Merge remote-tracking branch 'origin/master' into issue-17-monica-dj-queue-worker

Build profile-gated services so workers do not run stale images.
The build step omitted COMPOSE_PROFILES, so docker compose skipped the dj-queue worker and up -d reused an image from an earlier deploy; the monica_site beta worker kept psycopg2 and crash-looped on LISTEN/NOTIFY.
2026-08-09 06:24:07 -05:00 · 2026-08-09 06:23:17 -05:00 · 2026-08-08 13:59:27 -05:00
16 changed files with 64 additions and 435 deletions
@@ -10,8 +10,6 @@ flowchart TB
        Control1["ai-server-4080\n(control node)"]
        Control1 -->|ansible-playbook site.yml| Adama
        Control1 -->|ansible-playbook site.yml| Roslin
-        Control1 -->|ansible-playbook site.yml| Starbuck
-        Control1 -->|ansible-playbook site.yml| Apollo
    end

    subgraph cicd ["CI/CD (every merge to master)"]
@@ -21,8 +19,6 @@ flowchart TB
        Deploy --> AnsibleDeploy["ansible-playbook deploy-apps.yml"]
        AnsibleDeploy --> Adama2["adama"]
        AnsibleDeploy --> Roslin2["roslin"]
-        AnsibleDeploy --> Starbuck2["starbuck"]
-        AnsibleDeploy --> Apollo2["apollo"]
    end
 ```

@@ -39,8 +35,6 @@ Both pipelines share the same inventory (`inventory/hosts.yml`).
 |------|-----|------|
 | adama | 10.0.0.77 | Ubuntu Server VM (Proxmox) — app host |
 | roslin | 10.0.0.176 | Ubuntu Server VM (Proxmox) — app host |
-| starbuck | 10.0.0.44 | Ubuntu Server VM (Proxmox) — app host |
-| apollo | 10.0.0.7 | Ubuntu Server VM (Proxmox) — app host |
 | ai-server-4080 | 10.0.0.128 | Control node + Gitea act runner + Ollama + SearxNG + observability; also runs app replicas |

 Hostname on this machine: `ryan-development-1`
@@ -58,10 +52,8 @@ server-infra/
 │   ├── group_vars/
 │   │   └── all.yml         # vars + app_catalog
 │   └── host_vars/
-│       ├── adama.yml       # host_apps (django + static; monica worker)
-│       ├── roslin.yml      # host_apps (mirrors adama, no worker)
-│       ├── starbuck.yml    # host_apps (mirrors roslin)
-│       ├── apollo.yml      # host_apps (mirrors roslin)
+│       ├── adama.yml       # host_apps (django + dta_webapp)
+│       ├── roslin.yml      # host_apps (mirrors adama)
 │       └── ai-server-4080.yml  # control node / act runner / SearxNG / observability
 ├── playbooks/
 │   ├── site.yml            # Phase 1: provision
@@ -92,15 +84,11 @@ Ansible needs SSH + sudo on each target before playbooks work.
   ```bash
   ssh-copy-id westfarn@10.0.0.77
   ssh-copy-id westfarn@10.0.0.176
-   ssh-copy-id westfarn@10.0.0.44
-   ssh-copy-id westfarn@10.0.0.7
   ```
 3. Confirm passwordless SSH:
   ```bash
   ssh westfarn@10.0.0.77
   ssh westfarn@10.0.0.176
-   ssh westfarn@10.0.0.44
-   ssh westfarn@10.0.0.7
   ```
 4. **First-time only** — grant passwordless sudo on each new host before the first
   `provision.sh` run. Ubuntu 26.04 ships `sudo-rs` by default; Ansible's
@@ -154,8 +142,6 @@ New hosts need the one-time passwordless sudo bootstrap in

 # Same for other hosts
 ./scripts/provision.sh roslin
-./scripts/provision.sh starbuck
-./scripts/provision.sh apollo
 ./scripts/provision.sh ai-server-4080
 ```

@@ -170,8 +156,6 @@ New hosts need the one-time passwordless sudo bootstrap in
 ```bash
 ./scripts/deploy.sh adama
 ./scripts/deploy.sh --check roslin
-./scripts/deploy.sh starbuck
-./scripts/deploy.sh apollo
 ```

 Under the hood, scripts pass `--limit <hostname>` to `ansible-playbook`.
@@ -208,21 +192,13 @@ After Docker install, re-SSH so the `docker` group membership takes effect.

 | App | Type | Hosts | Envs | Notes |
 |-----|------|-------|------|-------|
-| `company_site` | django (docker) | all webservers | prod | active/active behind NPM; beta port reserved |
-| `dta_service` | django (docker) | all webservers | beta + prod | active/active behind NPM |
-| `dta_webapp` | node/vite static | all webservers | beta + prod | active/active; built to `/var/www/<env>.realpath.app/html`, served by web-static nginx |
-| `dta_blog` | node-static (Python SSG) | all webservers | beta + prod | active/active; built to `/var/www/<env>.blog.realpath.app/html`; **own hosts** (`blog.realpath.app` / `beta.blog.realpath.app`), not `realpath.app/blog`; Tianji ids baked at build |
-| `scha` | django (docker) | all webservers | prod | active/active behind NPM; beta port reserved |
-| `chat_web_app` | node-static (CRA) | all webservers | beta + prod | active/active; built to `/var/www/<env>.chat.aimloperations/html`, served by web-static nginx |
-| `chat_backend` | django (docker) | all webservers | beta + prod | active/active behind NPM; Ollama `http://10.0.0.128:11434`; SearxNG `http://10.0.0.128:8088` (`SEARXNG_BASE_URL`) |
-| `monica_site` | django (docker) | all webservers | beta + prod | active/active behind NPM; no bundled Postgres (like `scha`); dj-queue **worker singleton on adama** only (`compose --profile worker`); Ollama social drafting via `10.0.0.128:11434` |
-| `url_shortening_service` | django (docker) | all webservers | beta + prod | active/active behind NPM; no bundled Postgres; **no worker**. Two public hosts, same container: short domain (`GET /`, `GET /<code>` 302) and API host (`/api/links/`, Bearer required). |
-| `college_craft` | django (docker) | all webservers | beta + prod | active/active behind NPM; no bundled Postgres (like `scha` / `monica_site`); dj-queue **worker singleton on adama** only (`compose --profile worker`); Ollama social drafting via `10.0.0.128:11434`; Nominatim `http://10.0.0.128:8089`; prod `SITE_UNDER_CONSTRUCTION=true` until launch |
-| `print_forge` | django (docker) | all webservers | beta + prod | active/active behind NPM; no bundled Postgres (like `scha` / `monica_site` / `college_craft`); dj-queue **worker singleton on adama** only (`compose --profile worker`); Nominatim `http://10.0.0.128:8089`; prod `SITE_UNDER_CONSTRUCTION=true` until launch; prod NPM waits until launch |
-| `abc_be` | django (docker) | all webservers | **beta only** | AI Benefits Coach API; no bundled Postgres; Ollama `http://10.0.0.128:11434`; shares DB `abc_be_beta` with `abc_worker` |
-| `abc_worker` | django-type compose (FastAPI) | all webservers | **beta only** | same Postgres as `abc_be`; `migrate_cmd: true`; WS on host port 8018 |
-| `abc_fe` | node-static (Vite) | all webservers | **beta only** | built to `/var/www/<env>.abc.aimloperations/html`; no prod `host_apps` row |
-| `livekit` | django-type compose (LiveKit SFU) | all webservers | **beta only** | Docker like `abc_worker`. Host network `:7880`. **Do not NPM-balance** until Redis — pick one upstream (adama). Router DNAT UDP 3478 + 50000–60000 and TCP 7881 to that host. Secrets `~/Documents/secrets/livekit/livekit_beta.env` |
+| `company_site` | django (docker) | adama + roslin (+ ai-server-4080) | prod | active/active behind NPM; beta port reserved |
+| `dta_service` | django (docker) | adama + roslin + ai-server-4080 | beta + prod | active/active behind NPM |
+| `dta_webapp` | node/vite static | adama + roslin (+ ai-server-4080) | beta + prod | active/active; built to `/var/www/<env>.realpath.app/html`, served by web-static nginx |
+| `scha` | django (docker) | adama + roslin + ai-server-4080 | prod | active/active behind NPM; beta port reserved |
+| `chat_web_app` | node-static (CRA) | adama + roslin + ai-server-4080 | beta + prod | active/active; built to `/var/www/<env>.chat.aimloperations/html`, served by web-static nginx |
+| `chat_backend` | django (docker) | adama + roslin + ai-server-4080 | beta + prod | active/active behind NPM; Ollama `http://10.0.0.128:11434`; SearxNG `http://10.0.0.128:8088` (`SEARXNG_BASE_URL`) |
+| `monica_site` | django (docker) | adama + roslin + ai-server-4080 | beta + prod | active/active behind NPM; no bundled Postgres (like `scha`); dj-queue **worker singleton on adama** only (`compose --profile worker`); Ollama social drafting via `10.0.0.128:11434` |

 Django apps use a **shared external Postgres** (via `DATABASE_URL` in each host's
 env file) so active/active replicas share one database. Beta and prod never share
@@ -233,9 +209,9 @@ a DB.
 - `app_catalog` (`group_vars/all.yml`) — how each app is built (repo, type, compose file, migrate cmd).
 - `host_apps` (`host_vars/<host>.yml`) — which app+env+port runs on that host.
  Optional `compose_profiles: [worker]` activates docker compose profiles on that
-  host only (used for `monica_site` / `college_craft` / `print_forge` dj-queue singleton on adama).
+  host only (used for `monica_site` dj-queue singleton on adama).
 - Django app = one compose project per env: project name `<app>_<env>`, host port from `host_apps`.
-  Ports match across app hosts so NPM can balance `adama:PORT` + `roslin:PORT` + `starbuck:PORT` + `apollo:PORT`.
+  Ports match across adama/roslin so NPM can balance `adama:PORT` + `roslin:PORT`.

 ### Ports

@@ -245,29 +221,20 @@ future beta replica.

 | App | beta | prod | Deployed on |
 |-----|------|------|-------------|
-| company_site | 8010 (*not deployed*) | 8000 | all webservers |
-| dta_service | 8011 | 8001 | all webservers |
-| scha | 8012 (*not deployed*) | 8002 | all webservers |
-| chat_backend | 8013 | 8003 | all webservers |
-| monica_site | 8014 | 8004 | all webservers |
-| url_shortening_service | 8015 | 8005 | all webservers |
-| college_craft | 8016 | 8006 | all webservers |
-| print_forge | **8019** | **8007** | all webservers |
-| abc_be | **8017** | 8009 (*not deployed*) | all webservers |
-| abc_worker | **8018** | 8008 (*not deployed*) | all webservers |
-| dta_webapp (nginx) | 8081 | 8080 | all webservers |
-| chat_web_app (nginx) | 8083 | 8082 | all webservers |
-| abc_fe (nginx) | **8085** | 8084 (*not deployed*) | all webservers |
-| dta_blog (nginx) | **8087** | **8086** | all webservers |
-| livekit | **7880** | — | all webservers (signaling). UDP 3478 + 50000–60000 + TCP 7881 via router DNAT to the NPM upstream host |
+| company_site | 8010 (*not deployed*) | 8000 | adama, roslin, ai-server-4080 |
+| dta_service | 8011 | 8001 | adama, roslin, ai-server-4080 |
+| scha | 8012 (*not deployed*) | 8002 | adama, roslin, ai-server-4080 |
+| chat_backend | 8013 | 8003 | adama, roslin, ai-server-4080 |
+| monica_site | 8014 | 8004 | adama, roslin, ai-server-4080 |
+| dta_webapp (nginx) | 8081 | 8080 | adama, roslin, ai-server-4080 |
+| chat_web_app (nginx) | 8083 | 8082 | adama, roslin, ai-server-4080 |
 | SearxNG (LAN only) | — | **8088** | ai-server-4080 only (`searxng_stack`); not an NPM upstream |

 Host-local services on ai-server-4080 (not balanced by NPM):

 | Service | Port | Notes |
 |---------|------|-------|
-| Ollama | 11434 | Not Ansible-managed today; GPU host (`monica_site` / `college_craft` social drafting) |
-| Nominatim | 8089 | Not Ansible-managed today; LAN address autocomplete for `college_craft` / `print_forge` |
+| Ollama | 11434 | Not Ansible-managed today; GPU host |
 | SearxNG | 8088 | `roles/searxng` (#10); JSON API for chat_backend grounded search |
 | Loki | 3100 | `roles/observability` |
 | Prometheus | 9090 | `roles/observability` |
@@ -293,14 +260,11 @@ chat_backend secrets must use `SEARXNG_BASE_URL=http://10.0.0.128:8088`.
  to host `{{ apps_env_dir }}` → git checkout at ref → copy `.env` into checkout →
  `docker compose build` → `up -d` (with `COMPOSE_PROFILES` from optional
  `host_apps.compose_profiles`) → migrate (run once, shared DB).
-  **`monica_site` / `college_craft` / `print_forge` worker:** adama `host_apps` sets
-  `compose_profiles: [worker]` so deploy starts dj-queue with web. Other hosts
-  omit profiles (web only).
+  **`monica_site` worker:** adama `host_apps` sets `compose_profiles: [worker]` so
+  deploy starts dj-queue with web. Other hosts omit profiles (web only).
 - **node-static**: git checkout at ref → `npm ci` → `npm run build:<env>`
-  (writes to the app's `webroot_pattern`, e.g. `/var/www/{env}.realpath.app/html`,
-  `/var/www/{env}.blog.realpath.app/html`, or `/var/www/{env}.chat.aimloperations/html`).
-  Optional catalog `error_page_404` (used by `dta_blog`) serves that file instead
-  of the SPA `/index.html` fallback.
+  (writes to the app's `webroot_pattern`, e.g. `/var/www/{env}.realpath.app/html`
+  or `/var/www/{env}.chat.aimloperations/html`).
 - **web-static** role: one nginx container per app host serving the static roots
  on their ports (from `host_apps`); NPM balances across hosts. Before `compose up`,
  removes any container currently publishing those host ports (`docker ps --filter
@@ -313,27 +277,18 @@ point each domain at the backend(s):

 - Single host: standard Proxy Host → `adama:PORT`.
 - Active/active: jc21 NPM's UI Proxy Host is single-target. To balance
-  app hosts you need the **Advanced** tab with a custom `upstream {}` block
+  adama+roslin you need the **Advanced** tab with a custom `upstream {}` block
  (or a real LB). Confirm this before relying on active/active.

 | App | Domains | Backends |
 |-----|---------|----------|
-| company_site | aimloperations.com (+ www) | `adama:8000` + `roslin:8000` + `starbuck:8000` + `apollo:8000` |
-| dta_service | (see DTA NPM hosts) | `adama:8001` / `8011` + same on roslin / starbuck / apollo / ai-server-4080 |
-| dta_webapp | (see DTA NPM hosts) | `adama:8080` / `8081` + same on roslin / starbuck / apollo |
-| dta_blog | `blog.realpath.app` (prod); `beta.blog.realpath.app` (beta). **Do not** reverse-proxy onto `realpath.app/blog` | `adama:8086` / `8087` + same on roslin / starbuck / apollo / ai-server-4080 |
-| scha | `schawheaton.aimloperations.com`, `schawheaton.com` (+ www) | `adama:8002` + `roslin:8002` + `starbuck:8002` + `apollo:8002` (+ `ai-server-4080:8002`) |
-| chat_web_app | `chat.aimloperations.com` (+ www); `beta.chat.aimloperations.com` | `adama:8082` / `8083` + same on roslin / starbuck / apollo / ai-server-4080 |
-| chat_backend | `chatbackend.aimloperations.com`; `beta.chatbackend.aimloperations.com` | `adama:8003` / `8013` + same on roslin / starbuck / apollo / ai-server-4080 |
-| monica_site | `mkdrealtor.com` (+ www); `monica-preview.aimloperations.com` (beta) | `adama:8004` / `8014` + same on roslin / starbuck / apollo / ai-server-4080 |
-| url_shortening_service (short) | `aiml.pw` and/or `cidinn.li` (pick when DNS is ready); `short-beta.aimloperations.com` (beta). Proxy `/` + `/[a-z0-9]{4,8}` only — 404 `/api/`, `/admin/`, `/debug/` | `adama:8005` / `8015` + same on roslin / starbuck / apollo / ai-server-4080 |
-| url_shortening_service (API) | `shortener.aimloperations.com`; `shortener-beta.aimloperations.com` (beta). Proxy `/api/` only — 404 `/admin/` | same ports as short host (one container) |
-| college_craft | `collegecraft.com` (+ www); `college-craft-preview.aimloperations.com` (beta) | `adama:8006` / `8016` + same on roslin / starbuck / apollo / ai-server-4080 |
-| print_forge | `printforgeprints.com` (+ www) — **do not NPM-route prod until launch**; `print-forge-preview.aimloperations.com` (beta) | `adama:8007` / `8019` + same on roslin / starbuck / apollo / ai-server-4080 |
-| abc_fe | `beta.abc.aimloperations.com` (beta only) | `adama:8085` + same on roslin / starbuck / apollo / ai-server-4080 |
-| abc_be | `beta.abc.be.aimloperations.com` (beta only) | `adama:8017` + same on roslin / starbuck / apollo / ai-server-4080 |
-| abc_worker | `beta.abc.worker.aimloperations.com` (beta only; HTTP + WebSocket upgrade) | `adama:8018` + same on roslin / starbuck / apollo / ai-server-4080 |
-| livekit | `LIVEKIT_DOMAIN` (e.g. `livekit.aimloperations.com`) — NPM Proxy Host, WebSocket, **single upstream** | `adama:7880` (do not balance until Redis) |
+| company_site | aimloperations.com (+ www) | `adama:8000` + `roslin:8000` |
+| dta_service | (see DTA NPM hosts) | `adama:8001` / `8011` + same on roslin / ai-server-4080 |
+| dta_webapp | (see DTA NPM hosts) | `adama:8080` / `8081` + same on roslin |
+| scha | `schawheaton.aimloperations.com`, `schawheaton.com` (+ www) | `adama:8002` + `roslin:8002` (+ `ai-server-4080:8002`) |
+| chat_web_app | `chat.aimloperations.com` (+ www); `beta.chat.aimloperations.com` | `adama:8082` / `8083` + same on roslin / ai-server-4080 |
+| chat_backend | `chatbackend.aimloperations.com`; `beta.chatbackend.aimloperations.com` | `adama:8003` / `8013` + same on roslin / ai-server-4080 |
+| monica_site | `mkdrealtor.com` (+ www); `monica-preview.aimloperations.com` (beta) | `adama:8004` / `8014` + same on roslin / ai-server-4080 |

 ### Required changes IN each app repo (owned separately)

@@ -345,9 +300,6 @@ point each domain at the backend(s):
      (keep the test/docker jobs).
 - [ ] `dta_webapp`: `npm run build:beta` / `build:prod` output to
      `/var/www/beta.realpath.app/html` / `/var/www/prod.realpath.app/html`.
- [ ] `dta_blog`: `npm run build:beta` / `build:prod` output to
-      `/var/www/beta.blog.realpath.app/html` / `/var/www/prod.blog.realpath.app/html`
-      (`python3 build.py --env <env>` copies `dist/`). Default branch is `main`.
 - [ ] `chat_web_app`: `npm run build:beta` / `build:prod` output to
      `/var/www/beta.chat.aimloperations/html` / `/var/www/prod.chat.aimloperations/html`.

@@ -371,110 +323,11 @@ do not).
 | chat_backend | beta | `chat_backend_beta` | `postgres://westfarn:<pw>@10.0.0.230:5432/chat_backend_beta` |
 | monica_site | prod | `monica_site` | `postgres://westfarn:<pw>@10.0.0.230:5432/monica_site` |
 | monica_site | beta | `monica_site_beta` | `postgres://westfarn:<pw>@10.0.0.230:5432/monica_site_beta` |
-| url_shortening_service | prod | `url_shortener` | `postgres://westfarn:<pw>@10.0.0.230:5432/url_shortener` |
-| url_shortening_service | beta | `url_shortener_beta` | `postgres://westfarn:<pw>@10.0.0.230:5432/url_shortener_beta` |
-| college_craft | prod | `college_craft` | `postgres://westfarn:<pw>@10.0.0.230:5432/college_craft` |
-| college_craft | beta | `college_craft_beta` | `postgres://westfarn:<pw>@10.0.0.230:5432/college_craft_beta` |
-| print_forge | prod | `print_forge` | `postgres://westfarn:<pw>@10.0.0.230:5432/print_forge` |
-| print_forge | beta | `print_forge_beta` | `postgres://westfarn:<pw>@10.0.0.230:5432/print_forge_beta` |
-| abc_be | beta | `abc_be_beta` | `postgres://westfarn:<pw>@10.0.0.230:5432/abc_be_beta` |
-| abc_worker | beta | *(same `abc_be_beta`)* | worker uses `DB_*` pointing at `abc_be_beta` — do **not** create a second DB |

 Server prereqs on 10.0.0.230: create each DB + grant `westfarn`;
 `listen_addresses` covers LAN; `pg_hba.conf` allows `10.0.0.0/24`; firewall opens
 5432 to `10.0.0.0/24` only.

-`url_shortening_service` extra env (control-node secrets, not in git):
-`SHORT_PUBLIC_HOSTS` / `SHORT_API_HOSTS` / `SHORT_ADMIN_HOSTS` (admin = `localhost,127.0.0.1` only),
-`SHORTENER_API_TOKENS` (`monica:<token>`), `SHORT_ALLOWED_HOSTS`, `CLICK_IP_PEPPER`
-(distinct from `DJANGO_SECRET_KEY`). `DJANGO_DEBUG=false` for prod and beta.
-Caller `monica_site` uses `SHORTENER_BASE_URL=https://<api-host>` and Bearer mint;
-do not mint via the short hostname.
-
-`college_craft` extra env (control-node secrets, not in git):
-`~/Documents/secrets/college_craft/college_craft_prod.env` and
-`college_craft_beta.env`. Template: app repo `.env.prod.example`.
-`DJANGO_ENV` / `DJANGO_ALLOWED_HOSTS` / `DATABASE_URL` / `WEB_PORT` /
-`PUBLIC_SITE_URL` differ per env (prod `collegecraft.com` / `:8006`;
-beta `college-craft-preview.aimloperations.com` / `:8016`).
-`SITE_UNDER_CONSTRUCTION=true` on prod (holding page until launch), `false` on beta.
-`FEATURE_BLOG=true`; other `FEATURE_*` stay false until purchased. Prod also needs
-`TIANJI_WEBSITE_ID` + reCAPTCHA keys. If email/SMS or direct mail is turned on later,
-add a `college_craft:<token>` entry to `SHORTENER_API_TOKENS` on `url_shortening_service`.
-
-App-repo companion (`college_craft`, not this repo): deploy workflows still call
-`--app client_site` (template leftover). They must become `--app college_craft`
-before CI deploy will hit this catalog entry. Default branch is `master` (not `main`).
-
-`print_forge` extra env (control-node secrets, not in git):
-`~/Documents/secrets/print_forge/print_forge_prod.env` and
-`print_forge_beta.env`. Template: app repo `.env.prod.example`.
-`DJANGO_ENV` / `DJANGO_ALLOWED_HOSTS` / `DATABASE_URL` / `WEB_PORT` /
-`PUBLIC_SITE_URL` differ per env (prod `printforgeprints.com` / `:8007`;
-beta `print-forge-preview.aimloperations.com` / `:8019`).
-`SITE_UNDER_CONSTRUCTION=true` on prod (holding page until launch), `false` on beta.
-Purchased flags: `FEATURE_EMAIL_SMS`, `FEATURE_PAYMENTS`, `FEATURE_SHOP`,
-`FEATURE_SHIPPING`. Other `FEATURE_*` stay false. Add a `print_forge:<token>`
-entry to `SHORTENER_API_TOKENS` on `url_shortening_service` (beta token first).
-`SHORTENER_BASE_URL` is prod shortener on prod, `https://shortener-beta.aimloperations.com`
-on beta. Default branch is `master`.
-
-Companion app ticket: [print_forge#1](https://git.aimloperations.com/ai_ml_operations/print_forge/issues/1)
-([#27](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/27)).
-App Gitea workflow deploys beta on push to `master` (`--app print_forge`).
-
-`abc_be` / `abc_worker` / `abc_fe` (GIS org, not this repo) — **beta only** ([#26](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/26)):
-
-Control-node secrets (never git, mode `600`):
-
-```text
-~/Documents/secrets/abc_be/abc_be_beta.env
-~/Documents/secrets/abc_worker/abc_worker_beta.env
-```
-
-Templates: `GIS/abc_be` `.env.beta.example`, `GIS/abc_worker` `.env.beta.example`.
-`abc_fe` has no secret file — public `VITE_*` URLs live in committed `.env.beta`.
-Create Postgres DB `abc_be_beta` and grant `westfarn` before first deploy.
-NPM: `beta.abc.aimloperations.com` → `:8085`, `beta.abc.be.aimloperations.com` → `:8017`,
-`beta.abc.worker.aimloperations.com` → `:8018` (enable WebSocket). No prod ABC
-`host_apps` rows; ports **8009** / 8008 / 8084 reserved (`print_forge` took prod **8007**).
-
-Companion workflows: [abc_be#22](https://git.aimloperations.com/GIS/abc_be/issues/22),
-[abc_worker#27](https://git.aimloperations.com/GIS/abc_worker/issues/27),
-[abc_fe#27](https://git.aimloperations.com/GIS/abc_fe/issues/27).
-
-`livekit` (GIS org, SFU on webservers — [abc_worker#14](https://git.aimloperations.com/GIS/abc_worker/issues/14)–[#17](https://git.aimloperations.com/GIS/abc_worker/issues/17)):
-
-Control-node secret (never git, mode `600`):
-
-```text
-~/Documents/secrets/livekit/livekit_beta.env
-```
-
-Template: `GIS/livekit` `.env.beta.example`. Same `LIVEKIT_API_KEY` /
-`LIVEKIT_API_SECRET` pair as `abc_be` / `abc_worker`; worker `LIVEKIT_URL=wss://<LIVEKIT_DOMAIN>`.
-
-Deploy: `./scripts/deploy.sh --app livekit --env beta` (all webservers, like
-`abc_worker`). NPM: `LIVEKIT_DOMAIN` → **one** host `:7880` with WebSocket
-(adama). Router DNAT UDP 3478 + 50000–60000 and TCP 7881 to that same host.
-Do not active/active-balance LiveKit until Redis is in the compose.
-
-`dta_blog` ([#29](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/29)) —
-Python SSG, **no secrets file**. `npm run build:<env>` writes
-`/var/www/<env>.blog.realpath.app/html`. Prod (`:8086`) omits `demo: true` seed
-posts; beta (`:8087`) includes them. Header/footer links are baked at build
-(`https://realpath.app` vs `https://beta.realpath.app`); Tianji website ids
-are likewise baked (`cmtvvmf562afjzqumwt1yh2y8` / `cmtvvn6z62agdzqumtk8xijpy`).
-Default branch is `main`.
-
-NPM / DNS / Cloudflare (Ansible does not manage these): `blog.realpath.app` →
-`:8086`, `beta.blog.realpath.app` → `:8087`, TLS like the other RealPath names.
-Do **not** mount this on `realpath.app/blog`. Static ports stay LAN / NPM-only
-(UFW does not world-open 8086/8087).
-
-Companion app ticket: [dta_blog#1](https://git.aimloperations.com/Ditch_The_Agent/dta_blog/issues/1).
-Gitea deploy can later call `./scripts/deploy.sh --app dta_blog --env beta|prod`.
-
 ### One-time host bootstrap (per target)

 - [x] Gitea SSH key: the `gitea-key` role (in `site.yml`) generates a key per
@@ -485,7 +338,7 @@ Gitea deploy can later call `./scripts/deploy.sh --app dta_blog --env beta|prod`
      (default `~/Documents/secrets/<app>/<app>_<env>.env`) with `DATABASE_URL`
      (see table), `DJANGO_ENV`, `DJANGO_SECRET_KEY`, `WEB_PORT` (matching the port
      table). Deploy pushes these to `/opt/apps/env/<app>_<env>.env` (mode 600) on
-      adama + roslin + starbuck + apollo. Never committed to git.
+      adama + roslin. Never committed to git.
 - [x] Node.js/npm/npx for the `dta_webapp` build — installed by the `nodejs`
      role in `site.yml` (NodeSource, `node_major` default 20).

@@ -494,7 +347,7 @@ Gitea deploy can later call `./scripts/deploy.sh --app dta_blog --env beta|prod`
 **Recommended:** Single self-hosted runner on ai-server-4080.

 - One orchestration point.
- App hosts (adama/roslin/starbuck/apollo) run the workloads; no runner needed on them for deploy fan-out.
+- App hosts (adama/roslin) run the workloads; no runner needed on them for deploy fan-out.
 - Runner needs: Ansible, this repo checked out, SSH key to all hosts, vault password (later).

 ### Runner requirements on ai-server-4080
@@ -503,7 +356,7 @@ Gitea deploy can later call `./scripts/deploy.sh --app dta_blog --env beta|prod`
 |-------------|-----|
 | Ansible | Run `deploy-apps.yml` |
 | `server-infra` checkout | Playbooks + inventory |
-| SSH key to app hosts | Deploy fan-out |
+| SSH key to adama + roslin | Deploy fan-out |

 On every push or merged PR to `master`, `.gitea/workflows/sync-checkout.yml`
 fast-forward pulls this repo at `~/Documents/repos/server-infra` on the Act
@@ -534,8 +387,8 @@ Store vault password for CI in a file readable only by the Act runner (e.g. `~/.
 | # | Task | Status |
 |---|------|--------|
 | 1 | Create `server-infra` repo | Done |
-| 2 | Inventory with all 5 hosts | Done ([#20](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/20)) |
-| 3 | Bootstrap SSH to app hosts | Manual |
+| 2 | Inventory with all 3 hosts | Done |
+| 3 | Bootstrap SSH to adama + roslin | Manual |
 | 4 | `site.yml` → common, ufw, docker | Done |
 | 5 | Verify `ansible webservers -m ping` | Manual |
 | 6 | Test on single server: `./scripts/provision.sh adama` | Manual |
@@ -548,20 +401,13 @@ Store vault password for CI in a file readable only by the Act runner (e.g. `~/.
 | 10b | Register + deploy `chat_web_app` (node-static, ports 8082/8083) | Done (prod); beta ([#7](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/7), [chat_web_app#35](https://git.aimloperations.com/ai_ml_operations/chat_web_app/issues/35)) |
 | 10c | Register + deploy `chat_backend` (django, ports 8003/8013) | Done (prod); beta ([#7](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/7), [chat_backend#26](https://git.aimloperations.com/ai_ml_operations/chat_backend/issues/26)) |
 | 10d | Register + deploy `monica_site` (django, ports 8004/8014) | Done ([#14](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/14)) |
-| 10e | Auto-start `monica_site` dj-queue worker on adama (`compose_profiles`) | Done ([#17](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/17)) |
-| 10f | Add starbuck + apollo as app hosts (same workloads as roslin) | Done ([#20](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/20)) |
-| 10g | Register + deploy `url_shortening_service` (django, ports 8005/8015) | Done ([#22](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/22)) |
-| 10h | Register + deploy `college_craft` (django, ports 8006/8016) | Done ([#24](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/24)) |
-| 10i | Register + deploy ABC beta (`abc_be` 8017, `abc_worker` 8018, `abc_fe` 8085) | Done ([#26](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/26)) |
-| 10j | Register + deploy `print_forge` (django, ports 8007/8019) | Done ([#27](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/27)) |
-| 10k | Register + deploy `dta_blog` (node-static, ports 8086/8087) | Done ([#29](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/29)) |
-| 10l | Register GIS LiveKit SFU (`abc_worker`-style docker on webservers, port 7880) | This PR |
+| 10e | Auto-start `monica_site` dj-queue worker on adama (`compose_profiles`) | In progress ([#17](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/17)) |
 | 11 | Gitea container registry (optional) | Future |

 ## Open Decisions

 1. **Deploy user** — `westfarn` vs dedicated `deploy` for CI.
-2. **NPM load balancing** — confirm jc21 NPM can express all app-host upstreams (Advanced tab), else active/active is just independent instances.
+2. **NPM load balancing** — confirm jc21 NPM can express adama+roslin upstreams (Advanced tab), else active/active is just two independent instances.
 3. **Secrets** — Ansible Vault vs per-host env files (currently per-host `/opt/apps/env/*.env`).

 ## Adding a New VM
@@ -11,8 +11,6 @@ ansible-galaxy collection install -r requirements.yml
 # Bootstrap SSH key to each host (one-time, before Ansible)
 ssh-copy-id westfarn@10.0.0.77
 ssh-copy-id westfarn@10.0.0.176
-ssh-copy-id westfarn@10.0.0.44
-ssh-copy-id westfarn@10.0.0.7

 # First-time only: passwordless sudo on each new host (before first provision)
 ssh -t westfarn@10.0.0.176   # repeat for each host IP
@@ -48,6 +46,4 @@ the central **Loki / Prometheus / Grafana** stack (`observability_stack: true`).
 |------|-----|------|
 | adama | 10.0.0.77 | app host |
 | roslin | 10.0.0.176 | app host |
-| starbuck | 10.0.0.44 | app host |
-| apollo | 10.0.0.7 | app host |
 | ai-server-4080 | 10.0.0.128 | control node + act runner |
@@ -45,7 +45,7 @@ first; use text search (`|=`, `|~`) on logs second.

 | Label | Meaning | Examples |
 |-------|---------|----------|
-| `host` | Inventory hostname | `adama`, `roslin`, `starbuck`, `apollo`, `ai-server-4080` |
+| `host` | Inventory hostname | `adama`, `roslin`, `ai-server-4080` |
 | `env` | Deploy environment | `beta`, `prod`, `host` (journal), `infra` (stack containers) |
 | `app` | App / service name | `company_site`, `dta_service`, `dta_webapp`, `system` |
 | `job` | Collector | `docker`, `systemd` |
@@ -56,7 +56,7 @@ first; use text search (`|=`, `|~`) on logs second.

 | Label | Meaning | Examples |
 |-------|---------|----------|
-| `host` | Inventory hostname (stamped by Alloy) | `adama`, `roslin`, `starbuck`, `apollo`, `ai-server-4080` |
+| `host` | Inventory hostname (stamped by Alloy) | `adama`, `roslin`, `ai-server-4080` |
 | `job` | Scrape job | `node` (host), `cadvisor` (containers) |
 | `env` / `app` | Parsed from Compose project `<app>_<env>` | `prod` / `dta_service` |
 | `name` | Container name (cAdvisor) | `company_site_prod-web-1` |
@@ -10,8 +10,6 @@ flowchart LR
  subgraph hosts ["All webservers"]
    A["adama\nAlloy"]
    R["roslin\nAlloy"]
-    S["starbuck\nAlloy"]
-    Ap["apollo\nAlloy"]
    C["ai-server-4080\nAlloy"]
  end

@@ -26,13 +24,9 @@ flowchart LR

  A -->|logs| L
  R -->|logs| L
-  S -->|logs| L
-  Ap -->|logs| L
  C -->|logs| L
  A -->|metrics| P
  R -->|metrics| P
-  S -->|metrics| P
-  Ap -->|metrics| P
  C -->|metrics| P
  L --> G
  P --> G
@@ -42,7 +36,7 @@ flowchart LR

 | Piece | Where | Role |
 |-------|--------|------|
-| **Alloy** | every host (`adama`, `roslin`, `starbuck`, `apollo`, `ai-server-4080`) | Ship journald + Docker **logs** to Loki; scrape host + container **metrics** → Prometheus |
+| **Alloy** | every host (`adama`, `roslin`, `ai-server-4080`) | Ship journald + Docker **logs** to Loki; scrape host + container **metrics** → Prometheus |
 | **Loki** | `ai-server-4080` only | Store and index logs |
 | **Prometheus** | `ai-server-4080` only | Store metrics (CPU, RAM, disk, container health) |
 | **Grafana** | `ai-server-4080` only | Explore logs/metrics, dashboards, alerts |
@@ -188,7 +182,7 @@ services:
    user: "0:0"
    command: -config.file=/etc/loki/loki-config.yml
    ports:
-      # Bind to all interfaces so Alloy on app hosts can push.
+      # Bind to all interfaces so Alloy on adama/roslin can push.
      # Firewall (UFW) should restrict who can connect — see 1.6.
      - "3100:3100"
    volumes:
@@ -382,7 +376,7 @@ Alloy runs on **every** host in `webservers`. It:

 | Label | Source | Example values |
 |-------|--------|----------------|
-| `host` | Ansible inventory hostname | `adama`, `roslin`, `starbuck`, `apollo`, `ai-server-4080` |
+| `host` | Ansible inventory hostname | `adama`, `roslin`, `ai-server-4080` |
 | `job` | collector name | `systemd`, `docker` |
 | `env` | Docker Compose project suffix | `beta`, `prod`, `host`, `infra` |
 | `app` | Compose project prefix | `company_site`, `dta_service`, `dta_webapp`, … |
@@ -393,7 +387,7 @@ Alloy runs on **every** host in `webservers`. It:

 | Label | Source | Example values |
 |-------|--------|----------------|
-| `host` | Added by Alloy relabel | `adama`, `roslin`, `starbuck`, `apollo`, `ai-server-4080` |
+| `host` | Added by Alloy relabel | `adama`, `roslin`, `ai-server-4080` |
 | `job` | scrape job name | `node`, `cadvisor` |
 | `name` | container name (cAdvisor) | `company_site_prod-web-1` |
 | `container_label_com_docker_compose_project` | Compose project | `dta_service_prod` |
@@ -413,7 +407,7 @@ container_memory_usage_bytes{host="adama", env="prod", app="dta_service"}

 ### 3.1 Install Alloy (manual — one host)

-Repeat on `adama`, `roslin`, `starbuck`, `apollo`, and `ai-server-4080`. Example for **adama**:
+Repeat on `adama`, `roslin`, and `ai-server-4080`. Example for **adama**:

 ```bash
 sudo mkdir -p /opt/apps/observability/alloy
@@ -421,7 +415,7 @@ sudo chown -R westfarn:westfarn /opt/apps/observability
 ```

 Create `/opt/apps/observability/alloy/config.alloy`. **Change every
-`host = "adama"`** on each machine (`adama` / `roslin` / `starbuck` / `apollo` / `ai-server-4080`):
+`host = "adama"`** on each machine (`adama` / `roslin` / `ai-server-4080`):

 ```river
 // Grafana Alloy — logs → Loki, metrics → Prometheus.
@@ -711,8 +705,6 @@ Healthy Alloy logs mention connecting / sending without repeated
 ```logql
 {host="adama"}
 {host="roslin"}
-{host="starbuck"}
-{host="apollo"}
 {host="ai-server-4080"}
 ```

@@ -824,8 +816,6 @@ observability_stack: true
 ./scripts/provision.sh ai-server-4080
 ./scripts/provision.sh adama
 ./scripts/provision.sh roslin
-./scripts/provision.sh starbuck
-./scripts/provision.sh apollo
 # or all (site.yml orders stack before Alloy):
 ./scripts/provision.sh
 ```
@@ -926,7 +916,7 @@ du -sh /opt/apps/observability/loki/data \
 - [ ] `GF_SERVER_ROOT_URL` matches public URL
 - [ ] Both Loki and Prometheus datasources green in Grafana

-### Alloy (each of adama, roslin, starbuck, apollo, ai-server-4080)
+### Alloy (each of adama, roslin, ai-server-4080)

 - [ ] `config.alloy` has correct `host = "..."` (or Ansible `inventory_hostname`)
 - [ ] Alloy container running privileged with host `/proc` `/sys` mounts
@@ -12,15 +12,6 @@ ufw_allowed_tcp_ports:
  - 80
  - 443

-# LiveKit on webservers. Signaling stays LAN (NPM → :7880). UDP must be
-# reachable from the internet via router DNAT to the NPM upstream host.
-ufw_lan_tcp_ports:
-  - 7880
-  - 7881
-ufw_extra_udp_ports:
-  - 3478
-  - "50000:60000"
-
 # Docker
 docker_users:
  - "{{ admin_user }}"
@@ -89,15 +80,6 @@ app_catalog:
    webroot_pattern: "/var/www/{env}.realpath.app/html"
    # deploy runs `npm ci` then `npm run build:<env>`; that script writes to
    # {{ web_static_root }}/<env>_dta_webapp (beta/prod), served by web-static.
-  dta_blog:
-    type: node-static
-    repo: "{{ git_base_url }}/Ditch_The_Agent/dta_blog.git"
-    default_branch: main
-    # Python SSG (stdlib). package.json build:<env> copies dist/ to this webroot
-    # so the existing node-static path (`npm ci` then `npm run build:<env>`) works.
-    webroot_pattern: "/var/www/{env}.blog.realpath.app/html"
-    # Real 404 page (not SPA index fallback). See roles/web-static nginx.conf.j2.
-    error_page_404: /404.html
  scha:
    type: django
    repo: "{{ git_base_url }}/ai_ml_operations/scha.git"
@@ -130,60 +112,6 @@ app_catalog:
    migrate_cmd: "uv run python manage.py migrate --noinput"
    # dj-queue worker = compose profile `worker` (singleton). Deploy starts it
    # via host_apps.compose_profiles on adama only (see host_vars/adama.yml).
-  url_shortening_service:
-    type: django
-    repo: "{{ git_base_url }}/ai_ml_operations/url_shortening_service.git"
-    default_branch: master
-    compose_file: docker-compose.prod.yml
-    web_service: web
-    migrate_cmd: "uv run python manage.py migrate --noinput"
-    # No compose worker profile. Two public NPM hosts share one container/port.
-  college_craft:
-    type: django
-    repo: "{{ git_base_url }}/ai_ml_operations/college_craft.git"
-    default_branch: master
-    compose_file: docker-compose.prod.yml
-    web_service: web
-    migrate_cmd: "uv run python manage.py migrate --noinput"
-    # dj-queue worker = compose profile `worker` (singleton). Deploy starts it
-    # via host_apps.compose_profiles on adama only (see host_vars/adama.yml).
-  print_forge:
-    type: django
-    repo: "{{ git_base_url }}/ai_ml_operations/print_forge.git"
-    default_branch: master
-    compose_file: docker-compose.prod.yml
-    web_service: web
-    migrate_cmd: "uv run python manage.py migrate --noinput"
-    # dj-queue worker = compose profile `worker` (singleton). Deploy starts it
-    # via host_apps.compose_profiles on adama only (see host_vars/adama.yml).
-  abc_be:
-    type: django
-    repo: "{{ git_base_url }}/GIS/abc_be.git"
-    default_branch: master
-    compose_file: docker-compose.prod.yml
-    web_service: web
-    migrate_cmd: "uv run python manage.py migrate --noinput"
-  abc_worker:
-    type: django
-    repo: "{{ git_base_url }}/GIS/abc_worker.git"
-    default_branch: master
-    compose_file: docker-compose.prod.yml
-    web_service: web
-    # FastAPI — no Django migrations. `true` keeps the django deploy path happy.
-    migrate_cmd: "true"
-  abc_fe:
-    type: node-static
-    repo: "{{ git_base_url }}/GIS/abc_fe.git"
-    default_branch: master
-    webroot_pattern: "/var/www/{env}.abc.aimloperations/html"
-  livekit:
-    type: django
-    repo: "{{ git_base_url }}/GIS/livekit.git"
-    default_branch: master
-    compose_file: docker-compose.prod.yml
-    web_service: web
-    # SFU — no Django migrations. `true` keeps the django deploy path happy.
-    migrate_cmd: "true"

 # Deploy filter vars. CI passes these; manual runs may leave them undefined
 # to (re)deploy every app listed in the host's host_apps.
@@ -1,8 +1,7 @@
 ---
-# Django services run active/active here and on roslin/starbuck/apollo
-# (shared external DB). dta_webapp static also runs active/active (built into
-# /var/www, served by the web-static nginx container). Ports MUST match the
-# other app hosts so NPM can balance.
+# Django services run active/active here and on roslin (shared external DB).
+# dta_webapp static also runs active/active (built into /var/www, served by
+# the web-static nginx container). Ports MUST match roslin so NPM can balance.
 # Each entry is one workload: django -> compose project <name>_<env> on port;
 # node-static -> /var/www/<env>_dta_webapp served on port.
 host_apps:
@@ -11,24 +10,12 @@ host_apps:
  - { name: dta_service, env: beta, port: 8011 }
  - { name: dta_webapp, env: prod, port: 8080 }
  - { name: dta_webapp, env: beta, port: 8081 }
-  - { name: dta_blog, env: prod, port: 8086 }
-  - { name: dta_blog, env: beta, port: 8087 }
  - { name: scha, env: prod, port: 8002 }
  # optional: - { name: scha, env: beta, port: 8012 }
  - { name: chat_web_app, env: prod, port: 8082 }
  - { name: chat_web_app, env: beta, port: 8083 }
  - { name: chat_backend, env: prod, port: 8003 }
  - { name: chat_backend, env: beta, port: 8013 }
-  # compose_profiles: worker → dj-queue singleton (not on other app hosts).
+  # compose_profiles: worker → dj-queue singleton (not on roslin / ai-server-4080).
  - { name: monica_site, env: prod, port: 8004, compose_profiles: [worker] }
  - { name: monica_site, env: beta, port: 8014, compose_profiles: [worker] }
-  - { name: url_shortening_service, env: prod, port: 8005 }
-  - { name: url_shortening_service, env: beta, port: 8015 }
-  - { name: college_craft, env: prod, port: 8006, compose_profiles: [worker] }
-  - { name: college_craft, env: beta, port: 8016, compose_profiles: [worker] }
-  - { name: print_forge, env: prod, port: 8007, compose_profiles: [worker] }
-  - { name: print_forge, env: beta, port: 8019, compose_profiles: [worker] }
-  - { name: abc_be, env: beta, port: 8017 }
-  - { name: abc_worker, env: beta, port: 8018 }
-  - { name: abc_fe, env: beta, port: 8085 }
-  - { name: livekit, env: beta, port: 7880 }
@@ -22,13 +22,11 @@ searxng_stack: true
 gitea_key_path: "/home/{{ admin_user }}/.ssh/gitea_deploy"

 # company_site + dta_webapp + dta_service for side testing and active/active.
-# Ports MUST match adama/roslin/starbuck/apollo so NPM can balance all upstreams.
+# Ports MUST match adama/roslin so NPM can balance all three upstreams.
 host_apps:
  - { name: company_site, env: prod, port: 8000 }
  - { name: dta_webapp, env: prod, port: 8080 }
  - { name: dta_webapp, env: beta, port: 8081 }
-  - { name: dta_blog, env: prod, port: 8086 }
-  - { name: dta_blog, env: beta, port: 8087 }
  - { name: dta_service, env: prod, port: 8001 }
  - { name: dta_service, env: beta, port: 8011 }
  - { name: scha, env: prod, port: 8002 }
@@ -36,16 +34,6 @@ host_apps:
  - { name: chat_web_app, env: beta, port: 8083 }
  - { name: chat_backend, env: prod, port: 8003 }
  - { name: chat_backend, env: beta, port: 8013 }
-  # monica_site / college_craft / print_forge workers NOT here — adama sets compose_profiles: [worker].
+  # monica_site worker NOT here — adama host_apps sets compose_profiles: [worker].
  - { name: monica_site, env: prod, port: 8004 }
  - { name: monica_site, env: beta, port: 8014 }
-  - { name: url_shortening_service, env: prod, port: 8005 }
-  - { name: url_shortening_service, env: beta, port: 8015 }
-  - { name: college_craft, env: prod, port: 8006 }
-  - { name: college_craft, env: beta, port: 8016 }
-  - { name: print_forge, env: prod, port: 8007 }
-  - { name: print_forge, env: beta, port: 8019 }
-  - { name: abc_be, env: beta, port: 8017 }
-  - { name: abc_worker, env: beta, port: 8018 }
-  - { name: abc_fe, env: beta, port: 8085 }
-  - { name: livekit, env: beta, port: 7880 }
@@ -1,30 +0,0 @@
---
-# Mirrors roslin for active/active. Ports MUST match adama/roslin so NPM
-# upstreams can balance apollo:PORT with the other app hosts.
-host_apps:
-  - { name: company_site, env: prod, port: 8000 }
-  - { name: dta_service, env: prod, port: 8001 }
-  - { name: dta_service, env: beta, port: 8011 }
-  - { name: dta_webapp, env: prod, port: 8080 }
-  - { name: dta_webapp, env: beta, port: 8081 }
-  - { name: dta_blog, env: prod, port: 8086 }
-  - { name: dta_blog, env: beta, port: 8087 }
-  - { name: scha, env: prod, port: 8002 }
-  # optional: - { name: scha, env: beta, port: 8012 }
-  - { name: chat_web_app, env: prod, port: 8082 }
-  - { name: chat_web_app, env: beta, port: 8083 }
-  - { name: chat_backend, env: prod, port: 8003 }
-  - { name: chat_backend, env: beta, port: 8013 }
-  # monica_site / college_craft / print_forge workers NOT here — adama sets compose_profiles: [worker].
-  - { name: monica_site, env: prod, port: 8004 }
-  - { name: monica_site, env: beta, port: 8014 }
-  - { name: url_shortening_service, env: prod, port: 8005 }
-  - { name: url_shortening_service, env: beta, port: 8015 }
-  - { name: college_craft, env: prod, port: 8006 }
-  - { name: college_craft, env: beta, port: 8016 }
-  - { name: print_forge, env: prod, port: 8007 }
-  - { name: print_forge, env: beta, port: 8019 }
-  - { name: abc_be, env: beta, port: 8017 }
-  - { name: abc_worker, env: beta, port: 8018 }
-  - { name: abc_fe, env: beta, port: 8085 }
-  - { name: livekit, env: beta, port: 7880 }
@@ -1,30 +1,18 @@
 ---
-# Mirrors adama for active/active. Ports MUST match adama/starbuck/apollo so
-# NPM upstreams can balance roslin:PORT with the other app hosts.
+# Mirrors adama for active/active. Ports MUST match adama so NPM upstreams
+# can balance adama:PORT and roslin:PORT for the same workload.
 host_apps:
  - { name: company_site, env: prod, port: 8000 }
  - { name: dta_service, env: prod, port: 8001 }
  - { name: dta_service, env: beta, port: 8011 }
  - { name: dta_webapp, env: prod, port: 8080 }
  - { name: dta_webapp, env: beta, port: 8081 }
-  - { name: dta_blog, env: prod, port: 8086 }
-  - { name: dta_blog, env: beta, port: 8087 }
  - { name: scha, env: prod, port: 8002 }
  # optional: - { name: scha, env: beta, port: 8012 }
  - { name: chat_web_app, env: prod, port: 8082 }
  - { name: chat_web_app, env: beta, port: 8083 }
  - { name: chat_backend, env: prod, port: 8003 }
  - { name: chat_backend, env: beta, port: 8013 }
-  # monica_site / college_craft / print_forge workers NOT here — adama sets compose_profiles: [worker].
+  # monica_site worker NOT here — adama host_apps sets compose_profiles: [worker].
  - { name: monica_site, env: prod, port: 8004 }
  - { name: monica_site, env: beta, port: 8014 }
-  - { name: url_shortening_service, env: prod, port: 8005 }
-  - { name: url_shortening_service, env: beta, port: 8015 }
-  - { name: college_craft, env: prod, port: 8006 }
-  - { name: college_craft, env: beta, port: 8016 }
-  - { name: print_forge, env: prod, port: 8007 }
-  - { name: print_forge, env: beta, port: 8019 }
-  - { name: abc_be, env: beta, port: 8017 }
-  - { name: abc_worker, env: beta, port: 8018 }
-  - { name: abc_fe, env: beta, port: 8085 }
-  - { name: livekit, env: beta, port: 7880 }
@@ -1,30 +0,0 @@
---
-# Mirrors roslin for active/active. Ports MUST match adama/roslin so NPM
-# upstreams can balance starbuck:PORT with the other app hosts.
-host_apps:
-  - { name: company_site, env: prod, port: 8000 }
-  - { name: dta_service, env: prod, port: 8001 }
-  - { name: dta_service, env: beta, port: 8011 }
-  - { name: dta_webapp, env: prod, port: 8080 }
-  - { name: dta_webapp, env: beta, port: 8081 }
-  - { name: dta_blog, env: prod, port: 8086 }
-  - { name: dta_blog, env: beta, port: 8087 }
-  - { name: scha, env: prod, port: 8002 }
-  # optional: - { name: scha, env: beta, port: 8012 }
-  - { name: chat_web_app, env: prod, port: 8082 }
-  - { name: chat_web_app, env: beta, port: 8083 }
-  - { name: chat_backend, env: prod, port: 8003 }
-  - { name: chat_backend, env: beta, port: 8013 }
-  # monica_site / college_craft / print_forge workers NOT here — adama sets compose_profiles: [worker].
-  - { name: monica_site, env: prod, port: 8004 }
-  - { name: monica_site, env: beta, port: 8014 }
-  - { name: url_shortening_service, env: prod, port: 8005 }
-  - { name: url_shortening_service, env: beta, port: 8015 }
-  - { name: college_craft, env: prod, port: 8006 }
-  - { name: college_craft, env: beta, port: 8016 }
-  - { name: print_forge, env: prod, port: 8007 }
-  - { name: print_forge, env: beta, port: 8019 }
-  - { name: abc_be, env: beta, port: 8017 }
-  - { name: abc_worker, env: beta, port: 8018 }
-  - { name: abc_fe, env: beta, port: 8085 }
-  - { name: livekit, env: beta, port: 7880 }
@@ -7,9 +7,5 @@ all:
          ansible_host: 10.0.0.77
        roslin:
          ansible_host: 10.0.0.176
-        starbuck:
-          ansible_host: 10.0.0.44
-        apollo:
-          ansible_host: 10.0.0.7
        ai-server-4080:
          ansible_host: 10.0.0.128
@@ -104,8 +104,8 @@
    - _legacy_systemd_probe.stdout | default('') | length > 0

 # Optional host_apps.compose_profiles (e.g. [worker]) activates compose profiles
-# on this host only. Used for monica_site / college_craft / print_forge dj-queue singleton on
-# adama — without it, plain up --remove-orphans can drop a manually started worker.
+# on this host only. Used for monica_site dj-queue singleton on adama — without
+# it, plain up --remove-orphans can drop a manually started worker.
 - name: "django[{{ _project }}] start containers"
  ansible.builtin.command:
    cmd: "docker compose -f {{ _spec.compose_file }} --env-file .env up -d --remove-orphans"
@@ -28,28 +28,6 @@
    proto: tcp
  loop: "{{ ufw_allowed_tcp_ports }}"

- name: Allow extra TCP ports
-  community.general.ufw:
-    rule: allow
-    port: "{{ item }}"
-    proto: tcp
-  loop: "{{ ufw_extra_tcp_ports | default([]) }}"
-
- name: Allow extra TCP ports from LAN
-  community.general.ufw:
-    rule: allow
-    port: "{{ item }}"
-    proto: tcp
-    from_ip: "{{ ufw_ssh_allowed_network }}"
-  loop: "{{ ufw_lan_tcp_ports | default([]) }}"
-
- name: Allow extra UDP ports or ranges
-  community.general.ufw:
-    rule: allow
-    port: "{{ item }}"
-    proto: udp
-  loop: "{{ ufw_extra_udp_ports | default([]) }}"
-
 - name: Enable UFW
  community.general.ufw:
    state: enabled
@@ -30,17 +30,9 @@ server {
    root {{ (app_catalog[a.name].webroot_pattern | default(web_static_root ~ '/{env}_' ~ a.name)) | replace('{env}', a.env) }};
    index index.html;

-{% if app_catalog[a.name].error_page_404 | default('') %}
-    error_page 404 {{ app_catalog[a.name].error_page_404 }};
-
-    location / {
-        try_files $uri $uri/ =404;
-    }
-{% else %}
    location / {
        try_files $uri $uri/ /index.html;
    }
-{% endif %}

    location ~* \.(?:js|css|woff2?|png|jpg|jpeg|gif|svg|ico)$ {
        expires 7d;
@@ -14,10 +14,10 @@ Usage: $(basename "$0") [HOST] [OPTIONS]

 Deploy applications with deploy-apps.yml.

-  HOST              Optional. Limit to one host: adama, roslin, starbuck, apollo, or ai-server-4080.
+  HOST              Optional. Limit to one host: adama, roslin, or ai-server-4080.

 Options:
-  --app NAME        App to deploy (company_site, dta_service, dta_webapp, dta_blog, scha, chat_web_app, chat_backend, monica_site, url_shortening_service, college_craft, print_forge, abc_be, abc_worker, abc_fe, livekit)
+  --app NAME        App to deploy (company_site, dta_service, dta_webapp, scha, chat_web_app, chat_backend, monica_site)
  --env ENV         Environment: beta or prod
  --ref REF         Git ref/sha to deploy (default: master)
  --check           Dry run
@@ -67,7 +67,7 @@ while [[ $# -gt 0 ]]; do
      EXTRA_VARS+=(-e "$2")
      shift 2
      ;;
-    adama|roslin|starbuck|apollo|ai-server-4080)
+    adama|roslin|ai-server-4080)
      LIMIT="$1"
      shift
      ;;
@@ -18,7 +18,7 @@ On ai-server-4080 also: observability (Loki + Prometheus + Grafana) when
 observability_stack is true, and SearxNG when searxng_stack is true
 (chat_backend grounded search on :8088).

-  HOST              Optional. Limit to one host: adama, roslin, starbuck, apollo, or ai-server-4080.
+  HOST              Optional. Limit to one host: adama, roslin, or ai-server-4080.
                    Omit to run against all webservers.

 Options:
@@ -59,7 +59,7 @@ while [[ $# -gt 0 ]]; do
      EXTRA_ARGS+=(--ask-become-pass)
      shift
      ;;
-    adama|roslin|starbuck|apollo|ai-server-4080)
+    adama|roslin|ai-server-4080)
      LIMIT="$1"
      shift
      ;;
Author	SHA1	Message	Date
westfarn	63cb6ae45f	Merge remote-tracking branch 'origin/master' into issue-17-monica-dj-queue-worker Sync runner checkout / sync (pull_request) Successful in 7s Details	2026-08-09 06:24:07 -05:00
westfarn	853eff020d	Build profile-gated services so workers do not run stale images. The build step omitted COMPOSE_PROFILES, so docker compose skipped the dj-queue worker and up -d reused an image from an earlier deploy; the monica_site beta worker kept psycopg2 and crash-looped on LISTEN/NOTIFY.	2026-08-09 06:23:17 -05:00
westfarn	9a0cbf80d9	Auto-start monica_site dj-queue worker on adama deploy. Sync runner checkout / sync (pull_request) Successful in 6s Details Campaign sends stay Queued without the worker; wire compose_profiles into django deploy so adama brings up the singleton with web (closes #17).	2026-08-08 13:59:27 -05:00