HomeLab/services.yml at master · GreenMachine582/HomeLab · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
---
# services.yml — service repo registry for deploy-service
#
# Each entry maps a repo name to its deployment configuration.
# deploy-service reads this file (default: /opt/homelab/services.yml) and uses
# it to clone/pull the service repo, inject secrets from Infisical, and run
# the appropriate deploy mechanism.
#
# Schema reference: repo_split_brief.md §6.2
# deploy-service CLI: deploy-service/deploy_service/cli.py
#
# `device:` resolves against topology.yml (device -> hostname); see
# docs/topology_data_brief.md §3. `target_node:` (a bare hostname) still
# works as a fallback for any entry not yet migrated.
#
# Hook & secrets discovery: there is no pre_hook:/post_hook:/secrets: field.
# deploy-service auto-runs scripts/predeploy.sh and/or scripts/postdeploy.sh
# from the deployed repo if present, silently skipping whichever doesn't
# exist — a repo opts in just by adding the file, no registry entry here.
# Ordering of more than one step within either phase is that repo's own
# responsibility (see homelab-observe-services/scripts/postdeploy.sh for an
# example that calls several sub-scripts in sequence). Likewise, a repo
# declares its own required Infisical secrets in a secrets.yml at its root
# (path/env pairs, plus an optional addresses: list — see
# homelab-observe-services/secrets.yml or homelab-edge-services/secrets.yml
# for examples); deploy-service checks they all exist before deploying and
# prints ready-to-run `infisical secrets set` commands for anything missing.
# Repos without a secrets.yml yet (camunda-platform, n8n-automation) still
# fall back to this file's own secrets:/addresses: fields below.

repos:
  homelab-edge-services:
    repo: github.com/GreenMachine582/homelab-edge-services
    ref: master
    path: /srv/services/homelab-edge-services
    device: rpi-01
    deployment:
      type: compose
    deploy:
      compose_files: [docker-compose.yml]
      # MUST be rolling — cloudflared is the Cloudflare Tunnel (remote access
      # lifeline). deploy-service enforces `up -d --remove-orphans` and never
      # calls `docker compose down` for this stack.
      strategy: rolling
      # Pi-hole v6 ignores WEBPASSWORD env var.
    rollback:
      strategy: git
    services: [cloudflared, caddy, pihole, pihole-exporter, portainer-agent]

  homelab-observe-services:
    repo: github.com/GreenMachine582/homelab-observe-services
    ref: master
    path: /srv/services/homelab-observe-services
    device: rpi-02
    deployment:
      type: compose
    deploy:
      compose_files: [docker-compose.yml]
      # prometheus.yml/alertmanager.yml/monitors.yml are mounted config files,
      # not read by docker compose itself, so ${IP_*}/${DISCORD_WEBHOOK_*}
      # placeholders in them need envsubst before `docker compose up`.
    rollback:
      strategy: git
    services: [prometheus, loki, grafana, alertmanager, ntfy, uptime-kuma, portainer]

  homelab-data-services:
    repo: github.com/GreenMachine582/homelab-data-services
    ref: main
    path: /srv/services/homelab-data-services
    device: rpi-03
    deployment:
      type: compose
    deploy:
      compose_files: [docker-compose.yml]
      strategy: rolling
    rollback:
      strategy: git
    services: [postgres, redis]

  camunda-platform:
    repo: github.com/GreenMachine582/camunda-platform
    ref: master
    path: /srv/services/camunda-platform
    device: pc-01
    deployment:
      type: compose
    deploy:
      compose_files: [docker-compose.yml]
      strategy: rolling
      # Creates the ES bind-mount dir and sets vm.max_map_count (Elasticsearch
      # requirement) before compose up.
    secrets:
      infisical:
        - path: /prod/camunda/ADMIN_USER
          env: CAMUNDA_ADMIN_USER
        - path: /prod/camunda/ADMIN_PASSWORD
          env: CAMUNDA_ADMIN_PASSWORD
        - path: /prod/camunda/LICENSE_KEY
          env: CAMUNDA_LICENSE_KEY
    rollback:
      strategy: git
    services: [camunda-orchestration, elasticsearch]

  n8n-automation:
    repo: github.com/GreenMachine582/n8n-automation
    ref: master
    path: /srv/services/n8n-automation
    device: pc-01
    deployment:
      type: compose
    deploy:
      compose_files: [docker-compose.yml]
      strategy: rolling
    secrets:
      infisical:
        - path: /prod/n8n/USER
          env: N8N_USER
        - path: /prod/n8n/PASSWORD
          env: N8N_PASSWORD
        - path: /prod/n8n/OWNER_EMAIL
          env: N8N_OWNER_EMAIL
        - path: /prod/n8n/OWNER_PASSWORD
          env: N8N_OWNER_PASSWORD
        - path: /prod/n8n/ENCRYPTION_KEY
          env: N8N_ENCRYPTION_KEY
    rollback:
      strategy: git
    services: [n8n]