From f17cf9604efc1242e9e120ffc74c72b819ca5797 Mon Sep 17 00:00:00 2001 From: boxswapper Date: Fri, 13 Nov 2026 14:37:47 -0700 Subject: [PATCH] functional deployment without SSO for trade-hub --- README.md | 2 +- roles/trade_hub/README.md | 17 ++++++++-- roles/trade_hub/defaults/main.yml | 19 +++++++++-- .../files/trade-hub/frontend/Dockerfile | 2 +- .../files/trade-hub/frontend/nginx.conf | 4 +-- .../files/trade-hub/podman-compose.yml | 2 +- roles/trade_hub/tasks/main.yml | 32 +++++++++++++++++-- vars.yml | 4 +++ 8 files changed, 71 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index d9b69cd..03cbc1f 100755 --- a/README.md +++ b/README.md @@ -12,8 +12,8 @@ Each role is tagged with its name — run one or more with `--tags`: ```bash # Run one role -ansible-playbook -i inventory.ini ansible-playbook.yml --tags minecraft --ask-become-pass +ansible-playbook -i inventory.ini ansible-playbook.yml --tags minecraft --ask-become-pass # Run several ansible-playbook -i inventory.ini ansible-playbook.yml --tags "jellyfin,gitea" --ask-become-pass diff --git a/roles/trade_hub/README.md b/roles/trade_hub/README.md index d1b4b16..71e642e 100644 --- a/roles/trade_hub/README.md +++ b/roles/trade_hub/README.md @@ -61,7 +61,8 @@ node environment, then to the development default `sc_inventory_dev`. | `trade_hub_network` | `sc-inventory` | Podman network name | | `trade_hub_volume` | `sc-inventory-data` | PostgreSQL data volume | | `trade_hub_frontend_bind` | `0.0.0.0` | Address the frontend publishes on | -| `trade_hub_frontend_port` | `8080` | Host port for the frontend | +| `trade_hub_frontend_port` | `8071` | Host publish and container listen port for the frontend | +| `trade_hub_frontend_ip` | `10.10.0.5` | Static address on the shared `npm_internal` proxy network | | `trade_hub_cookie_secure` | `false` | Mark session cookies `Secure` (enable behind TLS) | | `trade_hub_healthcheck_url` | `http://127.0.0.1:/healthz` | Post-deploy check | | `trade_hub_remove_legacy_apache` | `false` | Remove a container named `my-apache-server` | @@ -77,6 +78,18 @@ existing installation is upgraded in place. ansible-playbook site.yml --tags trade_hub -e trade_hub_postgres_password='...' ``` -The role verifies `http://127.0.0.1:8080/healthz` after starting the containers. +The role verifies `http://127.0.0.1:8071/healthz` after starting the containers. Only the frontend publishes a port; the database and backend stay on the internal podman network. + +## Proxy manager + +The frontend is pinned to `10.10.0.5` on the shared `npm_internal` podman +network, which also hosts Nginx Proxy Manager (10.10.0.19). Configure the proxy +host upstream as `http://10.10.0.5:8071`. + +The `network` role must run before this one so `npm_internal` exists: + +```bash +ansible-playbook -i inventory.ini ansible-playbook.yml --tags "network,trade_hub" +``` diff --git a/roles/trade_hub/defaults/main.yml b/roles/trade_hub/defaults/main.yml index 3dc7ce9..dd0fde5 100644 --- a/roles/trade_hub/defaults/main.yml +++ b/roles/trade_hub/defaults/main.yml @@ -15,6 +15,16 @@ trade_hub_postgres_image: docker.io/library/postgres:16-alpine trade_hub_build_images: true trade_hub_force_rebuild: false +# Directories created under trade_hub_app_dir before the source is staged. +# ansible.builtin.copy does NOT create parent directories for single-file +# sources, so every directory a staged file lands in must exist first. +trade_hub_app_subdirs: + - backend + - backend/app + - backend/scripts + - frontend + - frontend/src + # Container names. Kept compatible with the previous standalone playbook so an # existing installation is upgraded in place. trade_hub_db_container: sc-inventory-db @@ -24,7 +34,7 @@ trade_hub_frontend_container: sc-inventory-frontend # Database. trade_hub_postgres_user: sc_inventory trade_hub_postgres_db: sc_inventory -trade_hub_postgres_password: "{{ lookup('env', 'POSTGRES_PASSWORD') | default('sc_inventory_dev', true) }}" +trade_hub_postgres_password: "{{ lookup('env', 'POSTGRES_PASSWORD') | default(trade_hub_postgres_pw, true) }}" trade_hub_database_url: "postgresql+psycopg://{{ trade_hub_postgres_user }}:{{ trade_hub_postgres_password }}@db:5432/{{ trade_hub_postgres_db }}" trade_hub_db_wait_seconds: 60 @@ -32,7 +42,12 @@ trade_hub_db_wait_seconds: 60 trade_hub_network: sc-inventory trade_hub_volume: sc-inventory-data trade_hub_frontend_bind: 0.0.0.0 -trade_hub_frontend_port: 8080 +# Published on the host and used as the container's nginx listen port. Nginx +# Proxy Manager proxies to http://:. +trade_hub_frontend_port: 8071 +# Static address for the frontend on the shared npm_internal proxy network +# (created by the "network" role), so the proxy-manager upstream never changes. +trade_hub_frontend_ip: "10.10.0.5" # Set to true (or "true") once the site is served over TLS. trade_hub_cookie_secure: "false" diff --git a/roles/trade_hub/files/trade-hub/frontend/Dockerfile b/roles/trade_hub/files/trade-hub/frontend/Dockerfile index dc414d3..0d56d01 100644 --- a/roles/trade_hub/files/trade-hub/frontend/Dockerfile +++ b/roles/trade_hub/files/trade-hub/frontend/Dockerfile @@ -3,4 +3,4 @@ FROM docker.io/library/nginx:1.27-alpine COPY nginx.conf /etc/nginx/conf.d/default.conf COPY src/ /usr/share/nginx/html/ -EXPOSE 80 +EXPOSE 8071 diff --git a/roles/trade_hub/files/trade-hub/frontend/nginx.conf b/roles/trade_hub/files/trade-hub/frontend/nginx.conf index 7a1e01c..ecdb928 100644 --- a/roles/trade_hub/files/trade-hub/frontend/nginx.conf +++ b/roles/trade_hub/files/trade-hub/frontend/nginx.conf @@ -1,5 +1,5 @@ server { - listen 80; + listen 8071; server_name _; gzip on; @@ -14,7 +14,7 @@ server { location /api/ { proxy_pass http://backend:8000; # $http_host keeps the client's port, which the backend's Origin check - # compares against; $host would drop ":8080" and reject real browsers. + # compares against; $host would drop the port and reject real browsers. proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; diff --git a/roles/trade_hub/files/trade-hub/podman-compose.yml b/roles/trade_hub/files/trade-hub/podman-compose.yml index 6d78076..bbf9b7c 100644 --- a/roles/trade_hub/files/trade-hub/podman-compose.yml +++ b/roles/trade_hub/files/trade-hub/podman-compose.yml @@ -29,7 +29,7 @@ services: build: ./frontend image: localhost/sc-inventory-frontend:latest ports: - - "8080:80" + - "8071:8071" depends_on: - backend restart: unless-stopped diff --git a/roles/trade_hub/tasks/main.yml b/roles/trade_hub/tasks/main.yml index e8e7752..bd874ae 100644 --- a/roles/trade_hub/tasks/main.yml +++ b/roles/trade_hub/tasks/main.yml @@ -45,6 +45,13 @@ state: directory mode: "0755" +- name: Create the application source directories + ansible.builtin.file: + path: "{{ trade_hub_app_dir }}/{{ item }}" + state: directory + mode: "0755" + loop: "{{ trade_hub_app_subdirs }}" + - name: Stage the application build context ansible.builtin.copy: src: "{{ role_path }}/files/trade-hub/{{ item.src }}" @@ -144,6 +151,23 @@ name: "{{ trade_hub_network }}" state: present +- name: Check whether the shared proxy network exists + ansible.builtin.command: podman network exists npm_internal + register: trade_hub_npm_network_check + changed_when: false + failed_when: false + check_mode: false + +- name: Require the shared proxy network to exist + ansible.builtin.assert: + that: + - trade_hub_npm_network_check.rc == 0 + fail_msg: >- + The npm_internal podman network does not exist on {{ inventory_hostname }}. + Run the network role first, e.g. + ansible-playbook -i inventory.ini ansible-playbook.yml --tags "network,trade_hub". + quiet: true + - name: Create the PostgreSQL data volume containers.podman.podman_volume: name: "{{ trade_hub_volume }}" @@ -192,9 +216,13 @@ image: "{{ trade_hub_frontend_image }}:{{ trade_hub_image_tag }}" state: started recreate: "{{ trade_hub_recreate_containers | bool }}" - network: "{{ trade_hub_network }}" + # Keep sc-inventory for the "backend" DNS alias and join the shared proxy + # network with a fixed address so the proxy-manager upstream never changes. + network: + - "{{ trade_hub_network }}" + - "npm_internal:ip={{ trade_hub_frontend_ip }}" ports: - - "{{ trade_hub_frontend_bind }}:{{ trade_hub_frontend_port }}:80" + - "{{ trade_hub_frontend_bind }}:{{ trade_hub_frontend_port }}:{{ trade_hub_frontend_port }}" restart_policy: unless-stopped when: not ansible_check_mode diff --git a/vars.yml b/vars.yml index c9c624b..c723b64 100755 --- a/vars.yml +++ b/vars.yml @@ -51,6 +51,10 @@ POSTGRES_ADMIN_USER: theuseriwant POSTGRES_PASSWORD: theuserthatineedpaswoord POSTGRES_DB: thatoneit +## trade_hub database password (the role also honours POSTGRES_PASSWORD exported +## on the control node; this variable is the in-repo fallback). +trade_hub_postgres_pw: "82uBeJkCzm483" + ## WireGuard Easy VPN ## IMPORTANT: After first run, change wireguard_ui_password to a strong password ## Public IP or DDNS hostname clients connect to — CHANGE THIS before deploying