fe4cbbe36a
Python control-panel package driving the full provisioning flow from a site's site.yaml (docs/05): - provision: ZFS web dataset + ownership, per-site DB + least-priv user, generated .env encrypted to secrets.enc.yaml (SOPS/age), render the profile templates + persist site.yaml, per-customer chrooted SFTP account, docker compose up. - deprovision (gated: data destroyed only with --purge, after a final backup), backup (ZFS snapshot + mariadb-dump), restore (rollback + import), render (preview), list. Design: one command/file runner with a real --dry-run (prints every action, redacts secrets); idempotent steps; Config + Site validation mirroring docs/03; passwords never logged. Modules: cli, config, naming, context, render, runner, zfs, database, secrets, sftp, compose, provision, backup. Plus pyproject (heleosctl entry point), config.example.yaml, an example site, and a README. Tests: 22 pure-logic unit tests (naming, config validation, template render across all profiles + db on/off) — all passing. Full provision and deprovision verified end-to-end in --dry-run. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
34 lines
1.2 KiB
YAML
34 lines
1.2 KiB
YAML
# heleos control-panel config. Copy to config.yaml (or /etc/heleos/config.yaml,
|
|
# or point at it with HELEOS_CONFIG) and adjust for your host.
|
|
|
|
pool: tank
|
|
customers_root: /tank/customers
|
|
|
|
# Where rendered per-site configs are written (the deployments repo/dir).
|
|
deployments_dir: /opt/heleos/deployments
|
|
# Where the profile templates live (this monorepo's site-templates/profiles).
|
|
templates_dir: /opt/heleos/site-templates/profiles
|
|
|
|
# Container image registry + image reference templates.
|
|
registry: git.example.com/heleos
|
|
images:
|
|
nginx: "{registry}/nginx:latest"
|
|
php_fpm: "{registry}/php-fpm:{php_version}"
|
|
wordpress: "wordpress:{php_version}-fpm-alpine"
|
|
|
|
# Shared MariaDB. Root password is read from this .env (or the
|
|
# MARIADB_ROOT_PASSWORD environment variable).
|
|
mariadb_container: mariadb
|
|
mariadb_env_file: /opt/heleos/platform-infra/stacks/mariadb/.env
|
|
|
|
# SOPS/age recipient (public key) used to encrypt each site's .env into
|
|
# secrets.enc.yaml. Leave empty to skip encryption (dev only).
|
|
sops_age_recipient: ""
|
|
|
|
# fpm user/group the web root is owned by (matches the alpine images: www-data).
|
|
fpm_uid: 82
|
|
fpm_gid: 82
|
|
|
|
default_resources:
|
|
cpu: "1.0"
|
|
memory: "512m"
|