From d15e7e562fb4dc295aab5d9c1238f573d7d5fa7a Mon Sep 17 00:00:00 2001 From: valberg Date: Sat, 26 Nov 2022 08:15:18 +0000 Subject: [PATCH] Collect versions and service information in docker/defaults/main.yml (#125) --- .ansible-lint | 111 +++++++++ .gitignore | 2 + .pre-commit-config.yaml | 14 ++ Makefile | 12 + deploy.sh | 11 +- playbook.yml | 25 -- roles/docker/defaults/main.yml | 235 +++++++++++------- .../docker/files/configs/mastodon/env_file.j2 | 4 +- .../files/configs/matrix/homeserver.yaml.j2 | 2 +- roles/docker/files/configs/rallly/env_file.j2 | 4 +- roles/docker/files/configs/riot/config.json | 4 +- roles/docker/files/configs/thelounge.js | 2 +- roles/docker/tasks/services.yml | 14 +- .../docker/tasks/services/docker_registry.yml | 18 +- roles/docker/tasks/services/drone.yml | 14 +- roles/docker/tasks/services/gitea.yml | 10 +- roles/docker/tasks/services/hedgedoc.yml | 18 +- roles/docker/tasks/services/keycloak.yml | 10 +- roles/docker/tasks/services/mailu.yml | 84 +++---- roles/docker/tasks/services/mastodon.yml | 36 ++- roles/docker/tasks/services/matrix_riot.yml | 40 +-- roles/docker/tasks/services/membersystem.yml | 12 +- roles/docker/tasks/services/netdata.yml | 6 +- roles/docker/tasks/services/nextcloud.yml | 16 +- roles/docker/tasks/services/nginx-proxy.yml | 48 ---- roles/docker/tasks/services/nginx_proxy.yml | 48 ++++ roles/docker/tasks/services/openldap.yml | 20 +- roles/docker/tasks/services/passit.yml | 14 +- roles/docker/tasks/services/portainer.yml | 10 +- roles/docker/tasks/services/postfix.yml | 5 +- roles/docker/tasks/services/privatebin.yml | 14 +- roles/docker/tasks/services/rallly.yml | 14 +- .../{restic-backup.yml => restic_backup.yml} | 9 +- roles/docker/tasks/services/watchtower.yml | 2 +- roles/docker/tasks/services/websites.yml | 100 -------- .../websites/2022.slides.data.coop.yml | 23 ++ .../services/websites/cryptoaarhus.dk.yml | 15 ++ .../services/websites/cryptohagen.dk.yml | 15 ++ .../tasks/services/websites/data.coop.yml | 15 ++ .../services/websites/new-new.data.coop.yml | 21 ++ .../tasks/services/websites/new.data.coop.yml | 15 ++ .../ulovliglogning.dk.yml} | 4 +- roles/docker/templates/mailu.env.j2 | 2 +- roles/ubuntu_base/tasks/users.yml | 4 +- vagrant_host | 1 + 45 files changed, 641 insertions(+), 462 deletions(-) create mode 100644 .ansible-lint create mode 100644 .pre-commit-config.yaml create mode 100644 Makefile delete mode 100644 roles/docker/tasks/services/nginx-proxy.yml create mode 100644 roles/docker/tasks/services/nginx_proxy.yml rename roles/docker/tasks/services/{restic-backup.yml => restic_backup.yml} (68%) delete mode 100644 roles/docker/tasks/services/websites.yml create mode 100644 roles/docker/tasks/services/websites/2022.slides.data.coop.yml create mode 100644 roles/docker/tasks/services/websites/cryptoaarhus.dk.yml create mode 100644 roles/docker/tasks/services/websites/cryptohagen.dk.yml create mode 100644 roles/docker/tasks/services/websites/data.coop.yml create mode 100644 roles/docker/tasks/services/websites/new-new.data.coop.yml create mode 100644 roles/docker/tasks/services/websites/new.data.coop.yml rename roles/docker/tasks/services/{ulovliglogning-dk.yml => websites/ulovliglogning.dk.yml} (69%) create mode 100644 vagrant_host diff --git a/.ansible-lint b/.ansible-lint new file mode 100644 index 00000000..03e5b4fe --- /dev/null +++ b/.ansible-lint @@ -0,0 +1,111 @@ +--- +# .ansible-lint + +profile: null # min, basic, moderate,safety, shared, production + +# exclude_paths included in this file are parsed relative to this file's location +# and not relative to the CWD of execution. CLI arguments passed to the --exclude +# option are parsed relative to the CWD of execution. +exclude_paths: + - .cache/ # implicit unless exclude_paths is defined in config + - .github/ + - test/fixtures/formatting-before/ + - test/fixtures/formatting-prettier/ +# parseable: true +# quiet: true +# strict: true +# verbosity: 1 + +# Mock modules or roles in order to pass ansible-playbook --syntax-check +mock_modules: + - zuul_return + # note the foo.bar is invalid as being neither a module or a collection + - fake_namespace.fake_collection.fake_module + - fake_namespace.fake_collection.fake_module.fake_submodule +mock_roles: + - mocked_role + - author.role_name # old standalone galaxy role + - fake_namespace.fake_collection.fake_role # role within a collection + +# Enable checking of loop variable prefixes in roles +loop_var_prefix: "{role}_" + +# Enforce variable names to follow pattern below, in addition to Ansible own +# requirements, like avoiding python identifiers. To disable add `var-naming` +# to skip_list. +# var_naming_pattern: "^[a-z_][a-z0-9_]*$" + +use_default_rules: true +# Load custom rules from this specific folder +# rulesdir: +# - ./rule/directory/ + +# Ansible-lint completely ignores rules or tags listed below +skip_list: + - skip_this_tag + +# Ansible-lint does not automatically load rules that have the 'opt-in' tag. +# You must enable opt-in rules by listing each rule 'id' below. +enable_list: + - empty-string-compare # opt-in + - no-log-password # opt-in + - no-same-owner # opt-in + # add yaml here if you want to avoid ignoring yaml checks when yamllint + # library is missing. Normally its absence just skips using that rule. + - yaml +# Report only a subset of tags and fully ignore any others +# tags: +# - jinja[spacing] + +# Ansible-lint does not fail on warnings from the rules or tags listed below +warn_list: + - skip_this_tag + - experimental # experimental is included in the implicit list + # - role-name + # - yaml[document-start] # you can also use sub-rule matches + +# Some rules can transform files to fix (or make it easier to fix) identified +# errors. `ansible-lint --write` will reformat YAML files and run these transforms. +# By default it will run all transforms (effectively `write_list: ["all"]`). +# You can disable running transforms by setting `write_list: ["none"]`. +# Or only enable a subset of rule transforms by listing rules/tags here. +# write_list: +# - all + +# Offline mode disables installation of requirements.yml +offline: false + +# Return success if number of violations compared with previous git +# commit has not increased. This feature works only in git +# repositories. +progressive: false + +# Define required Ansible's variables to satisfy syntax check +extra_vars: + foo: bar + multiline_string_variable: | + line1 + line2 + complex_variable: ":{;\t$()" + +# Uncomment to enforce action validation with tasks, usually is not +# needed as Ansible syntax check also covers it. +# skip_action_validation: false + +# List of additional kind:pattern to be added at the top of the default +# match list, first match determines the file kind. +kinds: + # - playbook: "**/examples/*.{yml,yaml}" + # - galaxy: "**/folder/galaxy.yml" + # - tasks: "**/tasks/*.yml" + # - vars: "**/vars/*.yml" + # - meta: "**/meta/main.yml" + - yaml: "**/*.yaml-too" + +# List of additional collections to allow in only-builtins rule. +# only_builtins_allow_collections: +# - example_ns.example_collection + +# List of additions modules to allow in only-builtins rule. +# only_builtins_allow_modules: +# - example_module \ No newline at end of file diff --git a/.gitignore b/.gitignore index 9e0226e2..6a544c34 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,5 @@ playbook.retry *.sw* .vagrant/ *.log +.idea/ +venv/ diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 00000000..6b4fbd39 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,14 @@ +repos: + +#- repo: https://github.com/semaphor-dk/dansabel +# rev: b72c70351d1a9e32a75db505fcb3aa414f3282f8 +# hooks: +# - id: dansabel + +- repo: https://github.com/ansible/ansible-lint + rev: v6.9.0 + hooks: + - id: ansible-lint + files: \.(yaml|yml)$ + additional_dependencies: + - ansible diff --git a/Makefile b/Makefile new file mode 100644 index 00000000..4c47f67f --- /dev/null +++ b/Makefile @@ -0,0 +1,12 @@ +init: create_venv install_pre_commit install_ansible_galaxy_modules + +create_venv: + python3 -m venv venv + venv/bin/pip install -U pip + venv/bin/pip install ansible pre-commit + +install_pre_commit: + venv/bin/pre-commit install + +install_ansible_galaxy_modules: + venv/bin/ansible-galaxy collection install community.general \ No newline at end of file diff --git a/deploy.sh b/deploy.sh index 70095a1f..83da6e8d 100755 --- a/deploy.sh +++ b/deploy.sh @@ -2,8 +2,13 @@ BASE_CMD="ansible-playbook playbook.yml --ask-vault-pass" +if [ "$1" = "--vagrant" ]; then + BASE_CMD="$BASE_CMD --inventory=vagrant_host" + shift +fi + if [ -z "$(ansible-galaxy collection list community.general 2>/dev/null)" ]; then - echo "Installing community modules" + echo "Installing community.general modules" ansible-galaxy collection install community.general fi @@ -17,8 +22,8 @@ else echo "Deploying all services!" $BASE_CMD --tags setup_services else - echo "Deploying services: $2" - $BASE_CMD --tags setup_services --extra-vars "services=$2" + echo "Deploying service: $2" + $BASE_CMD --tags setup_services --extra-vars "single_service=$2" fi ;; "base") diff --git a/playbook.yml b/playbook.yml index 66068c25..1ce47fbb 100644 --- a/playbook.yml +++ b/playbook.yml @@ -10,31 +10,6 @@ vagrant: "{{ ansible_virtualization_role == 'guest' }}" letsencrypt_enabled: "{{ not vagrant }}" - services: - - nginx-proxy - - postfix - - openldap - - keycloak - - restic-backup - - nextcloud - - passit - - gitea - - matrix_riot - - privatebin - - codimd - - hedgedoc - - netdata - - docker_registry - - drone - - websites - - ulovliglogning-dk - - watchtower - - mailu - - portainer - - mastodon - - rallly - - membersystem - smtp_host: "postfix" smtp_port: "587" diff --git a/roles/docker/defaults/main.yml b/roles/docker/defaults/main.yml index e890544d..2a239503 100644 --- a/roles/docker/defaults/main.yml +++ b/roles/docker/defaults/main.yml @@ -1,122 +1,169 @@ --- volume_root_folder: "/docker-volumes" -nginx: - volume_folder: "{{ volume_root_folder }}/nginx" +services: -ldap: - domain: "ldap.{{ base_domain }}" - volume_folder: "{{ volume_root_folder }}/openldap" + ### Internal services ### + postfix: + file: postfix.yml + version: "v3.5.0" -nextcloud: - domain: "cloud.{{ base_domain }}" - volume_folder: "{{ volume_root_folder }}/nextcloud" + nginx_proxy: + file: nginx_proxy.yml + version: "1.0-alpine" + volume_folder: "{{ volume_root_folder }}/nginx" -gitea: - domain: "git.{{ base_domain }}" - volume_folder: "{{ volume_root_folder }}/gitea" + nginx_acme_companion: + version: "2.2" -passit: - domain: "passit.{{ base_domain }}" - volume_folder: "{{ volume_root_folder }}/passit" + openldap: + file: openldap.yml + domain: "ldap.{{ base_domain }}" + volume_folder: "{{ volume_root_folder }}/openldap" + version: "1.5.0" -matrix: - domain: "matrix.{{ base_domain }}" - volume_folder: "{{ volume_root_folder }}/matrix" + phpldapadmin: + version: "0.9.0" -riot: - domains: - - "riot.{{ base_domain }}" - - "element.{{ base_domain }}" - volume_folder: "{{ volume_root_folder }}/riot" + netdata: + file: netdata.yml + domain: "netdata.{{ base_domain }}" + version: "v1" -privatebin: - domain: "paste.{{ base_domain }}" - volume_folder: "{{ volume_root_folder }}/privatebin" + portainer: + file: portainer.yml + domain: "portainer.{{ base_domain }}" + volume_folder: "{{ volume_root_folder }}/portainer" + version: "2.16.2" -codimd: - domain: "oldpad.{{ base_domain }}" - volume_folder: "{{ volume_root_folder }}/codimd" + keycloak: + file: keycloak.yml + domain: sso.{{ base_domain }} + volume_folder: "{{ volume_root_folder }}/keycloak" + version: "20.0" -hedgedoc: - domain: "pad.{{ base_domain }}" - volume_folder: "{{ volume_root_folder }}/hedgedoc" + restic: + file: restic_backup.yml + user: "datacoop" + domain: "restic.cannedtuna.org" + repository: "datacoop-hevonen" + version: "1.6.0" + disabled_in_vagrant: true -netdata: - domain: "netdata.{{ base_domain }}" + docker_registry: + file: docker_registry.yml + domain: "docker.{{ base_domain }}" + volume_folder: "{{ volume_root_folder }}/docker-registry" + username: "docker" + password: "{{ docker_password }}" + version: "2" -docker_registry: - domain: "docker.{{ base_domain }}" - volume_folder: "{{ volume_root_folder }}/docker-registry" - username: "docker" - password: "{{ docker_password }}" + ### External services ### -data_coop_website: - domains: - - "{{ base_domain }}" - - "www.{{ base_domain }}" + nextcloud: + file: nextcloud.yml + domain: "cloud.{{ base_domain }}" + volume_folder: "{{ volume_root_folder }}/nextcloud" + version: 25-apache -cryptohagen_website: - domains: - - "cryptohagen.dk" - - "www.cryptohagen.dk" + gitea: + file: gitea.yml + domain: "git.{{ base_domain }}" + volume_folder: "{{ volume_root_folder }}/gitea" + version: 1.17.3 + allowed_sender_domain: true -ulovliglogning_website: - domains: - - "ulovliglogning.dk" - - "www.ulovliglogning.dk" - - "ulovlig-logning.dk" + passit: + file: passit.yml + domain: "passit.{{ base_domain }}" + volume_folder: "{{ volume_root_folder }}/passit" + version: stable + allowed_sender_domain: true -cryptoaarhus_website: - domains: - - "cryptoaarhus.dk" - - "www.cryptoaarhus.dk" + matrix: + file: matrix_riot.yml + domain: "matrix.{{ base_domain }}" + volume_folder: "{{ volume_root_folder }}/matrix" + version: v1.63.1 -drone: - domain: "drone.{{ base_domain }}" - volume_folder: "{{ volume_root_folder }}/drone" + riot: + domains: + - "riot.{{ base_domain }}" + - "element.{{ base_domain }}" + volume_folder: "{{ volume_root_folder }}/riot" + version: v1.11.8 -mailu: - version: 1.6 - domain: "mail.{{ base_domain }}" - dns: 192.168.203.254 - subnet: 192.168.203.0/24 - volume_folder: "{{ volume_root_folder }}/mailu" + privatebin: + file: privatebin.yml + domain: "paste.{{ base_domain }}" + volume_folder: "{{ volume_root_folder }}/privatebin" + version: 20221009 -portainer: - domain: "portainer.{{ base_domain }}" - volume_folder: "{{ volume_root_folder }}/portainer" + codimd: + domain: "oldpad.{{ base_domain }}" + volume_folder: "{{ volume_root_folder }}/codimd" -ttrss: - domain: rss.{{ base_domain }} - volume_folder: "{{ volume_root_folder }}/tt-rss" + hedgedoc: + file: hedgedoc.yml + domain: "pad.{{ base_domain }}" + volume_folder: "{{ volume_root_folder }}/hedgedoc" + version: 1.9.6 -keycloak: - domain: sso.{{ base_domain }} - volume_folder: "{{ volume_root_folder }}/keycloak" + data_coop_website: + file: websites/data.coop.yml + domains: + - "{{ base_domain }}" + - "www.{{ base_domain }}" -postfix: - allowed_sender_domains: - - "services.{{ base_domain }}" - - "{{ passit.domain }}" - - "{{ gitea.domain }}" - - "{{ mastodon.domain }}" - - "{{ rallly.domain }}" - - "{{ membersystem.domain }}" + cryptohagen_website: + file: websites/cryptohagen.dk.yml + domains: + - "cryptohagen.dk" + - "www.cryptohagen.dk" -mastodon: - domain: "social.{{ base_domain }}" - volume_folder: "{{ volume_root_folder }}/mastodon" + ulovliglogning_website: + file: websites/ulovliglogning.dk.yml + domains: + - "ulovliglogning.dk" + - "www.ulovliglogning.dk" + - "ulovlig-logning.dk" -rallly: - domain: "when.{{ base_domain }}" - volume_folder: "{{ volume_root_folder }}/rallly" + cryptoaarhus_website: + file: websites/cryptoaarhus.dk.yml + domains: + - "cryptoaarhus.dk" + - "www.cryptoaarhus.dk" -membersystem: - domain: "member.{{ base_domain }}" - django_admins: "Vidir:valberg@orn.li" + drone: + file: drone.yml + domain: "drone.{{ base_domain }}" + volume_folder: "{{ volume_root_folder }}/drone" + version: 1 -restic: - user: "datacoop" - domain: "restic.cannedtuna.org" - repository: "datacoop-hevonen" + mailu: + file: mailu.yml + version: 1.6 + domain: "mail.{{ base_domain }}" + dns: 192.168.203.254 + subnet: 192.168.203.0/24 + volume_folder: "{{ volume_root_folder }}/mailu" + + mastodon: + file: mastodon.yml + domain: "social.{{ base_domain }}" + volume_folder: "{{ volume_root_folder }}/mastodon" + version: v4.0.2 + allowed_sender_domain: true + + rallly: + file: rallly.yml + domain: "when.{{ base_domain }}" + volume_folder: "{{ volume_root_folder }}/rallly" + version: a21f92bf74308d66cfcd545d49b81eba0211a222 + allowed_sender_domain: true + + membersystem: + file: membersystem.yml + domain: "member.{{ base_domain }}" + django_admins: "Vidir:valberg@orn.li" + allowed_sender_domain: true diff --git a/roles/docker/files/configs/mastodon/env_file.j2 b/roles/docker/files/configs/mastodon/env_file.j2 index e894d0d3..58436c45 100644 --- a/roles/docker/files/configs/mastodon/env_file.j2 +++ b/roles/docker/files/configs/mastodon/env_file.j2 @@ -14,7 +14,7 @@ # ---------- # This identifies your server and cannot be changed safely later # ---------- -LOCAL_DOMAIN={{ mastodon.domain }} +LOCAL_DOMAIN={{ services.mastodon.domain }} # Redis # ----- @@ -52,7 +52,7 @@ SMTP_SERVER={{ smtp_host }} SMTP_PORT={{ smtp_port }} SMTP_LOGIN= SMTP_PASSWORD= -SMTP_FROM_ADDRESS=notifications@{{ mastodon.domain }} +SMTP_FROM_ADDRESS=notifications@{{ services.mastodon.domain }} # File storage (optional) # ----------------------- diff --git a/roles/docker/files/configs/matrix/homeserver.yaml.j2 b/roles/docker/files/configs/matrix/homeserver.yaml.j2 index 44c22c2c..4b8c3aa2 100644 --- a/roles/docker/files/configs/matrix/homeserver.yaml.j2 +++ b/roles/docker/files/configs/matrix/homeserver.yaml.j2 @@ -44,7 +44,7 @@ pid_file: /data/homeserver.pid # use synapse with a reverse proxy, this should be the URL to reach # synapse via the proxy. # -public_baseurl: "https://{{ matrix.domain }}" +public_baseurl: "https://{{ services.matrix.domain }}" # Set the soft limit on the number of file descriptors synapse can use # Zero is used to indicate synapse should set the soft limit to the diff --git a/roles/docker/files/configs/rallly/env_file.j2 b/roles/docker/files/configs/rallly/env_file.j2 index e0cced2f..64036967 100644 --- a/roles/docker/files/configs/rallly/env_file.j2 +++ b/roles/docker/files/configs/rallly/env_file.j2 @@ -1,7 +1,7 @@ -NEXT_PUBLIC_BASE_URL="https://{{ rallly.domain }}" +NEXT_PUBLIC_BASE_URL="https://{{ services.rallly.domain }}" DATABASE_URL="postgres://postgres:{{ postgres_passwords.rallly }}@rallly_db:5432/rallly_db" SECRET_PASSWORD="{{ rallly_secrets.secret_password }}" -SUPPORT_EMAIL="noreply@{{ rallly.domain }}" +SUPPORT_EMAIL="noreply@{{ services.rallly.domain }}" SMTP_HOST="{{ smtp_host }}" SMTP_PORT="{{ smtp_port }}" SMTP_SECURE="false" diff --git a/roles/docker/files/configs/riot/config.json b/roles/docker/files/configs/riot/config.json index 0ea4d1a6..f88e420d 100644 --- a/roles/docker/files/configs/riot/config.json +++ b/roles/docker/files/configs/riot/config.json @@ -1,7 +1,7 @@ { "default_server_config": { "m.homeserver": { - "base_url": "https://{{ matrix.domain }}" + "base_url": "https://{{ services.matrix.domain }}" }, "m.identity_server": { "base_url": "https://vector.im" @@ -37,7 +37,7 @@ ] }, "enable_presence_by_hs_url": { - "https://{{ matrix.domain }}": false + "https://{{ services.matrix.domain }}": false }, "terms_and_conditions_links": [ { diff --git a/roles/docker/files/configs/thelounge.js b/roles/docker/files/configs/thelounge.js index b181e4c9..7dcdb253 100644 --- a/roles/docker/files/configs/thelounge.js +++ b/roles/docker/files/configs/thelounge.js @@ -404,7 +404,7 @@ module.exports = { // // @type string // - url: "ldap://{{ ldap.domain }}", + url: "ldap://{{ services.openldap.domain }}", // // LDAP connection tls options (only used if scheme is ldaps://) diff --git a/roles/docker/tasks/services.yml b/roles/docker/tasks/services.yml index 45c9233e..e183bbf6 100644 --- a/roles/docker/tasks/services.yml +++ b/roles/docker/tasks/services.yml @@ -4,5 +4,15 @@ name: external_services - name: setup services - include_tasks: "services/{{ item }}.yml" - with_items: "{{ services }}" + include_tasks: "services/{{ item.value.file }}" + loop: "{{ services | dict2items }}" + when: single_service is not defined and + item.value.file is defined and + item.value.disabled_in_vagrant is not defined + +- name: setup single service + include_tasks: "services/{{ services[single_service].file }}" + when: single_service is defined and + single_service in services and + services[single_service].file is defined and + services[single_service].disabled_in_vagrant is not defined diff --git a/roles/docker/tasks/services/docker_registry.yml b/roles/docker/tasks/services/docker_registry.yml index 3e538023..660e6846 100644 --- a/roles/docker/tasks/services/docker_registry.yml +++ b/roles/docker/tasks/services/docker_registry.yml @@ -2,34 +2,34 @@ - name: copy docker registry nginx configuration copy: src: "files/configs/docker_registry/nginx.conf" - dest: "/docker-volumes/nginx/vhost/{{ docker_registry.domain }}" + dest: "/docker-volumes/nginx/vhost/{{ services.docker_registry.domain }}" mode: "0644" - name: docker registry container docker_container: name: registry - image: registry:2 + image: registry:{{ services.docker_registry.version }} restart_policy: always volumes: - - "{{ docker_registry.volume_folder }}/registry:/var/lib/registry" - - "{{ docker_registry.volume_folder }}/auth:/auth" + - "{{ services.docker_registry.volume_folder }}/registry:/var/lib/registry" + - "{{ services.docker_registry.volume_folder }}/auth:/auth" networks: - name: external_services env: - VIRTUAL_HOST: "{{ docker_registry.domain }}" - LETSENCRYPT_HOST: "{{ docker_registry.domain }}" + VIRTUAL_HOST: "{{ services.docker_registry.domain }}" + LETSENCRYPT_HOST: "{{ services.docker_registry.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" REGISTRY_AUTH: "htpasswd" REGISTRY_AUTH_HTPASSWD_PATH: "/auth/htpasswd" REGISTRY_AUTH_HTPASSWD_REALM: "data.coop docker registry" - name: generate htpasswd file - shell: "docker exec -it registry htpasswd -Bbn docker {{ docker_password }} > {{ docker_registry.volume_folder }}/auth/htpasswd" + shell: "docker exec -it registry htpasswd -Bbn docker {{ docker_password }} > {{ services.docker_registry.volume_folder }}/auth/htpasswd" args: - creates: "{{ docker_registry.volume_folder }}/auth/htpasswd" + creates: "{{ services.docker_registry.volume_folder }}/auth/htpasswd" - name: log in to registry docker_login: - registry: "docker.data.coop" + registry: "{{ 'docker.data.coop' if vagrant else services.docker_registry.domain }}" username: "docker" password: "{{ docker_password }}" diff --git a/roles/docker/tasks/services/drone.yml b/roles/docker/tasks/services/drone.yml index 62bdbaa4..874ce03e 100644 --- a/roles/docker/tasks/services/drone.yml +++ b/roles/docker/tasks/services/drone.yml @@ -14,31 +14,31 @@ - external_services - drone volumes: - - "{{ drone.volume_folder }}:/data" + - "{{ services.drone.volume_folder }}:/data" - "/var/run/docker.sock:/var/run/docker.sock" environment: - DRONE_GITEA_SERVER: "https://{{ gitea.domain }}" + DRONE_GITEA_SERVER: "https://{{ services.gitea.domain }}" DRONE_GITEA_CLIENT_ID: "{{ drone_secrets.oauth_client_id }}" DRONE_GITEA_CLIENT_SECRET: "{{ drone_secrets.oauth_client_secret }}" DRONE_GIT_ALWAYS_AUTH: "true" - DRONE_SERVER_HOST: "{{ drone.domain }}" + DRONE_SERVER_HOST: "{{ services.drone.domain }}" DRONE_SERVER_PROTO: "https" DRONE_RPC_SECRET: "{{ drone_secrets.rpc_shared_secret }}" PLUGIN_CUSTOM_DNS: "91.239.100.100" - VIRTUAL_HOST: "{{ drone.domain }}" - LETSENCRYPT_HOST: "{{ drone.domain }}" + VIRTUAL_HOST: "{{ services.drone.domain }}" + LETSENCRYPT_HOST: "{{ services.drone.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" drone-runner-docker: container_name: "drone-runner-docker" - image: "drone/drone-runner-docker:1" + image: "drone/drone-runner-docker:{{ services.drone.version }}" restart: unless-stopped networks: - drone volumes: - "/var/run/docker.sock:/var/run/docker.sock" environment: - DRONE_RPC_HOST: "{{ drone.domain }}" + DRONE_RPC_HOST: "{{ services.drone.domain }}" DRONE_RPC_PROTO: "https" DRONE_RPC_SECRET: "{{ drone_secrets.rpc_shared_secret }}" DRONE_RUNNER_CAPACITY: 2 diff --git a/roles/docker/tasks/services/gitea.yml b/roles/docker/tasks/services/gitea.yml index aeffae18..514cc9e7 100644 --- a/roles/docker/tasks/services/gitea.yml +++ b/roles/docker/tasks/services/gitea.yml @@ -7,25 +7,25 @@ - name: gitea container docker_container: name: gitea - image: gitea/gitea:1.17.3 + image: gitea/gitea:{{ services.gitea.version }} restart_policy: unless-stopped networks: - name: gitea - name: postfix - name: external_services volumes: - - "{{ gitea.volume_folder }}:/data" + - "{{ services.gitea.volume_folder }}:/data" published_ports: - "22:22" env: - VIRTUAL_HOST: "{{ gitea.domain }}" + VIRTUAL_HOST: "{{ services.gitea.domain }}" VIRTUAL_PORT: "3000" - LETSENCRYPT_HOST: "{{ gitea.domain }}" + LETSENCRYPT_HOST: "{{ services.gitea.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" # Gitea customization, see: https://docs.gitea.io/en-us/install-with-docker/#customization # https://docs.gitea.io/en-us/config-cheat-sheet/#security-security GITEA__mailer__ENABLED: "true" - GITEA__mailer__FROM: "noreply@{{ gitea.domain }}" + GITEA__mailer__FROM: "noreply@{{ services.gitea.domain }}" GITEA__mailer__MAILER_TYPE: "smtp" GITEA__mailer__HOST: "{{ smtp_host }}:{{ smtp_port }}" GITEA__mailer__USER: "noop" diff --git a/roles/docker/tasks/services/hedgedoc.yml b/roles/docker/tasks/services/hedgedoc.yml index 7a68f372..7508535c 100644 --- a/roles/docker/tasks/services/hedgedoc.yml +++ b/roles/docker/tasks/services/hedgedoc.yml @@ -1,7 +1,7 @@ --- - name: create hedgedoc volume folders file: - name: "{{ hedgedoc.volume_folder }}/{{ volume }}" + name: "{{ services.hedgedoc.volume_folder }}/{{ volume }}" state: directory loop: - "db" @@ -12,7 +12,7 @@ - name: copy sso public certificate copy: src: "files/sso/sso.data.coop.pem" - dest: "{{ hedgedoc.volume_folder }}/sso.data.coop.pem" + dest: "{{ services.hedgedoc.volume_folder }}/sso.data.coop.pem" mode: "0644" - name: setup hedgedoc @@ -31,13 +31,13 @@ networks: - "hedgedoc" volumes: - - "{{ hedgedoc.volume_folder }}/db:/var/lib/postgresql/data" + - "{{ services.hedgedoc.volume_folder }}/db:/var/lib/postgresql/data" app: - image: quay.io/hedgedoc/hedgedoc:1.9.6 + image: quay.io/hedgedoc/hedgedoc:{{ services.hedgedoc.version }} environment: CMD_DB_URL: "postgres://codimd:{{ postgres_passwords.hedgedoc }}@hedgedoc_database_1:5432/codimd" - CMD_DOMAIN: "{{ hedgedoc.domain }}" + CMD_DOMAIN: "{{ services.hedgedoc.domain }}" CMD_ALLOW_EMAIL_REGISTER: "False" CMD_IMAGE_UPLOAD_TYPE: "filesystem" CMD_EMAIL: "False" @@ -47,12 +47,12 @@ CMD_SAML_IDENTIFIERFORMAT: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" CMD_USECDN: "false" CMD_PROTOCOL_USESSL: "true" - VIRTUAL_HOST: "{{ hedgedoc.domain }}" - LETSENCRYPT_HOST: "{{ hedgedoc.domain }}" + VIRTUAL_HOST: "{{ services.hedgedoc.domain }}" + LETSENCRYPT_HOST: "{{ services.hedgedoc.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" volumes: - - "{{ hedgedoc.volume_folder }}/hedgedoc/uploads:/hedgedoc/public/uploads" - - "{{ hedgedoc.volume_folder }}/sso.data.coop.pem:/sso.data.coop.pem" + - "{{ services.hedgedoc.volume_folder }}/hedgedoc/uploads:/hedgedoc/public/uploads" + - "{{ services.hedgedoc.volume_folder }}/sso.data.coop.pem:/sso.data.coop.pem" restart: "unless-stopped" networks: - "hedgedoc" diff --git a/roles/docker/tasks/services/keycloak.yml b/roles/docker/tasks/services/keycloak.yml index 26a56618..3f2da44b 100644 --- a/roles/docker/tasks/services/keycloak.yml +++ b/roles/docker/tasks/services/keycloak.yml @@ -12,24 +12,24 @@ networks: - "keycloak" volumes: - - "{{ keycloak.volume_folder }}/data:/var/lib/postgresql/data" + - "{{ services.keycloak.volume_folder }}/data:/var/lib/postgresql/data" environment: POSTGRES_USER: "keycloak" POSTGRES_PASSWORD: "{{ postgres_passwords.keycloak }}" POSTGRES_DB: "keycloak" app: - image: "quay.io/keycloak/keycloak:20.0.1" + image: "quay.io/keycloak/keycloak:{{ services.keycloak.version }}" restart: "unless-stopped" networks: - "keycloak" - "postfix" - "external_services" - command: "start --db=postgres --db-url=jdbc:postgresql://postgres:5432/keycloak --db-username=keycloak --db-password={{ postgres_passwords.keycloak }} --hostname={{ keycloak.domain }} --proxy=edge --https-port=8080 --http-relative-path=/auth" + command: "start --db=postgres --db-url=jdbc:postgresql://postgres:5432/keycloak --db-username=keycloak --db-password={{ postgres_passwords.keycloak }} --hostname={{ services.keycloak.domain }} --proxy=edge --https-port=8080 --http-relative-path=/auth" environment: - VIRTUAL_HOST: "{{ keycloak.domain }}" + VIRTUAL_HOST: "{{ services.keycloak.domain }}" VIRTUAL_PORT: "8080" - LETSENCRYPT_HOST: "{{ keycloak.domain }}" + LETSENCRYPT_HOST: "{{ services.keycloak.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" networks: diff --git a/roles/docker/tasks/services/mailu.yml b/roles/docker/tasks/services/mailu.yml index 3c28dee3..c1119c78 100644 --- a/roles/docker/tasks/services/mailu.yml +++ b/roles/docker/tasks/services/mailu.yml @@ -2,7 +2,7 @@ - name: create mailu volume folders file: - name: "{{ mailu.volume_folder }}/{{ volume }}" + name: "{{ services.mailu.volume_folder }}/{{ volume }}" state: directory loop: - redis @@ -20,20 +20,20 @@ - name: upload mailu.env file template: src: mailu.env.j2 - dest: "{{ mailu.volume_folder}}/mailu.env" + dest: "{{ services.mailu.volume_folder}}/mailu.env" - name: hard link to Let's Encrypt TLS certificate file: - src: "{{ nginx.volume_folder }}/certs/{{ mailu.domain }}/fullchain.pem" - dest: "{{ mailu.volume_folder }}/certs/cert.pem" + src: "{{ services.nginx_proxy.volume_folder }}/certs/{{ services.mailu.domain }}/fullchain.pem" + dest: "{{ services.mailu.volume_folder }}/certs/cert.pem" state: hard force: yes when: letsencrypt_enabled - name: hard link to Let's Encrypt TLS key file: - src: "{{ nginx.volume_folder }}/certs/{{ mailu.domain }}/key.pem" - dest: "{{ mailu.volume_folder }}/certs/key.pem" + src: "{{ services.nginx_proxy.volume_folder }}/certs/{{ services.mailu.domain }}/key.pem" + dest: "{{ services.mailu.volume_folder }}/certs/key.pem" state: hard force: yes when: letsencrypt_enabled @@ -49,30 +49,30 @@ image: redis:alpine restart: always volumes: - - "{{ mailu.volume_folder }}/redis:/data" + - "{{ services.mailu.volume_folder }}/redis:/data" database: - image: mailu/postgresql:{{ mailu.version }} + image: mailu/postgresql:{{ services.mailu.version }} restart: always - env_file: "{{ mailu.volume_folder}}/mailu.env" + env_file: "{{ services.mailu.volume_folder}}/mailu.env" volumes: - - "{{ mailu.volume_folder }}/data/psql_db:/data" - - "{{ mailu.volume_folder }}/data/psql_backup:/backup" + - "{{ services.mailu.volume_folder }}/data/psql_db:/data" + - "{{ services.mailu.volume_folder }}/data/psql_backup:/backup" networks: - default - external_services front: - image: mailu/nginx:{{ mailu.version }} + image: mailu/nginx:{{ services.mailu.version }} restart: always - env_file: "{{ mailu.volume_folder}}/mailu.env" + env_file: "{{ services.mailu.volume_folder}}/mailu.env" environment: - VIRTUAL_HOST: "{{ mailu.domain }}" - LETSENCRYPT_HOST: "{{ mailu.domain }}" + VIRTUAL_HOST: "{{ services.mailu.domain }}" + LETSENCRYPT_HOST: "{{ services.mailu.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" volumes: - - "{{ mailu.volume_folder }}/certs:/certs" - - "{{ mailu.volume_folder }}/overrides/nginx:/overrides" + - "{{ services.mailu.volume_folder }}/certs:/certs" + - "{{ services.mailu.volume_folder }}/overrides/nginx:/overrides" expose: - "80" ports: @@ -85,70 +85,70 @@ - external_services resolver: - image: mailu/unbound:{{ mailu.version }} + image: mailu/unbound:{{ services.mailu.version }} restart: always - env_file: "{{ mailu.volume_folder}}/mailu.env" + env_file: "{{ services.mailu.volume_folder}}/mailu.env" networks: default: - ipv4_address: "{{ mailu.dns }}" + ipv4_address: "{{ services.mailu.dns }}" admin: - image: mailu/admin:{{ mailu.version }} + image: mailu/admin:{{ services.mailu.version }} restart: always - env_file: "{{ mailu.volume_folder}}/mailu.env" + env_file: "{{ services.mailu.volume_folder}}/mailu.env" volumes: - - "{{ mailu.volume_folder }}/data:/data" - - "{{ mailu.volume_folder }}/dkim:/dkim" + - "{{ services.mailu.volume_folder }}/data:/data" + - "{{ services.mailu.volume_folder }}/dkim:/dkim" depends_on: - redis imap: - image: mailu/dovecot:{{ mailu.version }} + image: mailu/dovecot:{{ services.mailu.version }} restart: always - env_file: "{{ mailu.volume_folder}}/mailu.env" + env_file: "{{ services.mailu.volume_folder}}/mailu.env" volumes: - - "{{ mailu.volume_folder }}/mail:/mail" - - "{{ mailu.volume_folder }}/overrides:/overrides" + - "{{ services.mailu.volume_folder }}/mail:/mail" + - "{{ services.mailu.volume_folder }}/overrides:/overrides" depends_on: - front smtp: - image: mailu/postfix:{{ mailu.version }} + image: mailu/postfix:{{ services.mailu.version }} restart: always - env_file: "{{ mailu.volume_folder}}/mailu.env" + env_file: "{{ services.mailu.volume_folder}}/mailu.env" volumes: - - "{{ mailu.volume_folder }}/overrides:/overrides" + - "{{ services.mailu.volume_folder }}/overrides:/overrides" depends_on: - front - resolver dns: - - "{{ mailu.dns }}" + - "{{ services.mailu.dns }}" antispam: - image: mailu/rspamd:{{ mailu.version }} + image: mailu/rspamd:{{ services.mailu.version }} restart: always - env_file: "{{ mailu.volume_folder}}/mailu.env" + env_file: "{{ services.mailu.volume_folder}}/mailu.env" volumes: - - "{{ mailu.volume_folder }}/filter:/var/lib/rspamd" - - "{{ mailu.volume_folder }}/dkim:/dkim" - - "{{ mailu.volume_folder }}/overrides/rspamd:/etc/rspamd/override.d" + - "{{ services.mailu.volume_folder }}/filter:/var/lib/rspamd" + - "{{ services.mailu.volume_folder }}/dkim:/dkim" + - "{{ services.mailu.volume_folder }}/overrides/rspamd:/etc/rspamd/override.d" depends_on: - front - resolver dns: - - "{{ mailu.dns }}" + - "{{ services.mailu.dns }}" webmail: image: mailu/rainloop:1.6 restart: always - env_file: "{{ mailu.volume_folder}}/mailu.env" + env_file: "{{ services.mailu.volume_folder}}/mailu.env" volumes: - - "{{ mailu.volume_folder }}/webmail:/data" + - "{{ services.mailu.volume_folder }}/webmail:/data" depends_on: - front - resolver dns: - - "{{ mailu.dns }}" + - "{{ services.mailu.dns }}" networks: default: @@ -156,7 +156,7 @@ ipam: driver: default config: - - subnet: "{{ mailu.subnet }}" + - subnet: "{{ services.mailu.subnet }}" external_services: external: name: external_services diff --git a/roles/docker/tasks/services/mastodon.yml b/roles/docker/tasks/services/mastodon.yml index 7da21dfa..baeea09b 100644 --- a/roles/docker/tasks/services/mastodon.yml +++ b/roles/docker/tasks/services/mastodon.yml @@ -1,6 +1,6 @@ - name: create mastodon volume folders file: - name: "{{ mastodon.volume_folder }}/{{ volume }}" + name: "{{ services.mastodon.volume_folder }}/{{ volume }}" state: directory owner: "991" group: "991" @@ -14,12 +14,12 @@ - name: Copy mastodon environment file template: src: files/configs/mastodon/env_file.j2 - dest: "{{ mastodon.volume_folder }}/env_file" + dest: "{{ services.mastodon.volume_folder }}/env_file" - name: upload vhost config for root domain template: src: files/configs/mastodon/vhost-mastodon - dest: "{{ nginx.volume_folder }}/vhost/{{ mastodon.domain }}" + dest: "{{ services.nginx_proxy.volume_folder }}/vhost/{{ services.mastodon.domain }}" - name: set up mastodon docker_compose: @@ -37,7 +37,7 @@ healthcheck: test: ['CMD', 'pg_isready', '-U', 'postgres'] volumes: - - "{{ mastodon.volume_folder }}/postgres_data:/var/lib/postgresql/data" + - "{{ services.mastodon.volume_folder }}/postgres_data:/var/lib/postgresql/data" environment: - 'POSTGRES_HOST_AUTH_METHOD=trust' @@ -49,12 +49,12 @@ healthcheck: test: ['CMD', 'redis-cli', 'ping'] volumes: - - "{{ mastodon.volume_folder }}/redis_data:/data" + - "{{ services.mastodon.volume_folder }}/redis_data:/data" web: - image: "tootsuite/mastodon:{{ mastodon_version }}" + image: "tootsuite/mastodon:{{ services.mastodon.version }}" restart: always - env_file: "{{ mastodon.volume_folder }}/env_file" + env_file: "{{ services.mastodon.volume_folder }}/env_file" command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000" networks: - external_services @@ -66,18 +66,18 @@ - db - redis volumes: - - "{{ mastodon.volume_folder }}/mastodon_data:/mastodon/public/system" + - "{{ services.mastodon.volume_folder }}/mastodon_data:/mastodon/public/system" environment: - VIRTUAL_HOST: "{{ mastodon.domain }}" + VIRTUAL_HOST: "{{ services.mastodon.domain }}" VIRTUAL_PORT: "3000" VIRTUAL_PATH: "/" - LETSENCRYPT_HOST: "{{ mastodon.domain }}" + LETSENCRYPT_HOST: "{{ services.mastodon.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" streaming: - image: "tootsuite/mastodon:{{ mastodon_version }}" + image: "tootsuite/mastodon:{{ services.mastodon.version }}" restart: always - env_file: "{{ mastodon.volume_folder }}/env_file" + env_file: "{{ services.mastodon.volume_folder }}/env_file" command: node ./streaming networks: - external_services @@ -91,14 +91,14 @@ - db - redis environment: - VIRTUAL_HOST: "{{ mastodon.domain }}" + VIRTUAL_HOST: "{{ services.mastodon.domain }}" VIRTUAL_PORT: "4000" VIRTUAL_PATH: "/api/v1/streaming" sidekiq: - image: "tootsuite/mastodon:{{ mastodon_version }}" + image: "tootsuite/mastodon:{{ services.mastodon.version }}" restart: always - env_file: "{{ mastodon.volume_folder }}/env_file" + env_file: "{{ services.mastodon.volume_folder }}/env_file" command: bundle exec sidekiq -c 32 environment: DB_POOL: 32 @@ -110,7 +110,7 @@ - external_services - internal_network volumes: - - "{{ mastodon.volume_folder }}/mastodon_data:/mastodon/public/system" + - "{{ services.mastodon.volume_folder }}/mastodon_data:/mastodon/public/system" healthcheck: test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"] @@ -120,6 +120,4 @@ postfix: external: true internal_network: - internal: true - vars: - mastodon_version: "v4.0.2" \ No newline at end of file + internal: true \ No newline at end of file diff --git a/roles/docker/tasks/services/matrix_riot.yml b/roles/docker/tasks/services/matrix_riot.yml index 362b8518..666c5447 100644 --- a/roles/docker/tasks/services/matrix_riot.yml +++ b/roles/docker/tasks/services/matrix_riot.yml @@ -1,7 +1,7 @@ --- - name: create matrix volume folders file: - name: "{{ matrix.volume_folder }}/{{ volume }}" + name: "{{ services.matrix.volume_folder }}/{{ volume }}" state: directory owner: "991" group: "991" @@ -14,12 +14,12 @@ - name: create matrix DB folder file: - name: "{{ matrix.volume_folder }}/db" + name: "{{ services.matrix.volume_folder }}/db" state: "directory" - name: create riot volume folders file: - name: "{{ riot.volume_folder }}/{{ volume }}" + name: "{{ services.riot.volume_folder }}/{{ volume }}" state: directory loop: - "data" @@ -29,38 +29,38 @@ - name: upload riot config.json template: src: files/configs/riot/config.json - dest: "{{ riot.volume_folder }}/data/config.json" + dest: "{{ services.riot.volume_folder }}/data/config.json" - name: upload riot.im.conf template: src: files/configs/riot/riot.im.conf - dest: "{{ riot.volume_folder }}/data/riot.im.conf" + dest: "{{ services.riot.volume_folder }}/data/riot.im.conf" - name: upload vhost config for root domain template: src: files/configs/matrix/vhost-root - dest: "{{ nginx.volume_folder }}/vhost/{{ base_domain }}" + dest: "{{ services.nginx_proxy.volume_folder }}/vhost/{{ base_domain }}" - name: upload vhost config for matrix domain template: src: files/configs/matrix/vhost-matrix - dest: "{{ nginx.volume_folder }}/vhost/{{ matrix.domain }}" + dest: "{{ services.nginx_proxy.volume_folder }}/vhost/{{ services.matrix.domain }}" - name: upload vhost config for riot domain template: src: files/configs/matrix/vhost-riot - dest: "{{ nginx.volume_folder }}/vhost/{{ item }}" - loop: "{{ riot.domains }}" + dest: "{{ services.nginx_proxy.volume_folder }}/vhost/{{ item }}" + loop: "{{ services.riot.domains }}" - name: upload homeserver.yaml template: src: "files/configs/matrix/homeserver.yaml.j2" - dest: "{{ matrix.volume_folder }}/data/homeserver.yaml" + dest: "{{ services.matrix.volume_folder }}/data/homeserver.yaml" - name: upload matrix logging config template: src: "files/configs/matrix/matrix.data.coop.log.config" - dest: "{{ matrix.volume_folder }}/data/matrix.data.coop.log.config" + dest: "{{ services.matrix.volume_folder }}/data/matrix.data.coop.log.config" - name: set up matrix and riot docker_compose: @@ -76,32 +76,32 @@ networks: - matrix volumes: - - "{{ matrix.volume_folder }}/db:/var/lib/postgresql/data" + - "{{ services.matrix.volume_folder }}/db:/var/lib/postgresql/data" environment: POSTGRES_USER: "synapse" POSTGRES_PASSWORD: "{{ postgres_passwords.matrix }}" matrix_app: container_name: matrix - image: matrixdotorg/synapse:v1.63.1 + image: matrixdotorg/synapse:{{ services.matrix.version }} restart: unless-stopped networks: - matrix - external_services volumes: - - "{{ matrix.volume_folder }}/data:/data" + - "{{ services.matrix.volume_folder }}/data:/data" environment: SYNAPSE_CONFIG_PATH: "/data/homeserver.yaml" SYNAPSE_CACHE_FACTOR: "2" SYNAPSE_LOG_LEVEL: "INFO" - VIRTUAL_HOST: "{{ matrix.domain }}" + VIRTUAL_HOST: "{{ services.matrix.domain }}" VIRTUAL_PORT: "8008" - LETSENCRYPT_HOST: "{{ matrix.domain }}" + LETSENCRYPT_HOST: "{{ services.matrix.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" riot: container_name: riot_app - image: avhost/docker-matrix-riot:v1.11.8 + image: avhost/docker-matrix-riot:{{ services.riot.version }} restart: unless-stopped networks: - matrix @@ -109,11 +109,11 @@ expose: - 8080 volumes: - - "{{ riot.volume_folder }}/data:/data" + - "{{ services.riot.volume_folder }}/data:/data" environment: - VIRTUAL_HOST: "{{ riot.domains|join(',') }}" + VIRTUAL_HOST: "{{ services.riot.domains|join(',') }}" VIRTUAL_PORT: "8080" - LETSENCRYPT_HOST: "{{ riot.domains|join(',') }}" + LETSENCRYPT_HOST: "{{ services.riot.domains|join(',') }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" networks: diff --git a/roles/docker/tasks/services/membersystem.yml b/roles/docker/tasks/services/membersystem.yml index 671b026f..ca63851e 100644 --- a/roles/docker/tasks/services/membersystem.yml +++ b/roles/docker/tasks/services/membersystem.yml @@ -25,14 +25,14 @@ POSTGRES_PORT: 5432 EMAIL_BACKEND: "django.core.mail.backends.smtp.EmailBackend" EMAIL_URL: "smtp://noop@{{ smtp_host }}:{{ smtp_port }}" - VIRTUAL_HOST: "{{ membersystem.domain }}" + VIRTUAL_HOST: "{{ services.membersystem.domain }}" VIRTUAL_PORT: "8000" - LETSENCRYPT_HOST: "{{ membersystem.domain }}" + LETSENCRYPT_HOST: "{{ services.membersystem.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" - ALLOWED_HOSTS: "{{ membersystem.domain }}" - CSRF_TRUSTED_ORIGINS: "https://{{ membersystem.domain }}" - DJANGO_ADMINS: "{{ membersystem.django_admins }}" - DEFAULT_FROM_EMAIL: "noreply@{{ membersystem.domain }}" + ALLOWED_HOSTS: "{{ services.membersystem.domain }}" + CSRF_TRUSTED_ORIGINS: "https://{{ services.membersystem.domain }}" + DJANGO_ADMINS: "{{ services.membersystem.django_admins }}" + DEFAULT_FROM_EMAIL: "noreply@{{ services.membersystem.domain }}" labels: com.centurylinklabs.watchtower.enable: "true" diff --git a/roles/docker/tasks/services/netdata.yml b/roles/docker/tasks/services/netdata.yml index c1eb3967..e1a7bbe5 100644 --- a/roles/docker/tasks/services/netdata.yml +++ b/roles/docker/tasks/services/netdata.yml @@ -3,7 +3,7 @@ - name: setup netdata docker container for system monitoring docker_container: name: netdata - image: netdata/netdata + image: netdata/netdata:{{ services.netdata.version }} restart_policy: unless-stopped hostname: "hevonen.servers.{{ base_domain }}" capabilities: @@ -17,8 +17,8 @@ networks: - name: external_services env: - VIRTUAL_HOST : "{{ netdata.domain }}" - LETSENCRYPT_HOST: "{{ netdata.domain }}" + VIRTUAL_HOST : "{{ services.netdata.domain }}" + LETSENCRYPT_HOST: "{{ services.netdata.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" PGID: "999" labels: diff --git a/roles/docker/tasks/services/nextcloud.yml b/roles/docker/tasks/services/nextcloud.yml index 05ae4103..d36f8def 100644 --- a/roles/docker/tasks/services/nextcloud.yml +++ b/roles/docker/tasks/services/nextcloud.yml @@ -2,7 +2,7 @@ - name: upload vhost config for cloud.data.coop template: src: files/configs/nextcloud/vhost - dest: "{{ nginx.volume_folder }}/vhost/{{ nextcloud.domain }}" + dest: "{{ services.nginx_proxy.volume_folder }}/vhost/{{ services.nextcloud.domain }}" notify: "restart nginx" - name: setup nextcloud containers @@ -17,7 +17,7 @@ networks: - "nextcloud" volumes: - - "{{ nextcloud.volume_folder }}/postgres:/var/lib/postgresql/data" + - "{{ services.nextcloud.volume_folder }}/postgres:/var/lib/postgresql/data" environment: POSTGRES_DB: "nextcloud" POSTGRES_PASSWORD: "{{ postgres_passwords.nextcloud }}" @@ -33,29 +33,29 @@ - "nextcloud" cron: - image: "nextcloud:25-apache" + image: "nextcloud:{{ services.nextcloud.version }}" restart: "unless-stopped" entrypoint: "/cron.sh" networks: - "nextcloud" volumes: - - "{{ nextcloud.volume_folder }}/app:/var/www/html" + - "{{ services.nextcloud.volume_folder }}/app:/var/www/html" depends_on: - "postgres" - "redis" app: - image: "nextcloud:25-apache" + image: "nextcloud:{{ services.nextcloud.version }}" restart: "unless-stopped" networks: - "nextcloud" - "postfix" - "external_services" volumes: - - "{{ nextcloud.volume_folder }}/app:/var/www/html" + - "{{ services.nextcloud.volume_folder }}/app:/var/www/html" environment: - VIRTUAL_HOST: "{{ nextcloud.domain }}" - LETSENCRYPT_HOST: "{{ nextcloud.domain }}" + VIRTUAL_HOST: "{{ services.nextcloud.domain }}" + LETSENCRYPT_HOST: "{{ services.nextcloud.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" POSTGRES_HOST: "postgres" POSTGRES_DB: "nextcloud" diff --git a/roles/docker/tasks/services/nginx-proxy.yml b/roles/docker/tasks/services/nginx-proxy.yml deleted file mode 100644 index 6dfbf751..00000000 --- a/roles/docker/tasks/services/nginx-proxy.yml +++ /dev/null @@ -1,48 +0,0 @@ ---- - -- name: create nginx-proxy volume folders - file: - name: "{{ nginx.volume_folder }}/{{ volume }}" - state: directory - loop: - - conf - - vhost - - html - - dhparam - - certs - loop_control: - loop_var: volume - -- name: nginx proxy container - docker_container: - name: nginx-proxy - image: nginxproxy/nginx-proxy:1.0-alpine - restart_policy: always - networks: - - name: external_services - published_ports: - - "80:80" - - "443:443" - volumes: - - "{{ nginx.volume_folder }}/conf:/etc/nginx/conf.d" - - "{{ nginx.volume_folder }}/vhost:/etc/nginx/vhost.d" - - "{{ nginx.volume_folder }}/html:/usr/share/nginx/html" - - "{{ nginx.volume_folder }}/dhparam:/etc/nginx/dhparam" - - "{{ nginx.volume_folder }}/certs:/etc/nginx/certs:ro" - - /var/run/docker.sock:/tmp/docker.sock:ro - -- name: nginx letsencrypt container - docker_container: - name: nginx-proxy-le - image: nginxproxy/acme-companion:2.2 - restart_policy: always - volumes: - - "{{ nginx.volume_folder }}/vhost:/etc/nginx/vhost.d" - - "{{ nginx.volume_folder }}/html:/usr/share/nginx/html" - - "{{ nginx.volume_folder }}/dhparam:/etc/nginx/dhparam:ro" - - "{{ nginx.volume_folder }}/certs:/etc/nginx/certs" - - /var/run/docker.sock:/var/run/docker.sock:ro - env: - NGINX_PROXY_CONTAINER: nginx-proxy - when: letsencrypt_enabled - diff --git a/roles/docker/tasks/services/nginx_proxy.yml b/roles/docker/tasks/services/nginx_proxy.yml new file mode 100644 index 00000000..8081ab6d --- /dev/null +++ b/roles/docker/tasks/services/nginx_proxy.yml @@ -0,0 +1,48 @@ +--- + +- name: create nginx-proxy volume folders + file: + name: "{{ services.nginx_proxy.volume_folder }}/{{ volume }}" + state: directory + loop: + - conf + - vhost + - html + - dhparam + - certs + loop_control: + loop_var: volume + +- name: nginx proxy container + docker_container: + name: nginx-proxy + image: nginxproxy/nginx-proxy:{{ services.nginx_proxy.version }} + restart_policy: always + networks: + - name: external_services + published_ports: + - "80:80" + - "443:443" + volumes: + - "{{ services.nginx_proxy.volume_folder }}/conf:/etc/nginx/conf.d" + - "{{ services.nginx_proxy.volume_folder }}/vhost:/etc/nginx/vhost.d" + - "{{ services.nginx_proxy.volume_folder }}/html:/usr/share/nginx/html" + - "{{ services.nginx_proxy.volume_folder }}/dhparam:/etc/nginx/dhparam" + - "{{ services.nginx_proxy.volume_folder }}/certs:/etc/nginx/certs:ro" + - /var/run/docker.sock:/tmp/docker.sock:ro + +- name: nginx letsencrypt container + docker_container: + name: nginx-proxy-le + image: nginxproxy/acme-companion:{{ services.nginx_acme_companion.version }} + restart_policy: always + volumes: + - "{{ services.nginx_proxy.volume_folder }}/vhost:/etc/nginx/vhost.d" + - "{{ services.nginx_proxy.volume_folder }}/html:/usr/share/nginx/html" + - "{{ services.nginx_proxy.volume_folder }}/dhparam:/etc/nginx/dhparam:ro" + - "{{ services.nginx_proxy.volume_folder }}/certs:/etc/nginx/certs" + - /var/run/docker.sock:/var/run/docker.sock:ro + env: + NGINX_PROXY_CONTAINER: nginx-proxy + when: letsencrypt_enabled + diff --git a/roles/docker/tasks/services/openldap.yml b/roles/docker/tasks/services/openldap.yml index b08faded..a7682351 100644 --- a/roles/docker/tasks/services/openldap.yml +++ b/roles/docker/tasks/services/openldap.yml @@ -1,7 +1,7 @@ --- - name: create ldap volume folders file: - name: "{{ ldap.volume_folder }}/{{ volume }}" + name: "{{ services.openldap.volume_folder }}/{{ volume }}" state: directory loop: - "var/lib/ldap" @@ -17,19 +17,19 @@ - name: openLDAP container docker_container: name: openldap - image: osixia/openldap:1.5.0 + image: osixia/openldap:{{ services.openldap.version }} tty: true interactive: true restart_policy: unless-stopped volumes: - - "{{ ldap.volume_folder }}/var/lib/ldap:/var/lib/ldap" - - "{{ ldap.volume_folder }}/etc/slapd.d:/etc/ldap/slapd.d" - - "{{ ldap.volume_folder }}/certs:/container/service/slapd/assets/certs/" + - "{{ services.openldap.volume_folder }}/var/lib/ldap:/var/lib/ldap" + - "{{ services.openldap.volume_folder }}/etc/slapd.d:/etc/ldap/slapd.d" + - "{{ services.openldap.volume_folder }}/certs:/container/service/slapd/assets/certs/" published_ports: - "389:389" - "636:636" - hostname: "{{ ldap.domain }}" - domainname: "{{ ldap.domain }}" # important: same as hostname + hostname: "{{ services.openldap.domain }}" + domainname: "{{ services.openldap.domain }}" # important: same as hostname networks: - name: ldap env: @@ -58,7 +58,7 @@ - name: phpLDAPadmin container docker_container: name: phpldapadmin - image: osixia/phpldapadmin:0.9.0 + image: osixia/phpldapadmin:{{ services.phpldapadmin.version }} restart_policy: unless-stopped networks: - name: external_services @@ -68,6 +68,6 @@ PHPLDAPADMIN_HTTPS: "false" PHPLDAPADMIN_TRUST_PROXY_SSL: "true" - VIRTUAL_HOST: "{{ ldap.domain }}" - LETSENCRYPT_HOST: "{{ ldap.domain }}" + VIRTUAL_HOST: "{{ services.openldap.domain }}" + LETSENCRYPT_HOST: "{{ services.openldap.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" diff --git a/roles/docker/tasks/services/passit.yml b/roles/docker/tasks/services/passit.yml index 3214ae2f..300c0996 100644 --- a/roles/docker/tasks/services/passit.yml +++ b/roles/docker/tasks/services/passit.yml @@ -13,13 +13,13 @@ networks: - "passit" volumes: - - "{{ passit.volume_folder }}/data:/var/lib/postgresql/data" + - "{{ services.passit.volume_folder }}/data:/var/lib/postgresql/data" environment: POSTGRES_USER: "passit" POSTGRES_PASSWORD: "{{ postgres_passwords.passit }}" passit_app: - image: "passit/passit:stable" + image: "passit/passit:{{ services.passit.version }}" command: "bin/start.sh" restart: "always" networks: @@ -31,11 +31,11 @@ SECRET_KEY: "{{ passit_secret_key }}" IS_DEBUG: 'False' EMAIL_URL: "smtp://noop@{{ smtp_host }}:{{ smtp_port }}" - DEFAULT_FROM_EMAIL: "noreply@{{ passit.domain }}" - EMAIL_CONFIRMATION_HOST: "https://{{ passit.domain }}" - FIDO_SERVER_ID: "{{ passit.domain }}" - VIRTUAL_HOST: "{{ passit.domain }}" - LETSENCRYPT_HOST: "{{ passit.domain }}" + DEFAULT_FROM_EMAIL: "noreply@{{ services.passit.domain }}" + EMAIL_CONFIRMATION_HOST: "https://{{ services.passit.domain }}" + FIDO_SERVER_ID: "{{ services.passit.domain }}" + VIRTUAL_HOST: "{{ services.passit.domain }}" + LETSENCRYPT_HOST: "{{ services.passit.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" networks: diff --git a/roles/docker/tasks/services/portainer.yml b/roles/docker/tasks/services/portainer.yml index acadd753..005da7f4 100644 --- a/roles/docker/tasks/services/portainer.yml +++ b/roles/docker/tasks/services/portainer.yml @@ -2,21 +2,21 @@ - name: create portainer volume folder file: - name: "{{ portainer.volume_folder }}" + name: "{{ services.portainer.volume_folder }}" state: directory - name: run portainer docker_container: name: portainer - image: portainer/portainer-ee:2.16.2 + image: portainer/portainer-ee:{{ services.portainer.version }} restart_policy: always networks: - name: external_services volumes: - /var/run/docker.sock:/var/run/docker.sock - - "{{ portainer.volume_folder }}:/data" + - "{{ services.portainer.volume_folder }}:/data" env: - VIRTUAL_HOST: "{{ portainer.domain }}" + VIRTUAL_HOST: "{{ services.portainer.domain }}" VIRTUAL_PORT: "9000" - LETSENCRYPT_HOST: "{{ portainer.domain }}" + LETSENCRYPT_HOST: "{{ services.portainer.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" diff --git a/roles/docker/tasks/services/postfix.yml b/roles/docker/tasks/services/postfix.yml index 9fb9ce88..c5656866 100644 --- a/roles/docker/tasks/services/postfix.yml +++ b/roles/docker/tasks/services/postfix.yml @@ -10,10 +10,11 @@ - name: setup postfix docker container for outgoing mail docker_container: name: postfix - image: boky/postfix:v3.5.0 + image: boky/postfix:{{ services.postfix.version }} restart_policy: always networks: - name: postfix env: - ALLOWED_SENDER_DOMAINS: "{{ postfix.allowed_sender_domains|join(' ') }}" + # Get all services which have allowed_sender_domain defined + ALLOWED_SENDER_DOMAINS: "{{ services | dict2items | selectattr('value.allowed_sender_domain', 'defined') | map(attribute='value.domain') | list | join(' ') }}" HOSTNAME: "smtp.data.coop" # the name the smtp server will identify itself as diff --git a/roles/docker/tasks/services/privatebin.yml b/roles/docker/tasks/services/privatebin.yml index 3d0f7ada..bede1758 100644 --- a/roles/docker/tasks/services/privatebin.yml +++ b/roles/docker/tasks/services/privatebin.yml @@ -2,7 +2,7 @@ - name: create privatebin volume folders file: - name: "{{ privatebin.volume_folder }}/{{ volume }}" + name: "{{ services.privatebin.volume_folder }}/{{ volume }}" state: directory loop: - cfg @@ -13,19 +13,19 @@ - name: upload privatebin config template: src: files/configs/privatebin-conf.php - dest: "{{ privatebin.volume_folder }}/cfg/conf.php" + dest: "{{ services.privatebin.volume_folder }}/cfg/conf.php" - name: privatebin app container docker_container: name: privatebin - image: jgeusebroek/privatebin:latest + image: jgeusebroek/privatebin:{{ services.privatebin.version }} restart_policy: unless-stopped volumes: - - "{{ privatebin.volume_folder }}/cfg:/privatebin/cfg" - - "{{ privatebin.volume_folder }}/data:/privatebin/data" + - "{{ services.privatebin.volume_folder }}/cfg:/privatebin/cfg" + - "{{ services.privatebin.volume_folder }}/data:/privatebin/data" networks: - name: external_services env: - VIRTUAL_HOST: "{{ privatebin.domain }}" - LETSENCRYPT_HOST: "{{ privatebin.domain }}" + VIRTUAL_HOST: "{{ services.privatebin.domain }}" + LETSENCRYPT_HOST: "{{ services.privatebin.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" diff --git a/roles/docker/tasks/services/rallly.yml b/roles/docker/tasks/services/rallly.yml index 915e70f7..b5e9d2f2 100644 --- a/roles/docker/tasks/services/rallly.yml +++ b/roles/docker/tasks/services/rallly.yml @@ -1,12 +1,12 @@ - name: Create rallly volume folders file: - name: "{{ rallly.volume_folder }}/postgres" + name: "{{ services.rallly.volume_folder }}/postgres" state: directory - name: Copy Rallly environment file template: src: files/configs/rallly/env_file.j2 - dest: "{{ rallly.volume_folder }}/env_file" + dest: "{{ services.rallly.volume_folder }}/env_file" - name: Set up Rallly docker_compose: @@ -22,7 +22,7 @@ networks: rallly_internal: volumes: - - "{{ rallly.volume_folder }}/postgres:/var/lib/postgresql/data" + - "{{ services.rallly.volume_folder }}/postgres:/var/lib/postgresql/data" environment: POSTGRES_PASSWORD: "{{ postgres_passwords.rallly }}" POSTGRES_DB: "rallly_db" @@ -35,7 +35,7 @@ com.centurylinklabs.watchtower.enable: "true" rallly: - image: "lukevella/rallly:a21f92bf74308d66cfcd545d49b81eba0211a222" + image: "lukevella/rallly:{{ services.rallly.version }}" restart: "always" networks: rallly_internal: @@ -45,11 +45,11 @@ rallly_db: condition: "service_healthy" env_file: - - "{{ rallly.volume_folder }}/env_file" + - "{{ services.rallly.volume_folder }}/env_file" environment: - VIRTUAL_HOST: "{{ rallly.domain }}" + VIRTUAL_HOST: "{{ services.rallly.domain }}" VIRTUAL_PORT: "3000" - LETSENCRYPT_HOST: "{{ rallly.domain }}" + LETSENCRYPT_HOST: "{{ services.rallly.domain }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" labels: com.centurylinklabs.watchtower.enable: "true" diff --git a/roles/docker/tasks/services/restic-backup.yml b/roles/docker/tasks/services/restic_backup.yml similarity index 68% rename from roles/docker/tasks/services/restic-backup.yml rename to roles/docker/tasks/services/restic_backup.yml index c7452927..9dddb49e 100644 --- a/roles/docker/tasks/services/restic-backup.yml +++ b/roles/docker/tasks/services/restic_backup.yml @@ -1,6 +1,5 @@ --- - name: Setup restic backup - when: not vagrant docker_compose: project_name: restic_backup pull: true @@ -8,12 +7,12 @@ version: '3.6' services: restic-backup: - image: mazzolino/restic:1.6.0 + image: mazzolino/restic:{{ services.restic.version }} restart: always environment: RUN_ON_STARTUP: "true" BACKUP_CRON: "0 30 3 * * *" - RESTIC_REPOSITORY: "rest:https://{{ restic.user }}:{{ restic_secrets.user_password }}@{{ restic.domain }}/{{ restic.repository }}" + RESTIC_REPOSITORY: "rest:https://{{ services.restic.user }}:{{ restic_secrets.user_password }}@{{ services.restic.domain }}/{{ services.restic.repository }}" RESTIC_PASSWORD: "{{ restic_secrets.repository_password }}" RESTIC_BACKUP_SOURCES: "/mnt/volumes" RESTIC_BACKUP_ARGS: >- @@ -30,10 +29,10 @@ - /docker-volumes:/mnt/volumes:ro restic-prune: - image: "mazzolino/restic:1.6.0" + image: "mazzolino/restic:{{ services.restic.version }}" environment: RUN_ON_STARTUP: "true" PRUNE_CRON: "0 0 4 * * *" - RESTIC_REPOSITORY: "rest:https://{{ restic.user }}:{{ restic_secrets.user_password }}@{{ restic.domain }}/{{ restic.repository }}" + RESTIC_REPOSITORY: "rest:https://{{ services.restic.user }}:{{ restic_secrets.user_password }}@{{ services.restic.domain }}/{{ services.restic.repository }}" RESTIC_PASSWORD: "{{ restic_secrets.repository_password }}" TZ: Europe/copenhagen diff --git a/roles/docker/tasks/services/watchtower.yml b/roles/docker/tasks/services/watchtower.yml index 586ce249..87d3f4d8 100644 --- a/roles/docker/tasks/services/watchtower.yml +++ b/roles/docker/tasks/services/watchtower.yml @@ -8,7 +8,7 @@ - name: external_services volumes: - /var/run/docker.sock:/var/run/docker.sock - - "{{ docker_registry.volume_folder }}/auth/config.json:/config.json" + - "{{ services.docker_registry.volume_folder }}/auth/config.json:/config.json" env: WATCHTOWER_LABEL_ENABLE: "true" WATCHTOWER_POLL_INTERVAL: "60" \ No newline at end of file diff --git a/roles/docker/tasks/services/websites.yml b/roles/docker/tasks/services/websites.yml deleted file mode 100644 index 8c1b7931..00000000 --- a/roles/docker/tasks/services/websites.yml +++ /dev/null @@ -1,100 +0,0 @@ ---- - -- name: setup data.coop website docker container - docker_container: - name: data.coop_website - image: docker.data.coop/data-coop-website - restart_policy: unless-stopped - networks: - - name: external_services - env: - VIRTUAL_HOST : "{{ data_coop_website.domains|join(',') }}" - LETSENCRYPT_HOST: "{{ data_coop_website.domains|join(',') }}" - LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" - labels: - com.centurylinklabs.watchtower.enable: "true" - - -- name: setup new data.coop website using hugo - docker_container: - name: new.data.coop_website - image: docker.data.coop/data-coop-website:hugo - restart_policy: unless-stopped - networks: - - name: external_services - env: - VIRTUAL_HOST : "new.{{ data_coop_website.domains|join(',') }}" - LETSENCRYPT_HOST: "new.{{ data_coop_website.domains|join(',') }}" - LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" - labels: - com.centurylinklabs.watchtower.enable: "true" - -- name: setup new-new data.coop website using unipi - docker_container: - name: new-new.data.coop_website - image: docker.data.coop/unipi:latest - restart_policy: unless-stopped - purge_networks: yes - networks: - - name: external_services - env: - VIRTUAL_HOST: "new-new.{{ data_coop_website.domains|join(',') }}" - LETSENCRYPT_HOST: "new-new.{{ data_coop_website.domains|join(',') }}" - LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" - # The ssh-key is for read-only only - command: "--remote=git@git.data.coop:halfd/new-website.git#main --ssh-key ed25519:Ag9RekCyC2eow4P/e5crVvSTQ7dTK46WkG0wqEPVJbU= --ssh-authenticator SHA256:l9kdLkb0kJm46pOJ4tCHCtFUaqV1ImbZWMA5oje10fI" - capabilities: - - NET_ADMIN - devices: - - "/dev/net/tun" - labels: - com.centurylinklabs.watchtower.enable: "true" - -- name: setup 2022.slides.data.coop website using unipi - docker_container: - name: 2022.slides.data.coop_website - image: docker.data.coop/unipi:latest - restart_policy: unless-stopped - purge_networks: yes - networks: - - name: external_services - env: - VIRTUAL_HOST: "2022.slides.{{ data_coop_website.domains|join(',') }}" - LETSENCRYPT_HOST: "2022.slides.{{ data_coop_website.domains|join(',') }}" - LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" - # Temporarily hosting on github - command: "--remote=https://github.com/sorbusursina/datacoop-slides.git#slides2022" - capabilities: - - NET_ADMIN - devices: - - "/dev/net/tun" - labels: - com.centurylinklabs.watchtower.enable: "true" - -- name: setup cryptohagen.dk website docker container - docker_container: - name: cryptohagen_website - restart_policy: unless-stopped - image: docker.data.coop/cryptohagen-website - networks: - - name: external_services - env: - VIRTUAL_HOST : "{{ cryptohagen_website.domains|join(',') }}" - LETSENCRYPT_HOST: "{{ cryptohagen_website.domains|join(',') }}" - LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" - labels: - com.centurylinklabs.watchtower.enable: "true" - -- name: setup cryptoaarhus.dk website docker container - docker_container: - name: cryptoaarhus_website - restart_policy: unless-stopped - image: docker.data.coop/cryptoaarhus-website - networks: - - name: external_services - env: - VIRTUAL_HOST : "{{ cryptoaarhus_website.domains|join(',') }}" - LETSENCRYPT_HOST: "{{ cryptoaarhus_website.domains|join(',') }}" - LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" - labels: - com.centurylinklabs.watchtower.enable: "true" diff --git a/roles/docker/tasks/services/websites/2022.slides.data.coop.yml b/roles/docker/tasks/services/websites/2022.slides.data.coop.yml new file mode 100644 index 00000000..260af826 --- /dev/null +++ b/roles/docker/tasks/services/websites/2022.slides.data.coop.yml @@ -0,0 +1,23 @@ +--- + +- name: setup 2022.slides.data.coop website using unipi + docker_container: + name: 2022.slides.data.coop_website + image: docker.data.coop/unipi:latest + restart_policy: unless-stopped + purge_networks: yes + networks: + - name: external_services + env: + VIRTUAL_HOST: "2022.slides.{{ services.data_coop_website.domains|join(',') }}" + LETSENCRYPT_HOST: "2022.slides.{{ services.data_coop_website.domains|join(',') }}" + LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" + # Temporarily hosting on github + command: "--remote=https://github.com/sorbusursina/datacoop-slides.git#slides2022" + capabilities: + - NET_ADMIN + devices: + - "/dev/net/tun" + labels: + com.centurylinklabs.watchtower.enable: "true" + diff --git a/roles/docker/tasks/services/websites/cryptoaarhus.dk.yml b/roles/docker/tasks/services/websites/cryptoaarhus.dk.yml new file mode 100644 index 00000000..28d6997d --- /dev/null +++ b/roles/docker/tasks/services/websites/cryptoaarhus.dk.yml @@ -0,0 +1,15 @@ +--- + +- name: setup cryptoaarhus.dk website docker container + docker_container: + name: cryptoaarhus_website + restart_policy: unless-stopped + image: docker.data.coop/cryptoaarhus-website + networks: + - name: external_services + env: + VIRTUAL_HOST : "{{ services.cryptoaarhus_website.domains|join(',') }}" + LETSENCRYPT_HOST: "{{ services.cryptoaarhus_website.domains|join(',') }}" + LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" + labels: + com.centurylinklabs.watchtower.enable: "true" diff --git a/roles/docker/tasks/services/websites/cryptohagen.dk.yml b/roles/docker/tasks/services/websites/cryptohagen.dk.yml new file mode 100644 index 00000000..dcca2182 --- /dev/null +++ b/roles/docker/tasks/services/websites/cryptohagen.dk.yml @@ -0,0 +1,15 @@ +--- + +- name: setup cryptohagen.dk website docker container + docker_container: + name: cryptohagen_website + restart_policy: unless-stopped + image: docker.data.coop/cryptohagen-website + networks: + - name: external_services + env: + VIRTUAL_HOST : "{{ services.cryptohagen_website.domains|join(',') }}" + LETSENCRYPT_HOST: "{{ services.cryptohagen_website.domains|join(',') }}" + LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" + labels: + com.centurylinklabs.watchtower.enable: "true" diff --git a/roles/docker/tasks/services/websites/data.coop.yml b/roles/docker/tasks/services/websites/data.coop.yml new file mode 100644 index 00000000..24927579 --- /dev/null +++ b/roles/docker/tasks/services/websites/data.coop.yml @@ -0,0 +1,15 @@ +--- + +- name: setup data.coop website docker container + docker_container: + name: data.coop_website + image: docker.data.coop/data-coop-website + restart_policy: unless-stopped + networks: + - name: external_services + env: + VIRTUAL_HOST : "{{ services.data_coop_website.domains|join(',') }}" + LETSENCRYPT_HOST: "{{ services.data_coop_website.domains|join(',') }}" + LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" + labels: + com.centurylinklabs.watchtower.enable: "true" diff --git a/roles/docker/tasks/services/websites/new-new.data.coop.yml b/roles/docker/tasks/services/websites/new-new.data.coop.yml new file mode 100644 index 00000000..05ff1f35 --- /dev/null +++ b/roles/docker/tasks/services/websites/new-new.data.coop.yml @@ -0,0 +1,21 @@ +- name: setup new-new data.coop website using unipi + docker_container: + name: new-new.data.coop_website + image: docker.data.coop/unipi:latest + restart_policy: unless-stopped + purge_networks: yes + networks: + - name: external_services + env: + VIRTUAL_HOST: "new-new.{{ services.data_coop_website.domains|join(',') }}" + LETSENCRYPT_HOST: "new-new.{{ services.data_coop_website.domains|join(',') }}" + LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" + # The ssh-key is for read-only only + command: "--remote=git@git.data.coop:halfd/new-website.git#main --ssh-key ed25519:Ag9RekCyC2eow4P/e5crVvSTQ7dTK46WkG0wqEPVJbU= --ssh-authenticator SHA256:l9kdLkb0kJm46pOJ4tCHCtFUaqV1ImbZWMA5oje10fI" + capabilities: + - NET_ADMIN + devices: + - "/dev/net/tun" + labels: + com.centurylinklabs.watchtower.enable: "true" + diff --git a/roles/docker/tasks/services/websites/new.data.coop.yml b/roles/docker/tasks/services/websites/new.data.coop.yml new file mode 100644 index 00000000..f70596af --- /dev/null +++ b/roles/docker/tasks/services/websites/new.data.coop.yml @@ -0,0 +1,15 @@ +--- + +- name: setup new data.coop website using hugo + docker_container: + name: new.data.coop_website + image: docker.data.coop/data-coop-website:hugo + restart_policy: unless-stopped + networks: + - name: external_services + env: + VIRTUAL_HOST : "new.{{ services.data_coop_website.domains|join(',') }}" + LETSENCRYPT_HOST: "new.{{ services.data_coop_website.domains|join(',') }}" + LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" + labels: + com.centurylinklabs.watchtower.enable: "true" diff --git a/roles/docker/tasks/services/ulovliglogning-dk.yml b/roles/docker/tasks/services/websites/ulovliglogning.dk.yml similarity index 69% rename from roles/docker/tasks/services/ulovliglogning-dk.yml rename to roles/docker/tasks/services/websites/ulovliglogning.dk.yml index 0258df61..7abec88f 100644 --- a/roles/docker/tasks/services/ulovliglogning-dk.yml +++ b/roles/docker/tasks/services/websites/ulovliglogning.dk.yml @@ -6,8 +6,8 @@ networks: - name: external_services env: - VIRTUAL_HOST: "{{ ulovliglogning_website.domains|join(',') }}" - LETSENCRYPT_HOST: "{{ ulovliglogning_website.domains|join(',') }}" + VIRTUAL_HOST: "{{ services.ulovliglogning_website.domains|join(',') }}" + LETSENCRYPT_HOST: "{{ services.ulovliglogning_website.domains|join(',') }}" LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}" labels: com.centurylinklabs.watchtower.enable: "true" diff --git a/roles/docker/templates/mailu.env.j2 b/roles/docker/templates/mailu.env.j2 index c04392c4..68c63fb3 100644 --- a/roles/docker/templates/mailu.env.j2 +++ b/roles/docker/templates/mailu.env.j2 @@ -26,7 +26,7 @@ SECRET_KEY={{ mailu_secret_key }} # PUBLIC_IPV6= ::1 (default: ::1) # Subnet of the docker network. This should not conflict with any networks to which your system is connected. (Internal and external!) -SUBNET={{ mailu.subnet }} +SUBNET={{ services.mailu.subnet }} # Main mail domain DOMAIN=data.coop diff --git a/roles/ubuntu_base/tasks/users.yml b/roles/ubuntu_base/tasks/users.yml index 010666e0..deea3393 100644 --- a/roles/ubuntu_base/tasks/users.yml +++ b/roles/ubuntu_base/tasks/users.yml @@ -9,14 +9,14 @@ loop: "{{ users | default([]) }}" - name: "Add ssh authorized_keys" - authorized_key: + ansible.posix.authorized_key: user: "{{ item.name }}" key: "{{ item.ssh_keys | join('\n') }}" exclusive: true loop: "{{ users | default([]) }}" - name: "Add ssh authorized_keys to root user" - authorized_key: + ansible.posix.authorized_key: user: "root" key: "{{ users | default([]) | map(attribute='ssh_keys') | flatten | join('\n') }}" exclusive: true diff --git a/vagrant_host b/vagrant_host new file mode 100644 index 00000000..e247254e --- /dev/null +++ b/vagrant_host @@ -0,0 +1 @@ +localhost ansible_port=19022