mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 4.8
094c02a69d
Every Ansible rescue: block used to carry ad-hoc per-role failure dumps that drifted apart and captured different subsets. Replace them all with one diagnostics script (scripts/system/diagnostics/rescue.sh) that snapshots containers (full logs plus inspect per container), swarm services (ps plus logs per service), journal, host resources, runtime info and stats into a per-run folder and always exits 1 so the deploy still fails. A new lint enforces the shape: every rescue ends with the script, at most one nocheck-justified extra task before it (postgres pg_hba dump, xwiki extension-repo probe), and a nocheck rescue-recovery exemption for the one block that must genuinely recover: keycloak object updates, where a cross-node reschedule needs a swarm-wide node re-resolve plus a delegate_to change that only a rescue can express; its recovery is kept and now also captures diagnostics before the terminal failure. The snapshot folder path is a group_vars SPOT: DIR_RESCUE_DIAGNOSTICS and DIR_VAR_LIB live in group_vars/all/05_paths.yml as plain strings; new env handlers derive INFINITO_RESCUE_DIAGNOSTICS_DIR and INFINITO_DIR_VAR_LIB from it for the generated .env, replacing the default.env entries, and the play-level environment forwards the value to every task host so rescue.sh needs no second default. CI uploads the folder like the inventory and playwright artifacts: compose copies it out of the deploy container in dedicated.sh, swarm captures per node (manager and both workers) into node-named subfolders. Deleting the ad-hoc dumps orphaned helper files (postgres inspect_container, terminator docker_diagnostics, peertube diagnostics, matomo bootstrap debug, xwiki and openresty rescue includes) and 14 role vars; all removed. Generic pieces of those dumps (runtime version and info, stats, dmesg oom evidence, swapon) moved into the SPOT script instead. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
273 lines
12 KiB
Bash
273 lines
12 KiB
Bash
# Single source of truth for the project's static defaults.
|
|
#
|
|
# Every key here is copied verbatim into the generated `.env` by
|
|
# `make dotenv` (which delegates to `python -m cli.meta.env`), together
|
|
# with the dynamic runtime-resolved values (distro, GHA flags,
|
|
# df/meminfo-derived sizes, sha256 secrets, repository owner, ...).
|
|
#
|
|
# Override at generation time by exporting the variable before running
|
|
# `make dotenv` -- already-set env vars take precedence over the
|
|
# defaults below.
|
|
#
|
|
# Convention: every key is preceded by a single-line `# ...` comment
|
|
# that explains what the value is for. The generator preserves the
|
|
# comments when materialising `.env`.
|
|
|
|
# Markdown file (repo-relative or absolute) holding the agent conversation shortcuts; developers override this with their own table.
|
|
INFINITO_ALIAS_MD=docs/contributing/tools/agents/alias.md
|
|
|
|
# Git repository holding the operator's terminal aliases (an `aliases` file at repo root); developers override this with their own repo.
|
|
INFINITO_ALIAS_REPOSITORY=https://github.com/kevinveenbirkenbach/alias
|
|
|
|
# Where scripts/meta/resolve/apps.sh runs the meta-CLI: host | docker.
|
|
INFINITO_APP_DISCOVERY_RUNNER=docker
|
|
|
|
# Per-app variant index map for credential generation, set per round by the swarm matrix orchestrator; empty elsewhere.
|
|
INFINITO_APP_VARIANTS=
|
|
|
|
# Host interface(s) the compose stack binds published ports to.
|
|
INFINITO_BIND_IP=127.0.0.1
|
|
|
|
# `1` builds the local image; `0` skips the build and pulls the published image (CI overrides via -e INFINITO_BUILD=0).
|
|
INFINITO_BUILD=1
|
|
|
|
# `1` keeps BuildKit on (default); `0` forces the compose wrapper to use the legacy builder.
|
|
INFINITO_BUILDKIT_ENABLED=1
|
|
|
|
# Bind-mounted apt sources.list fragment for the package-cache frontend.
|
|
INFINITO_CACHE_PACKAGE_APT_LIST=./compose/package-cache/apt.list
|
|
|
|
# Host directory holding the package-cache frontend CA materials.
|
|
INFINITO_CACHE_PACKAGE_FRONTEND_CA_DIR=/var/cache/infinito/core/cache/package/frontend/ca
|
|
|
|
# CA certificate file produced under INFINITO_CACHE_PACKAGE_FRONTEND_CA_DIR.
|
|
INFINITO_CACHE_PACKAGE_FRONTEND_CA_FILE=/var/cache/infinito/core/cache/package/frontend/ca/ca.crt
|
|
|
|
# Host directory holding the package-cache frontend TLS certificates.
|
|
INFINITO_CACHE_PACKAGE_FRONTEND_CERTS_DIR=/var/cache/infinito/core/cache/package/frontend/certs
|
|
|
|
# Init image used by the package-cache frontend cert-gen wrapper to run cert-gen.sh.
|
|
INFINITO_CACHE_PACKAGE_FRONTEND_INIT_IMAGE=alpine:latest
|
|
|
|
# Static IPv4 address the package-cache frontend takes on the docker bridge.
|
|
INFINITO_CACHE_PACKAGE_FRONTEND_IP=172.30.0.4
|
|
|
|
# Host directory backing the Nexus 3 package-cache blobstore.
|
|
INFINITO_CACHE_PACKAGE_HOST_PATH=/var/cache/infinito/core/cache/package/data
|
|
|
|
# Cache freshness window (minutes) Nexus tolerates before re-validating upstream. 8640 = 6 days (below the 7-day Debian Valid-Until).
|
|
INFINITO_CACHE_PACKAGE_MAX_AGE_MIN=8640
|
|
|
|
# Bind-mounted .npmrc fragment for the package-cache frontend.
|
|
INFINITO_CACHE_PACKAGE_NPMRC=./compose/package-cache/npmrc
|
|
|
|
# Bind-mounted pip.conf fragment for the package-cache frontend.
|
|
INFINITO_CACHE_PACKAGE_PIP_CONF=./compose/package-cache/pip.conf
|
|
|
|
# Host port the Nexus 3 package cache binds to on BIND_IP.
|
|
INFINITO_CACHE_PACKAGE_PORT=8081
|
|
|
|
# Host directory holding the registry-cache CA materials.
|
|
INFINITO_CACHE_REGISTRY_CA_HOST_PATH=/var/cache/infinito/core/cache/registry/ca
|
|
|
|
# Host directory backing the docker registry-mirror cache (bind mount).
|
|
INFINITO_CACHE_REGISTRY_HOST_PATH=/var/cache/infinito/core/cache/registry/mirror
|
|
|
|
# Static IPv4 of the registry-cache; resolved via extra_hosts since coredns can't resolve the container name.
|
|
INFINITO_CACHE_REGISTRY_IP=172.30.0.6
|
|
|
|
# Bind-mounted registry-cache proxy configuration consumed by the cache container.
|
|
INFINITO_CACHE_REGISTRY_PROXY_CONF=./compose/registry-cache/proxy.conf
|
|
|
|
# Compose service container name; generator overrides as infinito_nexus_${INFINITO_DISTRO}.
|
|
INFINITO_CONTAINER=infinito_nexus_debian
|
|
|
|
# `1` (default) keeps CA injection on in the container wrapper; `0` skips it.
|
|
INFINITO_CONTAINER_CA_ENABLED=1
|
|
|
|
# cpus cap applied to the infinito container; 0 means "unlimited".
|
|
INFINITO_CPUS=0
|
|
|
|
# Truthy enables debug behavior in the local deploy flows.
|
|
INFINITO_DEBUG=true
|
|
|
|
# Deploy mode the discovery matrix targets (compose|swarm) for per-mode services.yml skip; empty disables it.
|
|
INFINITO_DEPLOY_MODE=
|
|
|
|
# Sort spec the CI app-discovery (scripts/meta/resolve/apps.sh) orders roles by before the --max-jobs budget cut.
|
|
INFINITO_DISCOVERY_SORT="asc covered_by,desc embeds,desc consumers,asc variant,asc random"
|
|
|
|
# Distro the build/test matrix is currently iterating over (generator may override).
|
|
INFINITO_DISTRO=debian
|
|
|
|
# Space-separated list of distros the build/test matrix iterates over.
|
|
INFINITO_DISTROS="arch debian ubuntu fedora centos"
|
|
|
|
# Domain the host-side DNS-fallback / dnsmasq config wires up (consumed by scripts/system/network/dns/).
|
|
INFINITO_DNS_DOMAIN=infinito.example
|
|
|
|
# Path to the hosts file the DNS-fallback installer writes the BEGIN/END block into.
|
|
INFINITO_DNS_HOSTS_FILE=/etc/hosts
|
|
|
|
# IPv4 of the CoreDNS sidecar inside INFINITO_SUBNET; CI/dev default, overridden in real deploys.
|
|
INFINITO_DNS_IP=172.30.0.53
|
|
|
|
# Repo-relative path of the docker CLI install script.
|
|
INFINITO_DOCKER_CLI_INSTALL_SCRIPT=roles/sys-svc-container/files/install-cli.sh
|
|
|
|
# Mount point inside the infinito container where INFINITO_DOCKER_VOLUME lands.
|
|
INFINITO_DOCKER_MOUNT=/var/lib/docker
|
|
|
|
# Docker volume backing /var/lib/docker; generator overrides to /mnt/docker on GHA.
|
|
INFINITO_DOCKER_VOLUME=docker
|
|
|
|
# Top-level project domain rendered into vhost/cert/test fixtures; CI/dev default, overridden in real deploys.
|
|
INFINITO_DOMAIN=infinito.example
|
|
|
|
# INFINITO_DOMAIN escaped for inclusion in regex patterns (literal `.`); keep in sync with INFINITO_DOMAIN.
|
|
INFINITO_DOMAIN_RE=infinito\.example
|
|
|
|
# IPv4 of the bridge gateway inside INFINITO_SUBNET.
|
|
INFINITO_GATEWAY=172.30.0.1
|
|
|
|
# Prefix path under which GHCR mirror lookups search for cached images.
|
|
INFINITO_GHCR_MIRROR_PREFIX=mirror
|
|
|
|
# Image tag used to address the published infinito image (CI publishes 'latest' on push).
|
|
INFINITO_IMAGE_TAG=latest
|
|
|
|
# Repo-relative path to the Ansible vars file `infinito administration inventory provision --vars-file <...>` consumes.
|
|
INFINITO_INVENTORY_VARS_FILE=inventories/development/default.yml
|
|
|
|
# IPv4 of the infinito application container inside INFINITO_SUBNET; CI/dev default, overridden in real deploys.
|
|
INFINITO_IP4=172.30.0.10
|
|
|
|
# IPv6 loopback / public address the playbook's `internet` network defaults to when no host_var pin is set.
|
|
INFINITO_IP6=::1
|
|
|
|
# True when /proc/version identifies the host as WSL2; generator overrides via runtime detection.
|
|
INFINITO_IS_WSL2=false
|
|
|
|
# Keep act-swarm test cluster alive after the workflow for post-mortem inspection.
|
|
INFINITO_KEEP_SWARM_NODES=false
|
|
|
|
# Lifecycle envelope the CI test-deploy discovery exercises (scripts/meta/resolve/apps.sh --lifecycles); comma/space-separated.
|
|
INFINITO_LIFECYCLES="alpha beta rc stable"
|
|
|
|
# Ansible limit pattern for local deploys.
|
|
INFINITO_LIMIT_HOST=localhost
|
|
|
|
# Where scripts/lint/wrapper.sh executes 'make lint*' / 'make autoformat': host | docker.
|
|
INFINITO_LINT_RUNNER=docker
|
|
|
|
# Cumulative CI job budget the app-discovery hard-caps at (scripts/meta/resolve/apps.sh --max-jobs).
|
|
INFINITO_MAX_JOBS=100
|
|
|
|
# memswap_limit cap applied to the infinito container; 0 means "unlimited".
|
|
INFINITO_MEMSWAP_LIMIT=0
|
|
|
|
# mem_limit cap applied to the infinito container; 0 means "unlimited".
|
|
INFINITO_MEM_LIMIT=0
|
|
|
|
# Repo checkout path on act-swarm DinD test nodes.
|
|
INFINITO_NODE_SRC_DIR=/opt/infinito-nexus
|
|
|
|
# MTU of the compose stack's bridge network; 1500 matches most hosts.
|
|
INFINITO_OUTER_NETWORK_MTU=1500
|
|
|
|
# Repo-relative path of the package build/install script.
|
|
INFINITO_PACKAGE_INSTALL_SCRIPT=scripts/install/package.sh
|
|
|
|
# GHCR owner of the pkgmgr base image. Composed into INFINITO_PARENT_IMAGE by utils/env/handlers/infinito_parent_image.py.
|
|
INFINITO_PARENT_IMAGE_OWNER=kevinveenbirkenbach
|
|
|
|
# Tag of the pkgmgr base image. Composed into INFINITO_PARENT_IMAGE by utils/env/handlers/infinito_parent_image.py.
|
|
INFINITO_PARENT_IMAGE_TAG=stable
|
|
|
|
# Variant of the pkgmgr base image. Currently only `full` is supported.
|
|
INFINITO_PARENT_IMAGE_VARIANT=full
|
|
|
|
# `true` keeps Playwright trace, screenshot, and video for every test; default `false` retains them only on failure.
|
|
INFINITO_PLAYWRIGHT_KEEP=false
|
|
|
|
# When `true`, the CI down-handler skips wiping the Docker volume so layer cache survives across jobs.
|
|
INFINITO_PRESERVE_DOCKER_CACHE=false
|
|
|
|
# When `false`, the dev-stack container publishes no host ports (nested runner deploys share the outer daemon via DooD).
|
|
INFINITO_PUBLISH_PORTS=true
|
|
|
|
# Docker pull policy compose applies; generator overrides to `always` on GHA.
|
|
INFINITO_PULL_POLICY=never
|
|
|
|
# Repo-relative path of the system python install script.
|
|
INFINITO_PYTHON_INSTALL_SCRIPT=roles/dev-python/files/install.sh
|
|
|
|
# Absolute path of the repository root on the runner host; passed through to nested Ansible invocations.
|
|
INFINITO_REPO_ROOT=
|
|
|
|
# Per-runner CI storage budget; roles needing more are dropped from the matrix (scripts/meta/resolve/apps.sh).
|
|
INFINITO_REQUIRED_STORAGE=60GB
|
|
|
|
# Prefix applied to per-runner Docker Compose project names and container labels; empty in non-runner contexts.
|
|
INFINITO_RUNNER_PREFIX=infinito
|
|
|
|
# True when running under nektos/act locally; generator overrides via runtime detection.
|
|
INFINITO_RUNNING_ON_ACT=false
|
|
|
|
# True when running on real GitHub Actions; generator overrides via runtime detection.
|
|
INFINITO_RUNNING_ON_GITHUB=false
|
|
|
|
# Extra flags forwarded verbatim to 'docker run' by 'make run'.
|
|
INFINITO_RUN_FLAGS=
|
|
|
|
# Git repository holding the agent skills (skills-lock.json + make project target); developers override this with their own repo.
|
|
INFINITO_SKILLS_REPOSITORY=https://github.com/kevinveenbirkenbach/skills
|
|
|
|
# Absolute path to the bind-mounted repo root inside the dev container.
|
|
INFINITO_SRC_DIR=/opt/src/infinito
|
|
|
|
# CIDR of the internal docker bridge used by the compose stack.
|
|
INFINITO_SUBNET=172.30.0.0/24
|
|
|
|
# Lab bridge-network base name linking the act-swarm-test containers.
|
|
INFINITO_SWARM_LAB_NET_NAME=swarm-lab
|
|
|
|
# Manager-node base name in the act-swarm-test cluster (prefixed with the cluster id at runtime).
|
|
INFINITO_SWARM_MGR_NAME=swarm-mgr-01
|
|
|
|
# NFS-server sidecar base name in the act-swarm-test cluster.
|
|
INFINITO_SWARM_NFS_NAME=nfs-server
|
|
|
|
# Docker label stamped on every act-swarm-test container (DinD + NFS sidecar) so cleanup selects by label, not a guessed name.
|
|
INFINITO_SWARM_TEST_LABEL=infinito.swarm-test
|
|
|
|
# Worker-node-1 base name in the act-swarm-test cluster.
|
|
INFINITO_SWARM_WRK1_NAME=swarm-wrk-01
|
|
|
|
# Worker-node-2 base name in the act-swarm-test cluster.
|
|
INFINITO_SWARM_WRK2_NAME=swarm-wrk-02
|
|
|
|
# Glob `unittest discover -p` applies when running the test suites.
|
|
INFINITO_TEST_PATTERN=test*.py
|
|
|
|
# Where scripts/tests/code/wrapper.sh executes the test run: docker | host.
|
|
INFINITO_TEST_RUNNER=docker
|
|
|
|
# Integer multiplier applied to Ansible retry/delay values on slow self-hosted hardware; 1 = no scaling.
|
|
INFINITO_TIMEOUT_MULTIPLIER=1
|
|
|
|
# Variant overlay (applications.<app> services/credentials) baked per round by the swarm matrix orchestrator; empty elsewhere.
|
|
INFINITO_VARS_PAYLOAD=
|
|
|
|
# Absolute path of the project virtualenv inside the dev container (and on the host when /opt is writable).
|
|
INFINITO_VENV_DIR=/opt/venvs/infinito
|
|
|
|
# Seconds 'make up' waits for the infinito container healthcheck before failing.
|
|
INFINITO_WAIT_HEALTH_TIMEOUT_S=600
|
|
|
|
# Optional app-discovery filter consumed by scripts/meta/resolve/apps.sh and the GHA workflow.
|
|
INFINITO_WHITELIST=
|
|
|
|
# Master toggle for the worker SPOT chain (INFINITO_WORKER_CPU / _FETCH); falsy values: 0/false/no/off.
|
|
INFINITO_WORKER_ENABLED=true
|