# Homekeeper Infrastructure

Ansible setup for a Hetzner VM (Ubuntu 24.04) running Homekeeper via rootless Podman.

## Architecture

```
nginx (system)          ← HTTPS
├── home.friessn.de     ← landing page (/var/www/html) + path routing
│   ├── /               → static landing page
│   ├── /api/           → homekeeper-api on 127.0.0.1:8000
│   ├── /beekeeper/      → homekeeper-beekeeper on 127.0.0.1:3838
│   └── /listkeeper/     → homekeeper-listkeeper on 127.0.0.1:3839
└── git.friessn.de       → Gitea on 127.0.0.1:3000 (git + container registry)
                            own site file, managed outside this role

Podman (rootless, user Quadlets under {{ deploy_user }} → systemd --user units)
├── homekeeper-db       postgres:17, data in named volume {{ homekeeper_db_volume }}
├── homekeeper-api      from Gitea registry, auto-update enabled
├── homekeeper-beekeeper  from Gitea registry, auto-update enabled
├── homekeeper-listkeeper from Gitea registry, auto-update enabled
└── gitea               from docker.io, data in named volume {{ gitea_data_volume }}

All containers run as {{ deploy_user }} (not root) — `loginctl enable-linger`
keeps the user systemd instance (and its containers) running after logout/reboot.
```

## First-time setup

### 1. Provision a Hetzner VM
- Ubuntu 24.04, min. CX22 (2 vCPU, 4 GB RAM)
- Add your SSH key in Hetzner console
- Point your domain DNS A-record to the VM IP

### 2. Configure variables
Edit `group_vars/all.yml`:
- Set `domain`
- Set all `CHANGE_ME` passwords (consider `ansible-vault encrypt_string`)
- Update `inventory/hosts.yml` with the VM IP

### 3. First run (without registry login — Gitea not yet up)
Comment out the "Login to Gitea registry" task in `roles/podman/tasks/main.yml`,
then run without the homekeeper role:

```bash
ansible-playbook -i inventory/hosts.yml site.yml --skip-tags homekeeper
```

### 4. Set up Gitea
- Visit https://git.friessn.de/ and complete the installation wizard
- Create user matching `gitea_admin_user`
- Create a repository for the code
- Generate an API token (Settings → Applications) with `package:write` scope
- Set `registry_token` in `group_vars/all.yml`

### 5. Push images to Gitea registry
On your local machine, build and push the three custom images:

```bash
# Login to Gitea registry
docker login git.friessn.de -u friessn

# Build and push
docker build -t git.friessn.de/friessn/homekeeper-api:latest ./api
docker build -t git.friessn.de/friessn/homekeeper-beekeeper:latest ./beekeeper
docker build -t git.friessn.de/friessn/homekeeper-listkeeper:latest ./listkeeper

docker push git.friessn.de/friessn/homekeeper-api:latest
docker push git.friessn.de/friessn/homekeeper-beekeeper:latest
docker push git.friessn.de/friessn/homekeeper-listkeeper:latest
```

### 6. Full playbook run
```bash
ansible-playbook -i inventory/hosts.yml site.yml
```

## Deploy updates

After pushing a new image to the Gitea registry, `podman auto-update` picks it up
automatically within `autoupdate_schedule` (default: every 15 minutes).

For an immediate deploy (containers run rootless as `deploy_user`, not root):
```bash
ssh nico@YOUR_IP podman auto-update
```

## Secrets management

For production, use ansible-vault:
```bash
ansible-vault encrypt_string 'mysecretpassword' --name 'db_password'
```
Paste the output into `group_vars/all.yml` and run playbooks with `--ask-vault-pass`.