PhilandClaude Opus 5.5
0875389d02
Deploys from unpushed branches were being reverted by the next deploy from main, and in-place vault edits could overwrite each other. - deploy-guard.yml (imported by site.yml and dns.yml) refuses real runs unless the checkout is clean and exactly origin/main; --check is fine. - bin/deploy holds a lock so only one deploy runs at a time. - bin/vault-run edits the vault under a lock with an atomic swap. - bin/worktree starts a task in a fresh worktree from origin/main. - CLAUDE.md explains the workflow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
118 lines
3.6 KiB
YAML
118 lines
3.6 KiB
YAML
---
|
|
# dns.yml
|
|
- import_playbook: deploy-guard.yml
|
|
|
|
- name: Add A Records for thesatelliteoflove.com and nerder.land
|
|
hosts: localhost
|
|
gather_facts: false
|
|
|
|
# Scoped IAM user (Route53 only) so this doesn't depend on an `aws login` session
|
|
module_defaults:
|
|
amazon.aws.route53:
|
|
access_key: "{{ vault_aws_dns.access_key }}"
|
|
secret_key: "{{ vault_aws_dns.secret_key }}"
|
|
|
|
vars:
|
|
# Domains to manage DNS records for
|
|
domains:
|
|
- name: thesatelliteoflove.com
|
|
dns_records:
|
|
- name: "git"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "social"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "auth"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "audio"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "books"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "paper"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "snippets"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: cal
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: loclog
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: watcher
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: models
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: bookmarks
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: gotify
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: gotify-assistant
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: pdg
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: opds
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: sync
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: gokapi
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: id
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: kavita
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: nerder.land
|
|
dns_records:
|
|
- name: "forms"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "listmonk"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "repaircafe"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "repair"
|
|
ip: "{{ network.netcup_ip }}"
|
|
|
|
# DNS records to remove for decommissioned services
|
|
removed_records:
|
|
- name: thesatelliteoflove.com
|
|
dns_records:
|
|
- name: "home"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "pin"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "code"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "phlog"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "tasks"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "post"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "files"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "kanboard"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "grocy"
|
|
ip: "{{ network.netcup_ip }}"
|
|
|
|
tasks:
|
|
- name: Remove A records for decommissioned services
|
|
amazon.aws.route53:
|
|
state: absent
|
|
zone: "{{ item.0.name }}"
|
|
record: "{{ item.1.name + '.' + item.0.name }}"
|
|
type: A
|
|
ttl: 300
|
|
value: "{{ item.1.ip }}"
|
|
loop: "{{ query('subelements', removed_records, 'dns_records') }}"
|
|
loop_control:
|
|
loop_var: item
|
|
|
|
- name: Add A records for subdomains of each domain
|
|
amazon.aws.route53:
|
|
state: present
|
|
zone: "{{ item.0.name }}"
|
|
record: "{{ item.0.name if item.1.name == '@' else item.1.name + '.' + item.0.name }}"
|
|
type: A
|
|
ttl: 300
|
|
value: "{{ item.1.ip }}"
|
|
loop: "{{ query('subelements', domains, 'dns_records') }}"
|
|
loop_control:
|
|
loop_var: item
|