remove empty line

Reviewed-on: #10

ansible/inventories/distributed.yaml

@@ -4,7 +4,7 @@ new_sudo:
     hserve1:
     hserve2:
     mini1:
-
+    backs.hassallab.it:
 
 
 distributed:
@@ -28,4 +28,7 @@ distributed:
     forgejo:
       hosts:
         hserve1:
+    borg:
+      hosts:
+        backs.hassallab.it:
 

ansible/inventories/group_vars/all/borg.yaml

@@ -0,0 +1,2 @@
+---
+borg_backup_server: backs.hassallab.it

ansible/inventories/group_vars/all/docker_vars.yaml

@@ -1,5 +1,3 @@
 ---
 docker_users:
   - "{{ ansible_user }}"
-
-docker_compose_projects_base_path: "/home/{{ ansible_user }}/compose_projects"

ansible/inventories/group_vars/all/vault.yaml

@@ -1,33 +1,45 @@
 $ANSIBLE_VAULT;1.1;AES256
-63663638383238373238386231396435393236303735313430633639326436636237396363356636
+32326233646532393231613436626235366262343565626264386561616466353736303435303030
-3335633566393761386331363065363230313134396562370a663439363937316338656361663563
+3666386236333538303034383762663663373661613638360a646138343865643464333539393333
-63366332333231666235613830663031663432613066376461316137336166646464323938373163
+66616134326333356332303337376631313066366236633936343436656638663834616132303334
-6436373935383464360a363536383139616636613033653035356464643432303838663130373938
+3935626133353161340a393964346632346163376564316232653132363436353130396562653965
-66336361363038393365653562323431633439336534373664356638313535316333633839366330
+31333963373361353432323339633961313030363036353464313534346330353966666634643364
-36383661363766386232616533323765386137656139373137623630356562386562653762336465
+33643863346239303866313865363433343462393837396666636266323864343537666564303833
-63363163643639616235353436613664636434393734393565316161633664323131396638346165
+63323763646333343732303662306234346233373836326438343937303932323763346538626230
-65616263643335396566393630636233306637313264366338636636666663373537613663663736
+38633339643833616632636631316638396661633035396137373362326231303861313134383164
-31613739643130353532306366626264363630623933313561366534393630613534643139353466
+34366664616465313938323061306232373139343466346537326264613664336561366365333535
-37373963333531666139356335393563623739323165356362616536656231663466366562333839
+64393331383334653135333630346131633730333162663631376537323339373639323462653138
-39393761396265303032343664353634383132323039373135376636633234656666323433633934
+65396565336665626635623961343236646336396565646137366435373436353835343162393865
-39613665643730373931383233643932373861396137306334353839663031633762663034396233
+31666635636565616461353433376530613661343331663766626565346430653532653364353263
-62616339613431333330666639356332376539616338626635653635386464366436643036383363
+32663966393237626362383263663138653631653538653361366266643638653365373130613661
-38663632346265303330666639613130396130626362643865316537323931633465326666636139
+33333238323262363139623263663338633162616131303236376636313531623937303333633461
-37383565326661656566313738636236663137636361616461616536393338363333663634373861
+66653130623433666662343038353532393032636662323536656466636238643931656130396132
-35643361663735316339663561643032343335666361383932316332393661643739393631343530
+64636136653066393032343862663639636638323163343661636565623766303230626136663662
-63366166386135653762343136643462336161653433653032363539336630636133623435313337
+32653361343963396238356138363666333536623965626665643837633437343661323538333666
-34333466396336633662653731343535383334303738366533653763326434366561393762386166
+64353564326363313961363339346131356462326461656130376666616236316137386234316130
-31303163396432343463666236336136653065633132613234643430646631356632306562653034
+37666438336464646236343336623261366337343731356631313131323364636337373933663862
-36643763313137626333313836383866323431343230326366663136643736383435326533613362
+32646137636533653236326538663836303938393565343138393763323064363838663163643361
-66613864656230303561626661613632363761316334306530323137616365396439623966623664
+37316334623862313739316338633932356136343435306564333139346235393833653864393232
-31386339313136366631616432623430363231646462653866313264333138383666313638396438
+62316638363965336132303038363332613737613836653832373130356333636264383636383434
-62386639346235663463633365386362326239666261303438656339306662623464633962353833
+36383436376137633934356338653966373531323938653663396337653135316662386232336633
-66323865613465353434666431663833363431356235376530636365313264626364633231633937
+35373834393461623563663562646264356434323031343139373535623636623165386239383033
-66356563656138663733653935643231613437316137383930353738363561666131393838346464
+64373432313466666532343266373932316461646433633062373439613063646136663532306134
-36646366303434323162363736343362623461343561363862313730316361383631313837366638
+64613364616162323638646235353933313930626431373238633635386363633665646261303133
-66353738396661323536383532323639303961313862663330636161643635636231393536383466
+32303464633434633864303334653566343538386466656337663334623336303461393339653338
-61366435663330633863343165636630373237356563636261636562613863633831643432323436
+33396231646666376436343932656335613430626461643462363436396535353161373666333735
-63396461643639396363653031666262386230346533346136633166636438336233333234313839
+37303263653566353362363330653738303831643830316630303764343738393162323136613165
-34373439363963633262663733663335353535343137366436336562336161373231346266393336
+62323533313939336131303930363131373033626439326266633936353162643733373032643436
-38303065323030653233323831303566336233336162323563336330366539303836663462346434
+64363035343366356332646362353838376266313833623031386565303735326362646436636364
-62643331643931383364
+61336630363334383062616431383563363438613337623430386364626430633739633439333762
+66653334646535623336393763663238613134653562613062376130346133353361326365373536
+66383966316263326230313062613466663266666264653338303536333162653136396366313533
+61313131633737306335646233626435616563316430316634343663326364333332323564653837
+31336134633333303233326636363533383436616364323839396536616662303266366364623233
+31346563396464326566646435323165313934666530373435613861376164666435613335363535
+38356438393461383739313933353336326532336462303562653165303961383766333465363537
+66316161323932646430343565363638353038363033343363356463643331653138626165623361
+65346132373162643131626165333366623665326333303532643763343330653436376134393961
+31393634616564313564643030373637346136333133343432663438383965626536396239626135
+66366262346438616532373438396431383462373232396364303464633637366332663135326137
+32393535356234393232613239353565356630616636323465366537333362343239623338363932
+32383539346631323665

ansible/inventories/group_vars/borg/auth_users.yaml

@@ -0,0 +1,9 @@
+configure_borg_server: true
+borg_auth_users:
+  - host: fabotest
+    key: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArNhKFcJ6T08sn7kTTLf+rO9HEvgOvqfhv5HQ2sRf2tFYfjfCb0zHKnMkgW+sy5gMU10Lyx1r7juXCvqRC955uIM97m1B1Xc6sVqASVKuGPhCKfhxEaMAyBcWFdE+HYbCOPYVN+JMrcwWfbblwiZTtK1OCqaEUvDDI7cFeU68noXwggEp46T48eqMUdi541D9Y+BVx9HYAo6OCQz0+6eXwxJL+tpRcAAXIMMWv362CYHoOgIU45R7xVSMLY1k/HLrcEAblwxEaSpduCH5cWUXZE/56IyxpvP44BxZkVhNdqJLmg4hxBQWhoMNYiTZxbLay3W2TwBCM111cAtUx4M/jQ== fabio@pc-fabio"
+  - host: rup_next
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILWSd+iKs/Qsr2JGTprUC6sHsxyCadO3YF8U81aNF+IA root@nextcloud-aio-borgbackup"
+  - host: hassallab_next
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJmmOdetpapMz1S2dGPgJB7qodPU7RVj3bExnKv/B2zK root@nextcloud-aio-borgbackup"
+    

ansible/inventories/group_vars/pangolin/mail.yaml

@@ -0,0 +1,7 @@
+---
+pangolin_mail_host: "smtp.ionos.it"
+pangolin_mail_port: 587
+pangolin_mail_user: "system@hassallab.it"
+pangolin_mail_password: "{{ pangolin_mail_crypted_password }}"
+pangolin_no_reply_address: "system@hassallab.it"
+pangolin_mail_secure_flag: false

ansible/inventories/host_vars/edge1.yaml

@@ -6,9 +6,9 @@ pangolin_admin_email: "hassallah@mail.com"
 
 pangolin_gerbil_subnet_group: "10.42.0.0/16"
 
-# Email (SMTP) settings
+configure_borg_client: true
-pangolin_email_smtp_host: "mail.com"
+borg_repos:
-pangolin_email_smtp_port: 587
+  - name: pangolin
-pangolin_email_smtp_user: "pango.lin@mail.com"
+    borg_passphrase: "{{ edge1_backup_pangolin_crypted_password }}"
-pangolin_email_smtp_pass: "{{ pangolin_mail_crypted_password }}"
+    paths_to_backup:
-pangolin_email_no_reply: "no-reply@mail.com"
+      - "/home/{{ ansible_user }}/compose_projects/pangolin"

ansible/inventories/host_vars/hserve1.yaml

@@ -4,3 +4,14 @@ newt_secret: "{{ test_nginx_newt_secret }}"
 
 
 forgejo_db_password : "{{ forgejo_db_crypted_password }}"
+
+configure_borg_client: true
+borg_repos:
+  - name: web
+    borg_passphrase: "{{ hserve1_backup_web_crypted_password }}"
+    paths_to_backup:
+      - "/home/{{ ansible_user }}/web"
+  - name: forgejo
+    borg_passphrase: "{{ hserve1_backup_forgejo_crypted_password }}"
+    paths_to_backup:
+      - "/home/{{ ansible_user }}/compose_projects/forgejo"

ansible/playbooks/README.md

@@ -3,7 +3,19 @@
 Qui vengono riportati i playbook disponibili, descrizione e utilizzo. 
 **NB** Ci si aspetta che i playbook siano idempotenti. In caso contrario e' importante riportarlo nella documentazione corrente. 
 
+### Summary
+- [Bootstrap](#bootstrap)
+- [VPN Server](#vpn-server)
+- [Pangolin](#pangolin)
+- [Forgejo](#forgejo)
+- [Authentik](#authentik)
+- [Nextcloud](#nextcloud)
+- [Static Nginx Page](#static-nginx-page)
+- [Borg Backups](#borg-backups)
+
+
 ### Bootstrap
+
 Implementa la configurazione di base di un nodo per poter essere gestito dagli altri playbook, in particolare : 
 - crea l'utente ansible
 - registra le chiavi ssh degli utenti configurati
@@ -67,7 +79,73 @@ Il playbook installa docker e docker compose. Attraverso docker compose vengono
 
 Il playbook utilizza : 
 - [geerlingguy.docker](https://github.com/geerlingguy/ansible-role-docker) attraverso ansible galaxy
-- I ruoli common e pangolin definiti in [pangolin-ansible-terraform](https://github.com/patelanuj21/pangolin-ansible-terraform/tree/main), riportati staticamente come ruolo *pangolin*
+- Il ruolo ***prepare_node***
-
+- Il ruolo ***pangolin*** preso da [pangolin-ansible-terraform](https://github.com/patelanuj21/pangolin-ansible-terraform/tree/main)
 
 I parametri attesi dal playbook sono quelli definiti nei ruoli da cui dipende. 
+
+### Forgejo
+Il playbook installa docker e docker compose. Attraverso docker compose vengono poi lanciati container per [forgejo](https://forgejo.org/) e [newt_client](https://docs.pangolin.net/manage/sites/install-site).
+
+Il playbook utilizza : 
+- [geerlingguy.docker](https://github.com/geerlingguy/ansible-role-docker) attraverso ansible galaxy
+- I ruoli ***forgejo*** e ***newt_client***
+
+### Authentik 
+Il playbook installa docker e docker compose. Attraverso docker compose vengono poi lanciati container per [authentik](https://docs.goauthentik.io/) e [newt_client](https://docs.pangolin.net/manage/sites/install-site).
+
+Il playbook utilizza : 
+- [geerlingguy.docker](https://github.com/geerlingguy/ansible-role-docker) attraverso ansible galaxy
+- [ax-bzh.authentik](https://galaxy.ansible.com/ui/standalone/roles/ax-bzh/authentik/documentation/) attraverso ***ansible galaxy***
+- Il ruolo ***newt_client***
+
+### Nextcloud
+Il playbook installa docker e docker compose. Attraverso docker viene poi lanciato il container per [Nextcloud AIO](https://github.com/nextcloud/all-in-one) e [newt_client](https://docs.pangolin.net/manage/sites/install-site).
+
+Il playbook utilizza : 
+- [geerlingguy.docker](https://github.com/geerlingguy/ansible-role-docker) attraverso ansible galaxy
+- I ruoli ***newt_client*** e ***nextcloud_aio***
+
+### Static Nginx Page
+Il playbook installa docker e docker compose. Attraverso docker viene poi lanciato il container per [Nginx](https://nginx.org/) e [newt_client](https://docs.pangolin.net/manage/sites/install-site).
+
+Il playbook utilizza : 
+- [geerlingguy.docker](https://github.com/geerlingguy/ansible-role-docker) attraverso ansible galaxy
+- I ruoli ***newt_client*** e ***nginx***
+
+### Borg Backups
+Il playbook configura sia i client che il server per i backup effettuati con [borg](https://www.borgbackup.org/). I client vengono risolti dinamicamente verificando la presenza della seguente configurazione in esempio: 
+
+```
+configure_borg_client: True
+borg_repos:
+  - name: test
+    borg_passphrase: "dummy_secret"
+    paths_to_backup: 
+      - "/home/{{ ansible_user }}"
+      - "/proc/version"
+```
+
+Per ogni client vengono configurati : 
+- l'utente e relative credenziali per connettersi al borg server
+- Un servizio systemd **borg\_backup.service** e relativo timer **borg\_backup.timer** per eseguire il backup
+- Uno script che esegue effettivamente il backup **"/home/{{borg_user}}/backup\_script.sh"** verso *"ssh://{{ borg\_user }}@{{ borg\_backup_server }}/./"*
+
+Sul server vengono configurati: 
+- L'utente con cui eseguire borg service
+- Le credenziali attese utilizzate dai vari client e i rispettivi path permessi per eseguire i report. 
+
+Sul server i permessi concessi ai vari client vengono limitati definendo su ***/home/{{borg\_user}}/.ssh/authorized\_keys*** le limitazioni di path (accesso solo al proprio repo) e di operation (solo ***"borg serve"***) con la seguente istruzione : 
+```
+command=\"cd {{ borg_pool }}/{{ item.host }};borg serve --restrict-to-path {{ borg_pool }}/{{ item.host }}\",restrict
+```
+
+E' possibile configurare il server per servire borg anche con altre credenziali e path, per casi non coperti dal playbook (e.g. borg backups usato direttamente da Nextcloud AIO) attraverso il seguente attributo: 
+
+```
+borg_auth_users:
+  - host: fabotest
+    key: "ssh-rsa ********"
+```
+
+Il playbook utilizza il role ***borg***

ansible/playbooks/borg_backups.yaml

@@ -0,0 +1,32 @@
+---
+- name: Evaluate borg client nodes
+  hosts: all
+  tags: clients
+  gather_facts: false
+  tasks:
+  - name: Gather configured clients
+    ansible.builtin.group_by:
+      key: "borg_clients_{{ configure_borg_client | default('False') }}"
+  # Creates: borg_clients_True and borg_clients_False
+
+
+- name: Configure borg backups system
+  tags: server
+  hosts: borg_clients_True:borg
+  debugger: on_failed
+  tasks: 
+    - name: Configure clients
+      include_role:
+        name: borg
+        apply:
+          become: true
+          become_exe: "{{ become_exe_value }}"
+      when: configure_borg_client | default(false)
+
+    - name: Configure server
+      include_role:
+        name: borg
+        apply:
+          become: true
+          become_exe: "{{ become_exe_value }}"
+      when: configure_borg_server | default(false)

ansible/playbooks/roles/borg/defaults/main.yaml

@@ -0,0 +1,8 @@
+---
+borg_user: borg
+borg_group: borg
+borg_home: "/home/{{ borg_user }}"
+borg_pool: "{{ borg_home }}/repos"
+borg_pool_dest : /usr/backups/borg_repos
+borg_repo_base: "ssh://{{ borg_user }}@{{ borg_backup_server }}/./"
+borg_auth_users: []

ansible/playbooks/roles/borg/tasks/configure_borg_client.yaml

@@ -0,0 +1,44 @@
+---
+- name: Define backup script
+  ansible.builtin.template:
+    dest: "/home/{{borg_user}}/backup_script.sh"
+    src: templates/backup_script.sh.j2
+    owner: root
+    mode: "0701"
+
+- name: Define backup service
+  ansible.builtin.template:
+    dest: /etc/systemd/system/borg_backup.service
+    src: templates/borg_backup.service.j2
+    owner: root
+    mode: "0700"
+
+
+- name: Define backup timer
+  ansible.builtin.copy:
+    content: |
+      [Unit]
+      Description=Daily Backup Timer
+
+      [Timer]
+      OnCalendar=*-*-* 02:00:00
+      Persistent=true
+      RandomizedDelaySec=300
+
+      [Install]
+      WantedBy=timers.target
+    dest: /etc/systemd/system/borg_backup.timer
+
+- name: Reload systemd
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+
+# Add entry in borg_auth_users for server configuration
+# borg_auth_users:
+#       - host: fabotest
+#         # Chiave di esempio per test
+#         key: "ssh-rsa ****"
+
+- name: Register public key for server configuration
+  set_fact:
+    borg_auth_users: "{{ borg_auth_users + [{'host': inventory_hostname, 'key':borg_user_definition.ssh_public_key}] }}"

ansible/playbooks/roles/borg/tasks/configure_borg_server.yaml

@@ -0,0 +1,51 @@
+---
+- name: Set ssh directory
+  file:
+    path: "{{ borg_home }}/.ssh"
+    owner: "{{ borg_user }}"
+    group: "{{ borg_group }}"
+    mode: "0700"
+    state: directory
+
+- name: Create pool directory
+  file:
+    path: "{{ borg_pool_dest}}"
+    owner: "{{ borg_user }}"
+    group: "{{ borg_group }}"
+    mode: "0700"
+    state: directory
+
+- name: Set pool directory link
+  file:
+    src: "{{ borg_pool_dest }}"
+    dest: "{{ borg_pool }}"
+    state: link
+
+- name: Gathering clients configurations
+  set_fact:
+    borg_auth_users: "{{ borg_auth_users + hostvars[item]['borg_auth_users']}}"
+  loop: "{{ groups['borg_clients_True'] }}"
+
+- name: Creating pool sub directories
+  file:
+    path: "{{ borg_pool }}/{{ item.host }}"
+    owner: "{{ borg_user }}"
+    group: "{{ borg_group }}"
+    mode: "0700"
+    state: directory
+  with_items: "{{ borg_auth_users }}"
+
+- name: Defining authorized_key
+  authorized_key:
+    user: "{{ borg_user }}"
+    key: "{{ item.key }}"
+    key_options: "command=\"cd {{ borg_pool }}/{{ item.host }};borg serve --restrict-to-path {{ borg_pool }}/{{ item.host }}\",restrict"
+  with_items: "{{ borg_auth_users }}"
+
+- name: Setting authorized keys file
+  file:
+    path: "{{ borg_home }}/.ssh/authorized_keys"
+    owner: "{{ borg_user }}"
+    group: "{{ borg_group }}"
+    mode: "0600"
+    state: file

ansible/playbooks/roles/borg/tasks/main.yaml

@@ -0,0 +1,9 @@
+---
+- name: Prepare borg
+  include_tasks: prepare_borg.yaml
+- name: Configure server
+  include_tasks: configure_borg_server.yaml
+  when: configure_borg_server | default(false)
+- name: Configure client
+  include_tasks: configure_borg_client.yaml
+  when: configure_borg_client | default(false)

ansible/playbooks/roles/borg/tasks/prepare_borg.yaml

@@ -0,0 +1,21 @@
+---
+- name: Install borg and requirements
+  ansible.builtin.package:
+    name: borgbackup
+    state: present
+
+- name: Set borg user group
+  group:
+    name: "{{ borg_group }}"
+    state: present
+
+- name: Set borg user
+  user:
+    name: "{{ borg_user }}"
+    shell: /bin/bash
+    home: "{{ borg_home }}"
+    create_home: true
+    group: "{{ borg_group }}"
+    state: present
+    generate_ssh_key: "{{ configure_borg_client | default(false) }}"
+  register: borg_user_definition

ansible/playbooks/roles/borg/templates/backup_script.sh.j2

@@ -0,0 +1,86 @@
+#!/bin/bash
+{% for repo_item in borg_repos %}
+
+# Setting this, so the repo does not need to be given on the commandline:
+export BORG_REPO="{{borg_repo_base}}{{repo_item.name}}"
+
+# See the section "Passphrase notes" for more infos.
+export BORG_PASSPHRASE="'{{ repo_item.borg_passphrase }}'"
+
+# some helpers and error handling:
+info() { logger "$*"; }
+trap 'echo $( date ) Backup interrupted >&2; exit 2' INT TERM
+
+info "Trying to initialize repo. NB returns error if already initialized"
+borg init --encryption=repokey
+
+info "Starting backup for repo {{repo_item.name}}"
+
+# Backup the most important directories into an archive named after
+# the machine this script is currently running on:
+
+borg create                         \
+    --verbose                       \
+    --filter AME                    \
+    --list                          \
+    --stats                         \
+    --show-rc                       \
+    --compression lz4               \
+    --exclude-caches                \
+    --exclude 'home/*/.cache/*'     \
+    --exclude 'var/tmp/*'           \
+                                    \
+    ::"'{{ inventory_hostname }}-{now}'"\
+    {% for item in repo_item.paths_to_backup %}
+    {{ item }}\
+    {% endfor %}
+
+backup_exit=$?
+
+info "Pruning repository {{ repo_item.name }}"
+
+# Use the `prune` subcommand to maintain 7 daily, 4 weekly and 6 monthly
+# archives of THIS machine. The '{hostname}-*' matching is very important to
+# limit prune's operation to this machine's archives and not apply to
+# other machines' archives also:
+
+borg prune                          \
+    --list                          \
+    --glob-archives "'{{ inventory_hostname }}-*'"  \
+    --show-rc                       \
+    --keep-daily    7               \
+    --keep-weekly   4               \
+    --keep-monthly  6
+
+prune_exit=$?
+
+# actually free repo disk space by compacting segments
+
+info "Compacting repository {{ repo_item.name }}"
+
+borg compact
+
+compact_exit=$?
+
+# use highest exit code as global exit code
+global_exit=$(( backup_exit > prune_exit ? backup_exit : prune_exit ))
+global_exit=$(( compact_exit > global_exit ? compact_exit : global_exit ))
+
+if [ ${global_exit} -eq 0 ]; then
+    info "Backup, Prune, and Compact finished successfully"
+elif [ ${global_exit} -eq 1 ]; then
+    info "Backup, Prune, and/or Compact finished with warnings"
+else
+    info "Backup, Prune, and/or Compact finished with errors"
+fi
+
+
+# end loop for repos
+
+{% endfor %}
+
+
+exit ${global_exit}
+
+
+

ansible/playbooks/roles/borg/templates/borg_backup.service.j2

@@ -0,0 +1,13 @@
+[Unit]
+Description=Borg Backup
+
+[Service]
+Type=oneshot
+User={{ borg_user }}
+ExecStart=/home/{{borg_user}}/backup_script.sh
+
+AmbientCapabilities=CAP_DAC_READ_SEARCH
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=borg

ansible/playbooks/roles/forgejo/tasks/forgejo_docker.yaml

@@ -1,14 +1,14 @@
 ---
 - name: Create docker compose directory
   ansible.builtin.file:
-    path: "{{ docker_compose_projects_base_path }}/forgejo"
+    path: "/home/{{ ansible_user }}/compose_projects/forgejo"
     state: directory
     mode: '0755'
   register: compose_dir
 
 - name: Create data directory
   ansible.builtin.file:
-    path: "{{ compose_dir }}/data"
+    path: "{{ compose_dir.path }}/data"
     state: directory
     mode: '0755'
   register: forgejo_data_dir
@@ -16,7 +16,7 @@
 
 - name: Create DB data directory
   ansible.builtin.file:
-    path: "{{ compose_dir }}/db"
+    path: "{{ compose_dir.path }}/db"
     state: directory
     mode: '0755'
   register: forgejo_db_dir

ansible/playbooks/roles/forgejo/tasks/main.yaml

@@ -1,2 +1,4 @@
 ---
 - include_tasks: forgejo_docker.yaml
+  tags:
+    - forgejo

ansible/playbooks/roles/forgejo/templates/forgejo_compose.yaml.j2

@@ -7,7 +7,8 @@ networks:
 
 services:
   server:
-    image: codeberg.org/forgejo/forgejo:16.0.1
+    image: codeberg.org/forgejo/forgejo:16.0.1-rootless
+    user: "{{ ansible_user_uid }}:{{ ansible_group_uid }}"
     container_name: forgejo
     restart: always
     environment:
@@ -26,11 +27,11 @@ services:
       - newt
       
     volumes:
-      - {{ forgejo_data_dir.path }}:/data
       - /etc/localtime:/etc/localtime:ro
+      - {{ forgejo_data_dir.path }}/gitea:/var/lib/gitea
     ports:
       - '3000:3000'
-      - '222:22'
+      - "222:2222"
 
     depends_on:
       - db
@@ -39,6 +40,7 @@ services:
   db:
     image: postgres:14
     restart: always
+    user: "{{ ansible_user_uid }}:{{ ansible_group_uid }}"
     environment:
       - POSTGRES_USER=forgejo
       - POSTGRES_PASSWORD={{ forgejo_db_password }}

ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml

@@ -1,7 +1,7 @@
 ---
 - name: Create docker compose directory
   ansible.builtin.file:
-    path: "{{ docker_compose_projects_base_path }}/newt_compose"
+    path: "/home/{{ ansible_user }}/compose_projects/newt_compose"
     state: directory
     mode: '0755'
   register: compose_dir

ansible/playbooks/roles/newt_client/tasks/main.yaml

@@ -1,2 +1,4 @@
 ---
 - include_tasks: docker_newt.yaml
+  tags:
+    - newt

ansible/playbooks/roles/nextcloud_aio/tasks/main.yaml

@@ -1,2 +1,4 @@
 ---
 - import_tasks: nextcloud_docker_aio.yaml
+  tags:
+    - nextcloud

ansible/playbooks/roles/nginx/tasks/main.yaml

@@ -1,2 +1,4 @@
 ---
 - include_tasks: docker_nginx.yaml
+  tags:
+    - nginx

ansible/playbooks/roles/pangolin/defaults/main.yaml

@@ -1,12 +1,4 @@
 ---
-pangolin_version: "ee-latest"
-gerbil_version: "latest"
-traefik_version: "latest"
-
-
-pangolin_base_path: "{{ docker_compose_projects_base_path }}/pangolin"
-
-
 # Derived Variables
 pangolin_cors_origin: "{{ pangolin_dashboard_url }}"
 

ansible/playbooks/roles/pangolin/tasks/docker_pangolin.yaml

@@ -1,46 +1,52 @@
 ---
 - name: Ensure Pangolin directory exists
   ansible.builtin.file:
-    path: "{{ pangolin_base_path }}"
+    path: "/home/{{ ansible_user }}/compose_projects/pangolin"
     state: directory
+    mode: '0755'
+  register: compose_dir
 
 - name: Ensure Pangolin config directory exists
   ansible.builtin.file:
-    path: "{{ pangolin_base_path }}/pangolin_config"
+    path: "{{ compose_dir.path }}/pangolin_config"
     state: directory
-  register: pangolin_config_dir
+    mode: '0755'
+  register: pangolin_config
 
 - name: Template Pangolin config file
   ansible.builtin.template:
     src: pangolin_config.yml.j2
-    dest: "{{ pangolin_config_dir.path }}/config.yaml"
+    dest: "{{ pangolin_config.path }}/config.yaml"
-
-- name: Ensure Letsencrypt config directory exists
-  ansible.builtin.file:
-    path: "{{ pangolin_config_dir.path }}/letsencrypt"
-    state: directory
-  register: letsencrypt_config_directory
 
 - name: Ensure Traefik config directory exists
   ansible.builtin.file:
-    path: "{{ pangolin_config_dir.path }}/traefik"
+    path: "{{ pangolin_config.path }}/traefik"
+    mode: '0755'
     state: directory
-  register: traefik_config_directory
+  register: traefik_config
+
+- name: Ensure gerbil config directory exists
+  ansible.builtin.file:
+    path: "{{ pangolin_config.path }}/gerbil"
+    mode: '0755'
+    state: directory
+  register: gerbil_config
+
 
 - name: Template Traefik config file
   ansible.builtin.template:
     src: traefik_config.yml.j2
-    dest: "{{ traefik_config_directory.path }}/traefik_config.yml"
+    dest: "{{ traefik_config.path }}/traefik_config.yml"
 
 - name: Template Traefik dynamic config file
   ansible.builtin.template:
     src: dynamic_config.yml.j2
-    dest: "{{ traefik_config_directory.path }}/dynamic_config.yml"
+    dest: "{{ traefik_config.path }}/dynamic_config.yml"
 
 - name: Template docker-compose.yml for Pangolin
   ansible.builtin.template:
     src: docker-compose.yml.j2
-    dest: "{{ pangolin_base_path }}/docker-compose.yml"
+    dest: "{{ compose_dir.path }}/docker-compose.yml"
   register: pangolin_compose_template
 
 - name: Check if Pangolin container is running
@@ -70,23 +76,27 @@
   when: pangolin_compose_needs_up
   ignore_errors: true
 
-- name: Start Pangolin and Gerbil with Docker Compose (force recreate if needed)
+- name: (Re)Start Pangolin and Gerbil with Docker Compose
-  ansible.builtin.shell: |
+  community.docker.docker_compose_v2:
-    cd {{ pangolin_base_path }}
+    project_src: "{{ compose_dir.path }}" 
-    docker compose up -d --force-recreate
-  when: pangolin_compose_needs_up
-  register: docker_compose_up
-  failed_when: docker_compose_up.rc != 0
-
-- name: Check Docker Compose service status
-  ansible.builtin.shell: |
-    cd {{ pangolin_base_path }}
-    docker compose ps
   register: docker_compose_status
+  state: restarted
+  # ansible.builtin.shell: |
+  #   cd /home/ubuntu/pangolin
+  #   docker compose up -d --force-recreate
+  # when: pangolin_compose_needs_up
+  # register: docker_compose_up
+  # failed_when: docker_compose_up.rc != 0
+
+# - name: Check Docker Compose service status
+#   ansible.builtin.shell: |
+#     cd /home/ubuntu/pangolin
+#     docker compose ps
+#   register: docker_compose_status
 
 - name: Display Docker Compose service status
   ansible.builtin.debug:
-    msg: "{{ docker_compose_status.stdout_lines }}"
+    msg: "{{ docker_compose_status }}"
 
 - name: "Assert that mandatory variables are defined and not default"
   ansible.builtin.assert:

ansible/playbooks/roles/pangolin/tasks/main.yaml

@@ -1,3 +1,5 @@
 ---
-- ansible.builtin.include_tasks: 
+- include_tasks: docker_pangolin.yaml
-    file: docker_pangolin.yaml
+  tags:
+    - pamgolin
+

ansible/playbooks/roles/pangolin/templates/docker-compose.yml.j2

@@ -1,10 +1,10 @@
 services:
   pangolin:
-    image: fosrl/pangolin:{{ pangolin_version }}
+    image: fosrl/pangolin:ee-latest
     container_name: pangolin
     restart: unless-stopped
     volumes:
-      - {{ pangolin_config_dir.path }}:/app/config
+      - {{ pangolin_config.path }}:/app/config
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
       interval: "3s"
@@ -12,7 +12,7 @@ services:
       retries: 15
 
   gerbil:
-    image: fosrl/gerbil:{{ gerbil_version }}
+    image: fosrl/gerbil:1.0.0
     container_name: gerbil
     restart: unless-stopped
     depends_on:
@@ -24,18 +24,17 @@ services:
       - --remoteConfig=http://pangolin:3001/api/v1/gerbil/get-config
       - --reportBandwidthTo=http://pangolin:3001/api/v1/gerbil/receive-bandwidth
     volumes:
-      - ./gerbil_config/:/var/config
+      - {{ gerbil_config.path }}:/var/config
     cap_add:
       - NET_ADMIN
       - SYS_MODULE
     ports:
       - 51820:51820/udp
-      - 21820:21820/udp
       - 443:443 # Port for traefik because of the network_mode
       - 80:80 # Port for traefik because of the network_mode
 
   traefik:
-    image: traefik:{{ traefik_version }}
+    image: traefik:v3.4.1
     container_name: traefik
     restart: unless-stopped
     network_mode: service:gerbil # Ports appear on the gerbil service
@@ -45,9 +44,9 @@ services:
     command:
       - --configFile=/etc/traefik/traefik_config.yml
     volumes:
-      - {{ traefik_config_directory.path }}:/etc/traefik:ro # Volume to store the Traefik configuration
+      - {{ traefik_config.path }}:/etc/traefik:ro # Volume to store the Traefik configuration
-      - {{ letsencrypt_config_directory.path }}:/letsencrypt # Volume to store the Let's Encrypt certificates
+      - {{ pangolin_config.path }}/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
-      - {{ traefik_config_directory.path }}/logs:/var/log/traefik # Volume to store Traefik logs
+      - {{ traefik_config.path }}/logs:/var/log/traefik # Volume to store Traefik logs
 networks:
   default:
     driver: bridge

ansible/playbooks/roles/pangolin/templates/pangolin_config.yml.j2

@@ -20,3 +20,12 @@ server:
 gerbil:
   start_port: {{ pangolin_gerbil_start_port }}
   base_endpoint: "{{ pangolin_dashboard_url | regex_replace('^https://', '') }}" # Gerbil endpoint should be the FQDN, not the full URL
+
+
+email:
+  smtp_host: "{{ pangolin_mail_host}}"
+  smtp_port: {{ pangolin_mail_port }}
+  smtp_user: "{{ pangolin_mail_user }}"
+  smtp_pass: "{{ pangolin_mail_password }}"
+  smtp_secure: {{ pangolin_mail_secure_flag }}
+  no-reply: "{{ pangolin_no_reply_address }}"

ansible/playbooks/roles/prepare_node/tasks/iptables.yaml

@@ -11,12 +11,11 @@
     - { protocol: tcp, port: '80', description: 'HTTP for Lets Encrypt ACME challenge' }
     - { protocol: tcp, port: '443', description: 'HTTPS for secure web traffic' }
     - { protocol: udp, port: '51820', description: 'WireGuard VPN traffic' }
-    - { protocol: udp, port: '21820', description: 'WireGuard VPN traffic clients' }
   become: true
   become_exe: "{{ become_exe_value }}"
   register: iptables_result
 
 - name: Display iptables configuration status
   ansible.builtin.debug:
-    msg: "Configured firewall rules for ports: 80 (HTTP), 443 (HTTPS), 51820 (WireGuard UDP), 21820 (VPN UDP clients)"
+    msg: "Configured firewall rules for ports: 80 (HTTP), 443 (HTTPS), 51820 (WireGuard UDP)"
   when: iptables_result is changed

ansible/playbooks/roles/prepare_node/tasks/main.yaml

@@ -1,18 +1,6 @@
 ---
-- ansible.builtin.include_tasks: 
+- include_tasks: updates.yaml
-    file: updates.yaml
+- include_tasks: swap.yaml
-    apply:
-      become: true
-
-- ansible.builtin.include_tasks: 
-    file: swap.yaml
-    apply:
-      become: true
   when: configure_swap is defined
-
+- include_tasks: iptables.yaml
-  
-- ansible.builtin.include_tasks: 
-    file: iptables.yaml
-    apply:
-      become: true
   when: ip_tables_coonfig is defined

ansible/playbooks/roles/vaultwarden/defaults/main.yaml

@@ -0,0 +1,2 @@
+vaultwarden_signup_allowed: true
+vaultwarden_image_tag: 1.37.2

ansible/playbooks/roles/vaultwarden/tasks/main.yaml

@@ -0,0 +1,4 @@
+---
+- include_tasks: vaultwarden_docker.yaml
+  tags:
+    - vaultwarden

ansible/playbooks/roles/vaultwarden/tasks/vaultwarden_docker.yaml

@@ -0,0 +1,24 @@
+---
+- name: Create docker compose directory
+  ansible.builtin.file:
+    path: "{{ docker_compose_projects_base_path }}/vaultwarden"
+    state: directory
+    mode: '0755'
+  register: compose_dir
+
+- name: Create data directory
+  ansible.builtin.file:
+    path: "{{ compose_dir.path }}/data"
+    state: directory
+    mode: '0755'
+  register: vaultwarden_data_dir
+
+- name: Copy compose file
+  ansible.builtin.template:
+    src: templates/vaultwarden_compose.yaml.j2
+    dest: "{{ compose_dir.path }}/compose.yaml"
+
+
+- name: Starting Vaultwarden compose project
+  community.docker.docker_compose_v2:
+    project_src: "{{ compose_dir.path }}" 

ansible/playbooks/roles/vaultwarden/templates/vaultwarden_compose.yaml.j2

@@ -0,0 +1,19 @@
+networks:
+  newt:
+    name: newt_compose_default
+    external: true
+
+services:
+  vaultwarden:
+    image: vaultwarden/server:{{ vaultwarden_image_tag }}
+    container_name: vaultwarden
+    restart: always
+    environment:
+      # DOMAIN: "https://vaultwarden.example.com"  # required when using a reverse proxy; your domain; vaultwarden needs to know it's https to work properly with attachments
+      SIGNUPS_ALLOWED: "{{ vaultwarden_signup_allowed }}" # Deactivate this with "false" after you have created your account so that no strangers can register
+    volumes:
+      - {{ vaultwarden_data_dir.path }}:/data # the path before the : can be changed
+    ports:
+      - 11001:80 # you can replace the 11001 with your preferred port
+    networks:
+      - newt

ansible/playbooks/vaultwarden.yaml

@@ -0,0 +1,15 @@
+---
+- name: Install Vaultwarden
+  hosts: vaultwarden
+  tasks:
+    - include_role:
+        name: geerlingguy.docker
+        apply:
+          become: true
+          become_exe: "{{ become_exe_value }}"
+          
+    - include_role:
+        name: "{{ item }}"
+      loop:
+        - newt_client
+        - vaultwarden