Initial VPS operations handbook

2026-08-03 12:26:42 +08:00
commit b73125e5bc
97 changed files with 3641 additions and 0 deletions
@@ -0,0 +1,99 @@
+---
+# Deploy the official ESS OCI chart on a K3s node.
+# Pre-tasks create the non-secret values files on the target host.
+# The matrix_stack role then validates and deploys the chart.
+- name: Deploy the Matrix stack (ESS OCI chart)
+  hosts: matrix
+  become: true
+  gather_facts: false
+  serial: 1
+  pre_tasks:
+    - name: Ensure the ESS values directory exists
+      ansible.builtin.file:
+        path: /etc/ess
+        state: directory
+        owner: root
+        group: root
+        mode: "0700"
+
+    - name: Write hostnames values file
+      ansible.builtin.copy:
+        dest: /etc/ess/hostnames.yaml
+        owner: root
+        group: root
+        mode: "0600"
+        content: |
+          serverName: {{ matrix_server_name }}
+
+          elementWeb:
+            ingress:
+              host: {{ matrix_element_host }}
+
+          synapse:
+            ingress:
+              host: {{ matrix_synapse_host }}
+
+          matrixAuthenticationService:
+            ingress:
+              host: {{ matrix_mas_host }}
+
+          elementAdmin:
+            ingress:
+              host: {{ matrix_admin_host }}
+
+          matrixRTC:
+            ingress:
+              host: {{ matrix_rtc_host }}
+
+    - name: Write TLS values file
+      ansible.builtin.copy:
+        dest: /etc/ess/tls.yaml
+        owner: root
+        group: root
+        mode: "0600"
+        content: |
+          certManager:
+            clusterIssuer: letsencrypt-prod
+          ingress:
+            className: traefik
+            tlsEnabled: true
+
+    - name: Write single-node tuning values file
+      ansible.builtin.copy:
+        dest: /etc/ess/single-node.yaml
+        owner: root
+        group: root
+        mode: "0600"
+        content: |
+          # ESS single-node resource tuning for K3s
+          # Chart defaults are already single-node-friendly
+          postgres:
+            storage:
+              size: 20Gi
+          redis:
+            maxMemory: 128mb
+          matrixRTC:
+            enabled: false
+
+    - name: Verify values files are in place
+      ansible.builtin.stat:
+        path: "/etc/ess/{{ item }}"
+      loop:
+        - hostnames.yaml
+        - tls.yaml
+        - single-node.yaml
+      register: _values_check
+
+    - name: Assert all values files exist
+      ansible.builtin.assert:
+        that:
+          - item.stat.exists
+          - item.stat.isreg
+          - item.stat.pw_name == 'root'
+      loop: "{{ _values_check.results }}"
+      loop_control:
+        label: "{{ item.stat.path | default(item.item) }}"
+
+  roles:
+    - role: matrix_stack
+      tags: [matrix, stack, mutating]