j3d1/toolshed
2
1
Fork 0
Code Issues 9 Pull requests 1 Projects Releases Packages Wiki Activity

stash

Browse source
This commit is contained in:
j3d1 2026-08-17 03:19:34 +02:00
parent 419893d93d
commit e743de33c0
2 changed files with 12 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

7
deploy/prod/README.md
View file

@ -51,8 +51,11 @@ toolshed:
in `user@yourtoolshed.tld`) — see [DNS](#3-dns) for how those two relate. in `user@yourtoolshed.tld`) — see [DNS](#3-dns) for how those two relate.
- `toolshed_handle_domain` — the **handle domain**, only needed when it's - `toolshed_handle_domain` — the **handle domain**, only needed when it's
different from `toolshed_domain`. Omit it when the two are the same (it different from `toolshed_domain`. Omit it when the two are the same (it
then defaults to `toolshed_domain`). Set so nginx/Django accept requests then defaults to `toolshed_domain`). It doesn't affect nginx/Django at all
for either domain, whichever ends up as the `Host` header. (they only ever accept `toolshed_domain` as the `Host` header) — it's used
solely to populate the `/local/domains` registration fixture (see
`toolshed_register_domains` below); publishing the SRV record is a
separate, manual DNS step either way.
- `toolshed_repo_url` — the git remote the playbook checks out and builds - `toolshed_repo_url` — the git remote the playbook checks out and builds
from. Required, no default. from. Required, no default.
- `toolshed_version` — the branch, tag or commit to check out and build. - `toolshed_version` — the branch, tag or commit to check out and build.

15
deploy/prod/playbook.yml
View file

@ -73,15 +73,14 @@
# header instead. # header instead.
toolshed_x_forwarded_proto: >- toolshed_x_forwarded_proto: >-
{{ '$http_x_forwarded_proto' if (behind_tls_proxy | default(false) | bool) else '$scheme' }} {{ '$http_x_forwarded_proto' if (behind_tls_proxy | default(false) | bool) else '$scheme' }}
# The web domain (toolshed_domain, mandatory) and the handle domain # Only the web domain (toolshed_domain) - nginx server_name, Django
# (toolshed_handle_domain, optional - defaults to the web domain when # ALLOWED_HOSTS, and the cert certbot requests. The handle domain
# they're the same) both need to be accepted by nginx/Django, since # (toolshed_handle_domain) is resolved by clients via its own SRV record
# either may show up as the Host header depending on how the admin set # and doesn't necessarily have an A record pointing at this host at all
# up DNS for this deployment. Deduplicated so setting them equal # (see the README's DNS section), so it can't reliably serve an HTTP-01
# doesn't produce a repeated entry. # challenge or ever show up as this nginx's Host header.
toolshed_hostnames: >- toolshed_hostnames: >-
{{ [toolshed_domain | mandatory('toolshed_domain must be set as a host_var for ' ~ inventory_hostname), {{ [toolshed_domain | mandatory('toolshed_domain must be set as a host_var for ' ~ inventory_hostname)] }}
toolshed_handle_domain | default(toolshed_domain)] | unique }}
# Generated once per host on the controller and reused on every # Generated once per host on the controller and reused on every
# subsequent run against that host, keyed by inventory_hostname so # subsequent run against that host, keyed by inventory_hostname so
# separate deployments never end up sharing a Django SECRET_KEY. # separate deployments never end up sharing a Django SECRET_KEY.