westfarn
7e48c22e3e
Sync runner checkout / sync (push) Successful in 7s
## Summary - Closes [#10](#10). - Deploys **SearxNG** on **ai-server-4080** (`10.0.0.128`) for [chat_backend#62](ai_ml_operations/chat_backend#62) / [PR #65](ai_ml_operations/chat_backend#65) grounded search. - New `roles/searxng/` (compose + JSON-enabled `settings.yml`), gated by `searxng_stack: true`, wired into `site.yml`. - **Host port 8088** (not 8080 — that is `dta_webapp` on this host). UFW allows `10.0.0.0/24` → `8088/tcp` only. ## Ops after merge ```bash ./scripts/provision.sh ai-server-4080 # or targeted: ansible-playbook playbooks/site.yml --limit ai-server-4080 --tags never # full site play includes searxng when searxng_stack ``` Then set in `chat_backend_prod.env` / `chat_backend_beta.env`: ```text SEARCH_PROVIDER=searxng SEARCH_FAILOVER_PROVIDER=ddgs SEARXNG_BASE_URL=http://10.0.0.128:8088 ``` Smoke test from any app host: ```bash curl -sG 'http://10.0.0.128:8088/search' --data-urlencode 'q=test' -d 'format=json' | head ``` ## Test plan - [ ] Provision ai-server-4080; confirm `docker ps` shows `searxng` - [ ] Confirm `:8088` responds with JSON; `:8080` still serves dta_webapp - [ ] Confirm UFW rule is LAN-only - [ ] From adama/roslin container network, curl SearxNG succeeds - [ ] Update chat_backend secrets to `:8088` and redeploy betaReviewed-on: #11
125 lines
2.8 KiB
Bash
Executable File
125 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
LIMIT=""
|
|
EXTRA_ARGS=()
|
|
|
|
usage() {
|
|
cat <<EOF
|
|
Usage: $(basename "$0") [HOST] [OPTIONS]
|
|
|
|
Provision server(s) with site.yml.
|
|
|
|
Applies: common, ufw, docker, nodejs, gitea-key, tianji, alloy (every host).
|
|
On ai-server-4080 also: observability (Loki + Prometheus + Grafana) when
|
|
observability_stack is true, and SearxNG when searxng_stack is true
|
|
(chat_backend grounded search on :8088).
|
|
|
|
HOST Optional. Limit to one host: adama, roslin, or ai-server-4080.
|
|
Omit to run against all webservers.
|
|
|
|
Options:
|
|
--check Dry run (ansible --check)
|
|
--diff Show diffs
|
|
--ask-pass Prompt for SSH password (bootstrap before ssh-copy-id)
|
|
--ask-become-pass Prompt for sudo password
|
|
-h, --help Show this help
|
|
|
|
Examples:
|
|
$(basename "$0") adama --check # dry run on adama only
|
|
$(basename "$0") adama # provision adama (includes Alloy)
|
|
$(basename "$0") adama --ask-pass # first SSH login before ssh-copy-id
|
|
$(basename "$0") ai-server-4080 # control node + Loki/Prometheus/Grafana + SearxNG
|
|
$(basename "$0") # provision all hosts
|
|
EOF
|
|
}
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
-h|--help)
|
|
usage
|
|
exit 0
|
|
;;
|
|
--check)
|
|
EXTRA_ARGS+=(--check)
|
|
shift
|
|
;;
|
|
--diff)
|
|
EXTRA_ARGS+=(--diff)
|
|
shift
|
|
;;
|
|
--ask-pass)
|
|
EXTRA_ARGS+=(--ask-pass)
|
|
shift
|
|
;;
|
|
--ask-become-pass)
|
|
EXTRA_ARGS+=(--ask-become-pass)
|
|
shift
|
|
;;
|
|
adama|roslin|ai-server-4080)
|
|
LIMIT="$1"
|
|
shift
|
|
;;
|
|
*)
|
|
echo "Unknown argument: $1" >&2
|
|
usage >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
done
|
|
|
|
ensure_ssh_key() {
|
|
local key="${HOME}/.ssh/id_ed25519"
|
|
|
|
if [[ -f "$key" ]]; then
|
|
echo "==> SSH key already exists: $key"
|
|
return 0
|
|
fi
|
|
|
|
echo "==> Generating SSH key: $key"
|
|
ssh-keygen -t ed25519 -N "" -f "$key" -C "$(whoami)@$(hostname)"
|
|
}
|
|
|
|
ensure_gitea_ssh_config() {
|
|
local ssh_dir="${HOME}/.ssh"
|
|
local config="${ssh_dir}/config"
|
|
|
|
mkdir -p "$ssh_dir"
|
|
chmod 700 "$ssh_dir"
|
|
|
|
if [[ -f "$config" ]] && grep -qE '^Host[[:space:]]+git\.aimloperations\.com$' "$config"; then
|
|
echo "==> SSH config already has git.aimloperations.com"
|
|
return 0
|
|
fi
|
|
|
|
if [[ -f "$config" && -s "$config" ]]; then
|
|
printf '\n' >>"$config"
|
|
fi
|
|
|
|
cat >>"$config" <<'EOF'
|
|
Host git.aimloperations.com
|
|
User git
|
|
Port 30009
|
|
AddressFamily inet
|
|
EOF
|
|
|
|
chmod 600 "$config"
|
|
echo "==> Added git.aimloperations.com to ${config}"
|
|
}
|
|
|
|
ensure_ssh_key
|
|
ensure_gitea_ssh_config
|
|
|
|
CMD=(ansible-playbook playbooks/site.yml "${EXTRA_ARGS[@]}")
|
|
if [[ -n "$LIMIT" ]]; then
|
|
CMD+=(--limit "$LIMIT")
|
|
echo "==> Targeting host: $LIMIT"
|
|
else
|
|
echo "==> Targeting all webservers"
|
|
fi
|
|
|
|
exec "${CMD[@]}"
|