wip

.gitignore

@@ -3,4 +3,5 @@
 .vagrant/
 *.log
 .idea/
+.vscode/
 venv/

datacoop_hosts

@@ -1,5 +0,0 @@
-[production]
-hevonen.servers.data.coop ansible_port=19022
-
-[monitoring]
-uptime.data.coop

group_vars/all/vars.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 users:
   - name: graffen

group_vars/monitoring/vars.yml

@@ -0,0 +1,13 @@
+# vim: ft=yaml.ansible
+# code: language=ansible
+---
+vagrant: "{{ from_vagrant is defined and from_vagrant }}"
+letsencrypt_enabled: "{{ not vagrant }}"
+
+base_domain: "{{ 'datacoop.devel' if vagrant else 'data.coop' }}"
+letsencrypt_email: admin@data.coop
+
+services_include:
+  - nginx_proxy
+  - uptime_kuma
+  - watchtower

group_vars/production/vars.yml

@@ -0,0 +1,16 @@
+# vim: ft=yaml.ansible
+# code: language=ansible
+---
+vagrant: "{{ from_vagrant is defined and from_vagrant }}"
+letsencrypt_enabled: "{{ not vagrant }}"
+
+base_domain: "{{ 'datacoop.devel' if vagrant else 'data.coop' }}"
+letsencrypt_email: admin@data.coop
+
+services_exclude:
+  - uptime_kuma
+
+smtp_host: "postfix"
+smtp_port: "587"
+
+ldap_dn: "dc=data,dc=coop"

group_vars/staging/vars.yml

@@ -0,0 +1,16 @@
+# vim: ft=yaml.ansible
+# code: language=ansible
+---
+vagrant: "{{ from_vagrant is defined and from_vagrant }}"
+letsencrypt_enabled: "{{ not vagrant }}"
+
+base_domain: "{{ 'staging.datacoop.devel' if vagrant else 'staging.data.coop' }}"
+letsencrypt_email: admin@data.coop
+
+services_exclude:
+  - uptime_kuma
+
+smtp_host: "postfix"
+smtp_port: "587"
+
+ldap_dn: "dc=staging,dc=data,dc=coop"

host_vars/cavall.yml

@@ -0,0 +1,5 @@
+# vim: ft=yaml.ansible
+# code: language=ansible
+---
+ansible_host: 85.209.118.134
+fqdn: cavall.servers.data.coop

host_vars/folald.yml

@@ -0,0 +1,6 @@
+# vim: ft=yaml.ansible
+# code: language=ansible
+---
+ansible_host: 85.209.118.134
+ansible_port: 19022
+fqdn: folald.vm.cavall.servers.data.coop

host_vars/hestur.yml

@@ -0,0 +1,5 @@
+# vim: ft=yaml.ansible
+# code: language=ansible
+---
+ansible_host: 159.223.17.241
+fqdn: hestur.servers.data.coop

host_vars/poltre.yml

@@ -0,0 +1,6 @@
+# vim: ft=yaml.ansible
+# code: language=ansible
+---
+ansible_host: 85.209.118.142
+ansible_port: 19022
+fqdn: poltre.vm.cavall.servers.data.coop

host_vars/varsa.yml

@@ -0,0 +1,6 @@
+# vim: ft=yaml.ansible
+# code: language=ansible
+---
+ansible_host: 85.209.118.143
+ansible_port: 19022
+fqdn: varsa.vm.cavall.servers.data.coop

inventory.ini

@@ -0,0 +1,19 @@
+[proxmox]
+cavall
+
+[monitoring]
+hestur
+
+[production]
+poltre
+
+[staging]
+varsa
+
+[control]
+folald
+
+[virtual:children]
+production
+staging
+control

playbook.yml

@@ -1,27 +1,13 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
-- hosts: production
+- hosts: all
   gather_facts: true
   become: true
-  vars:
+  roles:
-    ldap_dn: "dc=data,dc=coop"
+    - name: os_base
-
-    vagrant: "{{ from_vagrant is defined and from_vagrant }}"
-    letsencrypt_enabled: "{{ not vagrant }}"
-
-    base_domain: "{{ 'datacoop.devel' if vagrant else 'data.coop' }}"
-    letsencrypt_email: "admin@{{ base_domain }}"
-
-    smtp_host: "postfix"
-    smtp_port: "587"
-
-    services_exclude:
-      - uptime_kuma
-
-  tasks:
-    - import_role:
-        name: ubuntu_base
       tags:
         - base_only
-    - import_role:
+    - name: docker
-        name: docker
+      tags:
+        - docker

roles/docker/defaults/main.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 volume_root_folder: "/docker-volumes"
 volume_website_folder: "{{ volume_root_folder }}/websites"

roles/docker/handlers/main.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: restart nginx
   command: docker compose restart proxy

roles/docker/tasks/block.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Create volume folder for service {{ service.name }}
   file:

roles/docker/tasks/main.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Add Docker PGP key
   apt_key:

roles/docker/tasks/post_deploy/docker_registry.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Generate htpasswd file
   shell: docker compose exec registry htpasswd -Bbn docker {{ docker_password }} > auth/htpasswd

roles/docker/tasks/post_deploy/mastodon.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Configure cron job to remove old Mastodon media daily
   cron:

roles/docker/tasks/pre_deploy/data_coop_website.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Upload vhost config for root domain
   copy:

roles/docker/tasks/pre_deploy/docker_registry.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/element.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Create subfolder
   file:

roles/docker/tasks/pre_deploy/hedgedoc.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/mailu.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/mastodon.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Create subfolder for Mastodon data
   file:

roles/docker/tasks/pre_deploy/matrix.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/nextcloud.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/nginx_proxy.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/openldap.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/postfix.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Set up network for Postfix
   docker_network:

roles/docker/tasks/pre_deploy/privatebin.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/rallly.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Create subfolder
   file:

roles/docker/tasks/pre_deploy/restic.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Create SSH directory
   file:

roles/docker/tasks/pre_deploy/writefreely.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Create subfolder for MariaDB data
   file:

roles/docker/tasks/services.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Set up external services network
   docker_network:

roles/os_base/tasks/base.yml

@@ -1,17 +1,13 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Install necessary packages via apt
-  apt:
+  ansible.builtin.apt:
     name: "{{ packages }}"
   vars:
     packages:
-      - aptitude
-      - python3-pip
       - apparmor
       - haveged
       - mosh
-
+      - ufw
-- name: Install Dell OpenManage
+      - vim
-  apt:
-    name: srvadmin-all
-  when: not vagrant and not skip_dell_apt_repo

roles/os_base/tasks/firewall.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Setup firewall with UFW
   community.general.ufw: 
@@ -21,3 +22,4 @@
     - port: 587    # Email
     - port: 993    # Email
     - port: 19022  # SSH
+  when: inventory_hostname in groups['virtual']

roles/os_base/tasks/main.yml

@@ -0,0 +1,15 @@
+# vim: ft=yaml.ansible
+# code: language=ansible
+---
+- ansible.builtin.import_tasks: ssh-port.yml
+  tags: [change-ssh-port]
+  when: ansible_port != 22
+
+- ansible.builtin.import_tasks: base.yml
+  tags: [install-base-packages]
+
+- ansible.builtin.import_tasks: users.yml
+  tags: [setup-users]
+
+- ansible.builtin.import_tasks: firewall.yml
+  tags: [setup-firewall]

roles/os_base/tasks/ssh-port.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: Change SSH port on host
   lineinfile:

roles/os_base/tasks/upgrade.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: update and upgrade system via apt
   apt: 

roles/os_base/tasks/users.yml

@@ -1,4 +1,5 @@
 # vim: ft=yaml.ansible
+# code: language=ansible
 ---
 - name: "Add users"
   user:

roles/ubuntu_base/tasks/dell-apt-repo.yml

@@ -1,20 +0,0 @@
-# vim: ft=yaml.ansible
----
-- name: Import dell apt signing key
-  apt_key:
-    id: "1285491434D8786F"
-    keyserver: "keyserver.ubuntu.com"
-
-- name: Configure dell apt repo
-  apt_repository:
-    repo: "deb https://linux.dell.com/repo/community/openmanage/10101/focal focal main"
-    state: present
-
-- name: Restrict dell apt repo"
-  copy:
-    dest: "/etc/apt/preferences.d/dell"
-    content: |
-      Explanation: Deny all packages from this repo that exist elsewhere
-      Package: *
-      Pin: origin "linux.dell.com"
-      Pin-Priority: 400

roles/ubuntu_base/tasks/main.yml

@@ -1,21 +0,0 @@
-# vim: ft=yaml.ansible
----
-- import_tasks: ssh-port.yml
-  tags: [change-ssh-port]
-  when: not do_not_change_ssh_port
-
-- import_tasks: dell-apt-repo.yml
-  tags: [setup-dell-apt-repo]
-  when: not skip_dell_apt_repo and not vagrant
-
-- import_tasks: upgrade.yml
-  tags: [do-full-system-upgrade]
-
-- import_tasks: base.yml
-  tags: [install-base-packages]
-
-- import_tasks: users.yml
-  tags: [setup-users]
-
-- import_tasks: firewall.yml
-  tags: [setup-firewall]

uptime.data.coop.yml

@@ -1,24 +0,0 @@
-# vim: ft=yaml.ansible
----
-- hosts: monitoring
-  gather_facts: true
-  become: true
-  vars:
-    vagrant: false
-    base_domain: "{{ 'datacoop.devel' if vagrant else 'data.coop' }}"
-    letsencrypt_enabled: true
-    letsencrypt_email: "admin@{{ base_domain }}"
-    services_include:
-      - nginx_proxy
-      - uptime_kuma
-      - watchtower
-    do_not_change_ssh_port: true
-    skip_dell_apt_repo: true
-
-  tasks:
-    - import_role:
-        name: ubuntu_base
-      tags:
-        - base_only
-    - import_role:
-        name: docker