/
/
/
Ansible role that deployes services on my runner machine
1---
2# Runner Role - Vault Variable Validation
3# Fail fast if critical vault secrets are missing or empty
4
5- name: Validate PostgreSQL vault variables (Immich)
6 ansible.builtin.assert:
7 that:
8 - postgres_password | default('') | length > 0
9 - postgres_db | default('') | length > 0
10 - postgres_user | default('') | length > 0
11 fail_msg: |
12 Missing PostgreSQL vault variables required by Immich.
13 Ensure vault_runner contains: postgres_password, postgres_db, postgres_user
14 success_msg: "PostgreSQL vault variables validated"
15 when: immich_enabled
16 tags: [always, validation]
17
18- name: Validate Immich JWT secret
19 ansible.builtin.assert:
20 that:
21 - immich_jwt_secret | default('') | length > 0
22 fail_msg: |
23 Missing Immich JWT secret.
24 Ensure vault_runner contains: immich_jwt_secret
25 success_msg: "Immich JWT secret validated"
26 when: immich_enabled
27 tags: [always, validation]
28
29- name: Validate MySQL vault variables (Ghost)
30 ansible.builtin.assert:
31 that:
32 - mysql_password | default('') | length > 0
33 - mysql_root_password | default('') | length > 0
34 fail_msg: |
35 Missing MySQL vault variables required by Ghost CMS.
36 Ensure vault_runner contains: mysql_password, mysql_root_password
37 success_msg: "MySQL vault variables validated"
38 when: ghost_enabled
39 tags: [always, validation]
40
41- name: Validate Tandoor secret key
42 ansible.builtin.assert:
43 that:
44 - tandoor_secret_key | default('') | length > 0
45 fail_msg: |
46 Missing Tandoor secret key.
47 Ensure vault_runner contains: tandoor_secret_key
48 success_msg: "Tandoor secret key validated"
49 when: tandoor_enabled
50 tags: [always, validation]
51
52- name: Validate LiveKit API credentials
53 ansible.builtin.assert:
54 that:
55 - livekit_api_key | default('') | length > 0
56 - livekit_api_secret | default('') | length >= 32
57 fail_msg: |
58 Missing or weak LiveKit API credentials.
59 Ensure vault_runner contains: livekit_api_key, livekit_api_secret
60 The secret must be at least 32 characters. Generate a pair with:
61 docker run --rm livekit/livekit-server generate-keys
62 success_msg: "LiveKit API credentials validated"
63 when: livekit_enabled
64 tags: [always, validation]
65
66- name: Validate LiteLLM secrets
67 ansible.builtin.assert:
68 that:
69 - vault_runner.lite_llm_master_key | default('') | length > 0
70 - vault_runner.lite_llm_salt_key | default('') | length > 0
71 - vault_runner.lite_llm_db_password | default('') | length > 0
72 fail_msg: |
73 Missing LiteLLM secrets.
74 Ensure vault_runner contains: lite_llm_master_key, lite_llm_salt_key, lite_llm_db_password
75
76 lite_llm_salt_key encrypts model credentials at rest and must NEVER be
77 changed once models have been stored in the database - rotating it makes
78 previously stored credentials unrecoverable.
79 success_msg: "LiteLLM secrets validated"
80 when: llm_stack_enabled
81 tags: [always, validation]
82
83- name: Validate D&D agent secrets
84 ansible.builtin.assert:
85 that:
86 - vault_runner.homeassistant_token | default('') | length > 0
87 - vault_runner.homeassistant_url | default('') | length > 0
88 - vault_runner.huggingface_token | default('') | length > 0
89 fail_msg: |
90 Missing D&D session agent secrets.
91 Ensure vault_runner contains: homeassistant_token, homeassistant_url,
92 huggingface_token
93
94 The Home Assistant token drives lighting scenes; create one under
95 Profile -> Security -> Long-lived access tokens.
96
97 The HuggingFace token only downloads gated pyannote weights once -
98 diarization itself runs locally. It requires accepting the terms on
99 pyannote/segmentation-3.0, pyannote/speaker-diarization-3.1 and
100 pyannote/speaker-diarization-community-1.
101 success_msg: "D&D agent secrets validated"
102 when: dnd_enabled
103 tags: [always, validation]
104
105- name: Validate MQTT credentials
106 ansible.builtin.assert:
107 that:
108 - mqtt_username | default('') | length > 0
109 - mqtt_password | default('') | length > 0
110 fail_msg: |
111 Missing MQTT credentials.
112 Ensure the vault contains top-level: mqtt_username, mqtt_password
113 success_msg: "MQTT credentials validated"
114 when: frigate_enabled and frigate_mqtt_enabled
115 tags: [always, validation]
116
117- name: Validate at least one camera has a non-empty host
118 ansible.builtin.assert:
119 that:
120 - frigate_cameras | selectattr('enabled', 'equalto', true) | selectattr('host', 'ne', '') | list | length > 0
121 fail_msg: |
122 No enabled Frigate cameras have a configured host.
123 Ensure at least one camera in frigate_cameras has a non-empty host from vault.
124 success_msg: "Frigate camera configuration validated"
125 when: frigate_enabled
126 tags: [always, validation]
127