# Ansible: local inventory (server address, key path) and vault password

ansible/inventory/hosts.yml

ansible/.vault_pass

# Only pass the vault password when it exists, so these targets keep working

# before the vault has been imported (scripts/import-vault.sh creates it)

VAULT_ARGS := $(shell [ -f $(ANSIBLE_DIR)/.vault_pass ] && echo --vault-password-file $(CURDIR)/$(ANSIBLE_DIR)/.vault_pass)

.PHONY: help deploy-diff deploy-check provision cert deploy-nginx app vault-import

	@echo "make app            # render the app config from the vault (app.yml)"

	@echo "make vault-import   # build the encrypted vault from the live env files"

vault-import:

	$(ANSIBLE_DIR)/scripts/import-vault.sh

	cd $(ANSIBLE_DIR) && ansible-playbook -i $(INVENTORY) $(VAULT_ARGS) provision.yml --check --diff

	cd $(ANSIBLE_DIR) && ansible-playbook -i $(INVENTORY) $(VAULT_ARGS) provision.yml --ask-become-pass

	cd $(ANSIBLE_DIR) && ansible-playbook -i $(INVENTORY) $(VAULT_ARGS) cert.yml --ask-become-pass

	cd $(ANSIBLE_DIR) && ansible-playbook -i $(INVENTORY) $(VAULT_ARGS) deploy.yml --ask-become-pass

app:

	cd $(ANSIBLE_DIR) && ansible-playbook -i $(INVENTORY) $(VAULT_ARGS) app.yml --ask-become-pass

# Shared, non-secret configuration for every host

#

# Secrets live in the encrypted sibling file, vault.yml. It is produced by

# scripts/import-vault.sh and holds these variables:

#

#   vault_postgres_password

#   vault_jwt_secret

#   vault_resend_api_key

#   vault_s3_access_key

#   vault_s3_access_secret

#   vault_nginx_logs_htpasswd

# The deploy user to create

deploy_user: deploy

# The SSH public key that will be authorised for the deploy user

deploy_ssh_pubkey_file: ~/.ssh/nexo_deploy_key.pub

# App directories to create under /srv/app

app_environments:

  - production

  - staging

# Image pushed by the deploy workflow

app_github_repo: pedrolucasp/nexo

image_tag: latest

# API runtime

app_port: 3000

app_log_level: info

app_frontend_url: https://usenexo.xyz

# Postgres (the password is in the vault)

postgres_user: nexo

postgres_db: nexo_production

# Valkey

valkey_host: valkey

valkey_port: 6379

# Email (Resend); the API key is in the vault

# XXX: the display name still says "orbit"

resend_from: "orbit <naoresponda@updates.cabotia.dev>"

# Object storage (S3-compatible); the keys are in the vault

s3_region: br

s3_url: br-gru-1.linodeobjects.com

s3_bucket: nexo-stg

# Logging stack

victorialogs_tag: v1.53.0

victorialogs_port: 9428

victorialogs_retention: 14d

victorialogs_max_disk: 2GiB

vector_tag: 0.59.X-distroless-libc

log_max_size: 10m

log_max_file: 3

# Host-side application configuration. Non-secret app config lives in

# inventory/group_vars/all/main.yml; secrets live in the encrypted vault.yml

# The env files are rendered from group_vars (secrets come from the encrypted

# vault.yml), so there is nothing to fill in by hand anymore

- name: Install the environment files

    src: "{{ item.src }}"

    dest: "/srv/app/{{ app_env }}/{{ item.dest }}"

    mode: "0600"

    - { src: env.j2, dest: .env }

    - { src: env.production.j2, dest: .env.production }

  loop_control:

    label: "{{ item.dest }}"

# Rendered by Ansible (role: app). Do not edit on the server

POSTGRES_USER={{ postgres_user }}

POSTGRES_DB={{ postgres_db }}

POSTGRES_PASSWORD={{ vault_postgres_password }}

GITHUB_REPOSITORY={{ app_github_repo }}

IMAGE_TAG={{ image_tag }}

# Logging stack (VictoriaLogs + Vector)

VICTORIALOGS_TAG={{ victorialogs_tag }}

VICTORIALOGS_PORT={{ victorialogs_port }}

VICTORIALOGS_RETENTION={{ victorialogs_retention }}

VICTORIALOGS_MAX_DISK={{ victorialogs_max_disk }}

VECTOR_TAG={{ vector_tag }}

# Container log rotation (json-file driver)

LOG_MAX_SIZE={{ log_max_size }}

LOG_MAX_FILE={{ log_max_file }}

# Rendered by Ansible (role: app). Do not edit on the server

NODE_ENV=production

PORT={{ app_port }}

LOG_LEVEL={{ app_log_level }}

DATABASE_URL="postgres://{{ postgres_user }}:{{ vault_postgres_password }}@db:5432/{{ postgres_db }}"

VALKEY_HOST={{ valkey_host }}

VALKEY_PORT={{ valkey_port }}

JWT_SECRET="{{ vault_jwt_secret }}"

FRONTEND_URL="{{ app_frontend_url }}"

RESEND_API_KEY="{{ vault_resend_api_key }}"

RESEND_FROM="{{ resend_from }}"

S3_REGION="{{ s3_region }}"

S3_URL="{{ s3_url }}"

S3_ACCESS_KEY="{{ vault_s3_access_key }}"

S3_ACCESS_SECRET="{{ vault_s3_access_secret }}"

S3_BUCKET="{{ s3_bucket }}"

# "user:hash" line; the credential comes from the encrypted vault, with a

# throwaway fallback so the role still renders before the vault is imported

nginx_logs_htpasswd: "{{ vault_nginx_logs_htpasswd | default('logs:$apr1$Bb2qaSgH$TUfwUmDTRR/FpOLRu.Jnj/') }}"

#!/usr/bin/env bash

#

# Build the encrypted Ansible vault from the values that are live on the VPS

#

# Pulls /srv/app/production/.env and .env.production, extracts the secrets,

# generates a logs UI credential, and writes the encrypted group_vars vault.

# Read-only on the server

#

#   ansible/scripts/import-vault.sh

#

# The vault password lives in ansible/.vault_pass (git-ignored); this script

# creates it on first run and prints it, so store it somewhere safe. Connection

# details come from ansible/inventory/hosts.yml, or the VPS_HOST / VPS_USER /

# VPS_KEY environment variables

set -euo pipefail

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"

ansible_dir="$repo_root/ansible"

inventory="$ansible_dir/inventory/hosts.yml"

vault_file="$ansible_dir/inventory/group_vars/all/vault.yml"

vault_pass_file="$ansible_dir/.vault_pass"

field() { awk -F': *' -v k="^[[:space:]]*$1" '$0 ~ k {print $2; exit}' "$inventory"; }

HOST="${VPS_HOST:-}"

USER="${VPS_USER:-}"

KEY="${VPS_KEY:-}"

if [ -f "$inventory" ]; then

  [ -n "$HOST" ] || HOST="$(field 'ansible_host:')"

  [ -n "$USER" ] || USER="$(field 'ansible_user:')"

  [ -n "$KEY" ]  || KEY="$(field 'ansible_ssh_private_key_file:')"

fi

KEY="${KEY/#\~/$HOME}"

KEY="${KEY:-$HOME/.ssh/id_ed25519}"

[ -n "$HOST" ] || { echo "no host: set VPS_HOST or provide inventory/hosts.yml" >&2; exit 2; }

[ -n "$USER" ] || { echo "no user: set VPS_USER or provide inventory/hosts.yml" >&2; exit 2; }

tmp="$(mktemp -d)"

trap 'rm -rf "$tmp"' EXIT

ssh_opts=(-i "$KEY" -o StrictHostKeyChecking=accept-new)

echo "Pulling live env from ${USER}@${HOST} ..."

scp "${ssh_opts[@]}" "${USER}@${HOST}:/srv/app/production/.env"             "$tmp/env"           >/dev/null

scp "${ssh_opts[@]}" "${USER}@${HOST}:/srv/app/production/.env.production" "$tmp/env.production" >/dev/null

# The env files are plain KEY=value; sourcing them is the least fussy parse

set -a

# shellcheck disable=SC1091

. "$tmp/env"

# shellcheck disable=SC1091

. "$tmp/env.production"

set +a

if [ ! -f "$vault_pass_file" ]; then

  umask 077

  openssl rand -base64 32 >"$vault_pass_file"

  echo "==> generated $vault_pass_file"

  echo "    vault password: $(cat "$vault_pass_file")"

fi

logs_pass="$(openssl rand -base64 18)"

logs_hash="$(openssl passwd -apr1 "$logs_pass")"

cat >"$vault_file.plain" <<EOF

vault_postgres_password: "${POSTGRES_PASSWORD:?missing POSTGRES_PASSWORD}"

vault_jwt_secret: "${JWT_SECRET:?missing JWT_SECRET}"

vault_resend_api_key: "${RESEND_API_KEY:?missing RESEND_API_KEY}"

vault_s3_access_key: "${S3_ACCESS_KEY:?missing S3_ACCESS_KEY}"

vault_s3_access_secret: "${S3_ACCESS_SECRET:?missing S3_ACCESS_SECRET}"

vault_nginx_logs_htpasswd: "logs:${logs_hash}"

EOF

ansible-vault encrypt \

  --vault-password-file "$vault_pass_file" \

  --output "$vault_file" \

  "$vault_file.plain"

rm -f "$vault_file.plain"

echo

echo "Wrote $vault_file (encrypted)."

echo "Logs UI credential: user 'logs', password '${logs_pass}'"

echo "Back up both the vault password and this credential."