server-infra"
|
||||
|
||||
if [[ ! -d "${REPO}/.git" ]]; then
|
||||
echo "Missing git checkout at ${REPO}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cd "${REPO}"
|
||||
|
||||
if ! git diff --quiet || ! git diff --cached --quiet; then
|
||||
echo "Working tree is dirty; refusing to pull"
|
||||
git status --short
|
||||
exit 1
|
||||
fi
|
||||
|
||||
git fetch origin master
|
||||
git checkout master
|
||||
git pull --ff-only origin master
|
||||
git rev-parse --short HEAD
|
||||
+35
-14
@@ -187,15 +187,16 @@ After Docker install, re-SSH so the `docker` group membership takes effect.
|
||||
|
||||
### Apps
|
||||
|
||||
| App | Type | Hosts | Notes |
|
||||
|-----|------|-------|-------|
|
||||
| `company_site` | django (docker) | adama + roslin | active/active behind NPM |
|
||||
| `dta_service` | django (docker) | adama + roslin + ai-server-4080 | active/active behind NPM |
|
||||
| `dta_webapp` | node/vite static | adama + roslin | active/active; built to `/var/www/<env>_dta_webapp`, served by web-static nginx |
|
||||
| App | Type | Hosts | Envs | Notes |
|
||||
|-----|------|-------|------|-------|
|
||||
| `company_site` | django (docker) | adama + roslin (+ ai-server-4080) | prod | active/active behind NPM; beta port reserved |
|
||||
| `dta_service` | django (docker) | adama + roslin + ai-server-4080 | beta + prod | active/active behind NPM |
|
||||
| `dta_webapp` | node/vite static | adama + roslin (+ ai-server-4080) | beta + prod | active/active; built to `/var/www/<env>_dta_webapp`, served by web-static nginx |
|
||||
| `scha` | django (docker) | adama + roslin + ai-server-4080 | prod | active/active behind NPM; beta port reserved |
|
||||
|
||||
Both environments (`beta`, `prod`) are deployed. Django apps use a **shared external
|
||||
Postgres** (via `DATABASE_URL` in each host's env file) so active/active replicas
|
||||
share one database.
|
||||
Django apps use a **shared external Postgres** (via `DATABASE_URL` in each host's
|
||||
env file) so active/active replicas share one database. Beta and prod never share
|
||||
a DB.
|
||||
|
||||
### Data model
|
||||
|
||||
@@ -206,11 +207,16 @@ share one database.
|
||||
|
||||
### Ports
|
||||
|
||||
| App | beta | prod |
|
||||
|-----|------|------|
|
||||
| company_site | 8010 | 8000 |
|
||||
| dta_service | 8011 | 8001 |
|
||||
| dta_webapp (nginx) | 8081 | 8080 |
|
||||
Reserved host ports for NPM upstreams. Ports must match across every host that
|
||||
serves the same app+env. Rows marked *not deployed* keep the port free for a
|
||||
future beta replica.
|
||||
|
||||
| App | beta | prod | Deployed on |
|
||||
|-----|------|------|-------------|
|
||||
| company_site | 8010 (*not deployed*) | 8000 | adama, roslin, ai-server-4080 |
|
||||
| dta_service | 8011 | 8001 | adama, roslin, ai-server-4080 |
|
||||
| scha | 8012 (*not deployed*) | 8002 | adama, roslin, ai-server-4080 |
|
||||
| dta_webapp (nginx) | 8081 | 8080 | adama, roslin, ai-server-4080 |
|
||||
|
||||
### Flow
|
||||
|
||||
@@ -243,6 +249,13 @@ point each domain at the backend(s):
|
||||
adama+roslin you need the **Advanced** tab with a custom `upstream {}` block
|
||||
(or a real LB). Confirm this before relying on active/active.
|
||||
|
||||
| App | Domains | Backends |
|
||||
|-----|---------|----------|
|
||||
| company_site | aimloperations.com (+ www) | `adama:8000` + `roslin:8000` |
|
||||
| dta_service | (see DTA NPM hosts) | `adama:8001` / `8011` + same on roslin / ai-server-4080 |
|
||||
| dta_webapp | (see DTA NPM hosts) | `adama:8080` / `8081` + same on roslin |
|
||||
| scha | `schawheaton.aimloperations.com`, `schawheaton.com` (+ www) | `adama:8002` + `roslin:8002` (+ `ai-server-4080:8002`) |
|
||||
|
||||
### Required changes IN each app repo (owned separately)
|
||||
|
||||
- [ ] `docker-compose.prod.yml`: drop the bundled `db` service; `web` reads
|
||||
@@ -266,8 +279,10 @@ do not).
|
||||
| company_site | beta | `company_site_beta` | `postgres://westfarn:<pw>@10.0.0.230:5432/company_site_beta` |
|
||||
| dta_service | prod | `dta_service` | `postgres://westfarn:<pw>@10.0.0.230:5432/dta_service` |
|
||||
| dta_service | beta | `dta_service_beta` | `postgres://westfarn:<pw>@10.0.0.230:5432/dta_service_beta` |
|
||||
| scha | prod | `scha` | `postgres://westfarn:<pw>@10.0.0.230:5432/scha` |
|
||||
| scha | beta | `scha_beta` | `postgres://westfarn:<pw>@10.0.0.230:5432/scha_beta` |
|
||||
|
||||
Server prereqs on 10.0.0.230: create the 4 DBs + grant `westfarn`;
|
||||
Server prereqs on 10.0.0.230: create each DB + grant `westfarn`;
|
||||
`listen_addresses` covers LAN; `pg_hba.conf` allows `10.0.0.0/24`; firewall opens
|
||||
5432 to `10.0.0.0/24` only.
|
||||
|
||||
@@ -301,6 +316,10 @@ Server prereqs on 10.0.0.230: create the 4 DBs + grant `westfarn`;
|
||||
| `server-infra` checkout | Playbooks + inventory |
|
||||
| SSH key to adama + roslin | Deploy fan-out |
|
||||
|
||||
On every push or merged PR to `master`, `.gitea/workflows/sync-checkout.yml`
|
||||
fast-forward pulls this repo at `~/Documents/repos/server-infra` on the Act
|
||||
runner so playbooks and inventory stay current without a manual `git pull`.
|
||||
|
||||
## SSH Keys for CI Deploy
|
||||
|
||||
| Key | Used by | Purpose |
|
||||
@@ -333,8 +352,10 @@ Store vault password for CI in a file readable only by the Act runner (e.g. `~/.
|
||||
| 6 | Test on single server: `./scripts/provision.sh adama` | Manual |
|
||||
| 7 | Provision all: `./scripts/provision.sh` | Manual |
|
||||
| 8 | Deploy SSH key for Act runner | Future |
|
||||
| 8a | Auto-sync runner checkout on `master` (`.gitea/workflows/sync-checkout.yml`) | Done |
|
||||
| 9 | Stub `deploy-apps.yml` + update `company_site` workflow | Future |
|
||||
| 10 | Dockerize `company_site` | Future (separate ticket) |
|
||||
| 10a | Register + deploy `scha` (all webservers, port 8002) | In progress ([scha#19](https://git.aimloperations.com/ai_ml_operations/scha/issues/19)) |
|
||||
| 11 | Gitea container registry (optional) | Future |
|
||||
|
||||
## Open Decisions
|
||||
|
||||
@@ -80,6 +80,13 @@ app_catalog:
|
||||
webroot_pattern: "/var/www/{env}.app.ditchtheagent/html"
|
||||
# deploy runs `npm ci` then `npm run build:<env>`; that script writes to
|
||||
# {{ web_static_root }}/<env>_dta_webapp (beta/prod), served by web-static.
|
||||
scha:
|
||||
type: django
|
||||
repo: "{{ git_base_url }}/ai_ml_operations/scha.git"
|
||||
default_branch: master
|
||||
compose_file: docker-compose.prod.yml
|
||||
web_service: web
|
||||
migrate_cmd: "uv run python manage.py migrate --noinput"
|
||||
|
||||
# Deploy filter vars. CI passes these; manual runs may leave them undefined
|
||||
# to (re)deploy every app listed in the host's host_apps.
|
||||
|
||||
@@ -10,3 +10,5 @@ host_apps:
|
||||
- { name: dta_service, env: beta, port: 8011 }
|
||||
- { name: dta_webapp, env: prod, port: 8080 }
|
||||
- { name: dta_webapp, env: beta, port: 8081 }
|
||||
- { name: scha, env: prod, port: 8002 }
|
||||
# optional: - { name: scha, env: beta, port: 8012 }
|
||||
|
||||
@@ -24,3 +24,4 @@ host_apps:
|
||||
- { name: dta_webapp, env: beta, port: 8081 }
|
||||
- { name: dta_service, env: prod, port: 8001 }
|
||||
- { name: dta_service, env: beta, port: 8011 }
|
||||
- { name: scha, env: prod, port: 8002 }
|
||||
@@ -7,3 +7,5 @@ host_apps:
|
||||
- { name: dta_service, env: beta, port: 8011 }
|
||||
- { name: dta_webapp, env: prod, port: 8080 }
|
||||
- { name: dta_webapp, env: beta, port: 8081 }
|
||||
- { name: scha, env: prod, port: 8002 }
|
||||
# optional: - { name: scha, env: beta, port: 8012 }
|
||||
|
||||
+1
-1
@@ -17,7 +17,7 @@ Deploy applications with deploy-apps.yml.
|
||||
HOST Optional. Limit to one host: adama, roslin, or ai-server-4080.
|
||||
|
||||
Options:
|
||||
--app NAME App to deploy (company_site, dta_service, dta_webapp)
|
||||
--app NAME App to deploy (company_site, dta_service, dta_webapp, scha)
|
||||
--env ENV Environment: beta or prod
|
||||
--ref REF Git ref/sha to deploy (default: master)
|
||||
--check Dry run
|
||||
|
||||
Reference in New Issue
Block a user