diff --git a/roles/aurweb/tasks/main.yml b/roles/aurweb/tasks/main.yml index 5576bd83d0294ed237785946b3d2d7010b88048b..af669fd57542c4da004c1f28c41c702bdd3e431e 100644 --- a/roles/aurweb/tasks/main.yml +++ b/roles/aurweb/tasks/main.yml @@ -63,7 +63,7 @@ repo={{ aurweb_repository }} dest="{{ aurweb_dir }}" version={{ aurweb_version }} - verify_commit=true + verify_commit="{{ aurweb_environment_type == 'prod' }}" gpg_allowlist='{{ aurweb_pgp_keys }}' become: true become_user: "{{ aurweb_user }}" @@ -85,7 +85,7 @@ repo={{ aurweb_repository }} dest="{{ aurweb_dir }}" version={{ aurweb_version }} - verify_commit=true + verify_commit="{{ aurweb_environment_type == 'prod' }}" gpg_allowlist='{{ aurweb_pgp_keys }}' become: true become_user: "{{ aurweb_user }}" diff --git a/roles/aurweb/templates/config.j2 b/roles/aurweb/templates/config.j2 index 8568cd4306fb9e404724c62a80d92ebeef5d47c2..85c6dcca127be5628e2a4fdad6c9bbc28197d557 100644 --- a/roles/aurweb/templates/config.j2 +++ b/roles/aurweb/templates/config.j2 @@ -78,5 +78,7 @@ error-token = {{ vault_aurweb_error_token }} [fastapi] session_secret = {{ vault_aurweb_secret }} +{% if aurweb_environment_type == "prod" %} [tracing] otlp_endpoint = http://{{ hostvars['monitoring.archlinux.org']['wireguard_address'] }}:4318/v1/traces +{% endif %} diff --git a/roles/aurweb/templates/nginx.d.conf.j2 b/roles/aurweb/templates/nginx.d.conf.j2 index 58715f12efa74b26f2ceceeb09f9a153673525d3..7ad03b8cd65c21578d31dd21a57ee7eb0e92947c 100644 --- a/roles/aurweb/templates/nginx.d.conf.j2 +++ b/roles/aurweb/templates/nginx.d.conf.j2 @@ -129,9 +129,11 @@ server { } location = /rpc/metrics { +{% if aurweb_environment_type == 'prod' %} if ($http_authorization != "Bearer {{ vault_goaurrpc_metrics_token }}") { return 403; } +{% endif %} proxy_pass http://127.0.0.1:10666/metrics; proxy_set_header X-Forwarded-For $remote_addr; @@ -151,9 +153,11 @@ server { } location = /metrics { +{% if aurweb_environment_type == 'prod' %} if ($http_authorization != "Bearer {{ vault_aurweb_metrics_token }}") { return 403; } +{% endif %} {{ self.asgi_proxy() }} }