Further nanna stuff: Update docker setup & gitea runner

ansible/playbooks/nanna-docker.yaml

@@ -0,0 +1,67 @@
+---
+- name: Update Docker configuration
+  hosts: nanna
+  tasks:
+    - name: Add users for running containers
+      become: true
+      ansible.builtin.user:
+        name: "{{ item.name }}"
+        uid: "{{ item.uid }}"
+        state: "{{ item.state }}"
+        create_home: false
+        system: true
+      loop:
+        - name: gitea
+          uid: 42001
+          state: present
+        - name: caddy
+          uid: 42002
+          state: present
+    - name: Create Caddy network
+      become: true
+      community.docker.docker_network:
+        name: caddy-network
+        state: present
+    - name: Upload docker configuration
+      become: true
+      ansible.builtin.copy:
+        src: ../../docker/docker
+        dest: /etc/pbri
+        # Files should inaccessible to non-root users.
+        mode: u=rw,g=,o=
+        # Directories should be listable
+        directory_mode: u=rwx,g=rx,o=rx
+    - name: Create directory for docker volumes
+      become: true
+      ansible.builtin.file:
+        path: /var/lib/pbri/docker
+        state: directory
+        # Hide contents from non-root users
+        mode: u=rwx,g=,o=
+    - name: Upload and decrypt docker environment vars
+      become: true
+      ansible.builtin.copy:
+        src: "../../docker/envs/{{ item.name }}/.env"
+        dest: /etc/pbri/docker/{{ item.name }}/.env
+        # Files should inaccessible to non-root users.
+        mode: u=rw,g=,o=
+        # This is true by default but I put it here anyways
+        # to emphasize what's happening
+        decrypt: true
+      # Not quite happy with all the seperate loops yet.
+      loop:
+        - name: gitea
+          state: present
+    - name: Create volume directories with correct permissions
+      become: true
+      ansible.builtin.file:
+        path: "/var/lib/pbri/docker/{{ item.name }}"
+        owner: "{{ item.user }}"
+        group: "{{ item.user }}"
+        state: directory
+        mode: u=rwx,g=,o=
+      loop:
+        - name: caddy_config
+          user: caddy
+        - name: caddy_data
+          user: caddy

ansible/playbooks/nanna-setup.yaml

@@ -17,6 +17,9 @@
         validate: /usr/sbin/sshd -T -f %s
       notify:
         - Restart sshd
+    - name: Install and set up Docker and docker-compose
+      ansible.builtin.include_role:
+        name: docker
 
   handlers:
     - name: Restart sshd

ansible/playbooks/nanna-sites.yaml

@@ -0,0 +1,18 @@
+---
+- name: Check out static sites hosted on nanna
+  hosts: nanna
+  tasks:
+    - name: Check out static sites
+      ansible.builtin.include_role:
+        name: checkout_static_sites
+      vars:
+        checkout_static_sites_config:
+          checkouts:
+            - path: /home/paul/Sites/pbrinkmeier.de
+              url: https://git.pbrinkmeier.de/paul/pbrinkmeier.de
+              commit: bab3208e61972851a5e609930a05e0d4322f8a06
+              owner: paul
+            - path: /home/paul/Sites/tichy.click
+              url: https://github.com/pbrinkmeier/tichy-clicker
+              commit: 7dfb14183c765e3661fda84a7e89c2f73ca86f26
+              owner: paul