boxswapper/Internal-apps
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

functional deployment without SSO for trade-hub

Browse Source
This commit is contained in:
boxswapper
2026-11-13 14:37:47 -07:00
parent 2b72f23ea9
commit f17cf9604e
8 changed files with 71 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@@ -12,8 +12,8 @@ Each role is tagged with its name — run one or more with `--tags`:
```bash
# Run one role
ansible-playbook -i inventory.ini ansible-playbook.yml --tags minecraft --ask-become-pass
ansible-playbook -i inventory.ini ansible-playbook.yml --tags minecraft --ask-become-pass
# Run several
ansible-playbook -i inventory.ini ansible-playbook.yml --tags "jellyfin,gitea" --ask-become-pass

17
roles/trade_hub/README.md
View File

@@ -61,7 +61,8 @@ node environment, then to the development default `sc_inventory_dev`.
| `trade_hub_network` | `sc-inventory` | Podman network name |
| `trade_hub_volume` | `sc-inventory-data` | PostgreSQL data volume |
| `trade_hub_frontend_bind` | `0.0.0.0` | Address the frontend publishes on |
| `trade_hub_frontend_port` | `8080` | Host port for the frontend |
| `trade_hub_frontend_port` | `8071` | Host publish and container listen port for the frontend |
| `trade_hub_frontend_ip` | `10.10.0.5` | Static address on the shared `npm_internal` proxy network |
| `trade_hub_cookie_secure` | `false` | Mark session cookies `Secure` (enable behind TLS) |
| `trade_hub_healthcheck_url` | `http://127.0.0.1:<port>/healthz` | Post-deploy check |
| `trade_hub_remove_legacy_apache` | `false` | Remove a container named `my-apache-server` |
@@ -77,6 +78,18 @@ existing installation is upgraded in place.
ansible-playbook site.yml --tags trade_hub -e trade_hub_postgres_password='...'
```
The role verifies `http://127.0.0.1:8080/healthz` after starting the containers.
The role verifies `http://127.0.0.1:8071/healthz` after starting the containers.
Only the frontend publishes a port; the database and backend stay on the
internal podman network.
## Proxy manager
The frontend is pinned to `10.10.0.5` on the shared `npm_internal` podman
network, which also hosts Nginx Proxy Manager (10.10.0.19). Configure the proxy
host upstream as `http://10.10.0.5:8071`.
The `network` role must run before this one so `npm_internal` exists:
```bash
ansible-playbook -i inventory.ini ansible-playbook.yml --tags "network,trade_hub"
```

19
roles/trade_hub/defaults/main.yml
View File

@@ -15,6 +15,16 @@ trade_hub_postgres_image: docker.io/library/postgres:16-alpine
trade_hub_build_images: true
trade_hub_force_rebuild: false
# Directories created under trade_hub_app_dir before the source is staged.
# ansible.builtin.copy does NOT create parent directories for single-file
# sources, so every directory a staged file lands in must exist first.
trade_hub_app_subdirs:
- backend
- backend/app
- backend/scripts
- frontend
- frontend/src
# Container names. Kept compatible with the previous standalone playbook so an
# existing installation is upgraded in place.
trade_hub_db_container: sc-inventory-db
@@ -24,7 +34,7 @@ trade_hub_frontend_container: sc-inventory-frontend
# Database.
trade_hub_postgres_user: sc_inventory
trade_hub_postgres_db: sc_inventory
trade_hub_postgres_password: "{{ lookup('env', 'POSTGRES_PASSWORD') | default('sc_inventory_dev', true) }}"
trade_hub_postgres_password: "{{ lookup('env', 'POSTGRES_PASSWORD') | default(trade_hub_postgres_pw, true) }}"
trade_hub_database_url: "postgresql+psycopg://{{ trade_hub_postgres_user }}:{{ trade_hub_postgres_password }}@db:5432/{{ trade_hub_postgres_db }}"
trade_hub_db_wait_seconds: 60
@@ -32,7 +42,12 @@ trade_hub_db_wait_seconds: 60
trade_hub_network: sc-inventory
trade_hub_volume: sc-inventory-data
trade_hub_frontend_bind: 0.0.0.0
trade_hub_frontend_port: 8080
# Published on the host and used as the container's nginx listen port. Nginx
# Proxy Manager proxies to http://<trade_hub_frontend_ip>:<trade_hub_frontend_port>.
trade_hub_frontend_port: 8071
# Static address for the frontend on the shared npm_internal proxy network
# (created by the "network" role), so the proxy-manager upstream never changes.
trade_hub_frontend_ip: "10.10.0.5"
# Set to true (or "true") once the site is served over TLS.
trade_hub_cookie_secure: "false"

2
roles/trade_hub/files/trade-hub/frontend/Dockerfile
View File

@@ -3,4 +3,4 @@ FROM docker.io/library/nginx:1.27-alpine
COPY nginx.conf /etc/nginx/conf.d/default.conf
COPY src/ /usr/share/nginx/html/
EXPOSE 80
EXPOSE 8071

4
roles/trade_hub/files/trade-hub/frontend/nginx.conf
View File

@@ -1,5 +1,5 @@
server {
listen 80;
listen 8071;
server_name _;
gzip on;
@@ -14,7 +14,7 @@ server {
location /api/ {
proxy_pass http://backend:8000;
# $http_host keeps the client's port, which the backend's Origin check
# compares against; $host would drop ":8080" and reject real browsers.
# compares against; $host would drop the port and reject real browsers.
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

2
roles/trade_hub/files/trade-hub/podman-compose.yml
View File

@@ -29,7 +29,7 @@ services:
build: ./frontend
image: localhost/sc-inventory-frontend:latest
ports:
- "8080:80"
- "8071:8071"
depends_on:
- backend
restart: unless-stopped

32
roles/trade_hub/tasks/main.yml
View File

@@ -45,6 +45,13 @@
state: directory
mode: "0755"
- name: Create the application source directories
ansible.builtin.file:
path: "{{ trade_hub_app_dir }}/{{ item }}"
state: directory
mode: "0755"
loop: "{{ trade_hub_app_subdirs }}"
- name: Stage the application build context
ansible.builtin.copy:
src: "{{ role_path }}/files/trade-hub/{{ item.src }}"
@@ -144,6 +151,23 @@
name: "{{ trade_hub_network }}"
state: present
- name: Check whether the shared proxy network exists
ansible.builtin.command: podman network exists npm_internal
register: trade_hub_npm_network_check
changed_when: false
failed_when: false
check_mode: false
- name: Require the shared proxy network to exist
ansible.builtin.assert:
that:
- trade_hub_npm_network_check.rc == 0
fail_msg: >-
The npm_internal podman network does not exist on {{ inventory_hostname }}.
Run the network role first, e.g.
ansible-playbook -i inventory.ini ansible-playbook.yml --tags "network,trade_hub".
quiet: true
- name: Create the PostgreSQL data volume
containers.podman.podman_volume:
name: "{{ trade_hub_volume }}"
@@ -192,9 +216,13 @@
image: "{{ trade_hub_frontend_image }}:{{ trade_hub_image_tag }}"
state: started
recreate: "{{ trade_hub_recreate_containers | bool }}"
network: "{{ trade_hub_network }}"
# Keep sc-inventory for the "backend" DNS alias and join the shared proxy
# network with a fixed address so the proxy-manager upstream never changes.
network:
- "{{ trade_hub_network }}"
- "npm_internal:ip={{ trade_hub_frontend_ip }}"
ports:
- "{{ trade_hub_frontend_bind }}:{{ trade_hub_frontend_port }}:80"
- "{{ trade_hub_frontend_bind }}:{{ trade_hub_frontend_port }}:{{ trade_hub_frontend_port }}"
restart_policy: unless-stopped
when: not ansible_check_mode

4
vars.yml
View File

@@ -51,6 +51,10 @@ POSTGRES_ADMIN_USER: theuseriwant
POSTGRES_PASSWORD: theuserthatineedpaswoord
POSTGRES_DB: thatoneit
## trade_hub database password (the role also honours POSTGRES_PASSWORD exported
## on the control node; this variable is the in-repo fallback).
trade_hub_postgres_pw: "82uBeJkCzm483"
## WireGuard Easy VPN
## IMPORTANT: After first run, change wireguard_ui_password to a strong password
## Public IP or DDNS hostname clients connect to — CHANGE THIS before deploying