westfarn
f1f96e49b1
Sync runner checkout / sync (pull_request) Successful in 6s
Add roles/searxng (compose + JSON-enabled settings), gate with searxng_stack on ai-server-4080, open UFW 8088/tcp from the LAN. Port 8088 avoids the dta_webapp :8080 clash; chat_backend must use SEARXNG_BASE_URL=http://10.0.0.128:8088.
125 lines
2.8 KiB
Bash
Executable File
125 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
LIMIT=""
|
|
EXTRA_ARGS=()
|
|
|
|
usage() {
|
|
cat <<EOF
|
|
Usage: $(basename "$0") [HOST] [OPTIONS]
|
|
|
|
Provision server(s) with site.yml.
|
|
|
|
Applies: common, ufw, docker, nodejs, gitea-key, tianji, alloy (every host).
|
|
On ai-server-4080 also: observability (Loki + Prometheus + Grafana) when
|
|
observability_stack is true, and SearxNG when searxng_stack is true
|
|
(chat_backend grounded search on :8088).
|
|
|
|
HOST Optional. Limit to one host: adama, roslin, or ai-server-4080.
|
|
Omit to run against all webservers.
|
|
|
|
Options:
|
|
--check Dry run (ansible --check)
|
|
--diff Show diffs
|
|
--ask-pass Prompt for SSH password (bootstrap before ssh-copy-id)
|
|
--ask-become-pass Prompt for sudo password
|
|
-h, --help Show this help
|
|
|
|
Examples:
|
|
$(basename "$0") adama --check # dry run on adama only
|
|
$(basename "$0") adama # provision adama (includes Alloy)
|
|
$(basename "$0") adama --ask-pass # first SSH login before ssh-copy-id
|
|
$(basename "$0") ai-server-4080 # control node + Loki/Prometheus/Grafana + SearxNG
|
|
$(basename "$0") # provision all hosts
|
|
EOF
|
|
}
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
-h|--help)
|
|
usage
|
|
exit 0
|
|
;;
|
|
--check)
|
|
EXTRA_ARGS+=(--check)
|
|
shift
|
|
;;
|
|
--diff)
|
|
EXTRA_ARGS+=(--diff)
|
|
shift
|
|
;;
|
|
--ask-pass)
|
|
EXTRA_ARGS+=(--ask-pass)
|
|
shift
|
|
;;
|
|
--ask-become-pass)
|
|
EXTRA_ARGS+=(--ask-become-pass)
|
|
shift
|
|
;;
|
|
adama|roslin|ai-server-4080)
|
|
LIMIT="$1"
|
|
shift
|
|
;;
|
|
*)
|
|
echo "Unknown argument: $1" >&2
|
|
usage >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
done
|
|
|
|
ensure_ssh_key() {
|
|
local key="${HOME}/.ssh/id_ed25519"
|
|
|
|
if [[ -f "$key" ]]; then
|
|
echo "==> SSH key already exists: $key"
|
|
return 0
|
|
fi
|
|
|
|
echo "==> Generating SSH key: $key"
|
|
ssh-keygen -t ed25519 -N "" -f "$key" -C "$(whoami)@$(hostname)"
|
|
}
|
|
|
|
ensure_gitea_ssh_config() {
|
|
local ssh_dir="${HOME}/.ssh"
|
|
local config="${ssh_dir}/config"
|
|
|
|
mkdir -p "$ssh_dir"
|
|
chmod 700 "$ssh_dir"
|
|
|
|
if [[ -f "$config" ]] && grep -qE '^Host[[:space:]]+git\.aimloperations\.com$' "$config"; then
|
|
echo "==> SSH config already has git.aimloperations.com"
|
|
return 0
|
|
fi
|
|
|
|
if [[ -f "$config" && -s "$config" ]]; then
|
|
printf '\n' >>"$config"
|
|
fi
|
|
|
|
cat >>"$config" <<'EOF'
|
|
Host git.aimloperations.com
|
|
User git
|
|
Port 30009
|
|
AddressFamily inet
|
|
EOF
|
|
|
|
chmod 600 "$config"
|
|
echo "==> Added git.aimloperations.com to ${config}"
|
|
}
|
|
|
|
ensure_ssh_key
|
|
ensure_gitea_ssh_config
|
|
|
|
CMD=(ansible-playbook playbooks/site.yml "${EXTRA_ARGS[@]}")
|
|
if [[ -n "$LIMIT" ]]; then
|
|
CMD+=(--limit "$LIMIT")
|
|
echo "==> Targeting host: $LIMIT"
|
|
else
|
|
echo "==> Targeting all webservers"
|
|
fi
|
|
|
|
exec "${CMD[@]}"
|