Remove completed Atlas Gitea migration tooling

ansible/roles/profile_server/tasks/duckdns.yml

@@ -1,33 +0,0 @@
----
-- name: Require DuckDNS domain and Vault token before deployment
-  ansible.builtin.assert:
-    that:
-      - >-
-        server_duckdns_domain | default('') is
-        regex('[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?', match_type='fullmatch')
-      - >-
-        vault_duckdns_token | default('') is
-        regex('[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}', match_type='fullmatch')
-    fail_msg: >-
-      Define server_duckdns_domain in host_vars and the rotated vault_duckdns_token
-      in encrypted Vault or an untracked local vars file before deploying DuckDNS.
-  no_log: true
-
-- name: Ensure private DuckDNS directory exists
-  ansible.builtin.file:
-    path: "{{ server_user_home }}/duckdns"
-    state: directory
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0700"
-
-- name: Render DuckDNS updater with the Vault token
-  ansible.builtin.template:
-    src: duck.sh.j2
-    dest: "{{ server_user_home }}/duckdns/duck.sh"
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0700"
-    validate: /bin/sh -n %s
-  no_log: true
-  diff: false

ansible/roles/profile_server/tasks/gitea_final_export.yml

@@ -1,38 +0,0 @@
----
-- name: Install the explicit Gitea final-export helper
-  tags: [services, gitea_final_export]
-  ansible.builtin.template:
-    src: prometheus-gitea-final-export.sh.j2
-    dest: /usr/local/sbin/prometheus-gitea-final-export
-    owner: root
-    group: root
-    mode: "0750"
-  when:
-    - server_gitea_cutover_tools_enabled | bool
-    - not server_legacy_stack_retired | bool
-
-- name: Require the prepared source and explicit final-export approval
-  tags: [services, gitea_final_export]
-  ansible.builtin.assert:
-    that:
-      - server_gitea_cutover_tools_enabled | bool
-      - server_backup_export_enabled | bool
-      - not server_legacy_stack_retired | bool
-      - not ansible_check_mode
-    fail_msg: >-
-      Install the cutover helper and perform an explicit non-check-mode run
-      only after the Gitea outage gate has been approved.
-  when: server_gitea_final_export | bool
-
-- name: Stop source Gitea and publish the final consistent export
-  tags: [services, gitea_final_export]
-  ansible.builtin.command:
-    argv:
-      - /usr/local/sbin/prometheus-gitea-final-export
-  register: server_gitea_final_export_result
-  changed_when: server_gitea_final_export_result.rc == 0
-  no_log: true
-  when:
-    - server_gitea_final_export | bool
-    - not server_legacy_stack_retired | bool
-    - not ansible_check_mode

ansible/roles/profile_server/tasks/gitea_npm_proxy.yml

@@ -3,7 +3,7 @@
   tags: [services, gitea_cutover]
   ansible.builtin.assert:
     that:
-      - server_gitea_cutover_tools_enabled | bool
+      - server_gitea_proxy_enabled | bool
       - server_gitea_npm_domains | length > 0
       - server_gitea_npm_domains | select('match', '^[a-zA-Z0-9.-]+$') | list | length == server_gitea_npm_domains | length
     fail_msg: Declare the exact NPM Gitea hostnames before enabling the Atlas upstream.
@@ -17,7 +17,7 @@
     owner: root
     group: root
     mode: "0755"
-  when: server_gitea_cutover_tools_enabled | bool
+  when: server_gitea_proxy_enabled | bool
 
 - name: Render the Gitea-only NPM runtime upstream override
   tags: [services, gitea_cutover]
@@ -36,7 +36,7 @@
     path: /opt/npm/data/nginx/custom/server_proxy.conf
     state: absent
   when:
-    - server_gitea_cutover_tools_enabled | bool
+    - server_gitea_proxy_enabled | bool
     - not server_gitea_on_atlas | bool
 
 - name: Validate NPM configuration after a Gitea upstream change

ansible/roles/profile_server/tasks/gitea_ssh_proxy.yml

@@ -3,7 +3,7 @@
   tags: [services, gitea_cutover]
   ansible.builtin.assert:
     that:
-      - server_gitea_cutover_tools_enabled | bool
+      - server_gitea_proxy_enabled | bool
       - server_gitea_atlas_address is match('^[0-9]{1,3}(\.[0-9]{1,3}){3}$')
       - server_gitea_ssh_public_port | int > 1024
       - server_gitea_ssh_public_port | int < 65536
@@ -27,14 +27,14 @@
   loop_control:
     label: "{{ item }}"
   register: server_gitea_ssh_proxy_units
-  when: server_gitea_cutover_tools_enabled | bool
+  when: server_gitea_proxy_enabled | bool
 
 - name: Reload systemd after Gitea SSH proxy unit changes
   tags: [services, gitea_cutover]
   ansible.builtin.systemd:
     daemon_reload: true
   when:
-    - server_gitea_cutover_tools_enabled | bool
+    - server_gitea_proxy_enabled | bool
     - server_gitea_ssh_proxy_units is changed
     - not ansible_check_mode
 
@@ -45,7 +45,7 @@
     state: "{{ 'started' if server_gitea_on_atlas | bool else 'stopped' }}"
     enabled: "{{ server_gitea_on_atlas | bool }}"
   when:
-    - server_gitea_cutover_tools_enabled | bool
+    - server_gitea_proxy_enabled | bool
     - not ansible_check_mode
 
 - name: Open only the public Gitea SSH port after cutover
@@ -57,5 +57,5 @@
     permanent: true
     immediate: true
   when:
-    - server_gitea_cutover_tools_enabled | bool
+    - server_gitea_proxy_enabled | bool
     - server_firewall_backend == 'firewalld'

ansible/roles/profile_server/tasks/main.yml

@@ -8,11 +8,6 @@
     fail_msg: >-
       server_firewall_backend must be firewalld for the Rocky server profile.
 
-- name: Configure DuckDNS updater
-  tags: [dotfiles, dotfiles:server, duckdns]
-  ansible.builtin.import_tasks: duckdns.yml
-  when: server_duckdns_enabled | bool
-
 - name: Ensure server directories exist
   tags: [dotfiles, services]
   ansible.builtin.file:
@@ -79,9 +74,6 @@
   tags: [never, server_legacy_cleanup]
   when: server_legacy_cleanup | bool
 
-- name: Import explicit Prometheus Gitea final-export tasks
-  ansible.builtin.import_tasks: gitea_final_export.yml
-
 - name: Import Prometheus Gitea SSH proxy tasks
   ansible.builtin.import_tasks: gitea_ssh_proxy.yml
 

ansible/roles/profile_server/templates/duck.sh.j2

@@ -1,24 +0,0 @@
-#!/bin/sh
-# Managed by Ansible. Contains a Vault token; never copy this file into Git.
-set -eu
-umask 077
-
-log_file={{ (server_user_home ~ '/duckdns/duck.log') | quote }}
-
-# Keep the token out of process arguments and verify the HTTPS certificate.
-if ! response=$(curl --fail --silent --show-error --connect-timeout 10 --max-time 30 --config - <<'DUCKDNS_CONFIG'
-url = "https://www.duckdns.org/update?domains={{ server_duckdns_domain }}&token={{ vault_duckdns_token }}&ip="
-DUCKDNS_CONFIG
-); then
-  printf 'ERROR\n' > "$log_file"
-  exit 1
-fi
-
-case "$response" in
-  OK) printf 'OK\n' > "$log_file" ;;
-  *)
-    printf 'KO\n' > "$log_file"
-    printf 'DuckDNS update failed.\n' >&2
-    exit 1
-    ;;
-esac

ansible/roles/profile_server/templates/prometheus-gitea-final-export.sh.j2

@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-umask 077
-
-export_root={{ server_backup_export_root | quote }}
-versions="$export_root/versions"
-stamp=$(date -u +%Y%m%dT%H%M%SZ)
-stage=''
-gitea_stopped=false
-
-exec 9>/run/lock/prometheus-backup-export.lock
-flock -n 9 || { echo 'A Prometheus backup export is already running' >&2; exit 1; }
-
-cleanup() {
-  local rc=$?
-  trap - EXIT
-  if (( rc != 0 )) && "$gitea_stopped"; then
-    podman start gitea >/dev/null || rc=1
-  fi
-  if (( rc != 0 )) && [[ -n "$stage" && -d "$stage" ]]; then
-    rm -rf -- "$stage"
-  fi
-  exit "$rc"
-}
-trap cleanup EXIT
-trap 'exit 129' HUP
-trap 'exit 130' INT
-trap 'exit 143' TERM
-
-systemctl is-active --quiet podman-compose-server.service || {
-  echo 'Prometheus Compose stack is not active' >&2; exit 1;
-}
-if systemctl is-active --quiet prometheus-backup-export.timer; then
-  echo 'Stop the scheduled export timer for the cutover first' >&2
-  exit 1
-fi
-[[ $(podman inspect --format '{{ '{{.State.Running}}' }}' gitea) == true ]] || {
-  echo 'Source Gitea must be running before the final export' >&2; exit 1;
-}
-[[ -d /opt/gitea/data && -d /home/git/.ssh ]] || {
-  echo 'Required source Gitea paths are missing' >&2; exit 1;
-}
-[[ ! -e "$versions/$stamp" ]] || {
-  echo 'Final export timestamp already exists' >&2; exit 1;
-}
-
-gitea_stopped=true
-podman stop --time 30 gitea >/dev/null
-[[ $(podman inspect --format '{{ '{{.State.Running}}' }}' gitea) == false ]] || {
-  echo 'Source Gitea did not stop' >&2; exit 1;
-}
-python3 - <<'PY'
-import sqlite3
-path = '/opt/gitea/data/gitea/gitea.db'
-with sqlite3.connect(f'file:{path}?mode=ro', uri=True) as database:
-    if database.execute('PRAGMA quick_check').fetchone()[0] != 'ok':
-        raise SystemExit('Source Gitea SQLite quick_check failed')
-PY
-
-stage=$(mktemp -d "$export_root/.staging.XXXXXXXX")
-tar --acls --xattrs --selinux -C / -cf "$stage/payload.tar" \
-  opt/gitea/data home/git/.ssh
-tar -tf "$stage/payload.tar" >/dev/null
-(cd "$stage" && sha256sum payload.tar >payload.sha256)
-printf '{"schema":1,"host":"prometheus","purpose":"gitea-cutover","created_utc":"%s"}\n' \
-  "$stamp" >"$stage/metadata.json"
-
-[[ $(podman inspect --format '{{ '{{.State.Running}}' }}' gitea) == false ]] || {
-  echo 'Source Gitea restarted during final export' >&2; exit 1;
-}
-chown root:{{ server_backup_username }} "$stage" "$stage/payload.tar" \
-  "$stage/payload.sha256" "$stage/metadata.json"
-chmod 0750 "$stage"
-chmod 0640 "$stage/payload.tar" "$stage/payload.sha256" "$stage/metadata.json"
-mv -- "$stage" "$versions/$stamp"
-stage=''
-ln -s "$stamp" "$versions/.current.new"
-mv -Tf -- "$versions/.current.new" "$versions/current"
-
-echo "Prepared final Gitea export $stamp; source Gitea remains stopped"