mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-12-02 07:38:22 +00:00
Kevin Veen-Birkenbach
e09f561f0b
- Replace legacy utils/run_once.yml with the new helpers utils/once_flag.yml and utils/once_finalize.yml - Introduce utils/compose_up.yml to ensure docker-compose stacks are up and to flush handlers safely without coupling to run-once flags - Migrate all affected roles (desk-*, dev-*, sys-ctl-*, sys-svc-*, web-app-*, web-svc-*, util-*) to the new run-once helpers - Rework sys-svc-msmtp to auto-load Mailu once per deploy, check reachability, and reuse the running stack instead of requiring multiple playbook passes - Adjust web-app-mailu to integrate cert deployment, handler flushing, and run-once handling so Mailu is fully initialized in a single deploy - Improve Matomo, CDN, logout and CSP/health-check related roles to cooperate with the new compose_up / once_* pattern - Simplify alarm/backup/timer/service orchestration (sys-ctl-alm-*, sys-bkp-provider, sys-timer-cln-bkps, etc.) by moving run-once logic into dedicated 01_core.yml files - Update integration tests so utils/once_flag.yml and utils/once_finalize.yml are recognised as valid run-once providers, keeping the global run_once_* guarantees consistent - Align frontend injection and service dependencies so Mastodon- and Mailu-related services can be brought up coherently within a single deployment cycle rather than several iterations
39 lines
1.2 KiB
YAML
39 lines
1.2 KiB
YAML
---
|
||
- name: "Validate CLOUDFLARE_API_TOKEN"
|
||
fail:
|
||
msg: >
|
||
The variable "CLOUDFLARE_API_TOKEN" must be defined and cannot be empty!
|
||
when: (CLOUDFLARE_API_TOKEN | default('') | trim) == ''
|
||
|
||
- name: "Apply apex A/AAAA for base domains"
|
||
include_tasks: 02_apex.yml
|
||
loop: "{{ SYS_SVC_DNS_BASE_DOMAINS | list }}"
|
||
loop_control:
|
||
loop_var: base_domain
|
||
label: "{{ base_domain }}"
|
||
|
||
- name: "Ensure all CAA records are present"
|
||
community.general.cloudflare_dns:
|
||
api_token: "{{ CLOUDFLARE_API_TOKEN }}"
|
||
zone: "{{ item.0 }}"
|
||
record: "@"
|
||
type: CAA
|
||
flag: 0
|
||
tag: "{{ item.1.tag }}"
|
||
value: "{{ item.1.value }}"
|
||
ttl: 1
|
||
state: present
|
||
loop: "{{ SYS_SVC_DNS_BASE_DOMAINS | product(caa_entries) | list }}"
|
||
loop_control:
|
||
label: "{{ item.0 }} → {{ item.1.tag }}"
|
||
async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
|
||
poll: "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
|
||
|
||
- name: "Ensure wildcard parent DNS (*.parent) exists"
|
||
include_role:
|
||
name: sys-dns-wildcards
|
||
vars:
|
||
parent_dns_proxied: false
|
||
when: run_once_sys_dns_wildcards is not defined
|
||
|
||
- include_tasks: utils/once_finalize.yml |