cescm/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
2 commits 1 branch 0 tags 66 KiB
  • Python 47.8%
  • Shell 47.7%
  • Jinja 3.3%
  • PowerShell 1.2%
Find a file
Exact
Juan Carlos Escobosa d0cf4fc610 refactor(scripts): organize helpers by function and remove hardcoded secrets 
- move every helper into a functional folder (docker, infra, media, mediaserver, o2, stash)
- add templates/retry-vm.sh.j2 (rendered by Ansible into infra/)
- drop rclone-healthcheck.sh (superseded by the Ansible rclone role)
- read credentials from env vars or /etc/script-secrets (no secrets in the repo)
- document the convention in README.md and AGENTS.md
2026-10-22 16:21:45 +02:00
docker refactor(scripts): organize helpers by function and remove hardcoded secrets 2026-10-22 16:21:45 +02:00
infra refactor(scripts): organize helpers by function and remove hardcoded secrets 2026-10-22 16:21:45 +02:00
media refactor(scripts): organize helpers by function and remove hardcoded secrets 2026-10-22 16:21:45 +02:00
mediaserver refactor(scripts): organize helpers by function and remove hardcoded secrets 2026-10-22 16:21:45 +02:00
o2 refactor(scripts): organize helpers by function and remove hardcoded secrets 2026-10-22 16:21:45 +02:00
stash refactor(scripts): organize helpers by function and remove hardcoded secrets 2026-10-22 16:21:45 +02:00
templates refactor(scripts): organize helpers by function and remove hardcoded secrets 2026-10-22 16:21:45 +02:00
.gitignore refactor(scripts): organize helpers by function and remove hardcoded secrets 2026-10-22 16:21:45 +02:00
AGENTS.md refactor(scripts): organize helpers by function and remove hardcoded secrets 2026-10-22 16:21:45 +02:00
README.md refactor(scripts): organize helpers by function and remove hardcoded secrets 2026-10-22 16:21:45 +02:00

README.md

scripts

Helper scripts for the home lab (Proxmox host trastero01 and the services it runs).

This repository is the single source of truth for the scripts deployed in /mnt/scripts. The Ansible role scripts (repo cescm/ansible) clones this repo into /mnt/repos/scripts and deploys the content into /mnt/scripts, keeping the functional folders.

Layout

One folder per functional area:

Folder Purpose
docker/ Docker host helpers (config and volume backups)
infra/ Infrastructure helpers (Forgejo workflow dispatch, OCI VM bootstrap)
media/ Media library helpers (compression, CBR conversion, quarantine restore)
mediaserver/ Jellyfin / Tubearchivist helpers
o2/ Oracle Cloud (OCI) session capture and monitoring
stash/ Stash media management helpers
templates/ Jinja2 templates rendered by Ansible (retry-vm.sh.j2 → infra/)

Secrets

No credential is ever stored in this repository. Scripts read secrets in this order:

  1. Environment variable (GUARDOG_TOKEN, JELLYFIN_API_KEY, ES_PASSWORD).
  2. File in /etc/script-secrets/<name> (root:root, mode 0600), deployed by Ansible from the encrypted variables in group_vars/proxmox/vault.yml.
Secret file Variable Used by
/etc/script-secrets/guardog_token GUARDOG_TOKEN infra/trigger-guardog.sh
/etc/script-secrets/jellyfin_api_key JELLYFIN_API_KEY mediaserver/missing.py
/etc/script-secrets/es_password ES_PASSWORD mediaserver/ta_export.py

If a secret is missing the script fails fast with a clear error instead of sending an unauthenticated request.

Deployment

ansible-playbook playbook.yml --tags scripts

The role clones https://forgejo.caprichosdelucia.com/cescm/scripts.git into /mnt/repos/scripts (public repository, no credentials needed), copies the functional folders to /mnt/scripts and renders templates/retry-vm.sh.j2 into /mnt/scripts/infra/retry-vm.sh.

Adding a new script

  1. Put it in the folder that matches its function.
  2. Keep it idempotent and safe to re-run.
  3. Never hardcode credentials: use /etc/script-secrets/<name>.
  4. If it needs parameters from the infrastructure (OCI OCIDs, IPs), add a .j2 template under templates/ instead of hardcoding them in the script.
  5. Commit and push; the next Ansible run deploys it.

The same convention is recorded in AGENTS.md for AI agents working on this repository.