ansible.cfg

@@ -1,6 +1,3 @@
 [defaults]
 inventory = ./environments/development
 interpreter_python = /usr/bin/python3
-
-[connection]
-pipelining = true

dev/host_vars/proxy.yml

@@ -17,7 +17,7 @@ proxy:
     - domain: "{{ bitwarden_domain }}"
       proxy_pass: "http://127.0.0.1:8080"
     - domain: "{{ gitea_domain }}"
-      proxy_pass: "http://127.0.0.1:3000"
+      proxy_pass: "http://127.0.0.1:3080"
 
 # docker
 docker_users:
@@ -34,4 +34,8 @@ bitwarden_install_key: 1yB3Z2gRI0KnnH90C6p
 # gitea
 gitea_domain: "git.{{ base_domain }}"
 gitea_version: 1
+gitea_dbversion: latest
 gitea_dbpass: password
+gitea_ports:
+  - "222:22"
+  - "3080:3000"

dev/proxy.yml

@@ -5,8 +5,7 @@
     - host_vars/proxy.yml
   roles:
     - base
-    - postgresql
     - proxy
     - docker
-    - gitea
     - bitwarden
+    - gitea

roles/.gitignore

@@ -10,7 +10,6 @@
 !minecraft*/
 !nextcloud*/
 !nginx*/
-!postgresql*/
 !prometheus*/
 !proxy*/
 !rsnapshot*/

roles/base/tasks/ansible.yml

@@ -13,10 +13,3 @@
   loop:
     - aptitude
     - python3-docker
-    - python3-psycopg2
-
-- name: Create Ansible's temporary remote directory
-  file:
-    path: "~/.ansible/tmp"
-    state: directory
-    mode: 0700

roles/bitwarden/defaults/main.yml

@@ -1,5 +1,5 @@
 bitwarden_name: bitwarden
-bitwarden_root: "{{ docker_root }}/{{ bitwarden_name }}"
+bitwarden_root: "/opt/{{ bitwarden_name }}"
 bitwarden_database: "{{ bitwarden_name }}"
 bitwarden_standalone: false
 bitwarden_production: false

roles/bitwarden/handlers/main.yml

@@ -1,16 +1,7 @@
-- name: Stop Bitwarden for rebuild
-  service:
-    name: "{{ bitwarden_name }}"
-    state: stopped
-  listen: rebuild_bitwarden
-
 - name: Rebuild Bitwarden
   shell: "{{ bitwarden_root }}/bitwarden.sh rebuild"
   listen: rebuild_bitwarden
 
-- name: Start Bitwarden after rebuild
+- name: Start Bitwarden
-  service:
+  shell: "{{ bitwarden_root }}/bitwarden.sh start"
-    name: "{{ bitwarden_name }}"
+  listen: start_bitwarden
-    state: started
-    enabled: true
-  listen: rebuild_bitwarden

roles/bitwarden/tasks/main.yml

@@ -25,29 +25,36 @@
   shell: "{{ bitwarden_root }}/bw_wrapper"
   args:
     creates: "{{ bitwarden_root }}/bwdata/config.yml"
+  notify: start_bitwarden
 
 - name: Install docker-compose override
   template:
     src: compose.override.yml.j2
     dest: "{{ bitwarden_root }}/bwdata/docker/docker-compose.override.yml"
   when: traefik_version is defined
-  notify: rebuild_bitwarden
+  notify:
+    - rebuild_bitwarden
+    - start_bitwarden
 
 - name: Disable bitwarden-nginx HTTP on 80
   replace:
     path: "{{ bitwarden_root }}/bwdata/config.yml"
     regexp: "^http_port: 80$"
-    replace: "http_port: 127.0.0.1:8080"
+    replace: "http_port: 8080"
   when: not bitwarden_standalone
-  notify: rebuild_bitwarden
+  notify:
+    - rebuild_bitwarden
+    - start_bitwarden
 
 - name: Disable bitwarden-nginx HTTPS on 443
   replace:
     path: "{{ bitwarden_root }}/bwdata/config.yml"
     regexp: "^https_port: 443$"
-    replace: "https_port: 127.0.0.1:8443"
+    replace: "https_port: 8443"
   when: not bitwarden_standalone
-  notify: rebuild_bitwarden
+  notify:
+    - rebuild_bitwarden
+    - start_bitwarden
 
 - name: Disable Bitwarden managed Lets Encrypt
   replace:
@@ -55,7 +62,9 @@
     regexp: "^ssl_managed_lets_encrypt: true$"
     replace: "ssl_managed_lets_encrypt: false"
   when: not bitwarden_standalone or not bitwarden_production
-  notify: rebuild_bitwarden
+  notify:
+    - rebuild_bitwarden
+    - start_bitwarden
 
 - name: Disable Bitwarden managed SSL
   replace:
@@ -63,17 +72,6 @@
     regexp: "^ssl: true$"
     replace: "ssl: false"
   when: not bitwarden_standalone
-  notify: rebuild_bitwarden
+  notify:
-
+    - rebuild_bitwarden
-- name: Install Bitwarden systemd service
+    - start_bitwarden
-  template:
-    src: bitwarden.service.j2
-    dest: "/etc/systemd/system/{{ bitwarden_name }}.service"
-  register: bitwarden_systemd
-  notify: rebuild_bitwarden
-
-- name: Reload systemd manager configuration
-  systemd:
-    daemon_reload: true
-  when: bitwarden_systemd.changed
-  notify: rebuild_bitwarden

roles/bitwarden/templates/bitwarden.service.j2

@@ -1,13 +0,0 @@
-[Unit]
-Description=Bitwarden Password Manager Server
-PartOf=docker.service
-After=docker.service
-
-[Service]
-Type=oneshot
-RemainAfterExit=true
-ExecStart={{ bitwarden_root }}/bitwarden.sh start
-ExecStop={{ bitwarden_root }}/bitwarden.sh stop
-
-[Install]
-WantedBy=multi-user.target

roles/docker/defaults/main.yml

@@ -1,3 +0,0 @@
-docker_root: /var/lib/docker-compose
-docker_compose: /usr/bin/docker-compose
-docker_compose_service: compose

roles/docker/tasks/main.yml

@@ -4,22 +4,6 @@
     state: present
     update_cache: true
 
-- name: Create docker-compose root
-  file:
-    path: "{{ docker_root }}"
-    state: directory
-
-- name: Install docker-compose systemd service
-  template:
-    src: docker-compose.service.j2
-    dest: "/etc/systemd/system/{{ docker_compose_service }}@.service"
-  register: compose_systemd
-
-- name: Reload systemd manager configuration
-  systemd:
-    daemon_reload: true
-  when: compose_systemd.changed
-
 - name: Add users to docker group
   user:
     name: "{{ item }}"

roles/docker/templates/docker-compose.service.j2

@@ -1,14 +0,0 @@
-[Unit]
-Description=%i docker-compose service
-PartOf=docker.service
-After=docker.service
-
-[Service]
-Type=oneshot
-RemainAfterExit=true
-WorkingDirectory={{ docker_root }}/%i
-ExecStart={{ docker_compose }} up -d --remove-orphans
-ExecStop={{ docker_compose }} down
-
-[Install]
-WantedBy=multi-user.target

roles/gitea/defaults/main.yml

@@ -1,16 +1,11 @@
 # container settings
 gitea_name: gitea
-gitea_sshport: "127.0.0.1:222"
+gitea_dbname: "{{ gitea_name }}-db"
-gitea_webport: "127.0.0.1:3000"
+gitea_ports: "222:22"
-gitea_volume: "{{ gitea_name }}"
-gitea_rooturl: "http://{{ gitea_domain }}"
-gitea_signup: true
 
 # database settings
-gitea_dbtype: postgres
+gitea_dbuser: "{{ gitea_dbname }}"
-gitea_dbhost: host.docker.internal
-gitea_dbname: "{{ gitea_name }}"
-gitea_dbuser: "{{ gitea_name }}"
 
 # host
-gitea_root: "{{ docker_root }}/{{ gitea_name }}"
+gitea_root: "/opt/{{ gitea_name }}/data"
+gitea_dbroot: "/opt/{{ gitea_name }}/database"

roles/gitea/tasks/main.yml

@@ -1,34 +1,85 @@
-- name: Create Gitea directory
+- name: Create Gitea Network
-  file:
+  docker_network:
-    path: "{{ gitea_root }}"
+    name: "{{ gitea_name }}"
-    state: directory
 
-- name: Create Gitea database
+- name: Start Gitea's database container
-  postgresql_db:
+  docker_container:
     name: "{{ gitea_dbname }}"
-  become: true
+    image: mariadb:{{ gitea_dbversion }}
-  become_user: postgres
-
-- name: Create Gitea database user
-  postgresql_user:
-    db: "{{ gitea_dbname }}"
-    name: "{{ gitea_dbuser }}"
-    password: "{{ gitea_dbpass }}"
-  become: true
-  become_user: postgres
-
-- name: Install Gitea's docker-compose file
-  template:
-    src: docker-compose.yml.j2
-    dest: "{{ gitea_root }}/docker-compose.yml"
-
-- name: Install Gitea's docker-compose variables
-  template:
-    src: compose-env.j2
-    dest: "{{ gitea_root }}/.env"
-
-- name: Start and enable Gitea service
-  service:
-    name: "{{ docker_compose_service }}@{{ gitea_name }}"
     state: started
-    enabled: true
+    restart_policy: always
+    volumes: "{{ gitea_dbroot }}:/var/lib/mysql"
+    container_default_behavior: "no_defaults"
+    networks_cli_compatible: true
+    networks:
+      - name: "{{ gitea_name }}"
+    env:
+      MYSQL_RANDOM_ROOT_PASSWORD: "true"
+      MYSQL_DATABASE: "{{ gitea_dbname }}"
+      MYSQL_USER: "{{ gitea_dbuser }}"
+      MYSQL_PASSWORD: "{{ gitea_dbpass }}"
+
+- name: Start Gitea container (traefik routing)
+  docker_container:
+    name: "{{ gitea_name }}"
+    image: gitea/gitea:{{ gitea_version }}
+    state: started
+    restart_policy: always
+    container_default_behavior: "no_defaults"
+    networks_cli_compatible: true
+    ports: "{{ gitea_ports }}"
+    networks:
+      - name: "{{ gitea_name }}"
+      - name: traefik
+    volumes:
+      - "{{ gitea_root }}:/data"
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    env:
+      USER_UID: "1000"
+      USER_GID: "1000"
+      DB_TYPE: mysql
+      DB_HOST: "{{ gitea_dbname }}"
+      DB_NAME: "{{ gitea_dbname }}"
+      DB_USER: "{{ gitea_dbuser }}"
+      DB_PASSWD: "{{ gitea_dbpass }}"
+      ROOT_URL: "https://{{ gitea_domain }}/"
+      SSH_DOMAIN: "{{ gitea_domain }}"
+      DOMAIN: "{{ gitea_domain }}"
+    labels:
+      traefik.http.routers.gitea.rule: "Host(`{{ gitea_domain }}`)"
+      traefik.http.routers.gitea.entrypoints: websecure
+      traefik.http.routers.gitea.tls.certresolver: letsencrypt
+      traefik.http.routers.gitea.middlewares: "securehttps@file"
+      traefik.http.services.gitea.loadbalancer.server.port: "3000"
+      traefik.docker.network: traefik
+      traefik.enable: "true"
+  when: traefik_version is defined
+
+- name: Start Gitea container
+  docker_container:
+    name: "{{ gitea_name }}"
+    image: gitea/gitea:{{ gitea_version }}
+    state: started
+    restart_policy: always
+    container_default_behavior: "no_defaults"
+    networks_cli_compatible: true
+    ports: "{{ gitea_ports }}"
+    networks:
+      - name: "{{ gitea_name }}"
+    volumes:
+      - "{{ gitea_root }}:/data"
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    env:
+      USER_UID: "1000"
+      USER_GID: "1000"
+      DB_TYPE: mysql
+      DB_HOST: "{{ gitea_dbname }}"
+      DB_NAME: "{{ gitea_dbname }}"
+      DB_USER: "{{ gitea_dbuser }}"
+      DB_PASSWD: "{{ gitea_dbpass }}"
+      ROOT_URL: "https://{{ gitea_domain }}/"
+      SSH_DOMAIN: "{{ gitea_domain }}"
+      DOMAIN: "{{ gitea_domain }}"
+  when: traefik_version is not defined

roles/gitea/templates/compose-env.j2

@@ -1,17 +0,0 @@
-# {{ ansible_managed }}
-gitea_version={{ gitea_version }}
-gitea_name={{ gitea_name }}
-gitea_domain={{ gitea_domain }}
-gitea_rooturl={{ gitea_rooturl }}
-gitea_webport={{ gitea_webport }}
-gitea_sshport={{ gitea_sshport }}
-gitea_dbtype={{ gitea_dbtype }}
-gitea_dbhost={{ gitea_dbhost }}
-gitea_dbname={{ gitea_dbname }}
-gitea_dbuser={{ gitea_dbuser }}
-gitea_dbpass={{ gitea_dbpass }}
-{% if not gitea_signup %}
-gitea_disable_registration=true
-{% else %}
-gitea_disable_registration=false
-{% endif %}

roles/gitea/templates/docker-compose.yml.j2

@@ -1,30 +0,0 @@
-version: '3.7'
-
-services:
-  gitea:
-    image: "gitea/gitea:${gitea_version}"
-    container_name: "${gitea_name}"
-    ports:
-      - "${gitea_sshport}:22"
-      - "${gitea_webport}:3000"
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-    environment:
-      - USER_UID=1000
-      - USER_GID=1000
-      - GITEA__server__ROOT_URL=${gitea_rooturl}
-      - GITEA__server__DOMAIN=${gitea_domain}
-      - GITEA__server__SSH_DOMAIN=${gitea_domain}
-      - GITEA__database__DB_TYPE=${gitea_dbtype}
-      - GITEA__database__HOST=${gitea_dbhost}
-      - GITEA__database__NAME=${gitea_dbname}
-      - GITEA__database__USER=${gitea_dbuser}
-      - GITEA__database__PASSWD=${gitea_dbpass}
-      - GITEA__service__DISABLE_REGISTRATION=${gitea_disable_registration}
-    volumes:
-      - {{ gitea_volume }}:/data
-      - /etc/timezone:/etc/timezone:ro
-      - /etc/localtime:/etc/localtime:ro
-
-volumes:
-  {{ gitea_volume }}:

roles/postgresql/defaults/main.yml

@@ -1,2 +0,0 @@
-postgresql_config: /etc/postgresql/13/main/pg_hba.conf
-postgresql_listen: "*"

roles/postgresql/tasks/main.yml

@@ -1,34 +0,0 @@
-- name: Install PostgreSQL
-  apt:
-    name: postgresql
-    state: present
-
-- name: Trust connections to PostgreSQL from Docker
-  postgresql_pg_hba:
-    dest: "{{ postgresql_config }}"
-    contype: host
-    databases: all
-    users: all
-    address: "172.16.0.0/12"
-    method: trust
-  register: postgresql_hba
-
-- name: Change PostgreSQL listen addresses
-  postgresql_set:
-    name: listen_addresses
-    value: "{{ postgresql_listen }}"
-  become: true
-  become_user: postgres
-  register: postgresql_config
-
-- name: Reload PostgreSQL
-  service:
-    name: postgresql
-    state: reloaded
-  when: postgresql_hba.changed and not postgresql_config.changed
-
-- name: Restart PostgreSQL
-  service:
-    name: postgresql
-    state: restarted
-  when: postgresql_config.changed

roles/proxy/tasks/main.yml

@@ -62,7 +62,6 @@
   file:
     path: /etc/letsencrypt/renewal-hooks/post
     state: directory
-  when: proxy.production is defined and proxy.production
 
 - name: Install nginx post renewal hook
   copy:

roles/proxy/templates/server-nginx.conf.j2

@@ -1,10 +1,3 @@
-server {
-    listen 80;
-
-    server_name {{ item.domain }};
-    return 301 https://{{ item.domain }}$request_uri;
-}
-
 server {
   listen              443 ssl;
   server_name         {{ item.domain }};