Robert Helewka
e17ed59be6
Add comprehensive terraform import documentation for Incus resources. Includes syntax for importing containers with for_each keys, retrieving image fingerprints, and specific import commands for Uranian hosts. Covers troubleshooting for common import issues and state verification. Removes obsolete korax.helu.ca host from ansible inventory.
239 lines
7.9 KiB
YAML
239 lines
7.9 KiB
YAML
---
|
|
# Rosalind Configuration - GO, Node.js, PHP Apps
|
|
# Services: alloy, gitea, lobechat, nextcloud
|
|
|
|
services:
|
|
- alloy
|
|
- anythingllm
|
|
- docker
|
|
- gitea
|
|
- lobechat
|
|
- memcached
|
|
- nextcloud
|
|
- openwebui
|
|
- hass
|
|
- searxng
|
|
|
|
# Alloy
|
|
alloy_log_level: "warn"
|
|
lobechat_syslog_port: 51461
|
|
searxng_syslog_port: 51403
|
|
|
|
# AnythingLLM Configuration
|
|
anythingllm_user: anythingllm
|
|
anythingllm_group: anythingllm
|
|
anythingllm_directory: /srv/anythingllm
|
|
anythingllm_port: 22084
|
|
|
|
# AnythingLLM Database (Portia PostgreSQL)
|
|
anythingllm_db_host: portia.incus
|
|
anythingllm_db_port: 5432
|
|
anythingllm_db_name: anythingllm
|
|
anythingllm_db_user: anythingllm
|
|
anythingllm_db_password: "{{ vault_anythingllm_db_password }}"
|
|
|
|
# AnythingLLM Security
|
|
anythingllm_jwt_secret: "{{ vault_anythingllm_jwt_secret }}"
|
|
anythingllm_sig_key: "{{ vault_anythingllm_sig_key }}"
|
|
anythingllm_sig_salt: "{{ vault_anythingllm_sig_salt }}"
|
|
|
|
# AnythingLLM LLM Provider (Generic OpenAI / llama-cpp)
|
|
anythingllm_llm_base_url: "http://nyx.helu.ca:25540/v1"
|
|
anythingllm_llm_model: "global.anthropic.claude-opus-4-6-v1"
|
|
anythingllm_llm_token_limit: 200000
|
|
anythingllm_llm_api_key: "ak_WX_7paeOky041GeX7MtQ51gam4lJsff3ghlClwdcbiI"
|
|
|
|
# AnythingLLM Embedding
|
|
anythingllm_embedding_engine: "generic-openai"
|
|
anythingllm_embedding_model: "Qwen3-Embedding-0.6B-Q8_0"
|
|
|
|
# AnythingLLM TTS (FastKokoro)
|
|
anythingllm_tts_provider: "openai"
|
|
anythingllm_tts_api_key: "not-needed"
|
|
anythingllm_tts_endpoint: "http://pan.helu.ca:22070/v1"
|
|
anythingllm_tts_model: "kokoro"
|
|
anythingllm_tts_voice: "am_echo"
|
|
|
|
# Gitea User and Directories
|
|
gitea_user: git
|
|
gitea_group: git
|
|
gitea_home_dir: /srv/git
|
|
gitea_work_dir: /var/lib/gitea
|
|
gitea_data_dir: /var/lib/gitea/data
|
|
gitea_lfs_dir: /var/lib/gitea/data/lfs
|
|
gitea_repo_root: /mnt/dv
|
|
gitea_config_file: /etc/gitea/app.ini
|
|
# Ports
|
|
gitea_web_port: 22082
|
|
gitea_ssh_port: 22022
|
|
gitea_metrics_port: 22092
|
|
# Network
|
|
gitea_domain: ouranos.helu.ca
|
|
gitea_root_url: https://gitea.ouranos.helu.ca/
|
|
# Database Configuration
|
|
gitea_db_type: postgres
|
|
gitea_db_host: portia.incus
|
|
gitea_db_port: 5432
|
|
gitea_db_name: gitea
|
|
gitea_db_user: gitea
|
|
gitea_db_password: "{{vault_gitea_db_password}}"
|
|
gitea_db_ssl_mode: disable
|
|
# Features
|
|
gitea_lfs_enabled: true
|
|
gitea_metrics_enabled: true
|
|
# Service Settings
|
|
gitea_disable_registration: true # Use Casdoor SSO instead
|
|
gitea_require_signin_view: false
|
|
# Security (vault secrets)
|
|
gitea_secret_key: "{{vault_gitea_secret_key}}"
|
|
gitea_lfs_jwt_secret: "{{vault_gitea_lfs_jwt_secret}}"
|
|
gitea_metrics_token: "{{vault_gitea_metrics_token}}"
|
|
# OAuth2 (Casdoor SSO)
|
|
gitea_oauth_enabled: true
|
|
gitea_oauth_name: "casdoor"
|
|
gitea_oauth_display_name: "Sign in with Casdoor"
|
|
gitea_oauth_client_id: "{{vault_gitea_oauth_client_id}}"
|
|
gitea_oauth_client_secret: "{{vault_gitea_oauth_client_secret}}"
|
|
# Auth URL uses external HAProxy address (user's browser)
|
|
gitea_oauth_auth_url: "https://id.ouranos.helu.ca/login/oauth/authorize"
|
|
# Token and userinfo URLs use internal Casdoor address (server-to-server)
|
|
gitea_oauth_token_url: "https://id.ouranos.helu.ca/api/login/oauth/access_token"
|
|
gitea_oauth_userinfo_url: "https://id.ouranos.helu.ca/api/userinfo"
|
|
gitea_oauth_scopes: "openid profile email"
|
|
|
|
# Home Assistant Configuration
|
|
hass_user: hass
|
|
hass_group: hass
|
|
hass_directory: /srv/hass
|
|
hass_media_directory: /srv/hass/media
|
|
hass_port: 8123
|
|
hass_version: "2026.2.0"
|
|
hass_db_host: portia.incus
|
|
hass_db_port: 5432
|
|
hass_db_name: hass
|
|
hass_db_user: hass
|
|
hass_db_password: "{{ vault_hass_db_password }}"
|
|
hass_metrics_token: "{{ vault_hass_metrics_token }}"
|
|
|
|
# LobeChat Configuration
|
|
lobechat_user: lobechat
|
|
lobechat_group: lobechat
|
|
lobechat_directory: /srv/lobechat
|
|
lobechat_port: 22081
|
|
# Database Configuration
|
|
lobechat_db_host: portia.incus
|
|
lobechat_db_port: 5432
|
|
lobechat_db_name: lobechat
|
|
lobechat_db_user: lobechat
|
|
lobechat_db_password: "{{vault_lobechat_db_password}}"
|
|
lobechat_key_vaults_secret: "{{vault_lobechat_key_vaults_secret}}"
|
|
# Authentication
|
|
# NEXTAUTH_URL must be the public URL users access (not internal)
|
|
lobechat_nextauth_url: https://lobechat.ouranos.helu.ca
|
|
lobechat_next_auth_secret: "{{vault_lobechat_next_auth_secret}}"
|
|
lobechat_next_auth_sso_providers: casdoor
|
|
# Issuer must match exactly what Casdoor returns in .well-known/openid-configuration
|
|
lobechat_auth_casdoor_issuer: http://titania.incus:22081
|
|
lobechat_auth_casdoor_id: "{{vault_lobechat_auth_casdoor_id}}"
|
|
lobechat_auth_casdoor_secret: "{{vault_lobechat_auth_casdoor_secret}}"
|
|
# S3 Storage
|
|
lobechat_s3_endpoint: https://pan.helu.ca:8555
|
|
lobechat_s3_public_domain: https://pan.helu.ca:8555
|
|
lobechat_s3_access_key: "{{vault_lobechat_s3_access_key}}"
|
|
lobechat_s3_secret_key: "{{vault_lobechat_s3_secret_key}}"
|
|
lobechat_s3_bucket: lobechat
|
|
# Search
|
|
lobechat_searxng_url: http://oberon.incus:25599
|
|
# AI Models
|
|
lobechat_openai_proxy_url: http://sycorax.incus:25540/v1
|
|
lobechat_openai_key: "{{vault_lobechat_openai_api_key}}"
|
|
lobechat_ollama_proxy_url: http://perseus.helu.ca:11434
|
|
lobechat_anthropic_api_key: "{{vault_lobechat_anthropic_api_key}}"
|
|
lobechat_google_api_key: "{{vault_lobechat_google_api_key}}"
|
|
lobechat_app_url: https://lobechat.ouranos.helu.ca/
|
|
|
|
# Nextcloud Configuration
|
|
nextcloud_web_port: 22083
|
|
nextcloud_data_dir: /mnt/nextcloud
|
|
# Database Configuration
|
|
nextcloud_db_type: pgsql
|
|
nextcloud_db_host: portia.incus
|
|
nextcloud_db_port: 5432
|
|
nextcloud_db_name: nextcloud
|
|
nextcloud_db_user: nextcloud
|
|
nextcloud_db_password: "{{vault_nextcloud_db_password}}"
|
|
# Admin Configuration
|
|
nextcloud_admin_user: admin
|
|
nextcloud_admin_password: "{{vault_nextcloud_admin_password}}"
|
|
# Domain Configuration
|
|
nextcloud_domain: nextcloud.ouranos.helu.ca
|
|
# Instance secrets (generated during install)
|
|
nextcloud_instance_id: ""
|
|
nextcloud_password_salt: ""
|
|
nextcloud_secret: ""
|
|
|
|
|
|
# Open WebUI Configuration
|
|
openwebui_user: openwebui
|
|
openwebui_group: openwebui
|
|
openwebui_directory: /srv/openwebui
|
|
openwebui_cors_allow_origin: https://openwebui.ouranos.helu.ca
|
|
openwebui_port: 22088
|
|
openwebui_host: puck.incus
|
|
openwebui_secret_key: "{{ vault_openwebui_secret_key }}"
|
|
openwebui_enable_signup: true
|
|
openwebui_enable_email_login: false
|
|
|
|
# OAuth/OIDC Configuration (Casdoor SSO)
|
|
openwebui_oauth_client_id: "{{ vault_openwebui_oauth_client_id }}"
|
|
openwebui_oauth_client_secret: "{{ vault_openwebui_oauth_client_secret }}"
|
|
openwebui_oauth_provider_name: "Casdoor"
|
|
openwebui_oauth_provider_url: "https://id.ouranos.helu.ca/.well-known/openid-configuration"
|
|
|
|
# Database Configuration
|
|
openwebui_db_host: portia.incus
|
|
openwebui_db_port: 5432
|
|
openwebui_db_name: openwebui
|
|
openwebui_db_user: openwebui
|
|
openwebui_db_password: "{{ vault_openwebui_db_password }}"
|
|
|
|
# API Keys
|
|
openwebui_openai_api_key: "{{ vault_openwebui_openai_api_key }}"
|
|
openwebui_anthropic_api_key: "{{ vault_openwebui_anthropic_api_key }}"
|
|
openwebui_groq_api_key: "{{ vault_openwebui_groq_api_key }}"
|
|
openwebui_mistral_api_key: "{{ vault_openwebui_mistral_api_key }}"
|
|
|
|
# Ollama Configuration
|
|
ollama_api_base_url: ""
|
|
openwebui_ollama_api_key: ""
|
|
|
|
# SSL Configuration
|
|
openwebui_enable_https: false
|
|
openwebui_ssl_cert_path: ""
|
|
openwebui_ssl_key_path: ""
|
|
|
|
# Logging
|
|
openwebui_log_level: info
|
|
|
|
# SearXNG Configuration
|
|
searxng_user: searxng
|
|
searxng_group: searxng
|
|
searxng_directory: /srv/searxng
|
|
searxng_port: 22089
|
|
searxng_base_url: http://rosalind.incus:22089/
|
|
searxng_instance_name: "Ouranos Search"
|
|
searxng_secret_key: "{{ vault_searxng_secret_key }}"
|
|
|
|
# SearXNG OAuth2-Proxy Sidecar
|
|
# Note: Each host supports at most one OAuth2-Proxy sidecar instance
|
|
# (binary shared at /usr/local/bin/oauth2-proxy, unique systemd unit per service)
|
|
searxng_oauth2_proxy_dir: /etc/oauth2-proxy-searxng
|
|
searxng_proxy_port: 22079
|
|
searxng_domain: "ouranos.helu.ca"
|
|
searxng_oauth2_oidc_issuer_url: "https://id.ouranos.helu.ca"
|
|
searxng_oauth2_redirect_url: "https://searxng.ouranos.helu.ca/oauth2/callback"
|
|
|
|
# OAuth2 Credentials (from vault)
|
|
searxng_oauth2_client_id: "{{ vault_searxng_oauth2_client_id }}"
|
|
searxng_oauth2_client_secret: "{{ vault_searxng_oauth2_client_secret }}"
|
|
searxng_oauth2_cookie_secret: "{{ vault_searxng_oauth2_cookie_secret }}" |