kris/FRITA-infra
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

testing

Browse Source
This commit is contained in:
Kris Lamoureux
2025-06-06 12:36:28 -04:00
parent 236ec455cc
commit 6776923048
18 changed files with 408 additions and 145 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
roles/webserver/files/docker-compose.yml
View File

@@ -1,5 +1,3 @@
version: '3.5'
volumes:
wordpress:
nextcloud:
@@ -10,7 +8,7 @@ networks:
services:
traefik:
image: traefik:${TRAEFIK_VERSION:-latest}
image: ${TRAEFIK_IMAGE:-docker.io/library/traefik}:${TRAEFIK_VERSION:-latest}
restart: always
command:
- --api.dashboard=${TRAEFIK_DASHBOARD:-true}
@@ -20,7 +18,7 @@ services:
- --providers.docker.exposedbydefault=${TRAEFIK_EXPOSED_DEFAULT:-false}
- --entrypoints.web.address=:80
- --entrypoints.websecure.address=:443
- --entrypoints.local.address=:8443
- --entrypoints.local.address=:9443
- --entrypoints.web.http.redirections.entrypoint.to=websecure
- --entrypoints.web.http.redirections.entrypoint.scheme=https
- --entrypoints.web.http.redirections.entrypoint.permanent=true
@@ -33,9 +31,9 @@ services:
environment:
DREAMHOST_API_KEY: ${TRAEFIK_DREAMHOST_APIKEY}
ports:
- 80:80
- 443:443
- "127.0.0.1:8443:8443"
- 8080:80
- 8443:443
- "127.0.0.1:9443:9443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./.acme:/etc/letsencrypt
@@ -52,7 +50,7 @@ services:
- traefik
wordpress:
image: wordpress:${WORDPRESS_VERSION:-latest}
image: ${WORDPRESS_IMAGE:-docker.io/library/wordpress}:${WORDPRESS_VERSION:-latest}
restart: always
environment:
WORDPRESS_DB_HOST: ${WORDPRESS_DB_HOST:-host.docker.internal}
@@ -81,7 +79,7 @@ services:
- host.docker.internal:host-gateway
nextcloud:
image: nextcloud:${NEXTCLOUD_VERSION:-stable}
image: ${NEXTCLOUD_IMAGE:-docker.io/library/nextcloud}:${NEXTCLOUD_VERSION:-stable}
restart: always
environment:
MYSQL_HOST: ${NEXTCLOUD_MYSQL_HOST:-host.docker.internal:3306}

32
roles/webserver/handlers/main.yml
View File

@@ -4,11 +4,10 @@
state: restarted
listen: restart_mariadb
- name: Compose up on webserver stack
ansible.builtin.command: "docker-compose up -d"
args:
chdir: "{{ webserver_root }}"
listen: composeup_webserver
- name: Start podman compose project
ansible.builtin.command:
cmd: podman compose up -d
chdir: /home/oci/webserver
- name: Grab Nextcloud container information
community.docker.docker_container_info:
@@ -22,11 +21,12 @@
port: 80
listen: composeup_webserver
- name: Check Nextcloud status
ansible.builtin.command: "docker exec --user www-data {{ webserver_root | basename }}_nextcloud_1
php occ status"
listen: composeup_webserver
register: nextcloud_status
# - name: Check Nextcloud status
# ansible.builtin.command:
# "docker exec --user www-data {{ webserver_root | basename }}_nextcloud_1
# php occ status"
# listen: composeup_webserver
# register: nextcloud_status
- name: Import Nextcloud installation handlers
ansible.builtin.import_tasks: nextcloud.yml
@@ -34,3 +34,15 @@
when:
- nextcloud_status.stderr[:26] == "Nextcloud is not installed"
- nextcloud_autoinstall
- name: Import Webserver project handlers
ansible.builtin.import_tasks: webserver.yml
- name: Install webserver docker-compose.yml
ansible.builtin.copy:
src: docker-compose.yml
dest: /home/oci/webserver/compose.yml
mode: "600"
owner: oci
group: oci
notify: Generate systemd service files

27
roles/webserver/handlers/webserver.yml Normal file
View File

@@ -0,0 +1,27 @@
- name: Start podman compose project
ansible.builtin.command:
cmd: podman compose up -d
chdir: /home/oci/webserver
notify: Generate systemd service files
become_user: oci
- name: Generate systemd service files
ansible.builtin.command:
cmd: podman generate systemd --new --files --file /home/oci/webserver/compose.yml
chdir: "/home/oci/.config/systemd/user"
notify: Reload systemd user daemon
become_user: oci
- name: Reload systemd user daemon
ansible.builtin.systemd:
daemon_reload: true
scope: user
become_user: oci
notify: Enable systemd user service
- name: Enable systemd user service
ansible.builtin.systemd:
name: webserver
enabled: true
scope: user
become_user: oci

48
roles/webserver/tasks/debian.yml Normal file
View File

@@ -0,0 +1,48 @@
- name: Install MariaDB Server
ansible.builtin.apt:
name: mariadb-server
state: present
- name: Change the bind-address to allow Docker
ansible.builtin.lineinfile:
path: /etc/mysql/mariadb.conf.d/50-server.cnf
regex: "^bind-address"
line: "bind-address = 0.0.0.0"
notify: restart_mariadb
- name: Install MySQL Support for Python 3
ansible.builtin.apt:
name: python3-pymysql
state: present
- name: Create MariaDB databases
community.mysql.mysql_db:
name: "{{ item.name }}"
state: present
login_unix_socket: /var/run/mysqld/mysqld.sock
loop: "{{ databases }}"
no_log: true
- name: Create MariaDB users
community.mysql.mysql_user:
name: "{{ item.name }}"
password: "{{ item.pass }}"
host: "%"
state: present
priv: "{{ item.name }}.*:ALL"
login_unix_socket: /var/run/mysqld/mysqld.sock
loop: "{{ databases }}"
no_log: true
- name: Create webserver docker-compose directory
ansible.builtin.file:
path: "{{ webserver_root }}"
state: directory
mode: "600"
- name: Install webserver docker-compose.yml
ansible.builtin.copy:
src: docker-compose.yml
dest: "{{ webserver_root }}/docker-compose.yml"
mode: "600"
notify: composeup_webserver

77
roles/webserver/tasks/main.yml
View File

@@ -1,72 +1,7 @@
- name: Install MariaDB Server
ansible.builtin.apt:
name: mariadb-server
state: present
- name: Include Debian-specific tasks
ansible.builtin.include_tasks: debian.yml
when: ansible_os_family == "Debian"
- name: Change the bind-address to allow Docker
ansible.builtin.lineinfile:
path: /etc/mysql/mariadb.conf.d/50-server.cnf
regex: "^bind-address"
line: "bind-address = 0.0.0.0"
notify: restart_mariadb
- name: Install MySQL Support for Python 3
ansible.builtin.apt:
name: python3-pymysql
state: present
- name: Create MariaDB databases
community.mysql.mysql_db:
name: "{{ item.name }}"
state: present
login_unix_socket: /var/run/mysqld/mysqld.sock
loop: "{{ databases }}"
no_log: "{{ item.pass is defined }}"
- name: Create MariaDB users
community.mysql.mysql_user:
name: "{{ item.name }}"
password: "{{ item.pass }}"
host: '%'
state: present
priv: "{{ item.name }}.*:ALL"
login_unix_socket: /var/run/mysqld/mysqld.sock
loop: "{{ databases }}"
no_log: "{{ item.pass is defined }}"
- name: Create webserver docker-compose directory
ansible.builtin.file:
path: "{{ webserver_root }}"
state: directory
mode: 0600
- name: Install webserver docker-compose.yml
ansible.builtin.copy:
src: docker-compose.yml
dest: "{{ webserver_root }}/docker-compose.yml"
mode: 0600
notify: composeup_webserver
- name: Install docker-compose .env
ansible.builtin.template:
src: compose-env.j2
dest: "{{ webserver_root }}/.env"
mode: 0600
notify: composeup_webserver
- name: Allow MariaDB database connections
community.general.ufw:
rule: allow
port: 3306
proto: tcp
src: "{{ item }}"
loop: "{{ mariadb_trust }}"
- name: Add HTTP and HTTPS firewall rule
community.general.ufw:
rule: allow
port: "{{ item }}"
proto: tcp
loop:
- "80"
- "443"
- name: Include Rocky Linux-specific tasks
ansible.builtin.include_tasks: rocky.yml
when: ansible_os_family == "RedHat"

102
roles/webserver/tasks/rocky.yml Normal file
View File

@@ -0,0 +1,102 @@
- name: Install MariaDB Server
ansible.builtin.dnf:
name: mariadb-server
state: present
- name: Change the bind-address to allow Docker
ansible.builtin.lineinfile:
path: /etc/my.cnf.d/mariadb-server.cnf
regex: "^bind-address"
line: "bind-address = 0.0.0.0"
notify: restart_mariadb
- name: Start and enable MariaDB service
ansible.builtin.systemd:
name: mariadb
state: started
enabled: true
- name: Install MySQL Support for Python 3
ansible.builtin.dnf:
name: python3-PyMySQL
state: present
- name: Create MariaDB databases
community.mysql.mysql_db:
name: "{{ item.name }}"
state: present
login_unix_socket: /var/lib/mysql/mysql.sock
loop: "{{ databases }}"
no_log: true
- name: Create MariaDB users
community.mysql.mysql_user:
name: "{{ item.name }}"
password: "{{ item.pass }}"
host: "%"
state: present
priv: "{{ item.name }}.*:ALL"
login_unix_socket: /var/lib/mysql/mysql.sock
loop: "{{ databases }}"
no_log: true
- name: Create webserver stack directory
ansible.builtin.file:
path: /home/oci/webserver
state: directory
mode: "700"
owner: oci
group: oci
- name: Install webserver compose file
ansible.builtin.copy:
src: docker-compose.yml
dest: /home/oci/webserver/compose.yml
mode: "600"
owner: oci
group: oci
notify: Start podman compose project
- name: Generate webserver environment configuration
ansible.builtin.template:
src: compose-env.j2
dest: /home/oci/webserver/.env
mode: "644"
owner: oci
group: oci
notify: Start podman compose project
- name: Enable IP forwarding
ansible.posix.sysctl:
name: net.ipv4.ip_forward
value: '1'
state: present
reload: true
- name: Allow port 80 in firewall
ansible.posix.firewalld:
port: 80/tcp
permanent: true
state: enabled
immediate: true
- name: Forward port 80 to 8080
ansible.posix.firewalld:
rich_rule: 'rule family="ipv4" forward-port port="80" protocol="tcp" to-port="8080"'
permanent: true
state: enabled
immediate: true
- name: Allow port 443 in firewall
ansible.posix.firewalld:
port: 443/tcp
permanent: true
state: enabled
immediate: true
- name: Forward port 443 to 8443
ansible.posix.firewalld:
rich_rule: 'rule family="ipv4" forward-port port="443" protocol="tcp" to-port="8443"'
permanent: true
state: enabled
immediate: true