kris/homelab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

testing

Browse Source
This commit is contained in:
Kris Lamoureux
2022-05-26 22:26:35 -04:00
parent 209ff57a4a
commit 2fc770ab0c
20 changed files with 221 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
ansible.cfg
View File

@@ -1,3 +1,6 @@
[defaults]
inventory = ./environments/development
interpreter_python = /usr/bin/python3
[connection]
pipelining = true

6
dev/host_vars/proxy.yml
View File

@@ -17,7 +17,7 @@ proxy:
- domain: "{{ bitwarden_domain }}"
proxy_pass: "http://127.0.0.1:8080"
- domain: "{{ gitea_domain }}"
proxy_pass: "http://127.0.0.1:3080"
proxy_pass: "http://127.0.0.1:3000"
# docker
docker_users:
@@ -34,8 +34,4 @@ bitwarden_install_key: 1yB3Z2gRI0KnnH90C6p
# gitea
gitea_domain: "git.{{ base_domain }}"
gitea_version: 1
gitea_dbversion: latest
gitea_dbpass: password
gitea_ports:
- "222:22"
- "3080:3000"

3
dev/proxy.yml
View File

@@ -5,7 +5,8 @@
- host_vars/proxy.yml
roles:
- base
- postgresql
- proxy
- docker
- bitwarden
- gitea
- bitwarden

1
roles/.gitignore vendored
View File

@@ -10,6 +10,7 @@
!minecraft*/
!nextcloud*/
!nginx*/
!postgresql*/
!prometheus*/
!proxy*/
!rsnapshot*/

7
roles/base/tasks/ansible.yml
View File

@@ -13,3 +13,10 @@
loop:
- aptitude
- python3-docker
- python3-psycopg2
- name: Create Ansible's temporary remote directory
file:
path: "~/.ansible/tmp"
state: directory
mode: 0700

2
roles/bitwarden/defaults/main.yml
View File

@@ -1,5 +1,5 @@
bitwarden_name: bitwarden
bitwarden_root: "/opt/{{ bitwarden_name }}"
bitwarden_root: "{{ docker_root }}/{{ bitwarden_name }}"
bitwarden_database: "{{ bitwarden_name }}"
bitwarden_standalone: false
bitwarden_production: false

15
roles/bitwarden/handlers/main.yml
View File

@@ -1,7 +1,16 @@
- name: Stop Bitwarden for rebuild
service:
name: "{{ bitwarden_name }}"
state: stopped
listen: rebuild_bitwarden
- name: Rebuild Bitwarden
shell: "{{ bitwarden_root }}/bitwarden.sh rebuild"
listen: rebuild_bitwarden
- name: Start Bitwarden
shell: "{{ bitwarden_root }}/bitwarden.sh start"
listen: start_bitwarden
- name: Start Bitwarden after rebuild
service:
name: "{{ bitwarden_name }}"
state: started
enabled: true
listen: rebuild_bitwarden

34
roles/bitwarden/tasks/main.yml
View File

@@ -25,16 +25,13 @@
shell: "{{ bitwarden_root }}/bw_wrapper"
args:
creates: "{{ bitwarden_root }}/bwdata/config.yml"
notify: start_bitwarden
- name: Install docker-compose override
template:
src: compose.override.yml.j2
dest: "{{ bitwarden_root }}/bwdata/docker/docker-compose.override.yml"
when: traefik_version is defined
notify:
- rebuild_bitwarden
- start_bitwarden
notify: rebuild_bitwarden
- name: Disable bitwarden-nginx HTTP on 80
replace:
@@ -42,9 +39,7 @@
regexp: "^http_port: 80$"
replace: "http_port: 8080"
when: not bitwarden_standalone
notify:
- rebuild_bitwarden
- start_bitwarden
notify: rebuild_bitwarden
- name: Disable bitwarden-nginx HTTPS on 443
replace:
@@ -52,9 +47,7 @@
regexp: "^https_port: 443$"
replace: "https_port: 8443"
when: not bitwarden_standalone
notify:
- rebuild_bitwarden
- start_bitwarden
notify: rebuild_bitwarden
- name: Disable Bitwarden managed Lets Encrypt
replace:
@@ -62,9 +55,7 @@
regexp: "^ssl_managed_lets_encrypt: true$"
replace: "ssl_managed_lets_encrypt: false"
when: not bitwarden_standalone or not bitwarden_production
notify:
- rebuild_bitwarden
- start_bitwarden
notify: rebuild_bitwarden
- name: Disable Bitwarden managed SSL
replace:
@@ -72,6 +63,17 @@
regexp: "^ssl: true$"
replace: "ssl: false"
when: not bitwarden_standalone
notify:
- rebuild_bitwarden
- start_bitwarden
notify: rebuild_bitwarden
- name: Install Bitwarden systemd service
template:
src: bitwarden.service.j2
dest: "/etc/systemd/system/{{ bitwarden_name }}.service"
register: bitwarden_systemd
notify: rebuild_bitwarden
- name: Reload systemd manager configuration
systemd:
daemon_reload: true
when: bitwarden_systemd.changed
notify: rebuild_bitwarden

13
roles/bitwarden/templates/bitwarden.service.j2 Normal file
View File

@@ -0,0 +1,13 @@
[Unit]
Description=Bitwarden Password Manager Server
PartOf=docker.service
After=docker.service
[Service]
Type=oneshot
RemainAfterExit=true
ExecStart={{ bitwarden_root }}/bitwarden.sh start
ExecStop={{ bitwarden_root }}/bitwarden.sh stop
[Install]
WantedBy=multi-user.target

3
roles/docker/defaults/main.yml Normal file
View File

@@ -0,0 +1,3 @@
docker_root: /var/lib/docker-compose
docker_compose: /usr/bin/docker-compose
docker_compose_service: compose

16
roles/docker/tasks/main.yml
View File

@@ -4,6 +4,22 @@
state: present
update_cache: true
- name: Create docker-compose root
file:
path: "{{ docker_root }}"
state: directory
- name: Install docker-compose systemd service
template:
src: docker-compose.service.j2
dest: "/etc/systemd/system/{{ docker_compose_service }}@.service"
register: compose_systemd
- name: Reload systemd manager configuration
systemd:
daemon_reload: true
when: compose_systemd.changed
- name: Add users to docker group
user:
name: "{{ item }}"

14
roles/docker/templates/docker-compose.service.j2 Normal file
View File

@@ -0,0 +1,14 @@
[Unit]
Description=%i docker-compose service
PartOf=docker.service
After=docker.service
[Service]
Type=oneshot
RemainAfterExit=true
WorkingDirectory={{ docker_root }}/%i
ExecStart={{ docker_compose }} up -d --remove-orphans
ExecStop={{ docker_compose }} down
[Install]
WantedBy=multi-user.target

15
roles/gitea/defaults/main.yml
View File

@@ -1,11 +1,16 @@
# container settings
gitea_name: gitea
gitea_dbname: "{{ gitea_name }}-db"
gitea_ports: "222:22"
gitea_sshport: "127.0.0.1:222"
gitea_webport: "127.0.0.1:3000"
gitea_volume: "{{ gitea_name }}"
gitea_rooturl: "http://{{ gitea_domain }}"
gitea_signup: true
# database settings
gitea_dbuser: "{{ gitea_dbname }}"
gitea_dbtype: postgres
gitea_dbhost: host.docker.internal
gitea_dbname: "{{ gitea_name }}"
gitea_dbuser: "{{ gitea_name }}"
# host
gitea_root: "/opt/{{ gitea_name }}/data"
gitea_dbroot: "/opt/{{ gitea_name }}/database"
gitea_root: "{{ docker_root }}/{{ gitea_name }}"

109
roles/gitea/tasks/main.yml
View File

@@ -1,85 +1,34 @@
- name: Create Gitea Network
docker_network:
name: "{{ gitea_name }}"
- name: Create Gitea directory
file:
path: "{{ gitea_root }}"
state: directory
- name: Start Gitea's database container
docker_container:
- name: Create gitea database
postgresql_db:
name: "{{ gitea_dbname }}"
image: mariadb:{{ gitea_dbversion }}
state: started
restart_policy: always
volumes: "{{ gitea_dbroot }}:/var/lib/mysql"
container_default_behavior: "no_defaults"
networks_cli_compatible: true
networks:
- name: "{{ gitea_name }}"
env:
MYSQL_RANDOM_ROOT_PASSWORD: "true"
MYSQL_DATABASE: "{{ gitea_dbname }}"
MYSQL_USER: "{{ gitea_dbuser }}"
MYSQL_PASSWORD: "{{ gitea_dbpass }}"
become: true
become_user: postgres
- name: Start Gitea container (traefik routing)
docker_container:
name: "{{ gitea_name }}"
image: gitea/gitea:{{ gitea_version }}
state: started
restart_policy: always
container_default_behavior: "no_defaults"
networks_cli_compatible: true
ports: "{{ gitea_ports }}"
networks:
- name: "{{ gitea_name }}"
- name: traefik
volumes:
- "{{ gitea_root }}:/data"
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
env:
USER_UID: "1000"
USER_GID: "1000"
DB_TYPE: mysql
DB_HOST: "{{ gitea_dbname }}"
DB_NAME: "{{ gitea_dbname }}"
DB_USER: "{{ gitea_dbuser }}"
DB_PASSWD: "{{ gitea_dbpass }}"
ROOT_URL: "https://{{ gitea_domain }}/"
SSH_DOMAIN: "{{ gitea_domain }}"
DOMAIN: "{{ gitea_domain }}"
labels:
traefik.http.routers.gitea.rule: "Host(`{{ gitea_domain }}`)"
traefik.http.routers.gitea.entrypoints: websecure
traefik.http.routers.gitea.tls.certresolver: letsencrypt
traefik.http.routers.gitea.middlewares: "securehttps@file"
traefik.http.services.gitea.loadbalancer.server.port: "3000"
traefik.docker.network: traefik
traefik.enable: "true"
when: traefik_version is defined
- name: Create gitea database user
postgresql_user:
db: "{{ gitea_dbname }}"
name: "{{ gitea_dbuser }}"
password: "{{ gitea_dbpass }}"
become: true
become_user: postgres
- name: Start Gitea container
docker_container:
name: "{{ gitea_name }}"
image: gitea/gitea:{{ gitea_version }}
- name: Install Gitea's docker-compose file
template:
src: docker-compose.yml.j2
dest: "{{ gitea_root }}/docker-compose.yml"
- name: Install Gitea's docker-compose variables
template:
src: compose-env.j2
dest: "{{ gitea_root }}/.env"
- name: Start and enable Gitea service
service:
name: "{{ docker_compose_service }}@{{ gitea_name }}"
state: started
restart_policy: always
container_default_behavior: "no_defaults"
networks_cli_compatible: true
ports: "{{ gitea_ports }}"
networks:
- name: "{{ gitea_name }}"
volumes:
- "{{ gitea_root }}:/data"
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
env:
USER_UID: "1000"
USER_GID: "1000"
DB_TYPE: mysql
DB_HOST: "{{ gitea_dbname }}"
DB_NAME: "{{ gitea_dbname }}"
DB_USER: "{{ gitea_dbuser }}"
DB_PASSWD: "{{ gitea_dbpass }}"
ROOT_URL: "https://{{ gitea_domain }}/"
SSH_DOMAIN: "{{ gitea_domain }}"
DOMAIN: "{{ gitea_domain }}"
when: traefik_version is not defined
enabled: true

17
roles/gitea/templates/compose-env.j2 Normal file
View File

@@ -0,0 +1,17 @@
# {{ ansible_managed }}
gitea_version={{ gitea_version }}
gitea_name={{ gitea_name }}
gitea_domain={{ gitea_domain }}
gitea_rooturl={{ gitea_rooturl }}
gitea_webport={{ gitea_webport }}
gitea_sshport={{ gitea_sshport }}
gitea_dbtype={{ gitea_dbtype }}
gitea_dbhost={{ gitea_dbhost }}
gitea_dbname={{ gitea_dbname }}
gitea_dbuser={{ gitea_dbuser }}
gitea_dbpass={{ gitea_dbpass }}
{% if not gitea_signup %}
gitea_disable_registration=true
{% else %}
gitea_disable_registration=false
{% endif %}

30
roles/gitea/templates/docker-compose.yml.j2 Normal file
View File

@@ -0,0 +1,30 @@
version: '3.7'
services:
gitea:
image: "gitea/gitea:${gitea_version}"
container_name: "${gitea_name}"
ports:
- "${gitea_sshport}:22"
- "${gitea_webport}:3000"
extra_hosts:
- "host.docker.internal:host-gateway"
environment:
- USER_UID=1000
- USER_GID=1000
- GITEA__server__ROOT_URL=${gitea_rooturl}
- GITEA__server__DOMAIN=${gitea_domain}
- GITEA__server__SSH_DOMAIN=${gitea_domain}
- GITEA__database__DB_TYPE=${gitea_dbtype}
- GITEA__database__HOST=${gitea_dbhost}
- GITEA__database__NAME=${gitea_dbname}
- GITEA__database__USER=${gitea_dbuser}
- GITEA__database__PASSWD=${gitea_dbpass}
- GITEA__service__DISABLE_REGISTRATION=${gitea_disable_registration}
volumes:
- {{ gitea_volume }}:/data
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
volumes:
{{ gitea_volume }}:

2
roles/postgresql/defaults/main.yml Normal file
View File

@@ -0,0 +1,2 @@
postgresql_config: /etc/postgresql/13/main/pg_hba.conf
postgresql_listen: "*"

34
roles/postgresql/tasks/main.yml Normal file
View File

@@ -0,0 +1,34 @@
- name: Install PostgreSQL
apt:
name: postgresql
state: present
- name: Trust connections to PostgreSQL from Docker
postgresql_pg_hba:
dest: "{{ postgresql_config }}"
contype: host
databases: all
users: all
address: "172.16.0.0/12"
method: trust
register: postgresql_hba
- name: Change PostgreSQL listen addresses
postgresql_set:
name: listen_addresses
value: "{{ postgresql_listen }}"
become: true
become_user: postgres
register: postgresql_config
- name: Reload PostgreSQL
service:
name: postgresql
state: reloaded
when: postgresql_hba.changed and not postgresql_config.changed
- name: Restart PostgreSQL
service:
name: postgresql
state: restarted
when: postgresql_config.changed

1
roles/proxy/tasks/main.yml
View File

@@ -62,6 +62,7 @@
file:
path: /etc/letsencrypt/renewal-hooks/post
state: directory
when: proxy.production is defined and proxy.production
- name: Install nginx post renewal hook
copy:

7
roles/proxy/templates/server-nginx.conf.j2
View File

@@ -1,3 +1,10 @@
server {
listen 80;
server_name {{ item.domain }};
return 301 https://{{ item.domain }}$request_uri;
}
server {
listen 443 ssl;
server_name {{ item.domain }};