Add port forward script and WordPress

- Added Makefile
- Added UFW firewall

roles/common/tasks/main.yml

@@ -0,0 +1,30 @@
+- name: Create Ansible's temporary remote directory
+  ansible.builtin.file:
+    path: "~/.ansible/tmp"
+    state: directory
+    mode: 0700
+
+- name: Install the Uncomplicated Firewall
+  ansible.builtin.apt:
+    name: ufw
+    state: present
+    update_cache: true
+
+- name: Deny incoming traffic by default
+  community.general.ufw:
+    default: deny
+    direction: incoming
+
+- name: Allow outgoing traffic by default
+  community.general.ufw:
+    default: allow
+    direction: outgoing
+
+- name: Allow OpenSSH with rate limiting
+  community.general.ufw:
+    name: ssh
+    rule: limit
+
+- name: Enable firewall
+  community.general.ufw:
+    state: enabled

roles/docker/tasks/main.yml

@@ -2,7 +2,6 @@
   ansible.builtin.apt:
     name: ['docker.io', 'docker-compose']
     state: present
-    update_cache: true
 
 - name: Create docker-compose root
   ansible.builtin.file:

roles/webserver/defaults/main.yml

@@ -1 +1,4 @@
 webserver_root: "{{ docker_compose_root }}/webserver"
+mariadb_trust:
+  - "172.16.0.0/12"
+  - "192.168.0.0/16"

roles/webserver/files/docker-compose.yml

@@ -1,5 +1,8 @@
 version: '3.5'
 
+volumes:
+  wordpress:
+
 networks:
   traefik:
     name: traefik
@@ -7,10 +10,12 @@ networks:
 services:
   traefik:
     image: traefik:${TRAEFIK_VERSION:-latest}
+    restart: always
     command:
       - --api.dashboard=${TRAEFIK_DASHBOARD:-true}
       - --api.debug=${TRAEFIK_DEBUG:-false}
       - --providers.docker=true
+      - --providers.docker.exposedbydefault=${TRAEFIK_EXPOSED_DEFAULT:-false}
       - --entrypoints.web.address=:80
       - --entrypoints.web.http.redirections.entrypoint.to=websecure
       - --entrypoints.web.http.redirections.entrypoint.scheme=https
@@ -28,5 +33,28 @@ services:
       traefik.http.routers.api.entrypoints: local
       traefik.http.routers.api.service: api@internal
       traefik.http.routers.api.tls: true
+      traefik.enable: ${TRAEFIK_WEB_ENABLED:-true}
     networks:
       - traefik
+
+  wordpress:
+    image: wordpress:${WORDPRESS_VERSION:-latest}
+    restart: always
+    environment:
+      WORDPRESS_DB_HOST: ${WORDPRESS_DB_HOST:-host.docker.internal}
+      WORDPRESS_DB_NAME: ${WORDPRESS_DB_NAME-wordpress}
+      WORDPRESS_DB_USER: ${WORDPRESS_DB_USER:-wordpress}
+      WORDPRESS_DB_PASSWORD: ${WORDPRESS_DB_PASSWORD}
+    labels:
+      traefik.http.routers.wordpress.rule: Host(`${WORDPRESS_DOMAIN:-www.local.freeitathens.org}`)
+      traefik.http.routers.wordpress.entrypoints: websecure
+      traefik.http.routers.wordpress.tls: true
+      traefik.http.services.wordpress.loadbalancer.server.port: 80
+      traefik.docker.network: traefik
+      traefik.enable: ${WORDPRESS_WEB_ENABLED:-true}
+    volumes:
+      - wordpress:/var/www/html
+    networks:
+      - traefik
+    extra_hosts:
+      - host.docker.internal:host-gateway

roles/webserver/handlers/main.yml

@@ -3,3 +3,9 @@
   args:
     chdir: "{{ webserver_root }}"
   listen: composeup_webserver
+
+- name: Restart MariaDB
+  ansible.builtin.service:
+    name: mariadb
+    state: restarted
+  listen: restart_mariadb

roles/webserver/tasks/main.yml

@@ -3,6 +3,37 @@
     name: mariadb-server
     state: present
 
+- name: Change the bind-address to allow Docker
+  ansible.builtin.lineinfile:
+    path: /etc/mysql/mariadb.conf.d/50-server.cnf
+    regex: "^bind-address"
+    line: "bind-address            = 0.0.0.0"
+  notify: restart_mariadb
+
+- name: Install MySQL Support for Python 3
+  ansible.builtin.apt:
+    name: python3-pymysql
+    state: present
+
+- name: Create MariaDB databases
+  community.mysql.mysql_db:
+    name: "{{ item.name }}"
+    state: present
+    login_unix_socket: /var/run/mysqld/mysqld.sock
+  loop: "{{ databases }}"
+  no_log: "{{ item.pass is defined }}"
+
+- name: Create MariaDB users
+  community.mysql.mysql_user:
+    name: "{{ item.name }}"
+    password: "{{ item.pass }}"
+    host: '%'
+    state: present
+    priv: "{{ item.name }}.*:ALL"
+    login_unix_socket: /var/run/mysqld/mysqld.sock
+  loop: "{{ databases }}"
+  no_log: "{{ item.pass is defined }}"
+
 - name: Create webserver docker-compose directory
   ansible.builtin.file:
     path: "{{ webserver_root }}"
@@ -22,3 +53,20 @@
     dest: "{{ webserver_root }}/.env"
     mode: 0600
   notify: composeup_webserver
+
+- name: Allow MariaDB database connections
+  community.general.ufw:
+    rule: allow
+    port: 3306
+    proto: tcp
+    src: "{{ item }}"
+  loop: "{{ mariadb_trust }}"
+
+- name: Add HTTP and HTTPS firewall rule
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop:
+    - "80"
+    - "443"

roles/webserver/templates/compose-env.j2

@@ -1,4 +1,4 @@
 # {{ ansible_managed }}
-{% for key, value in webserver_env.items() %}
+{% for key, value in webserver.items() %}
 {{ key }}={{ value }}
 {% endfor %}