This PR tries a new pattern that I think our other nos services can use, where the application, the certificates, and the proxy are all done in a single compose file. It uses traefik instead of nginx for the proxy as it is easier to configure with this pattern and has nice auto-discovery features.
This considerably reduces the ansible steps needed to deploy a service-- in the meta/main.yml file included, you can see that we remove the nginx and certbot roles, and the tasks included in the nostrface role are halved. The critical ansible steps are to ensure docker is installed, copy up a docker compose file from a template, open up the firewall to allow https traffic, and run docker compose up. Additionally, we add a systemd service to make sure we are running hte latest docker image.
This essentially works to move away from ansible holding the majority of the logic of deployment, and instead that logic is at the repo level (with how the docker image is being built) and in the compose file.
dcadenas
commented
7 months ago
This PR tries a new pattern that I think our other nos services can use, where the application, the certificates, and the proxy are all done in a single compose file. It uses traefik instead of nginx for the proxy as it is easier to configure with this pattern and has nice auto-discovery features.
This considerably reduces the ansible steps needed to deploy a service-- in the meta/main.yml file included, you can see that we remove the nginx and certbot roles, and the tasks included in the nostrface role are halved. The critical ansible steps are to ensure docker is installed, copy up a docker compose file from a template, open up the firewall to allow https traffic, and run
docker compose up. Additionally, we add a systemd service to make sure we are running hte latest docker image.This essentially works to move away from ansible holding the majority of the logic of deployment, and instead that logic is at the repo level (with how the docker image is being built) and in the compose file.