[infra] update dashmate configs and Fix ZeroSSL undefined variable ch…

[vivekgsharma]

• Add zmq configuration to core config (required by new dashmate schema)
• Add rsDapi configuration with metrics and logging
• Add deprecated flag for legacy DAPI control
• Fix ZeroSSL undefined variable checks in deployment tasks
• Add rs_dapi_image variable to support separate rs-dapi image versioning

Test completed on Testnet: Deployed on HPMN-16 and HPMN-21

Summary by CodeRabbit

• New Features

  • Added rsDapi service configuration with deploy settings, metrics (127.0.0.1:9091), and enhanced logging options.
  • Exposed Core ZMQ settings (host 0.0.0.0 with configurable port).

• Refactor

  • Updated DAPI build configuration (Dockerfile/target adjustments).
  • Introduced rsDapi alongside existing services and related sections.

• Bug Fixes

  • Improved ZeroSSL task conditions to avoid unnecessary certificate operations when configuration is unset or unchanged.

• Chores

  • Added configurable image selection for rsDapi.
  • Marked legacy DAPI block as deprecated (disabled by default).

[coderabbitai]

Walkthrough

Adds rs_dapi_image config, updates ZeroSSL Ansible tasks with stricter conditional gating, and extends dashmate.json template: adds core ZMQ settings, deprecates dapi block (disabled), revises dapi build config, and introduces a new rsDapi block with image selection, deploy, build, metrics, and logging settings.

Changes

Cohort / File(s)	Summary
Configuration Variables ansible/group_vars/all	Added new variable rs_dapi_image under DAPI configuration (dashpay/rs-dapi).
ZeroSSL Task Gating ansible/roles/dashmate/tasks/ssl/zerossl.yml	Replaced single condition with multiple when clauses: tasks now run only if dashmate_zerossl_config_certificate_id is defined and differs from dashmate_zerossl_ssm_certificate_id. Applied to SSM updates, reading key/CSR files, list setup, and per-file SSM updates.
Dashmate Template: rsDapi and related updates ansible/roles/dashmate/templates/dashmate.json.j2	Added core.settings.zmq (host 0.0.0.0, port dashd_zmq_port). Introduced dapi.deprecated.enabled: false. Updated dapi.build (Dockerfile path to Dockerfile, target dapi). Added rsDapi section: image from rs_dapi_image or derived from dapi_image, deploy replicas variable, build disabled with target rs-dapi, metrics (127.0.0.1:9091), logs (debug, non-JSON, access log config).

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant A as Ansible (zerossl tasks)
  participant C as Config Vars
  participant L as Local FS
  participant S as AWS SSM

  A->>C: Read dashmate_zerossl_config_certificate_id<br/>and dashmate_zerossl_ssm_certificate_id
  alt config id is defined AND differs from SSM id
    A->>S: Update SSM parameter with new certificate id
    A->>L: Read private key file
    A->>L: Read CSR file
    A->>A: Set list of CSR/private key files
    loop For each file in list
      A->>S: Update corresponding SSM parameter
    end
  else skip
    A-->>A: Skip all update/read tasks
  end

Loading

sequenceDiagram
  autonumber
  participant T as dashmate.json.j2 Template
  participant V as Ansible Vars
  participant D as Docker Runtime

  T->>V: Resolve rsDapi image (use rs_dapi_image<br/>or derive from dapi_image)
  T-->>D: Emit dapi build config (Dockerfile, target dapi)
  T-->>D: Emit rsDapi config (build disabled, target rs-dapi,<br/>deploy replicas var, metrics 127.0.0.1:9091, logs debug)
  T-->>D: Emit core ZMQ settings (0.0.0.0:dashd_zmq_port)
  T-->>D: Emit dapi.deprecated.enabled=false

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

I twitch my ears at configs new,
A ZMQ breeze, fresh ports in view.
rsDapi hops into the run,
With measured logs and metrics spun.
ZeroSSL checks, precise and neat—
Thump-thump! Our playbook skips on fleet. 🐇✨

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title succinctly describes the two main changes—updating dashmate configurations and fixing the ZeroSSL undefined variable check—without extraneous detail, making the primary intent clear to reviewers.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch vivek/dashmate_config_changes

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 21a21bb and 66f0766.

📒 Files selected for processing (3)

• ansible/group_vars/all (1 hunks)
• ansible/roles/dashmate/tasks/ssl/zerossl.yml (3 hunks)
• ansible/roles/dashmate/templates/dashmate.json.j2 (3 hunks)

🧰 Additional context used

📓 Path-based instructions (1)

ansible/**/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Use force flags (force_dashmate_rebuild, force_dashmate_reinstall, force_ssl_regenerate, force_logs_config, skip_dashmate_image_update) as manual overrides in Ansible playbooks and tasks when needed

Files:

• ansible/roles/dashmate/tasks/ssl/zerossl.yml

🧠 Learnings (2)

📓 Common learnings

Learnt from: CR
PR: dashpay/dash-network-deploy#0
File: CLAUDE.md:0-0
Timestamp: 2025-08-06T08:09:00.292Z
Learning: Applies to ansible/roles/dashmate/tasks/main.yml : Implement conditional execution for user/group checks, dash.conf generation, log configuration, and Docker image updates in `ansible/roles/dashmate/tasks/main.yml` based on fast mode flags

📚 Learning: 2025-08-06T08:09:00.292Z

Learnt from: CR
PR: dashpay/dash-network-deploy#0
File: CLAUDE.md:0-0
Timestamp: 2025-08-06T08:09:00.292Z
Learning: Applies to ansible/roles/dashmate/tasks/*.yml : Use `is defined` checks and conditional execution for variables such as `dashmate_group_check`, `dashmate_user_check`, `dash_conf_stat`, `dash_conf_changed`, `logrotate_config_stat`, `dashmate_update`, `dashmate_start_all`, `dashmate_restart_all`, `dashmate_install_result`, and `template_result` in Ansible tasks to prevent undefined variable errors

Applied to files:

• ansible/roles/dashmate/tasks/ssl/zerossl.yml

🔇 Additional comments (6)

ansible/group_vars/all (1)

44-44: LGTM!

The addition of rs_dapi_image is well-placed and follows the existing naming convention. This variable properly supports the new rs-dapi service configuration.

ansible/roles/dashmate/tasks/ssl/zerossl.yml (1)

104-106: LGTM! Critical fix for undefined variable handling.

The addition of dashmate_zerossl_config_certificate_id is defined checks prevents undefined variable errors when certificate renewal isn't needed. Since dashmate_zerossl_config_certificate_id is only set when dashmate_obtain has changed (lines 93-96), these tasks would fail without this guard condition. The fix is consistently applied across all five dependent tasks.

Based on learnings.

Also applies to: 112-114, 120-122, 131-133, 142-144

ansible/roles/dashmate/templates/dashmate.json.j2 (4)

148-151: LGTM!

The ZMQ configuration addition correctly exposes the ZMQ interface on all interfaces (0.0.0.0) using the configured port. This aligns with the PR objective to add ZMQ configuration required by the new dashmate schema.

---

235-237: LGTM!

The deprecated flag properly marks the legacy DAPI control as deprecated with enabled: false, aligning with the PR objective to deprecate legacy DAPI functionality.

---

247-249: LGTM!

The updated docker build configuration correctly references the consolidated Dockerfile with the dapi target, supporting a multi-stage build approach. This aligns with the new rsDapi configuration pattern.

---

252-276: rsDapi image fallback is never used
The rs_dapi_image variable is set in ansible/group_vars/all, so the regex fallback branch is never executed by default—no changes needed.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ktechmidas]

LGTM