This commit is contained in:
@@ -1,8 +0,0 @@
|
||||
# All tasks for misc, use this to check whether everything is deployed.
|
||||
---
|
||||
- name: Set up basic packages, Docker, Nix, sshd
|
||||
import_playbook: misc-setup.yaml
|
||||
- name: Deploy Docker configuration
|
||||
import_playbook: misc-docker.yaml
|
||||
- name: Check out static websites from git
|
||||
import_playbook: misc-sites.yaml
|
||||
@@ -1,160 +0,0 @@
|
||||
---
|
||||
- name: Update Docker configuration on shamash
|
||||
hosts: misc
|
||||
tasks:
|
||||
- name: Add users for running containers
|
||||
become: true
|
||||
ansible.builtin.user:
|
||||
name: "{{ item.name }}"
|
||||
uid: "{{ item.uid }}"
|
||||
state: "{{ item.state }}"
|
||||
create_home: false
|
||||
system: true
|
||||
loop:
|
||||
- name: jupyter
|
||||
uid: 42000
|
||||
state: present
|
||||
- name: gitea
|
||||
uid: 42001
|
||||
state: present
|
||||
- name: factorio
|
||||
uid: 845
|
||||
state: present
|
||||
- name: hackmd
|
||||
uid: 1500
|
||||
state: present
|
||||
|
||||
- name: hedgedoc
|
||||
uid: 10000
|
||||
state: absent
|
||||
- name: bsa
|
||||
uid: 42002
|
||||
state: absent
|
||||
- name: score
|
||||
uid: 42003
|
||||
state: absent
|
||||
# All services that are behind Caddy need to be in this network
|
||||
- name: Create Caddy network
|
||||
become: true
|
||||
community.docker.docker_network:
|
||||
name: caddy-network
|
||||
state: present
|
||||
- name: Upload docker configuration
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
src: ../../docker/docker
|
||||
dest: /etc/pbri
|
||||
# Files should inaccessible to non-root users.
|
||||
mode: u=rw,g=,o=
|
||||
# Directories should be listable
|
||||
directory_mode: u=rwx,g=rx,o=rx
|
||||
- name: Upload and decrypt docker environment vars
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
src: "../../docker/envs/{{ item.name }}/.env"
|
||||
dest: /etc/pbri/docker/{{ item.name }}/.env
|
||||
# Files should inaccessible to non-root users.
|
||||
mode: u=rw,g=,o=
|
||||
# This is true by default but I put it here anyways
|
||||
# to emphasize what's happening
|
||||
decrypt: true
|
||||
# Not quite happy with all the seperate loops yet.
|
||||
loop:
|
||||
- name: codi
|
||||
state: present
|
||||
- name: drone
|
||||
state: present
|
||||
- name: factorio
|
||||
state: present
|
||||
- name: gitea
|
||||
state: present
|
||||
- name: vrnp
|
||||
state: present
|
||||
- name: Create directory for docker volumes
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /var/lib/pbri/docker
|
||||
state: directory
|
||||
# Hide contents from non-root users
|
||||
mode: u=rwx,g=,o=
|
||||
- name: Create jupyter folders
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "/var/lib/pbri/docker/{{ item.name }}"
|
||||
owner: "{{ item.user }}"
|
||||
group: "{{ item.user }}"
|
||||
state: directory
|
||||
mode: u=rwx,g=,o=
|
||||
loop:
|
||||
- name: jupyter_data
|
||||
user: jupyter
|
||||
- name: jupyter_notebooks
|
||||
user: jupyter
|
||||
- name: Create Factorio data folder
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /var/lib/pbri/docker/factorio
|
||||
state: directory
|
||||
owner: factorio
|
||||
group: factorio
|
||||
mode: u=rwx,g=,o=
|
||||
- name: Delete score data folder
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /var/lib/pbri/docker/score
|
||||
state: absent
|
||||
owner: score
|
||||
group: score
|
||||
mode: u=rwx,g=,o=
|
||||
# Since some docker-compose configuration might want to pull
|
||||
# images from the Gitea package repository, we need to ensure
|
||||
# that Gitea is reachable before those configurations are deployed.
|
||||
- name: Set up caddy and gitea containers
|
||||
become: true
|
||||
community.docker.docker_compose_v2:
|
||||
project_src: "/etc/pbri/docker/{{ item.name }}"
|
||||
state: "{{ item.state }}"
|
||||
build: "always"
|
||||
pull: "always"
|
||||
loop:
|
||||
- name: caddy
|
||||
state: present
|
||||
- name: gitea
|
||||
state: present
|
||||
# Before deploying the remaining configs below, we check that
|
||||
# Gitea is reachable at git.pbrinkmeier.de
|
||||
- name: Wait for gitea to be reachable
|
||||
check_mode: false
|
||||
ansible.builtin.uri:
|
||||
method: GET
|
||||
url: https://git.pbrinkmeier.de/api/v1/version
|
||||
register: gitea_version_response
|
||||
until: gitea_version_response.status == 200
|
||||
retries: 10
|
||||
delay: 5 # Retry every 5 seconds
|
||||
- name: Set up other containers
|
||||
become: true
|
||||
community.docker.docker_compose_v2:
|
||||
project_src: "/etc/pbri/docker/{{ item.name }}"
|
||||
state: "{{ item.state }}"
|
||||
build: "always"
|
||||
pull: "always"
|
||||
loop:
|
||||
- name: drone
|
||||
state: present
|
||||
- name: codi
|
||||
state: present
|
||||
- name: jupyter
|
||||
state: present
|
||||
- name: utoy
|
||||
state: present
|
||||
- name: vrnp
|
||||
state: present
|
||||
|
||||
# Keep these to ensure they're down
|
||||
- name: factorio
|
||||
state: absent
|
||||
- name: glebby
|
||||
state: absent
|
||||
- name: score
|
||||
state: absent
|
||||
@@ -1,74 +0,0 @@
|
||||
---
|
||||
- name: Basic setup for shamash (packages, Docker, Nix, sshd)
|
||||
hosts: misc
|
||||
tasks:
|
||||
- name: Create /etc/pbri
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /etc/pbri
|
||||
state: directory
|
||||
mode: u=rwx,g=rx,o=rx
|
||||
- name: Create /home/paul/{Sites,Source}
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "/home/paul/{{ item }}"
|
||||
state: directory
|
||||
owner: paul
|
||||
group: paul
|
||||
mode: u=rwx,g=rx,o=rx
|
||||
loop:
|
||||
- Sites
|
||||
- Source
|
||||
- name: Install basic packages
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- vim
|
||||
- git
|
||||
- htop
|
||||
- tmux
|
||||
update_cache: true
|
||||
tags:
|
||||
- apt
|
||||
- name: Install and set up Docker and docker-compose
|
||||
ansible.builtin.include_role:
|
||||
name: docker
|
||||
- name: Install and set up Nix
|
||||
ansible.builtin.include_role:
|
||||
name: install_nix
|
||||
- name: Install pip prerequisites
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- python3-pip
|
||||
- python3-setuptools
|
||||
- python3-virtualenv
|
||||
- name: Install global python docker package
|
||||
become: true
|
||||
ansible.builtin.pip:
|
||||
name:
|
||||
- docker
|
||||
- docker-compose
|
||||
- requests
|
||||
- name: Configure sshd
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/ssh/sshd_config.d/00_pbri.conf
|
||||
mode: u=rw,g=r,o=r
|
||||
# Included by /etc/ssh/sshd_config before other configuration
|
||||
content: |
|
||||
Port 2309
|
||||
PermitRootLogin no
|
||||
PubkeyAuthentication yes
|
||||
AuthorizedKeysFile .ssh/authorized_keys
|
||||
PasswordAuthentication no
|
||||
validate: /usr/sbin/sshd -T -f %s
|
||||
notify:
|
||||
- Restart sshd
|
||||
|
||||
handlers:
|
||||
- name: Restart sshd
|
||||
become: true
|
||||
ansible.builtin.service:
|
||||
name: sshd
|
||||
state: restarted
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
- name: Check out static sites hosted on shamash
|
||||
hosts: misc
|
||||
tasks:
|
||||
- name: Check out static sites
|
||||
ansible.builtin.include_role:
|
||||
name: checkout_static_sites
|
||||
vars:
|
||||
checkout_static_sites_config:
|
||||
checkouts:
|
||||
- path: /home/paul/Sites/pbrinkmeier.de
|
||||
url: https://git.pbrinkmeier.de/paul/pbrinkmeier.de
|
||||
commit: bab3208e61972851a5e609930a05e0d4322f8a06
|
||||
owner: paul
|
||||
- path: /home/paul/Sites/tichy.click
|
||||
url: https://github.com/pbrinkmeier/tichy-clicker
|
||||
commit: 7dfb14183c765e3661fda84a7e89c2f73ca86f26
|
||||
owner: paul
|
||||
Reference in New Issue
Block a user