Document Atlas backend phase one and WireGuard deployment

ansible/inventory/group_vars/server.yml

@@ -6,29 +6,6 @@ effective_username: "{{ server_username }}"
 effective_user_group: "{{ server_user_group }}"
 effective_user_home: "{{ server_user_home }}"
 server_container_stack_dir: /opt/docker/server
-server_atlas_music_enabled: false
-server_atlas_sftp_remote_name: atlas
-server_atlas_sftp_host: CHANGEME_ATLAS_WIREGUARD_IP
-server_atlas_sftp_port: 22
-server_atlas_sftp_username: admin
-server_atlas_sftp_remote_path: /pool/media/music
-server_atlas_sftp_private_key: "{{ vault_prometheus_atlas_sftp_private_key | default('') }}"
-server_atlas_sftp_private_key_file: /etc/rclone/atlas_ed25519
-server_atlas_sftp_known_host: ""
-server_atlas_sftp_known_hosts_file: /etc/rclone/known_hosts
-server_atlas_wireguard_unit: ""
-server_rclone_config_dir: /etc/rclone
-server_rclone_config_file: /etc/rclone/rclone.conf
-server_rclone_music_service: rclone-music.service
-server_rclone_music_mountpoint: /mnt/music_atlas
-server_rclone_music_cache_dir: /var/cache/rclone-music
-server_navidrome_data_dir: /opt/navidrome/data
-server_navidrome_quadlet_dir: "{{ server_user_home }}/.config/containers/systemd"
-server_navidrome_env_dir: "{{ server_user_home }}/.config/navidrome"
-server_navidrome_env_file: "{{ server_navidrome_env_dir }}/navidrome.env"
-server_navidrome_image: docker.io/deluan/navidrome:latest
-server_navidrome_port: 4533
-server_navidrome_db_password: "{{ vault_navidrome_db_password | default('') }}"
 ai_agents: {}
 vim_plugins_enabled: false
 
@@ -85,10 +62,6 @@ server_directories:
     owner: root
     group: root
     mode: "0755"
-  - path: "{{ server_navidrome_data_dir }}"
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0755"
   - path: /opt/npm/data
     owner: root
     group: root
@@ -97,10 +70,6 @@ server_directories:
     owner: root
     group: root
     mode: "0755"
-  - path: /opt/postgres/data
-    owner: root
-    group: root
-    mode: "0755"
   - path: /opt/gitea/data
     owner: root
     group: root

ansible/inventory/host_vars/atlas.yml

@@ -22,17 +22,35 @@ atlas_firewalld_zone: public
 atlas_zfs_pool: zpool
 atlas_zfs_dataset_work: work
 atlas_zfs_dataset_archive: archive
+atlas_zfs_dataset_app_data: archive/app_data
+atlas_zfs_dataset_navidrome: archive/app_data/navidrome
+atlas_zfs_dataset_syncthing: archive/app_data/syncthing
+atlas_zfs_dataset_media: media
 atlas_zfs_dataset_music: media/music
-atlas_zfs_dataset_syncthing: syncthing
 atlas_zfs_dataset_backup_prometheus: backup_prometheus
-atlas_zfs_dataset_icloud_photos: media/icloud_photos
+atlas_zfs_dataset_photobook: media/photobook
+atlas_zfs_dataset_backups: backups
 atlas_zfs_dataset_service_backups: backups/services
 atlas_mount_root: /zpool
 atlas_manage_storage: false
 atlas_manage_media_stack: false
 
+wireguard_overlay_enabled: false
+wireguard_address: 10.0.0.2/24
+wireguard_peers:
+  - name: prometheus
+    host: prometheus
+    endpoint: "{{ hostvars['prometheus']['ansible_host'] }}:{{ hostvars['prometheus']['wireguard_listen_port'] }}"
+    allowed_ips:
+      - 10.0.0.0/24
+    persistent_keepalive: 25
+
+backend_phase1_enabled: false
+backend_phase1_start_services: false
+backend_phase1_wireguard_address: 10.0.0.2
+
 rocky_manage_openzfs_repo: true
-rocky_manage_syncthing_binary: true
+rocky_manage_syncthing_binary: false
 rocky_manage_podman: true
 rocky_podman_packages:
   - podman
@@ -47,7 +65,7 @@ host_packages:
   - zfs
 
 atlas_nfs_exports:
-  - path: "{{ atlas_icloud_photos_mountpoint }}"
+  - path: "{{ atlas_photobook_mountpoint }}"
     client: "{{ atlas_aegis_ip }}"
     options:
       - rw

ansible/inventory/host_vars/prometheus.yml

@@ -7,19 +7,21 @@ ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519
 
 server_username: rocky
 server_duckdns_domain: fscotto
-server_atlas_music_enabled: false
-server_atlas_sftp_host: CHANGEME_ATLAS_WIREGUARD_IP
-server_atlas_sftp_username: admin
-server_atlas_sftp_known_host: CHANGEME_ATLAS_SSH_HOST_KEY
-server_atlas_wireguard_unit: wg-quick@wg0.service
-server_atlas_sftp_private_key: "{{ vault_prometheus_atlas_sftp_private_key | default('') }}"
+
+wireguard_overlay_enabled: false
+wireguard_address: 10.0.0.1/24
+wireguard_listen_port: 51820
+wireguard_enable_ipv4_forwarding: true
+wireguard_peers:
+  - name: atlas
+    host: atlas
+    allowed_ips:
+      - 10.0.0.2/32
 
 host_packages:
   - cockpit
   - cockpit-navigator
   - cockpit-podman
-  - fuse3
-  - rclone
 
 host_enabled_services:
   - cockpit.socket

ansible/inventory/hosts.yml

@@ -95,3 +95,12 @@ all:
     rocky_server:
       hosts:
         prometheus:
+
+    wireguard_overlay:
+      hosts:
+        prometheus:
+        atlas:
+
+    role_backend_phase1:
+      hosts:
+        atlas: