.gitignore

@@ -3,5 +3,4 @@
 .vagrant/
 *.log
 .idea/
-.vscode/
 venv/

datacoop_hosts

@@ -0,0 +1,5 @@
+[production]
+hevonen.servers.data.coop ansible_port=19022
+
+[monitoring]
+uptime.data.coop

group_vars/all/vars.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 users:
   - name: graffen

group_vars/monitoring/vars.yml

@@ -1,13 +0,0 @@
-# vim: ft=yaml.ansible
-# code: language=ansible
----
-vagrant: "{{ from_vagrant is defined and from_vagrant }}"
-letsencrypt_enabled: "{{ not vagrant }}"
-
-base_domain: "{{ 'datacoop.devel' if vagrant else 'data.coop' }}"
-letsencrypt_email: admin@data.coop
-
-services_include:
-  - nginx_proxy
-  - uptime_kuma
-  - watchtower

group_vars/production/vars.yml

@@ -1,16 +0,0 @@
-# vim: ft=yaml.ansible
-# code: language=ansible
----
-vagrant: "{{ from_vagrant is defined and from_vagrant }}"
-letsencrypt_enabled: "{{ not vagrant }}"
-
-base_domain: "{{ 'datacoop.devel' if vagrant else 'data.coop' }}"
-letsencrypt_email: admin@data.coop
-
-services_exclude:
-  - uptime_kuma
-
-smtp_host: "postfix"
-smtp_port: "587"
-
-ldap_dn: "dc=data,dc=coop"

group_vars/staging/vars.yml

@@ -1,16 +0,0 @@
-# vim: ft=yaml.ansible
-# code: language=ansible
----
-vagrant: "{{ from_vagrant is defined and from_vagrant }}"
-letsencrypt_enabled: "{{ not vagrant }}"
-
-base_domain: "{{ 'staging.datacoop.devel' if vagrant else 'staging.data.coop' }}"
-letsencrypt_email: admin@data.coop
-
-services_exclude:
-  - uptime_kuma
-
-smtp_host: "postfix"
-smtp_port: "587"
-
-ldap_dn: "dc=staging,dc=data,dc=coop"

host_vars/cavall.yml

@@ -1,5 +0,0 @@
-# vim: ft=yaml.ansible
-# code: language=ansible
----
-ansible_host: 85.209.118.134
-fqdn: cavall.servers.data.coop

host_vars/folald.yml

@@ -1,6 +0,0 @@
-# vim: ft=yaml.ansible
-# code: language=ansible
----
-ansible_host: 85.209.118.134
-ansible_port: 19022
-fqdn: folald.vm.cavall.servers.data.coop

host_vars/hestur.yml

@@ -1,5 +0,0 @@
-# vim: ft=yaml.ansible
-# code: language=ansible
----
-ansible_host: 159.223.17.241
-fqdn: hestur.servers.data.coop

host_vars/poltre.yml

@@ -1,6 +0,0 @@
-# vim: ft=yaml.ansible
-# code: language=ansible
----
-ansible_host: 85.209.118.142
-ansible_port: 19022
-fqdn: poltre.vm.cavall.servers.data.coop

host_vars/varsa.yml

@@ -1,6 +0,0 @@
-# vim: ft=yaml.ansible
-# code: language=ansible
----
-ansible_host: 85.209.118.143
-ansible_port: 19022
-fqdn: varsa.vm.cavall.servers.data.coop

inventory.ini

@@ -1,19 +0,0 @@
-[proxmox]
-cavall
-
-[monitoring]
-hestur
-
-[production]
-poltre
-
-[staging]
-varsa
-
-[control]
-folald
-
-[virtual:children]
-production
-staging
-control

playbook.yml

@@ -1,13 +1,27 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
-- hosts: all
+- hosts: production
   gather_facts: true
   become: true
-  roles:
+  vars:
-    - name: os_base
+    ldap_dn: "dc=data,dc=coop"
+
+    vagrant: "{{ from_vagrant is defined and from_vagrant }}"
+    letsencrypt_enabled: "{{ not vagrant }}"
+
+    base_domain: "{{ 'datacoop.devel' if vagrant else 'data.coop' }}"
+    letsencrypt_email: "admin@{{ base_domain }}"
+
+    smtp_host: "postfix"
+    smtp_port: "587"
+
+    services_exclude:
+      - uptime_kuma
+
+  tasks:
+    - import_role:
+        name: ubuntu_base
       tags:
         - base_only
-    - name: docker
+    - import_role:
-      tags:
+        name: docker
-        - docker

roles/docker/defaults/main.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 volume_root_folder: "/docker-volumes"
 volume_website_folder: "{{ volume_root_folder }}/websites"

roles/docker/handlers/main.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: restart nginx
   command: docker compose restart proxy

roles/docker/tasks/block.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Create volume folder for service {{ service.name }}
   file:

roles/docker/tasks/main.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Add Docker PGP key
   apt_key:

roles/docker/tasks/post_deploy/docker_registry.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Generate htpasswd file
   shell: docker compose exec registry htpasswd -Bbn docker {{ docker_password }} > auth/htpasswd

roles/docker/tasks/post_deploy/mastodon.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Configure cron job to remove old Mastodon media daily
   cron:

roles/docker/tasks/pre_deploy/data_coop_website.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Upload vhost config for root domain
   copy:

roles/docker/tasks/pre_deploy/docker_registry.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/element.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Create subfolder
   file:

roles/docker/tasks/pre_deploy/hedgedoc.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/mailu.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/mastodon.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Create subfolder for Mastodon data
   file:

roles/docker/tasks/pre_deploy/matrix.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/nextcloud.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/nginx_proxy.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/openldap.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/postfix.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Set up network for Postfix
   docker_network:

roles/docker/tasks/pre_deploy/privatebin.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Create subfolders
   file:

roles/docker/tasks/pre_deploy/rallly.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Create subfolder
   file:

roles/docker/tasks/pre_deploy/restic.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Create SSH directory
   file:

roles/docker/tasks/pre_deploy/writefreely.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Create subfolder for MariaDB data
   file:

roles/docker/tasks/services.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Set up external services network
   docker_network:

roles/os_base/tasks/main.yml

@@ -1,15 +0,0 @@
-# vim: ft=yaml.ansible
-# code: language=ansible
----
-- ansible.builtin.import_tasks: ssh-port.yml
-  tags: [change-ssh-port]
-  when: ansible_port != 22
-
-- ansible.builtin.import_tasks: base.yml
-  tags: [install-base-packages]
-
-- ansible.builtin.import_tasks: users.yml
-  tags: [setup-users]
-
-- ansible.builtin.import_tasks: firewall.yml
-  tags: [setup-firewall]

roles/ubuntu_base/tasks/base.yml

@@ -1,13 +1,17 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Install necessary packages via apt
-  ansible.builtin.apt:
+  apt:
     name: "{{ packages }}"
   vars:
     packages:
+      - aptitude
+      - python3-pip
       - apparmor
       - haveged
       - mosh
-      - ufw
+
-      - vim
+- name: Install Dell OpenManage
+  apt:
+    name: srvadmin-all
+  when: not vagrant and not skip_dell_apt_repo

roles/ubuntu_base/tasks/dell-apt-repo.yml

@@ -0,0 +1,20 @@
+# vim: ft=yaml.ansible
+---
+- name: Import dell apt signing key
+  apt_key:
+    id: "1285491434D8786F"
+    keyserver: "keyserver.ubuntu.com"
+
+- name: Configure dell apt repo
+  apt_repository:
+    repo: "deb https://linux.dell.com/repo/community/openmanage/10101/focal focal main"
+    state: present
+
+- name: Restrict dell apt repo"
+  copy:
+    dest: "/etc/apt/preferences.d/dell"
+    content: |
+      Explanation: Deny all packages from this repo that exist elsewhere
+      Package: *
+      Pin: origin "linux.dell.com"
+      Pin-Priority: 400

roles/ubuntu_base/tasks/firewall.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Setup firewall with UFW
   community.general.ufw: 
@@ -22,4 +21,3 @@
     - port: 587    # Email
     - port: 993    # Email
     - port: 19022  # SSH
-  when: inventory_hostname in groups['virtual']

roles/ubuntu_base/tasks/main.yml

@@ -0,0 +1,21 @@
+# vim: ft=yaml.ansible
+---
+- import_tasks: ssh-port.yml
+  tags: [change-ssh-port]
+  when: not do_not_change_ssh_port
+
+- import_tasks: dell-apt-repo.yml
+  tags: [setup-dell-apt-repo]
+  when: not skip_dell_apt_repo and not vagrant
+
+- import_tasks: upgrade.yml
+  tags: [do-full-system-upgrade]
+
+- import_tasks: base.yml
+  tags: [install-base-packages]
+
+- import_tasks: users.yml
+  tags: [setup-users]
+
+- import_tasks: firewall.yml
+  tags: [setup-firewall]

roles/ubuntu_base/tasks/ssh-port.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: Change SSH port on host
   lineinfile:

roles/ubuntu_base/tasks/upgrade.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: update and upgrade system via apt
   apt: 

roles/ubuntu_base/tasks/users.yml

@@ -1,5 +1,4 @@
 # vim: ft=yaml.ansible
-# code: language=ansible
 ---
 - name: "Add users"
   user:

uptime.data.coop.yml

@@ -0,0 +1,24 @@
+# vim: ft=yaml.ansible
+---
+- hosts: monitoring
+  gather_facts: true
+  become: true
+  vars:
+    vagrant: false
+    base_domain: "{{ 'datacoop.devel' if vagrant else 'data.coop' }}"
+    letsencrypt_enabled: true
+    letsencrypt_email: "admin@{{ base_domain }}"
+    services_include:
+      - nginx_proxy
+      - uptime_kuma
+      - watchtower
+    do_not_change_ssh_port: true
+    skip_dell_apt_repo: true
+
+  tasks:
+    - import_role:
+        name: ubuntu_base
+      tags:
+        - base_only
+    - import_role:
+        name: docker