Remove completed Atlas Gitea migration tooling

ansible/inventory/group_vars/server.yml

@@ -10,7 +10,6 @@ server_npm_quadlet_stage: false
 server_npm_quadlet_cutover: false
 server_legacy_stack_retired: false
 server_legacy_cleanup: false
-server_duckdns_enabled: true
 ai_agents: {}
 vim_plugins_enabled: false
 
@@ -92,9 +91,8 @@ server_backup_export_root: /var/lib/prometheus-backup-export
 server_backup_rrsync_path: /usr/share/doc/rsync/support/rrsync
 server_backup_export_calendar: "*-*-* 02:00:00 Europe/Rome"
 server_backup_export_start_timer: false
-# Explicit Gitea cutover helper: installed separately from any outage action.
-server_gitea_cutover_tools_enabled: false
-server_gitea_final_export: false
+# Ongoing public Gitea proxy configuration.
+server_gitea_proxy_enabled: false
 server_gitea_on_atlas: false
 server_gitea_atlas_address: "{{ hostvars['atlas'].ansible_host }}"
 server_gitea_npm_domains: []

ansible/inventory/host_vars/prometheus.yml

@@ -22,12 +22,10 @@ server_npm_quadlet_cutover: true
 server_backup_export_enabled: true
 server_backup_export_start_timer: true
 # Install the final-copy helper only; it is never run by a normal playbook invocation.
-server_gitea_cutover_tools_enabled: true
+server_gitea_proxy_enabled: true
 server_gitea_on_atlas: true
 server_gitea_npm_domains:
   - git.fscotto.duckdns.org
-server_duckdns_domain: fscotto
-server_duckdns_enabled: false
 server_ssh_authorized_keys:
   - name: ikaros
     key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"

ansible/roles/profile_atlas/defaults/main.yml

@@ -175,9 +175,6 @@ atlas_gitea_home: "{{ atlas_admin_home }}"
 atlas_gitea_container_uid: 1000
 atlas_gitea_container_gid: 1000
 atlas_gitea_legacy_username: gitea
-atlas_gitea_legacy_uid: 1101
-atlas_gitea_legacy_home: /var/lib/atlas-gitea
-atlas_gitea_owner_migration: false
 atlas_gitea_dataset: "{{ atlas_zfs_pool }}/services/data/gitea"
 atlas_gitea_mountpoint: "{{ atlas_app_data_mountpoint }}/gitea"
 atlas_gitea_quadlet_dir: "{{ atlas_gitea_home }}/.config/containers/systemd"
@@ -191,9 +188,6 @@ atlas_gitea_ssh_port: 2222
 atlas_gitea_staging_bind_address: 127.0.0.1
 atlas_gitea_staging_http_port: 3001
 atlas_gitea_staging_ssh_port: 2223
-atlas_gitea_restore_test: false
-atlas_gitea_final_restore: false
-atlas_gitea_restore_helper: /usr/local/libexec/atlas-gitea-restore-test
 
 # Declare storage and an inactive Quadlet only. The operator supplies the
 # private configuration, handles MFA, and starts the user service manually.

ansible/roles/profile_atlas/files/atlas-gitea-restore-test.py

@@ -1,249 +0,0 @@
-#!/usr/bin/python3
-"""Rehearse a selective rootful-to-rootless Gitea restore, never a cutover."""
-
-import argparse
-import hashlib
-import json
-import os
-from pathlib import Path, PurePosixPath
-import re
-import shutil
-import sqlite3
-import tarfile
-import tempfile
-
-
-SOURCE_PREFIX = PurePosixPath("opt/gitea/data")
-HOST_KEYS = (
-    "ssh_host_ed25519_key",
-    "ssh_host_rsa_key",
-    "ssh_host_ecdsa_key",
-)
-SERVER_SETTINGS = {
-    "START_SSH_SERVER": "true",
-    "BUILTIN_SSH_SERVER_USER": "git",
-    "SSH_USER": "git",
-    "SSH_PORT": "2222",
-    "SSH_LISTEN_PORT": "2222",
-    "SSH_SERVER_HOST_KEYS": ", ".join(
-        f"/var/lib/gitea/ssh/{key}" for key in HOST_KEYS
-    ),
-}
-
-
-def sha256(path):
-    digest = hashlib.sha256()
-    with path.open("rb") as stream:
-        for chunk in iter(lambda: stream.read(1024 * 1024), b""):
-            digest.update(chunk)
-    return digest.hexdigest()
-
-
-def expected_digest(backup):
-    checksum = (backup / "payload.sha256").read_text().strip().split()
-    if len(checksum) != 2 or checksum[1] != "payload.tar":
-        raise ValueError("Unexpected Prometheus backup checksum manifest")
-    if not re.fullmatch(r"[0-9a-f]{64}", checksum[0]):
-        raise ValueError("Invalid Prometheus backup SHA-256")
-    return checksum[0]
-
-
-def convert_config(config):
-    original = config.read_text()
-    output = []
-    section = ""
-    server_seen = set()
-    server_found = False
-    run_user_seen = False
-
-    def append_missing_server_settings():
-        for key, value in SERVER_SETTINGS.items():
-            if key not in server_seen:
-                output.append(f"{key} = {value}\n")
-
-    for line in original.splitlines(keepends=True):
-        match = re.match(r"^\s*\[([^]]+)\]\s*$", line)
-        if match:
-            if not run_user_seen:
-                output.append("RUN_USER = gitea\n")
-                run_user_seen = True
-            if section == "server":
-                append_missing_server_settings()
-            section = match.group(1).lower()
-            server_found |= section == "server"
-            output.append(line)
-            continue
-        setting = re.match(r"^(\s*)([A-Z_]+)(\s*=\s*)(.*?)(\r?\n?)$", line)
-        if setting and section == "" and setting.group(2) == "RUN_USER":
-            run_user_seen = True
-            line = f"{setting.group(1)}RUN_USER{setting.group(3)}gitea{setting.group(5)}"
-        elif setting and section == "server" and setting.group(2) in SERVER_SETTINGS:
-            key = setting.group(2)
-            server_seen.add(key)
-            line = f"{setting.group(1)}{key}{setting.group(3)}{SERVER_SETTINGS[key]}{setting.group(5)}"
-        else:
-            line = line.replace("/data/", "/var/lib/gitea/")
-        output.append(line)
-    if section == "server":
-        append_missing_server_settings()
-    if not server_found:
-        raise ValueError("Gitea server configuration missing")
-    config.write_text("".join(output))
-    config.chmod(0o600)
-
-
-def extract_gitea(tar_path, staged_data):
-    count = 0
-    with tarfile.open(tar_path, mode="r") as archive:
-        for member in archive:
-            name = PurePosixPath(member.name)
-            if name == SOURCE_PREFIX:
-                continue
-            if SOURCE_PREFIX not in name.parents:
-                continue
-            relative = name.relative_to(SOURCE_PREFIX)
-            if not relative.parts or any(part in (".", "..") for part in relative.parts):
-                raise ValueError("Unsafe Gitea backup path")
-            if not (member.isdir() or member.isfile()):
-                raise ValueError("Unexpected Gitea backup member type")
-            destination = staged_data.joinpath(*relative.parts)
-            if member.isdir():
-                destination.mkdir(parents=True, exist_ok=True)
-                destination.chmod(0o700)
-                continue
-            destination.parent.mkdir(parents=True, exist_ok=True)
-            with archive.extractfile(member) as source, destination.open("xb") as target:
-                shutil.copyfileobj(source, target)
-            destination.chmod(member.mode & 0o777)
-            count += 1
-    if count == 0:
-        raise ValueError("No Gitea files in backup")
-
-
-def validate(staged_data, staged_config):
-    database = staged_data / "gitea/gitea.db"
-    repositories = staged_data / "git/repositories"
-    if not database.is_file() or not repositories.is_dir():
-        raise ValueError("Missing SQLite database or Git repositories")
-    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
-        if connection.execute("PRAGMA quick_check").fetchone()[0] != "ok":
-            raise ValueError("Gitea SQLite quick_check failed")
-        if connection.execute("SELECT count(*) FROM repository").fetchone()[0] < 1:
-            raise ValueError("Gitea backup contains no repository records")
-    if not any(repositories.rglob("*.git")):
-        raise ValueError("Gitea backup contains no Git repository directories")
-    if not (staged_config / "app.ini").is_file():
-        raise ValueError("Gitea app.ini missing")
-    for name in HOST_KEYS:
-        if not (staged_data / "ssh" / name).is_file():
-            raise ValueError("Gitea SSH host key missing")
-
-
-def chown_tree(root, uid, gid):
-    for directory, dirs, files in os.walk(root):
-        os.chown(directory, uid, gid)
-        for name in dirs + files:
-            os.chown(os.path.join(directory, name), uid, gid)
-
-
-def replace_rehearsal(target, stage, digest, uid, gid):
-    previous_data = target / ".previous-rehearsal-data"
-    previous_config = target / ".previous-rehearsal-config"
-    if previous_data.exists() or previous_config.exists():
-        raise ValueError("An interrupted Gitea replacement needs manual recovery")
-    os.rename(target / "data", previous_data)
-    try:
-        os.rename(target / "config", previous_config)
-        os.rename(stage / "data", target / "data")
-        os.rename(stage / "config", target / "config")
-        final_marker = target / ".final-sha256"
-        final_marker.write_text(digest + "\n")
-        final_marker.chmod(0o600)
-        os.chown(final_marker, uid, gid)
-        (target / ".rehearsal-sha256").unlink()
-    except Exception:
-        for name, previous in (("data", previous_data), ("config", previous_config)):
-            current = target / name
-            if previous.exists():
-                if current.exists():
-                    shutil.rmtree(current)
-                os.rename(previous, current)
-        (target / ".final-sha256").unlink(missing_ok=True)
-        raise
-    shutil.rmtree(previous_data)
-    shutil.rmtree(previous_config)
-
-
-def main():
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--backup", type=Path, required=True)
-    parser.add_argument("--target", type=Path, required=True)
-    parser.add_argument("--uid", type=int, required=True)
-    parser.add_argument("--gid", type=int, required=True)
-    parser.add_argument("--replace-rehearsal", action="store_true")
-    args = parser.parse_args()
-
-    backup = args.backup.resolve(strict=True)
-    target = args.target.resolve(strict=True)
-    if not str(backup).startswith("/zpool/backup/hosts/prometheus/snapshots/"):
-        raise ValueError("Refusing backup outside the Atlas Prometheus snapshots")
-    if str(target) != "/zpool/services/data/gitea":
-        raise ValueError("Refusing target outside the dedicated Gitea dataset")
-    if args.uid != 1000 or args.gid != 1000:
-        raise ValueError("Unexpected admin-owned Gitea account IDs")
-    expected = expected_digest(backup)
-    if sha256(backup / "payload.tar") != expected:
-        raise ValueError("Prometheus backup SHA-256 mismatch")
-
-    marker = target / (".final-sha256" if args.replace_rehearsal else ".rehearsal-sha256")
-    if marker.exists():
-        if marker.read_text().strip() != expected:
-            raise ValueError("A different Gitea restore already occupies this dataset")
-        validate(target / "data", target / "config")
-        print("unchanged")
-        return
-    if args.replace_rehearsal:
-        metadata = json.loads((backup / "metadata.json").read_text())
-        if metadata.get("purpose") != "gitea-cutover":
-            raise ValueError("Final restore requires an explicit Gitea cutover export")
-        if not (target / ".rehearsal-sha256").is_file():
-            raise ValueError("Only a marked rehearsal may be replaced")
-        if not all((target / name).is_dir() for name in ("data", "config")):
-            raise ValueError("Prepared Gitea volume paths are missing")
-    else:
-        if (target / ".final-sha256").exists():
-            raise ValueError("Refusing a rehearsal restore over final Gitea data")
-        for name in ("data", "config"):
-            directory = target / name
-            if not directory.is_dir() or any(directory.iterdir()):
-                raise ValueError("Gitea target is not empty; refusing overwrite")
-
-    with tempfile.TemporaryDirectory(prefix=".rehearsal-", dir=target) as temporary:
-        stage = Path(temporary)
-        staged_data = stage / "data"
-        staged_config = stage / "config"
-        staged_data.mkdir()
-        staged_config.mkdir()
-        extract_gitea(backup / "payload.tar", staged_data)
-        source_config = staged_data / "gitea/conf/app.ini"
-        if not source_config.is_file():
-            raise ValueError("Source Gitea app.ini missing")
-        shutil.copy2(source_config, staged_config / "app.ini")
-        source_config.unlink()
-        convert_config(staged_config / "app.ini")
-        validate(staged_data, staged_config)
-        chown_tree(stage, args.uid, args.gid)
-        if args.replace_rehearsal:
-            replace_rehearsal(target, stage, expected, args.uid, args.gid)
-        else:
-            for name in ("data", "config"):
-                (target / name).rmdir()
-                os.rename(stage / name, target / name)
-            marker.write_text(expected + "\n")
-            marker.chmod(0o600)
-            os.chown(marker, args.uid, args.gid)
-    print("restored")
-
-
-if __name__ == "__main__":
-    main()

ansible/roles/profile_atlas/tasks/gitea.yml

@@ -47,8 +47,8 @@
           - atlas_gitea_dataset_owner.stat.uid | int == atlas_admin_uid | int
           - atlas_gitea_dataset_owner.stat.gid | int == atlas_admin_gid | int
         fail_msg: >-
-          Run the explicit Gitea owner migration before enabling the admin
-          Quadlet; never chown an active legacy service in a normal run.
+          The production dataset must already belong to admin before enabling
+          the Quadlet; normal provisioning must not chown an active legacy service.
       when: atlas_gitea_production_enabled | bool
 
     - name: Remove the retired account's parent-dataset traverse ACL

ansible/roles/profile_atlas/tasks/gitea_owner_migration.yml

@@ -1,275 +0,0 @@
----
-# Run only in an approved outage with -e atlas_gitea_owner_migration=true.
-- name: Move live Gitea from the legacy host account to admin
-  tags: [atlas, gitea_owner_migration]
-  when: atlas_gitea_owner_migration | bool
-  block:
-    - name: Refuse a check-mode owner migration
-      ansible.builtin.assert:
-        that: not ansible_check_mode
-        fail_msg: The owner migration requires an explicit live outage.
-
-    - name: Inspect the Gitea dataset owner
-      ansible.builtin.stat:
-        path: "{{ atlas_gitea_mountpoint }}"
-      register: atlas_gitea_migration_owner
-
-    - name: Require either the legacy owner or an already migrated dataset
-      ansible.builtin.assert:
-        that:
-          - atlas_gitea_migration_owner.stat.isdir | default(false)
-          - atlas_gitea_migration_owner.stat.uid | int in [atlas_gitea_legacy_uid | int, atlas_admin_uid | int]
-        fail_msg: Refusing to modify a Gitea dataset with an unexpected owner.
-
-    - name: Migrate only a legacy-owned Gitea dataset
-      when: atlas_gitea_migration_owner.stat.uid | int == atlas_gitea_legacy_uid | int
-      block:
-        - name: Require the final cutover marker and configuration
-          ansible.builtin.stat:
-            path: "{{ item }}"
-          loop:
-            - "{{ atlas_gitea_mountpoint }}/.final-sha256"
-            - "{{ atlas_gitea_mountpoint }}/config/app.ini"
-          register: atlas_gitea_migration_files
-
-        - name: Refuse migration without both final data and configuration
-          ansible.builtin.assert:
-            that: atlas_gitea_migration_files.results | map(attribute='stat.isreg') | min
-
-        - name: Check that admin has no existing Gitea Quadlet
-          ansible.builtin.stat:
-            path: "{{ atlas_gitea_quadlet_dir }}/atlas-gitea.container"
-          register: atlas_gitea_admin_quadlet
-
-        - name: Refuse to overwrite an existing admin Quadlet
-          ansible.builtin.assert:
-            that: not atlas_gitea_admin_quadlet.stat.exists
-
-        - name: Check pool health before the outage
-          ansible.builtin.command:
-            argv: [zpool, status, -x, "{{ atlas_zfs_pool }}"]
-          register: atlas_gitea_pool_before
-          changed_when: false
-          failed_when: "'is healthy' not in atlas_gitea_pool_before.stdout"
-
-        - name: Ensure the admin Gitea image is available before stopping the source
-          ansible.builtin.import_tasks: gitea_image.yml
-
-        - name: Stop, snapshot and test the admin-owned staging service
-          block:
-            - name: Stop and disable the legacy Gitea user service
-              become_user: "{{ atlas_gitea_legacy_username }}"
-              ansible.builtin.systemd:
-                name: atlas-gitea.service
-                scope: user
-                state: stopped
-                enabled: false
-              environment:
-                XDG_RUNTIME_DIR: "/run/user/{{ atlas_gitea_legacy_uid }}"
-                DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ atlas_gitea_legacy_uid }}/bus"
-
-            - name: Record the migration snapshot name
-              ansible.builtin.set_fact:
-                atlas_gitea_migration_snapshot: >-
-                  {{ atlas_gitea_dataset }}@gitea-owner-migration-{{ ansible_facts.date_time.iso8601_basic_short }}
-
-            - name: Snapshot the stopped Gitea dataset for manual recovery
-              ansible.builtin.command:
-                argv: [zfs, snapshot, "{{ atlas_gitea_migration_snapshot }}"]
-
-            - name: Transfer only the Gitea dataset to admin
-              ansible.builtin.file:
-                path: "{{ atlas_gitea_mountpoint }}"
-                state: directory
-                owner: "{{ atlas_admin_username }}"
-                group: "{{ atlas_admin_group }}"
-                recurse: true
-
-            - name: Set the actual internal Unix process user
-              ansible.builtin.lineinfile:
-                path: "{{ atlas_gitea_mountpoint }}/config/app.ini"
-                regexp: '^RUN_USER\s*='
-                line: RUN_USER = gitea
-                mode: "0600"
-              no_log: true
-              diff: false
-
-            - name: Preserve public git clone URLs independently of the Unix user
-              community.general.ini_file:
-                path: "{{ atlas_gitea_mountpoint }}/config/app.ini"
-                section: server
-                option: "{{ item }}"
-                value: git
-                mode: "0600"
-                no_extra_spaces: false
-              loop: [BUILTIN_SSH_SERVER_USER, SSH_USER]
-              no_log: true
-              diff: false
-
-            - name: Render admin's loopback-only staging Quadlet
-              ansible.builtin.template:
-                src: atlas-gitea.container.j2
-                dest: "{{ atlas_gitea_quadlet_dir }}/atlas-gitea.container"
-                owner: "{{ atlas_admin_username }}"
-                group: "{{ atlas_admin_group }}"
-                mode: "0644"
-              vars:
-                atlas_gitea_production_enabled: false
-
-            - name: Reload the admin user manager for staging
-              become_user: "{{ atlas_admin_username }}"
-              ansible.builtin.systemd:
-                scope: user
-                daemon_reload: true
-              environment:
-                XDG_RUNTIME_DIR: "/run/user/{{ atlas_admin_uid }}"
-                DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ atlas_admin_uid }}/bus"
-
-            - name: Start admin's loopback-only staging service
-              become_user: "{{ atlas_admin_username }}"
-              ansible.builtin.systemd:
-                name: atlas-gitea.service
-                scope: user
-                state: started
-              environment:
-                XDG_RUNTIME_DIR: "/run/user/{{ atlas_admin_uid }}"
-                DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ atlas_admin_uid }}/bus"
-
-            - name: Verify staging HTTP before promotion
-              ansible.builtin.uri:
-                url: "http://127.0.0.1:{{ atlas_gitea_staging_http_port }}/"
-                status_code: 200
-              register: atlas_gitea_staging_http
-              retries: 30
-              delay: 2
-              until: atlas_gitea_staging_http is succeeded
-
-            - name: Verify the container really runs as internal gitea
-              become_user: "{{ atlas_admin_username }}"
-              ansible.builtin.command:
-                argv: [podman, exec, atlas-gitea, id, -un]
-              environment:
-                HOME: "{{ atlas_admin_home }}"
-                XDG_RUNTIME_DIR: "/run/user/{{ atlas_admin_uid }}"
-              register: atlas_gitea_internal_user
-              changed_when: false
-              failed_when: atlas_gitea_internal_user.stdout != 'gitea'
-
-            - name: Verify the migrated SQLite database
-              ansible.builtin.command:
-                argv:
-                  - sqlite3
-                  - "{{ atlas_gitea_mountpoint }}/data/gitea/gitea.db"
-                  - PRAGMA quick_check;
-              register: atlas_gitea_migration_sqlite
-              changed_when: false
-              failed_when: atlas_gitea_migration_sqlite.stdout != 'ok'
-
-          rescue:
-            - name: Stop admin's failed staging service
-              become_user: "{{ atlas_admin_username }}"
-              ansible.builtin.systemd:
-                name: atlas-gitea.service
-                scope: user
-                state: stopped
-              environment:
-                XDG_RUNTIME_DIR: "/run/user/{{ atlas_admin_uid }}"
-                DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ atlas_admin_uid }}/bus"
-              failed_when: false
-
-            - name: Restore the original Gitea configuration from the safety snapshot
-              ansible.builtin.command:
-                argv:
-                  - cp
-                  - -a
-                  - "{{ atlas_gitea_mountpoint }}/.zfs/snapshot/{{ atlas_gitea_migration_snapshot.split('@')[1] }}/config/app.ini"
-                  - "{{ atlas_gitea_mountpoint }}/config/app.ini"
-              when: atlas_gitea_migration_snapshot is defined
-
-            - name: Return the Gitea dataset to the legacy account
-              ansible.builtin.file:
-                path: "{{ atlas_gitea_mountpoint }}"
-                state: directory
-                owner: "{{ atlas_gitea_legacy_username }}"
-                group: "{{ atlas_gitea_legacy_username }}"
-                recurse: true
-
-            - name: Restart the legacy Gitea service
-              become_user: "{{ atlas_gitea_legacy_username }}"
-              ansible.builtin.systemd:
-                name: atlas-gitea.service
-                scope: user
-                state: started
-                enabled: true
-              environment:
-                XDG_RUNTIME_DIR: "/run/user/{{ atlas_gitea_legacy_uid }}"
-                DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ atlas_gitea_legacy_uid }}/bus"
-
-            - name: Report the failed migration and preserved snapshot
-              ansible.builtin.fail:
-                msg: >-
-                  Admin staging failed; legacy Gitea was restarted. Inspect
-                  {{ atlas_gitea_migration_snapshot | default('the host journal') }}.
-
-        - name: Stop admin's validated staging service
-          become_user: "{{ atlas_admin_username }}"
-          ansible.builtin.systemd:
-            name: atlas-gitea.service
-            scope: user
-            state: stopped
-          environment:
-            XDG_RUNTIME_DIR: "/run/user/{{ atlas_admin_uid }}"
-            DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ atlas_admin_uid }}/bus"
-
-        - name: Render admin's production Gitea Quadlet
-          ansible.builtin.template:
-            src: atlas-gitea.container.j2
-            dest: "{{ atlas_gitea_quadlet_dir }}/atlas-gitea.container"
-            owner: "{{ atlas_admin_username }}"
-            group: "{{ atlas_admin_group }}"
-            mode: "0644"
-          vars:
-            atlas_gitea_production_enabled: true
-
-        - name: Reload admin's production user manager
-          become_user: "{{ atlas_admin_username }}"
-          ansible.builtin.systemd:
-            scope: user
-            daemon_reload: true
-          environment:
-            XDG_RUNTIME_DIR: "/run/user/{{ atlas_admin_uid }}"
-            DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ atlas_admin_uid }}/bus"
-
-        - name: Enable and start admin's production Gitea
-          become_user: "{{ atlas_admin_username }}"
-          ansible.builtin.systemd:
-            name: atlas-gitea.service
-            scope: user
-            state: started
-            enabled: true
-          environment:
-            XDG_RUNTIME_DIR: "/run/user/{{ atlas_admin_uid }}"
-            DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ atlas_admin_uid }}/bus"
-
-        - name: Verify production HTTP before retiring the old Quadlet
-          ansible.builtin.uri:
-            url: "http://{{ atlas_gitea_bind_address }}:{{ atlas_gitea_http_port }}/"
-            status_code: 200
-          register: atlas_gitea_production_http
-          retries: 30
-          delay: 2
-          until: atlas_gitea_production_http is succeeded
-
-        - name: Remove only the disabled legacy Quadlet
-          ansible.builtin.file:
-            path: "{{ atlas_gitea_legacy_home }}/.config/containers/systemd/atlas-gitea.container"
-            state: absent
-
-        - name: Reload the legacy user manager after Quadlet removal
-          become_user: "{{ atlas_gitea_legacy_username }}"
-          ansible.builtin.systemd:
-            scope: user
-            daemon_reload: true
-          environment:
-            XDG_RUNTIME_DIR: "/run/user/{{ atlas_gitea_legacy_uid }}"
-            DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ atlas_gitea_legacy_uid }}/bus"

ansible/roles/profile_atlas/tasks/gitea_restore.yml

@@ -1,107 +0,0 @@
----
-- name: Restore Gitea from a verified Prometheus backup only on explicit request
-  tags: [atlas, gitea_restore, gitea_final_restore]
-  when: atlas_gitea_restore_test | bool or atlas_gitea_final_restore | bool
-  block:
-    - name: Require the prepared rootless Gitea target
-      ansible.builtin.assert:
-        that:
-          - atlas_manage_gitea | bool
-          - not (atlas_gitea_restore_test | bool and atlas_gitea_final_restore | bool)
-          - atlas_gitea_staging_bind_address == '127.0.0.1'
-          - atlas_gitea_mountpoint == atlas_app_data_mountpoint ~ '/gitea'
-        fail_msg: Prepare the isolated, loopback-only rootless Gitea target first.
-
-    - name: Confirm the rootless Gitea service is inactive
-      become_user: "{{ atlas_gitea_username }}"
-      ansible.builtin.command:
-        argv:
-          - systemctl
-          - --user
-          - is-active
-          - atlas-gitea.service
-      environment:
-        XDG_RUNTIME_DIR: "/run/user/{{ atlas_gitea_uid }}"
-        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ atlas_gitea_uid }}/bus"
-      register: atlas_gitea_restore_service_state
-      changed_when: false
-      failed_when: false
-      when: not ansible_check_mode
-
-    - name: Refuse to overwrite an active rootless Gitea service
-      ansible.builtin.assert:
-        that:
-          - atlas_gitea_restore_service_state.stdout == 'inactive'
-        fail_msg: The rootless Gitea user service must be known and inactive before restoring data.
-      when: not ansible_check_mode
-
-    - name: Check for a manually running rootless Gitea container
-      become_user: "{{ atlas_gitea_username }}"
-      ansible.builtin.command:
-        argv:
-          - podman
-          - ps
-          - --quiet
-          - --filter
-          - name=atlas-gitea
-      args:
-        chdir: "{{ atlas_gitea_home }}"
-      environment:
-        XDG_RUNTIME_DIR: "/run/user/{{ atlas_gitea_uid }}"
-      register: atlas_gitea_restore_container_state
-      changed_when: false
-      when: not ansible_check_mode
-
-    - name: Refuse to overwrite a running rootless Gitea container
-      ansible.builtin.assert:
-        that:
-          - atlas_gitea_restore_container_state.stdout | length == 0
-        fail_msg: Stop every rootless Atlas Gitea container before restoring data.
-      when: not ansible_check_mode
-
-    - name: Install the selective rootless Gitea restore helper
-      ansible.builtin.copy:
-        src: atlas-gitea-restore-test.py
-        dest: "{{ atlas_gitea_restore_helper }}"
-        owner: root
-        group: root
-        mode: "0700"
-
-    - name: Restore only Gitea data into the isolated target
-      ansible.builtin.command:
-        argv:
-          - "{{ atlas_gitea_restore_helper }}"
-          - --backup
-          - "{{ atlas_backup_prometheus_mountpoint }}/latest"
-          - --target
-          - "{{ atlas_gitea_mountpoint }}"
-          - --uid
-          - "{{ atlas_gitea_uid | string }}"
-          - --gid
-          - "{{ atlas_gitea_gid | string }}"
-      register: atlas_gitea_restore_result
-      changed_when: atlas_gitea_restore_result.stdout == 'restored'
-      no_log: true
-      when:
-        - atlas_gitea_restore_test | bool
-        - not ansible_check_mode
-
-    - name: Replace the marked rehearsal with the final consistent Gitea export
-      ansible.builtin.command:
-        argv:
-          - "{{ atlas_gitea_restore_helper }}"
-          - --backup
-          - "{{ atlas_backup_prometheus_mountpoint }}/latest"
-          - --target
-          - "{{ atlas_gitea_mountpoint }}"
-          - --uid
-          - "{{ atlas_gitea_uid | string }}"
-          - --gid
-          - "{{ atlas_gitea_gid | string }}"
-          - --replace-rehearsal
-      register: atlas_gitea_final_restore_result
-      changed_when: atlas_gitea_final_restore_result.stdout == 'restored'
-      no_log: true
-      when:
-        - atlas_gitea_final_restore | bool
-        - not ansible_check_mode

ansible/roles/profile_atlas/tasks/main.yml

@@ -14,9 +14,6 @@
 - name: Import Atlas storage tasks
   ansible.builtin.import_tasks: storage.yml
 
-- name: Import explicit Atlas Gitea owner migration
-  ansible.builtin.import_tasks: gitea_owner_migration.yml
-
 - name: Import staged Atlas rootless Gitea tasks
   ansible.builtin.import_tasks: gitea.yml
 
@@ -26,9 +23,6 @@
 - name: Import Atlas iCloudPD storage and boot-started Quadlet tasks
   ansible.builtin.import_tasks: icloudpd.yml
 
-- name: Import explicit Atlas Gitea restore rehearsal tasks
-  ansible.builtin.import_tasks: gitea_restore.yml
-
 - name: Import Atlas ZFS maintenance tasks
   ansible.builtin.import_tasks: zfs_maintenance.yml
 

ansible/roles/profile_server/tasks/duckdns.yml

@@ -1,33 +0,0 @@
----
-- name: Require DuckDNS domain and Vault token before deployment
-  ansible.builtin.assert:
-    that:
-      - >-
-        server_duckdns_domain | default('') is
-        regex('[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?', match_type='fullmatch')
-      - >-
-        vault_duckdns_token | default('') is
-        regex('[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}', match_type='fullmatch')
-    fail_msg: >-
-      Define server_duckdns_domain in host_vars and the rotated vault_duckdns_token
-      in encrypted Vault or an untracked local vars file before deploying DuckDNS.
-  no_log: true
-
-- name: Ensure private DuckDNS directory exists
-  ansible.builtin.file:
-    path: "{{ server_user_home }}/duckdns"
-    state: directory
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0700"
-
-- name: Render DuckDNS updater with the Vault token
-  ansible.builtin.template:
-    src: duck.sh.j2
-    dest: "{{ server_user_home }}/duckdns/duck.sh"
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0700"
-    validate: /bin/sh -n %s
-  no_log: true
-  diff: false

ansible/roles/profile_server/tasks/gitea_final_export.yml

@@ -1,38 +0,0 @@
----
-- name: Install the explicit Gitea final-export helper
-  tags: [services, gitea_final_export]
-  ansible.builtin.template:
-    src: prometheus-gitea-final-export.sh.j2
-    dest: /usr/local/sbin/prometheus-gitea-final-export
-    owner: root
-    group: root
-    mode: "0750"
-  when:
-    - server_gitea_cutover_tools_enabled | bool
-    - not server_legacy_stack_retired | bool
-
-- name: Require the prepared source and explicit final-export approval
-  tags: [services, gitea_final_export]
-  ansible.builtin.assert:
-    that:
-      - server_gitea_cutover_tools_enabled | bool
-      - server_backup_export_enabled | bool
-      - not server_legacy_stack_retired | bool
-      - not ansible_check_mode
-    fail_msg: >-
-      Install the cutover helper and perform an explicit non-check-mode run
-      only after the Gitea outage gate has been approved.
-  when: server_gitea_final_export | bool
-
-- name: Stop source Gitea and publish the final consistent export
-  tags: [services, gitea_final_export]
-  ansible.builtin.command:
-    argv:
-      - /usr/local/sbin/prometheus-gitea-final-export
-  register: server_gitea_final_export_result
-  changed_when: server_gitea_final_export_result.rc == 0
-  no_log: true
-  when:
-    - server_gitea_final_export | bool
-    - not server_legacy_stack_retired | bool
-    - not ansible_check_mode

ansible/roles/profile_server/tasks/gitea_npm_proxy.yml

@@ -3,7 +3,7 @@
   tags: [services, gitea_cutover]
   ansible.builtin.assert:
     that:
-      - server_gitea_cutover_tools_enabled | bool
+      - server_gitea_proxy_enabled | bool
       - server_gitea_npm_domains | length > 0
       - server_gitea_npm_domains | select('match', '^[a-zA-Z0-9.-]+$') | list | length == server_gitea_npm_domains | length
     fail_msg: Declare the exact NPM Gitea hostnames before enabling the Atlas upstream.
@@ -17,7 +17,7 @@
     owner: root
     group: root
     mode: "0755"
-  when: server_gitea_cutover_tools_enabled | bool
+  when: server_gitea_proxy_enabled | bool
 
 - name: Render the Gitea-only NPM runtime upstream override
   tags: [services, gitea_cutover]
@@ -36,7 +36,7 @@
     path: /opt/npm/data/nginx/custom/server_proxy.conf
     state: absent
   when:
-    - server_gitea_cutover_tools_enabled | bool
+    - server_gitea_proxy_enabled | bool
     - not server_gitea_on_atlas | bool
 
 - name: Validate NPM configuration after a Gitea upstream change

ansible/roles/profile_server/tasks/gitea_ssh_proxy.yml

@@ -3,7 +3,7 @@
   tags: [services, gitea_cutover]
   ansible.builtin.assert:
     that:
-      - server_gitea_cutover_tools_enabled | bool
+      - server_gitea_proxy_enabled | bool
       - server_gitea_atlas_address is match('^[0-9]{1,3}(\.[0-9]{1,3}){3}$')
       - server_gitea_ssh_public_port | int > 1024
       - server_gitea_ssh_public_port | int < 65536
@@ -27,14 +27,14 @@
   loop_control:
     label: "{{ item }}"
   register: server_gitea_ssh_proxy_units
-  when: server_gitea_cutover_tools_enabled | bool
+  when: server_gitea_proxy_enabled | bool
 
 - name: Reload systemd after Gitea SSH proxy unit changes
   tags: [services, gitea_cutover]
   ansible.builtin.systemd:
     daemon_reload: true
   when:
-    - server_gitea_cutover_tools_enabled | bool
+    - server_gitea_proxy_enabled | bool
     - server_gitea_ssh_proxy_units is changed
     - not ansible_check_mode
 
@@ -45,7 +45,7 @@
     state: "{{ 'started' if server_gitea_on_atlas | bool else 'stopped' }}"
     enabled: "{{ server_gitea_on_atlas | bool }}"
   when:
-    - server_gitea_cutover_tools_enabled | bool
+    - server_gitea_proxy_enabled | bool
     - not ansible_check_mode
 
 - name: Open only the public Gitea SSH port after cutover
@@ -57,5 +57,5 @@
     permanent: true
     immediate: true
   when:
-    - server_gitea_cutover_tools_enabled | bool
+    - server_gitea_proxy_enabled | bool
     - server_firewall_backend == 'firewalld'

ansible/roles/profile_server/tasks/main.yml

@@ -8,11 +8,6 @@
     fail_msg: >-
       server_firewall_backend must be firewalld for the Rocky server profile.
 
-- name: Configure DuckDNS updater
-  tags: [dotfiles, dotfiles:server, duckdns]
-  ansible.builtin.import_tasks: duckdns.yml
-  when: server_duckdns_enabled | bool
-
 - name: Ensure server directories exist
   tags: [dotfiles, services]
   ansible.builtin.file:
@@ -79,9 +74,6 @@
   tags: [never, server_legacy_cleanup]
   when: server_legacy_cleanup | bool
 
-- name: Import explicit Prometheus Gitea final-export tasks
-  ansible.builtin.import_tasks: gitea_final_export.yml
-
 - name: Import Prometheus Gitea SSH proxy tasks
   ansible.builtin.import_tasks: gitea_ssh_proxy.yml
 

ansible/roles/profile_server/templates/duck.sh.j2

@@ -1,24 +0,0 @@
-#!/bin/sh
-# Managed by Ansible. Contains a Vault token; never copy this file into Git.
-set -eu
-umask 077
-
-log_file={{ (server_user_home ~ '/duckdns/duck.log') | quote }}
-
-# Keep the token out of process arguments and verify the HTTPS certificate.
-if ! response=$(curl --fail --silent --show-error --connect-timeout 10 --max-time 30 --config - <<'DUCKDNS_CONFIG'
-url = "https://www.duckdns.org/update?domains={{ server_duckdns_domain }}&token={{ vault_duckdns_token }}&ip="
-DUCKDNS_CONFIG
-); then
-  printf 'ERROR\n' > "$log_file"
-  exit 1
-fi
-
-case "$response" in
-  OK) printf 'OK\n' > "$log_file" ;;
-  *)
-    printf 'KO\n' > "$log_file"
-    printf 'DuckDNS update failed.\n' >&2
-    exit 1
-    ;;
-esac

ansible/roles/profile_server/templates/prometheus-gitea-final-export.sh.j2

@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-umask 077
-
-export_root={{ server_backup_export_root | quote }}
-versions="$export_root/versions"
-stamp=$(date -u +%Y%m%dT%H%M%SZ)
-stage=''
-gitea_stopped=false
-
-exec 9>/run/lock/prometheus-backup-export.lock
-flock -n 9 || { echo 'A Prometheus backup export is already running' >&2; exit 1; }
-
-cleanup() {
-  local rc=$?
-  trap - EXIT
-  if (( rc != 0 )) && "$gitea_stopped"; then
-    podman start gitea >/dev/null || rc=1
-  fi
-  if (( rc != 0 )) && [[ -n "$stage" && -d "$stage" ]]; then
-    rm -rf -- "$stage"
-  fi
-  exit "$rc"
-}
-trap cleanup EXIT
-trap 'exit 129' HUP
-trap 'exit 130' INT
-trap 'exit 143' TERM
-
-systemctl is-active --quiet podman-compose-server.service || {
-  echo 'Prometheus Compose stack is not active' >&2; exit 1;
-}
-if systemctl is-active --quiet prometheus-backup-export.timer; then
-  echo 'Stop the scheduled export timer for the cutover first' >&2
-  exit 1
-fi
-[[ $(podman inspect --format '{{ '{{.State.Running}}' }}' gitea) == true ]] || {
-  echo 'Source Gitea must be running before the final export' >&2; exit 1;
-}
-[[ -d /opt/gitea/data && -d /home/git/.ssh ]] || {
-  echo 'Required source Gitea paths are missing' >&2; exit 1;
-}
-[[ ! -e "$versions/$stamp" ]] || {
-  echo 'Final export timestamp already exists' >&2; exit 1;
-}
-
-gitea_stopped=true
-podman stop --time 30 gitea >/dev/null
-[[ $(podman inspect --format '{{ '{{.State.Running}}' }}' gitea) == false ]] || {
-  echo 'Source Gitea did not stop' >&2; exit 1;
-}
-python3 - <<'PY'
-import sqlite3
-path = '/opt/gitea/data/gitea/gitea.db'
-with sqlite3.connect(f'file:{path}?mode=ro', uri=True) as database:
-    if database.execute('PRAGMA quick_check').fetchone()[0] != 'ok':
-        raise SystemExit('Source Gitea SQLite quick_check failed')
-PY
-
-stage=$(mktemp -d "$export_root/.staging.XXXXXXXX")
-tar --acls --xattrs --selinux -C / -cf "$stage/payload.tar" \
-  opt/gitea/data home/git/.ssh
-tar -tf "$stage/payload.tar" >/dev/null
-(cd "$stage" && sha256sum payload.tar >payload.sha256)
-printf '{"schema":1,"host":"prometheus","purpose":"gitea-cutover","created_utc":"%s"}\n' \
-  "$stamp" >"$stage/metadata.json"
-
-[[ $(podman inspect --format '{{ '{{.State.Running}}' }}' gitea) == false ]] || {
-  echo 'Source Gitea restarted during final export' >&2; exit 1;
-}
-chown root:{{ server_backup_username }} "$stage" "$stage/payload.tar" \
-  "$stage/payload.sha256" "$stage/metadata.json"
-chmod 0750 "$stage"
-chmod 0640 "$stage/payload.tar" "$stage/payload.sha256" "$stage/metadata.json"
-mv -- "$stage" "$versions/$stamp"
-stage=''
-ln -s "$stamp" "$versions/.current.new"
-mv -Tf -- "$versions/.current.new" "$versions/current"
-
-echo "Prepared final Gitea export $stamp; source Gitea remains stopped"