Merge pull request 'authentik' (#3) from authentik into main

Reviewed-on: #3

ansible/ansible.cfg

@@ -444,7 +444,7 @@ interpreter_python=auto_silent
 ;become_ask_pass=False
 
 # (string) executable to use for privilege escalation, otherwise Ansible will depend on PATH.
-;become_exe=
+;become_exe=sudo.ws
 
 # (string) Flags to pass to the privilege escalation executable.
 ;become_flags=

ansible/inventories/distributed.yaml

@@ -1,7 +1,31 @@
 ---
+new_sudo:
+  hosts:
+    hserve1:
+    hserve2:
+    mini1:
+
+
+
 distributed:
   children:
     pangolin:
       hosts:
-        mini1:
+        edge1:
           ansible_host: 172.104.128.23
+    authentik:
+      hosts:
+        mini1:
+          ansible_host: 192.168.1.66
+    nextcloud:
+      hosts:
+        hserve2:
+          ansible_host: 192.168.1.0
+    nginx:
+      hosts:
+        hserve1:
+          ansible_host: 192.168.1.142
+    forgejo:
+      hosts:
+        hserve1:
+

ansible/inventories/group_vars/all/bootstrap_info.yaml

@@ -1,5 +1,8 @@
 ---
 ansible_user: ansible
+ansible_group: ansible
+ansible_user_uid: 1100
+ansible_group_uid: 1100
 to_set_authorized_keys:
   - label: hassallah
     key: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArNhKFcJ6T08sn7kTTLf+rO9HEvgOvqfhv5HQ2sRf2tFYfjfCb0zHKnMkgW+sy5gMU10Lyx1r7juXCvqRC955uIM97m1B1Xc6sVqASVKuGPhCKfhxEaMAyBcWFdE+HYbCOPYVN+JMrcwWfbblwiZTtK1OCqaEUvDDI7cFeU68noXwggEp46T48eqMUdi541D9Y+BVx9HYAo6OCQz0+6eXwxJL+tpRcAAXIMMWv362CYHoOgIU45R7xVSMLY1k/HLrcEAblwxEaSpduCH5cWUXZE/56IyxpvP44BxZkVhNdqJLmg4hxBQWhoMNYiTZxbLay3W2TwBCM111cAtUx4M/jQ=="

ansible/inventories/group_vars/all/docker_vars.yaml

@@ -0,0 +1,3 @@
+---
+docker_users:
+  - "{{ ansible_user }}"

ansible/inventories/group_vars/all/pangolin_info.yaml

@@ -0,0 +1,3 @@
+---
+pangolin_secret: "{{ pangolin_crypted_secret }}"
+base_domain: "hassallab.it"

ansible/inventories/group_vars/all/vault.yaml

@@ -1,15 +1,29 @@
 $ANSIBLE_VAULT;1.1;AES256
-35316234643930663465333664613362323061613838343333313331636366616163366162303165
-3565383837343936306536633765616638646437356562630a396536396664303736303965383863
-64383632386534316230366337633462613336666636633138626438336163373138616363323835
-3137666361653932390a393432313565323939356232376430393762336136613762363036343961
-36613462636630626430303636613130346533336534386165633232326238366134376233613466
-35613338333035623237303336653137333133666234643466643166633636343234616430346130
-31643238653833663761326262626536636537666162653863363934363165323134646564653736
-65663334363037636266383930356664356531356664303261333539636462356533396634616130
-63336431376532323630323531386437313639393639353332393061633764613030613261393862
-36373738613136663165623834376462356139353932626364366164643038323665346639346462
-30356166343639653632313833333565393436633733346136653538663235636333383333313533
-31306634366535306464313738356662646130363662653062366635333837666464633330393038
-31376561323264633063616530656661396331353165626135366462373663346333373131396535
-6430326664303432393137353864366339366639643332356134
+38356639333633663161333637663539623835623666653738333235336563373030653036393837
+3235613032363938623938303463333562656561316636660a626532363638396138613637323265
+66663562366431333139616134333039323737356437393031643463363362363335636464333162
+3430353964646133660a666234613262396464363134313935383661393438616237633961643233
+31646435326336353130323139323961343561646137636332333139643033303664333035663538
+30346138613061616432656431613437306462666432646239373236323633346131663431366564
+66663031353366663766663330346633306233653033626134343738303937393934393936646533
+63613338323631366537353531356538643738393562346161666566393639363138663832306639
+32336433643134323433633433376137363834353763643834393530356536316565653831616165
+32306661353761643139343838313535333365646265613537626533346338333239626137363533
+39323930636336396134313561346463313662333734643536366433663030393130646366396564
+66656335353138376638353939316263306633613563663465636366353437333536353731326562
+66313862373830383736323330616236643066393032353961643166663935333966386562646335
+62616634363964333062306637656331396339643662663132623533636663313962376266353137
+30663131326365613635616234616138366236303938386536346633393839393732653964316636
+36626262663463306434386332353166313162356365643866393638663564343161643430373937
+37336233396632316537626465323866373463306565633835363263616362653266303364373835
+30386163626239356333353232343662643438353965346335613937346366386331343965343738
+32633732366161653834663766326536343065613463643263333065396532356635376362336335
+36386339343832623664323732363638616632363964373732336565636161396237333934353931
+66656339653731343534666635663331336238646561353664323438356339343164353531303362
+38333535333064386562346234656232653938316337343163616361633834656234333036393932
+37303539663032363134613335663937363165636135663338656434633031336631613236346663
+31376535353235636362346462333530633334313266613433396361333331363936643863323261
+61653564393238323935373935653662636363353063613432653531393337613664336433663337
+34383533376362303439303132363665313437363134333432643566636335393739616639613961
+32626163333961343331323364636238353137613835363363613538333231303031323033383634
+65643735636133313964

ansible/inventories/group_vars/new_sudo/main.yaml

@@ -0,0 +1,2 @@
+---
+become_exe: sudo.ws

ansible/inventories/host_vars/edge1.yaml

@@ -1,6 +1,6 @@
 ---
-pangolin_dashboard_url: "https://pangolin.hassallab.it"
-pangolin_base_domain: "hassallab.it"
+pangolin_dashboard_url: "https://pangolin.{{ base_domain}}"
+pangolin_base_domain: "{{ base_domain }}"
 pangolin_secret: "{{ pangolin_crypted_secret }}"
 pangolin_admin_email: "hassallah@mail.com"
 

ansible/inventories/host_vars/hserve1.yaml

@@ -0,0 +1,6 @@
+---
+pangolin_site_id: 7drc3dz2bg5gbq5
+newt_secret: "{{ test_nginx_newt_secret }}"
+
+
+forgejo_db_password : "{{ forgejo_db_crypted_password }}"

ansible/inventories/host_vars/mini1.yaml

@@ -0,0 +1,17 @@
+---
+pangolin_site_id: "original-steppe-polecat"
+newt_compose_network: "proxy-network"
+
+authentik_subdomain: "idp"
+
+# The hostname at which authentik is served.
+authentik_base_domain: "{{ base_domain }}"
+
+authentik_secret_key: "{{ authentik_crypted_secret_key }}"
+authentik_postgres_user: "authentik_ps"
+authentik_postgres_password: "{{ authentik_crypted_postgres_password }}"
+#authentik_api_token : "{{ authentik_crypted_token }}"
+
+
+authentik_email_enabled: false
+authentik_bootstrap_enabled: false

ansible/playbooks/authentik.yaml

@@ -0,0 +1,10 @@
+---
+- name: Install / remove authentik
+  hosts: authentik
+  become: true
+  debugger: on_failed
+  roles:
+    - geerlingguy.docker
+    - newt_client
+    - ax-bzh.authentik
+

ansible/playbooks/bootstrap.yaml

@@ -26,7 +26,7 @@
 
     - name: Set ansible user as sudoer
       ansible.builtin.copy:
-        content: "ansible ALL = (ALL) NOPASSWD:ALL"
+        content: "ansible ALL = (ALL) NOPASSWD:ALL\n"
         dest: /etc/sudoers.d/ansible
         owner: root
         group: root

ansible/playbooks/forgejo.yaml

@@ -0,0 +1,5 @@
+---
+- name : Install Forgejo
+  hosts: forgejo
+  roles:
+    - forgejo

ansible/playbooks/roles/forgejo/tasks/forgejo_docker.yaml

@@ -0,0 +1,34 @@
+---
+- name: Create docker compose directory
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/compose_projects/forgejo"
+    state: directory
+    mode: '0755'
+  register: compose_dir
+
+- name: Create data directory
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/forgejo/data"
+    state: directory
+    mode: '0755'
+  register: forgejo_data_dir
+
+
+- name: Create DB data directory
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/forgejo/db"
+    state: directory
+    mode: '0755'
+  register: forgejo_db_dir
+
+
+- name: Copy compose file
+  ansible.builtin.template:
+    src: templates/forgejo_compose.yaml.j2
+    dest: "{{ compose_dir.path }}/compose.yaml"
+
+
+- name: Starting forgejo compose project
+  community.docker.docker_compose_v2:
+    project_src: "{{ compose_dir.path }}" 
+

ansible/playbooks/roles/forgejo/tasks/main.yaml

@@ -0,0 +1,6 @@
+---
+- include_role:
+    name: geerlingguy.docker
+    apply:
+      become: true
+- include_tasks: forgejo_docker.yaml

ansible/playbooks/roles/forgejo/templates/forgejo_compose.yaml.j2

@@ -0,0 +1,52 @@
+networks:
+  forgejo:
+    external: false
+  newt:
+    name: newt_compose_default
+    external: true
+
+services:
+  server:
+    image: codeberg.org/forgejo/forgejo:16.0.1
+    container_name: forgejo
+    restart: always
+    environment:
+      - USER_UID={{ ansible_user_uid }}
+      - USER_GID={{ ansible_group_uid }}
+
+      - FORGEJO__database__DB_TYPE=postgres
+      - FORGEJO__database__HOST=db:5432
+      - FORGEJO__database__NAME=forgejo
+      - FORGEJO__database__USER=forgejo
+      - FORGEJO__database__PASSWD={{ forgejo_db_password }}
+
+
+    networks:
+      - forgejo
+      - newt
+      
+    volumes:
+      - {{ forgejo_data_dir.path }}:/data
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - '3000:3000'
+      - '222:22'
+
+    depends_on:
+      - db
+
+
+  db:
+    image: postgres:14
+    restart: always
+    environment:
+      - POSTGRES_USER=forgejo
+      - POSTGRES_PASSWORD={{ forgejo_db_password }}
+      - POSTGRES_DB=forgejo
+    networks:
+      - forgejo
+    volumes:
+      - {{ forgejo_db_dir.path }}:/var/lib/postgresql/data
+
+
+

ansible/playbooks/roles/newt_client/defaults/main.yaml

@@ -0,0 +1 @@
+---

ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml

@@ -0,0 +1,23 @@
+---
+- name: Create docker compose directory
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/compose_projects/newt_compose"
+    state: directory
+    mode: '0755'
+  register: compose_dir
+
+- name: Copy compose file
+  ansible.builtin.template:
+    src: templates/newt_compose.yaml.j2
+    dest: "{{ compose_dir.path }}/compose.yaml"
+
+
+- name: Copy secret file
+  ansible.builtin.template:
+    src: templates/newt-config.secret.j2
+    dest: "{{ compose_dir.path }}/newt-config.secret"
+
+- name: Starting newt project
+  community.docker.docker_compose_v2:
+    project_src: "{{ compose_dir.path }}" 
+

ansible/playbooks/roles/newt_client/tasks/main.yaml

@@ -0,0 +1,2 @@
+---
+- include_tasks: docker_newt.yaml

ansible/playbooks/roles/newt_client/templates/newt-config.secret.j2

@@ -0,0 +1,10 @@
+{
+  "id": "{{ pangolin_site_id }}",
+  "secret": "{{ newt_secret }}",
+  "endpoint": "https://pangolin.{{ base_domain }}",
+
+  "dockerSocket": "unix:///var/run/docker.sock",
+  "dockerEnforceNetworkValidation": true,
+
+  "tlsClientCert": ""
+}

ansible/playbooks/roles/newt_client/templates/newt_compose.yaml.j2

@@ -0,0 +1,16 @@
+services:
+
+  newt:
+    image: fosrl/newt
+    container_name: newt
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      - CONFIG_FILE=/run/secrets/newt-config
+    secrets:
+      - newt-config
+
+secrets:
+  newt-config:
+    file: ./newt-config.secret

ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml

@@ -0,0 +1,55 @@
+---
+- name: Pull docker image
+  docker_image:
+    name: "nginx"
+    source: pull
+
+
+- name: Create site dir
+  file:
+    path: "/home/{{ ansible_user }}/web/static_nginx_site"
+    state: directory
+  register: site_dir
+
+
+- name: Create index.html
+  template:
+    src: templates/index.html.j2
+    dest: "{{site_dir.path}}/index.html"
+
+
+- name: Create nginx conf dir
+  file:
+    path: "/home/{{ ansible_user }}/nginx/conf"
+    state: directory
+  register: nginx_conf_dir
+
+- name: Copy nginx config
+  template:
+    src: templates/nginx.conf.j2
+    dest: "{{ nginx_conf_dir.path }}/nginx.conf"
+
+
+- name: Create nginx logs dir
+  file:
+    path: "/home/{{ ansible_user }}/nginx/logs"
+    state: directory
+  register: nginx_logs_dir
+
+
+- name: Create container
+  docker_container:
+    name: nginx-static
+    image: nginx
+    ports:
+      - "80:80"
+    volumes:
+      - "{{ site_dir.path }}:/usr/share/nginx/html"
+      - "{{ nginx_conf_dir.path }}:/etc/nginx/conf.d"
+      - "{{ nginx_logs_dir.path }}:/var/log/nginx"
+    restart_policy : "unless-stopped"
+    networks:
+      - name: "newt_compose_default"
+    init : true
+    recreate: true
+    state: started

ansible/playbooks/roles/nginx/tasks/main.yaml

@@ -0,0 +1,2 @@
+---
+- include_tasks: docker_nginx.yaml

ansible/playbooks/roles/nginx/templates/index.html.j2

@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html lang=”en”>
+<head>
+<meta charset=”UTF-8″>
+<meta name=”viewport” content=”width=device-width, initial-scale=1.0″>
+<title>Welcome to My NGINX App</title>
+<link rel=”stylesheet” href=”style.css”>
+</head>
+<body>
+<h1>Static</h1>
+<p>This is a static web page served by NGINX inside a Docker container.</p>
+</body>
+</html>

ansible/playbooks/roles/nginx/templates/nginx.conf.j2

@@ -0,0 +1,13 @@
+server {
+    listen                  80;
+    root                    /usr/share/nginx/html;
+    index                   index.html index.htm;
+    server_name             static1;
+    client_max_body_size    32m;
+    access_log              /var/log/nginx/static1.access.log;
+    error_log               /var/log/nginx/static1.error.log debug;
+    error_page              500 502 503 504  /50x.html;
+    location = /50x.html {
+          root              /var/lib/nginx/html;
+    }
+}

ansible/playbooks/roles/pangolin/tasks/main.yaml

@@ -1,3 +1,10 @@
 ---
 - ansible.builtin.include_tasks: prepare_node.yaml
-- ansible.builtin.include_tasks: docker_pangolin.yaml
+- include_role:
+    name: geerlingguy.docker
+    apply:
+      become: true
+- ansible.builtin.include_tasks: 
+    file: docker_pangolin.yaml
+    apply:
+      become: true

ansible/playbooks/roles/pangolin/templates/docker-compose.yml.j2

@@ -1,6 +1,6 @@
 services:
   pangolin:
-    image: fosrl/pangolin:latest
+    image: fosrl/pangolin:ee-latest
     container_name: pangolin
     restart: unless-stopped
     volumes:

ansible/playbooks/static_nginx_page.yaml

@@ -0,0 +1,9 @@
+---
+- name : Nginx static with docker
+  hosts: all
+  become: true
+  roles:
+    - geerlingguy.docker
+    - newt_client
+    - nginx
+    

ansible/playbooks/tests.yaml

@@ -0,0 +1,10 @@
+---
+- name: tests
+  hosts: all
+  tasks:
+    - name: testing
+      shell: echo $USER
+
+    - name: testing sudo
+      become: true
+      shell: echo $USER

ansible/requirements.yaml

@@ -1,7 +1,19 @@
 # requirements.yml
 ---
 
-collections:
+roles:
+  # Used by pangolin playbook
+  - name: geerlingguy.docker
 
+  # Used by authentik playbook
+  - name: ax-bzh.authentik
+
+
+collections:
   # Used by role wireguard_server
-- name: ansible.netcommon
+  - name: ansible.netcommon
+
+  # Used by ax-bzh.authentik
+  - name: community.docker
+    version: ">=3.0.0"
+  - name: community.general