Disable admin interface in Caddy

Enable Gitea actions

.ansible-lint

@@ -0,0 +1,4 @@
+---
+
+profile: production
+offline: true

.drone.yml

@@ -1,10 +0,0 @@
----
-kind: pipeline
-type: docker
-name: ansible
-steps:
-  - name: ansible-lint
-    image: python:3.10.7
-    commands:
-      - pip install -r ansible/requirements.txt > /dev/null 2> /dev/null
-      - ansible-lint ansible

.gitea/workflows/check.yaml

@@ -0,0 +1,15 @@
+name: Check
+on: [push]
+jobs:
+  "Lint Ansible Files":
+    runs-on: ubuntu-22.04
+    steps:
+      - run: apt-get update
+      - run: apt-get install -y python3 python3-pip python3-venv
+      - run: python3 --version
+      - name: Check out repo
+        uses: actions/checkout@v3
+      - run: python3 -m venv venv
+      - run: venv/bin/pip --disable-pip-version-check install ansible==7.2.0 ansible-lint==6.16.1 > /dev/null 2> /dev/null
+      - run: venv/bin/ansible-lint -c .ansible-lint ansible
+  # TODO: Reimplement ansible-play --check step from old drone config

.gitignore

@@ -1,2 +1,2 @@
-*.env
 backups
+*.swp

README.md

@@ -4,21 +4,16 @@
 
 | Prop | Value |
 | --- | --- |
-| Hostname | `h2954114`                                                                |
-| Domains  | `{wiki.,codi.,git.,}pbrinkmeier.de`, `tichy.click`, `h2954114.stratoserver.net` |
+| Hostname | `shamash` |
+| Domains  | `{,pad.,codi.,ci.,git.,jupyter.,plantuml.}pbrinkmeier.de`, `tichy.click`, `beany.club`, `vmd98928.contaboserver.net` |
 
-### Personal Website
+## Linting
 
-[pbrinkmeier.de](https://pbrinkmeier.de)
+Use `nix develop` to drop into a shell containing `ansible-lint`.
+Then run it using
 
-### Personal Wiki
+```
+ansible-lint --offline
+```
 
-[wiki.pbrinkmeier.de](https://wiki.pbrinkmeier.de)
-
-### Collaborative Markdown Editing
-
-[codi.pbrinkmeier.de](https://codi.pbrinkmeier.de)
-
-### Tichy-Clicker
-
-[tichy.click](https://tichy.click)
+to avoid checking for a new version every single run.

TODO.md

@@ -6,7 +6,13 @@
     - [x] Make it inaccessible to anyone but root (`-rw------`)
 - [x] Add [Drone runner](https://docs.drone.io/runner/docker/installation/linux/)
 - [ ] Figure out how to dependably store `.env` files (Ansible vault? Something else?)
+    - [ ] In vault, seperate from other config
 - [x] Check out docker swarm and current best practices for Ansible
 - [x] Use Gitea instead of GitLab
 - [ ] Add drone exec runner for Nix builds with shared `/nix`
-- [ ] Lint caddy file, add gzip and disable admin interface
+- [ ] Lint caddy file, add gzip and disable admin interface
+- [x] Make Gitea display graphs in Notebooks (see https://docs.gitea.io/en-us/external-renderers/).
+- [x] Factorio server
+- [ ] Add flag for Gitea backups (after which Gitea will be up but no contain the sites source code)
+- [x] Add Gitea actions
+- [ ] Remove drone

ansible/.gitignore

@@ -1 +0,0 @@
-venv

ansible/README.md

@@ -2,10 +2,11 @@
 
 ## Ansible Control Node Setup
 
-In a Python 3 environment (perhaps a venv), run:
+The root of this repo contains a `flake.nix` that defines a shell with all necessary tools.
+To drop into a shell with `ansible-*` commands, run:
 
 ```
-pip install -r requirements.txt
+nix develop
 ```
 
 ## `misc.yaml`

ansible/inventory

@@ -1,2 +1,2 @@
 [misc]
-shamash
+vmd98928.contaboserver.net ansible_port=2309

ansible/playbooks/misc-docker.yaml

@@ -7,8 +7,9 @@
       ansible.builtin.user:
         name: "{{ item.name }}"
         uid: "{{ item.uid }}"
+        state: "{{ item.state }}"
         create_home: false
-        state: present
+        system: true
       loop:
         - name: jupyter
           uid: 42000
@@ -16,24 +17,57 @@
         - name: gitea
           uid: 42001
           state: present
+        - name: score
+          uid: 42003
+          state: present
+        - name: factorio
+          uid: 845
+          state: present
         - name: hackmd
           uid: 1500
           state: present
+
+        - name: hedgedoc
+          uid: 10000
+          state: absent
+        - name: bsa
+          uid: 42002
+          state: absent
     # All services that are behind Caddy need to be in this network
     - name: Create Caddy network
       become: true
-      docker_network:
+      community.docker.docker_network:
         name: caddy-network
         state: present
     - name: Upload docker configuration
       become: true
       ansible.builtin.copy:
-        src: ../../docker
+        src: ../../docker/docker
         dest: /etc/pbri
         # Files should inaccessible to non-root users.
         mode: u=rw,g=,o=
         # Directories should be listable
         directory_mode: u=rwx,g=rx,o=rx
+    - name: Upload and decrypt docker environment vars
+      become: true
+      ansible.builtin.copy:
+        src: "../../docker/envs/{{ item.name }}/.env"
+        dest: /etc/pbri/docker/{{ item.name }}/.env
+        # Files should inaccessible to non-root users.
+        mode: u=rw,g=,o=
+        # This is true by default but I put it here anyways
+        # to emphasize what's happening
+        decrypt: true
+      # Not quite happy with all the seperate loops yet.
+      loop:
+        - name: codi
+          state: present
+        - name: drone
+          state: present
+        - name: factorio
+          state: present
+        - name: gitea
+          state: present
     - name: Create directory for docker volumes
       become: true
       ansible.builtin.file:
@@ -41,9 +75,41 @@
         state: directory
         # Hide contents from non-root users
         mode: u=rwx,g=,o=
-    - name: Set up docker stuff
+    - name: Create jupyter folders
       become: true
-      docker_compose:
+      ansible.builtin.file:
+        path: "/var/lib/pbri/docker/{{ item.name }}"
+        owner: "{{ item.user }}"
+        group: "{{ item.user }}"
+        state: directory
+        mode: u=rwx,g=,o=
+      loop:
+        - name: jupyter_data
+          user: jupyter
+        - name: jupyter_notebooks
+          user: jupyter
+    - name: Create Factorio data folder
+      become: true
+      ansible.builtin.file:
+        path: /var/lib/pbri/docker/factorio
+        state: directory
+        owner: factorio
+        group: factorio
+        mode: u=rwx,g=,o=
+    - name: Create score data folder
+      become: true
+      ansible.builtin.file:
+        path: /var/lib/pbri/docker/score
+        state: directory
+        owner: score
+        group: score
+        mode: u=rwx,g=,o=
+    # Since some docker-compose configuration might want to pull
+    # images from the Gitea package repository, we need to ensure
+    # that Gitea is reachable before those configurations are deployed.
+    - name: Set up caddy and gitea containers
+      become: true
+      community.docker.docker_compose:
         project_src: "/etc/pbri/docker/{{ item.name }}"
         state: "{{ item.state }}"
         build: true
@@ -53,15 +119,37 @@
           state: present
         - name: gitea
           state: present
+    # Before deploying the remaining configs below, we check that
+    # Gitea is reachable at git.pbrinkmeier.de
+    - name: Wait for gitea to be reachable
+      check_mode: false
+      ansible.builtin.uri:
+        method: GET
+        url: https://git.pbrinkmeier.de/api/v1/version
+      register: gitea_version_response
+      until: gitea_version_response.status == 200
+      retries: 10
+      delay: 5  # Retry every 5 seconds
+    - name: Set up other containers
+      become: true
+      community.docker.docker_compose:
+        project_src: "/etc/pbri/docker/{{ item.name }}"
+        state: "{{ item.state }}"
+        build: true
+        debug: true
+      loop:
         - name: drone
           state: present
         - name: codi
           state: present
-    - name: Add Notebooks folder
-      become: true
-      ansible.builtin.file:
-        path: /home/jupyter/Notebooks
-        owner: jupyter
-        group: jupyter
-        state: directory
-        mode: 0755
+        - name: jupyter
+          state: present
+        - name: utoy
+          state: present
+        - name: score
+          state: present
+
+        - name: factorio
+          state: absent
+        - name: glebby
+          state: absent

ansible/requirements.txt

@@ -1,2 +0,0 @@
-ansible==6.4.0
-ansible-lint==6.5.2

ansible/roles/docker/tasks/main.yaml

@@ -12,6 +12,7 @@
       - lsb-release
 
 - name: Retrieve Docker GPG key
+  check_mode: false
   ansible.builtin.uri:
     url: https://download.docker.com/linux/debian/gpg
     return_content: true
@@ -25,8 +26,9 @@
     creates: /usr/share/keyrings/docker-archive-keyring.gpg
 
 - name: Retrieve dpkg architecture
+  check_mode: false
   ansible.builtin.command: dpkg --print-architecture
-  register: dpkg_architecture
+  register: docker_dpkg_architecture
   changed_when: false
 
 - name: Add Docker apt repository
@@ -34,7 +36,7 @@
   ansible.builtin.template:
     src: docker.list.j2
     dest: /etc/apt/sources.list.d/docker.list
-    mode: 0644
+    mode: "u=rw,g=r,o=r"
 
 - name: Install Docker
   become: true

ansible/roles/docker/templates/docker.list.j2

@@ -1 +1 @@
-deb [arch={{ dpkg_architecture.stdout }} signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable
+deb [arch={{ docker_dpkg_architecture.stdout }} signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable

docker/README.md

@@ -0,0 +1,4 @@
+## Folders
+
+- `docker`: Contains `docker-compose` configurations for projects
+- `envs`: Contains `.env` files encrypted using `ansible-vault`. These files are decrypted and uploaded next to their corresponding `docker-compose.yaml` file.

docker/docker/caddy/Caddyfile

@@ -1,3 +1,7 @@
+{
+    admin off
+}
+
 pbrinkmeier.de {
     file_server {
         root /srv/pbrinkmeier.de
@@ -11,6 +15,10 @@ tichy.click {
 }
 
 codi.pbrinkmeier.de {
+    redir https://pad.pbrinkmeier.de{uri} permanent
+}
+
+pad.pbrinkmeier.de {
     reverse_proxy codi:3000
 }
 
@@ -32,3 +40,11 @@ jupyter.pbrinkmeier.de {
 plantuml.pbrinkmeier.de {
     reverse_proxy codi_plantuml:8080
 }
+
+utoy.beany.club {
+    reverse_proxy utoy:3000
+}
+
+score.brocke.net {
+    reverse_proxy score:8080
+}

docker/docker/codi/docker-compose.yaml

@@ -5,15 +5,33 @@ services:
     image: hackmdio/hackmd:2.4.2
     user: hackmd
     environment:
-      CMD_USECDN: "false"
-      CMD_DOMAIN: codi.pbrinkmeier.de
-      CMD_PROTOCOL_USESSL: "true"
-      CMD_EMAIL: "true"
-      CMD_ALLOW_EMAIL_REGISTER: "false"
-      CMD_ALLOW_ANONYMOUS_EDITS: "true"
-      CMD_PLANTUML_SERVER: https://plantuml.pbrinkmeier.de
+      # Admin stuff
       CMD_DB_URL: "postgres://${CODI_DB_USER}:${CODI_DB_PASSWORD}@codi_db/${CODI_DB_DB}"
       CMD_SESSION_SECRET: "${CODI_SESSION_SECRET}"
+      CMD_USECDN: "false"
+      CMD_DOMAIN: pad.pbrinkmeier.de
+      CMD_PROTOCOL_USESSL: "true"
+      CMD_ALLOW_GRAVATAR: "false"
+      # Don't allow unauthenticated users to create notes
+      CMD_ALLOW_ANONYMOUS: "false"
+      # Allow unauthenticated users to edit "Freely" notes
+      CMD_ALLOW_ANONYMOUS_EDITS: "true"
+      # Misc
+      CMD_ALLOW_FREEURL: "true"
+      CMD_REQUIRE_FREEURL_AUTHENTICATION: "true"
+      CMD_PLANTUML_SERVER: https://plantuml.pbrinkmeier.de
+      # Authentication: Use Gitea OAuth2
+      CMD_EMAIL: "false"
+      CMD_ALLOW_EMAIL_REGISTER: "false"
+      CMD_OAUTH2_CLIENT_ID: "${CODI_OAUTH2_CLIENT_ID}"
+      CMD_OAUTH2_CLIENT_SECRET: "${CODI_OAUTH2_CLIENT_SECRET}"
+      CMD_OAUTH2_AUTHORIZATION_URL: https://git.pbrinkmeier.de/login/oauth/authorize
+      CMD_OAUTH2_TOKEN_URL: https://git.pbrinkmeier.de/login/oauth/access_token
+      CMD_OAUTH2_USER_PROFILE_URL: https://git.pbrinkmeier.de/api/v1/user
+      CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR: login
+      CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR: full_name
+      CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR: email
+
     depends_on:
       - codi_db
       - codi_plantuml

docker/docker/drone/docker-compose.yaml

@@ -12,7 +12,7 @@ services:
       DRONE_SERVER_PROTO: https
     volumes:
       - /var/lib/pbri/docker/drone:/data
-    restart: always
+    restart: unless-stopped
 
   drone_runner:
     image: drone/drone-runner-docker:1
@@ -24,7 +24,7 @@ services:
       DRONE_RUNNER_NAME: shamash
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-    restart: always
+    restart: unless-stopped
 
 networks:
   default:

docker/docker/factorio/Dockerfile

@@ -0,0 +1,4 @@
+FROM factoriotools/factorio:1.1.87
+
+COPY server-settings.json /server-settings.json
+ENTRYPOINT [ "/bin/sh", "-c", "mkdir -p /factorio/config && envsubst < /server-settings.json > /factorio/config/server-settings.json && exec /docker-entrypoint.sh" ]

docker/docker/factorio/README.md

@@ -0,0 +1,10 @@
+# factorio
+
+Add a `.env` file like this:
+
+```
+GAME_PASSWORD=...
+```
+
+Environment variables are put into `server-settings.json` during startup using `envsubst`.
+See also: https://hub.docker.com/r/factoriotools/factorio.

docker/docker/factorio/docker-compose.yaml

@@ -0,0 +1,14 @@
+version: "3"
+
+services:
+  gitea:
+    image: pbrinkmeier/factorio
+    build: .
+    restart: always
+    environment:
+      GAME_PASSWORD: "${GAME_PASSWORD}"
+    volumes:
+      - /var/lib/pbri/docker/factorio:/factorio
+    ports:
+      - "34197:34197/udp"
+      - "27015:27015/tcp"

docker/docker/factorio/server-settings.json

@@ -0,0 +1,72 @@
+{
+    "name": "le epic factorio server",
+    "description": "Description of the game that will appear in the listing",
+    "tags": ["game", "tags"],
+  
+    "_comment_max_players": "Maximum number of players allowed, admins can join even a full server. 0 means unlimited.",
+    "max_players": 0,
+  
+    "_comment_visibility": ["public: Game will be published on the official Factorio matching server",
+                            "lan: Game will be broadcast on LAN"],
+    "visibility":
+    {
+      "public": false,
+      "lan": false
+    },
+  
+    "_comment_credentials": "Your factorio.com login credentials. Required for games with visibility public",
+    "username": "",
+    "password": "",
+  
+    "_comment_token": "Authentication token. May be used instead of 'password' above.",
+    "token": "",
+  
+    "game_password": "",
+  
+    "_comment_require_user_verification": "When set to true, the server will only allow clients that have a valid Factorio.com account",
+    "require_user_verification": false,
+  
+    "_comment_max_upload_in_kilobytes_per_second" : "optional, default value is 0. 0 means unlimited.",
+    "max_upload_in_kilobytes_per_second": 0,
+  
+    "_comment_max_upload_slots" : "optional, default value is 5. 0 means unlimited.",
+    "max_upload_slots": 5,
+  
+    "_comment_minimum_latency_in_ticks": "optional one tick is 16ms in default speed, default value is 0. 0 means no minimum.",
+    "minimum_latency_in_ticks": 0,
+  
+    "_comment_max_heartbeats_per_second": "Network tick rate. Maximum rate game updates packets are sent at before bundling them together. Minimum value is 6, maximum value is 240.",
+    "max_heartbeats_per_second": 60,
+  
+    "_comment_ignore_player_limit_for_returning_players": "Players that played on this map already can join even when the max player limit was reached.",
+    "ignore_player_limit_for_returning_players": false,
+  
+    "_comment_allow_commands": "possible values are, true, false and admins-only",
+    "allow_commands": "admins-only",
+  
+    "_comment_autosave_interval": "Autosave interval in minutes",
+    "autosave_interval": 10,
+  
+    "_comment_autosave_slots": "server autosave slots, it is cycled through when the server autosaves.",
+    "autosave_slots": 5,
+  
+    "_comment_afk_autokick_interval": "How many minutes until someone is kicked when doing nothing, 0 for never.",
+    "afk_autokick_interval": 5,
+  
+    "_comment_auto_pause": "Whether should the server be paused when no players are present.",
+    "auto_pause": true,
+  
+    "only_admins_can_pause_the_game": true,
+  
+    "_comment_autosave_only_on_server": "Whether autosaves should be saved only on server or also on all connected clients. Default is true.",
+    "autosave_only_on_server": true,
+  
+    "_comment_non_blocking_saving": "Highly experimental feature, enable only at your own risk of losing your saves. On UNIX systems, server will fork itself to create an autosave. Autosaving on connected Windows clients will be disabled regardless of autosave_only_on_server option.",
+    "non_blocking_saving": false,
+  
+    "_comment_segment_sizes": "Long network messages are split into segments that are sent over multiple ticks. Their size depends on the number of peers currently connected. Increasing the segment size will increase upload bandwidth requirement for the server and download bandwidth requirement for clients. This setting only affects server outbound messages. Changing these settings can have a negative impact on connection stability for some clients.",
+    "minimum_segment_size": 25,
+    "minimum_segment_size_peer_count": 20,
+    "maximum_segment_size": 100,
+    "maximum_segment_size_peer_count": 10
+  }

docker/docker/gitea/Dockerfile

@@ -0,0 +1,3 @@
+ FROM gitea/act_runner:0.2.5
+
+ COPY runner-config.yaml /opt/runner-config.yaml

docker/docker/gitea/README.md

@@ -0,0 +1,17 @@
+# gitea
+
+Add a `.env` file like this:
+
+```
+GITEA_DB_PASSWORD=...
+GITEA_SMTP_PASSWORD=...
+GITEA_RUNNER_REGISTRATION_TOKEN=...
+```
+
+You should keep an eye on `GITEA_RUNNER_REGISTRATION_TOKEN`. I suspect
+it might change over time, e.g. when restarting or updating Gitea.
+
+## Files
+
+- `runner-config.yaml`: Configuration for `gitea/act_runner`. Generated using `act_runner generate-config` then adjusted
+- `Dockerfile`: Creates an image based on `gitea/act_runner` that comes with `runner-config.yaml` in `/opt` (to avoid the extra mount)

docker/docker/gitea/docker-compose.yaml

@@ -2,8 +2,8 @@ version: "3"
 
 services:
   gitea:
-    image: gitea/gitea:1.17.1
-    restart: always
+    image: gitea/gitea:1.20.3
+    restart: unless-stopped
     environment:
       # Ref: https://docs.gitea.io/en-us/config-cheat-sheet
       # User is created by misc-docker.yaml
@@ -35,12 +35,17 @@ services:
       GITEA__service__DEFAULT_ENABLE_TIMETRACKING: "false"
       GITEA__service__DEFAULT_ALLOW_ONLY_CONTRIBUTORS_TO_TRACK_TIME: "false"
       GITEA__mailer__ENABLED: "true"
-      GITEA__mailer__HOST: smtp.mailbox.org:465
+      GITEA__mailer__PROTOCOL: smtps
+      GITEA__mailer__SMTP_ADDR: smtp.mailbox.org
+      GITEA__mailer__SMTP_HOST: 465
       GITEA__mailer__FROM: git@pbrinkmeier.de
       GITEA__mailer__USER: hallo@pbrinkmeier.de
       GITEA__mailer__PASSWD: "${GITEA_SMTP_PASSWORD}"
       GITEA__openid__ENABLE_OPENID_SIGNIN: "false"
       GITEA__openid__ENABLE_OPENID_SIGNUP: "false"
+      # Enable Gitea actions
+      # Ref: https://docs.gitea.com/usage/actions/quickstart
+      GITEA__actions__ENABLED: "true"
     volumes:
       - /var/lib/pbri/docker/gitea:/data
       - /etc/timezone:/etc/timezone:ro
@@ -52,7 +57,7 @@ services:
 
   gitea_db:
     image: postgres:14.5-alpine
-    restart: always
+    restart: unless-stopped
     environment:
       POSTGRES_DB: gitea
       POSTGRES_USER: gitea
@@ -60,6 +65,21 @@ services:
     volumes:
       - /var/lib/pbri/docker/gitea_db:/var/lib/postgresql/data
 
+  gitea_runner:
+    image: pbrinkmeier/act_runner:0.2.5
+    build: .
+    restart: unless-stopped
+    environment:
+      CONFIG_FILE: /opt/runner-config.yaml
+      GITEA_INSTANCE_URL: "https://git.pbrinkmeier.de"
+      GITEA_RUNNER_REGISTRATION_TOKEN: "${GITEA_RUNNER_REGISTRATION_TOKEN}"
+      GITEA_RUNNER_NAME: "basic-bitchboy"
+    volumes:
+      - /var/lib/pbri/docker/gitea_runner_data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    depends_on:
+      - gitea
+
 networks:
   default:
     name: caddy-network

docker/docker/gitea/runner-config.yaml

@@ -0,0 +1,85 @@
+log:
+  # The level of logging, can be trace, debug, info, warn, error, fatal
+  level: info
+
+runner:
+  # Where to store the registration result.
+  file: .runner
+  # Execute how many tasks concurrently at the same time.
+  capacity: 1
+  # Extra environment variables to run jobs.
+  # envs:
+  #   A_TEST_ENV_NAME_1: a_test_env_value_1
+  #   A_TEST_ENV_NAME_2: a_test_env_value_2
+  # Extra environment variables to run jobs from a file.
+  # It will be ignored if it's empty or the file doesn't exist.
+  # env_file: .env
+  # The timeout for a job to be finished.
+  # Please note that the Gitea instance also has a timeout (3h by default) for the job.
+  # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
+  timeout: 3h
+  # Whether skip verifying the TLS certificate of the Gitea instance.
+  insecure: false
+  # The timeout for fetching the job from the Gitea instance.
+  fetch_timeout: 5s
+  # The interval for fetching the job from the Gitea instance.
+  fetch_interval: 2s
+  # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
+  # Like: ["macos-arm64:host", "ubuntu-latest:docker://node:16-bullseye", "ubuntu-22.04:docker://node:16-bullseye"]
+  # If it's empty when registering, it will ask for inputting labels.
+  # If it's empty when execute `deamon`, will use labels in `.runner` file.
+  # Some (most?) GitHub actions use node for scripting, so just using
+  # ubuntu:22.04 here is not enough.
+  labels:
+    - "ubuntu-22.04:docker://node:16-bullseye"
+
+cache:
+  # Enable cache server to use actions/cache.
+  enabled: false
+  # The directory to store the cache data.
+  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
+  dir: ""
+  # The host of the cache server.
+  # It's not for the address to listen, but the address to connect from job containers.
+  # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
+  host: ""
+  # The port of the cache server.
+  # 0 means to use a random available port.
+  port: 0
+  # The external cache server URL. Valid only when enable is true.
+  # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
+  # The URL should generally end with "/".
+  external_server: ""
+
+container:
+  # Specifies the network to which the container will connect.
+  # Could be host, bridge or the name of a custom network.
+  # If it's empty, act_runner will create a network automatically.
+  network: ""
+  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+  privileged: false
+  # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
+  options:
+  # The parent directory of a job's working directory.
+  # If it's empty, /workspace will be used.
+  workdir_parent:
+  # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
+  # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
+  # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
+  # valid_volumes:
+  #   - data
+  #   - /src/*.json
+  # If you want to allow any volume, please use the following configuration:
+  # valid_volumes:
+  #   - '**'
+  valid_volumes: []
+  # overrides the docker client host with the specified one.
+  # If it's empty, act_runner will find an available docker host automatically.
+  # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
+  # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
+  docker_host: ""
+
+host:
+  # The parent directory of a job's working directory.
+  # If it's empty, $HOME/.cache/act/ will be used.
+  workdir_parent:

docker/docker/glebby/docker-compose.yaml

@@ -0,0 +1,11 @@
+version: "3"
+
+services:
+  glebby:
+    image: git.pbrinkmeier.de/paul/glebby:1.1-prod
+    restart: always
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/docker/jupyter/docker-compose.yaml

@@ -0,0 +1,15 @@
+version: "3"
+
+services:
+  jupyter:
+    image: git.pbrinkmeier.de/paul/jup:1.5
+    user: "42000"
+    volumes:
+      - /var/lib/pbri/docker/jupyter_data:/data
+      - /var/lib/pbri/docker/jupyter_notebooks:/notebooks
+    restart: always
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/docker/score/docker-compose.yaml

@@ -0,0 +1,16 @@
+version: "3"
+
+services:
+  score:
+    image: ghcr.io/lbrocke/score:v1.0.2
+    user: "42003:42003"
+    environment:
+      SCORE_LISTEN: 0.0.0.0:8080
+    volumes:
+      - /var/lib/pbri/docker/score:/data
+    restart: unless-stopped
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/docker/utoy/docker-compose.yaml

@@ -0,0 +1,11 @@
+version: "3"
+
+services:
+  utoy:
+    image: git.pbrinkmeier.de/paul/utoy:0.6
+    restart: always
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/envs/codi/.env

@@ -0,0 +1,20 @@
+$ANSIBLE_VAULT;1.1;AES256
+35633339346331336263653239623234333765623065313466373635353662306632663063323138
+3138333732376665636531396335393235653538393438660a326664656462383737383735386262
+34646634653631613333656132663536653337386362303536626634363239663064383564633663
+3563383663383266610a613938376665353936643361366465393765313666636531663837383036
+34373064616662363839396233623232643134366361313130636433356237323565636338306435
+36333139356635376366643538303736306364383764393365663365643137383439376636376561
+65343036363538393235333434316632393562613735313165636165666662326462663063356532
+34343936356364643536313230383633396438363638623963643239643638633435353164623635
+35646631353364663261633862666331636532663762636164663861303262373630643265623239
+62333737393562376235373430363662613032623436303865613634636436376565363130366532
+36303834343439333865313037336233323036373833663837303332393330306434373431363961
+30323134373666376563316661303131306566393830633732313664653039313263613761346262
+34393738376434313663336231656132386163663665393133363465366230383537656630313563
+66373633333663653837336439646363646233326233303062643635396531356438363433633131
+36353561366265343036386533373563613836663831613836643432386633643535396536376362
+65306335313363316236363362316533663433656531366331336132303965373230623330313636
+38623361623934303663333631306330333434343833336132333333313939616261666461346333
+34343935663165303665373735646636326364393336626462363732353739366161366164333465
+643034323233333535376461313834663132

docker/envs/drone/.env

@@ -0,0 +1,14 @@
+$ANSIBLE_VAULT;1.1;AES256
+31333834393366333930346366373931333930646233383664643463393965303238613430646638
+6461373434616433353337643131396462326537346434380a386562633335346436303662336362
+62333739626237323334333666633162616338313932393261303231353539623237383638643030
+3364393934653232310a383065386530373433393635313665353532666361303436613337316565
+32306233336134383531633232393862303466373331373764376462653736663861663366323762
+65666263366461396362386264613830336435346234386234333562616131653938386439336566
+34386461343433346363336161373038303434383563303564653533623939613937323030636362
+66636639643963613236366138646335393831366432333637333065326162646237643561336666
+61323833333337633861646462393930663733333266336233663630396532366566303835653431
+38363365383166393765343735363030363562313837643837313864373735643264663264643633
+66306261633666616363666562306632613032373231633730313638383033633761653661383738
+39623630643766663438656635653530626664313765633430646330356333306239653437373839
+3933

docker/envs/factorio/.env

@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+32356463313330336636636363646138393236636233326132623165353962623565356364396530
+3636336532396665333637653432353332643434643962390a313162343836306435383536313937
+36656632356366303561366536373535383538303730386239386437323466346533353634306436
+3930633464353235360a653936333734353137313363316261366666353238366566613865366463
+32393431343439383733343766323831643561663938376264336331306139646337343633346536
+3236343538323032636666366639303539316236393535323661

docker/envs/gitea/.env

@@ -0,0 +1,14 @@
+$ANSIBLE_VAULT;1.1;AES256
+35623364633833623964623536646534373634663736613561333561343136333965306638396532
+6162393239383936386338666565306132646230383066630a336337613636383431623738343663
+61343262363631376665383035323139313863626331666439336134613035663439376231343863
+3032353139643138640a383365356630323835383538393734643134343133653033383663333464
+62386361633435633664306531623835353665326432393932336163316561653866343137323030
+63643262323436356166373533363235366238393633336631336266373837373932313134303563
+65633337393938623134636538653561356565333831356638373862376333336163363438626438
+39343436383732313561396236656530303064363961663636353538346264633532633866333162
+35303032303662646166333537373566316462633536333463323433353539623363323036643763
+34376365613932303133366236613235636238643139666663356436326532616437383432303437
+39376535656266383465373837643634383937656431323265386163373138336164383666383962
+64623762613332363731323739666238613634646237396331666463363663313461313966356233
+30653362353061333739303234336461373337346632646433623462623765353330

docker/gitea/README.md

@@ -1,6 +0,0 @@
-Add a `.env` file like this:
-
-```
-GITEA_DB_PASSWORD=...
-GITEA_SMTP_PASSWORD=...
-```

flake.lock

@@ -0,0 +1,60 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1685518550,
+        "narHash": "sha256-o2d0KcvaXzTrPRIo0kOLV0/QXHhDQ5DTi+OxcjO8xqY=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "a1720a10a6cfe8234c0e93907ffe81be440f4cef",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1686259070,
+        "narHash": "sha256-bJ2TqJHMdU27o3+AlYzsDooUzneFHwvK5LaRv5JYit4=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "8a7d5c039cacc83bd1926aaabc04d541e04a1460",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,27 @@
+{
+  description = "infrastructure environment";
+
+  inputs = {
+    # lib
+    nixpkgs.url = github:nixos/nixpkgs;
+    flake-utils.url = github:numtide/flake-utils;
+  };
+
+  outputs = { self, nixpkgs, flake-utils }: flake-utils.lib.eachDefaultSystem (system:
+    let
+      pkgs = nixpkgs.legacyPackages.${system};
+    in
+      {
+        devShells.default = pkgs.mkShell {
+          buildInputs = [
+            pkgs.ansible
+            pkgs.ansible-lint
+          ];
+
+          shellHook = ''
+            PS1="(infra) $PS1"
+          '';
+        };
+      }
+  );
+}