westfarn
7e48c22e3e
Sync runner checkout / sync (push) Successful in 7s
## Summary - Closes [#10](#10). - Deploys **SearxNG** on **ai-server-4080** (`10.0.0.128`) for [chat_backend#62](ai_ml_operations/chat_backend#62) / [PR #65](ai_ml_operations/chat_backend#65) grounded search. - New `roles/searxng/` (compose + JSON-enabled `settings.yml`), gated by `searxng_stack: true`, wired into `site.yml`. - **Host port 8088** (not 8080 — that is `dta_webapp` on this host). UFW allows `10.0.0.0/24` → `8088/tcp` only. ## Ops after merge ```bash ./scripts/provision.sh ai-server-4080 # or targeted: ansible-playbook playbooks/site.yml --limit ai-server-4080 --tags never # full site play includes searxng when searxng_stack ``` Then set in `chat_backend_prod.env` / `chat_backend_beta.env`: ```text SEARCH_PROVIDER=searxng SEARCH_FAILOVER_PROVIDER=ddgs SEARXNG_BASE_URL=http://10.0.0.128:8088 ``` Smoke test from any app host: ```bash curl -sG 'http://10.0.0.128:8088/search' --data-urlencode 'q=test' -d 'format=json' | head ``` ## Test plan - [ ] Provision ai-server-4080; confirm `docker ps` shows `searxng` - [ ] Confirm `:8088` responds with JSON; `:8080` still serves dta_webapp - [ ] Confirm UFW rule is LAN-only - [ ] From adama/roslin container network, curl SearxNG succeeds - [ ] Update chat_backend secrets to `:8088` and redeploy betaReviewed-on: #11
36 lines
1.5 KiB
YAML
36 lines
1.5 KiB
YAML
---
|
|
# ai-server-4080 — control node + Gitea act runner. Update IP with:
|
|
# ip -4 addr show scope global
|
|
ansible_host: 10.0.0.128
|
|
|
|
ansible_control_node: true
|
|
# Deploy/ansible runs on this host; avoid self-SSH (breaks after long tasks / CI keys).
|
|
ansible_connection: local
|
|
act_runner_enabled: true
|
|
|
|
# Central Loki + Prometheus + Grafana (roles/observability).
|
|
observability_stack: true
|
|
|
|
# SearxNG JSON search API for chat_backend grounded retrieval (#10).
|
|
# Host port 8088 — 8080 is dta_webapp on this host. chat_backend secret:
|
|
# SEARXNG_BASE_URL=http://10.0.0.128:8088
|
|
searxng_stack: true
|
|
|
|
# This host's pre-existing ~/.ssh/id_ed25519 is a personal key WITH a passphrase,
|
|
# which hangs the (non-BatchMode) gitea access probe. Use a dedicated,
|
|
# passphrase-less deploy key here instead.
|
|
gitea_key_path: "/home/{{ admin_user }}/.ssh/gitea_deploy"
|
|
|
|
# company_site + dta_webapp + dta_service for side testing and active/active.
|
|
# Ports MUST match adama/roslin so NPM can balance all three upstreams.
|
|
host_apps:
|
|
- { name: company_site, env: prod, port: 8000 }
|
|
- { name: dta_webapp, env: prod, port: 8080 }
|
|
- { name: dta_webapp, env: beta, port: 8081 }
|
|
- { name: dta_service, env: prod, port: 8001 }
|
|
- { name: dta_service, env: beta, port: 8011 }
|
|
- { name: scha, env: prod, port: 8002 }
|
|
- { name: chat_web_app, env: prod, port: 8082 }
|
|
- { name: chat_web_app, env: beta, port: 8083 }
|
|
- { name: chat_backend, env: prod, port: 8003 }
|
|
- { name: chat_backend, env: beta, port: 8013 } |