mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 4.7
9a0620f7bb
Root cause of the DinD DNS-check failure on test-deploy-server
(networks.internet.ip4 falling through to 127.0.0.1 despite
INFINITO_IP4=172.30.0.10 reaching every link of the env pipeline):
cli/administration/inventory/provision/cli.py declared --ip4 with a
hardcoded default of "127.0.0.1" and ensure_host_vars_file wrote that
value unconditionally into host_vars/<host>.yml. group_vars'
defaults_networks.internet.ip4 resolves "172.30.0.10" via
\`lookup('env', 'INFINITO_IP4')\`, but tasks/stages/01_constructor.yml
merges \`defaults_networks | combine(networks | default({}, true))\` so
host_vars wins. INFINITO_IP4 looked broken end-to-end; the breakage
actually lived in the provision-CLI host_vars overlay.
INFINITO_DNS_IP and INFINITO_DOMAIN propagated correctly because
the provision CLI had no --dns and the --primary-domain write was
None-gated and never invoked.
While here, --ssl-disabled and --primary-domain are removed too:
neither had any effect in the dev flow. provision/cli.py applies
\`--vars-file inventories/development/default.yml\` AFTER
ensure_host_vars_file via apply_vars_overrides_from_file, whose
_deep_update_commented_map unconditionally overwrites
(\`target[key] = value\`). The dev vars-file always set
\`TLS_ENABLED: true\`, so \`--ssl-disabled\` (which forced
\`TLS_ENABLED: false\` in host_vars) was systematically reverted to
true. Dev/CI ran with TLS enabled the whole time. Inventory stays at
\`TLS_ENABLED: true\` to preserve that effective behaviour.
Removed from cli/administration/inventory/provision/cli.py:
- --ip4, --ip6: defaulted to 127.0.0.1 / ::1, shadowed group_vars
- --primary-domain: never set by any caller, None-gated write
- --ssl-disabled: always re-overwritten by --vars-file later in the
same provision pass
Removed from cli/administration/inventory/provision/host_vars.py the
matching writes in ensure_host_vars_file; the function now only sets
\`ansible_connection: local\` for localhost-class hosts. Defaults for
DOMAIN_PRIMARY / TLS_ENABLED / networks.internet.{ip4,ip6} live in
group_vars (env-driven) and the inventory vars-file (deployment-wide
flags); host_vars stops duplicating them.
Callers cleaned up:
- cli/administration/deploy/development/inventory/builder.py
- cli/administration/deploy/container/command.py
- scripts/tests/deploy/local/utils/fresh-kept-all-init-and-deploy.sh
- scripts/tests/deploy/local/reset/inventory.sh
Tests + docs follow:
- tests/unit/cli/administration/inventory/provision/test_host_vars.py
now asserts host_vars no longer carries baked DOMAIN_PRIMARY /
TLS_ENABLED / networks defaults
- docs/administration/deploy.md drops --ssl-disabled from the
provision example
- docs/contributing/design/inventory.md re-scopes the host_vars
column: the DOMAIN_PRIMARY / TLS_ENABLED / networks.internet.{ip4,ip6}
values arrive via --vars / --vars-file overlays, otherwise group_vars
provides the env-driven default
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
45 lines
1.9 KiB
Markdown
45 lines
1.9 KiB
Markdown
# Deploy Guide 🚀
|
|
|
|
Use this guide to create inventories, run a full deploy, and redeploy an existing environment with `infinito` commands only. The audience is the operator running deploys against a managed (production or staging) host. Contributors iterating on a local development stack should follow [Local Deploy](../contributing/actions/deploy.md) instead.
|
|
|
|
## Full Deploy 📦
|
|
|
|
Create or refresh the inventory first, then deploy against the generated inventory file.
|
|
|
|
### Create or Refresh the Inventory 📝
|
|
|
|
```bash
|
|
infinito administration inventory provision /etc/infinito.nexus/inventories/prod \
|
|
--inventory-file /etc/infinito.nexus/inventories/prod/devices.yml \
|
|
--host localhost \
|
|
--vars-file inventories/<env>/default.yml \
|
|
--include 'web-app-nextcloud,web-app-keycloak'
|
|
```
|
|
|
|
### Run the Deploy 🛠️
|
|
|
|
```bash
|
|
infinito administration deploy dedicated /etc/infinito.nexus/inventories/prod/devices.yml \
|
|
--password-file /etc/infinito.nexus/inventories/prod/.password \
|
|
--log /etc/infinito.nexus/logs \
|
|
--diff \
|
|
-vv
|
|
```
|
|
|
|
## Redeploy 🔁
|
|
|
|
When you need to redeploy after changes, repeat the same two `infinito` commands:
|
|
|
|
1. Re-run `infinito administration inventory provision ...` to refresh the inventory file and included app list.
|
|
2. Re-run `infinito administration deploy dedicated ...` against the same inventory file.
|
|
|
|
## Inventory Notes 📒
|
|
|
|
- Keep one inventory directory per environment.
|
|
- Store the password file next to the inventory file.
|
|
- Update `--include` whenever the target app set changes.
|
|
- Use a `--vars-file` that matches the target environment. Production deploys MUST NOT point at the development sample file.
|
|
|
|
For CLI installation prerequisites, see the [Installation Guide](installation.md).
|
|
For the local development deploy flow (make targets, matrix variants, single-variant pinning), see [Local Deploy](../contributing/actions/deploy.md).
|