Snipe-IT¶
Asset management.
| Runtime | Container (Docker Swarm), 2 containers: app, db |
| Tier | Experimental |
| Node | swarm-media |
| Image | snipe/snipe-it:v8.6.3; mariadb:11.4 |
| URL | https://snipe-it.lab.riversfamily.uk |
| Auth | Native SAML (manual admin-UI step, see below) |
| Source | ansible/stacks/experimental/snipe-it/ |
Configuration¶
SAML only, and only through the admin UI (Settings > SAML), which persists to the database — there is no env or config-file surface. The service side is a one-time manual step after deploy:
- Enter the Authentik IdP metadata URL:
https://authentik.lab.riversfamily.uk/application/saml/snipe-it/metadata/ - Set the ACS URL:
https://snipe-it.lab.riversfamily.uk/saml/acs
The Authentik side is the declarative snipe-it-saml blueprint.
Volumes¶
| Volume | Path | Backing | Contents |
|---|---|---|---|
data |
/var/lib/snipeit |
Local | Uploaded assets/attachments |
database |
/var/lib/mysql |
Local | MariaDB data — never NFS |
Networking¶
app joins both the shared traefik network (for its Traefik route) and
this stack's private internal network. db joins internal only — it is
unreachable from every other stack.
Secrets¶
| Vault variable | Delivered as | Purpose |
|---|---|---|
vault_snipeit_db_password |
Swarm secret (MARIADB_PASSWORD_FILE on db); app reads the same value inline as DB_PASSWORD |
MariaDB password |
vault_snipeit_app_key |
Plain env var (APP_KEY), Laravel base64:-prefixed key |
App encryption key |
db also sets MARIADB_RANDOM_ROOT_PASSWORD: "yes".
Gotchas¶
- Deferred tier: these
vault_*variables live in the[DEFERRED]block ofvault.yml.example, not yet part of the live deploy. - SAML setup is entirely manual, post-deploy, through the admin UI — nothing automates this step.