westfarn
1988def1a6
Sync runner checkout / sync (push) Successful in 7s
## Summary - Closes [#29](#29). - Register `dta_blog` in `app_catalog` (`type: node-static`, repo `Ditch_The_Agent/dta_blog`, default branch `main`, webroot `/var/www/{env}.blog.realpath.app/html`). Reuses `roles/app-deploy/tasks/node_static.yml` (`npm ci` then `npm run build:<env>`); the blog's `package.json` copies `dist/` to that webroot after `python3 build.py --env <env>`. - Add prod **8086** / beta **8087** `host_apps` on adama, roslin, starbuck, apollo, and ai-server-4080 (those ports were free vs 8080–8085 / 8088). - Optional nginx `error_page 404 /404.html` for this app only (`error_page_404` catalog field); other static apps keep the SPA `try_files` fallback. - Document NPM/DNS (`blog.realpath.app` → `:8086`, `beta.blog.realpath.app` → `:8087`), no `realpath.app/blog` mount, and UFW staying LAN/NPM-only. ## Test plan - [ ] Confirm 8086/8087 unused on app hosts before first deploy. - [ ] `./scripts/deploy.sh --app dta_blog --env beta --ref main` publishes `/var/www/beta.blog.realpath.app/html`. - [ ] `./scripts/deploy.sh --app dta_blog --env prod --ref main` publishes `/var/www/prod.blog.realpath.app/html`. - [ ] **Until [dta_blog#1](Ditch_The_Agent/dta_blog#1) is on `main`**, use `--ref issue-1-static-blog` so the SSG (not the stub README) is built. - [ ] NPM + DNS + TLS: `blog.realpath.app` → `:8086`, `beta.blog.realpath.app` → `:8087`. Do not reverse-proxy onto `realpath.app/blog`. - [ ] Prod HTML has article text, Tianji id `cmtvvmf562afjzqumwt1yh2y8`, links to `https://realpath.app/`. - [ ] Beta HTML has Tianji id `cmtvvn6z62agdzqumtk8xijpy`, links to `https://beta.realpath.app/`, demo posts present. - [ ] `https://blog.realpath.app/sitemap.xml`, `robots.txt`, `llms.txt` return 200. - [ ] Unknown slug returns 404.html (not the index SPA fallback). Reviewed-on: #30
server-infra
Ansible provisioning and deployment for homelab web servers.
Quick Start
# Install collections (once)
ansible-galaxy collection install -r requirements.yml
# Bootstrap SSH key to each host (one-time, before Ansible)
ssh-copy-id westfarn@10.0.0.77
ssh-copy-id westfarn@10.0.0.176
ssh-copy-id westfarn@10.0.0.44
ssh-copy-id westfarn@10.0.0.7
# First-time only: passwordless sudo on each new host (before first provision)
ssh -t westfarn@10.0.0.176 # repeat for each host IP
# on the host:
echo 'westfarn ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/westfarn
sudo chmod 440 /etc/sudoers.d/westfarn
exit
# Test connectivity to one host
ansible adama -m ping
# Provision one host (dry run first) — includes Alloy log/metrics agent
./scripts/provision.sh adama --check
./scripts/provision.sh adama
# Control node: Alloy + Loki + Prometheus + Grafana
./scripts/provision.sh ai-server-4080
# Provision all hosts
./scripts/provision.sh
See IMPLEMENTATION.md for full architecture, CI/CD plan, and phase breakdown.
Observability (Alloy → Loki / Prometheus → Grafana): docs/OBSERVABILITY.md · docs/GRAFANA_USAGE.md
Provision installs Alloy on every host. On ai-server-4080 it also starts
the central Loki / Prometheus / Grafana stack (observability_stack: true).
Servers
| Host | IP | Role |
|---|---|---|
| adama | 10.0.0.77 | app host |
| roslin | 10.0.0.176 | app host |
| starbuck | 10.0.0.44 | app host |
| apollo | 10.0.0.7 | app host |
| ai-server-4080 | 10.0.0.128 | control node + act runner |