Update Gitea role for docker_compose_deploy

- Add MariaDB to dev playbook
- Set Git user in "users:"
- Define Gitea external compose project
- Forward SSH port in forwarding script
- Create user groups with system users
- Install python3-pymysql for Ansible
- Strip old Gitea deployment methods
- Bind MariaDB to docker0 for Docker access
This commit is contained in:
Kris Lamoureux 2023-10-20 15:41:44 -04:00
parent c3b4321667
commit 7adb5f10e9
Signed by: kris
GPG Key ID: 3EDA9C3441EDA925
9 changed files with 68 additions and 63 deletions

View File

@ -6,4 +6,5 @@
roles: roles:
- base - base
- docker - docker
- mariadb
- gitea - gitea

View File

@ -2,6 +2,12 @@
allow_reboot: false allow_reboot: false
manage_network: false manage_network: false
users:
git:
uid: 1001
gid: 1001
home: true
# Import my GPG key for git signature verification # Import my GPG key for git signature verification
root_gpgkeys: root_gpgkeys:
- name: kris@lamoureux.io - name: kris@lamoureux.io
@ -16,10 +22,24 @@ docker_compose_deploy:
# Traefik # Traefik
- name: traefik - name: traefik
url: https://github.com/krislamo/traefik url: https://github.com/krislamo/traefik
version: 31ee724feebc1d5f91cb17ffd6892c352537f194 version: 398eb48d311db78b86abf783f903af4a1658d773
enabled: true enabled: true
accept_newhostkey: true # Consider verifying manually instead accept_newhostkey: true
trusted_keys: trusted_keys:
- FBF673CEEC030F8AECA814E73EDA9C3441EDA925 - FBF673CEEC030F8AECA814E73EDA9C3441EDA925
env: env:
ENABLE: true ENABLE: true
# Gitea
- name: gitea
url: https://github.com/krislamo/gitea
version: b0ce66f6a1ab074172eed79eeeb36d7e9011ef8f
env:
USER_UID: "{{ users.git.uid }}"
USER_GID: "{{ users.git.gid }}"
DB_PASSWD: "{{ gitea.DB_PASSWD }}"
# gitea
gitea:
DB_NAME: gitea
DB_USER: gitea
DB_PASSWD: password

View File

@ -23,9 +23,10 @@ function ssh_connect {
[yY]) [yY])
printf "[INFO]: Starting new vagrant SSH tunnel on PID " printf "[INFO]: Starting new vagrant SSH tunnel on PID "
sudo -u "$USER" ssh -fNT -i "$PRIVATE_KEY" \ sudo -u "$USER" ssh -fNT -i "$PRIVATE_KEY" \
-L 8443:localhost:8443 \ -L 22:localhost:22 \
-L 80:localhost:80 \ -L 80:localhost:80 \
-L 443:localhost:443 \ -L 443:localhost:443 \
-L 8443:localhost:8443 \
-o UserKnownHostsFile=/dev/null \ -o UserKnownHostsFile=/dev/null \
-o StrictHostKeyChecking=no \ -o StrictHostKeyChecking=no \
vagrant@"$HOST_IP" 2>/dev/null vagrant@"$HOST_IP" 2>/dev/null

View File

@ -27,4 +27,4 @@
ansible.builtin.service: ansible.builtin.service:
name: smbd name: smbd
state: restarted state: restarted
listen: restart_samba listen: restart_samba

View File

@ -66,13 +66,27 @@
mode: 0400 mode: 0400
when: authorized_keys is defined when: authorized_keys is defined
- name: Create system user groups
ansible.builtin.group:
name: "{{ item.key }}"
gid: "{{ item.value.gid }}"
state: present
loop: "{{ users | dict2items }}"
loop_control:
label: "{{ item.key }}"
when: users is defined
- name: Create system users - name: Create system users
ansible.builtin.user: ansible.builtin.user:
name: "{{ item.name }}" name: "{{ item.key }}"
state: present state: present
shell: "{{ item.shell | default('/bin/bash') }}" uid: "{{ item.value.uid }}"
create_home: "{{ item.home | default(false) }}" group: "{{ item.value.gid }}"
loop: "{{ users }}" shell: "{{ item.value.shell | default('/bin/bash') }}"
create_home: "{{ item.value.home | default(false) }}"
loop: "{{ users | dict2items }}"
loop_control:
label: "{{ item.key }}"
when: users is defined when: users is defined
- name: Set authorized_keys for system users - name: Set authorized_keys for system users
@ -80,7 +94,9 @@
user: "{{ item.key }}" user: "{{ item.key }}"
key: "{{ item.value.key }}" key: "{{ item.value.key }}"
state: present state: present
loop: "{{ users }}" loop: "{{ users | dict2items }}"
loop_control:
label: "{{ item.key }}"
when: users is defined and item.value.key is defined when: users is defined and item.value.key is defined
- name: Manage filesystem mounts - name: Manage filesystem mounts

View File

@ -1,38 +1,23 @@
- name: Create Gitea directory - name: Install MySQL module for Ansible
ansible.builtin.file: ansible.builtin.apt:
path: "{{ gitea_root }}" name: python3-pymysql
state: directory state: present
- name: Create Gitea database - name: Create Gitea database
community.mysql.mysql_db: community.mysql.mysql_db:
name: "{{ gitea_dbname }}" name: "{{ gitea.DB_NAME }}"
state: present state: present
login_unix_socket: /var/run/mysqld/mysqld.sock login_unix_socket: /var/run/mysqld/mysqld.sock
- name: Create Gitea database user - name: Create Gitea database user
community.mysql.mysql_user: community.mysql.mysql_user:
name: "{{ gitea_dbuser }}" name: "{{ gitea.DB_USER }}"
password: "{{ gitea_dbpass }}" password: "{{ gitea.DB_PASSWD }}"
host: '%' host: '%'
state: present state: present
priv: "{{ gitea_dbname }}.*:ALL" priv: "{{ gitea.DB_NAME }}.*:ALL"
login_unix_socket: /var/run/mysqld/mysqld.sock login_unix_socket: /var/run/mysqld/mysqld.sock
- name: Create git user
ansible.builtin.user:
name: git
state: present
- name: Git user uid
ansible.builtin.getent:
database: passwd
key: git
- name: Git user gid
ansible.builtin.getent:
database: group
key: git
- name: Create git's .ssh directory - name: Create git's .ssh directory
ansible.builtin.file: ansible.builtin.file:
path: /home/git/.ssh path: /home/git/.ssh
@ -70,28 +55,11 @@
dest: /usr/local/bin/gitea dest: /usr/local/bin/gitea
mode: 0755 mode: 0755
- name: Install Gitea's docker-compose file
ansible.builtin.template:
src: docker-compose.yml.j2
dest: "{{ gitea_root }}/docker-compose.yml"
notify: restart_gitea
- name: Install Gitea's docker-compose variables
ansible.builtin.template:
src: compose-env.j2
dest: "{{ gitea_root }}/.env"
notify: restart_gitea
- name: Create Gitea's logging directory - name: Create Gitea's logging directory
ansible.builtin.file: ansible.builtin.file:
name: /var/log/gitea name: /var/log/gitea
state: directory state: directory
- name: Create Gitea's initial log file
ansible.builtin.file:
name: /var/log/gitea/gitea.log
state: touch
- name: Install Gitea's Fail2ban filter - name: Install Gitea's Fail2ban filter
ansible.builtin.template: ansible.builtin.template:
src: fail2ban-filter.conf.j2 src: fail2ban-filter.conf.j2

View File

@ -1,3 +0,0 @@
mariadb_trust:
- "172.16.0.0/12"
- "192.168.0.0/16"

View File

@ -0,0 +1,5 @@
- name: Restart MariaDB
ansible.builtin.service:
name: mariadb
state: restarted
listen: restart_mariadb

View File

@ -3,23 +3,20 @@
name: mariadb-server name: mariadb-server
state: present state: present
- name: Change the bind-address to allow Docker - name: Regather facts for the potentially new docker0 interface
ansible.builtin.setup:
- name: Change the bind-address to allow from docker0
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: /etc/mysql/mariadb.conf.d/50-server.cnf path: /etc/mysql/mariadb.conf.d/50-server.cnf
regex: "^bind-address" regex: "^bind-address"
line: "bind-address = 0.0.0.0" line: "bind-address = {{ ansible_facts.docker0.ipv4.address }}"
register: mariadb_conf notify: restart_mariadb
- name: Restart MariaDB - name: Allow database connections from Docker
ansible.builtin.service:
name: mariadb
state: restarted
when: mariadb_conf.changed
- name: Allow database connections
community.general.ufw: community.general.ufw:
rule: allow rule: allow
port: "3306" port: "3306"
proto: tcp proto: tcp
src: "{{ item }}" src: "{{ item }}"
loop: "{{ mariadb_trust }}" loop: "{{ mariadb_trust | default(['172.16.0.0/12']) }}"