From f3a0608a5a6cef77d21c0a76d49ce6aa636d038f Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Mon, 27 Jul 2026 17:19:00 +0200
Subject: [PATCH 01/15] sudo backward compatibility (sudo_rs in newer nodes)

---
 ansible/ansible.cfg | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg
index b6cbd19..2a96d72 100644
--- a/ansible/ansible.cfg
+++ b/ansible/ansible.cfg
@@ -444,7 +444,7 @@ interpreter_python=auto_silent
 ;become_ask_pass=False
 
 # (string) executable to use for privilege escalation, otherwise Ansible will depend on PATH.
-;become_exe=
+become_exe=sudo.ws
 
 # (string) Flags to pass to the privilege escalation executable.
 ;become_flags=

From afceb5514b89eb5c52c50cf3b9c1f6292ba44684 Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Mon, 27 Jul 2026 17:19:15 +0200
Subject: [PATCH 02/15] updated inventory

---
 ansible/inventories/distributed.yaml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/ansible/inventories/distributed.yaml b/ansible/inventories/distributed.yaml
index b246ad1..7d62432 100644
--- a/ansible/inventories/distributed.yaml
+++ b/ansible/inventories/distributed.yaml
@@ -3,5 +3,18 @@ distributed:
   children:
     pangolin:
       hosts:
-        mini1:
+        edge1:
           ansible_host: 172.104.128.23
+    authentik:
+      hosts:
+        mini1:
+          ansible_host: 192.168.1.66
+    nextcloud:
+      hosts:
+        hserve2:
+          ansible_host: 192.168.1.0
+    nginx:
+      hosts:
+        hserve1:
+          ansible_host: 192.168.1.142
+

From 8454f975e54d8d226621f6d60429ae9053cb09bd Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Mon, 27 Jul 2026 17:19:39 +0200
Subject: [PATCH 03/15] fix missing new line in sudoers

---
 ansible/playbooks/bootstrap.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ansible/playbooks/bootstrap.yaml b/ansible/playbooks/bootstrap.yaml
index 41471e8..008a181 100644
--- a/ansible/playbooks/bootstrap.yaml
+++ b/ansible/playbooks/bootstrap.yaml
@@ -26,7 +26,7 @@
 
     - name: Set ansible user as sudoer
       ansible.builtin.copy:
-        content: "ansible ALL = (ALL) NOPASSWD:ALL"
+        content: "ansible ALL = (ALL) NOPASSWD:ALL\n"
         dest: /etc/sudoers.d/ansible
         owner: root
         group: root

From 88c646ea823f10f7d7a855900375cd3f0070c750 Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Mon, 27 Jul 2026 17:20:10 +0200
Subject: [PATCH 04/15] add dependencies

---
 ansible/requirements.yaml | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/ansible/requirements.yaml b/ansible/requirements.yaml
index 2e0f99c..968b832 100644
--- a/ansible/requirements.yaml
+++ b/ansible/requirements.yaml
@@ -1,7 +1,19 @@
 # requirements.yml
 ---
 
-collections:
+roles:
+  # Used by pangolin playbook
+  - name: geerlingguy.docker
 
+  # Used by authentik playbook
+  - name: ax-bzh.authentik
+
+
+collections:
   # Used by role wireguard_server
-- name: ansible.netcommon
\ No newline at end of file
+  - name: ansible.netcommon
+
+  # Used by ax-bzh.authentik
+  - name: community.docker
+    version: ">=3.0.0"
+  - name: community.general
\ No newline at end of file

From 7354dfa595b605ded8ec106bd78c1d32d6d5cb0a Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Mon, 27 Jul 2026 17:20:47 +0200
Subject: [PATCH 05/15] refactor variables

---
 .../group_vars/all/pangolin_info.yaml           |  3 +++
 .../inventories/group_vars/authentik/mini1.yaml | 17 +++++++++++++++++
 .../inventories/group_vars/nginx/hserve1.yaml   |  3 +++
 .../pangolin/{mini1.yaml => edge1.yaml}         |  4 ++--
 4 files changed, 25 insertions(+), 2 deletions(-)
 create mode 100644 ansible/inventories/group_vars/all/pangolin_info.yaml
 create mode 100644 ansible/inventories/group_vars/authentik/mini1.yaml
 create mode 100644 ansible/inventories/group_vars/nginx/hserve1.yaml
 rename ansible/inventories/group_vars/pangolin/{mini1.yaml => edge1.yaml} (70%)

diff --git a/ansible/inventories/group_vars/all/pangolin_info.yaml b/ansible/inventories/group_vars/all/pangolin_info.yaml
new file mode 100644
index 0000000..62669f1
--- /dev/null
+++ b/ansible/inventories/group_vars/all/pangolin_info.yaml
@@ -0,0 +1,3 @@
+---
+pangolin_secret: "{{ pangolin_crypted_secret }}"
+base_domain: "hassallab.it"
\ No newline at end of file
diff --git a/ansible/inventories/group_vars/authentik/mini1.yaml b/ansible/inventories/group_vars/authentik/mini1.yaml
new file mode 100644
index 0000000..dba9226
--- /dev/null
+++ b/ansible/inventories/group_vars/authentik/mini1.yaml
@@ -0,0 +1,17 @@
+---
+pangolin_site_id: "original-steppe-polecat"
+newt_compose_network: "proxy-network"
+
+authentik_subdomain: "idp"
+
+# The hostname at which authentik is served.
+authentik_base_domain: "{{ base_domain }}"
+
+authentik_secret_key: "{{ authentik_crypted_secret_key }}"
+authentik_postgres_user: "authentik_ps"
+authentik_postgres_password: "{{ authentik_crypted_postgres_password }}"
+#authentik_api_token : "{{ authentik_crypted_token }}"
+
+
+authentik_email_enabled: false
+authentik_bootstrap_enabled: false
\ No newline at end of file
diff --git a/ansible/inventories/group_vars/nginx/hserve1.yaml b/ansible/inventories/group_vars/nginx/hserve1.yaml
new file mode 100644
index 0000000..50058a5
--- /dev/null
+++ b/ansible/inventories/group_vars/nginx/hserve1.yaml
@@ -0,0 +1,3 @@
+---
+pangolin_site_id: 7drc3dz2bg5gbq5
+newt_secret: "{{ test_nginx_newt_secret }}"
\ No newline at end of file
diff --git a/ansible/inventories/group_vars/pangolin/mini1.yaml b/ansible/inventories/group_vars/pangolin/edge1.yaml
similarity index 70%
rename from ansible/inventories/group_vars/pangolin/mini1.yaml
rename to ansible/inventories/group_vars/pangolin/edge1.yaml
index 20664df..085163a 100644
--- a/ansible/inventories/group_vars/pangolin/mini1.yaml
+++ b/ansible/inventories/group_vars/pangolin/edge1.yaml
@@ -1,6 +1,6 @@
 ---
-pangolin_dashboard_url: "https://pangolin.hassallab.it"
-pangolin_base_domain: "hassallab.it"
+pangolin_dashboard_url: "https://pangolin.{{ base_domain}}"
+pangolin_base_domain: "{{ base_domain }}"
 pangolin_secret: "{{ pangolin_crypted_secret }}"
 pangolin_admin_email: "hassallah@mail.com"
 

From 468b72d9dadea9a0825bc85b7fb8d655c498dca7 Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Mon, 27 Jul 2026 17:21:10 +0200
Subject: [PATCH 06/15] updated vars

---
 ansible/inventories/group_vars/all/vault.yaml | 39 ++++++++++++-------
 1 file changed, 25 insertions(+), 14 deletions(-)

diff --git a/ansible/inventories/group_vars/all/vault.yaml b/ansible/inventories/group_vars/all/vault.yaml
index 6178444..cb545f2 100644
--- a/ansible/inventories/group_vars/all/vault.yaml
+++ b/ansible/inventories/group_vars/all/vault.yaml
@@ -1,15 +1,26 @@
 $ANSIBLE_VAULT;1.1;AES256
-35316234643930663465333664613362323061613838343333313331636366616163366162303165
-3565383837343936306536633765616638646437356562630a396536396664303736303965383863
-64383632386534316230366337633462613336666636633138626438336163373138616363323835
-3137666361653932390a393432313565323939356232376430393762336136613762363036343961
-36613462636630626430303636613130346533336534386165633232326238366134376233613466
-35613338333035623237303336653137333133666234643466643166633636343234616430346130
-31643238653833663761326262626536636537666162653863363934363165323134646564653736
-65663334363037636266383930356664356531356664303261333539636462356533396634616130
-63336431376532323630323531386437313639393639353332393061633764613030613261393862
-36373738613136663165623834376462356139353932626364366164643038323665346639346462
-30356166343639653632313833333565393436633733346136653538663235636333383333313533
-31306634366535306464313738356662646130363662653062366635333837666464633330393038
-31376561323264633063616530656661396331353165626135366462373663346333373131396535
-6430326664303432393137353864366339366639643332356134
+34303734613430353163313633353035646165656434326438646437303736383834646165336532
+3662363136306137386136613762663235323737306436350a303430616636383733646163393933
+38313266376538343963666562333134666237653964303966323762396437643235633236333231
+6438333637633833380a343638363338363665363231653534333761343833343136663164373131
+35346561313539653636356637326165336438646435363537613331333565333635626139323563
+62323331356463623965326264643061386431373561343537633733323137646661383462626331
+63646631616565323338356565373639616637323936346164643032383730646265333830656239
+37613364666262353537386433366365623265373364303530313364393937336337323936663231
+38643932663461346137393161343536303838393964633365323236663363366432356530303864
+30343239336436313535376331666431323865643436323431666261633137623432303439383235
+35656535323335636338636539353064613638323538633232653634643962316235666662623932
+33663430623633363432643766396563646233396635663431343166343431663266663930356432
+31636632326234666464633331643262653833396531646330323764313638663963343263316238
+37633837313665323639363666633764323062386165323238326365623338346434306564616335
+31626234303437646636363933366262646639326232303432653337636363376134616238336538
+63653734636166623034376430626232613132313532323163393466613936363033396235643433
+35383037626233633735306164366136616532316434363034623239306230326635623563366434
+36393432386330363837633763663933623165333534323363323433306265666635663737653066
+63653739613738643430643466393335353262346432643333333862393563393133396133373662
+36373537393061363936663632383731646234353866356236306265656264333232343634353365
+33643134313962653264326133343065333731613736653663386666653433633965373734363238
+31306634623962656431386662376130343262666236353337613661613935653862396338363865
+35623963653761396363336632633831383462346538396635393436633637383434343531316232
+61373137633838393137363636356566346433636239323432336138633635643833363061323632
+36383130376365336564633234363433393439353434616331306561623363613263

From 9095522515e1f0870601d4bb03be88a2e089bf4a Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Mon, 27 Jul 2026 17:21:30 +0200
Subject: [PATCH 07/15] authentik first implementation

---
 ansible/playbooks/authentik.yaml              | 10 ++++++
 .../roles/newt_client/defaults/main.yaml      |  1 +
 .../roles/newt_client/tasks/docker_newt.yaml  | 31 +++++++++++++++++++
 .../roles/newt_client/tasks/main.yaml         |  2 ++
 .../templates/newt-config.secret.j2           |  6 ++++
 .../templates/newt_compose.yaml.j2            | 23 ++++++++++++++
 6 files changed, 73 insertions(+)
 create mode 100644 ansible/playbooks/authentik.yaml
 create mode 100644 ansible/playbooks/roles/newt_client/defaults/main.yaml
 create mode 100644 ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml
 create mode 100644 ansible/playbooks/roles/newt_client/tasks/main.yaml
 create mode 100644 ansible/playbooks/roles/newt_client/templates/newt-config.secret.j2
 create mode 100644 ansible/playbooks/roles/newt_client/templates/newt_compose.yaml.j2

diff --git a/ansible/playbooks/authentik.yaml b/ansible/playbooks/authentik.yaml
new file mode 100644
index 0000000..150e05b
--- /dev/null
+++ b/ansible/playbooks/authentik.yaml
@@ -0,0 +1,10 @@
+---
+- name: Install / remove authentik
+  hosts: authentik
+  become: true
+  debugger: on_failed
+  roles:
+    - geerlingguy.docker
+    - newt_client
+    - ax-bzh.authentik
+
diff --git a/ansible/playbooks/roles/newt_client/defaults/main.yaml b/ansible/playbooks/roles/newt_client/defaults/main.yaml
new file mode 100644
index 0000000..ed97d53
--- /dev/null
+++ b/ansible/playbooks/roles/newt_client/defaults/main.yaml
@@ -0,0 +1 @@
+---
diff --git a/ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml b/ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml
new file mode 100644
index 0000000..eeece4c
--- /dev/null
+++ b/ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml
@@ -0,0 +1,31 @@
+---
+- name: Create docker compose directory
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/compose_projects/newt_compose"
+    state: directory
+    mode: '0755'
+  register: compose_dir
+
+- name: Copy compose file
+  ansible.builtin.template:
+    src: templates/newt_compose.yaml.j2
+    dest: "{{ compose_dir.path }}/compose.yaml"
+
+
+- name: Copy secret file
+  ansible.builtin.template:
+    src: templates/newt-config.secret.j2
+    dest: "{{ compose_dir.path }}/newt-config.secret"
+
+
+
+- name: Defining network
+  community.docker.docker_network:
+    name: "newt-network"
+    state: present 
+
+
+
+- name: Starting newt project
+  community.docker.docker_compose_v2:
+    project_src: "{{ compose_dir.path }}" 
diff --git a/ansible/playbooks/roles/newt_client/tasks/main.yaml b/ansible/playbooks/roles/newt_client/tasks/main.yaml
new file mode 100644
index 0000000..1e18ee5
--- /dev/null
+++ b/ansible/playbooks/roles/newt_client/tasks/main.yaml
@@ -0,0 +1,2 @@
+---
+- include_tasks: docker_newt.yaml
diff --git a/ansible/playbooks/roles/newt_client/templates/newt-config.secret.j2 b/ansible/playbooks/roles/newt_client/templates/newt-config.secret.j2
new file mode 100644
index 0000000..f6fb0ff
--- /dev/null
+++ b/ansible/playbooks/roles/newt_client/templates/newt-config.secret.j2
@@ -0,0 +1,6 @@
+{
+  "id": "{{ pangolin_site_id }}",
+  "secret": "{{ newt_secret }}",
+  "endpoint": "https://pangolin.{{ base_domain }}",
+  "tlsClientCert": ""
+}
\ No newline at end of file
diff --git a/ansible/playbooks/roles/newt_client/templates/newt_compose.yaml.j2 b/ansible/playbooks/roles/newt_client/templates/newt_compose.yaml.j2
new file mode 100644
index 0000000..a607f9c
--- /dev/null
+++ b/ansible/playbooks/roles/newt_client/templates/newt_compose.yaml.j2
@@ -0,0 +1,23 @@
+services:
+
+  newt:
+    image: fosrl/newt
+    container_name: newt
+    restart: unless-stopped
+    environment:
+      - CONFIG_FILE=/run/secrets/newt-config
+    secrets:
+      - newt-config
+
+    networks:
+      - newt-network
+
+
+
+networks:
+  newt-network:
+    external: true
+    
+secrets:
+  newt-config:
+    file: ./newt-config.secret
\ No newline at end of file

From 14dcfb436dbc41e9421dd805a14b84f2becd1aa8 Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Mon, 27 Jul 2026 17:21:41 +0200
Subject: [PATCH 08/15] testing purposes

---
 .../roles/nginx/tasks/docker_nginx.yaml       | 29 +++++++++++++++++++
 ansible/playbooks/roles/nginx/tasks/main.yaml |  2 ++
 .../roles/nginx/templates/index.html.j2       | 13 +++++++++
 ansible/playbooks/static_nginx_page.yaml      |  9 ++++++
 ansible/playbooks/tests.yaml                  | 10 +++++++
 5 files changed, 63 insertions(+)
 create mode 100644 ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml
 create mode 100644 ansible/playbooks/roles/nginx/tasks/main.yaml
 create mode 100644 ansible/playbooks/roles/nginx/templates/index.html.j2
 create mode 100644 ansible/playbooks/static_nginx_page.yaml
 create mode 100644 ansible/playbooks/tests.yaml

diff --git a/ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml b/ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml
new file mode 100644
index 0000000..835db15
--- /dev/null
+++ b/ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml
@@ -0,0 +1,29 @@
+---
+- name: Pull docker image
+  docker_image:
+    name: "nginx"
+    source: pull
+
+
+- name: Create site dir
+  file:
+    path: "statis_nginx_site"
+    state: directory
+  register: site_dir
+
+
+- name: Create index.html
+  template:
+    src: templates/index.html.j2
+    dest: "{{site_dir.path}}/index.html"
+
+- name: Create container
+  docker_container:
+    name: nginx-static
+    image: nginx
+    ports:
+      - "80:80"
+    volumes:
+      - "{{ site_dir.path }}:/usr/share/nginx/html"
+    restart_policy : "unless-stopped"
+    init : true
\ No newline at end of file
diff --git a/ansible/playbooks/roles/nginx/tasks/main.yaml b/ansible/playbooks/roles/nginx/tasks/main.yaml
new file mode 100644
index 0000000..5e42f23
--- /dev/null
+++ b/ansible/playbooks/roles/nginx/tasks/main.yaml
@@ -0,0 +1,2 @@
+---
+- include_tasks: docker_nginx.yaml
\ No newline at end of file
diff --git a/ansible/playbooks/roles/nginx/templates/index.html.j2 b/ansible/playbooks/roles/nginx/templates/index.html.j2
new file mode 100644
index 0000000..31c0ee2
--- /dev/null
+++ b/ansible/playbooks/roles/nginx/templates/index.html.j2
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html lang=”en”>
+<head>
+<meta charset=”UTF-8″>
+<meta name=”viewport” content=”width=device-width, initial-scale=1.0″>
+<title>Welcome to My NGINX App</title>
+<link rel=”stylesheet” href=”style.css”>
+</head>
+<body>
+<h1>Static</h1>
+<p>This is a static web page served by NGINX inside a Docker container.</p>
+</body>
+</html>
\ No newline at end of file
diff --git a/ansible/playbooks/static_nginx_page.yaml b/ansible/playbooks/static_nginx_page.yaml
new file mode 100644
index 0000000..54d4fd8
--- /dev/null
+++ b/ansible/playbooks/static_nginx_page.yaml
@@ -0,0 +1,9 @@
+---
+- name : Nginx static with docker
+  hosts: all
+  become: true
+  roles:
+    - geerlingguy.docker
+    - newt_client
+    - nginx
+    
\ No newline at end of file
diff --git a/ansible/playbooks/tests.yaml b/ansible/playbooks/tests.yaml
new file mode 100644
index 0000000..cfc6ec4
--- /dev/null
+++ b/ansible/playbooks/tests.yaml
@@ -0,0 +1,10 @@
+---
+- name: tests
+  hosts: all
+  tasks:
+    - name: testing
+      shell: echo $USER
+
+    - name: testing sudo
+      become: true
+      shell: echo $USER
\ No newline at end of file

From e05314cbc1d928b2e735cf76e45f564bf3a20cac Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Mon, 27 Jul 2026 18:08:05 +0200
Subject: [PATCH 09/15] fixes to nginx conf

---
 .../roles/nginx/tasks/docker_nginx.yaml          | 16 +++++++++++++++-
 .../roles/nginx/templates/nginx.conf.j2          |  8 ++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 ansible/playbooks/roles/nginx/templates/nginx.conf.j2

diff --git a/ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml b/ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml
index 835db15..c7e8050 100644
--- a/ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml
+++ b/ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml
@@ -7,7 +7,7 @@
 
 - name: Create site dir
   file:
-    path: "statis_nginx_site"
+    path: "/home/{{ ansible_user }}/web/static_nginx_site"
     state: directory
   register: site_dir
 
@@ -17,6 +17,19 @@
     src: templates/index.html.j2
     dest: "{{site_dir.path}}/index.html"
 
+
+- name: Create nginx conf dir
+  file:
+    path: "/home/{{ ansible_user }}/nginx/conf"
+    state: directory
+  register: nginx_conf_dir
+
+- name: Copy nginx config
+  template:
+    src: templates/nginx.conf.j2
+    dest: "{{ nginx_conf_dir.path }}/nginx.conf"
+
+
 - name: Create container
   docker_container:
     name: nginx-static
@@ -25,5 +38,6 @@
       - "80:80"
     volumes:
       - "{{ site_dir.path }}:/usr/share/nginx/html"
+      - "{{ nginx_conf_dir.path }}:/etc/nginx/conf.d"
     restart_policy : "unless-stopped"
     init : true
\ No newline at end of file
diff --git a/ansible/playbooks/roles/nginx/templates/nginx.conf.j2 b/ansible/playbooks/roles/nginx/templates/nginx.conf.j2
new file mode 100644
index 0000000..42616a1
--- /dev/null
+++ b/ansible/playbooks/roles/nginx/templates/nginx.conf.j2
@@ -0,0 +1,8 @@
+server {
+    listen 80;
+    listen [::]:80;
+
+    root   /var/www/html;
+    index  index.html;
+
+} 
\ No newline at end of file

From c503d49904b2b946dee973995f16be154cb9263d Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Wed, 29 Jul 2026 17:37:39 +0200
Subject: [PATCH 10/15] Refactor inventory vars

---
 ansible/inventories/distributed.yaml          |  3 ++
 .../group_vars/all/bootstrap_info.yaml        |  3 ++
 .../group_vars/all/docker_vars.yaml           |  3 ++
 ansible/inventories/group_vars/all/vault.yaml | 53 ++++++++++---------
 .../inventories/group_vars/nginx/hserve1.yaml |  3 --
 .../pangolin => host_vars}/edge1.yaml         |  0
 ansible/inventories/host_vars/hserve1.yaml    |  6 +++
 .../authentik => host_vars}/mini1.yaml        |  0
 8 files changed, 43 insertions(+), 28 deletions(-)
 create mode 100644 ansible/inventories/group_vars/all/docker_vars.yaml
 delete mode 100644 ansible/inventories/group_vars/nginx/hserve1.yaml
 rename ansible/inventories/{group_vars/pangolin => host_vars}/edge1.yaml (100%)
 create mode 100644 ansible/inventories/host_vars/hserve1.yaml
 rename ansible/inventories/{group_vars/authentik => host_vars}/mini1.yaml (100%)

diff --git a/ansible/inventories/distributed.yaml b/ansible/inventories/distributed.yaml
index 7d62432..f730750 100644
--- a/ansible/inventories/distributed.yaml
+++ b/ansible/inventories/distributed.yaml
@@ -17,4 +17,7 @@ distributed:
       hosts:
         hserve1:
           ansible_host: 192.168.1.142
+    forgejo:
+      hosts:
+        hserve1:
 
diff --git a/ansible/inventories/group_vars/all/bootstrap_info.yaml b/ansible/inventories/group_vars/all/bootstrap_info.yaml
index 6b9cc34..79a7b55 100644
--- a/ansible/inventories/group_vars/all/bootstrap_info.yaml
+++ b/ansible/inventories/group_vars/all/bootstrap_info.yaml
@@ -1,5 +1,8 @@
 ---
 ansible_user: ansible
+ansible_group: ansible
+ansible_user_uid: 1100
+ansible_group_uid: 1100
 to_set_authorized_keys:
   - label: hassallah
     key: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArNhKFcJ6T08sn7kTTLf+rO9HEvgOvqfhv5HQ2sRf2tFYfjfCb0zHKnMkgW+sy5gMU10Lyx1r7juXCvqRC955uIM97m1B1Xc6sVqASVKuGPhCKfhxEaMAyBcWFdE+HYbCOPYVN+JMrcwWfbblwiZTtK1OCqaEUvDDI7cFeU68noXwggEp46T48eqMUdi541D9Y+BVx9HYAo6OCQz0+6eXwxJL+tpRcAAXIMMWv362CYHoOgIU45R7xVSMLY1k/HLrcEAblwxEaSpduCH5cWUXZE/56IyxpvP44BxZkVhNdqJLmg4hxBQWhoMNYiTZxbLay3W2TwBCM111cAtUx4M/jQ=="
diff --git a/ansible/inventories/group_vars/all/docker_vars.yaml b/ansible/inventories/group_vars/all/docker_vars.yaml
new file mode 100644
index 0000000..2dc0414
--- /dev/null
+++ b/ansible/inventories/group_vars/all/docker_vars.yaml
@@ -0,0 +1,3 @@
+---
+docker_users:
+  - "{{ ansible_user }}"
\ No newline at end of file
diff --git a/ansible/inventories/group_vars/all/vault.yaml b/ansible/inventories/group_vars/all/vault.yaml
index cb545f2..8dd5674 100644
--- a/ansible/inventories/group_vars/all/vault.yaml
+++ b/ansible/inventories/group_vars/all/vault.yaml
@@ -1,26 +1,29 @@
 $ANSIBLE_VAULT;1.1;AES256
-34303734613430353163313633353035646165656434326438646437303736383834646165336532
-3662363136306137386136613762663235323737306436350a303430616636383733646163393933
-38313266376538343963666562333134666237653964303966323762396437643235633236333231
-6438333637633833380a343638363338363665363231653534333761343833343136663164373131
-35346561313539653636356637326165336438646435363537613331333565333635626139323563
-62323331356463623965326264643061386431373561343537633733323137646661383462626331
-63646631616565323338356565373639616637323936346164643032383730646265333830656239
-37613364666262353537386433366365623265373364303530313364393937336337323936663231
-38643932663461346137393161343536303838393964633365323236663363366432356530303864
-30343239336436313535376331666431323865643436323431666261633137623432303439383235
-35656535323335636338636539353064613638323538633232653634643962316235666662623932
-33663430623633363432643766396563646233396635663431343166343431663266663930356432
-31636632326234666464633331643262653833396531646330323764313638663963343263316238
-37633837313665323639363666633764323062386165323238326365623338346434306564616335
-31626234303437646636363933366262646639326232303432653337636363376134616238336538
-63653734636166623034376430626232613132313532323163393466613936363033396235643433
-35383037626233633735306164366136616532316434363034623239306230326635623563366434
-36393432386330363837633763663933623165333534323363323433306265666635663737653066
-63653739613738643430643466393335353262346432643333333862393563393133396133373662
-36373537393061363936663632383731646234353866356236306265656264333232343634353365
-33643134313962653264326133343065333731613736653663386666653433633965373734363238
-31306634623962656431386662376130343262666236353337613661613935653862396338363865
-35623963653761396363336632633831383462346538396635393436633637383434343531316232
-61373137633838393137363636356566346433636239323432336138633635643833363061323632
-36383130376365336564633234363433393439353434616331306561623363613263
+38356639333633663161333637663539623835623666653738333235336563373030653036393837
+3235613032363938623938303463333562656561316636660a626532363638396138613637323265
+66663562366431333139616134333039323737356437393031643463363362363335636464333162
+3430353964646133660a666234613262396464363134313935383661393438616237633961643233
+31646435326336353130323139323961343561646137636332333139643033303664333035663538
+30346138613061616432656431613437306462666432646239373236323633346131663431366564
+66663031353366663766663330346633306233653033626134343738303937393934393936646533
+63613338323631366537353531356538643738393562346161666566393639363138663832306639
+32336433643134323433633433376137363834353763643834393530356536316565653831616165
+32306661353761643139343838313535333365646265613537626533346338333239626137363533
+39323930636336396134313561346463313662333734643536366433663030393130646366396564
+66656335353138376638353939316263306633613563663465636366353437333536353731326562
+66313862373830383736323330616236643066393032353961643166663935333966386562646335
+62616634363964333062306637656331396339643662663132623533636663313962376266353137
+30663131326365613635616234616138366236303938386536346633393839393732653964316636
+36626262663463306434386332353166313162356365643866393638663564343161643430373937
+37336233396632316537626465323866373463306565633835363263616362653266303364373835
+30386163626239356333353232343662643438353965346335613937346366386331343965343738
+32633732366161653834663766326536343065613463643263333065396532356635376362336335
+36386339343832623664323732363638616632363964373732336565636161396237333934353931
+66656339653731343534666635663331336238646561353664323438356339343164353531303362
+38333535333064386562346234656232653938316337343163616361633834656234333036393932
+37303539663032363134613335663937363165636135663338656434633031336631613236346663
+31376535353235636362346462333530633334313266613433396361333331363936643863323261
+61653564393238323935373935653662636363353063613432653531393337613664336433663337
+34383533376362303439303132363665313437363134333432643566636335393739616639613961
+32626163333961343331323364636238353137613835363363613538333231303031323033383634
+65643735636133313964
diff --git a/ansible/inventories/group_vars/nginx/hserve1.yaml b/ansible/inventories/group_vars/nginx/hserve1.yaml
deleted file mode 100644
index 50058a5..0000000
--- a/ansible/inventories/group_vars/nginx/hserve1.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
----
-pangolin_site_id: 7drc3dz2bg5gbq5
-newt_secret: "{{ test_nginx_newt_secret }}"
\ No newline at end of file
diff --git a/ansible/inventories/group_vars/pangolin/edge1.yaml b/ansible/inventories/host_vars/edge1.yaml
similarity index 100%
rename from ansible/inventories/group_vars/pangolin/edge1.yaml
rename to ansible/inventories/host_vars/edge1.yaml
diff --git a/ansible/inventories/host_vars/hserve1.yaml b/ansible/inventories/host_vars/hserve1.yaml
new file mode 100644
index 0000000..96c9642
--- /dev/null
+++ b/ansible/inventories/host_vars/hserve1.yaml
@@ -0,0 +1,6 @@
+---
+pangolin_site_id: 7drc3dz2bg5gbq5
+newt_secret: "{{ test_nginx_newt_secret }}"
+
+
+forgejo_db_password : "{{ forgejo_db_crypted_password }}"
\ No newline at end of file
diff --git a/ansible/inventories/group_vars/authentik/mini1.yaml b/ansible/inventories/host_vars/mini1.yaml
similarity index 100%
rename from ansible/inventories/group_vars/authentik/mini1.yaml
rename to ansible/inventories/host_vars/mini1.yaml

From bd299333b8186f905352e71acb362df728142117 Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Wed, 29 Jul 2026 17:38:16 +0200
Subject: [PATCH 11/15] fixing newt configuration

---
 .../roles/newt_client/tasks/docker_newt.yaml  | 10 +---------
 .../templates/newt-config.secret.j2           |  4 ++++
 .../templates/newt_compose.yaml.j2            | 11 ++---------
 .../roles/nginx/tasks/docker_nginx.yaml       | 14 +++++++++++++-
 .../roles/nginx/templates/nginx.conf.j2       | 19 ++++++++++++-------
 5 files changed, 32 insertions(+), 26 deletions(-)

diff --git a/ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml b/ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml
index eeece4c..a8b9cb2 100644
--- a/ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml
+++ b/ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml
@@ -17,15 +17,7 @@
     src: templates/newt-config.secret.j2
     dest: "{{ compose_dir.path }}/newt-config.secret"
 
-
-
-- name: Defining network
-  community.docker.docker_network:
-    name: "newt-network"
-    state: present 
-
-
-
 - name: Starting newt project
   community.docker.docker_compose_v2:
     project_src: "{{ compose_dir.path }}" 
+
diff --git a/ansible/playbooks/roles/newt_client/templates/newt-config.secret.j2 b/ansible/playbooks/roles/newt_client/templates/newt-config.secret.j2
index f6fb0ff..014c277 100644
--- a/ansible/playbooks/roles/newt_client/templates/newt-config.secret.j2
+++ b/ansible/playbooks/roles/newt_client/templates/newt-config.secret.j2
@@ -2,5 +2,9 @@
   "id": "{{ pangolin_site_id }}",
   "secret": "{{ newt_secret }}",
   "endpoint": "https://pangolin.{{ base_domain }}",
+
+  "dockerSocket": "unix:///var/run/docker.sock",
+  "dockerEnforceNetworkValidation": true,
+
   "tlsClientCert": ""
 }
\ No newline at end of file
diff --git a/ansible/playbooks/roles/newt_client/templates/newt_compose.yaml.j2 b/ansible/playbooks/roles/newt_client/templates/newt_compose.yaml.j2
index a607f9c..f1c0de1 100644
--- a/ansible/playbooks/roles/newt_client/templates/newt_compose.yaml.j2
+++ b/ansible/playbooks/roles/newt_client/templates/newt_compose.yaml.j2
@@ -4,20 +4,13 @@ services:
     image: fosrl/newt
     container_name: newt
     restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
     environment:
       - CONFIG_FILE=/run/secrets/newt-config
     secrets:
       - newt-config
 
-    networks:
-      - newt-network
-
-
-
-networks:
-  newt-network:
-    external: true
-    
 secrets:
   newt-config:
     file: ./newt-config.secret
\ No newline at end of file
diff --git a/ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml b/ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml
index c7e8050..7d4d57f 100644
--- a/ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml
+++ b/ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml
@@ -30,6 +30,13 @@
     dest: "{{ nginx_conf_dir.path }}/nginx.conf"
 
 
+- name: Create nginx logs dir
+  file:
+    path: "/home/{{ ansible_user }}/nginx/logs"
+    state: directory
+  register: nginx_logs_dir
+
+
 - name: Create container
   docker_container:
     name: nginx-static
@@ -39,5 +46,10 @@
     volumes:
       - "{{ site_dir.path }}:/usr/share/nginx/html"
       - "{{ nginx_conf_dir.path }}:/etc/nginx/conf.d"
+      - "{{ nginx_logs_dir.path }}:/var/log/nginx"
     restart_policy : "unless-stopped"
-    init : true
\ No newline at end of file
+    networks:
+      - name: "newt_compose_default"
+    init : true
+    recreate: true
+    state: started
\ No newline at end of file
diff --git a/ansible/playbooks/roles/nginx/templates/nginx.conf.j2 b/ansible/playbooks/roles/nginx/templates/nginx.conf.j2
index 42616a1..f2b7ed9 100644
--- a/ansible/playbooks/roles/nginx/templates/nginx.conf.j2
+++ b/ansible/playbooks/roles/nginx/templates/nginx.conf.j2
@@ -1,8 +1,13 @@
 server {
-    listen 80;
-    listen [::]:80;
-
-    root   /var/www/html;
-    index  index.html;
-
-} 
\ No newline at end of file
+    listen                  80;
+    root                    /usr/share/nginx/html;
+    index                   index.html index.htm;
+    server_name             static1;
+    client_max_body_size    32m;
+    access_log              /var/log/nginx/static1.access.log;
+    error_log               /var/log/nginx/static1.error.log debug;
+    error_page              500 502 503 504  /50x.html;
+    location = /50x.html {
+          root              /var/lib/nginx/html;
+    }
+}
\ No newline at end of file

From 54026f7a2145dd39a9c8ec9cad9fc408663ed287 Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Wed, 29 Jul 2026 17:38:31 +0200
Subject: [PATCH 12/15] Install forgejo

---
 ansible/playbooks/forgejo.yaml                |  5 ++
 .../roles/forgejo/tasks/forgejo_docker.yaml   | 34 ++++++++++++
 .../playbooks/roles/forgejo/tasks/main.yaml   |  6 +++
 .../forgejo/templates/forgejo_compose.yaml.j2 | 52 +++++++++++++++++++
 4 files changed, 97 insertions(+)
 create mode 100644 ansible/playbooks/forgejo.yaml
 create mode 100644 ansible/playbooks/roles/forgejo/tasks/forgejo_docker.yaml
 create mode 100644 ansible/playbooks/roles/forgejo/tasks/main.yaml
 create mode 100644 ansible/playbooks/roles/forgejo/templates/forgejo_compose.yaml.j2

diff --git a/ansible/playbooks/forgejo.yaml b/ansible/playbooks/forgejo.yaml
new file mode 100644
index 0000000..da01c0d
--- /dev/null
+++ b/ansible/playbooks/forgejo.yaml
@@ -0,0 +1,5 @@
+---
+- name : Install Forgejo
+  hosts: forgejo
+  roles:
+    - forgejo
\ No newline at end of file
diff --git a/ansible/playbooks/roles/forgejo/tasks/forgejo_docker.yaml b/ansible/playbooks/roles/forgejo/tasks/forgejo_docker.yaml
new file mode 100644
index 0000000..40aad45
--- /dev/null
+++ b/ansible/playbooks/roles/forgejo/tasks/forgejo_docker.yaml
@@ -0,0 +1,34 @@
+---
+- name: Create docker compose directory
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/compose_projects/forgejo"
+    state: directory
+    mode: '0755'
+  register: compose_dir
+
+- name: Create data directory
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/forgejo/data"
+    state: directory
+    mode: '0755'
+  register: forgejo_data_dir
+
+
+- name: Create DB data directory
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/forgejo/db"
+    state: directory
+    mode: '0755'
+  register: forgejo_db_dir
+
+
+- name: Copy compose file
+  ansible.builtin.template:
+    src: templates/forgejo_compose.yaml.j2
+    dest: "{{ compose_dir.path }}/compose.yaml"
+
+
+- name: Starting forgejo compose project
+  community.docker.docker_compose_v2:
+    project_src: "{{ compose_dir.path }}" 
+
diff --git a/ansible/playbooks/roles/forgejo/tasks/main.yaml b/ansible/playbooks/roles/forgejo/tasks/main.yaml
new file mode 100644
index 0000000..daaca37
--- /dev/null
+++ b/ansible/playbooks/roles/forgejo/tasks/main.yaml
@@ -0,0 +1,6 @@
+---
+- include_role:
+    name: geerlingguy.docker
+    apply:
+      become: true
+- include_tasks: forgejo_docker.yaml
\ No newline at end of file
diff --git a/ansible/playbooks/roles/forgejo/templates/forgejo_compose.yaml.j2 b/ansible/playbooks/roles/forgejo/templates/forgejo_compose.yaml.j2
new file mode 100644
index 0000000..cf43b54
--- /dev/null
+++ b/ansible/playbooks/roles/forgejo/templates/forgejo_compose.yaml.j2
@@ -0,0 +1,52 @@
+networks:
+  forgejo:
+    external: false
+  newt:
+    name: newt_compose_default
+    external: true
+
+services:
+  server:
+    image: codeberg.org/forgejo/forgejo:16.0.1
+    container_name: forgejo
+    restart: always
+    environment:
+      - USER_UID={{ ansible_user_uid }}
+      - USER_GID={{ ansible_group_uid }}
+
+      - FORGEJO__database__DB_TYPE=postgres
+      - FORGEJO__database__HOST=db:5432
+      - FORGEJO__database__NAME=forgejo
+      - FORGEJO__database__USER=forgejo
+      - FORGEJO__database__PASSWD={{ forgejo_db_password }}
+
+
+    networks:
+      - forgejo
+      - newt
+      
+    volumes:
+      - {{ forgejo_data_dir.path }}:/data
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - '3000:3000'
+      - '222:22'
+
+    depends_on:
+      - db
+
+
+  db:
+    image: postgres:14
+    restart: always
+    environment:
+      - POSTGRES_USER=forgejo
+      - POSTGRES_PASSWORD={{ forgejo_db_password }}
+      - POSTGRES_DB=forgejo
+    networks:
+      - forgejo
+    volumes:
+      - {{ forgejo_db_dir.path }}:/var/lib/postgresql/data
+
+
+

From 2f10f3b5d71843aba4992464b62d69998e8ad649 Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Wed, 29 Jul 2026 18:26:51 +0200
Subject: [PATCH 13/15] Become method by host group

---
 ansible/ansible.cfg                               | 2 +-
 ansible/inventories/distributed.yaml              | 8 ++++++++
 ansible/inventories/group_vars/new_sudo/main.yaml | 2 ++
 3 files changed, 11 insertions(+), 1 deletion(-)
 create mode 100644 ansible/inventories/group_vars/new_sudo/main.yaml

diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg
index 2a96d72..bd60647 100644
--- a/ansible/ansible.cfg
+++ b/ansible/ansible.cfg
@@ -444,7 +444,7 @@ interpreter_python=auto_silent
 ;become_ask_pass=False
 
 # (string) executable to use for privilege escalation, otherwise Ansible will depend on PATH.
-become_exe=sudo.ws
+;become_exe=sudo.ws
 
 # (string) Flags to pass to the privilege escalation executable.
 ;become_flags=
diff --git a/ansible/inventories/distributed.yaml b/ansible/inventories/distributed.yaml
index f730750..56ef2b6 100644
--- a/ansible/inventories/distributed.yaml
+++ b/ansible/inventories/distributed.yaml
@@ -1,4 +1,12 @@
 ---
+new_sudo:
+  hosts:
+    hserve1:
+    hserve2:
+    mini1:
+
+
+
 distributed:
   children:
     pangolin:
diff --git a/ansible/inventories/group_vars/new_sudo/main.yaml b/ansible/inventories/group_vars/new_sudo/main.yaml
new file mode 100644
index 0000000..58490a0
--- /dev/null
+++ b/ansible/inventories/group_vars/new_sudo/main.yaml
@@ -0,0 +1,2 @@
+---
+become_exe: sudo.ws
\ No newline at end of file

From f5db60a0b7a35667a653d3ab9f0e6077410ef7e1 Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Wed, 29 Jul 2026 18:27:10 +0200
Subject: [PATCH 14/15] Pangolin Enterprise

---
 .../playbooks/roles/pangolin/templates/docker-compose.yml.j2    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ansible/playbooks/roles/pangolin/templates/docker-compose.yml.j2 b/ansible/playbooks/roles/pangolin/templates/docker-compose.yml.j2
index b0efb85..5aeded0 100644
--- a/ansible/playbooks/roles/pangolin/templates/docker-compose.yml.j2
+++ b/ansible/playbooks/roles/pangolin/templates/docker-compose.yml.j2
@@ -1,6 +1,6 @@
 services:
   pangolin:
-    image: fosrl/pangolin:latest
+    image: fosrl/pangolin:ee-latest
     container_name: pangolin
     restart: unless-stopped
     volumes:

From acec737b0116471b7458c08bbd16ea79cba7b644 Mon Sep 17 00:00:00 2001
From: Fabio Sinibaldi <fabio.sinibaldi@isti.cnr.it>
Date: Wed, 29 Jul 2026 18:27:20 +0200
Subject: [PATCH 15/15] Selective become

---
 ansible/playbooks/roles/pangolin/tasks/main.yaml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/ansible/playbooks/roles/pangolin/tasks/main.yaml b/ansible/playbooks/roles/pangolin/tasks/main.yaml
index 2c34c0a..f0de8a8 100644
--- a/ansible/playbooks/roles/pangolin/tasks/main.yaml
+++ b/ansible/playbooks/roles/pangolin/tasks/main.yaml
@@ -1,3 +1,10 @@
 ---
 - ansible.builtin.include_tasks: prepare_node.yaml
-- ansible.builtin.include_tasks: docker_pangolin.yaml
+- include_role:
+    name: geerlingguy.docker
+    apply:
+      become: true
+- ansible.builtin.include_tasks: 
+    file: docker_pangolin.yaml
+    apply:
+      become: true