Skip to content

consolidate stacks: fold ideon + album_sort, hoist sendgrid key

jedmund requested to merge jedmund/consolidate-vault-playbook into main

Created by: jedmund

Summary

Three related cleanups, on top of #27:

  1. Fold Ideon into productivity — out of its own role/playbook/group, in alongside Silverbullet/Blinko/Draftboard/CouchDB.
  2. Fold Album Sort into media_acquisition — out of its own role/playbook/group, in alongside slskd/Lidarr (music acquisition pipeline; shares the music NFS volume).
  3. Hoist SendGrid API key — both Mastodon and Ideon SMTP now reference a single shared sendgrid_api_key from group_vars/compute_servers/vault.yml instead of per-stack copies.

README also gets a refresh: in-house projects (album-sort and line) are now explicitly called out as ours, the role/service listing is up to date, and the group_vars/album_sort/vault.yml and group_vars/ideon/vault.yml sections are gone (their entries moved to the parent stack vaults).

Removed

  • roles/ideon/, deploy/ideon.yml, ideon inventory group, deploy-ideon Makefile target
  • roles/album_sort/, deploy/album_sort.yml, album_sort inventory group, deploy-album-sort Makefile target

What you need to do after merging

1. Move Album Sort's bind-mount data on nuc-mini

Bind-mount paths shifted because the project_src directory changed. Before the next make deploy-media-acquisition:

ssh nuc-mini
sudo systemctl stop docker  # or: docker compose -f /opt/docker/album-sort/compose.yaml down
sudo mv /opt/docker/album-sort/data        /opt/docker/media-acquisition/album-sort-data
sudo mv /opt/docker/album-sort/beets-data  /opt/docker/media-acquisition/album-sort-beets-data
sudo rm -rf /opt/docker/album-sort

(If you skip this, album-sort and beets come up with empty state.)

2. Create group_vars/productivity/vault.yml entries for Ideon

Add to the existing productivity vault (or create it if missing):

ideon_secret_key: \"<openssl rand -hex 32>\"
ideon_db_password: \"<openssl rand -base64 32>\"

Then ansible-vault encrypt group_vars/productivity/vault.yml (or re-encrypt if it already existed).

Note: Ideon's SMTP password reuses the shared sendgrid_api_key — do not add ideon_smtp_password.

3. Create group_vars/compute_servers/vault.yml for the shared SendGrid key

This is a new vault file. Move your existing SendGrid API key (currently in group_vars/social/vault.yml as mastodon_smtp_password) into it under the new shared name:

sendgrid_api_key: \"<your existing SendGrid API key>\"

Then encrypt:

ansible-vault encrypt group_vars/compute_servers/vault.yml

After that, remove mastodon_smtp_password from group_vars/social/vault.yml (it's no longer referenced).

4. Optional: clean up old Album Sort vault location

If you previously had group_vars/album_sort/vault.yml, move its entries (incl. the new album_sort_lastfm_api_key / album_sort_lastfm_api_secret) into group_vars/media_acquisition/vault.yml and delete the old file.

Test plan

  • All four vault files in place and encrypted
  • Album Sort data migrated on nuc-mini
  • make deploy-productivity brings up Ideon at https://idea.atelier.house healthy alongside the rest of the stack
  • make deploy-media-acquisition rebuilds album-sort from source and brings it + beets up healthy at https://sorter.atelier.house
  • Mastodon at fireplace.cafe still sends mail (confirms shared SendGrid key works)
  • Re-runs of both playbooks are idempotent (no changes reported)

Merge request reports