Disable hitparade service

It's back to plain text

.ansible-lint

@@ -0,0 +1,4 @@
+---
+
+profile: production
+offline: true

.gitea/workflows/check.yaml

@@ -0,0 +1,16 @@
+name: Check
+"on": [push]
+jobs:
+  "Lint Ansible Files":
+    runs-on: node-26-trixie
+    steps:
+      - run: apt-get update
+      - run: apt-get upgrade -y
+      - run: apt-get install -y python3 python3-pip python3-venv
+      - run: python3 --version
+      - name: Check out repo
+        uses: actions/checkout@v3
+      - run: python3 -m venv venv
+      - run: venv/bin/pip --disable-pip-version-check install ansible==12.0.0 ansible-lint==25.8.2
+      - run: venv/bin/ansible-lint -c .ansible-lint ansible
+  # TODO: Reimplement ansible-play --check step from old drone config

.gitignore

@@ -1,2 +1,2 @@
-*.env
 backups
+*.swp

README.md

@@ -4,21 +4,23 @@
 
 | Prop | Value |
 | --- | --- |
-| Hostname | `h2954114`                                                                |
-| Domains  | `{wiki.,codi.,git.,}pbrinkmeier.de`, `tichy.click`, `h2954114.stratoserver.net` |
+| Hostname | `nanna` |
+| Domains  | `{,pad.,codi.,git.,plantuml.}pbrinkmeier.de`, `tichy.click`, `{utoy,vrnp}.beany.club` |
 
-### Personal Website
+## Linting
 
-[pbrinkmeier.de](https://pbrinkmeier.de)
+Use `nix develop` to drop into a shell containing `ansible-lint`.
+Then run it using
 
-### Personal Wiki
+```
+ansible-lint --offline
+```
 
-[wiki.pbrinkmeier.de](https://wiki.pbrinkmeier.de)
+to avoid checking for a new version every single run.
 
-### Collaborative Markdown Editing
+## TODO
 
-[codi.pbrinkmeier.de](https://codi.pbrinkmeier.de)
-
-### Tichy-Clicker
-
-[tichy.click](https://tichy.click)
+- [x] Migrate to `community.docker.docker_compose_v2` (`v1` is deprecated)
+- [x] Nix Gitea Action runner
+- [x] Install but disable zomboid server
+- [x] Download volume for yore

TODO.md

@@ -1,8 +1,15 @@
 # TODO
 
 - [ ] Update Readme (CI, Git, plantuml, etc.)
-- [ ] Split `docker/web/docker-compose.yaml` into different configs (e.g. `web`, `gitlab`, `drone`) using the same network
-- [ ] Use `/var/lib/pbri/docker/...` instead of Docker volumes (makes backups easier)
+- [x] Split `docker/web/docker-compose.yaml` into different configs (e.g. `web`, `gitlab`, `drone`) using the same network
+- [x] Use `/var/lib/pbri/docker/...` instead of Docker volumes (makes backups easier)
     - [x] Make it inaccessible to anyone but root (`-rw------`)
 - [x] Add [Drone runner](https://docs.drone.io/runner/docker/installation/linux/)
-- [ ] Figure out how to dependably store `.env` files (Ansible vault? Something else?)
+- [x] Figure out how to dependably store `.env` files (Ansible vault? Something else?)
+    - [x] In vault, seperate from other config
+- [x] Check out docker swarm and current best practices for Ansible
+- [x] Use Gitea instead of GitLab
+- [x] Make Gitea display graphs in Notebooks (see https://docs.gitea.io/en-us/external-renderers/).
+- [x] Factorio server
+- [x] Add Gitea actions
+- [x] Remove drone

ansible/.gitignore

@@ -1 +0,0 @@
-venv

ansible/README.md

@@ -2,30 +2,33 @@
 
 ## Ansible Control Node Setup
 
-In a Python 3 environment (perhaps a venv):
+The root of this repo contains a `flake.nix` that defines a shell with all necessary tools.
+To drop into a shell with `ansible-*` commands, run:
 
 ```
-pip install -r requirements.txt
+nix develop
 ```
 
-## `misc.yaml`
+## `nanna-setup.yaml`
 
-Server for miscellaneous stuff, e.g. the website.
-Expects to have a user `andi` who can `sudo`.
+Small VPS for self-hosted services.
+Expects to have a user `paul` who can `sudo`.
 Sets up:
 
 - Some basic packages
-- Docker and `docker-compose` (the latter via `pip`)
+- Docker and `docker-compose`
 - Nix multi-user installation
 
-## `misc-docker.yaml`
+## `nanna-docker.yaml`
 
-- Deploys Docker configurations from `../docker`
+Deploys Docker Compose configurations from `../docker`:
 
-## `misc-sites.yaml`
+- Sets up the docker network `caddy-network` for services that are reverse proxied by caddy
+- Copies configuration into `/etc/pbri/docker`
+- Creates folder `/var/lib/pbri/docker` for storing application files
+- Creates users with `42xxx` UIDs for running containers
+- `docker compose {up,down}`s all enabled/disabled services
+
+## `nanna-sites.yaml`
 
 Checks out static sites into `/home/paul/Sites` which is mounted into `/srv` in the Caddy container.
-
-## `misc-backup.yaml`
-
-Backs up relevant Docker volumes.

ansible/ansible.cfg

@@ -1,2 +1,3 @@
 [defaults]
 inventory = ./inventory
+roles_path = ./roles

ansible/group_vars/gods/vars.yaml

@@ -0,0 +1,18 @@
+---
+ansible_python_interpreter: /usr/bin/python3
+gods_users:
+  - name: postgres
+    uid: 70
+    state: present
+  - name: hackmd
+    uid: 1500
+    state: present
+  - name: gitea
+    uid: 42001
+    state: present
+  - name: caddy
+    uid: 42002
+    state: present
+  - name: yore
+    uid: 42004
+    state: present

ansible/group_vars/misc/vars.yaml

@@ -1,3 +0,0 @@
----
-ansible_user: andi
-ansible_python_interpreter: /usr/bin/python3

ansible/host_vars/nanna/vars.yaml

@@ -0,0 +1,10 @@
+$ANSIBLE_VAULT;1.1;AES256
+62643463383563343863376537643438356663636666356636346465613165363231653664323164
+3137343761613064616566656133346339613462333330360a626431653366643162316435373066
+65323863373361363765623563653863366338616564623532363233646466316539376666356564
+3034393930376630350a396632393262316238663162346533343464386135666364383663313539
+63393536353334666432393639616130636232343630626235663337393438336430666637663133
+65316161646161376333376330353063363966383936396566323633366435663835346564356137
+65633262623133373865643230303236663532623863386264326662393364396636306537653264
+62326264393039343733643138313639333635366532383137613131656163356534303738336338
+6339

ansible/inventory

@@ -1,2 +1,2 @@
-[misc]
-pbrinkmeier.de
+[gods]
+nanna

ansible/misc-all.yaml

@@ -1,8 +0,0 @@
-# All tasks for misc, use this to check whether everything is deployed.
----
-- name: Set up basic packages, Docker, Nix, sshd
-  import_playbook: misc-setup.yaml
-- name: Deploy Docker configuration
-  import_playbook: misc-docker.yaml
-- name: Check out static websites from git
-  import_playbook: misc-sites.yaml

ansible/misc-backup.yaml

@@ -1,50 +0,0 @@
----
-- hosts: misc
-  vars:
-    start_time: "{{ ansible_date_time.iso8601_basic_short }}"
-  tasks:
-    - name: Stop docker stuff
-      become: yes
-      docker_compose:
-        project_src: /etc/pbri/docker/web
-        state: present
-        stopped: yes
-    - name: Create backups in /etc/pbri/backups
-      become: yes
-      docker_container:
-        container_default_behavior: no_defaults
-        name: bacman
-        image: busybox
-        volumes:
-          - "{{ item }}:/data"
-          - "/etc/pbri/backups/{{ start_time }}:/backup"
-        command: "cp -r /data /backup/{{ item }}"
-        detach: no
-        cleanup: yes
-      loop:
-        - codi_database
-        - codi_uploads
-        - gitlab_data
-        - gitlab_logs
-        - gitlab_config
-    - name: Make tar
-      become: yes
-      shell:
-        cmd: "tar -czvf ../{{ start_time }}.tar.gz *"
-        chdir: "/etc/pbri/backups/{{ start_time }}"
-    - name: Download tar
-      become: yes
-      fetch:
-        src: /etc/pbri/backups/{{ start_time }}.tar.gz
-        dest: ../backups
-    - name: Remove backups folder
-      become: yes
-      file:
-        path: /etc/pbri/backups
-        state: absent
-    - name: Restart docker stuff
-      become: yes
-      docker_compose:
-        project_src: /etc/pbri/docker/web
-        state: present
-        restarted: yes

ansible/misc-docker.yaml

@@ -1,68 +0,0 @@
----
-- hosts: misc
-  tasks:
-    - name: Upload docker configuration
-      become: yes
-      copy:
-        src: ../docker
-        dest: /etc/pbri
-        # Files should inaccessible to non-root users.
-        mode: u=rw,g=,o=
-        # Directories should be listable
-        directory_mode: u=rwx,g=rx,o=rx
-    - name: Create global docker volumes (/var/lib)
-      become: yes
-      file:
-        path: "/var/lib/pbri/docker/{{ item.name }}"
-        state: directory
-        # Hide contents from non-root users
-        mode: u=rw,g=,o=
-      loop:
-        - name: drone
-    - name: Create global docker volumes (docker_volume)
-      become: yes
-      docker_volume:
-        name: "{{ item.name }}"
-        state: "{{ item.state }}"
-      loop:
-        - name: codi_database
-          state: present
-        - name: codi_uploads
-          state: present
-        - name: gitlab_data
-          state: present
-        - name: gitlab_logs
-          state: present
-        - name: gitlab_config
-          state: present
-        - name: gitlab_runner_config
-          state: present
-        - name: gitlab_runner_cache
-          state: present
-    - name: Set up docker stuff
-      become: yes
-      docker_compose:
-        project_src: "/etc/pbri/docker/{{ item.name }}"
-        state: "{{ item.state }}"
-        build: yes
-        debug: yes
-      loop:
-        - name: web
-          state: present
-        - name: runner
-          state: absent
-    - name: Add jupyter user with UID 42000
-      become: yes
-      ansible.builtin.user:
-        name: jupyter
-        uid: 42000
-        state: present
-    - name: Add Notebooks folder
-      become: yes
-      ansible.builtin.file:
-        path: /home/jupyter/Notebooks
-        owner: jupyter
-        group: jupyter
-        state: directory
-        mode: 0755
-

ansible/misc-setup.yaml

@@ -1,52 +0,0 @@
----
-- hosts: misc
-  tasks:
-    - name: Install basic packages
-      become: yes
-      apt:
-        name:
-          - vim
-          - git
-          - htop
-          - tmux
-        update_cache: yes
-      tags:
-        - apt
-    - include_role:
-        name: docker
-    - include_role:
-        name: install_nix
-    - name: Install pip prerequisites
-      become: yes
-      apt:
-        name:
-          - python3-pip
-          - python3-setuptools
-          - python3-virtualenv
-    - name: Install global python docker package
-      become: yes
-      pip:
-        name:
-          - docker
-          - docker-compose
-          - requests
-    - name: Configure sshd
-      register: sshdconfig
-      become: yes
-      copy:
-        dest: /etc/ssh/sshd_config.d/00_pbri.conf
-        mode: u=rw,g=r,o=r
-        # Included by /etc/ssh/sshd_config before other configuration
-        content: |
-          Port 2309
-          PermitRootLogin no
-          PubkeyAuthentication yes
-          AuthorizedKeysFile .ssh/authorized_keys
-          PasswordAuthentication no
-        validate: /usr/sbin/sshd -T -f %s
-    - name: Restart sshd
-      when: sshdconfig.changed
-      become: yes
-      service:
-        name: sshd
-        state: restarted

ansible/misc-sites.yaml

@@ -1,16 +0,0 @@
----
-- hosts: misc
-  tasks:
-    - include_role:
-        name: checkout_static_sites
-      vars:
-        checkout_static_sites:
-          checkouts:
-            - path: /home/paul/Sites/pbrinkmeier.de
-              url: https://git.pbrinkmeier.de/paul/pbrinkmeier.de
-              commit: 680ac7d9c44752f57436d0ecb9c8018205a5fc0f
-              owner: paul
-            - path: /home/paul/Sites/tichy.click
-              url: https://github.com/pbrinkmeier/tichy-clicker
-              commit: 7dfb14183c765e3661fda84a7e89c2f73ca86f26
-              owner: paul

ansible/playbooks/nanna-docker.yaml

@@ -0,0 +1,135 @@
+---
+- name: Update Docker configuration
+  hosts: gods
+  tasks:
+    - name: Add groups
+      become: true
+      ansible.builtin.group:
+        name: "{{ item.name }}"
+        gid: "{{ item.uid }}"
+        state: "{{ item.state }}"
+        system: true
+      loop: "{{ gods_users }}"
+    - name: Add users for running containers
+      become: true
+      ansible.builtin.user:
+        name: "{{ item.name }}"
+        uid: "{{ item.uid }}"
+        group: "{{ item.name }}"
+        state: "{{ item.state }}"
+        create_home: false
+        system: true
+      loop: "{{ gods_users }}"
+    - name: Create Caddy network
+      become: true
+      community.docker.docker_network:
+        name: caddy-network
+        state: present
+    - name: Upload docker configuration
+      become: true
+      ansible.builtin.copy:
+        src: ../../docker/docker
+        dest: /etc/pbri
+        # Files should inaccessible to non-root users.
+        mode: u=rw,g=,o=
+        # Directories should be listable
+        directory_mode: u=rwx,g=rx,o=rx
+    - name: Create directory for docker volumes
+      become: true
+      ansible.builtin.file:
+        path: /var/lib/pbri/docker
+        state: directory
+        # Hide contents from non-root users
+        mode: u=rwx,g=,o=
+    - name: Upload and decrypt docker environment vars
+      become: true
+      ansible.builtin.copy:
+        src: "../../docker/envs/{{ item.path }}"
+        dest: "/etc/pbri/docker/{{ item.path }}"
+        # Files should inaccessible to non-root users.
+        mode: u=rw,g=,o=
+        # This is true by default but I put it here anyways
+        # to emphasize what's happening
+        decrypt: true
+      loop:
+        - path: gitea/.env
+        - path: codi/.env
+        - path: vrnp/.env
+        - path: zomboid/.env
+        - path: yore/.env
+        - path: factorio/.env
+        - path: hitparade/.env
+        - path: hitparade/pollmaster-config.yml
+    # This needs to be done for any services where user:
+    # is set in docker-compose.yaml.
+    - name: Create volume directories with correct permissions
+      become: true
+      ansible.builtin.file:
+        path: "/var/lib/pbri/docker/{{ item.name }}"
+        owner: "{{ item.user }}"
+        group: "{{ item.user }}"
+        state: directory
+        mode: u=rwx,g=,o=
+      loop:
+        - name: caddy_config
+          user: caddy
+        - name: caddy_data
+          user: caddy
+        - name: codi_uploads
+          user: hackmd
+        - name: nix_runner_etc
+          user: 1000
+        - name: nix_runner_nix
+          user: 1000
+        - name: nix_runner_home_node
+          user: 1000
+        - name: yore_data
+          user: yore
+    # Since some docker-compose configuration might want to pull
+    # images from the Gitea package repository, we need to ensure
+    # that Gitea is reachable before those configurations are deployed.
+    - name: Set up caddy and gitea containers
+      become: true
+      community.docker.docker_compose_v2:
+        project_src: "/etc/pbri/docker/{{ item.name }}"
+        state: "{{ item.state }}"
+        build: "always"
+        pull: "always"
+      loop:
+        - name: caddy
+          state: present
+        - name: gitea
+          state: present
+    # Before deploying the remaining configs below, we check that
+    # Gitea is reachable at git.pbrinkmeier.de
+    - name: Wait for gitea to be reachable
+      check_mode: false
+      ansible.builtin.uri:
+        method: GET
+        url: https://git.pbrinkmeier.de/api/v1/version
+      register: gitea_version_response
+      until: gitea_version_response.status == 200
+      retries: 10
+      delay: 3  # Retry every 3 seconds
+    - name: Set up other containers
+      become: true
+      community.docker.docker_compose_v2:
+        project_src: "/etc/pbri/docker/{{ item.name }}"
+        state: "{{ item.state }}"
+        build: "always"
+        pull: "always"
+      loop:
+        - name: codi
+          state: present
+        - name: utoy
+          state: present
+        - name: vrnp
+          state: present
+        - name: yore
+          state: present
+        - name: hitparade
+          state: absent
+        - name: factorio
+          state: absent
+        - name: zomboid
+          state: absent

ansible/playbooks/nanna-setup.yaml

@@ -0,0 +1,109 @@
+---
+- name: Basic setup for nanna
+  hosts: nanna
+  tasks:
+    - name: Configure sshd
+      become: true
+      ansible.builtin.copy:
+        dest: /etc/ssh/sshd_config.d/00_pbri.conf
+        mode: u=rw,g=r,o=r
+        # Included by /etc/ssh/sshd_config before other configuration
+        content: |
+          Port 2309
+          PermitRootLogin no
+          PubkeyAuthentication yes
+          AuthorizedKeysFile .ssh/authorized_keys
+          PasswordAuthentication no
+        validate: /usr/sbin/sshd -T -f %s
+      notify:
+        - Restart sshd
+    - name: Install and set up Docker and docker-compose
+      ansible.builtin.include_role:
+        name: docker
+    - name: Add Davids group
+      become: true
+      ansible.builtin.group:
+        name: "david"
+        state: "present"
+    - name: Add David
+      become: true
+      ansible.builtin.user:
+        name: "david"
+        group: "david"
+        state: "present"
+        shell: "/bin/bash"
+        # Disable password auth
+        password: "!"
+    - name: Create David SSH directory
+      become: true
+      ansible.builtin.file:
+        path: /home/david/.ssh
+        owner: david
+        group: david
+        state: directory
+        mode: "0700"
+    - name: Set David SSH key
+      become: true
+      ansible.builtin.lineinfile:
+        path: /home/david/.ssh/authorized_keys
+        line: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICttSQcZsKvw5qKCDGt\
+nxEdyH1aEGOGGRqDCp3U/SG46 davidtanner@coolerLaptop2.fritz.box"
+        owner: david
+        group: david
+        create: true
+        state: present
+        mode: "0600"
+    - name: Add Jakobs group
+      become: true
+      ansible.builtin.group:
+        name: "jakob"
+        state: "present"
+    - name: Add Jakob
+      become: true
+      ansible.builtin.user:
+        name: "jakob"
+        group: "jakob"
+        state: "present"
+        shell: "/bin/bash"
+        append: true
+        groups:
+          - sudo
+    - name: Create Jakob SSH directory
+      become: true
+      ansible.builtin.file:
+        path: /home/jakob/.ssh
+        owner: jakob
+        group: jakob
+        state: directory
+        mode: "0700"
+    - name: Set Jakob SSH key
+      become: true
+      ansible.builtin.lineinfile:
+        path: /home/jakob/.ssh/authorized_keys
+        line: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHzStuc1f7CfTsmp1qLz5x/YCwJ2wHVjxOv2Fvocs3xH pbrinkmeier.de@jakob.moser.contact"
+        owner: jakob
+        group: jakob
+        create: true
+        state: present
+        mode: "0600"
+    - name: Add work SSH key
+      become: true
+      ansible.builtin.lineinfile:
+        path: /home/paul/.ssh/authorized_keys
+        line: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMeHrSd8NJ9dAoQEJez\
+FbxfbWlo/HQNoA8vaaBZj58Cp paul@MacBook-Pro.meqo"
+        owner: paul
+        group: paul
+        create: true
+        state: present
+        mode: "0600"
+    - name: Install Nix
+      ansible.builtin.include_role:
+        name: install_nix
+
+  handlers:
+    - name: Restart sshd
+      become: true
+      ansible.builtin.service:
+        name: ssh
+        state: restarted

ansible/playbooks/nanna-sites.yaml

@@ -0,0 +1,50 @@
+---
+- name: Check out static sites hosted on nanna
+  hosts: nanna
+  tasks:
+    - name: Check out static sites
+      ansible.builtin.include_role:
+        name: checkout_static_sites
+      vars:
+        checkout_static_sites_config:
+          checkouts:
+            - path: /home/paul/Sites/pbrinkmeier.de
+              url: https://git.pbrinkmeier.de/paul/pbrinkmeier.de
+              commit: 1df3566997535ab563b5fa76724a8c6c55b96483
+              owner: paul
+            - path: /home/paul/Sites/tichy.click
+              url: https://github.com/pbrinkmeier/tichy-clicker
+              commit: 7dfb14183c765e3661fda84a7e89c2f73ca86f26
+              owner: paul
+    - name: Create David Sites directory
+      become: true
+      ansible.builtin.file:
+        path: /home/david/Sites
+        state: directory
+        owner: david
+        group: david
+        mode: "0755"
+    - name: Create dt.beany.club directory
+      become: true
+      ansible.builtin.file:
+        path: /home/david/Sites/dt.beany.club
+        state: directory
+        owner: david
+        group: david
+        mode: "0775"
+    - name: Create vorschlagzumklangvongeschichtsschreibendenprozessen.de directory
+      become: true
+      ansible.builtin.file:
+        path: /home/david/Sites/vorschlagzumklangvongeschichtsschreibendenprozessen.de
+        state: directory
+        owner: david
+        group: david
+        mode: "0775"
+    - name: Create beany.club directory
+      become: true
+      ansible.builtin.file:
+        path: /home/paul/Sites/beany.club
+        state: directory
+        owner: paul
+        group: paul
+        mode: "0775"

ansible/roles/checkout_static_sites/tasks/main.yaml

@@ -1,18 +1,19 @@
 ---
 - name: Create static site directories
-  become: yes
+  become: true
   ansible.builtin.file:
     path: "{{ item.path }}"
     state: directory
     mode: '0755'
     owner: "{{ item.owner }}"
     group: "{{ item.owner }}"
-  loop: "{{ checkout_static_sites.checkouts }}"
+  loop: "{{ checkout_static_sites_config.checkouts }}"
 - name: Check out static site repositories
-  become: yes
+  become: true
   become_user: "{{ item.owner }}"
   ansible.builtin.git:
     dest: "{{ item.path }}"
     repo: "{{ item.url }}"
     version: "{{ item.commit }}"
-  loop: "{{ checkout_static_sites.checkouts }}"
+    force: true
+  loop: "{{ checkout_static_sites_config.checkouts }}"

ansible/roles/docker/defaults/main.yaml

@@ -0,0 +1,3 @@
+---
+docker_apt_arch: "amd64"
+docker_ubuntu_release: "{{ ansible_distribution_release }}"

ansible/roles/docker/tasks/main.yaml

@@ -1,38 +1,45 @@
 ---
 - name: Install Docker installation prerequisites
-  become: yes
-  apt:
-    update_cache: yes
-    state: latest
+  become: true
+  ansible.builtin.apt:
+    update_cache: true
+    # Don't upgrade, only make sure that the packages are present
+    # state: latest
     name:
       - ca-certificates
       - curl
       - gnupg
       - lsb-release
 
-- name: Add Docker GPG key
-  become: yes
-  shell: "curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg"
+- name: Retrieve Docker GPG key
+  check_mode: false
+  ansible.builtin.uri:
+    url: https://download.docker.com/linux/debian/gpg
+    return_content: true
+  register: docker_gpg_key
+
+- name: Install Docker GPG key
+  become: true
+  ansible.builtin.command: "gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg"
   args:
+    stdin: "{{ docker_gpg_key.content }}"
     creates: /usr/share/keyrings/docker-archive-keyring.gpg
 
-- name: Retrieve dpkg architecture
-  shell: dpkg --print-architecture
-  register: dpkg_architecture
-  changed_when: False
-
 - name: Add Docker apt repository
-  become: yes
-  template:
+  become: true
+  ansible.builtin.template:
     src: docker.list.j2
     dest: /etc/apt/sources.list.d/docker.list
+    mode: "u=rw,g=r,o=r"
 
 - name: Install Docker
-  become: yes
-  apt:
-    update_cache: yes
-    state: latest
+  become: true
+  ansible.builtin.apt:
+    update_cache: true
+    # Don't upgrade, only make sure that the packages are present
+    # state: latest
     name:
-    - docker-ce
-    - docker-ce-cli
-    - containerd.io
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io
+      - docker-compose-plugin

ansible/roles/docker/templates/docker.list.j2

@@ -1 +1 @@
-deb [arch={{ dpkg_architecture.stdout }} signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable
+deb [arch={{ docker_apt_arch }} signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu {{ docker_ubuntu_release }} stable

ansible/roles/install_nix/files/install-nix

@@ -26,38 +26,43 @@ require_util() {
 
 case "$(uname -s).$(uname -m)" in
     Linux.x86_64)
-        hash=0b32afd8c9147532bf8ce8908395b1b4d6dde9bedb0fcf5ace8b9fe0bd4c075c
-        path=0zij5bm5f2gm3p2c8dkkv58684j1k100/nix-2.8.0-x86_64-linux.tar.xz
+        hash=d1f67c86eed016214864ba08bfb9529c307aea7e8fafb74853f96fcc3bfd8a60
+        path=n1j9ng0120ql98l5a8mi626ka8wvixq4/nix-2.31.2-x86_64-linux.tar.xz
         system=x86_64-linux
         ;;
     Linux.i?86)
-        hash=3f4bb50f639515df069fb682bb68da77565e5ca8678a3b0fb7dcc79ef591f518
-        path=kjpj1rn6x5lh20fkyfyyzgmgjdra1jpy/nix-2.8.0-i686-linux.tar.xz
+        hash=9e8a403421c68683557180444f089861469e12b41d41ee2f9be4c8e731b7d160
+        path=zjcwglfyf0fvjb4j86kgijzwhzaqbngc/nix-2.31.2-i686-linux.tar.xz
         system=i686-linux
         ;;
     Linux.aarch64)
-        hash=d29ea31c581e1ba7a651e6b22999cef8923e852e1d6fe7008d9545f4275f5343
-        path=npadny2da5149lcycbfmacf1r936n9zg/nix-2.8.0-aarch64-linux.tar.xz
+        hash=64db528412096d718b4bf8f78f85e5ac2b714b774e5005500dee37d23f560456
+        path=0aw1ka8njh94nvjy8596va5bbx4wd2nw/nix-2.31.2-aarch64-linux.tar.xz
         system=aarch64-linux
         ;;
-    Linux.armv6l_linux)
-        hash=69d5cb0e95bc83154099debd139d4f767622d94b17149fa127d492017c2e3896
-        path=jb1l7y40im5dsbq5gamppss59y0c7jmj/nix-2.8.0-armv6l-linux.tar.xz
+    Linux.armv6l)
+        hash=5e088d3f4fe27dd35991b1888c1ea5284edade24965328604968b9a1cc20a94c
+        path=2pzkwf2ysf0znsnz5i9gfn6w2gikhlys/nix-2.31.2-armv6l-linux.tar.xz
         system=armv6l-linux
         ;;
-    Linux.armv7l_linux)
-        hash=25857729f23dc25fe92dabd376917d83fe0f23038f82c1f2ab230171eb70f648
-        path=firp24ikxcygwrwd4208lyla4b6jl3sh/nix-2.8.0-armv7l-linux.tar.xz
+    Linux.armv7l)
+        hash=4e2c1e8a3172ae71f041b9b647aa8153fb24518272d1a9bc3d9b384ab7ad54a1
+        path=nkp9wbvnsxinr9xl7sn0yy96wvc4chn0/nix-2.31.2-armv7l-linux.tar.xz
         system=armv7l-linux
         ;;
+    Linux.riscv64)
+        hash=79601e08b6389df130b5bf1e0a48590aea044ac18bc61660545cf65843b39251
+        path=dhqxgwygm94vd6rdiwscxxz98kh8jal3/nix-2.31.2-riscv64-linux.tar.xz
+        system=riscv64-linux
+        ;;
     Darwin.x86_64)
-        hash=ebf383f1b499d3e4897cd61d068dc46e118e5f53667f5f28748b0b3682d7649a
-        path=wwf7b61nyhgj3z0vvgnnb4yzi081jkjp/nix-2.8.0-x86_64-darwin.tar.xz
+        hash=ed8df6a1046dea90ba4068a827bdeaf372d522867c4d2b48cdb37145c200eeba
+        path=5zp5bzz45sn9ff2bfhh03cmavvm1r6gs/nix-2.31.2-x86_64-darwin.tar.xz
         system=x86_64-darwin
         ;;
     Darwin.arm64|Darwin.aarch64)
-        hash=f320f381299e0fc2f907ae81ac123d0689245cb39f0672f8a65dffea12fa0240
-        path=fr5rcinvqzgcrggxw3phrzcck9wpzz83/nix-2.8.0-aarch64-darwin.tar.xz
+        hash=3baa0af88a1ef4e2cc82cb64cd384b1805ecc3771b574e97277ae213d52711d8
+        path=b7hidzsb4i3gx6s23ig9mp7mwmiljzfk/nix-2.31.2-aarch64-darwin.tar.xz
         system=aarch64-darwin
         ;;
     *) oops "sorry, there is no binary distribution of Nix for your platform";;
@@ -71,10 +76,10 @@ if [ "${1:-}" = "--tarball-url-prefix" ]; then
     url=${2}/${path}
     shift 2
 else
-    url=https://releases.nixos.org/nix/nix-2.8.0/nix-2.8.0-$system.tar.xz
+    url=https://releases.nixos.org/nix/nix-2.31.2/nix-2.31.2-$system.tar.xz
 fi
 
-tarball=$tmpDir/nix-2.8.0-$system.tar.xz
+tarball=$tmpDir/nix-2.31.2-$system.tar.xz
 
 require_util tar "unpack the binary tarball"
 if [ "$(uname -s)" != "Darwin" ]; then
@@ -89,7 +94,7 @@ else
     oops "you don't have wget or curl installed, which I need to download the binary tarball"
 fi
 
-echo "downloading Nix 2.8.0 binary tarball for $system from '$url' to '$tmpDir'..."
+echo "downloading Nix 2.31.2 binary tarball for $system from '$url' to '$tmpDir'..."
 fetch "$url" "$tarball" || oops "failed to download '$url'"
 
 if command -v sha256sum > /dev/null 2>&1; then

ansible/roles/install_nix/tasks/main.yaml

@@ -1,7 +1,7 @@
 ---
 # Obvious race condition here that we are just going to ignore
 - name: Copy Nix installation script
-  become: yes
+  become: true
   ansible.builtin.copy:
     src: install-nix
     dest: /etc/pbri/install-nix

docker/README.md

@@ -0,0 +1,4 @@
+## Folders
+
+- `docker`: Contains `docker-compose` configurations for projects
+- `envs`: Contains `.env` files encrypted using `ansible-vault`. These files are decrypted and uploaded next to their corresponding `docker-compose.yaml` file.

docker/docker/caddy/Caddyfile

@@ -0,0 +1,90 @@
+{
+    admin off
+}
+
+pbrinkmeier.de {
+    file_server {
+        root /srv/pbrinkmeier.de
+    }
+}
+
+files.pbrinkmeier.de {
+    basicauth {
+        wug JDJhJDE0JEJrQXUzVWxFZ2JGVmx6YlZWTkpYdy5IMjRXdnZZdGw5SjZDcUg2ZWMxOEVjcEV6dWhIRmhD
+    }
+    file_server {
+        root /srv/files.pbrinkmeier.de
+    }
+}
+
+dt.beany.club {
+    file_server {
+        root /srv/dt.beany.club
+        browse
+    }
+}
+
+vorschlagzumklangvongeschichtsschreibendenprozessen.de {
+    file_server {
+        root /srv/vorschlagzumklangvongeschichtsschreibendenprozessen.de
+        browse
+    }
+}
+
+tichy.click {
+    file_server {
+        root /srv/tichy.click
+    }
+}
+
+codi.pbrinkmeier.de {
+    redir https://pad.pbrinkmeier.de{uri} permanent
+}
+
+pad.pbrinkmeier.de {
+    reverse_proxy codi:3000
+}
+
+git.pbrinkmeier.de {
+    # Allow apps to requests tokens 'n stuff
+    @oauth path /login/oauth/*
+    header @oauth {
+        Access-Control-Allow-Origin "*"
+        Access-Control-Allow-Methods "GET, POST, OPTIONS"
+        Access-Control-Allow-Headers "Content-Type, Authorization"
+    }
+
+    @oauth_preflight {
+        path /login/oauth/*
+        method OPTIONS
+    }
+    respond @oauth_preflight 204
+
+    reverse_proxy gitea:3000
+}
+
+plantuml.pbrinkmeier.de {
+    reverse_proxy codi_plantuml:8080
+}
+
+utoy.beany.club {
+    reverse_proxy utoy:3000
+}
+
+vrnp.beany.club {
+    reverse_proxy vrnp:8000
+}
+
+fz.beany.club {
+    reverse_proxy yore:3000
+}
+
+beany.club, www.beany.club {
+    file_server {
+        root /srv/beany.club
+    }
+}
+
+qr.beany.club {
+    redir https://beany.club{uri}
+}

docker/docker/caddy/Dockerfile

@@ -0,0 +1,4 @@
+FROM caddy:latest
+
+COPY Caddyfile /etc/caddy/Caddyfile
+RUN chown 42002:42002 /etc/caddy/Caddyfile

docker/docker/caddy/docker-compose.yaml

@@ -0,0 +1,28 @@
+services:
+  # Webserver for static files and reverse proxy
+  web:
+    image: pbrinkmeier/web
+    build: .
+    ports:
+      - "80:80"
+      - "443:443"
+      # For hitparade/pollmaster
+      - "12080:12080"
+      - "12081:12081"
+    user: "42002"
+    volumes:
+      - /var/lib/pbri/docker/caddy_data:/data
+      - /var/lib/pbri/docker/caddy_config:/config
+      # See nanna-sites playbook/Caddyfile
+      - /home/david/Sites/dt.beany.club:/srv/dt.beany.club:ro
+      - /home/david/Sites/vorschlagzumklangvongeschichtsschreibendenprozessen.de:/srv/vorschlagzumklangvongeschichtsschreibendenprozessen.de:ro
+      - /home/paul/Sites/files.pbrinkmeier.de:/srv/files.pbrinkmeier.de:ro
+      - /home/paul/Sites/pbrinkmeier.de:/srv/pbrinkmeier.de:ro
+      - /home/paul/Sites/tichy.click:/srv/tichy.click:ro
+      - /home/paul/Sites/beany.club:/srv/beany.club:ro
+    restart: always
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/docker/codi/README.md

@@ -0,0 +1,8 @@
+Add a `.env` file like this:
+
+```
+CODI_SESSION_SECRET=...
+CODI_DB_USER=...
+CODI_DB_PASSWORD=...
+CODI_DB_DB=...
+```

docker/docker/codi/docker-compose.yaml

@@ -0,0 +1,57 @@
+services:
+  codi:
+    image: hackmdio/hackmd:2.6.1
+    user: hackmd
+    environment:
+      # Admin stuff
+      CMD_DB_URL: "postgres://${CODI_DB_USER}:${CODI_DB_PASSWORD}@codi_db/${CODI_DB_DB}"
+      CMD_SESSION_SECRET: "${CODI_SESSION_SECRET}"
+      CMD_USECDN: "false"
+      CMD_DOMAIN: pad.pbrinkmeier.de
+      CMD_PROTOCOL_USESSL: "true"
+      CMD_ALLOW_GRAVATAR: "false"
+      # Don't allow unauthenticated users to create notes
+      CMD_ALLOW_ANONYMOUS: "false"
+      # Allow unauthenticated users to edit "Freely" notes
+      CMD_ALLOW_ANONYMOUS_EDITS: "true"
+      # Misc
+      CMD_ALLOW_FREEURL: "true"
+      CMD_REQUIRE_FREEURL_AUTHENTICATION: "true"
+      CMD_PLANTUML_SERVER: https://plantuml.pbrinkmeier.de
+      # Authentication: Use Gitea OAuth2
+      CMD_EMAIL: "false"
+      CMD_ALLOW_EMAIL_REGISTER: "false"
+      CMD_OAUTH2_CLIENT_ID: "${CODI_OAUTH2_CLIENT_ID}"
+      CMD_OAUTH2_CLIENT_SECRET: "${CODI_OAUTH2_CLIENT_SECRET}"
+      CMD_OAUTH2_AUTHORIZATION_URL: https://git.pbrinkmeier.de/login/oauth/authorize
+      CMD_OAUTH2_TOKEN_URL: https://git.pbrinkmeier.de/login/oauth/access_token
+      CMD_OAUTH2_USER_PROFILE_URL: https://git.pbrinkmeier.de/api/v1/user
+      CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR: login
+      CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR: full_name
+      CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR: email
+
+    depends_on:
+      - codi_db
+      - codi_plantuml
+    volumes:
+      - /var/lib/pbri/docker/codi_uploads:/home/hackmd/app/public/uploads
+    restart: always
+
+  codi_db:
+    image: postgres:11.6-alpine
+    environment:
+      POSTGRES_USER: "${CODI_DB_USER}"
+      POSTGRES_PASSWORD: "${CODI_DB_PASSWORD}"
+      POSTGRES_DB: "${CODI_DB_DB}"
+    volumes:
+      - /var/lib/pbri/docker/codi_database:/var/lib/postgresql/data
+    restart: always
+
+  codi_plantuml:
+    image: plantuml/plantuml-server:jetty-v1.2022.7
+    restart: always
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/docker/factorio/Dockerfile

@@ -0,0 +1,4 @@
+FROM factoriotools/factorio:2.0.73
+
+COPY server-settings.json /server-settings.json
+ENTRYPOINT [ "/bin/sh", "-c", "mkdir -p /factorio/config && envsubst < /server-settings.json > /factorio/config/server-settings.json && exec /docker-entrypoint.sh" ]

docker/docker/factorio/README.md

@@ -0,0 +1,10 @@
+# factorio
+
+Add a `.env` file like this:
+
+```
+GAME_PASSWORD=...
+```
+
+Environment variables are put into `server-settings.json` during startup using `envsubst`.
+See also: https://hub.docker.com/r/factoriotools/factorio.

docker/docker/factorio/docker-compose.yaml

@@ -0,0 +1,15 @@
+---
+
+services:
+  factorio:
+    image: pbrinkmeier/factorio
+    build: .
+    restart: always
+    environment:
+      GAME_PASSWORD: "${GAME_PASSWORD}"
+      DLC_SPACE_AGE: false
+    volumes:
+      - /var/lib/pbri/docker/factorio:/factorio
+    ports:
+      - "34197:34197/udp"
+      - "27015:27015/tcp"

docker/docker/factorio/server-settings.json

@@ -0,0 +1,72 @@
+{
+    "name": "le epic factorio server",
+    "description": "Description of the game that will appear in the listing",
+    "tags": ["game", "tags"],
+  
+    "_comment_max_players": "Maximum number of players allowed, admins can join even a full server. 0 means unlimited.",
+    "max_players": 0,
+  
+    "_comment_visibility": ["public: Game will be published on the official Factorio matching server",
+                            "lan: Game will be broadcast on LAN"],
+    "visibility":
+    {
+      "public": false,
+      "lan": false
+    },
+  
+    "_comment_credentials": "Your factorio.com login credentials. Required for games with visibility public",
+    "username": "",
+    "password": "",
+  
+    "_comment_token": "Authentication token. May be used instead of 'password' above.",
+    "token": "",
+  
+    "game_password": "${GAME_PASSWORD}",
+  
+    "_comment_require_user_verification": "When set to true, the server will only allow clients that have a valid Factorio.com account",
+    "require_user_verification": false,
+  
+    "_comment_max_upload_in_kilobytes_per_second" : "optional, default value is 0. 0 means unlimited.",
+    "max_upload_in_kilobytes_per_second": 0,
+  
+    "_comment_max_upload_slots" : "optional, default value is 5. 0 means unlimited.",
+    "max_upload_slots": 5,
+  
+    "_comment_minimum_latency_in_ticks": "optional one tick is 16ms in default speed, default value is 0. 0 means no minimum.",
+    "minimum_latency_in_ticks": 0,
+  
+    "_comment_max_heartbeats_per_second": "Network tick rate. Maximum rate game updates packets are sent at before bundling them together. Minimum value is 6, maximum value is 240.",
+    "max_heartbeats_per_second": 60,
+  
+    "_comment_ignore_player_limit_for_returning_players": "Players that played on this map already can join even when the max player limit was reached.",
+    "ignore_player_limit_for_returning_players": false,
+  
+    "_comment_allow_commands": "possible values are, true, false and admins-only",
+    "allow_commands": "admins-only",
+  
+    "_comment_autosave_interval": "Autosave interval in minutes",
+    "autosave_interval": 10,
+  
+    "_comment_autosave_slots": "server autosave slots, it is cycled through when the server autosaves.",
+    "autosave_slots": 5,
+  
+    "_comment_afk_autokick_interval": "How many minutes until someone is kicked when doing nothing, 0 for never.",
+    "afk_autokick_interval": 5,
+  
+    "_comment_auto_pause": "Whether should the server be paused when no players are present.",
+    "auto_pause": true,
+  
+    "only_admins_can_pause_the_game": true,
+  
+    "_comment_autosave_only_on_server": "Whether autosaves should be saved only on server or also on all connected clients. Default is true.",
+    "autosave_only_on_server": true,
+  
+    "_comment_non_blocking_saving": "Highly experimental feature, enable only at your own risk of losing your saves. On UNIX systems, server will fork itself to create an autosave. Autosaving on connected Windows clients will be disabled regardless of autosave_only_on_server option.",
+    "non_blocking_saving": false,
+  
+    "_comment_segment_sizes": "Long network messages are split into segments that are sent over multiple ticks. Their size depends on the number of peers currently connected. Increasing the segment size will increase upload bandwidth requirement for the server and download bandwidth requirement for clients. This setting only affects server outbound messages. Changing these settings can have a negative impact on connection stability for some clients.",
+    "minimum_segment_size": 25,
+    "minimum_segment_size_peer_count": 20,
+    "maximum_segment_size": 100,
+    "maximum_segment_size_peer_count": 10
+  }

docker/docker/gitea/Dockerfile

@@ -0,0 +1,3 @@
+ FROM gitea/runner:5.0.0
+
+ COPY runner-config.yaml /opt/runner-config.yaml

docker/docker/gitea/README.md

@@ -0,0 +1,17 @@
+# gitea
+
+Add a `.env` file like this:
+
+```
+GITEA_DB_PASSWORD=...
+GITEA_SMTP_PASSWORD=...
+GITEA_RUNNER_REGISTRATION_TOKEN=...
+```
+
+You should keep an eye on `GITEA_RUNNER_REGISTRATION_TOKEN`. I suspect
+it might change over time, e.g. when restarting or updating Gitea.
+
+## Files
+
+- `runner-config.yaml`: Configuration for `gitea/act_runner`. Generated using `act_runner generate-config` then adjusted
+- `Dockerfile`: Creates an image based on `gitea/act_runner` that comes with `runner-config.yaml` in `/opt` (to avoid the extra mount)

docker/docker/gitea/docker-compose.yaml

@@ -0,0 +1,83 @@
+services:
+  gitea:
+    image: gitea/gitea:1.27.3
+    restart: unless-stopped
+    environment:
+      # Ref: https://docs.gitea.io/en-us/config-cheat-sheet
+      # User is created by misc-docker.yaml
+      USER: gitea
+      USER_UID: 42001
+      USER_GID: 42001
+      GITEA__repository__ENABLE_PUSH_CREATE_USER: "true"
+      GITEA__repository__ENABLE_PUSH_CREATE_ORG: "true"
+      GITEA__server__DOMAIN: git.pbrinkmeier.de
+      GITEA__server__HTTP_PORT: 3000
+      GITEA__server__ROOT_URL: https://git.pbrinkmeier.de/
+      GITEA__server__SSH_DOMAIN: git.pbrinkmeier.de
+      GITEA__server__BUILTIN_SSH_SERVER_USER: git
+      GITEA__server__SSH_LISTEN_PORT: 2222
+      GITEA__server__SSH_PORT: 22
+      GITEA__server__OFFLINE_MODE: "true"
+      GITEA__database__DB_TYPE: postgres
+      GITEA__database__HOST: gitea_db:5432
+      GITEA__database__NAME: gitea
+      GITEA__database__USER: gitea
+      GITEA__database__PASSWD: "${GITEA_DB_PASSWORD}"
+      GITEA__service__DISABLE_REGISTRATION: "true"
+      GITEA__service__REGISTER_EMAIL_CONFIRM: "true"
+      GITEA__service__ENABLE_NOTIFY_MAIL: "true"
+      GITEA__service__NOREPLY_ADDRESS: noreply.pbrinkmeier.de
+      GITEA__service__ENABLE_TIMETRACKING: "false"
+      GITEA__service__DEFAULT_ENABLE_TIMETRACKING: "false"
+      GITEA__service__DEFAULT_ALLOW_ONLY_CONTRIBUTORS_TO_TRACK_TIME: "false"
+      GITEA__mailer__ENABLED: "true"
+      GITEA__mailer__PROTOCOL: smtps
+      GITEA__mailer__SMTP_ADDR: smtp.mailbox.org
+      GITEA__mailer__SMTP_HOST: 465
+      GITEA__mailer__FROM: git@pbrinkmeier.de
+      GITEA__mailer__USER: hallo@pbrinkmeier.de
+      GITEA__mailer__PASSWD: "${GITEA_SMTP_PASSWORD}"
+      GITEA__openid__ENABLE_OPENID_SIGNIN: "false"
+      GITEA__openid__ENABLE_OPENID_SIGNUP: "false"
+      # Enable Gitea actions
+      # Ref: https://docs.gitea.com/usage/actions/quickstart
+      GITEA__actions__ENABLED: "true"
+    volumes:
+      - /var/lib/pbri/docker/gitea:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - "22:2222"
+    depends_on:
+      - gitea_db
+
+  gitea_db:
+    image: postgres:14.5-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: gitea
+      POSTGRES_USER: gitea
+      POSTGRES_PASSWORD: "${GITEA_DB_PASSWORD}"
+    volumes:
+      - /var/lib/pbri/docker/gitea_db:/var/lib/postgresql/data
+
+  gitea_runner:
+    # Make sure to keep this in sync with the version in the Dockerfile
+    image: pbrinkmeier/gitea-runner:5.0.0
+    build: .
+    restart: unless-stopped
+    environment:
+      CONFIG_FILE: /opt/runner-config.yaml
+      GITEA_INSTANCE_URL: "https://git.pbrinkmeier.de"
+      GITEA_RUNNER_REGISTRATION_TOKEN: "${GITEA_RUNNER_REGISTRATION_TOKEN}"
+      GITEA_RUNNER_NAME: "basic-bitchboy"
+    volumes:
+      - /var/lib/pbri/docker/gitea_runner_data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    depends_on:
+      - gitea
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/docker/gitea/runner-config.yaml

@@ -0,0 +1,91 @@
+log:
+  # The level of logging, can be trace, debug, info, warn, error, fatal
+  level: info
+
+runner:
+  # Where to store the registration result.
+  file: .runner
+  # Execute how many tasks concurrently at the same time.
+  capacity: 1
+  # Extra environment variables to run jobs.
+  # envs:
+  #   A_TEST_ENV_NAME_1: a_test_env_value_1
+  #   A_TEST_ENV_NAME_2: a_test_env_value_2
+  # Extra environment variables to run jobs from a file.
+  # It will be ignored if it's empty or the file doesn't exist.
+  # env_file: .env
+  # The timeout for a job to be finished.
+  # Please note that the Gitea instance also has a timeout (3h by default) for the job.
+  # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
+  timeout: 3h
+  # Whether skip verifying the TLS certificate of the Gitea instance.
+  insecure: false
+  # The timeout for fetching the job from the Gitea instance.
+  fetch_timeout: 5s
+  # The interval for fetching the job from the Gitea instance.
+  fetch_interval: 2s
+  # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
+  # Like: ["macos-arm64:host", "ubuntu-latest:docker://node:16-bullseye", "ubuntu-22.04:docker://node:16-bullseye"]
+  # If it's empty when registering, it will ask for inputting labels.
+  # If it's empty when execute `deamon`, will use labels in `.runner` file.
+  # Some (most?) GitHub actions use node for scripting, so just using
+  # ubuntu:22.04 here is not enough.
+  labels:
+    - "ubuntu-22.04:docker://node:16-bullseye"
+    - "node-22-bullseye:docker://node:22-bullseye"
+    - "node-22-bookworm:docker://node:22-bookworm"
+    - "node-26-trixie:docker://node:26-trixie"
+
+cache:
+  # Enable cache server to use actions/cache.
+  enabled: false
+  # The directory to store the cache data.
+  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
+  dir: ""
+  # The host of the cache server.
+  # It's not for the address to listen, but the address to connect from job containers.
+  # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
+  host: ""
+  # The port of the cache server.
+  # 0 means to use a random available port.
+  port: 0
+  # The external cache server URL. Valid only when enable is true.
+  # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
+  # The URL should generally end with "/".
+  external_server: ""
+
+container:
+  # Specifies the network to which the container will connect.
+  # Could be host, bridge or the name of a custom network.
+  # If it's empty, act_runner will create a network automatically.
+  network: ""
+  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+  privileged: false
+  # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
+  options:
+  # The parent directory of a job's working directory.
+  # If it's empty, /workspace will be used.
+  workdir_parent:
+  # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
+  # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
+  # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
+  # valid_volumes:
+  #   - data
+  #   - /src/*.json
+  # If you want to allow any volume, please use the following configuration:
+  # valid_volumes:
+  #   - '**'
+  valid_volumes:
+    - /var/lib/pbri/docker/nix_runner_etc
+    - /var/lib/pbri/docker/nix_runner_nix
+    - /var/lib/pbri/docker/nix_runner_home_node
+  # overrides the docker client host with the specified one.
+  # If it's empty, act_runner will find an available docker host automatically.
+  # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
+  # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
+  docker_host: ""
+
+host:
+  # The parent directory of a job's working directory.
+  # If it's empty, $HOME/.cache/act/ will be used.
+  workdir_parent:

docker/docker/hitparade/Dockerfile

@@ -0,0 +1,3 @@
+FROM mariadb:10.6
+
+COPY pollmaster_scheme.sql /docker-entrypoint-initdb.d/init.sql

docker/docker/hitparade/docker-compose.yaml

@@ -0,0 +1,30 @@
+services:
+  pollmaster_db:
+    image: pbrinkmeier/pollmaster_db
+    build: .
+    restart: unless-stopped
+    environment:
+      MYSQL_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD}"
+      MYSQL_DATABASE: 'pollmaster'
+      MYSQL_USER: 'pollmaster'
+      MYSQL_PASSWORD: "${MYSQL_PASSWORD}"
+    volumes:
+      - /var/lib/pbri/docker/hitparade_pollmaster_db_data:/var/lib/mysql
+
+  # Caddy terminates https for :12080 and :12081
+  pollmaster:
+    image: git.pbrinkmeier.de/paul/pollmaster:4
+    volumes:
+      - /etc/pbri/docker/hitparade/pollmaster-config.yml:/config.yml:ro
+      - /var/lib/pbri/docker/pollmaster_sessions:/app/pollmaster/sessions
+    depends_on:
+      - pollmaster_db
+
+  # Doesn't need further config, the pollmaster URL is baked into the image
+  voter:
+    image: git.pbrinkmeier.de/paul/voter:4
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/docker/hitparade/pollmaster_scheme.sql

@@ -0,0 +1,114 @@
+CREATE TABLE IF NOT EXISTS `admin` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `name` varchar(50) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `password` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `image` mediumtext CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `Schlüssel 2` (`name`) USING BTREE
+) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `artist` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `name` varchar(300) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `locked` tinyint(1) NOT NULL DEFAULT 0,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `Name` (`name`) USING BTREE
+) ENGINE=InnoDB AUTO_INCREMENT=2285 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `track` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `uri` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `name` varchar(300) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `album` varchar(300) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `year` varchar(50) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `length` mediumint(8) unsigned NOT NULL,
+  `image` varchar(200) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `locked` tinyint(1) unsigned NOT NULL DEFAULT 0,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `URI` (`uri`) USING BTREE,
+  KEY `Name` (`name`)
+) ENGINE=InnoDB AUTO_INCREMENT=3570 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `playback` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `track_id` int(10) unsigned NOT NULL,
+  `timestamp` bigint(20) unsigned NOT NULL,
+  PRIMARY KEY (`id`),
+  KEY `FK_playback_track` (`track_id`),
+  KEY `Time` (`timestamp`),
+  CONSTRAINT `FK_playback_track` FOREIGN KEY (`track_id`) REFERENCES `track` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
+) ENGINE=InnoDB AUTO_INCREMENT=227 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `playlist` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `name` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `uri` varchar(80) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `Schlüssel 2` (`name`),
+  KEY `Schlüssel 3` (`uri`)
+) ENGINE=InnoDB AUTO_INCREMENT=6 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `playlist_track` (
+  `playlist_id` int(10) unsigned NOT NULL,
+  `track_id` int(10) unsigned NOT NULL,
+  `position` int(10) unsigned NOT NULL,
+  PRIMARY KEY (`playlist_id`,`track_id`),
+  KEY `FK_playlist_track_track` (`track_id`),
+  KEY `FK_playlist_track_playlist` (`playlist_id`),
+  CONSTRAINT `FK_playlist_track_playlist` FOREIGN KEY (`playlist_id`) REFERENCES `playlist` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `FK_playlist_track_track` FOREIGN KEY (`track_id`) REFERENCES `track` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `search_term` (
+  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
+  `term` varchar(200) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `first_search` bigint(20) unsigned NOT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `Schlüssel 2` (`term`) USING BTREE
+) ENGINE=InnoDB AUTO_INCREMENT=88 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `search_term_track` (
+  `search_term_id` int(10) unsigned NOT NULL,
+  `track_id` int(10) unsigned NOT NULL,
+  PRIMARY KEY (`search_term_id`,`track_id`),
+  KEY `FK_search_term_tracks_track` (`track_id`),
+  CONSTRAINT `FK_search_term_tracks_search_term` FOREIGN KEY (`search_term_id`) REFERENCES `search_term` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `FK_search_term_tracks_track` FOREIGN KEY (`track_id`) REFERENCES `track` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `session` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `name` varchar(50) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `image` mediumtext CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `last_seen` bigint(20) unsigned NOT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `Schlüssel 2` (`name`) USING BTREE
+) ENGINE=InnoDB AUTO_INCREMENT=14 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `setting` (
+  `key` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `value` varchar(500) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  PRIMARY KEY (`key`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `track_artist` (
+  `track_id` int(10) unsigned NOT NULL,
+  `artist_id` int(10) unsigned NOT NULL,
+  PRIMARY KEY (`artist_id`,`track_id`),
+  KEY `FK__track` (`track_id`),
+  KEY `FK__artist` (`artist_id`),
+  CONSTRAINT `FK__artist` FOREIGN KEY (`artist_id`) REFERENCES `artist` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `FK__track` FOREIGN KEY (`track_id`) REFERENCES `track` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `vote` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `track_id` int(10) unsigned NOT NULL,
+  `session_id` int(10) unsigned DEFAULT NULL,
+  `timestamp` bigint(20) unsigned NOT NULL,
+  PRIMARY KEY (`id`),
+  KEY `FK_vote_track` (`track_id`),
+  KEY `FK_vote_session` (`session_id`),
+  CONSTRAINT `FK_vote_track` FOREIGN KEY (`track_id`) REFERENCES `track` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
+) ENGINE=InnoDB AUTO_INCREMENT=319 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+

docker/docker/utoy/docker-compose.yaml

@@ -0,0 +1,9 @@
+services:
+  utoy:
+    image: git.pbrinkmeier.de/paul/utoy:0.6.3
+    restart: always
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/docker/vrnp/docker-compose.yaml

@@ -0,0 +1,12 @@
+services:
+  vrnp:
+    image: git.pbrinkmeier.de/paul/vrnp:0.0.10
+    restart: always
+    environment:
+      VRNP_PASSWORD: "${VRNP_PASSWORD}"
+      VRNP_CLIENT_ALLOWLIST: "VAG"
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/docker/yore/docker-compose.yaml

@@ -0,0 +1,34 @@
+services:
+  yore:
+    image: git.pbrinkmeier.de/paul/yore:0.0.12
+    restart: always
+    environment:
+      # For dbmate (migrations)
+      DATABASE_URL: "postgres://yore:${YORE_DB_PASSWORD}@yore_db/yore-db?sslmode=disable&search_path=public"
+      # For yore itself
+      YORE_DB: "host=yore_db dbname=yore-db user=yore password=${YORE_DB_PASSWORD}"
+      YORE_DOWNLOAD_DIR: /data/downloads
+      YORE_DBMATE_DIR: /data/dbmate
+    user: 42004:42004
+    volumes:
+      - /etc/passwd:/etc/passwd:ro
+      - /etc/group:/etc/group:ro
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+      - /var/lib/pbri/docker/yore_data:/data
+
+  yore_db:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: yore-db
+      POSTGRES_USER: yore
+      POSTGRES_PASSWORD: "${YORE_DB_PASSWORD}"
+    volumes:
+      - /var/lib/pbri/docker/yore_db:/var/lib/postgresql/data
+
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/docker/zomboid/docker-compose.yaml

@@ -0,0 +1,15 @@
+services:
+  zomboid:
+    image: renegademaster/zomboid-dedicated-server:2.5.0
+    restart: unless-stopped
+    volumes:
+      - /var/lib/pbri/docker/zomboid_dedicated_server:/home/steam/ZomboidDedicatedServer
+      - /var/lib/pbri/docker/zomboid_config:/home/steam/Zomboid
+    ports:
+      - "16261:16261/udp"
+      - "16262:16262/udp"
+    environment:
+      ADMIN_USERNAME: "the_gwiddy"
+      ADMIN_PASSWORD: "${ZOMBOID_ADMIN_PASSWORD}"
+      SERVER_NAME: "server3"
+      SERVER_PASSWORD: "${ZOMBOID_SERVER_PASSWORD}"

docker/envs/codi/.env

@@ -0,0 +1,20 @@
+$ANSIBLE_VAULT;1.1;AES256
+35633339346331336263653239623234333765623065313466373635353662306632663063323138
+3138333732376665636531396335393235653538393438660a326664656462383737383735386262
+34646634653631613333656132663536653337386362303536626634363239663064383564633663
+3563383663383266610a613938376665353936643361366465393765313666636531663837383036
+34373064616662363839396233623232643134366361313130636433356237323565636338306435
+36333139356635376366643538303736306364383764393365663365643137383439376636376561
+65343036363538393235333434316632393562613735313165636165666662326462663063356532
+34343936356364643536313230383633396438363638623963643239643638633435353164623635
+35646631353364663261633862666331636532663762636164663861303262373630643265623239
+62333737393562376235373430363662613032623436303865613634636436376565363130366532
+36303834343439333865313037336233323036373833663837303332393330306434373431363961
+30323134373666376563316661303131306566393830633732313664653039313263613761346262
+34393738376434313663336231656132386163663665393133363465366230383537656630313563
+66373633333663653837336439646363646233326233303062643635396531356438363433633131
+36353561366265343036386533373563613836663831613836643432386633643535396536376362
+65306335313363316236363362316533663433656531366331336132303965373230623330313636
+38623361623934303663333631306330333434343833336132333333313939616261666461346333
+34343935663165303665373735646636326364393336626462363732353739366161366164333465
+643034323233333535376461313834663132

docker/envs/factorio/.env

@@ -0,0 +1,6 @@
+$ANSIBLE_VAULT;1.1;AES256
+33633161386465383663373137623030626264653862373161353564343662346433376437353530
+6265356266663464613439663434373531333939326538330a313064343637366632633866343534
+38313234303830636364383361613538666338636333323262333438313134353134356635626239
+6366336439353266660a633161383062666130396566396431383534313266343431633064376463
+38623562656564363565346166396363303636323062336636313838653638663833

docker/envs/gitea/.env

@@ -0,0 +1,14 @@
+$ANSIBLE_VAULT;1.1;AES256
+30626565616334613665623138613533653739333038643530636633393264393334373563326631
+3838333663306537326534333666316539383038363236650a613163643433653466666639666366
+33653861613638653862393338386334643332633762666136613932343834333162303363373030
+6161323863316134340a646532386537313164643039353435633535363061616363363337663365
+39343461356631383062353837383034653430373663323966373632323063636132613137643662
+37373065313764626539396463376637353136613365366566363436356537343932376565633962
+62316631663634316530623736613961623635303763633964386433333531626437303136363537
+35393134643935316330396161303134626537643162393062636363376435636162393136373034
+39636231626635643530313634333464653564353861656666633035623932336234303735386366
+62303133326237613763336435323338623036663137333439613462333434303734303737363936
+65333762376233396332633434353832373136383137336665623534356538636166303835376334
+64346139656432633230386666653531333864333664393936366630346334323963343431346164
+64376165666230386464303036303861653437646463633764343064376464396135

docker/envs/hitparade/.env

@@ -0,0 +1,11 @@
+$ANSIBLE_VAULT;1.1;AES256
+39313233623136333531343838643537373064363466356664326339323237623032303436613735
+6233383831383339366365663931333837313161646263390a646237306331386263323031373164
+33383365643735343834643839356238646161613330353938643738636135653562646430303330
+3332306436613537370a653234353464646639366236623665623162643363353230643963636361
+65386363623336396664333237313066383764656438363233653831623238623062333064343263
+36336132393563333031656366313066383132663732313964376261656331613863393965393232
+66383031366564313636643363653239663537616537623263383135326464376330636333303736
+32316530316139323264353136633865373634323761653763326262383238396639646664653039
+31376639346138343635343937613061623261666465323332313361363064393035663038346231
+3734333734656334626265643030303634383864613536373934

docker/envs/hitparade/pollmaster-config.yml

@@ -0,0 +1,30 @@
+$ANSIBLE_VAULT;1.1;AES256
+62303232383236386431613965343261333235646564616235643363393462646166613531303230
+6361343030396633663262333363616538323230313733620a306237396132663064316633323937
+62313339383336613066653662663066323330396234303435373137326435343637623465366133
+3534643534396639640a373834656135393733373465663138316564383662613561353065613861
+62643438383165316132333737623038336132666264353531633965663032333165666630626633
+65643632616363343938643138353238636231383134383733656466346531626634346163626434
+32383065316231363737663463663562373031313965346363336134653536663365613264383261
+61616434383537666334663166393536376634386231343030343465393837326439363465633064
+62643661643063316465623034646566363962353431623430356432366461613835633133663663
+35663836383830616161656265316463396335326330623439383935323039366136366232303235
+38323262316432343762663865333036313137396235396530656632366531303535626364363666
+32613030346636646136636532653134616639396237643866356464363138633863363061656534
+34646431393238386166306239666331376166316635333361616464396363626635343963306663
+30363930366332343934613830396464633534653565306138613066383933346633323337656264
+62636337326266633162356363373430626433653837346330653338306530356261383462336261
+65333364656263623335653937386439326164623838613463613031323037383762343165363230
+38343366346130383632316234656166313935336464666530373939333063356461303139643033
+38636133313037613431663161383836653137653964393866346564663339363764643535333037
+36616337666636653835313334373164666165313066366163373739393462653362306135396538
+66303636623535353231373839383539613165353463643961643130666563633465353534623931
+31343039313336323932373230643137323432313737396538353834376639353235306332353334
+65303231623138386237383437383234366461356464343236396631303234353566346534326665
+34316436326335333737633463386635356432326162346463646665643034626339643161383938
+63363531393131363464643232376232363639306564656463323162316362343233376663633662
+31333164316565383436326461316533386536623062373531323037373033373265333437393836
+36613530303163393931363666613865616566626533356131613239626162633236643635613938
+30393362316461396532393261643464376365643337633233323666336135366535653536386130
+35623564626135303232656337313430346136376361376232343166663232353763376464376230
+39356565373364353635386630333238616263306639663963616662633137343965

docker/envs/vrnp/.env

@@ -0,0 +1,10 @@
+$ANSIBLE_VAULT;1.1;AES256
+36643163613366383136326339346231373533373361633834663332343932356665303434333564
+3936636366396233326664636137363134643066303432380a363662646465656130303431386530
+37316138366239313038336664313661333632393333666539363565623032653431623935613631
+3635323330363663610a353263663736653561666261636138336438666261613739346664393233
+32323364346665633662663266626436343831386565663761393237346637376438613865363663
+36613035376638653937633866613935343834633431393830303438363265656337343565323063
+36303033323537666236633037656236656133396431326362303462353237326162626335363761
+36636362306232333630613464393135383539666632343038393333353462336238663130326166
+3061

docker/envs/yore/.env

@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+36313063633538313631386664353535373166306563613830316430613035306438326564396331
+6336306566306166616266643630343262616465306631350a393932613665346164613361333037
+39386135396364666630623962653462623234386430383034353731353361663837343036393130
+3261633964626135610a626364363761373734333762373764366363643537316662643634616263
+32383730663230303064626130393164616237636362656331313333316439323135366535303334
+3436323333383739666261656531363335326532616562353166

docker/envs/zomboid/.env

@@ -0,0 +1,10 @@
+$ANSIBLE_VAULT;1.1;AES256
+35336632386231333233333633656163356564316637366438383532626437303364633733353436
+3836376461393761653637666532643264613864633935620a326365386634393935333433306564
+62346235346262313339633739353232663562623562616136623838386233633136383764666536
+6239663264643333370a393762636231343034643133613163626239353735363037646638633933
+62376165306438653537343564376536396537666534633330666163346533313434616561306434
+63313035643732303863663430303936346264626637623936343763303738623865356536306365
+32623164323738663065613332656465643536633933643731366139626165636230343966383839
+64343961316139313931313966356430343438376461366537356337363835623637306539646265
+32376562363061643630663937663064393664663766613365363439653030393239

docker/runner/README.md

@@ -1,19 +0,0 @@
-# runner
-
-After installation, individual runners must still be registered, e.g.:
-
-```
-docker run --rm -it -v gitlab_runner_config:/etc/gitlab-runner gitlab/gitlab-runner register --name <name>
-```
-
-An issue I encountered when trying to cache stuff between builds was the following warning in the runner logs:
-
-```
-ERROR: Could not create cache adapter               error=cache factory not found: factory for cache adapter "" was not registered
-```
-
-In order to make the runner able to create caches, register it like so:
-
-```
-docker run --rm -it -v gitlab_runner_config:/etc/gitlab-runner gitlab/gitlab-runner register --name <name> --docker-disable-cache=false -docker-cache-dir /cache --docker-volumes gitlab_runner_cache:/cache
-```

docker/runner/docker-compose.yaml

@@ -1,13 +0,0 @@
-version: "3"
-
-services:
-  # Webserver for static files and reverse proxy
-  gitlab_runner:
-    image: gitlab/gitlab-runner:alpine
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - gitlab_runner_config:/etc/gitlab-runner
-    restart: always
-volumes:
-  gitlab_runner_config:
-    external: yes

docker/web/Caddyfile

@@ -1,34 +0,0 @@
-pbrinkmeier.de {
-    file_server {
-        root /srv/pbrinkmeier.de
-    }
-}
-
-tichy.click {
-    file_server {
-        root /srv/tichy.click
-    }
-}
-
-codi.pbrinkmeier.de {
-    reverse_proxy codi:3000
-}
-
-git.pbrinkmeier.de {
-    reverse_proxy gitlab:80
-}
-
-ci.pbrinkmeier.de {
-    reverse_proxy drone:80
-}
-
-jupyter.pbrinkmeier.de {
-    reverse_proxy jupyter:8888
-    basicauth {
-        wug JDJhJDE0JEJrQXUzVWxFZ2JGVmx6YlZWTkpYdy5IMjRXdnZZdGw5SjZDcUg2ZWMxOEVjcEV6dWhIRmhD
-    }
-}
-
-plantuml.pbrinkmeier.de {
-    reverse_proxy codi_plantuml:8080
-}

docker/web/Dockerfile

@@ -1,3 +0,0 @@
-FROM caddy
-
-COPY Caddyfile /etc/caddy/Caddyfile

docker/web/README.md

@@ -1,7 +0,0 @@
-# web
-
-Contains stuff exposed via HTTP(S) to the Internet, e.g. personal website, Wiki, etc.
-
-## Jupyter
-
-The Docker image for Jupyter is built using Nix. That process is not part of the Ansible setup (yet).

docker/web/docker-compose.yaml

@@ -1,135 +0,0 @@
-version: "3"
-
-services:
-  # Webserver for static files and reverse proxy
-  web:
-    image: pbrinkmeier/web
-    build: .
-    ports:
-      - 80:80
-      - 443:443
-    volumes:
-      - caddy_data:/data
-      - caddy_config:/config
-      - /home/paul/Sites:/srv:ro
-    restart: always
-
-  codi:
-    image: hackmdio/hackmd:2.4.2
-    # CMD_DB_{URL,CMD_SESSION_SECRET}
-    env_file: codi.env
-    environment:
-      - CMD_USECDN=false
-      - CMD_DOMAIN=codi.pbrinkmeier.de
-      - CMD_PROTOCOL_USESSL=true
-      - CMD_EMAIL=true
-      - CMD_ALLOW_EMAIL_REGISTER=false
-      - CMD_ALLOW_ANONYMOUS_EDITS=true
-      - CMD_PLANTUML_SERVER=https://plantuml.pbrinkmeier.de
-    depends_on:
-      - codi_db
-      - codi_plantuml
-    volumes:
-      - codi_uploads:/home/hackmd/app/public/uploads
-    restart: always
-    
-  codi_db:
-    image: postgres:11.6-alpine
-    # POSTGRES_{USER,PASSWORD,DB}
-    # Must match CMD_DB_URL in codi.env
-    env_file: codi_db.env
-    volumes:
-      - codi_database:/var/lib/postgresql/data
-    restart: always
-  
-  codi_plantuml:
-    image: plantuml/plantuml-server:jetty-v1.2022.7
-    restart: always
-
-  gitlab:
-    image: gitlab/gitlab-ce:15.3.2-ce.0
-    ports:
-      - "22:22"
-    volumes:
-      - gitlab_data:/var/opt/gitlab
-      - gitlab_logs:/var/log/gitlab
-      - gitlab_config:/etc/gitlab
-    restart: always
-    # GITLAB_SMTP_PASSWORD
-    env_file: gitlab.env
-    environment:
-      GITLAB_OMNIBUS_CONFIG: |
-        external_url 'https://git.pbrinkmeier.de'
-
-        gitlab_rails['smtp_enable'] = true
-        gitlab_rails['smtp_address'] = "smtp.mailbox.org"
-        gitlab_rails['smtp_port'] = 465
-        gitlab_rails['smtp_user_name'] = "hallo@pbrinkmeier.de"
-        gitlab_rails['smtp_password'] = ENV['GITLAB_SMTP_PASSWORD']
-        gitlab_rails['smtp_domain'] = "smtp.mailbox.org"
-        gitlab_rails['smtp_authentication'] = "login"
-        gitlab_rails['smtp_enable_starttls_auto'] = true
-        gitlab_rails['smtp_tls'] = true
-        gitlab_rails['smtp_openssl_verify_mode'] = 'none'
-        gitlab_rails['gitlab_email_from'] = 'git@pbrinkmeier.de'
-        gitlab_rails['gitlab_email_reply_to'] = 'noreply@pbrinkmeier.de'
-
-        gitlab_rails['gitlab_shell_ssh_port'] = 22
-
-        # https://docs.gitlab.com/omnibus/settings/rpi.html
-        puma['worker_processes'] = 2
-        sidekiq['concurrency'] = 9
-        prometheus_monitoring['enable'] = false
-
-        nginx['listen_port'] = 80
-        nginx['listen_https'] = false
-
-  jupyter:
-    image: ihaskell-docker:1.0
-    # ports:
-    #   - "8888:8888"
-    user: "42000" # Jupyter user UID (jupyter does not exist in container (TODO...))
-    environment:
-      HOME: /Notebooks
-    volumes:
-      - /home/jupyter/Notebooks:/Notebooks
-    restart: always
-  
-  drone:
-    image: drone/drone:2
-    # DRONE_{GITLAB_CLIENT_ID,GITLAB_CLIENT_SECRET,RPC_SECRET}
-    env_file: drone.env
-    environment:
-      DRONE_GITLAB_SERVER: https://git.pbrinkmeier.de
-      DRONE_SERVER_HOST: ci.pbrinkmeier.de
-      DRONE_SERVER_PROTO: https
-    volumes:
-      - /var/lib/pbri/docker/drone:/data
-    restart: always
-
-  drone_runner:
-    image: drone/drone-runner-docker:1
-    # DRONE_RPC_SECRET
-    env_file: drone.env
-    environment:
-      DRONE_RPC_PROTO: https
-      DRONE_RPC_HOST: ci.pbrinkmeier.de
-      DRONE_RUNNER_CAPACITY: 1
-      DRONE_RUNNER_NAME: shamash
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-    restart: always
-
-volumes:
-  caddy_data:
-  caddy_config:
-  codi_uploads:
-    external: yes
-  codi_database:
-    external: yes
-  gitlab_data:
-    external: yes
-  gitlab_logs:
-    external: yes
-  gitlab_config:
-    external: yes

flake.lock

@@ -0,0 +1,60 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1779042148,
+        "narHash": "sha256-0/iVMQ31Zna06KJselli3hFuGy4HKacyJ8UxmWMrNZI=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "3ef9dc56727d66ad28c2c3608da7261391ca18ad",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,27 @@
+{
+  description = "infrastructure environment";
+
+  inputs = {
+    # lib
+    nixpkgs.url = github:nixos/nixpkgs;
+    flake-utils.url = github:numtide/flake-utils;
+  };
+
+  outputs = { self, nixpkgs, flake-utils }: flake-utils.lib.eachDefaultSystem (system:
+    let
+      pkgs = nixpkgs.legacyPackages.${system};
+    in
+      {
+        devShells.default = pkgs.mkShell {
+          buildInputs = [
+            pkgs.ansible
+            pkgs.ansible-lint
+          ];
+
+          shellHook = ''
+            PS1="(infra) $PS1"
+          '';
+        };
+      }
+  );
+}