Use Debian’s docker and docker-compose

Vagrantfile

@@ -20,7 +20,7 @@ else
 end
 
 Vagrant.configure("2") do |config|
-  config.vm.box = "debian/contrib-buster64"
+  config.vm.box = "debian/bullseye64"
   config.vm.network "private_network", type: "dhcp"
   config.vm.synced_folder ".", "/vagrant", disabled: true
   config.vm.synced_folder "./scratch", "/vagrant/scratch"

dev/bitwarden.yml

@@ -5,6 +5,7 @@
     - host_vars/bitwarden.yml
   roles:
     - base
+    - nginx
     - docker
     - traefik
     - bitwarden

dev/host_vars/bitwarden.yml

@@ -2,6 +2,9 @@
 allow_reboot: false
 manage_network: false
 
+# nginx proxy
+proxy: helloworld
+
 # docker
 docker_users:
   - vagrant
@@ -13,6 +16,9 @@ traefik_domain: traefik.vm.krislamo.org
 traefik_auth: admin:$apr1$T1l.BCFz$Jyg8msXYEAUi3LLH39I9d1 # admin:admin
 #traefik_acme_email: realemail@example.com # Let's Encrypt settings
 #traefik_production: true
+traefik_ports:
+  - "8000:80"
+  - "4430:443"
 
 # bitwarden
 # Get Installation ID & Key at https://bitwarden.com/host/

roles/bitwarden/tasks/main.yml

@@ -11,7 +11,7 @@
 - name: Download Bitwarden script
   get_url:
     url: "https://raw.githubusercontent.com/\
-          bitwarden/server/master/scripts/bitwarden.sh"
+          bitwarden/self-host/master/bitwarden.sh"
     dest: "{{ bitwarden_root }}"
     mode: u+x
 

roles/docker/docker-ce.list

@@ -1 +0,0 @@
-deb [arch=amd64] https://download.docker.com/linux/debian buster stable

roles/docker/install-compose.sh

@@ -1,38 +0,0 @@
-#!/bin/bash
-
-# Github username and repo name
-user="docker"
-repo="compose"
-
-# Retrieve the latest version number
-addr="https://github.com/$user/$repo/releases/latest"
-page=$(curl -s $addr | grep -o releases/tag/*.*\")
-version=$(echo $page | awk '{print substr($1, 14, length($1) - 14)}')
-
-# Download prep
-url="https://github.com/$user/$repo/releases/download/$version"
-file="docker-compose-$(uname -s)-$(uname -m)"
-
-# Download latest Docker Compose if that version hasn't been downloaded
-if [ ! -f /tmp/docker_compose_$version ]; then
-  curl -L $url/$file -o /tmp/docker-compose_$version
-fi
-
-# Is it already installed?
-if installed=$(which docker-compose); then
-
-  new_chksum=$(sha256sum /tmp/docker-compose_$version)
-  old_chksum=$(sha256sum /usr/local/bin/docker-compose)
-
-  # If checksums are different, delete and install new version
-  if [ ! "$new_chksum" = "$old_chksum" ]; then
-    rm /usr/local/bin/docker-compose
-    mv /tmp/docker-compose_$version /usr/local/bin/docker-compose
-    chmod +x /usr/local/bin/docker-compose
-  fi
-
-else
-  # It's not installed, so no need to remove
-  mv /tmp/docker-compose_$version /usr/local/bin/docker-compose
-  chmod +x /usr/local/bin/docker-compose
-fi

roles/docker/tasks/main.yml

@@ -1,43 +1,6 @@
-# Copyright (C) 2019  Kris Lamoureux
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, version 3 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-- name: Remove old versions of Docker
+- name: Install Docker
   apt:
-    name: ['docker', 'docker-engine', 'docker.io', 'containerd', 'runc']
-    state: absent
-    update_cache: true
-
-- name: Install HTTPS capability for apt
-  apt:
-    name: ['apt-transport-https', 'ca-certificates',
-           'curl', 'gnupg2', 'software-properties-common']
-    state: present
-
-- name: Install Docker's signing key
-  apt_key:
-    url: https://download.docker.com/linux/debian/gpg
-    id: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
-    state: present
-
-- name: Install Docker's stable repository
-  template:
-    src: docker-ce.list
-    dest: /etc/apt/sources.list.d/docker-ce.list
-
-- name: Install Docker CE
-  apt:
-    name: ['docker-ce', 'docker-ce-cli', 'containerd.io']
+    name: ['docker.io', 'docker-compose']
     state: present
     update_cache: true
 
@@ -49,11 +12,6 @@
   loop: "{{ docker_users }}"
   when: docker_users is defined
 
-- name: Install docker-compose
-  script: install-compose.sh
-  args:
-    creates: /usr/local/bin/docker-compose
-
 - name: Start Docker and enable on boot
   service:
     name: docker

roles/nginx/tasks/main.yml

@@ -1,37 +1,7 @@
-- name: Create nginx root
-  file:
-    path: "{{ nginx_root }}"
-    state: directory
+- import_tasks: proxy.yml
+  tags: proxy
+  when: proxy is defined
 
-- name: Generate deploy keys
-  openssh_keypair:
-    path: "{{ nginx_repo_key }}"
-    state: present
-
-- name: Clone static website files
-  git:
-    repo: "{{ nginx_repo_url }}"
-    dest: "{{ nginx_html }}"
-    version: "{{ nginx_repo_branch }}"
-    key_file: "{{ nginx_repo_key }}"
-    separate_git_dir: "{{ nginx_repo_dest }}"
-
-- name: Start nginx container
-  docker_container:
-    name: "{{ nginx_name }}"
-    image: nginx:{{ nginx_version }}
-    state: started
-    restart_policy: always
-    networks_cli_compatible: true
-    networks:
-      - name: traefik
-    volumes:
-      - "{{ nginx_html }}:/usr/share/nginx/html:ro"
-    labels:
-      traefik.http.routers.nginx.rule: "Host(`{{ nginx_domain }}`)"
-      traefik.http.middlewares.nginxauth.basicauth.users: "{{ nginx_auth }}"
-      traefik.http.routers.nginx.entrypoints: websecure
-      traefik.http.routers.nginx.tls.certresolver: letsencrypt
-      traefik.http.routers.nginx.middlewares: "securehttps@file,nginxauth"
-      traefik.docker.network: traefik
-      traefik.enable: "true"
+- import_tasks: webserver.yml
+  tags: nginx
+  when: nginx_domain is defined

roles/nginx/tasks/proxy.yml

@@ -0,0 +1,17 @@
+- name: Install nginx
+  apt:
+    name: nginx
+    state: present
+
+- name: Install nginx configuration
+  template:
+    src: nginx.conf.j2
+    dest: /etc/nginx/nginx.conf
+    mode: '0644'
+  register: nginx_conf
+
+- name: Reload nginx
+  service:
+    name: nginx
+    state: reloaded
+    enabled: true

roles/nginx/tasks/webserver.yml

@@ -0,0 +1,39 @@
+- name: Create nginx root
+  file:
+    path: "{{ nginx_root }}"
+    state: directory
+
+- name: Generate deploy keys
+  openssh_keypair:
+    path: "{{ nginx_repo_key }}"
+    state: present
+
+- name: Clone static website files
+  git:
+    repo: "{{ nginx_repo_url }}"
+    dest: "{{ nginx_html }}"
+    version: "{{ nginx_repo_branch }}"
+    key_file: "{{ nginx_repo_key }}"
+    separate_git_dir: "{{ nginx_repo_dest }}"
+
+- name: Start nginx container
+  docker_container:
+    name: "{{ nginx_name }}"
+    image: nginx:{{ nginx_version }}
+    state: started
+    restart_policy: always
+    container_default_behavior: no_defaults
+    networks_cli_compatible: true
+    network_mode: traefik
+    networks:
+      - name: traefik
+    volumes:
+      - "{{ nginx_html }}:/usr/share/nginx/html:ro"
+    labels:
+      traefik.http.routers.nginx.rule: "Host(`{{ nginx_domain }}`)"
+      traefik.http.middlewares.nginxauth.basicauth.users: "{{ nginx_auth }}"
+      traefik.http.routers.nginx.entrypoints: websecure
+      traefik.http.routers.nginx.tls.certresolver: letsencrypt
+      traefik.http.routers.nginx.middlewares: "securehttps@file,nginxauth"
+      traefik.docker.network: traefik
+      traefik.enable: "true"

roles/nginx/templates/nginx.conf.j2

@@ -0,0 +1,45 @@
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+  worker_connections 1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+    log_format    main  '$remote_addr - $remote_user [$time_local] "$request" '
+                        '$status $body_bytes_sent "$http_referer" '
+                        '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+    sendfile        on;
+    #tcp_nopush     on;
+    keepalive_timeout  65;
+    #gzip  on;
+
+    include /etc/nginx/conf.d/*.conf;
+}
+
+## tcp LB  and SSL passthrough for backend ##
+stream {
+    upstream traefik {
+        server 127.0.0.1:4430 max_fails=3 fail_timeout=10s;
+    }
+
+log_format basic '$remote_addr [$time_local] '
+                 '$protocol $status $bytes_sent $bytes_received '
+                 '$session_time "$upstream_addr" '
+                 '"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';
+
+    access_log /var/log/nginx/traefik_access.log basic;
+    error_log  /var/log/nginx/traefik_error.log;
+
+    server {
+        listen 443;
+        proxy_pass traefik;
+        proxy_next_upstream on;
+    }
+}

roles/traefik/handlers/main.yml

@@ -9,5 +9,6 @@
     name: "{{ traefik_name }}"
     image: traefik:{{ traefik_version }}
     state: started
-    restart: yes
+    container_default_behavior: no_defaults
+    restart: true
   listen: restart_traefik

roles/traefik/tasks/main.yml

@@ -36,7 +36,9 @@
     state: started
     restart_policy: always
     ports: "{{ traefik_ports }}"
-    networks_cli_compatible: "false"
+    container_default_behavior: no_defaults
+    networks_cli_compatible: true
+    network_mode: traefik
     networks:
       - name: traefik
     labels: