Session Handoff: Appwrite Stack Setup & Infrastructure Hardening

Date: 2026-03-14 Session Duration: ~4 hours Session Focus: Bring Appwrite stack to production-ready state on bab1.mgmt.toal.ca Context Usage at Handoff: ~70%

Current State

The install playbook is ready to run. All open questions from the session are resolved. The stack on bab1 is running but with an unpatched compose (no proxyProtocol, old entrypoint issue). One run of the playbook will bring everything current.

What Was Accomplished This Session

Appwrite .env Jinja2 template → playbooks/templates/appwrite.env.j2
Systemd unit template → playbooks/templates/appwrite.service.j2
Prometheus node exporter playbook → playbooks/install_node_exporter.yml
Appwrite inventory vars → ~/Dev/inventories/bab-inventory/host_vars/bab1.mgmt.toal.ca/appwrite.yml
Monitoring inventory vars → ~/Dev/inventories/bab-inventory/host_vars/bab1.mgmt.toal.ca/monitoring.yml
HashiCorp Vault secret lookups → ~/Dev/inventories/bab-inventory/host_vars/bab1.mgmt.toal.ca/secrets.yml
playbooks/install_appwrite.yml — .env deploy, systemd, tags (deps/image/configure), restart handler, production compose URL (appwrite.io/install/compose)
playbooks/tasks/patch_appwrite_compose.yml — Traefik 2.11.31 pin, image fix (appwrite-dev→official), forwardedHeaders + proxyProtocol trustedIPs for both entrypoints, handler notifications
playbooks/upgrade_appwrite.yml — docker prune after upgrade
requirements.yml — added community.hashi_vault
~/.ansible-navigator.yml — pipelining fixed (ANSIBLE_CONFIG file was never mounted into EE; replaced with environment-variables.set); SSH multiplexing, fact caching, profile_tasks via CALLBACKS_ENABLED
Deleted secrets.yml.example — contained plaintext secrets

Key Numbers

appwrite_version: "1.8.1"
appwrite_traefik_version: "2.11.31" — minimum for Docker Engine >= 29
appwrite_web_port: 8080, appwrite_websecure_port: 8443
appwrite_traefik_trusted_ips: "192.168.0.0/22" — HAProxy subnet; used for both forwardedHeaders.trustedIPs and proxyProtocol.trustedIPs
node_exporter_version: "1.9.0", node_exporter_port: 9100
Vault path: kv/data/oys/bab-appwrite (populated 2026-03-14)

Decisions Made

Decision	Rationale
HashiCorp Vault for secrets	AAP + dev both need access; 1Password ansible-vault is local-only
`appwrite.io/install/compose` as compose source	GitHub raw URL pointed to dev compose with `image: appwrite-dev` and broken entrypoint override
Traefik pinned to 2.11.31	Floating `traefik:2.11` tag incompatible with Docker Engine >= 29
`proxyProtocol.trustedIPs` on both Traefik entrypoints	HAProxy uses `send-proxy-v2` on both `appwrite` and `babdevapi` backends; without this Traefik returns 503
`_APP_DOMAIN_TARGET` added to .env template	Appwrite 1.8.x `console.php:49` constructs a `Domain` object from this var; null = crash
systemd `Type=oneshot RemainAfterExit=yes`	`docker compose up -d` exits after starting containers; oneshot keeps unit active
node exporter `security_opts: label=disable`	`:z` on `/` bind-mount would recursively relabel entire filesystem under RHEL 9 SELinux
`profile_tasks` via `ANSIBLE_CALLBACKS_ENABLED`	It's an aggregate callback, not a stdout callback; `ANSIBLE_STDOUT_CALLBACK=profile_tasks` causes `'sort_order'` error

What the NEXT Session Should Do

Run the install playbook (skipping deps and image pull since stack is already running):

ansible-navigator run playbooks/install_appwrite.yml --mode stdout --skip-tags deps,image

Verify curl -v https://appwrite.toal.ca returns 200 (not 503)
Verify Appwrite console loads without Domain::__construct() null error

Run node exporter:

ansible-navigator run playbooks/install_node_exporter.yml --mode stdout

Verify curl http://bab1.mgmt.toal.ca:9100/metrics returns Prometheus metrics

Open Questions

None. All issues from the session are resolved.

Files to Load Next Session

playbooks/install_appwrite.yml — if continuing install/configure work
playbooks/tasks/patch_appwrite_compose.yml — if debugging compose patches
docs/context/architecture.md — for Appwrite API or EDA work

4.3 KiB Raw Blame History