dev/host_vars/gitea.yml

@@ -7,7 +7,6 @@ users:
     uid: 1001
     gid: 1001
     home: true
-    system: true
 
 # Import my GPG key for git signature verification
 root_gpgkeys:
@@ -36,8 +35,6 @@ docker_compose_deploy:
     url: https://github.com/krislamo/gitea
     version: b0ce66f6a1ab074172eed79eeeb36d7e9011ef8f
     enabled: true
-    trusted_keys:
-      - FBF673CEEC030F8AECA814E73EDA9C3441EDA925
     env:
       USER_UID: "{{ users.git.uid }}"
       USER_GID: "{{ users.git.gid }}"

dev/host_vars/proxy.yml

@@ -4,18 +4,6 @@ base_domain: local.krislamo.org
 allow_reboot: false
 manage_network: false
 
-users:
-  git:
-    uid: 1001
-    gid: 1001
-    home: true
-    system: true
-
-# Import my GPG key for git signature verification
-root_gpgkeys:
-  - name: kris@lamoureux.io
-    id: FBF673CEEC030F8AECA814E73EDA9C3441EDA925
-
 # proxy
 proxy:
   #production: true
@@ -27,49 +15,14 @@ proxy:
       - "{{ base_domain }}"
   servers:
     - domain: "{{ bitwarden_domain }}"
-      proxy_pass: "http://127.0.0.1"
+      proxy_pass: "http://127.0.0.1:8080"
     - domain: "{{ gitea_domain }}"
-      proxy_pass: "http://127.0.0.1"
+      proxy_pass: "http://127.0.0.1:3000"
 
 # docker
-docker_official: true # docker's apt repos
 docker_users:
   - vagrant
 
-docker_compose_env_nolog: false # dev only setting
-docker_compose_deploy:
-  # Traefik
-  - name: traefik
-    url: https://github.com/krislamo/traefik
-    version: e97db75e2e214582fac5f5e495687ab5cdf855ad
-    path: docker-compose.web.yml
-    enabled: true
-    accept_newhostkey: true
-    trusted_keys:
-      - FBF673CEEC030F8AECA814E73EDA9C3441EDA925
-    env:
-      ENABLE: true
-  # Gitea
-  - name: gitea
-    url: https://github.com/krislamo/gitea
-    version: b0ce66f6a1ab074172eed79eeeb36d7e9011ef8f
-    enabled: true
-    trusted_keys:
-      - FBF673CEEC030F8AECA814E73EDA9C3441EDA925
-    env:
-      ENTRYPOINT: web
-      ENABLE_TLS: false
-      USER_UID: "{{ users.git.uid }}"
-      USER_GID: "{{ users.git.gid }}"
-      DB_PASSWD: "{{ gitea.DB_PASSWD }}"
-
-# gitea
-gitea_domain: "git.{{ base_domain }}"
-gitea:
-  DB_NAME: gitea
-  DB_USER: gitea
-  DB_PASSWD: password
-
 # bitwarden
 # Get Installation ID & Key at https://bitwarden.com/host/
 bitwarden_domain: "vault.{{ base_domain }}"
@@ -77,3 +30,8 @@ bitwarden_dbpass: password
 bitwarden_install_id: 4ea840a3-532e-4cb6-a472-abd900728b23
 bitwarden_install_key: 1yB3Z2gRI0KnnH90C6p
 #bitwarden_prodution: true
+
+# gitea
+gitea_domain: "git.{{ base_domain }}"
+gitea_version: 1
+gitea_dbpass: password

dev/proxy.yml

@@ -5,8 +5,8 @@
     - host_vars/proxy.yml
   roles:
     - base
+    - mariadb
     - proxy
     - docker
-    - mariadb
     - gitea
     - bitwarden

roles/bitwarden/tasks/main.yml

@@ -26,18 +26,18 @@
   args:
     creates: "{{ bitwarden_root }}/bwdata/config.yml"
 
-- name: Install compose override
+- name: Install docker-compose override
   ansible.builtin.template:
     src: compose.override.yml.j2
     dest: "{{ bitwarden_root }}/bwdata/docker/docker-compose.override.yml"
-  when: bitwarden_override | default(true)
+  when: traefik_version is defined
   notify: rebuild_bitwarden
 
 - name: Disable bitwarden-nginx HTTP on 80
   ansible.builtin.replace:
     path: "{{ bitwarden_root }}/bwdata/config.yml"
     regexp: "^http_port: 80$"
-    replace: "http_port: {{ bitwarden_http_port | default('127.0.0.1:9080') }}"
+    replace: "http_port: 127.0.0.1:8080"
   when: not bitwarden_standalone
   notify: rebuild_bitwarden
 
@@ -45,7 +45,7 @@
   ansible.builtin.replace:
     path: "{{ bitwarden_root }}/bwdata/config.yml"
     regexp: "^https_port: 443$"
-    replace: "https_port: {{ bitwarden_https_port | default('127.0.0.1:9443') }}"
+    replace: "https_port: 127.0.0.1:8443"
   when: not bitwarden_standalone
   notify: rebuild_bitwarden
 

roles/bitwarden/templates/bw_wrapper.j2

@@ -23,13 +23,10 @@ send "{{ bitwarden_install_id }}\r"
 expect "Enter your installation key:"
 send "{{ bitwarden_install_key }}\r"
 
-expect "Enter your region (US/EU) \\\[US\\\]:"
+expect "Do you have a SSL certificate to use? (y/n):"
-send "US\r"
-
-expect "Do you have a SSL certificate to use? (y/N):"
 send "n\r"
 
-expect "Do you want to generate a self-signed SSL certificate? (y/N):"
+expect "Do you want to generate a self-signed SSL certificate? (y/n):"
 {% if bitwarden_standalone and not bitwarden_production %}
 send "y\r"
 {% else %}

roles/bitwarden/templates/compose.override.yml.j2

@@ -6,11 +6,13 @@ services:
       - traefik
     labels:
       traefik.http.routers.bitwarden.rule: "Host(`{{ bitwarden_domain }}`)"
-      traefik.http.routers.bitwarden.entrypoints: {{ bitwarden_entrypoint | default('web') }}
+      traefik.http.routers.bitwarden.entrypoints: websecure
-      traefik.http.routers.bitwarden.tls: {{ bitwarden_traefik_tls | default('false') }}
+      traefik.http.routers.bitwarden.tls.certresolver: letsencrypt
+      traefik.http.routers.bitwarden.middlewares: "securehttps@file"
       traefik.http.services.bitwarden.loadbalancer.server.port: 8080
       traefik.docker.network: traefik
       traefik.enable: "true"
+
 networks:
   traefik:
     external: true

roles/docker/defaults/main.yml

@@ -8,4 +8,4 @@ docker_compose: "{{ (docker_official | bool) | ternary('/usr/bin/docker compose'
 docker_official: false
 docker_repos_keys: "{{ docker_repos_path }}/.keys"
 docker_repos_keytype: rsa
-docker_repos_path: /srv/.compose_repos
+docker_repos_path: /srv/.compose_repos

roles/docker/handlers/main.yml

@@ -4,7 +4,7 @@
   listen: compose_systemd
 
 - name: Find which services had a docker-compose.yml updated
-  ansible.builtin.set_fact:
+  set_fact:
     compose_restart_list: "{{ (compose_restart_list | default([])) + [item.item.name] }}"
   loop: "{{ compose_update.results }}"
   loop_control:
@@ -13,7 +13,7 @@
   listen: compose_restart
 
 - name: Find which services had their .env updated
-  ansible.builtin.set_fact:
+  set_fact:
     compose_restart_list: "{{ (compose_restart_list | default([])) + [item.item.name] }}"
   loop: "{{ compose_env_update.results }}"
   loop_control:
@@ -29,20 +29,20 @@
   listen: restart_mariadb # hijack handler for early restart
 
 - name: Set MariaDB as restarted
-  ansible.builtin.set_fact:
+  set_fact:
     mariadb_restarted: true
   when: not mariadb_restarted
   listen: restart_mariadb
 
-- name: Restart compose services
+- name: Restart {{ docker_compose_service }} services
   ansible.builtin.systemd:
     state: restarted
     name: "{{ docker_compose_service }}@{{ item }}"
-  loop: "{{ compose_restart_list | default([]) | unique }}"
+  loop: "{{ compose_restart_list | unique }}"
   when: compose_restart_list is defined
   listen: compose_restart
 
-- name: Start compose services and enable on boot
+- name: Start {{ docker_compose_service }} services and enable on boot
   ansible.builtin.service:
     name: "{{ docker_compose_service }}@{{ item.name }}"
     state: started

roles/docker/tasks/main.yml

@@ -3,9 +3,6 @@
     url: "{{ docker_apt_keyring_url }}"
     dest: "{{ docker_apt_keyring }}"
     checksum: "sha256:{{ docker_apt_keyring_hash }}"
-    mode: "644"
-    owner: root
-    group: root
   when: docker_official
 
 - name: Remove official Docker APT key