sinibaldi
/
hlab
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: sinibaldi:main
Branches Tags
sinibaldi:main
sinibaldi:nextcloud_aio
sinibaldi:authentik
sinibaldi:pangolin
..
compare: sinibaldi:pangolin
Branches Tags
sinibaldi:main
sinibaldi:nextcloud_aio
sinibaldi:authentik
sinibaldi:pangolin

No commits in common. "main" and "pangolin" have entirely different histories.
main ... pangolin

43 changed files with 58 additions and 510 deletions
Show Stats Expand all files Collapse all files

2
ansible/ansible.cfg
View File

@ -444,7 +444,7 @@ interpreter_python=auto_silent
;become_ask_pass=False
# (string) executable to use for privilege escalation, otherwise Ansible will depend on PATH.
;become_exe=sudo.ws
;become_exe=
# (string) Flags to pass to the privilege escalation executable.
;become_flags=

26
ansible/inventories/distributed.yaml
View File

@ -1,31 +1,7 @@
---
new_sudo:
hosts:
hserve1:
hserve2:
mini1:
distributed:
children:
pangolin:
hosts:
edge1:
ansible_host: 172.104.128.23
authentik:
hosts:
mini1:
ansible_host: 192.168.1.66
nextcloud:
hosts:
hserve2:
ansible_host: 192.168.1.130
nginx:
hosts:
hserve1:
ansible_host: 192.168.1.142
forgejo:
hosts:
hserve1:
ansible_host: 172.104.128.23

3
ansible/inventories/group_vars/all/bootstrap_info.yaml
View File

@ -1,8 +1,5 @@
---
ansible_user: ansible
ansible_group: ansible
ansible_user_uid: 1100
ansible_group_uid: 1100
to_set_authorized_keys:
- label: hassallah
key: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArNhKFcJ6T08sn7kTTLf+rO9HEvgOvqfhv5HQ2sRf2tFYfjfCb0zHKnMkgW+sy5gMU10Lyx1r7juXCvqRC955uIM97m1B1Xc6sVqASVKuGPhCKfhxEaMAyBcWFdE+HYbCOPYVN+JMrcwWfbblwiZTtK1OCqaEUvDDI7cFeU68noXwggEp46T48eqMUdi541D9Y+BVx9HYAo6OCQz0+6eXwxJL+tpRcAAXIMMWv362CYHoOgIU45R7xVSMLY1k/HLrcEAblwxEaSpduCH5cWUXZE/56IyxpvP44BxZkVhNdqJLmg4hxBQWhoMNYiTZxbLay3W2TwBCM111cAtUx4M/jQ=="

3
ansible/inventories/group_vars/all/docker_vars.yaml
View File

@ -1,3 +0,0 @@
---
docker_users:
- "{{ ansible_user }}"

2
ansible/inventories/group_vars/all/main.yaml
View File

@ -1,2 +0,0 @@
---
become_exe_value: "sudo"

3
ansible/inventories/group_vars/all/pangolin_info.yaml
View File

@ -1,3 +0,0 @@
---
pangolin_secret: "{{ pangolin_crypted_secret }}"
base_domain: "hassallab.it"

46
ansible/inventories/group_vars/all/vault.yaml
View File

@ -1,33 +1,15 @@
$ANSIBLE_VAULT;1.1;AES256
63663638383238373238386231396435393236303735313430633639326436636237396363356636
3335633566393761386331363065363230313134396562370a663439363937316338656361663563
63366332333231666235613830663031663432613066376461316137336166646464323938373163
6436373935383464360a363536383139616636613033653035356464643432303838663130373938
66336361363038393365653562323431633439336534373664356638313535316333633839366330
36383661363766386232616533323765386137656139373137623630356562386562653762336465
63363163643639616235353436613664636434393734393565316161633664323131396638346165
65616263643335396566393630636233306637313264366338636636666663373537613663663736
31613739643130353532306366626264363630623933313561366534393630613534643139353466
37373963333531666139356335393563623739323165356362616536656231663466366562333839
39393761396265303032343664353634383132323039373135376636633234656666323433633934
39613665643730373931383233643932373861396137306334353839663031633762663034396233
62616339613431333330666639356332376539616338626635653635386464366436643036383363
38663632346265303330666639613130396130626362643865316537323931633465326666636139
37383565326661656566313738636236663137636361616461616536393338363333663634373861
35643361663735316339663561643032343335666361383932316332393661643739393631343530
63366166386135653762343136643462336161653433653032363539336630636133623435313337
34333466396336633662653731343535383334303738366533653763326434366561393762386166
31303163396432343463666236336136653065633132613234643430646631356632306562653034
36643763313137626333313836383866323431343230326366663136643736383435326533613362
66613864656230303561626661613632363761316334306530323137616365396439623966623664
31386339313136366631616432623430363231646462653866313264333138383666313638396438
62386639346235663463633365386362326239666261303438656339306662623464633962353833
66323865613465353434666431663833363431356235376530636365313264626364633231633937
66356563656138663733653935643231613437316137383930353738363561666131393838346464
36646366303434323162363736343362623461343561363862313730316361383631313837366638
66353738396661323536383532323639303961313862663330636161643635636231393536383466
61366435663330633863343165636630373237356563636261636562613863633831643432323436
63396461643639396363653031666262386230346533346136633166636438336233333234313839
34373439363963633262663733663335353535343137366436336562336161373231346266393336
38303065323030653233323831303566336233336162323563336330366539303836663462346434
62643331643931383364
35316234643930663465333664613362323061613838343333313331636366616163366162303165
3565383837343936306536633765616638646437356562630a396536396664303736303965383863
64383632386534316230366337633462613336666636633138626438336163373138616363323835
3137666361653932390a393432313565323939356232376430393762336136613762363036343961
36613462636630626430303636613130346533336534386165633232326238366134376233613466
35613338333035623237303336653137333133666234643466643166633636343234616430346130
31643238653833663761326262626536636537666162653863363934363165323134646564653736
65663334363037636266383930356664356531356664303261333539636462356533396634616130
63336431376532323630323531386437313639393639353332393061633764613030613261393862
36373738613136663165623834376462356139353932626364366164643038323665346639346462
30356166343639653632313833333565393436633733346136653538663235636333383333313533
31306634366535306464313738356662646130363662653062366635333837666464633330393038
31376561323264633063616530656661396331353165626135366462373663346333373131396535
6430326664303432393137353864366339366639643332356134

2
ansible/inventories/group_vars/new_sudo/main.yaml
View File

@ -1,2 +0,0 @@
---
become_exe_value: "sudo.ws"

4
ansible/inventories/host_vars/edge1.yaml → ansible/inventories/group_vars/pangolin/mini1.yaml
View File

@ -1,6 +1,6 @@
---
pangolin_dashboard_url: "https://pangolin.{{ base_domain}}"
pangolin_base_domain: "{{ base_domain }}"
pangolin_dashboard_url: "https://pangolin.hassallab.it"
pangolin_base_domain: "hassallab.it"
pangolin_secret: "{{ pangolin_crypted_secret }}"
pangolin_admin_email: "hassallah@mail.com"

3
ansible/inventories/group_vars/pangolin/node_setup.yaml
View File

@ -1,3 +0,0 @@
---
configure_swap: true
ip_tables_config: true

6
ansible/inventories/host_vars/hserve1.yaml
View File

@ -1,6 +0,0 @@
---
pangolin_site_id: 7drc3dz2bg5gbq5
newt_secret: "{{ test_nginx_newt_secret }}"
forgejo_db_password : "{{ forgejo_db_crypted_password }}"

4
ansible/inventories/host_vars/hserve2.yaml
View File

@ -1,4 +0,0 @@
---
pangolin_site_id: 5hraslci7wl46nj
newt_secret: "{{ hserve2_crypted_site_secret }}"
nextcloud_docker_mastercontainer_volume_dir: "/home/{{ ansible_user }}/docker_data/nextcloud_aio_mastercontainer"

17
ansible/inventories/host_vars/mini1.yaml
View File

@ -1,17 +0,0 @@
---
pangolin_site_id: "original-steppe-polecat"
newt_compose_network: "proxy-network"
authentik_subdomain: "idp"
# The hostname at which authentik is served.
authentik_base_domain: "{{ base_domain }}"
authentik_secret_key: "{{ authentik_crypted_secret_key }}"
authentik_postgres_user: "authentik_ps"
authentik_postgres_password: "{{ authentik_crypted_postgres_password }}"
#authentik_api_token : "{{ authentik_crypted_token }}"
authentik_email_enabled: false
authentik_bootstrap_enabled: false

15
ansible/playbooks/authentik.yaml
View File

@ -1,15 +0,0 @@
---
- name: Install / remove authentik
hosts: authentik
tasks:
- include_role:
name: geerlingguy.docker
apply:
become: true
become_exe: "{{ become_exe_value }}"
- include_role:
name: "{{ item }}"
loop :
- newt_client
- ax-bzh.authentik

3
ansible/playbooks/bootstrap.yaml
View File

@ -2,7 +2,6 @@
- name: Bootstrap node
hosts: all
become: true
become_exe: "{{ become_exe_value }}"
tasks:
- name: Add the ansible group
ansible.builtin.group:
@ -27,7 +26,7 @@
- name: Set ansible user as sudoer
ansible.builtin.copy:
content: "ansible ALL = (ALL) NOPASSWD:ALL\n"
content: "ansible ALL = (ALL) NOPASSWD:ALL"
dest: /etc/sudoers.d/ansible
owner: root
group: root

15
ansible/playbooks/forgejo.yaml
View File

@ -1,15 +0,0 @@
---
- name : Install Forgejo
hosts: forgejo
tasks:
- include_role:
name: geerlingguy.docker
apply:
become: true
become_exe: "{{ become_exe_value }}"
- include_role:
name: "{{ item }}"
loop :
- newt_client
- forgejo

15
ansible/playbooks/nextcloud.yaml
View File

@ -1,15 +0,0 @@
---
- name: Install Nextcloud
hosts: nextcloud
tasks:
- include_role:
name: geerlingguy.docker
apply:
become: true
become_exe: "{{ become_exe_value }}"
- include_role:
name: "{{ item }}"
loop:
- newt_client
- nextcloud_aio

15
ansible/playbooks/pangolin.yaml
View File

@ -1,14 +1,7 @@
---
- name: Install and configure Pangolin
hosts: pangolin
tasks:
- include_role:
name: "{{ item }}"
apply:
become: true
become_exe: "{{ become_exe_value }}"
loop:
- geerlingguy.docker
- prepare_node
- include_role: pangolin
become: true
roles:
- geerlingguy.docker
- pangolin

34
ansible/playbooks/roles/forgejo/tasks/forgejo_docker.yaml
View File

@ -1,34 +0,0 @@
---
- name: Create docker compose directory
ansible.builtin.file:
path: "/home/{{ ansible_user }}/compose_projects/forgejo"
state: directory
mode: '0755'
register: compose_dir
- name: Create data directory
ansible.builtin.file:
path: "/home/{{ ansible_user }}/forgejo/data"
state: directory
mode: '0755'
register: forgejo_data_dir
- name: Create DB data directory
ansible.builtin.file:
path: "/home/{{ ansible_user }}/forgejo/db"
state: directory
mode: '0755'
register: forgejo_db_dir
- name: Copy compose file
ansible.builtin.template:
src: templates/forgejo_compose.yaml.j2
dest: "{{ compose_dir.path }}/compose.yaml"
- name: Starting forgejo compose project
community.docker.docker_compose_v2:
project_src: "{{ compose_dir.path }}"

2
ansible/playbooks/roles/forgejo/tasks/main.yaml
View File

@ -1,2 +0,0 @@
---
- include_tasks: forgejo_docker.yaml

52
ansible/playbooks/roles/forgejo/templates/forgejo_compose.yaml.j2
View File

@ -1,52 +0,0 @@
networks:
forgejo:
external: false
newt:
name: newt_compose_default
external: true
services:
server:
image: codeberg.org/forgejo/forgejo:16.0.1
container_name: forgejo
restart: always
environment:
- USER_UID={{ ansible_user_uid }}
- USER_GID={{ ansible_group_uid }}
- FORGEJO__database__DB_TYPE=postgres
- FORGEJO__database__HOST=db:5432
- FORGEJO__database__NAME=forgejo
- FORGEJO__database__USER=forgejo
- FORGEJO__database__PASSWD={{ forgejo_db_password }}
networks:
- forgejo
- newt
volumes:
- {{ forgejo_data_dir.path }}:/data
- /etc/localtime:/etc/localtime:ro
ports:
- '3000:3000'
- '222:22'
depends_on:
- db
db:
image: postgres:14
restart: always
environment:
- POSTGRES_USER=forgejo
- POSTGRES_PASSWORD={{ forgejo_db_password }}
- POSTGRES_DB=forgejo
networks:
- forgejo
volumes:
- {{ forgejo_db_dir.path }}:/var/lib/postgresql/data

1
ansible/playbooks/roles/newt_client/defaults/main.yaml
View File

@ -1 +0,0 @@
---

23
ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml
View File

@ -1,23 +0,0 @@
---
- name: Create docker compose directory
ansible.builtin.file:
path: "/home/{{ ansible_user }}/compose_projects/newt_compose"
state: directory
mode: '0755'
register: compose_dir
- name: Copy compose file
ansible.builtin.template:
src: templates/newt_compose.yaml.j2
dest: "{{ compose_dir.path }}/compose.yaml"
- name: Copy secret file
ansible.builtin.template:
src: templates/newt-config.secret.j2
dest: "{{ compose_dir.path }}/newt-config.secret"
- name: Starting newt project
community.docker.docker_compose_v2:
project_src: "{{ compose_dir.path }}"

2
ansible/playbooks/roles/newt_client/tasks/main.yaml
View File

@ -1,2 +0,0 @@
---
- include_tasks: docker_newt.yaml

10
ansible/playbooks/roles/newt_client/templates/newt-config.secret.j2
View File

@ -1,10 +0,0 @@
{
"id": "{{ pangolin_site_id }}",
"secret": "{{ newt_secret }}",
"endpoint": "https://pangolin.{{ base_domain }}",
"dockerSocket": "unix:///var/run/docker.sock",
"dockerEnforceNetworkValidation": true,
"tlsClientCert": ""
}

16
ansible/playbooks/roles/newt_client/templates/newt_compose.yaml.j2
View File

@ -1,16 +0,0 @@
services:
newt:
image: fosrl/newt
container_name: newt
restart: unless-stopped
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
environment:
- CONFIG_FILE=/run/secrets/newt-config
secrets:
- newt-config
secrets:
newt-config:
file: ./newt-config.secret

4
ansible/playbooks/roles/nextcloud_aio/defaults/main.yaml
View File

@ -1,4 +0,0 @@
nextcloud_docker_image_name: "ghcr.io/nextcloud-releases/all-in-one"
nextcloud_docker_image_tag: latest
nextcloud_docker_skip_domain_validation: "true"
nextcloud_docker_mastercontainer_volume_dir: /usr/data/nextcloud_aio_mastercontainer

2
ansible/playbooks/roles/nextcloud_aio/tasks/main.yaml
View File

@ -1,2 +0,0 @@
---
- import_tasks: nextcloud_docker_aio.yaml

33
ansible/playbooks/roles/nextcloud_aio/tasks/nextcloud_docker_aio.yaml
View File

@ -1,33 +0,0 @@
---
- name: Pull docker image
docker_image:
name: "{{ nextcloud_docker_image_name }}"
tag: "{{ nextcloud_docker_image_tag }}"
source: pull
- name: Create Master Container volume dir
file:
path: "{{ nextcloud_docker_mastercontainer_volume_dir }}"
state: directory
mode: "0766"
- name: Create container
docker_container:
name: nextcloud-aio-mastercontainer
image: "{{ nextcloud_docker_image_name }}:{{ nextcloud_docker_image_tag }}"
ports:
- "8080:8080"
# - "80:80"
# - "8443:8443"
env:
APACHE_PORT: "11000"
APACHE_IP_BINDING: "0.0.0.0"
# APACHE_ADDITIONAL_NETWORK: ""
SKIP_DOMAIN_VALIDATION: "{{ nextcloud_docker_skip_domain_validation }}"
volumes:
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config
- /var/run/docker.sock:/var/run/docker.sock:ro
networks:
- name: newt_compose_default
restart_policy : "always"
init : true

55
ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml
View File

@ -1,55 +0,0 @@
---
- name: Pull docker image
docker_image:
name: "nginx"
source: pull
- name: Create site dir
file:
path: "/home/{{ ansible_user }}/web/static_nginx_site"
state: directory
register: site_dir
- name: Create index.html
template:
src: templates/index.html.j2
dest: "{{site_dir.path}}/index.html"
- name: Create nginx conf dir
file:
path: "/home/{{ ansible_user }}/nginx/conf"
state: directory
register: nginx_conf_dir
- name: Copy nginx config
template:
src: templates/nginx.conf.j2
dest: "{{ nginx_conf_dir.path }}/nginx.conf"
- name: Create nginx logs dir
file:
path: "/home/{{ ansible_user }}/nginx/logs"
state: directory
register: nginx_logs_dir
- name: Create container
docker_container:
name: nginx-static
image: nginx
ports:
- "80:80"
volumes:
- "{{ site_dir.path }}:/usr/share/nginx/html"
- "{{ nginx_conf_dir.path }}:/etc/nginx/conf.d"
- "{{ nginx_logs_dir.path }}:/var/log/nginx"
restart_policy : "unless-stopped"
networks:
- name: "newt_compose_default"
init : true
recreate: true
state: started

2
ansible/playbooks/roles/nginx/tasks/main.yaml
View File

@ -1,2 +0,0 @@
---
- include_tasks: docker_nginx.yaml

13
ansible/playbooks/roles/nginx/templates/index.html.j2
View File

@ -1,13 +0,0 @@
<!DOCTYPE html>
<html lang=”en”>
<head>
<meta charset=”UTF-8″>
<meta name=”viewport” content=”width=device-width, initial-scale=1.0″>
<title>Welcome to My NGINX App</title>
<link rel=”stylesheet” href=”style.css”>
</head>
<body>
<h1>Static</h1>
<p>This is a static web page served by NGINX inside a Docker container.</p>
</body>
</html>

13
ansible/playbooks/roles/nginx/templates/nginx.conf.j2
View File

@ -1,13 +0,0 @@
server {
listen 80;
root /usr/share/nginx/html;
index index.html index.htm;
server_name static1;
client_max_body_size 32m;
access_log /var/log/nginx/static1.access.log;
error_log /var/log/nginx/static1.error.log debug;
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /var/lib/nginx/html;
}
}

9
ansible/playbooks/roles/pangolin/tasks/main.yaml
View File

@ -1,10 +1,3 @@
---
- ansible.builtin.include_tasks: prepare_node.yaml
- include_role:
name: geerlingguy.docker
apply:
become: true
- ansible.builtin.include_tasks:
file: docker_pangolin.yaml
apply:
become: true
- ansible.builtin.include_tasks: docker_pangolin.yaml

33
ansible/playbooks/roles/prepare_node/tasks/iptables.yaml → ansible/playbooks/roles/pangolin/tasks/prepare_node.yaml
View File

@ -1,4 +1,34 @@
---
- name: Update all packages
ansible.builtin.apt:
update_cache: true
upgrade: dist
- name: Install essential packages
ansible.builtin.apt:
name:
- net-tools
- curl
- wget
- htop
- vim
state: present
- name: Add 1GB swap file
ansible.builtin.shell: |
fallocate -l 1G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
args:
creates: /swapfile
- name: Make swap persistent
ansible.builtin.lineinfile:
dest: /etc/fstab
line: '/swapfile none swap sw 0 0'
state: present
- name: Configure iptables firewall rules
ansible.builtin.iptables:
chain: INPUT
@ -12,10 +42,9 @@
- { protocol: tcp, port: '443', description: 'HTTPS for secure web traffic' }
- { protocol: udp, port: '51820', description: 'WireGuard VPN traffic' }
become: true
become_exe: "{{ become_exe_value }}"
register: iptables_result
- name: Display iptables configuration status
ansible.builtin.debug:
msg: "Configured firewall rules for ports: 80 (HTTP), 443 (HTTPS), 51820 (WireGuard UDP)"
when: iptables_result is changed
when: iptables_result is changed

2
ansible/playbooks/roles/pangolin/templates/docker-compose.yml.j2
View File

@ -1,6 +1,6 @@
services:
pangolin:
image: fosrl/pangolin:ee-latest
image: fosrl/pangolin:latest
container_name: pangolin
restart: unless-stopped
volumes:

6
ansible/playbooks/roles/prepare_node/tasks/main.yaml
View File

@ -1,6 +0,0 @@
---
- include_role: updates.yaml
- include_role: swap.yaml
when: configure_swap is defined
- include_role: iptables.yaml
when: ip_tables_coonfig is defined

15
ansible/playbooks/roles/prepare_node/tasks/swap.yaml
View File

@ -1,15 +0,0 @@
---
- name: Add 1GB swap file
ansible.builtin.shell: |
fallocate -l 1G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
args:
creates: /swapfile
- name: Make swap persistent
ansible.builtin.lineinfile:
dest: /etc/fstab
line: '/swapfile none swap sw 0 0'
state: present

15
ansible/playbooks/roles/prepare_node/tasks/updates.yaml
View File

@ -1,15 +0,0 @@
---
- name: Update all packages
ansible.builtin.apt:
update_cache: true
upgrade: dist
- name: Install essential packages
ansible.builtin.apt:
name:
- net-tools
- curl
- wget
- htop
- vim
state: present

15
ansible/playbooks/static_nginx_page.yaml
View File

@ -1,15 +0,0 @@
---
- name : Nginx static with docker
hosts: all
tasks:
- include_role:
name: geerlingguy.docker
apply:
become: true
become_exe: "{{ become_exe_value }}"
- include_role:
name: "{{ item }}"
loop :
- newt_client
- nginx

10
ansible/playbooks/tests.yaml
View File

@ -1,10 +0,0 @@
---
- name: tests
hosts: all
tasks:
- name: testing
shell: echo $USER
- name: testing sudo
become: true
shell: echo $USER

1
ansible/playbooks/vpn_server.yaml
View File

@ -2,6 +2,5 @@
- name: Configure VPN Server
hosts: wireguard_server
become: true
become_exe: "{{ become_exe_value }}"
roles:
- wireguard_server

16
ansible/requirements.yaml
View File

@ -1,19 +1,7 @@
# requirements.yml
---
roles:
# Used by pangolin playbook
- name: geerlingguy.docker
# Used by authentik playbook
- name: ax-bzh.authentik
collections:
# Used by role wireguard_server
- name: ansible.netcommon
# Used by ax-bzh.authentik
- name: community.docker
version: ">=3.0.0"
- name: community.general
# Used by role wireguard_server
- name: ansible.netcommon