cbalders/homelab-ansible-lxc-meridian
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: sync Infisical secret paths to the two-level tree

Browse Source 
Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Your Name
2026-08-02 17:14:43 -04:00
co-authored by Claude Opus 4.8
parent 54a561854c
commit 40b512dd96
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+6 -6
View File
@@ -24,7 +24,7 @@ Two services on one LXC, sharing one Claude Max OAuth subscription:
- **Meridian**: Node 22 from NodeSource apt + `npm i -g @rynfar/meridian`. systemd unit `meridian.service` as user `meridian`, bound to `0.0.0.0:3456`, `HOME=/opt/meridian`. - **Meridian**: Node 22 from NodeSource apt + `npm i -g @rynfar/meridian`. systemd unit `meridian.service` as user `meridian`, bound to `0.0.0.0:3456`, `HOME=/opt/meridian`.
- **LiteLLM**: Python venv at `/opt/litellm/venv` + `pip install 'litellm[proxy]'`. systemd unit `litellm.service` as user `litellm`, bound to `0.0.0.0:4000`. `Requires=meridian.service` so it can't outlive the backend. - **LiteLLM**: Python venv at `/opt/litellm/venv` + `pip install 'litellm[proxy]'`. systemd unit `litellm.service` as user `litellm`, bound to `0.0.0.0:4000`. `Requires=meridian.service` so it can't outlive the backend.
- **OAuth credentials** at `/opt/meridian/.claude/` (mode 0700, owned by `meridian`). - **OAuth credentials** at `/opt/meridian/.claude/` (mode 0700, owned by `meridian`).
- **LITELLM_MASTER_KEY** at `/opt/litellm/litellm.env` (mode 0600, owned by `litellm`). Source of truth in Infisical `/meridian/vault_litellm_master_key`. Pulled by `deploy.sh` on the controller and exported for the playbook to consume. - **LITELLM_MASTER_KEY** at `/opt/litellm/litellm.env` (mode 0600, owned by `litellm`). Source of truth in Infisical `/apps/meridian/vault_litellm_master_key`. Pulled by `deploy.sh` on the controller and exported for the playbook to consume.
- **No Caddy, no Cloudflare.** Both ports exposed via the same UDM alias `meridian.lan.balders.ca → .164`. - **No Caddy, no Cloudflare.** Both ports exposed via the same UDM alias `meridian.lan.balders.ca → .164`.
## Bootstrap ## Bootstrap
@@ -69,7 +69,7 @@ Two services on one LXC, sharing one Claude Max OAuth subscription:
``` ```
6. Smoke via LiteLLM (OpenAI format, master-key auth): 6. Smoke via LiteLLM (OpenAI format, master-key auth):
```bash ```bash
KEY=$(infisical secrets get vault_litellm_master_key --env prod --path /meridian --plain) KEY=$(infisical secrets get vault_litellm_master_key --env prod --path /apps/meridian --plain)
curl http://192.168.1.164:4000/v1/chat/completions \ curl http://192.168.1.164:4000/v1/chat/completions \
-H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' \ -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' \
-d '{"model":"claude-haiku-4-5","max_tokens":40,"messages":[{"role":"user","content":"reply with the single word: pong"}]}' -d '{"model":"claude-haiku-4-5","max_tokens":40,"messages":[{"role":"user","content":"reply with the single word: pong"}]}'
@@ -79,7 +79,7 @@ Two services on one LXC, sharing one Claude Max OAuth subscription:
Pulled from Infisical at deploy time (`infisical.vault.read_secrets` in `site.yml`): Pulled from Infisical at deploy time (`infisical.vault.read_secrets` in `site.yml`):
**`/meridian/`** **`/apps/meridian/`**
- `vault_litellm_master_key` — LiteLLM proxy master key (required; sanity-checked in `site.yml`) - `vault_litellm_master_key` — LiteLLM proxy master key (required; sanity-checked in `site.yml`)
- `vault_openai_api_key` — OpenAI key for LiteLLM `direct_*` models (optional, `default('')`) - `vault_openai_api_key` — OpenAI key for LiteLLM `direct_*` models (optional, `default('')`)
- `vault_gemini_api_key` — Gemini key for LiteLLM `direct_*` models (optional, `default('')`) - `vault_gemini_api_key` — Gemini key for LiteLLM `direct_*` models (optional, `default('')`)
@@ -97,8 +97,8 @@ Available model aliases (same on both endpoints, all backed by Claude Max): `cla
```bash ```bash
# vault_pulse_admin_token (possibly stale — verify before removing; not read by the playbook, manual recipe only) # vault_pulse_admin_token (possibly stale — verify before removing; not read by the playbook, manual recipe only)
PULSE_ADMIN_TOKEN=$(infisical secrets get vault_pulse_admin_token --env prod --path /pulse --plain) PULSE_ADMIN_TOKEN=$(infisical secrets get vault_pulse_admin_token --env prod --path /automation/pulse --plain)
LITELLM_KEY=$(infisical secrets get vault_litellm_master_key --env prod --path /meridian --plain) LITELLM_KEY=$(infisical secrets get vault_litellm_master_key --env prod --path /apps/meridian --plain)
curl -X POST https://pulse.balders.ca/api/settings/ai/update \ curl -X POST https://pulse.balders.ca/api/settings/ai/update \
-H "X-API-Token: $PULSE_ADMIN_TOKEN" -H 'Content-Type: application/json' \ -H "X-API-Token: $PULSE_ADMIN_TOKEN" -H 'Content-Type: application/json' \
-d "{\"provider\":\"openai\",\"openai_api_key\":\"$LITELLM_KEY\",\"openai_base_url\":\"http://meridian.lan.balders.ca:4000/v1\",\"model\":\"claude-haiku-4-5\",\"enabled\":true}" -d "{\"provider\":\"openai\",\"openai_api_key\":\"$LITELLM_KEY\",\"openai_base_url\":\"http://meridian.lan.balders.ca:4000/v1\",\"model\":\"claude-haiku-4-5\",\"enabled\":true}"
@@ -112,7 +112,7 @@ curl -X POST https://pulse.balders.ca/api/ai/test -H "X-API-Token: $PULSE_ADMIN_
- **Subsequent deploys**: via Semaphore template "Meridian Deploy" (scheduled Sun 02:55 EDT). `LITELLM_MASTER_KEY` is auto-reconciled into Semaphore environment 4 by `homelab-ansible-lxc-semaphore/scripts/sync-semaphore-state.py` (merge-only `ENVIRONMENT_KEYS` step). - **Subsequent deploys**: via Semaphore template "Meridian Deploy" (scheduled Sun 02:55 EDT). `LITELLM_MASTER_KEY` is auto-reconciled into Semaphore environment 4 by `homelab-ansible-lxc-semaphore/scripts/sync-semaphore-state.py` (merge-only `ENVIRONMENT_KEYS` step).
- **Token refresh**: handled automatically by the Claude Code SDK. Manual fallback: `sudo -u meridian /usr/bin/meridian refresh-token`. - **Token refresh**: handled automatically by the Claude Code SDK. Manual fallback: `sudo -u meridian /usr/bin/meridian refresh-token`.
- **Restart after creds change**: `sudo systemctl restart meridian` (LiteLLM follows automatically via `Requires=`). - **Restart after creds change**: `sudo systemctl restart meridian` (LiteLLM follows automatically via `Requires=`).
- **Rotate master key**: update `/meridian/vault_litellm_master_key` in Infisical, redeploy, update consumers (Pulse, paperless-ai, etc.). - **Rotate master key**: update `/apps/meridian/vault_litellm_master_key` in Infisical, redeploy, update consumers (Pulse, paperless-ai, etc.).
- **Logs**: `journalctl -u meridian -f` / `journalctl -u litellm -f`. - **Logs**: `journalctl -u meridian -f` / `journalctl -u litellm -f`.
## Files ## Files