ginnoir
f995014d48
Post-monolith documentation and ops cleanup: - CLAUDE.md rewritten end-to-end. Documents the 11 Portainer-managed stacks + raw-compose management plane, the single shared `edge` network, the SSD-vs-ZFS bind-mount tiering, the four deployment channels (git push for app stacks, runner for Caddyfile, apply-compose.ps1 for mgmt plane / Caddyfile / vault), and the fact that the repo is now canonical. - homelab-apply skill rewritten for the new channels — no more `dc up -d`, no more monolith. - homelab-ssh skill rewritten — no `dc` alias, plain `docker` against container names; per-stack compose ops via /data/compose/<id>/... - homelab-sync skill + sync-prod.ps1 retired. The repo is canonical now; pulling from prod is the wrong direction. - .github/workflows/deploy.yml: drop the dc up -d steps, gate on paths:[Caddyfile, .github/workflows/deploy.yml], reload caddy via `docker exec` (no longer through compose). - apply-compose.ps1: drop -Compose and -DevStack flags; -Caddy now reloads via `docker exec caddy` (Caddy is in its own Portainer stack now). No live container is touched by this commit. The runner workflow is currently disabled at the repo level; re-enabling it makes Caddyfile pushes auto-deploy again.
75 lines
3.0 KiB
PowerShell
75 lines
3.0 KiB
PowerShell
# Manual ops helper for the management plane + Caddyfile + Vault.
|
|
#
|
|
# Post-split topology: every application stack lives under stacks/<domain>/ and
|
|
# is deployed by Portainer's git poll — there is no monolithic root compose any
|
|
# more, so this script no longer pushes one. The runner workflow (deploy.yml)
|
|
# handles Caddyfile reload on push automatically; -Caddy here is for ad-hoc
|
|
# pushes when you don't want to wait for the runner.
|
|
#
|
|
# Usage (flags combine; no flags = .env + Caddyfile):
|
|
# powershell -File apply-compose.ps1 # .env + Caddyfile
|
|
# powershell -File apply-compose.ps1 -EnvFile # .env only (mgmt plane / vault unseal)
|
|
# powershell -File apply-compose.ps1 -Caddy # Caddyfile only + hot-reload Caddy
|
|
# powershell -File apply-compose.ps1 -Portainer # portainer-compose.yml + vault.hcl + up -d
|
|
# powershell -File apply-compose.ps1 -VaultUnseal # unseal vault after restart (keys from .env)
|
|
|
|
param(
|
|
[switch]$Caddy,
|
|
[switch]$EnvFile,
|
|
[switch]$Portainer,
|
|
[switch]$VaultUnseal
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
# Make a non-zero exit from scp/ssh abort the script instead of silently continuing.
|
|
$PSNativeCommandUseErrorActionPreference = $true
|
|
|
|
$server = "ginnoir@valhalla"
|
|
$caddyLocal = Join-Path $PSScriptRoot "Caddyfile"
|
|
$envLocal = Join-Path $PSScriptRoot ".env"
|
|
$portainerLocal = Join-Path $PSScriptRoot "portainer-compose.yml"
|
|
$vaultConfigLocal = Join-Path $PSScriptRoot "vault.hcl"
|
|
|
|
# Default (no flags): push .env + Caddyfile.
|
|
if (-not $Caddy -and -not $EnvFile -and -not $Portainer -and -not $VaultUnseal) {
|
|
$EnvFile = $true; $Caddy = $true
|
|
}
|
|
|
|
if ($EnvFile) {
|
|
Write-Host "Pushing .env ..."
|
|
scp $envLocal "${server}:~/valhalla-lab/.env"
|
|
}
|
|
|
|
if ($Caddy) {
|
|
Write-Host "Pushing Caddyfile ..."
|
|
scp $caddyLocal "${server}:/config/caddy/Caddyfile"
|
|
Write-Host "Reloading Caddy ..."
|
|
ssh $server "docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
|
|
}
|
|
|
|
if ($Portainer) {
|
|
Write-Host "Pushing portainer-compose.yml ..."
|
|
scp $portainerLocal "${server}:~/valhalla-lab/portainer-compose.yml"
|
|
Write-Host "Pushing vault.hcl (Vault lives in the management plane) ..."
|
|
ssh $server "mkdir -p /config/vault/config /config/vault/data /config/vault/logs"
|
|
scp $vaultConfigLocal "${server}:/config/vault/config/vault.hcl"
|
|
Write-Host "Applying management plane (portainer, vault, github-runner, watchtower) ..."
|
|
ssh $server "docker compose -f ~/valhalla-lab/portainer-compose.yml --env-file ~/valhalla-lab/.env up -d"
|
|
}
|
|
|
|
if ($VaultUnseal) {
|
|
# Load the three unseal keys from .env
|
|
$envContent = Get-Content $envLocal | Where-Object { $_ -match "^VAULT_UNSEAL_KEY_[123]=" }
|
|
$keys = $envContent | ForEach-Object { ($_ -split "=", 2)[1] }
|
|
if ($keys.Count -lt 3) {
|
|
Write-Error "Could not find VAULT_UNSEAL_KEY_1/2/3 in .env"
|
|
exit 1
|
|
}
|
|
Write-Host "Unsealing Vault (3 of 5 keys) ..."
|
|
foreach ($key in $keys) {
|
|
ssh $server "docker exec vault vault operator unseal $key 2>&1 | grep -E 'Sealed|Error'"
|
|
}
|
|
}
|
|
|
|
Write-Host "Done."
|