Merge pull request 'nextcloud_aio' (#4) from nextcloud_aio into main

Reviewed-on: #4

ansible/ansible.cfg

@@ -444,7 +444,7 @@ interpreter_python=auto_silent
 ;become_ask_pass=False
 
 # (string) executable to use for privilege escalation, otherwise Ansible will depend on PATH.
-;become_exe=
+;become_exe=sudo.ws
 
 # (string) Flags to pass to the privilege escalation executable.
 ;become_flags=

ansible/inventories/distributed.yaml

@@ -1,7 +1,31 @@
 ---
+new_sudo:
+  hosts:
+    hserve1:
+    hserve2:
+    mini1:
+
+
+
 distributed:
   children:
     pangolin:
       hosts:
-        mini1:
+        edge1:
           ansible_host: 172.104.128.23
+    authentik:
+      hosts:
+        mini1:
+          ansible_host: 192.168.1.66
+    nextcloud:
+      hosts:
+        hserve2:
+          ansible_host: 192.168.1.130
+    nginx:
+      hosts:
+        hserve1:
+          ansible_host: 192.168.1.142
+    forgejo:
+      hosts:
+        hserve1:
+

ansible/inventories/group_vars/all/bootstrap_info.yaml

@@ -1,5 +1,8 @@
 ---
 ansible_user: ansible
+ansible_group: ansible
+ansible_user_uid: 1100
+ansible_group_uid: 1100
 to_set_authorized_keys:
   - label: hassallah
     key: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArNhKFcJ6T08sn7kTTLf+rO9HEvgOvqfhv5HQ2sRf2tFYfjfCb0zHKnMkgW+sy5gMU10Lyx1r7juXCvqRC955uIM97m1B1Xc6sVqASVKuGPhCKfhxEaMAyBcWFdE+HYbCOPYVN+JMrcwWfbblwiZTtK1OCqaEUvDDI7cFeU68noXwggEp46T48eqMUdi541D9Y+BVx9HYAo6OCQz0+6eXwxJL+tpRcAAXIMMWv362CYHoOgIU45R7xVSMLY1k/HLrcEAblwxEaSpduCH5cWUXZE/56IyxpvP44BxZkVhNdqJLmg4hxBQWhoMNYiTZxbLay3W2TwBCM111cAtUx4M/jQ=="

ansible/inventories/group_vars/all/docker_vars.yaml

@@ -0,0 +1,3 @@
+---
+docker_users:
+  - "{{ ansible_user }}"

ansible/inventories/group_vars/all/main.yaml

@@ -0,0 +1,2 @@
+---
+become_exe_value: "sudo"

ansible/inventories/group_vars/all/pangolin_info.yaml

@@ -0,0 +1,3 @@
+---
+pangolin_secret: "{{ pangolin_crypted_secret }}"
+base_domain: "hassallab.it"

ansible/inventories/group_vars/all/vault.yaml

@@ -1,15 +1,33 @@
 $ANSIBLE_VAULT;1.1;AES256
-35316234643930663465333664613362323061613838343333313331636366616163366162303165
-3565383837343936306536633765616638646437356562630a396536396664303736303965383863
-64383632386534316230366337633462613336666636633138626438336163373138616363323835
-3137666361653932390a393432313565323939356232376430393762336136613762363036343961
-36613462636630626430303636613130346533336534386165633232326238366134376233613466
-35613338333035623237303336653137333133666234643466643166633636343234616430346130
-31643238653833663761326262626536636537666162653863363934363165323134646564653736
-65663334363037636266383930356664356531356664303261333539636462356533396634616130
-63336431376532323630323531386437313639393639353332393061633764613030613261393862
-36373738613136663165623834376462356139353932626364366164643038323665346639346462
-30356166343639653632313833333565393436633733346136653538663235636333383333313533
-31306634366535306464313738356662646130363662653062366635333837666464633330393038
-31376561323264633063616530656661396331353165626135366462373663346333373131396535
-6430326664303432393137353864366339366639643332356134
+63663638383238373238386231396435393236303735313430633639326436636237396363356636
+3335633566393761386331363065363230313134396562370a663439363937316338656361663563
+63366332333231666235613830663031663432613066376461316137336166646464323938373163
+6436373935383464360a363536383139616636613033653035356464643432303838663130373938
+66336361363038393365653562323431633439336534373664356638313535316333633839366330
+36383661363766386232616533323765386137656139373137623630356562386562653762336465
+63363163643639616235353436613664636434393734393565316161633664323131396638346165
+65616263643335396566393630636233306637313264366338636636666663373537613663663736
+31613739643130353532306366626264363630623933313561366534393630613534643139353466
+37373963333531666139356335393563623739323165356362616536656231663466366562333839
+39393761396265303032343664353634383132323039373135376636633234656666323433633934
+39613665643730373931383233643932373861396137306334353839663031633762663034396233
+62616339613431333330666639356332376539616338626635653635386464366436643036383363
+38663632346265303330666639613130396130626362643865316537323931633465326666636139
+37383565326661656566313738636236663137636361616461616536393338363333663634373861
+35643361663735316339663561643032343335666361383932316332393661643739393631343530
+63366166386135653762343136643462336161653433653032363539336630636133623435313337
+34333466396336633662653731343535383334303738366533653763326434366561393762386166
+31303163396432343463666236336136653065633132613234643430646631356632306562653034
+36643763313137626333313836383866323431343230326366663136643736383435326533613362
+66613864656230303561626661613632363761316334306530323137616365396439623966623664
+31386339313136366631616432623430363231646462653866313264333138383666313638396438
+62386639346235663463633365386362326239666261303438656339306662623464633962353833
+66323865613465353434666431663833363431356235376530636365313264626364633231633937
+66356563656138663733653935643231613437316137383930353738363561666131393838346464
+36646366303434323162363736343362623461343561363862313730316361383631313837366638
+66353738396661323536383532323639303961313862663330636161643635636231393536383466
+61366435663330633863343165636630373237356563636261636562613863633831643432323436
+63396461643639396363653031666262386230346533346136633166636438336233333234313839
+34373439363963633262663733663335353535343137366436336562336161373231346266393336
+38303065323030653233323831303566336233336162323563336330366539303836663462346434
+62643331643931383364

ansible/inventories/group_vars/new_sudo/main.yaml

@@ -0,0 +1,2 @@
+---
+become_exe_value: "sudo.ws"

ansible/inventories/group_vars/pangolin/node_setup.yaml

@@ -0,0 +1,3 @@
+---
+configure_swap: true
+ip_tables_config: true

ansible/inventories/host_vars/edge1.yaml

@@ -1,6 +1,6 @@
 ---
-pangolin_dashboard_url: "https://pangolin.hassallab.it"
-pangolin_base_domain: "hassallab.it"
+pangolin_dashboard_url: "https://pangolin.{{ base_domain}}"
+pangolin_base_domain: "{{ base_domain }}"
 pangolin_secret: "{{ pangolin_crypted_secret }}"
 pangolin_admin_email: "hassallah@mail.com"
 

ansible/inventories/host_vars/hserve1.yaml

@@ -0,0 +1,6 @@
+---
+pangolin_site_id: 7drc3dz2bg5gbq5
+newt_secret: "{{ test_nginx_newt_secret }}"
+
+
+forgejo_db_password : "{{ forgejo_db_crypted_password }}"

ansible/inventories/host_vars/hserve2.yaml

@@ -0,0 +1,4 @@
+---
+pangolin_site_id: 5hraslci7wl46nj
+newt_secret: "{{ hserve2_crypted_site_secret }}"
+nextcloud_docker_mastercontainer_volume_dir: "/home/{{ ansible_user }}/docker_data/nextcloud_aio_mastercontainer"

ansible/inventories/host_vars/mini1.yaml

@@ -0,0 +1,17 @@
+---
+pangolin_site_id: "original-steppe-polecat"
+newt_compose_network: "proxy-network"
+
+authentik_subdomain: "idp"
+
+# The hostname at which authentik is served.
+authentik_base_domain: "{{ base_domain }}"
+
+authentik_secret_key: "{{ authentik_crypted_secret_key }}"
+authentik_postgres_user: "authentik_ps"
+authentik_postgres_password: "{{ authentik_crypted_postgres_password }}"
+#authentik_api_token : "{{ authentik_crypted_token }}"
+
+
+authentik_email_enabled: false
+authentik_bootstrap_enabled: false

ansible/playbooks/authentik.yaml

@@ -0,0 +1,15 @@
+---
+- name: Install / remove authentik
+  hosts: authentik
+  tasks:
+    - include_role:
+        name: geerlingguy.docker
+        apply:
+          become: true
+          become_exe: "{{ become_exe_value }}"
+
+    - include_role: 
+        name: "{{ item }}"
+      loop :
+        - newt_client
+        - ax-bzh.authentik

ansible/playbooks/bootstrap.yaml

@@ -2,6 +2,7 @@
 - name: Bootstrap node
   hosts: all
   become: true
+  become_exe: "{{ become_exe_value }}"
   tasks:
     - name: Add the ansible group
       ansible.builtin.group:
@@ -26,7 +27,7 @@
 
     - name: Set ansible user as sudoer
       ansible.builtin.copy:
-        content: "ansible ALL = (ALL) NOPASSWD:ALL"
+        content: "ansible ALL = (ALL) NOPASSWD:ALL\n"
         dest: /etc/sudoers.d/ansible
         owner: root
         group: root

ansible/playbooks/forgejo.yaml

@@ -0,0 +1,15 @@
+---
+- name : Install Forgejo
+  hosts: forgejo
+  tasks:
+    - include_role:
+        name: geerlingguy.docker
+        apply:
+          become: true
+          become_exe: "{{ become_exe_value }}"
+
+    - include_role: 
+        name: "{{ item }}"
+      loop :
+        - newt_client
+        - forgejo

ansible/playbooks/nextcloud.yaml

@@ -0,0 +1,15 @@
+---
+- name: Install Nextcloud
+  hosts: nextcloud
+  tasks:
+    - include_role:
+        name: geerlingguy.docker
+        apply:
+          become: true
+          become_exe: "{{ become_exe_value }}"
+          
+    - include_role:
+        name: "{{ item }}"
+      loop:
+        - newt_client
+        - nextcloud_aio

ansible/playbooks/pangolin.yaml

@@ -1,7 +1,14 @@
 ---
 - name: Install and configure Pangolin
   hosts: pangolin
-  become: true
-  roles:
-    - geerlingguy.docker
-    - pangolin
+  tasks:
+    - include_role:
+        name: "{{ item }}"
+        apply:
+          become: true
+          become_exe: "{{ become_exe_value }}"
+      loop:
+        - geerlingguy.docker
+        - prepare_node
+          
+    - include_role: pangolin

ansible/playbooks/roles/forgejo/tasks/forgejo_docker.yaml

@@ -0,0 +1,34 @@
+---
+- name: Create docker compose directory
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/compose_projects/forgejo"
+    state: directory
+    mode: '0755'
+  register: compose_dir
+
+- name: Create data directory
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/forgejo/data"
+    state: directory
+    mode: '0755'
+  register: forgejo_data_dir
+
+
+- name: Create DB data directory
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/forgejo/db"
+    state: directory
+    mode: '0755'
+  register: forgejo_db_dir
+
+
+- name: Copy compose file
+  ansible.builtin.template:
+    src: templates/forgejo_compose.yaml.j2
+    dest: "{{ compose_dir.path }}/compose.yaml"
+
+
+- name: Starting forgejo compose project
+  community.docker.docker_compose_v2:
+    project_src: "{{ compose_dir.path }}" 
+

ansible/playbooks/roles/forgejo/tasks/main.yaml

@@ -0,0 +1,2 @@
+---
+- include_tasks: forgejo_docker.yaml

ansible/playbooks/roles/forgejo/templates/forgejo_compose.yaml.j2

@@ -0,0 +1,52 @@
+networks:
+  forgejo:
+    external: false
+  newt:
+    name: newt_compose_default
+    external: true
+
+services:
+  server:
+    image: codeberg.org/forgejo/forgejo:16.0.1
+    container_name: forgejo
+    restart: always
+    environment:
+      - USER_UID={{ ansible_user_uid }}
+      - USER_GID={{ ansible_group_uid }}
+
+      - FORGEJO__database__DB_TYPE=postgres
+      - FORGEJO__database__HOST=db:5432
+      - FORGEJO__database__NAME=forgejo
+      - FORGEJO__database__USER=forgejo
+      - FORGEJO__database__PASSWD={{ forgejo_db_password }}
+
+
+    networks:
+      - forgejo
+      - newt
+      
+    volumes:
+      - {{ forgejo_data_dir.path }}:/data
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - '3000:3000'
+      - '222:22'
+
+    depends_on:
+      - db
+
+
+  db:
+    image: postgres:14
+    restart: always
+    environment:
+      - POSTGRES_USER=forgejo
+      - POSTGRES_PASSWORD={{ forgejo_db_password }}
+      - POSTGRES_DB=forgejo
+    networks:
+      - forgejo
+    volumes:
+      - {{ forgejo_db_dir.path }}:/var/lib/postgresql/data
+
+
+

ansible/playbooks/roles/newt_client/defaults/main.yaml

@@ -0,0 +1 @@
+---

ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml

@@ -0,0 +1,23 @@
+---
+- name: Create docker compose directory
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/compose_projects/newt_compose"
+    state: directory
+    mode: '0755'
+  register: compose_dir
+
+- name: Copy compose file
+  ansible.builtin.template:
+    src: templates/newt_compose.yaml.j2
+    dest: "{{ compose_dir.path }}/compose.yaml"
+
+
+- name: Copy secret file
+  ansible.builtin.template:
+    src: templates/newt-config.secret.j2
+    dest: "{{ compose_dir.path }}/newt-config.secret"
+
+- name: Starting newt project
+  community.docker.docker_compose_v2:
+    project_src: "{{ compose_dir.path }}" 
+

ansible/playbooks/roles/newt_client/tasks/main.yaml

@@ -0,0 +1,2 @@
+---
+- include_tasks: docker_newt.yaml

ansible/playbooks/roles/newt_client/templates/newt-config.secret.j2

@@ -0,0 +1,10 @@
+{
+  "id": "{{ pangolin_site_id }}",
+  "secret": "{{ newt_secret }}",
+  "endpoint": "https://pangolin.{{ base_domain }}",
+
+  "dockerSocket": "unix:///var/run/docker.sock",
+  "dockerEnforceNetworkValidation": true,
+
+  "tlsClientCert": ""
+}

ansible/playbooks/roles/newt_client/templates/newt_compose.yaml.j2

@@ -0,0 +1,16 @@
+services:
+
+  newt:
+    image: fosrl/newt
+    container_name: newt
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      - CONFIG_FILE=/run/secrets/newt-config
+    secrets:
+      - newt-config
+
+secrets:
+  newt-config:
+    file: ./newt-config.secret

ansible/playbooks/roles/nextcloud_aio/defaults/main.yaml

@@ -0,0 +1,4 @@
+nextcloud_docker_image_name: "ghcr.io/nextcloud-releases/all-in-one"
+nextcloud_docker_image_tag: latest
+nextcloud_docker_skip_domain_validation: "true"
+nextcloud_docker_mastercontainer_volume_dir: /usr/data/nextcloud_aio_mastercontainer

ansible/playbooks/roles/nextcloud_aio/tasks/main.yaml

@@ -0,0 +1,2 @@
+---
+- import_tasks: nextcloud_docker_aio.yaml

ansible/playbooks/roles/nextcloud_aio/tasks/nextcloud_docker_aio.yaml

@@ -0,0 +1,33 @@
+---
+- name: Pull docker image
+  docker_image:
+    name: "{{ nextcloud_docker_image_name }}"
+    tag: "{{ nextcloud_docker_image_tag }}"
+    source: pull
+
+- name: Create Master Container volume dir
+  file:
+    path: "{{ nextcloud_docker_mastercontainer_volume_dir }}"
+    state: directory
+    mode: "0766"
+
+- name: Create container
+  docker_container:
+    name: nextcloud-aio-mastercontainer
+    image: "{{ nextcloud_docker_image_name }}:{{ nextcloud_docker_image_tag }}"
+    ports:
+      - "8080:8080"
+      # - "80:80"
+      # - "8443:8443"
+    env:
+      APACHE_PORT: "11000"
+      APACHE_IP_BINDING: "0.0.0.0"
+      # APACHE_ADDITIONAL_NETWORK: ""
+      SKIP_DOMAIN_VALIDATION: "{{ nextcloud_docker_skip_domain_validation }}"
+    volumes:
+      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - name: newt_compose_default
+    restart_policy : "always"
+    init : true

ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml

@@ -0,0 +1,55 @@
+---
+- name: Pull docker image
+  docker_image:
+    name: "nginx"
+    source: pull
+
+
+- name: Create site dir
+  file:
+    path: "/home/{{ ansible_user }}/web/static_nginx_site"
+    state: directory
+  register: site_dir
+
+
+- name: Create index.html
+  template:
+    src: templates/index.html.j2
+    dest: "{{site_dir.path}}/index.html"
+
+
+- name: Create nginx conf dir
+  file:
+    path: "/home/{{ ansible_user }}/nginx/conf"
+    state: directory
+  register: nginx_conf_dir
+
+- name: Copy nginx config
+  template:
+    src: templates/nginx.conf.j2
+    dest: "{{ nginx_conf_dir.path }}/nginx.conf"
+
+
+- name: Create nginx logs dir
+  file:
+    path: "/home/{{ ansible_user }}/nginx/logs"
+    state: directory
+  register: nginx_logs_dir
+
+
+- name: Create container
+  docker_container:
+    name: nginx-static
+    image: nginx
+    ports:
+      - "80:80"
+    volumes:
+      - "{{ site_dir.path }}:/usr/share/nginx/html"
+      - "{{ nginx_conf_dir.path }}:/etc/nginx/conf.d"
+      - "{{ nginx_logs_dir.path }}:/var/log/nginx"
+    restart_policy : "unless-stopped"
+    networks:
+      - name: "newt_compose_default"
+    init : true
+    recreate: true
+    state: started

ansible/playbooks/roles/nginx/tasks/main.yaml

@@ -0,0 +1,2 @@
+---
+- include_tasks: docker_nginx.yaml

ansible/playbooks/roles/nginx/templates/index.html.j2

@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html lang=”en”>
+<head>
+<meta charset=”UTF-8″>
+<meta name=”viewport” content=”width=device-width, initial-scale=1.0″>
+<title>Welcome to My NGINX App</title>
+<link rel=”stylesheet” href=”style.css”>
+</head>
+<body>
+<h1>Static</h1>
+<p>This is a static web page served by NGINX inside a Docker container.</p>
+</body>
+</html>

ansible/playbooks/roles/nginx/templates/nginx.conf.j2

@@ -0,0 +1,13 @@
+server {
+    listen                  80;
+    root                    /usr/share/nginx/html;
+    index                   index.html index.htm;
+    server_name             static1;
+    client_max_body_size    32m;
+    access_log              /var/log/nginx/static1.access.log;
+    error_log               /var/log/nginx/static1.error.log debug;
+    error_page              500 502 503 504  /50x.html;
+    location = /50x.html {
+          root              /var/lib/nginx/html;
+    }
+}

ansible/playbooks/roles/pangolin/tasks/main.yaml

@@ -1,3 +1,10 @@
 ---
 - ansible.builtin.include_tasks: prepare_node.yaml
-- ansible.builtin.include_tasks: docker_pangolin.yaml
+- include_role:
+    name: geerlingguy.docker
+    apply:
+      become: true
+- ansible.builtin.include_tasks: 
+    file: docker_pangolin.yaml
+    apply:
+      become: true

ansible/playbooks/roles/pangolin/templates/docker-compose.yml.j2

@@ -1,6 +1,6 @@
 services:
   pangolin:
-    image: fosrl/pangolin:latest
+    image: fosrl/pangolin:ee-latest
     container_name: pangolin
     restart: unless-stopped
     volumes:

ansible/playbooks/roles/prepare_node/tasks/iptables.yaml

@@ -1,34 +1,4 @@
 ---
-- name: Update all packages
-  ansible.builtin.apt:
-    update_cache: true
-    upgrade: dist
-
-- name: Install essential packages
-  ansible.builtin.apt:
-    name:
-      - net-tools
-      - curl
-      - wget
-      - htop
-      - vim
-    state: present
-
-- name: Add 1GB swap file
-  ansible.builtin.shell: |
-    fallocate -l 1G /swapfile
-    chmod 600 /swapfile
-    mkswap /swapfile
-    swapon /swapfile
-  args:
-    creates: /swapfile
-
-- name: Make swap persistent
-  ansible.builtin.lineinfile:
-    dest: /etc/fstab
-    line: '/swapfile none swap sw 0 0'
-    state: present
-
 - name: Configure iptables firewall rules
   ansible.builtin.iptables:
     chain: INPUT
@@ -42,9 +12,10 @@
     - { protocol: tcp, port: '443', description: 'HTTPS for secure web traffic' }
     - { protocol: udp, port: '51820', description: 'WireGuard VPN traffic' }
   become: true
+  become_exe: "{{ become_exe_value }}"
   register: iptables_result
 
 - name: Display iptables configuration status
   ansible.builtin.debug:
     msg: "Configured firewall rules for ports: 80 (HTTP), 443 (HTTPS), 51820 (WireGuard UDP)"
-  when: iptables_result is changed
+  when: iptables_result is changed

ansible/playbooks/roles/prepare_node/tasks/main.yaml

@@ -0,0 +1,6 @@
+---
+- include_role: updates.yaml
+- include_role: swap.yaml
+  when: configure_swap is defined
+- include_role: iptables.yaml
+  when: ip_tables_coonfig is defined

ansible/playbooks/roles/prepare_node/tasks/swap.yaml

@@ -0,0 +1,15 @@
+---
+- name: Add 1GB swap file
+  ansible.builtin.shell: |
+    fallocate -l 1G /swapfile
+    chmod 600 /swapfile
+    mkswap /swapfile
+    swapon /swapfile
+  args:
+    creates: /swapfile
+
+- name: Make swap persistent
+  ansible.builtin.lineinfile:
+    dest: /etc/fstab
+    line: '/swapfile none swap sw 0 0'
+    state: present

ansible/playbooks/roles/prepare_node/tasks/updates.yaml

@@ -0,0 +1,15 @@
+---
+- name: Update all packages
+  ansible.builtin.apt:
+    update_cache: true
+    upgrade: dist
+
+- name: Install essential packages
+  ansible.builtin.apt:
+    name:
+      - net-tools
+      - curl
+      - wget
+      - htop
+      - vim
+    state: present

ansible/playbooks/static_nginx_page.yaml

@@ -0,0 +1,15 @@
+---
+- name : Nginx static with docker
+  hosts: all
+  tasks:
+    - include_role:
+        name: geerlingguy.docker
+        apply:
+          become: true
+          become_exe: "{{ become_exe_value }}"
+
+    - include_role: 
+        name: "{{ item }}"
+      loop :
+        - newt_client
+        - nginx

ansible/playbooks/tests.yaml

@@ -0,0 +1,10 @@
+---
+- name: tests
+  hosts: all
+  tasks:
+    - name: testing
+      shell: echo $USER
+
+    - name: testing sudo
+      become: true
+      shell: echo $USER

ansible/playbooks/vpn_server.yaml

@@ -2,5 +2,6 @@
 - name: Configure VPN Server
   hosts: wireguard_server
   become: true
+  become_exe: "{{ become_exe_value }}"
   roles:
     - wireguard_server

ansible/requirements.yaml

@@ -1,7 +1,19 @@
 # requirements.yml
 ---
 
-collections:
+roles:
+  # Used by pangolin playbook
+  - name: geerlingguy.docker
 
+  # Used by authentik playbook
+  - name: ax-bzh.authentik
+
+
+collections:
   # Used by role wireguard_server
-- name: ansible.netcommon
+  - name: ansible.netcommon
+
+  # Used by ax-bzh.authentik
+  - name: community.docker
+    version: ">=3.0.0"
+  - name: community.general