Upgrade gitea -> v1.15.7

Reviewed-on: data.coop/ansible#67

ansible.cfg

@@ -1,2 +1,3 @@
 [defaults]
 remote_user = root
+inventory = datacoop_hosts

deploy.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-BASE_CMD="ansible-playbook playbook.yml -i datacoop_hosts --ask-vault-pass"
+BASE_CMD="ansible-playbook playbook.yml --ask-vault-pass"
 
 if [ -z "$1" ]; then
     echo "Deploying all!"

group_vars/all/secrets.yml

@@ -1,58 +1,102 @@
 $ANSIBLE_VAULT;1.1;AES256
-32393230646466336565653530386632356235653437356237393163313033663066393963343031
-3339346530316430666632666230316165663564313464390a666539666265326235666266306231
-38383466343364646333343132333338306434613961663765353566353166626539306335653537
-3466326433316166370a376639363235326363323234313630336330613733616362653838396464
-36623733643261633730306537613132333432333239353638636363646464633665643832646238
-34663635343437643534633232346466373336316664343335313435366636303136303239643834
-63623436323831613862343938303137643735336637306433376237643032633738376563666265
-33383032643461653763653231333132633034383431303165646439393266616634386431313565
-38656530306538343239323864303538376165313330623231646265626261303235343130653665
-62363839346630343461323136363037666135373733303864623737313634316136336537323464
-37633539396462313462386364373733313566373332343834353164393161636161356537303237
-39646561376138613433633431626530346430356264653932636163393663356565393464393161
-37313661633466636437623233623937353234313962633131383365396631643631346261386439
-65393162633965353538626133636534336635623364353963626135333637343662353765633161
-34373337653730333032396663306663653830643761633730663432366433346631363463323464
-38356163363836636562376431373933623930643236636239663065306536396236633130306165
-62343730306465333361663530363462666439343438633965393965623239623836333335366438
-65336463333539303366376635303432643538666362643335393834336231646562366234623832
-33623632653932636662653933623362356431393739646166353136346235333231643530323738
-62643135386563353933616632363664363430393035343263393736393736623831666239363866
-63333163646631396266366164633562653633333536663763643364616666323262666633663265
-65386238366131343432646164383061373635346165303064626632303234663730356130636436
-63396237313338656533393062363133643631346563303139306230333137383734333764616165
-61303632393363396565383731353066633666353835313665303532656635356465343861613132
-38613530376165376666303536303263383039613533393731396663376431616561656564316336
-39613134666531303638323230316365333432376165303361303361383339363539353938633931
-61373765366133643263373233626436333735393130373461383333613363626135666663633637
-33633061316661313930333133343262666636343835633234383264613966656438646430316636
-34333866616634306239333238356261333336343930353361656263326135656163353937316434
-63623831333939653264326638366230333636663234303762393966386539653932346436303965
-35383137323661663862313764653064353030626662353365623663653565623866626266333335
-39633538303566333061383938383739396266396533666231316534323161666331333632663963
-38383332623561383164336633316534326635323435356135383736303536643133383631393339
-36353732393263626661346563356663356436363465393639613631366332353938663535356137
-32393138323662646166386139653833313536656434363461383565636232333630653462343934
-61363535363332353131393265353031643964303766363431343332666634353166303435303165
-34356363326539383139396536643338316631333630393839623339616263666661366462313236
-34303939623335353366613865363530333338643364633862336337373737653863643239386132
-38633065623365326136656538663839313563313435653733336633613737393739623334303938
-39623161353939663935373838316137633262373435353335323537363637623834363030343839
-64666565633534326662636530383733396531613939613431646136396366323764393363343231
-38393239663762623932626537613763353065643564303766663932346666393938616562376666
-38383939643632313931343063323838613461633161643434353532623433303434396262363764
-30303361303832363765316265346534313637663462303362633039363163356535356565343964
-66653639356661373231653630646338393835656435386566623263353363376365353565333961
-62646634323730633364366137326434663661383165373066303062396432373361346436316338
-38663264663235333938363538353736636161633639383937336365323732353161643365616264
-39643234643238646332613934343666323736666261366164383034303637623133303365313062
-38353832353366383637626532386339306438333035313563333464326539363661633564316534
-62613538356366343566303339383863343265633161396162353962356366333432623438343039
-63303662643339636366623630616339363363633434383731376334323736373265326138356161
-66336636613138666465623635343163386537376263353437333765323832333539386336326564
-37356331343139653339313337383461333834353166353838643666376439376237353032363164
-66613530633538666436366563343232326334613432363162383163383031343763653864646331
-36303463316637336132353832643761386332643130353839363833346532626162643661366464
-34336438306661343961663163386361316338303930343364656561326363623630303036616264
-3232
+32336562633266653862666430393834306131343538636136643866306639313132383063393335
+3437383263343337323637616330383761346661383065390a396466663135313433643830316439
+65626336303339653730643435353366633839366165393463663031333030356464373338353765
+3662646137623936650a633038376161633737376432306466663938333838333339626235663362
+34303237306533343435346361346461613339323931666461313261623936653936656439663139
+39666639616234653565303235313866636463656237363861636366666433393631366364623534
+39313638363231646539383133383938353439356335313263656362376538623531636166383233
+32653461653965303835613833383736396563306436623762613138343665343461623964666464
+31363836343534616235323238663262343963376133636337333937353732623938616434333666
+37386231356633653034656130383463643065373935633334653766396539326262646465376338
+31346134356162613266393132313839363166623562316230313338373062393535363236363133
+62653261663865323933323061353864643435323538633733363030356636653162616237323839
+33636235396166326336303133613431326231356434383431623366386437303162396234626563
+66333232343234613661363339653234343333323965353537353337303964653066356664303265
+62333237343334333836623566643633656134353034623630323361376562353464636538623664
+65313435316533633834303734636233333164616230393664646261663133323536356338323430
+38623734366530313461653062376136336634386132333138666439326636373536636134333432
+61396432353962366333373961323263633036656362653330393236333737306664633335313438
+34383335313933613930376436323236343539363035323461333366646462623961633933313432
+38656530653336306130313932393162626437383736393162656364333162623831356163303365
+66343433316131313332346537343863343966323765373035306661366633336261306661363966
+39326131336561633463613731396663336639613634636631373435623263353961323539623162
+30383831393164373632336265373662663936336131306563323833643236616338653835633832
+33383530623733386564373935663437613366633536386131363465363466306632373535646661
+62616531363737336536616132343034663038623665666636613232663666303164663661366232
+33626536336435323031663662383836326331633262386634393333373630343431333461393234
+33656664666466623262353533363833616663303637393164633633336438393131366261326230
+63623266353432613832633163663363663964303461386366373236386131376336623138366134
+33626234383661646637323062363265623630663061353630313466626632623062386638643433
+36333262666562396433393866393362303134616664616531386637336233306334383434616238
+62353237396432353335316631336265326135616430383735353638346339623539393064373365
+66336463653139323962333065666363363733376161613434363830663161303735306264396339
+35643535326130313033636135656634303731323030623131613866653932346665343365343537
+30393534346438343833336262646161643665613639373835336438663664643763323735646566
+30303339386131353863643463383333616432333262633962656434343563323165366533643730
+36646431336361316234393731373563656164646437636536353530343731373531373932313633
+61363462386663333465333465363864643039346238303635323362646335363037323437633462
+62373839666639326465383766333462356635636163376366373764373462386430616566386564
+39353662346632623661326238306136373364343231303664626630663761643433393033633335
+62336232376134656537383632643730303330353533626634633138383163356533646461656230
+31373733326436323937373537363839653034356137343864656364313831336235396530373265
+31663035326365373033313030363032343030346635343333656637343961303861393336316134
+35383635393737643935646334373865386637373636303162363562326239326433396466396435
+66336235373238326662323763333733636635313862653233353165346233313663353164383937
+37373934343261373462373832363633323438663536356133343464316563316362343932396234
+30343335396562336433353233306132656239663036663064653235376264653933363636326132
+33353064663930626330386562396564323965393432353430326362616235353464623861313336
+37363333623736306632643931356138373031363938363966616632666236346265323562306538
+39303365613463393964376536383431326661323237616538353333373930616438633630633961
+35303436353231373133666165306534346137396662653736343135303431613438363864616237
+65643338633065663266303232643264316564373066663038306632653962626336346639393061
+33326638323066323264353338636535336363376639646233336234643137646262666238363865
+34623236396437623539653466653331326434643036663930333065393836383265613036393233
+64333530636138356361643635613933313335636662646666656131613834376632313734373261
+66626262373630386337303539323332343831373731643830323661656435626266386633366666
+38626330663635623262336435373432383066393335633261383633343633616564353135613334
+34616663333562643232333133626433313265316561633638633236343334323337643066386363
+33316637303533393165656665373931313666616330316465643531303730333036613965383161
+65346133303835643134643030373966636632663937343434633263633161366236613039313866
+63343362303866313732326438393262643630633461316534313638343230653462636330363437
+36613561366235646465326163343165633764333466643766316235396534363366366238626161
+32656566386130623962643865643562623338353939306463663034653939383864356164316332
+34396661303364323430323764346438393165313430623464373436323337303966613437626136
+34303166396636666237383138636230306161323161343738353062383262373631643637366139
+36313033623162366530366130376338623634363661623965643364666330313066646233303963
+65353137616236396266336238346562343331363964356237356132303734326138646164663961
+62383761663837326431343939666432663132396464646439626364373833653164313931353631
+34633737333961646137663764363763356138396264353534303236633135643936313039303565
+37663937613961643563346130653536653236346165633333383666623961303138363961646138
+36613062346562326537656236343835383663386235353638653861613865333635333161326337
+66343664373262383164313838393261663566393838633364363931653164613663643966643063
+39656261643733663763383339653433616231653737623865353038646331373334666232346334
+39653730613439393532326430623239666239616361313738343738376536303839623938396439
+37393134343333383430303963356563633862336134373962306634613261653131636631626638
+35613635643336306435643832383761353465633537666563333763646338656164333661666462
+38643765313865626535326136343365643362373234326262366332653264363863646539366630
+36623635396635363636373139383530633332386263656339396433653936333834656631373637
+65663564353938623737303332373261623862646566386230313865643835323231373933303165
+39356561656534326661346636633933613532373137393737623737383134333132363436373630
+63653139356565356566663532313736613437623634313236663537376462383465613332656233
+65306131356165366131633432383730356163326561326332346535373738636333333165666365
+31636564303838333061323063653135623162636464656263613538306561303361633864383634
+35613164386334646338613661356134303766393239366530666137376362646263333530623565
+34643166313038376136643032393630303435376631336366343632383735626335333232303463
+33643363313434363633393964323064653966353161636135633264333766386266646366316132
+63303935356138356566306234356435343961356166646430633335386435366666333234636465
+36336439663731643663353732353261313037363231306430373962613838616238313662343761
+33316335316236626631636636386137376263323862306262316366663039396334326564303762
+34623562363839386439366639323662393831653530663463396230663133396466326363303065
+35646635323439323062333864336332333938663536373834663535643832316532313262326265
+63376436356662663165616532613963303030613166663865376531613031383865363864333238
+33616230336263306434643933356530303163653232323331643731353134353939363762303933
+32363061346537666637663733346431643164323364363133316265306336626466353366313635
+66653162643533316162363035373532656239356434623761666663626366663336376539656537
+31323561356363393038323762646633323461666263633937313264346364356439343761623337
+34643731393763323339653636656565663665646431313531616337616363373764626334656264
+66633366346137613032313865666363613530643663373834313731353437373239653332656134
+62376164313138303233623964663234643661336232366165616163313866336230353565393365
+36613361346437336431376164663930393530626339626361323764623635396137396634316364
+31393030323539376233383965366433623562646161643866346138316536613437383035656139
+6533

group_vars/all/secrets.yml.contents

@@ -0,0 +1,42 @@
+# These are the variables contained in secrets.yml
+# Secrets are usually 32 characters or more, matching [a-Z0-9]
+
+postgres_passwords:
+  fider: xxx
+  nextcloud: xxx
+  passit: xxx
+  gitea: xxx
+  matrix: xxx
+  codimd: xxx
+  mailu: xxx
+  ttrss: xxx
+  keycloak: xxx
+
+fider_jwt_secret: xxx
+
+ldap_admin_password: xxx
+ldap_config_password: xxx
+
+passit_secret_key: xxx
+
+docker_password: xxx
+
+mailu_secret_key: xxx
+
+drone_secrets:
+  oauth_client_id: xxx
+  oauth_client_secret: xxx
+  rpc_shared_secret: xxx
+
+restic_secrets:
+  user_secret: xxx
+  encryption_secret: xxx
+
+matrix_secrets:
+  registration_shared_secret: xxx
+  macaroon_secret_key: xxx
+  form_secret: xxx
+
+keycloak_secrets:
+  admin_user: xxx    //used for setting up the initial admin user on first run
+  admin_password: xxx

group_vars/all/vars.yml

@@ -21,11 +21,4 @@ users:
     groups:
       - sudo
 
-  deni:
-    comment: Denis Smajlović
-    key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC0pB42dtqruXr2Ha8Rdp3QoSrMOLU5cbLMfuNTNmgwPZmprhGGRTAsz8E0aG+5HCFBmW6JxiTGyHGdIZrhYWpKYshxxn4zODfitP7IzDgvg9Pz0Ugw/c5i5eKjkVfw9xLZKjO/H3Ql8R+wFMawpdw7j+Q9G+J3eIidEI6TmSvJVWijBxpLI4qrLceL084qg93XpJENYBOcvx9fYQQ+Es0jo4hmPuHWq5VIkIoIfvVvdhwjlaBsqv2je5BNx8uTMVIyV34ZHpJc95wJ6MOcqpQunW2bR4mGc9FLh67eP2ba9nDoQ0pnnlWGqAIKx5P1ELIg7RM3HhuwfRVh4DxCfjXpMz3l1gr1dA1wVD9bOtzbPWLjo7LNkRcT/loba/jpznTNIEv+kawmm/H0aTZZdlofkGHuX0iOpLV1c1tCDMH1s/MCqwosSRihrXhSOozsABvaaZpJiHcpE4DcNr+xJhe1XrHMqR30KU0r7ulIP8JdhzMNEsq3HxZQh9s8XLIUukrpcpOgJYyGuQK3kG6li5kYbmVqjLDQ1xHi/4r/4TXjJYpsFCZ71SURLzxoF1nauHpBLKcHI3MPFvqr27SQcM92fO14wKDAmAtHINwzMQjlda6B0jFNC+2xUfHrH7yIhwSktytq5qbhiFKK71DSLiMKFvOqoTVWRckO2+Zw1HZB+Q== deni@deni.dk
-    password: $6$ooKtdqASOxYJN2CJ$ziMrGG/qIOeyiTGjx.hPYjVBlHpzM9YY6qCJB9/L8aR33feUvXxZNBCgME93ZhbwDBjblS/tP796LsCF4i17D.
-    groups:
-      - sudo
-
 volume_root_folder: "/docker-volumes"

playbook.yml

@@ -27,7 +27,7 @@
       - ouroboros
       - mailu
       - portainer
-      - tt-rss
+#      - tt-rss
 
     smtp_host: "postfix"
     smtp_port: "587"

roles/docker/defaults/main.yml

@@ -12,6 +12,7 @@ thelounge:
 
 nextcloud:
   domain: "cloud.{{ base_domain }}"
+  volume_folder: "{{ volume_root_folder }}/nextcloud"
 
 gitea:
   domain: "git.{{ base_domain }}"
@@ -19,6 +20,7 @@ gitea:
 
 passit:
   domain: "passit.{{ base_domain }}"
+  volume_folder: "{{ volume_root_folder }}/passit"
 
 fider:
   domain: "feedback.{{ base_domain }}"
@@ -28,7 +30,9 @@ matrix:
   volume_folder: "{{ volume_root_folder }}/matrix"
 
 riot:
-  domain: "riot.{{ base_domain }}"
+  domains: 
+  - "riot.{{ base_domain }}"
+  - "element.{{ base_domain }}"
   volume_folder: "{{ volume_root_folder }}/riot"
 
 privatebin:
@@ -36,9 +40,13 @@ privatebin:
   volume_folder: "{{ volume_root_folder }}/privatebin"
 
 codimd:
-  domain: "pad.{{ base_domain }}"
+  domain: "oldpad.{{ base_domain }}"
   volume_folder: "{{ volume_root_folder }}/codimd"
 
+hedgedoc:
+  domain: "pad.{{ base_domain }}"
+  volume_folder: "{{ volume_root_folder }}/hedgedoc"
+
 netdata:
   domain: "netdata.{{ base_domain }}"
 
@@ -49,13 +57,25 @@ docker_registry:
   password: "{{ docker_password }}"
 
 data_coop_website:
-  domain: "{{ base_domain }},www.{{ base_domain }}"
+  domains: 
+  - "{{ base_domain }}"
+  - "www.{{ base_domain }}"
 
 cryptohagen_website:
-  domain: "cryptohagen.dk,www.cryptohagen.dk"
+  domains: 
+  - "cryptohagen.dk"
+  - "www.cryptohagen.dk"
 
 ulovliglogning_website:
-  domain: "ulovliglogning.dk,www.ulovliglogning.dk"
+  domains: 
+  - "ulovliglogning.dk"
+  - "www.ulovliglogning.dk"
+  - "ulovlig-logning.dk"
+
+cryptoaarhus_website:
+  domains: 
+  - "cryptoaarhus.dk"
+  - "www.cryptoaarhus.dk"
 
 drone:
   domain: "drone.{{ base_domain }}"
@@ -76,3 +96,6 @@ ttrss:
   domain: rss.{{ base_domain }}
   volume_folder: "{{ volume_root_folder }}/tt-rss"
 
+keycloak:
+  domain: sso.{{ base_domain }}
+  volume_folder: "{{ volume_root_folder }}/keycloak"

roles/docker/files/configs/matrix/homeserver.yaml.j2

@@ -54,6 +54,10 @@ soft_file_limit: 0
 # Set to false to disable presence tracking on this homeserver.
 use_presence: true
 
+# If set to 'false', forbids any other homeserver to fetch the server's public
+# rooms directory via federation.
+allow_public_rooms_over_federation: true
+
 # The GC threshold parameters to pass to `gc.set_threshold`, if defined
 #
 #gc_thresholds: [700, 10, 10]
@@ -411,7 +415,7 @@ uploads_path: "/data/uploads"
 
 # The largest allowed upload size in bytes
 #
-max_upload_size: "10M"
+max_upload_size: "50M"
 
 # Maximum number of pixels that will be thumbnailed
 #
@@ -573,7 +577,7 @@ turn_allow_guests: True
 ## Registration ##
 
 # Enable registration for new users.
-enable_registration: True
+enable_registration: False
 
 # The user must provide all of the below types of 3PID when registering.
 #
@@ -600,7 +604,7 @@ enable_registration: True
 # If set, allows registration by anyone who also has the shared
 # secret, even if registration is otherwise disabled.
 #
-registration_shared_secret: "jnJ5gfTj_qi#H0:vnPZx7OH*Qz.9u4cxpq.wHcHEAfuhcMgpxG"
+registration_shared_secret: "{{ matrix_secrets.registration_shared_secret }}"
 
 # Set the number of bcrypt rounds used to generate password hash.
 # Larger numbers increase the work factor needed to generate the hash.
@@ -695,7 +699,7 @@ track_appservice_user_ips: False
 # the registration_shared_secret is used, if one is given; otherwise,
 # a secret key is derived from the signing key.
 #
-macaroon_secret_key: "PLawJ8o.Q_.pR3Rr.vJO3=F&eAe=b~g6hVOKbrRrSl#w5Eqr8X"
+macaroon_secret_key: "{{ matrix_secrets.macaroon_secret_key }}"
 
 # Used to enable access token expiration.
 #
@@ -705,7 +709,7 @@ expire_access_token: False
 # falsification of values. Must be specified for the User Consent
 # forms to work.
 #
-form_secret: "ssHGS0,URi,oQ8~Upfi53meultXQ-Vo-r5XgKjP.u42qL;WGc-"
+form_secret: "{{ matrix_secrets.form_secret }}"
 
 ## Signing Keys ##
 

roles/docker/files/configs/matrix/vhost-matrix

@@ -1 +1,2 @@
-listen 8008;
+listen 8008;
+client_max_body_size 50M; # default is 1M

roles/docker/files/configs/matrix/vhost-riot

@@ -0,0 +1 @@
+client_max_body_size 50M; # default is 1M

roles/docker/files/configs/riot/config.json

@@ -1,7 +1,7 @@
 {
     "default_hs_url": "https://{{ matrix.domain }}",
     "default_is_url": "https://vector.im",
-    "brand": "riot.data.coop",
+    "brand": "element.data.coop",
     "integrations_ui_url": "https://scalar.vector.im/",
     "integrations_rest_url": "https://scalar.vector.im/api",
     "integrations_widgets_urls": [

roles/docker/files/sso/sso.data.coop.pem

@@ -0,0 +1 @@
+MIICszCCAZsCBgF8WpKKwTANBgkqhkiG9w0BAQsFADAdMRswGQYDVQQDDBJkYXRhLmNvb3Agc2VydmljZXMwHhcNMjExMDA3MTE0MzQ1WhcNMzExMDA3MTE0NTI1WjAdMRswGQYDVQQDDBJkYXRhLmNvb3Agc2VydmljZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCdV0stfU8aA1bi+GYd/a5DOyoox01BgzWwBFqVjlo80frsOsH8g814eDuMuff/UJy+2YxaozYQGxP+DcOVXi+0Fts9zjRj6wa6HCQqiR/SNUa69fGHcyAo2Tr0faxOyf3QMBqIngTRZB99quNMuAM96RCg25LtDaaWjNVxdHlj78+kU1bQXExp0ZfELlKGtllWP07cyz4nGfZmuK1AiWSsRbDIbyK5dvzw/pMS1kexh6ylnQu1iLqD3vYZBUDX9lPNkavTYZNCEL4ElUvR81S0ko2zkYAUiuVTtTUKucc98dTRhkuV4YCiiW6UQGY/jzmXYBfpzAY3n5eH5iUu/tRXAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFQc8ytexKiXOIGrSYYtFaF/lxv8AwMgsndv8YxJ+x/cUwN9tdmA8IAZDIS13qBrCOdZE4pJ/09VkYdErcpbtV7PWC3LDv/c2qakyiBUYZj4WgJio+oD0GCqXsby3aqJeVt9cJr4gSsXxn1c+7GV7p/gc/2FFmlWcqMN/2F7LvFvObu55QlppWZrn8kreaUQmRuTTIviFQRmvrmwKyK52LEcK7qoh/v1aHyYDl91gu3nLMEluz6hy3UEPYgpdH1t2C7K0Kjri25pJNGCFrpKjWWveteKazUeDd4adHMiw2MVfeEyTCXEFoaxQS9QmbmhSMRhiHjbdffL7xi//aSh1bo=

roles/docker/tasks/services.yml

@@ -3,14 +3,6 @@
   docker_network:
     name: external_services
 
-- name: setup network for postfix
-  docker_network:
-    name: postfix
-    ipam_options:
-      subnet: '172.16.0.0/16'
-      gateway: 172.16.0.1
-
-
 - name: setup services
   include_tasks: "services/{{ item }}.yml"
   with_items: "{{ services }}"

roles/docker/tasks/services/drone.yml

@@ -1,21 +1,51 @@
 ---
-- name: Drone container
-  docker_container:
-    name: drone
-    image: drone/drone:latest
-    restart_policy: unless-stopped
-    networks:
-      - name: external_services
-    volumes:
-      - "{{ drone.volume_folder }}:/data"
-      - "/var/run/docker.sock:/var/run/docker.sock"
-    env:
-      DRONE_GITEA_SERVER: "https://{{ gitea.domain }}"
-      DRONE_GITEA_ALWAYS_AUTH: "False"
-      DRONE_RUNNER_CAPACITY: "2"
-      DRONE_SERVER_HOST: "{{ drone.domain }}"
-      DRONE_SERVER_PROTO: "https"
-      PLUGIN_CUSTOM_DNS: "91.239.100.100"
-      VIRTUAL_HOST: "{{ drone.domain }}"
-      LETSENCRYPT_HOST: "{{ drone.domain }}"
-      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
+- name: set up drone with docker runner
+  docker_compose:
+    project_name: drone
+    pull: yes
+    definition:
+      version: "3.6"
+      services:
+        drone:
+          container_name: "drone"
+          image: drone/drone:1
+          restart: unless-stopped
+          networks:
+            - external_services
+            - drone
+          volumes:
+            - "{{ drone.volume_folder }}:/data"
+            - "/var/run/docker.sock:/var/run/docker.sock"
+          environment:
+            DRONE_GITEA_SERVER: "https://{{ gitea.domain }}"
+            DRONE_GITEA_CLIENT_ID: "{{ drone_secrets.oauth_client_id }}"
+            DRONE_GITEA_CLIENT_SECRET: "{{ drone_secrets.oauth_client_secret }}"
+            DRONE_GIT_ALWAYS_AUTH: "true"
+            DRONE_SERVER_HOST: "{{ drone.domain }}"
+            DRONE_SERVER_PROTO: "https"
+            DRONE_RPC_SECRET: "{{ drone_secrets.rpc_shared_secret }}"
+            PLUGIN_CUSTOM_DNS: "91.239.100.100"
+            VIRTUAL_HOST: "{{ drone.domain }}"
+            LETSENCRYPT_HOST: "{{ drone.domain }}"
+            LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
+
+        drone-runner-docker:
+          container_name: "drone-runner-docker"
+          image: "drone/drone-runner-docker:1"
+          restart: unless-stopped
+          networks:
+            - drone
+          volumes:
+            - "/var/run/docker.sock:/var/run/docker.sock"
+          environment:
+            DRONE_RPC_HOST: "{{ drone.domain }}"
+            DRONE_RPC_PROTO: "https"
+            DRONE_RPC_SECRET: "{{ drone_secrets.rpc_shared_secret }}"
+            DRONE_RUNNER_CAPACITY: 2
+            DRONE_RUNNER_NAME: "data.coop_drone_runner"
+
+      networks:
+        drone:
+        external_services:
+          external:
+            name: external_services

roles/docker/tasks/services/gitea.yml

@@ -1,9 +1,13 @@
 ---
+- name: gitea network
+  docker_network:
+    name: gitea
+
 # old DNS: 138.68.71.153
 - name: gitea container
   docker_container:
     name: gitea
-    image: gitea/gitea:1.11.1
+    image: gitea/gitea:1.15.7
     restart_policy: unless-stopped
     networks:
       - name: gitea

roles/docker/tasks/services/hedgedoc.yml

@@ -0,0 +1,66 @@
+---
+- name: create hedgedoc volume folders
+  file:
+    name: "{{ hedgedoc.volume_folder }}/{{ volume }}"
+    state: directory
+  loop:
+    - "db"
+    - "hedgedoc/uploads"
+  loop_control:
+    loop_var: volume
+
+- name: copy sso public certificate
+  copy:
+    src: "files/sso/sso.data.coop.pem"
+    dest: "{{ hedgedoc.volume_folder }}/sso.data.coop.pem"
+    mode: "0644"
+
+- name: setup hedgedoc
+  docker_compose:
+    project_name: "hedgedoc"
+    pull: "yes"
+    definition:
+      services:
+        database:
+          image: "postgres:10-alpine"
+          environment:
+            POSTGRES_USER: "codimd"
+            POSTGRES_PASSWORD: "{{ postgres_passwords.hedgedoc }}"
+            POSTGRES_DB: "codimd"
+          restart: "unless-stopped"
+          networks:
+            - "hedgedoc"
+          volumes:
+            - "{{ hedgedoc.volume_folder }}/db:/var/lib/postgresql/data"
+        
+        app:
+          image: quay.io/hedgedoc/hedgedoc:1.9.0
+          environment:
+            CMD_DB_URL: "postgres://codimd:{{ postgres_passwords.hedgedoc }}@hedgedoc_database_1:5432/codimd"
+            CMD_DOMAIN: "{{ hedgedoc.domain }}"
+            CMD_ALLOW_EMAIL_REGISTER: "False"
+            CMD_IMAGE_UPLOAD_TYPE: "filesystem"
+            CMD_EMAIL: "False"
+            CMD_SAML_IDPCERT: "/sso.data.coop.pem"
+            CMD_SAML_IDPSSOURL: "https://sso.data.coop/auth/realms/datacoop/protocol/saml"
+            CMD_SAML_ISSUER: "hedgedoc"
+            CMD_SAML_IDENTIFIERFORMAT: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
+            CMD_USECDN: "false"
+            CMD_PROTOCOL_USESSL: "true"
+            VIRTUAL_HOST: "{{ hedgedoc.domain }}"
+            LETSENCRYPT_HOST: "{{ hedgedoc.domain }}"
+            LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
+          volumes:
+            - "{{ hedgedoc.volume_folder }}/hedgedoc/uploads:/hedgedoc/public/uploads"
+            - "{{ hedgedoc.volume_folder }}/sso.data.coop.pem:/sso.data.coop.pem"
+          restart: "unless-stopped"
+          networks: 
+            - "hedgedoc"
+            - "external_services"
+          depends_on:
+            - database
+
+      networks: 
+        hedgedoc:
+        external_services:
+          external: true

roles/docker/tasks/services/keycloak.yml

@@ -0,0 +1,45 @@
+- name: setup keycloak containers for sso.data.coop
+  docker_compose:
+    project_name: "keycloak"
+    pull: "yes"
+    definition:
+      version: "3.6"
+      services:
+
+        postgres:
+          image: "postgres:10"
+          restart: "unless-stopped"
+          networks:
+            - "keycloak"
+          volumes:
+            - "{{ keycloak.volume_folder }}/data:/var/lib/postgresql/data"
+          environment:
+            POSTGRES_USER: "keycloak"
+            POSTGRES_PASSWORD: "{{ postgres_passwords.keycloak }}"
+            POSTGRES_DB: "keycloak"
+
+        app:
+          image: "quay.io/keycloak/keycloak:15.0.2"
+          restart: "unless-stopped"
+          networks:
+            - "keycloak"
+            - "postfix"
+            - "external_services"
+          environment:
+            VIRTUAL_HOST: "{{ keycloak.domain }}"
+            VIRTUAL_PORT: "8080"
+            LETSENCRYPT_HOST: "{{ keycloak.domain }}"
+            LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
+            DB_USER: "keycloak"
+            DB_PASSWORD: "{{ postgres_passwords.keycloak }}"
+            DB_ADDR: "keycloak_postgres_1"
+            #KEYCLOAK_USER: "{{ keycloak_secrets.admin_user }}" # Only used for the first run of the application to set up the admin user
+            #KEYCLOAK_PASSWORD: "{{ keycloak_secrets.admin_password }}"
+            PROXY_ADDRESS_FORWARDING: "true"
+             
+      networks:
+        keycloak:
+        postfix:
+          external: true
+        external_services:
+          external: true

roles/docker/tasks/services/mailu.yml

@@ -38,7 +38,7 @@
     force: yes
 
 - name: run mail server containers
-  docker_service:
+  docker_compose:
     project_name: mail_server
     pull: yes
     definition:

roles/docker/tasks/services/matrix_riot.yml

@@ -46,9 +46,14 @@
     src: files/configs/matrix/vhost-matrix
     dest: "{{ nginx.volume_folder }}/vhost/{{ matrix.domain }}"
 
+- name: upload vhost config for riot domain
+  template:
+    src: files/configs/matrix/vhost-riot
+    dest: "{{ nginx.volume_folder }}/vhost/{{ riot.domains[0] }}"
+
 - name: upload homeserver.yaml
   template:
-    src: "files/configs/matrix/homeserver.yaml"
+    src: "files/configs/matrix/homeserver.yaml.j2"
     dest: "{{ matrix.volume_folder }}/data/homeserver.yaml"
 
 - name: upload matrix logging config
@@ -57,7 +62,7 @@
     dest: "{{ matrix.volume_folder }}/data/matrix.data.coop.log.config"
 
 - name: set up matrix and riot
-  docker_service:
+  docker_compose:
     project_name: matrix
     pull: yes
     definition:
@@ -77,7 +82,7 @@
 
         matrix_app:
           container_name: matrix
-          image: matrixdotorg/synapse:v1.11.0
+          image: matrixdotorg/synapse:v1.47.1
           restart: unless-stopped
           networks:
             - matrix
@@ -97,7 +102,7 @@
 
         riot:
           container_name: riot_app
-          image: avhost/docker-matrix-riot:v1.5.10
+          image: avhost/docker-matrix-riot:v1.9.0
           restart: unless-stopped
           networks:
             - matrix
@@ -107,9 +112,9 @@
           volumes:
             - "{{ riot.volume_folder }}/data:/data"
           environment:
-            VIRTUAL_HOST: "{{ riot.domain }}"
+            VIRTUAL_HOST: "{{ riot.domains|join(',') }}"
             VIRTUAL_PORT: "8080"
-            LETSENCRYPT_HOST: "{{ riot.domain }}"
+            LETSENCRYPT_HOST: "{{ riot.domains|join(',') }}"
             LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 
       networks:

roles/docker/tasks/services/nextcloud.yml

@@ -1,48 +1,42 @@
 ---
+- name: setup nextcloud containers
+  docker_compose:
+    project_name: "nextcloud"
+    pull: "yes"
+    definition:
+      services:
+        postgres:
+          image: "postgres:10"
+          restart: "unless-stopped"
+          networks:
+            - "nextcloud"
+          volumes:
+            - "{{ nextcloud.volume_folder }}/postgres:/var/lib/postgresql/data"
+          environment: 
+            POSTGRES_DB: "nextcloud"
+            POSTGRES_PASSWORD: "{{ postgres_passwords.nextcloud }}"
+            POSTGRES_USER: "nextcloud"
+        
+        app:
+          image: "nextcloud:22-apache"
+          restart: "unless-stopped"
+          networks:
+            - "nextcloud"
+            - "external_services"
+          volumes:
+          - "{{ nextcloud.volume_folder }}/app:/var/www/html"
+          environment:
+            VIRTUAL_HOST: "{{ nextcloud.domain }}"
+            LETSENCRYPT_HOST: "{{ nextcloud.domain }}"
+            LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
+            POSTGRES_HOST: "nextcloud_postgres_1"
+            POSTGRES_DB: "nextcloud"
+            POSTGRES_USER: "nextcloud"
+            POSTGRES_PASSWORD: "{{ postgres_passwords.nextcloud }}"
 
-- name: nextcloud network
-  docker_network:
-    name: nextcloud
-
-- name: nextcloud database volume
-  docker_volume:
-    name: nextcloud_db
-
-- name: nextcloud database container
-  docker_container:
-    name: nextcloud_db
-    image: postgres:10
-    state: started
-    restart_policy: always
-    networks:
-      - name: nextcloud
-    volumes:
-      - nextcloud_db:/var/lib/postgresql/data
-    env:
-      POSTGRES_DB: somethingelse
-      POSTGRES_USER: nextcloud
-      POSTGRES_PASSWORD: "{{ postgres_passwords.nextcloud }}"
-
-- name: nextcloud app volume
-  docker_volume:
-    name: nextcloud_app
-
-- name: nextcloud app container
-  docker_container:
-    name: nextcloud_app
-    image: nextcloud:apache
-    state: started
-    restart_policy: always
-    networks:
-      - name: nextcloud
-      - name: external_services
-    volumes:
-      - nextcloud_app:/var/www/html
-    env:
-      VIRTUAL_HOST: "{{ nextcloud.domain }}"
-      LETSENCRYPT_HOST: "{{ nextcloud.domain }}"
-      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
-      POSTGRES_HOST: nextcloud_db
-      POSTGRES_DB: nextcloud
-      POSTGRES_USER: nextcloud
-      POSTGRES_PASSWORD: "{{ postgres_passwords.nextcloud }}"
+      networks:
+          nextcloud:
+          postfix:
+            external: true
+          external_services:
+            external: true

roles/docker/tasks/services/openldap.yml

@@ -17,7 +17,7 @@
 - name: openLDAP container
   docker_container:
     name: openldap
-    image: osixia/openldap:1.2.2
+    image: osixia/openldap:1.5.0
     tty: true
     interactive: true
     volumes:
@@ -57,7 +57,7 @@
 - name: phpLDAPadmin container
   docker_container:
     name: phpldapadmin
-    image: osixia/phpldapadmin:latest
+    image: osixia/phpldapadmin:0.9.0
     networks:
       - name: external_services
       - name: ldap

roles/docker/tasks/services/ouroboros.yml

@@ -14,5 +14,5 @@
       LABELS_ONLY: "true"
       CLEANUP: "true"
       LATEST: "true"
-      CRON: "*/1 * * * *"
+      CRON: "*/10 * * * *"
       

roles/docker/tasks/services/passit.yml

@@ -1,45 +1,47 @@
 ---
 
-- name: passit network
-  docker_network:
-    name: passit
+- name: setup passit containers
+  docker_compose:
+    project_name: "passit"
+    pull: "yes"
+    definition:
+      version: "3.6"
+      services:
 
-- name: passit database volume
-  docker_volume:
-    name: passit_db
+        passit_db:
+          image: "postgres:10"
+          restart: "always"
+          networks:
+            - "passit"
+          volumes:
+            - "{{ passit.volume_folder }}/data:/var/lib/postgresql/data"
+          environment:
+            POSTGRES_USER: "passit"
+            POSTGRES_PASSWORD: "{{ postgres_passwords.passit }}"
 
-- name: passit database container
-  docker_container:
-    name: passit_db
-    image: postgres:10
-    state: started
-    restart_policy: always
-    networks:
-      - name: passit
-    volumes:
-      - passit_db:/var/lib/postgresql/data
-    env:
-      POSTGRES_USER: passit
-      POSTGRES_PASSWORD: "{{ postgres_passwords.passit }}"
+        passit_app:
+          image: "passit/passit:stable"
+          command: "bin/start.sh"
+          restart: "always"
+          networks:
+            - "passit"
+            - "postfix"
+            - "external_services"
+          environment:
+            DATABASE_URL: "postgres://passit:{{ postgres_passwords.passit }}@passit_db:5432/passit"
+            SECRET_KEY: "{{ passit_secret_key }}"
+            IS_DEBUG: 'False'
+            EMAIL_URL: "smtp://noop@{{ smtp_host }}:{{ smtp_port }}"
+            DEFAULT_FROM_EMAIL: "noreply@{{ passit.domain }}"
+            EMAIL_CONFIRMATION_HOST: "https://{{ passit.domain }}"
 
-- name: passit app container
-  docker_container:
-    name: passit
-    image: passit/passit:stable
-    command: bin/start.sh
-    restart_policy: always
-    networks:
-      - name: passit
-      - name: postfix
-      - name: external_services
-    env:
-      DATABASE_URL: "postgres://passit:{{ postgres_passwords.passit }}@passit_db:5432/passit"
-      SECRET_KEY: "{{ passit_secret_key }}"
-      IS_DEBUG: 'False'
-      EMAIL_URL: smtp://noop@{{ smtp_host }}:{{ smtp_port }}
-      DEFAULT_FROM_EMAIL: "noreply@{{ passit.domain }}"
-      EMAIL_CONFIRMATION_HOST: "https://{{ passit.domain }}"
+            VIRTUAL_HOST: "{{ passit.domain }}"
+            LETSENCRYPT_HOST: "{{ passit.domain }}"
+            LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 
-      VIRTUAL_HOST: "{{ passit.domain }}"
-      LETSENCRYPT_HOST: "{{ passit.domain }}"
-      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
+      networks:
+        passit:
+        postfix:
+          external: true
+        external_services:
+          external: true

roles/docker/tasks/services/portainer.yml

@@ -8,7 +8,7 @@
 - name: run portainer
   docker_container:
     name: portainer
-    image: portainer/portainer:1.23.1
+    image: portainer/portainer-ce:2.9.1
     restart_policy: always
     networks:
       - name: external_services
@@ -19,5 +19,6 @@
       - 9001:9000
     env:
       VIRTUAL_HOST: "{{ portainer.domain }}"
+      VIRTUAL_PORT: "9000"
       LETSENCRYPT_HOST: "{{ portainer.domain }}"
       LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"

roles/docker/tasks/services/postfix.yml

@@ -1,5 +1,12 @@
 ---
 
+- name: setup network for postfix
+  docker_network:
+    name: postfix
+    ipam_config:
+      - subnet: '172.16.0.0/16'
+        gateway: 172.16.0.1
+
 - name: setup postfix docker container for outgoing mail
   docker_container:
     name: postfix
@@ -8,5 +15,5 @@
     networks:
       - name: postfix
     env:
-      ALLOWED_SENDER_DOMAINS: "{{ base_domain }}"
+      ALLOWED_SENDER_DOMAINS: "services.{{ base_domain }}"
 

roles/docker/tasks/services/restic-backup.yml

@@ -0,0 +1,38 @@
+---
+- name: setup restic backup
+  docker_compose:
+    project_name: restic_backup
+    pull: yes
+    definition:
+      version: '3.6'
+      services:
+        restic-backup:
+          image: mazzolino/restic
+          restart: always
+          environment:
+            RUN_ON_STARTUP: "true"
+            BACKUP_CRON: "0 30 3 * * *"
+            RESTIC_REPOSITORY: "rest:https://datacoop:{{ restic_secrets.user_secret }}@restic.graffen.io/datacoop-hevonen" 
+            RESTIC_PASSWORD: "{{ restic_secrets.encryption_secret }}"
+            RESTIC_BACKUP_SOURCES: "/mnt/volumes"
+            RESTIC_BACKUP_ARGS: >-
+              --tag datacoop-volumes
+              --exclude='*.tmp'
+              --verbose
+            RESTIC_FORGET_ARGS: >-
+              --keep-last 10
+              --keep-daily 7
+              --keep-weekly 5
+              --keep-monthly 12
+            TZ: Europe/Copenhagen
+          volumes:
+            - /docker-volumes:/mnt/volumes:ro
+        
+        restic-prune:
+          image: "mazzolino/restic"
+          environment:
+            RUN_ON_STARTUP: "true"
+            PRUNE_CRON: "0 0 4 * * *"
+            RESTIC_REPOSITORY: "rest:https://datacoop:{{ restic_secrets.user_secret }}@restic.graffen.io/datacoop-hevonen"
+            RESTIC_PASSWORD: "{{ restic_secrets.encryption_secret }}"
+            TZ: Europe/copenhagen

roles/docker/tasks/services/tt-rss.yml

@@ -10,7 +10,7 @@
     loop_var: volume
 
 - name: "set up tt-rss"
-  docker_service:
+  docker_compose:
     project_name: "tt-rss"
     pull: yes
     definition:

roles/docker/tasks/services/ulovliglogning-dk.yml

@@ -6,8 +6,8 @@
     networks:
       - name: external_services
     env:
-      VIRTUAL_HOST: "{{ ulovliglogning_website.domain }}"
-      LETSENCRYPT_HOST: "{{ ulovliglogning_website.domain }}"
+      VIRTUAL_HOST: "{{ ulovliglogning_website.domains|join(',') }}"
+      LETSENCRYPT_HOST: "{{ ulovliglogning_website.domains|join(',') }}"
       LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
     labels:
       com.ouroboros.enable: "true"

roles/docker/tasks/services/websites.yml

@@ -8,11 +8,25 @@
     networks:
       - name: external_services
     env:
-      VIRTUAL_HOST : "{{ data_coop_website.domain }}"
-      LETSENCRYPT_HOST: "{{ data_coop_website.domain }}"
+      VIRTUAL_HOST : "{{ data_coop_website.domains|join(',') }}"
+      LETSENCRYPT_HOST: "{{ data_coop_website.domains|join(',') }}"
       LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
     labels:
-      com.ouroboros.enable: "true"    
+      com.ouroboros.enable: "true"
+
+- name: setup new data.coop website using hugo
+  docker_container:
+    name: new.data.coop_website
+    image: docker.data.coop/data-coop-website:hugo
+    restart_policy: unless-stopped
+    networks:
+      - name: external_services
+    env:
+      VIRTUAL_HOST : "new.{{ data_coop_website.domains|join(',') }}"
+      LETSENCRYPT_HOST: "new.{{ data_coop_website.domains|join(',') }}"
+      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
+    labels:
+      com.ouroboros.enable: "true"
 
 - name: setup cryptohagen.dk website docker container
   docker_container:
@@ -22,8 +36,22 @@
     networks:
       - name: external_services
     env:
-      VIRTUAL_HOST : "{{ cryptohagen_website.domain }}"
-      LETSENCRYPT_HOST: "{{ cryptohagen_website.domain }}"
+      VIRTUAL_HOST : "{{ cryptohagen_website.domains|join(',') }}"
+      LETSENCRYPT_HOST: "{{ cryptohagen_website.domains|join(',') }}"
       LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
     labels:
       com.ouroboros.enable: "true"  
+
+- name: setup cryptoaarhus.dk website docker container
+  docker_container:
+    name: cryptoaarhus_website
+    restart_policy: unless-stopped
+    image: docker.data.coop/cryptoaarhus-website
+    networks:
+      - name: external_services
+    env:
+      VIRTUAL_HOST : "{{ cryptoaarhus_website.domains|join(',') }}"
+      LETSENCRYPT_HOST: "{{ cryptoaarhus_website.domains|join(',') }}"
+      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
+    labels:
+      com.ouroboros.enable: "true"

roles/ubuntu_base/tasks/base.yml

@@ -1,5 +1,5 @@
 ---
-- name: Install necessary packages
+- name: Install necessary packages via apt
   apt:
     name: "{{ packages }}"
   vars:
@@ -8,4 +8,11 @@
     - python3-pip
     - apparmor
     - haveged
-    
+
+- name: Install necessary packages via pip
+  pip:
+    name: "{{ packages }}"
+  vars:
+    packages:
+      - docker
+      - docker-compose