Document Gitea domain and retire Prometheus DuckDNS

ansible/inventory/group_vars/server.yml

@@ -10,6 +10,7 @@ server_npm_quadlet_stage: false
 server_npm_quadlet_cutover: false
 server_legacy_stack_retired: false
 server_legacy_cleanup: false
+server_duckdns_enabled: true
 ai_agents: {}
 vim_plugins_enabled: false
 

ansible/inventory/host_vars/atlas.yml

@@ -52,6 +52,7 @@ atlas_manage_storage: true
 # Rootless Gitea was restored from the stopped-source export before production activation.
 atlas_manage_gitea: true
 atlas_gitea_production_enabled: true
+atlas_gitea_public_domain: git.fscotto.co
 atlas_prometheus_pull_start_timer: true
 atlas_manage_zfs_snapshots: true
 atlas_zfs_snapshot_prefix: atlas-auto

ansible/inventory/host_vars/prometheus.yml

@@ -27,6 +27,7 @@ server_gitea_on_atlas: true
 server_gitea_npm_domains:
   - git.fscotto.duckdns.org
 server_duckdns_domain: fscotto
+server_duckdns_enabled: false
 server_ssh_authorized_keys:
   - name: ikaros
     key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"

ansible/roles/profile_atlas/defaults/main.yml

@@ -184,6 +184,7 @@ atlas_gitea_quadlet_dir: "{{ atlas_gitea_home }}/.config/containers/systemd"
 atlas_gitea_image: localhost/atlas-gitea:1.25.2-user-gitea-v1
 atlas_gitea_image_build_dir: "{{ atlas_gitea_home }}/.local/share/atlas-gitea-image"
 atlas_gitea_production_enabled: false
+atlas_gitea_public_domain: ""
 atlas_gitea_bind_address: "{{ ansible_host }}"
 atlas_gitea_http_port: 3000
 atlas_gitea_ssh_port: 2222

ansible/roles/profile_atlas/tasks/gitea_public_domain.yml

@@ -0,0 +1,58 @@
+---
+- name: Manage the public domain of the restored production Gitea
+  tags: [atlas, gitea, gitea_public_domain]
+  when:
+    - atlas_manage_gitea | bool
+    - atlas_gitea_production_enabled | bool
+    - atlas_gitea_public_domain | length > 0
+  block:
+    - name: Require an explicit public Gitea hostname
+      ansible.builtin.assert:
+        that:
+          - atlas_gitea_public_domain is match('^[a-zA-Z0-9][a-zA-Z0-9.-]*\.[a-zA-Z]{2,}$')
+
+    - name: Inspect the restored private Gitea configuration
+      ansible.builtin.stat:
+        path: "{{ atlas_gitea_mountpoint }}/config/app.ini"
+        follow: false
+      register: atlas_gitea_public_config
+
+    - name: Refuse to create or replace an unprepared Gitea configuration
+      ansible.builtin.assert:
+        that:
+          - atlas_gitea_public_config.stat.isreg | default(false)
+          - atlas_gitea_public_config.stat.uid | int == atlas_gitea_uid | int
+          - atlas_gitea_public_config.stat.mode == '0600'
+
+    # app.ini contains secrets: preserve all unrelated settings and suppress diffs.
+    - name: Set only the declared public Gitea server fields
+      community.general.ini_file:
+        path: "{{ atlas_gitea_mountpoint }}/config/app.ini"
+        section: server
+        option: "{{ item.option }}"
+        value: "{{ item.value }}"
+        create: false
+        backup: true
+        owner: "{{ atlas_gitea_username }}"
+        group: "{{ atlas_gitea_group }}"
+        mode: "0600"
+      loop:
+        - { option: DOMAIN, value: "{{ atlas_gitea_public_domain }}" }
+        - { option: ROOT_URL, value: "https://{{ atlas_gitea_public_domain }}/" }
+        - { option: SSH_DOMAIN, value: "{{ atlas_gitea_public_domain }}" }
+      register: atlas_gitea_public_domain_update
+      no_log: true
+      diff: false
+
+    - name: Restart only Gitea when its public configuration changes
+      become_user: "{{ atlas_gitea_username }}"
+      ansible.builtin.systemd:
+        name: atlas-gitea.service
+        scope: user
+        state: restarted
+      environment:
+        XDG_RUNTIME_DIR: "/run/user/{{ atlas_gitea_uid }}"
+        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ atlas_gitea_uid }}/bus"
+      when:
+        - atlas_gitea_public_domain_update is changed
+        - not ansible_check_mode

ansible/roles/profile_atlas/tasks/main.yml

@@ -20,6 +20,9 @@
 - name: Import staged Atlas rootless Gitea tasks
   ansible.builtin.import_tasks: gitea.yml
 
+- name: Import the declared Atlas Gitea public domain
+  ansible.builtin.import_tasks: gitea_public_domain.yml
+
 - name: Import Atlas iCloudPD storage and boot-started Quadlet tasks
   ansible.builtin.import_tasks: icloudpd.yml
 

ansible/roles/profile_server/tasks/main.yml

@@ -11,6 +11,7 @@
 - name: Configure DuckDNS updater
   tags: [dotfiles, dotfiles:server, duckdns]
   ansible.builtin.import_tasks: duckdns.yml
+  when: server_duckdns_enabled | bool
 
 - name: Ensure server directories exist
   tags: [dotfiles, services]