118 changed files with 1523 additions and 3933 deletions
--- a/.ansible-lint
+++ b/.ansible-lint
@ -1,111 +0,0 @@
 ---
 # .ansible-lint
 profile: null # min, basic, moderate,safety, shared, production
 # exclude_paths included in this file are parsed relative to this file's location
 # and not relative to the CWD of execution. CLI arguments passed to the --exclude
 # option are parsed relative to the CWD of execution.
 exclude_paths:
  - .cache/ # implicit unless exclude_paths is defined in config
  - .github/
  - test/fixtures/formatting-before/
  - test/fixtures/formatting-prettier/
 # parseable: true
 # quiet: true
 # strict: true
 # verbosity: 1
 # Mock modules or roles in order to pass ansible-playbook --syntax-check
 mock_modules:
  - zuul_return
  # note the foo.bar is invalid as being neither a module or a collection
  - fake_namespace.fake_collection.fake_module
  - fake_namespace.fake_collection.fake_module.fake_submodule
 mock_roles:
  - mocked_role
  - author.role_name # old standalone galaxy role
  - fake_namespace.fake_collection.fake_role # role within a collection
 # Enable checking of loop variable prefixes in roles
 loop_var_prefix: "{role}_"
 # Enforce variable names to follow pattern below, in addition to Ansible own
 # requirements, like avoiding python identifiers. To disable add `var-naming`
 # to skip_list.
 # var_naming_pattern: "^[a-z_][a-z0-9_]*$"
 use_default_rules: true
 # Load custom rules from this specific folder
 # rulesdir:
 #   - ./rule/directory/
 # Ansible-lint completely ignores rules or tags listed below
 skip_list:
  - skip_this_tag
 # Ansible-lint does not automatically load rules that have the 'opt-in' tag.
 # You must enable opt-in rules by listing each rule 'id' below.
 enable_list:
  - empty-string-compare # opt-in
  - no-log-password # opt-in
  - no-same-owner # opt-in
  # add yaml here if you want to avoid ignoring yaml checks when yamllint
  # library is missing. Normally its absence just skips using that rule.
  - yaml
 # Report only a subset of tags and fully ignore any others
 # tags:
 #   - jinja[spacing]
 # Ansible-lint does not fail on warnings from the rules or tags listed below
 warn_list:
  - skip_this_tag
  - experimental # experimental is included in the implicit list
  # - role-name
  # - yaml[document-start]  # you can also use sub-rule matches
 # Some rules can transform files to fix (or make it easier to fix) identified
 # errors. `ansible-lint --write` will reformat YAML files and run these transforms.
 # By default it will run all transforms (effectively `write_list: ["all"]`).
 # You can disable running transforms by setting `write_list: ["none"]`.
 # Or only enable a subset of rule transforms by listing rules/tags here.
 # write_list:
 #   - all
 # Offline mode disables installation of requirements.yml
 offline: false
 # Return success if number of violations compared with previous git
 # commit has not increased. This feature works only in git
 # repositories.
 progressive: false
 # Define required Ansible's variables to satisfy syntax check
 extra_vars:
  foo: bar
  multiline_string_variable: |
    line1
    line2
  complex_variable: ":{;\t$()"
 # Uncomment to enforce action validation with tasks, usually is not
 # needed as Ansible syntax check also covers it.
 # skip_action_validation: false
 # List of additional kind:pattern to be added at the top of the default
 # match list, first match determines the file kind.
 kinds:
  # - playbook: "**/examples/*.{yml,yaml}"
  # - galaxy: "**/folder/galaxy.yml"
  # - tasks: "**/tasks/*.yml"
  # - vars: "**/vars/*.yml"
  # - meta: "**/meta/main.yml"
  - yaml: "**/*.yaml-too"
 # List of additional collections to allow in only-builtins rule.
 # only_builtins_allow_collections:
 #   - example_ns.example_collection
 # List of additions modules to allow in only-builtins rule.
 # only_builtins_allow_modules:
 #   - example_module
--- a/.gitignore
+++ b/.gitignore
@ -1,6 +1,4 @@
-*.retry
+playbook.retry
 *.sw*
 .vagrant/
 *.log
 .idea/
 venv/
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@ -1,14 +0,0 @@
 repos:
 #- repo: https://github.com/semaphor-dk/dansabel
 #  rev: b72c70351d1a9e32a75db505fcb3aa414f3282f8
 #  hooks:
 #  - id: dansabel
 - repo: https://github.com/ansible/ansible-lint
  rev: v6.9.0
  hooks:
  - id: ansible-lint
    files: \.(yaml|yml)$
    additional_dependencies:
      - ansible
--- a/12
+++ b/12
@ -1,12 +0,0 @@
 init: create_venv install_pre_commit install_ansible_galaxy_modules
 create_venv:
 	python3 -m venv venv
 	venv/bin/pip install -U pip
 	venv/bin/pip install ansible pre-commit
 install_pre_commit:
 	venv/bin/pre-commit install
 install_ansible_galaxy_modules:
 	venv/bin/ansible-galaxy collection install community.general
--- a/README.md
+++ b/README.md
@ -1,108 +0,0 @@
 # data.coop infrastructure
 This repository contains the code used to deploy data.coop's services
 and websites. We use Ansible to encode our infrastructure setup. Only
 the association's administrators have access to deploy the services.
 ## Deploying
 To deploy the services, the included `deploy.sh` script can be used. The
 Ansible playbook uses two custom-made roles (in the `roles/` directory):
 - `ubuntu_base` - used to configure the host itself and install the
  necessary packages
 - `docker` - used to deploy our services and websites with Docker
  containers
 The script has options to deploy only one of the roles. Select services
 only can also be specified. By default, the script deploys everything.
 Here is a summary of the options that can be used with the script:
 ```sh
 # deploy everything
 ./deploy.sh
 # deploy the ubuntu_base role only
 ./deploy.sh base
 # deploy user setup only
 ./deploy.sh users
 # deploy the docker role only
 ./deploy.sh services
 # deploy SINGLE_SERVICE Docker service only
 ./deploy.sh services SINGLE_SERVICE
 ```
 `SINGLE_SERVICE` should match one of the service names in the `services`
 dictionary in `roles/docker/defaults/main.yml` (e.g. `gitea` or
 `data_coop_website`).
 ## Testing
 In order for us to be able to test our setup locally, we use Vagrant to
 deploy the services in a virtual machine. To do this, Vagrant and
 VirtualBox must both be installed on the development machine. Then, the
 services can be deployed locally by using the `vagrant` command-line
 tool. The working directory needs to be the root of the repository for
 this to work properly.
 > Note: As our secrets are contained in an Ansible Vault file, only the
 > administrators have the ability to run the deployment in Vagrant.
 > However, one could replace the vault file for testing purposes.
 Here is a summary of the commands that are available with the `vagrant`
 command-line tool:
 ```sh
 # Create and provision the VM
 vagrant up
 # Re-provision the VM
 vagrant provision
 # SSH into the VM
 vagrant ssh
 # Power down the VM
 vagrant halt
 # Power down and delete the VM
 vagrant destroy
 ```
 The `vagrant` command-line tool does not support supplying extra
 variables to Ansible on runtime, so to be able to deploy only parts of
 the Ansible playbook to Vagrant, the `deploy.sh` script can be used with
 the `--vagrant` flag. Here are some examples:
 ```sh
 # deploy the ubuntu_base role only in the Vagrant VM
 ./deploy.sh --vagrant base
 # deploy SINGLE_SERVICE Docker service only in the Vagrant VM
 ./deploy.sh --vagrant services SINGLE_SERVICE
 ```
 Note that the `--vagrant` flag should be the first argument when using
 the script.
 ## Contributing
 If you want to contribute, you can fork the repository and submit a pull
 request. We use a pre-commit hook for linting the YAML files before
 every commit, so please use that. To initialize pre-commit, you need to
 have Python and GNU make installed. Then, just run the following shell
 command:
 ```sh
 make init
 ```
 ## Nice tools
 - [J2Live](https://j2live.ttl255.com/): A live Jinja2 parser, nice to
  test out filters
--- a/40
+++ b/40
@ -1,38 +1,24 @@
-Vagrant.require_version ">= 2.0.0"
+Vagrant.require_version ">= 1.7.0"
 PORT = 19022
 def provisioned?(vm="default", provider="virtualbox")
  File.exist?(".vagrant/machines/#{vm}/#{provider}/action_provision")
 end
 Vagrant.configure(2) do |config|
  config.vm.network :private_network, ip: "192.168.56.10"
  config.vm.network :forwarded_port, guest: PORT, host: PORT
-  config.vm.box = "ubuntu/focal64"
+  config.vm.define "datacoop" do |datacoop|
-  config.vm.hostname = "datacoop"
+    datacoop.vm.box = "ubuntu/bionic64"
-
+    datacoop.vm.hostname = "datacoop"
-  config.vm.provider :virtualbox do |v|
+    datacoop.vm.provider "virtualbox" do |v|
-    v.cpus = 8
+      v.memory = 4096
    v.memory = 16384
    end
-
+    datacoop.vm.network "private_network", ip: "192.168.0.42"
-  config.vm.provision :ansible do |ansible|
+    datacoop.vm.provision "ansible" do |ansible|
      ansible.verbose = "v"
      ansible.compatibility_mode = "2.0"
      ansible.playbook = "playbook.yml"
      ansible.ask_vault_pass = true
-    ansible.verbose = "v"
+      ansible.host_vars = {
-
+        "datacoop" => {"ansible_python_interpreter" => "/usr/bin/python3.6"}
    # If the VM is already provisioned, we need to use the new port
    if provisioned?
      config.ssh.guest_port = PORT
      ansible.extra_vars = {
        ansible_port: PORT,
        from_vagrant: true
      }
-    else
+      ansible.groups = {
-      ansible.extra_vars = {
+        "all" => ["datacoop"]
        from_vagrant: true
      }
    end
  end
--- a/ansible.cfg
+++ b/ansible.cfg
@ -1,8 +1,2 @@
 [defaults]
 ask_vault_pass = True
 inventory = datacoop_hosts
 interpreter_python = /usr/bin/python3
 remote_user = root
 retry_files_enabled = True
 use_persistent_connections = True
 forks = 10
--- a/8
+++ b/8
@ -1,5 +1,3 @@
-[production]
+######################################
-hevonen.servers.data.coop ansible_port=19022
+### All hosts
-
+85.235.225.231 ansible_port=19022 ansible_python_interpreter=/usr/bin/python3
 [monitoring]
 uptime.data.coop
--- a/deploy.sh
+++ b/deploy.sh
@ -1,26 +1,6 @@
 #!/bin/sh
-usage () {
+BASE_CMD="ansible-playbook playbook.yml -i datacoop_hosts --ask-vault-pass"
    {
        echo "Usage: $0 [--vagrant]"
        echo "Usage: $0 [--vagrant] base"
        echo "Usage: $0 [--vagrant] users"
        echo "Usage: $0 [--vagrant] services [SERVICE]"
    } >&2
 }
 BASE_CMD="ansible-playbook playbook.yml"
 if [ "$1" = "--vagrant" ]; then
    BASE_CMD="$BASE_CMD --verbose --inventory=vagrant_host"
    VAGRANT_VAR="from_vagrant"
    shift
 fi
 if [ -z "$(ansible-galaxy collection list community.general 2>/dev/null)" ]; then
    echo "Installing community.general modules"
    ansible-galaxy collection install community.general
 fi
 if [ -z "$1" ]; then
    echo "Deploying all!"
@ -30,21 +10,10 @@ else
        "services")
            if [ -z "$2" ]; then
                echo "Deploying all services!"
-                eval "$BASE_CMD --tags setup_services $(test -z "$VAGRANT_VAR" || printf '%s' "$VAGRANT_VAR=true")"
+                $BASE_CMD --tags setup_services
            else
-                echo "Deploying service: $2"
+                echo "Deploying services: $2"
-                $BASE_CMD --tags setup_services --extra-vars '{"single_service": "'"$2"'"'"$(test -z "$VAGRANT_VAR" || printf '%s' ', "'"$VAGRANT_VAR"'": true')"'}'
+                $BASE_CMD --tags setup_services --extra-vars "services=$2"
            fi
        ;;
        "base")
            eval "$BASE_CMD --tags base_only $(test -z "$VAGRANT_VAR" || printf '%s' "$VAGRANT_VAR=true")"
        ;;
        "users")
            eval "$BASE_CMD --tags setup-users $(test -z "$VAGRANT_VAR" || printf '%s' "$VAGRANT_VAR=true")"
        ;;
        *)
            usage
            exit 1
        ;;
    esac
 fi
--- a/group_vars/all/secrets.yml
+++ b/group_vars/all/secrets.yml
@ -1,185 +1,54 @@
 $ANSIBLE_VAULT;1.1;AES256
-31303330643235313132323363306532616164646565636532646131386663633330333335353938
+62313439613039363637356330653731356138373839373435306535656137646266633764393537
-6632373337386339323566373163306435663562303663320a666438653936356335653534353464
+3737663637343865303232643632613934313137613536640a633634356338353764366365626266
-37373932623562326430396132316138373930383365313433646536343839636637386232306235
+66323064346539663435646265346665616465353363623732303563303838356364643734393231
-6566393031643037340a643463373163663062643932353931646366306566346230336362623561
+3161633362383363390a376530393463643838303238386139313661366335386439373734333835
-30323138333636343165666239393138653462396538386139376432346335373066363366613535
+63323034303732386430313265306465636630356330303431663761363461623530643933393831
-38623130333434386266393363306139333666393537663161626666323262646364636136393736
+62666438316266396432353663633331343137643265333966636436373730343938623732653030
-37656438373365353335633237326635636263653534353961396562646535303764613564306133
+62383536373139366239363535353463643961313839376436663830613738303262646639396131
-39373362343133643536383937386633373437333763636331663761646432663636373738373332
+66656532616231636537623162373965356537336436613130366464393461343730646664356466
-36383638363539663034303536636264336230636630636331336438333338356431666332313931
+38313439373332306265643039666532363863333364666233333861363832316637383432343464
-66653738656263613739333835366139633335643661373135396333346361343032303832353562
+64366536613364363265333938643438313837643936323536636335613064623639393437303466
-61376531343861656532626630623330336362373666343863373738306430616530373565663438
+31333539373130376230323964636335393166306662626131636462656632623635393036663437
-37373131646233656533633466356162326162616433613964616530393734336438326133373763
+37333735616665383431623266393365613433323335313161316161373637616563626637333861
-65663266313939363361396231663564663664393363373061646436653535663338336138373961
+37326532303638653139383639383166323361363334306361663261366661613038633464323337
-66303662323930376564313562376661336162316430316439313565633935323835386561356333
+31393538653830333865373064383837626261663163623664653938303230616334363861346132
-61393330333965633764633364366336646166353031613438373234333436326330336537643464
+63353036313164313265313134633861633937323335303830336232363939613635303764313063
-32383732336166303535393837353061353333386363356162323966336138363864663464356430
+33666161356366636139633138653736333662303364333838663033633163613136616639376532
-62396530393234666339346537616637323334383365663732663365653636383036616263303362
+31373131326264383666326566303930636166653463313630376235663638663937663765306439
-38623063623035616336346562396263336236376435386264336632336165336463613932383465
+31663039323663633735326266393263633937373339383537623835306431333636316664303864
-37323634633831363938616137373335653130303465383939303332333131363866303863383965
+63653564313339376135303237626366666164623738626439613562616338663539393635396437
-62333866333830666361613637333230363566333035366664353034303766633264643365343566
+30333036353035613131613034666262346233336563343531633033343163326264326563643235
-30326530383562633764643630363963646337363865343431353530353036616434363062313132
+62663538623532333432656435306462663362353630346133373262633630306262626362653733
-37393661326139613732636236633239653837333063646566653861643635363537386137393434
+65363031346339393632396664363362346236373035376632663466343034376566666563353231
-64616437363666653664303132666630376665646666323733376164653636623465623964336638
+36623538303262323265616237326630666662646634383962656533636165326665316366643231
-33623838616330353265333733343261356462613665653530333431343732646136346164626534
+39303465313135616238653664366637356361393165356430636137366236643938316430613838
-34343463646262623464613832393963633366353835393531653634623234393230343430666161
+65353331636564373136393930303537386335653766363632646433353962613033656434313063
-62306164616636616461306464333536333265313765326665626331363463363038393935653334
+35653365366332316434373665316230646665613166656230313832356136346439326232343166
-64646132393835656366643239303063333233303331373961346631633034343136623663666462
+38323934396561386138323739396166303132396234386435633965663139643234396434333163
-64306262636636346131333662626639323865343435373037306130366566343230656338626537
+66346634393330306638383430616433333361623861623864356563366162313830393334616138
-62336234373136326330306633306637326239356439326339373839383130623836383338373561
+32346633396662636633373637363262656165316434333139346530303562356236306637643365
-32646163616336623838373436303464643937333164643639623631393764623064626235303733
+65613361373637383936633431396636356634656333343537353762383537353035616131633732
-61633063303962343931333437313031653435636432393531393130336234613462343838366363
+38303736636136393039613537613831633139363338656239613261383637653332333737323034
-35383134303137633833363233376365666538333535306434373139333633386630636161636261
+61303839636330396139346436336663643531613364383134613061646136646236636364636662
-63373339386364326231366634303962636437353336346461336661396566623034306132326332
+33666564623731343264306638303333326463323363306439333762306434306235643530663931
-33633434326365353438313362616664393264633937393762336264633061313134656536363062
+63623932373737373539393230326538643739653734306131366365303638313263316635633439
-37303861663732336238386331363164363436363966393534613332393230666266616364303661
+34343231663761393266636537353330643361306139653734383466666662623931616665663239
-31323633656332643839616434313066643833616639353562386432663538366563633766393639
+65633136636333316266616433396166326333303033646162656466363931313539343035623666
-33636534363263633261323533666366366665323437346431653464646233303636366231626535
+63346162386533373334633261383237376330643738663761636166653033303933613630653835
-33373134333163373633313739626636303830383232616663636639646564643436313331643334
+66313439663732356539363833616338356337666335316136623231383161656362653561653565
-37663132343030666566333431633136653064626466626362373864613334663737326233313138
+33616437643533386263393733636666373237663132343432636664633535653535316134313266
-38336261663765633331393766333965613364306136333362626466623235303033396362346365
+66363362383662313632633535613635656364323939313466303634646237653061353766373831
-36633963333561366265633633303262393832336364333365313336383066363065316133303634
+62303366366564653231613863633564303637346262336535386366663034663832663762666132
-65363037646566323831363365653937623966323735353439353339616439306534663831653663
+64333630666463653266333430386135386436643939393964303230366538336562333737616639
-34623537666435313661326631326235313130363938643635666531636165306539663630366265
+65646566663363313430396132653832646263393739656564653138353637373362613261366230
-65323234613133663337363466336663633464316361656564326136633064373365373239363662
+62616561303735316230626134353266613938326563326232623361656364623062326365343534
-37323834633163653938633435323763333539396532393664653162643832646535353262336631
+62346433373965336430326632333634306463343934393830393165393933323439393534386665
-61386237663136336338663165613238663035386361643135333361383666643432396363363132
+32373235353037626638343066386563663431356465353039353338643835653166333761386433
-66323832643339346534373066326333396232386166383161383764633338373533623236346366
+64333338306661346436373238646134653233666565653834303935303235653661343366653563
-33373138303864323532363761313762376439343130316432613933353033363536336337363566
+63356566633730303033376230356363326561663232386161333566616334623236663562613234
-31396133663330323665313033656436396238623630633465313734343063633537323939356337
+63646561623565366332313837353461313566653531356662613663323065613035323731323832
-62306364633765323834333836316161366531643763333434383062363032653164353037336562
+31386166623935373139356239353037633363313531396466363735613332653430396161303366
-61653332333062643362386665633665306662356532653031383365356632643861363038383137
+37376238333831306231393433313734303839376132656532616461356662383430303532373937
-36326666356231396433363538666131353839353366323934343532306532633866623733663138
+39303634303762373736626439323830353665343162363531376134616466303762633535343866
-33376665333430653533383439373463323661666165333636353434643739386363356536333837
+3162
 39313365643039386638623731386635363632376139666638643734303035386564376136656537
 39356162346164313839373931653139386464653232633339616166306235323232336139306538
 32623135666535633462613430646637313030343933653461333230656564396663653364633238
 30336161323431323337636135323539663466323637313366376535666132663662356239366339
 66373830336132336439653637366664656230323834623039306337636433663931373138616466
 30616437376435643535303237313831383534656634353265386565376564623431616263643334
 65613633656533646138663138393831623330363635313662653264646636396461326664633362
 38633765316333373363616563346230393866363365623862333162306263613938373663633963
 31363639613238316334333437326631353830383734393765303037346436343036386437653637
 32636139313464383264376663393730363038343831336565663565383135653139663765303239
 31653036623138316566666461313665663462383662343461353332366634666437363263373864
 30323564343934386666666338373238383333303939626237363131346261386562663566323365
 37316563653231346336343166646661393431363739346237303161363838613237666533353034
 64623435376462613961326333393930346663353737386130346461616638363639386364313266
 34353465326632356233343633636331343638333937303562356133363432323939633865316630
 33353539653162333734653338363764313439376439656435313932626431313930346662633838
 39636463393861396531633833343264393339323133316566356562613932663131633631303065
 31323937663764613563333736313733326639643961653161303237353165343939666461396263
 34323136356632336138643162326163653331616561626263616132393734396237666434326264
 65653837383063306436643466383964386661643336343230393436326139313963633036613065
 31393930386463626131653565393932386462313236623531616235393064656237663837346539
 34333730666337353537613564363531363831323035353532363366363731306335316138366361
 37353438326130366439303136356636653030666464366436366566626464626262663838393462
 34626662396239636536666433636436316535363539636261343131313430613765353836643133
 38653839336663353663313535633231363765636633666363386561303039313438353838643561
 32643131623162386661653464623461623434313733643564343435386636326531633136306139
 38613937336132653238616561356338303264393962306431356463613764613364363738323366
 31326562613764386533353135643737323161616363656362326262653765353764626166363338
 34646231633764383962326135323164326565343034656430326531653231666633666465336231
 62366635356566613766643832386234383766363236306638623133643036643662396430623330
 31396239366338656565346563313430353463366465373534636536393131303166333263613663
 36393864663636333666396566303638646166346665303765343531313661376632623137613131
 32653031343861363831646635356232353836363536613834343663326261623262336336393838
 35623638636538626566353864343362633264366435383633333562366365326432663839613934
 34323466396565303963333531346362363338623537343439666265353332303230356533323834
 61333838356665653138346337336532333931616432353936306261356537663036643064333964
 39643065303032393932323136363264316264386131353035383933386535303632613033633363
 66346437333465653633626235336336353738343036326265376162383163326530373032663335
 66643663666166366165396137383133396635336237343161303666393437303538316661336335
 32396434323532303238303538303864393031303832346161303535386461666161316565646539
 37303261336435323139663962316562346265343064346562393633616666653066623466316634
 61346263366161366232386138666131323162333031623533303739646336623864613333323662
 35363539646433323430313839633363393936356438313037613434663161653964366635363464
 62643539393631386531313966643339383865623065393936666235653035376139656663616336
 65663136326466616161376232316463643834356531336362336163343637326238663836363734
 30363032653962306530633562636161396634363131633065326433363136316666633738343966
 66303939383232373738373965393934653439396666623039353933633935393731653839623737
 35376338363338306332353539313664303962353064306434323530623161323064633766643035
 38363234343036616335393461643964386664616134313831663565633366616633626266393937
 31623435646138646131356164313936656639393532343630663933613066333432666132363338
 30356136303763376465396637613565386661333265633636643435313035313064383936306437
 39626265643862313435343465643063656266373035356538393262363561356433323134333537
 66663233313832326136366163623337373835663961313938636134613933663534333730333761
 39313334346364623431646439386162633961316161393636656139303966626265623035366335
 66666634363036326631376562623039303961663136366461313637343932303338356334383139
 38383133306436303261643535353532383538613764616233363864656665633264623236623537
 31353335343064626465626130356433366531306338623830623139316462316662633665663164
 38363363656237326239633930623862663230623464663031363463356133626166353433633535
 63343231326438383535356235343530393361636465363933356164323565326566303034383466
 63323136643835623563393666333030656534333565316466333266663365346561363937336665
 32323637366138303233373565333932626435306130633064656336623764366130323534333039
 64613934383530343036343334396439373066326264353638353462613266663935343436353130
 38616238313133363732343634663962666435656330396536643836326636373032623734353832
 32313064663164626534336363376131656438623035646263666336633862613833323565656437
 63616463613732663966643039653761633231616462363761336231313335363165646134356137
 38633963393264653139356333626534303936326563326433363164623131393562393533383564
 62646532643366376333373364646139363635323034613262386265383066303365323134633836
 66666536653264393138326436393037373537393561613864343730366135353166633765323938
 38306562326238613331343337306239376165636562666433356266313030613136656162646166
 36303966373931363463383631386136313262633136383637626562353336306465613435336434
 32303136393638396233393232386534643733626539653961366637316135373439386432643264
 63663837306461376461306664366538396436386234366638626263303735323661393839343938
 36393264306132313130326435636266643363616438613538303530306434636331333033323138
 39656337666635363263316363363133616538356336646337373762613666323663656665383733
 31623433396466383939306666373562303330373731323864363266323261383736353465633662
 38356130353233663161623139653465646238363630643239386634623262303836333232303239
 61313930346263643565333534373430653430363965373037646639633638333861346262373433
 65346133636162396332373130356238346438626330373163326632323137333862373436363133
 37373663396461613062616664336662373432383863333536366465313838333835653966353661
 38343336316136316532613661306336636131653236663336396638316136626434303533323365
 38356534353530633766646466663266613735396333386263356662613939373030396436363530
 38333939623534356266323237623835373038663534616532326665346631616665616665666663
 33633266333630646563363637666562336339393138326435373836336566346661646464613730
 39616438373062656130393134353535313232376266386262623862383162366662626231373338
 37373561376435323361316337636239366263656336303636346436373363663164343333656538
 32633835353436623565393538643563646630366633343632633532396433616139303766666435
 30373235373262633134383033363137316366316563613662313437663832356165353661666533
 63343138393230333335323938666566623365623762643563633036613339636537366264333138
 62656265363261663233396266616466333332633266326661373736353135383563313666633765
 37316430633763326438326263643766396137363333353035623036346662303834376463613162
 30363938396638336565303535663831326135393061383634646430343931373135636638333866
 64623032366163386530313563656266376334343835366665633362643339643534643738373839
 34323134636330383963353439376436323530373066623435376230306435333832633964653639
 39373235353262383864303430336635393435656430646233613461306135643230666437393361
 36616134356461616534646535396338656138616636396538373031626136323264323936366633
 61373631306538363437323934316434663735323533656364393135613761326337303833383934
 37383162356162373737336666663430343334356532333335363463623238643662333232333336
 31376639386632626161303232653363626637376630333733343035323539623463626132373763
 36613535623064636163643236383336653934663739326264653362333237303237393335613339
 30323030353632613434393636336562363064306332663931393061393964393661363163326632
 37353434656464333532343263363961613866643338396335656131373134333665353437613837
 37336533366635616138366566666635366634613633616533373966336637303334613731316436
 66376565643033383162373166373665633362313164643530356561383630343531346436343663
 62313836323530623535356532303362333436643434663131653539646331346535666133336162
 37653036376165333364373661386262633030363165353638386139646266623365306338383963
 36373732356364333166386566653835663466346630356438323866636564663966363832613862
 64623831646261333064663939613763323466336431343861386537633337396637383330333633
 32636436343564633365616331626465613163333465373961656631373736373430396633393733
 64386534353131666438346362376462636331353761636535663234613731356130666534323735
 35636162323234386435646132396366326165663234653637363139303162613832346333383665
 64323737306634613530633636643761346461326130663234373363326230616331336430353261
 38346630356136333966656562343730356234643537323635653532396337373331363537393662
 33373862336232623563636436643239623837623862386638353361383830303365333362353665
 33666236363035616363326462376337363736333234613133383636396464306236386238333863
 39316237326638663535646361393939393938656335653262633063326132663331343235626364
 35366532333161343562383763653130306235633934393066356239653565633962343235643036
 62333363323065663137393736383964613061393131376637363031393335306534626230383139
 35333437613963386664646336383637323534366635336264333039643861396561373461636439
 30323831333335393365383834386138626664653531333830363862363330346466646432656663
 62383534343131636331353763356166386339303564353035383466353636636335653333383431
 30616133383565623430326534396432376331636161393930366263366539343332666631616530
 36383937313164663631626163646339623365653937616634656235303039636439646335616561
 31623135366136333766663833333932383032343438376336366533636466353666633437353338
 33386166386231353430646665323164363961666538343537313734343465366333383763666666
 33326363656134613031393033646435333937353865316161626137633939333934316536643830
 37386364356233353964326661386564656132643937366665353139653533336331323138356633
 35656562663961343238386132636331636439383236383761306337626262303764656431303964
 62646133323361643162313231376633663231313833633964613862353265336538633261643834
 62353230316334363363343133626530643832356631353937353334613538616366396438383338
 39336366623332363966383535373365666263383231356532346533386262643465306430336462
 64623764333861663031
--- a/group_vars/all/secrets.yml.contents
+++ b/group_vars/all/secrets.yml.contents
@ -1,62 +0,0 @@
 # These are the variables contained in secrets.yml
 # Secrets are usually 32 characters or more, matching [a-Z0-9]
 ---
 postgres_passwords:
  nextcloud: xxx
  passit: xxx
  gitea: xxx
  matrix: xxx
  mailu: xxx
  keycloak: xxx
  hedgedoc: xxx
  mastodon: xxx
  rallly: xxx
  membersystem: xxx
 ldap_admin_password: xxx
 ldap_config_password: xxx
 passit_secret_key: xxx
 docker_password: xxx
 mailu_secret_key: xxx
 nextcloud_secrets:
  redis_password: xxx
 drone_secrets:
  oauth_client_id: xxx
  oauth_client_secret: xxx
  rpc_shared_secret: xxx
 restic_secrets:
  repository_password: xxx
  ssh_privkey: xxx
  uptime_kuma_url: xxx
 matrix_secrets:
  registration_shared_secret: xxx
  macaroon_secret_key: xxx
  form_secret: xxx
 keycloak_secrets:
  admin_user: xxx    # used for setting up the initial admin user on first run
  admin_password: xxx
 mastodon_secrets:
  secret_key_base: xxx
  otp_secret: xxx
  vapid_private_key: xxx
  vapid_public_key: xxx
 rallly_secrets:
  secret_password: xxx
 membersystem_secrets:
  secret_key: xxx
  stripe_api_key: xxx
  stripe_endpoint_secret: xxx
 diun:
  matrix_password: xxx
--- a/group_vars/all/vars.yml
+++ b/group_vars/all/vars.yml
@ -1,35 +1,17 @@
 # vim: ft=yaml.ansible
 ---
 users:
-  - name: graffen
+  graffen:
    comment: Jesper Hess Nielsen
-    password: '!'
+    key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCbxFVukt5TIzoB0HX2q8b8lHJmXD1juzsWOu5XkexVDlCsvupa1cZ/OVkrIEAbDKk6RmJQj0TJ2O5+v9hbf0TDi0Pi+V8ADZIgO+OW5a4EeXsU72a4CN0nEocQhUPfQuC4IU+F7icoG2/I9jXg7U6p1LhBr8vlC3cNHnrH3yqrakrUR51/iRVIwo4FKvQg7jutaKTyOjlYa1uTdaczvAzNHWEdytCQgFnkzpR9fHvzkA79qHUD9n32rIpJicRJsHY3NnyDGfBcDv+4sLq15sM9jN83duGnSuMMtZgfSriwMUd/UwVReU2ZKxjMLe3WHB7+ZE/p39OJk/gjVfWJVh/za1/teTAwaLLmxh/HFt+AVYWkCj22fUxscl0dh2zy6Ki1Ua3ApChn6v6Gvng6khobFlxawSJZ49+0KoAl1qqFMR1o9EGWvqgDPuITAqJFN+ik0jxcxfmKrG3mbOYM1ikhJd0ER8wbS8e6NowHUBV7PUyDqxP5VM2gum58IYrDqaP2RYYi9vWWnXJJA8J1t+Wp3bF7fdktyVgkd7HQk02uVkxdMQQ802GCrQQuvJhWTCzrgkgrjPY8p0KcbCNt6jYQOUKV0T2vp6PbTJ5XWKb5u7gVXW1xiP9dYzgAr0DroiTK4xIuF80mv1Rfst0ceHAIQVcQ3GcGbh000QUYzbHT2Q== openpgp:0x265EE03C (Graffen)
-    groups: []
+    password: $6$6bgPWZ76LvB$DZ3ipFsFtL2b1nSC0AQ63k8ibJidyIE9iIsWWzY0fux0ynz9L/o7b2sR2XYSaDuG.jewFV36IGStTF3NCZRC30
-    ssh_keys: []
+    groups:
      - sudo
-  - name: valberg
+  valberg:
    comment: Vidir Valberg Gudmundsson
    key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUmGeHc6QXDcJHkmVxbTUv04Q3vs20avquoGr6eOkkvYbcgjuFnBOOtvs2Nul1odcvvnHa1nN7DfL8XJamiwsB1B/xe2seaNS1axgwk9XowlVN9pgga8gsC+4gZWBtSObG2GR8n4NtPENzPmW5deNn8dRpTvULPMxZ0VRE9yNQOx8v8w85yYh+vxbbkWGVDYJU23yuJI50U9y6bXxNHinsACDFBeR/giXDlw29TaOaSxz0R6zrRPBoX+V68RyWwBL+KWQKtX2ULtJI40S98Ohd6p41bIxYHCBS/zroqNne8PjYOLcHHsjHUGfTvhcS5a3zdz/iHsvsaOOjFjsydAXH valberg
    password: $6$qt3G.E.CxhC$OwBDn4rZUbCz06HLEMBHjgvKjxiv/eeerbklTHi.gpHIn1OejzX3k2.0NM0Dforaw6Yn5Y8Cgn8kL2FdbQLZ3/
    groups:
      - sudo
    ssh_keys:
      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUmGeHc6QXDcJHkmVxbTUv04Q3vs20avquoGr6eOkkvYbcgjuFnBOOtvs2Nul1odcvvnHa1nN7DfL8XJamiwsB1B/xe2seaNS1axgwk9XowlVN9pgga8gsC+4gZWBtSObG2GR8n4NtPENzPmW5deNn8dRpTvULPMxZ0VRE9yNQOx8v8w85yYh+vxbbkWGVDYJU23yuJI50U9y6bXxNHinsACDFBeR/giXDlw29TaOaSxz0R6zrRPBoX+V68RyWwBL+KWQKtX2ULtJI40S98Ohd6p41bIxYHCBS/zroqNne8PjYOLcHHsjHUGfTvhcS5a3zdz/iHsvsaOOjFjsydAXH valberg
      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4FRrbTpxwGdlF6RVi/thJaMlaEE0Z9YCQA4Y+KnHbBoVWMjzgbIkSWw3MM+E/iiVnix8SFh4tjDSdFjb8lCvHt/PqhMFhZJ02vhVgSwyU+Ji5ur23i202LB9ua54NLN4kNG8K47U0tKi2/EV6LWl2QdRviAcOUctz6u9XDkkMLUgPEYH384XSTRRj4GJ8+0LRzB2rXqetH3gBe9v1vlv0ETYWvzTnpfZUxcrrqEGtXV9Wa0BZoWLos2oKOsYVjNdLZMoFpmyBxPnqzAi1hr7beblFZKqBkvD7XA9RnERbZn1nxkWufVahppPjKQ+se3esWJCp6ri/vNP4WNKY3hiIoekBLbpvGcP1Te7cAIQXiZOilN92NKKYrzN2gAtsxgqGZw7lI1PE71luGdPir2Evl6hPj6/nnNdEHZWgcmBSPy17uCpVvZYBcDDzj8L3hbkLVQ3kcLZTz6I8BXvuGqoeLvRQpBtn5EaLpCCOmXuKqm+dzHzsOIwh+SA5NA8M3P0=
-  - name: reynir
+volume_root_folder: "/docker-volumes"
    comment: Reynir Björnsson
    password: $6$MiPv.ZFlWnLHGNOb$jdQD9NaPMRUGaP2YHRJNwrMPBGl9qwK0HFhI6x51Xpn7hdzuC4GIwvOw1DJK33sNs/gGP5bWB0izviXkDcq7B0
    groups:
      - sudo
    ssh_keys:
      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDJl8/rikIUnqr9fPF3rE0rjWHCNzte10LvkjGmpdO9ka/NubQ7O25fp08rC+n0d1pUooYwHBAgiv9Hsql6HF9QfNKNUp7IKp7CXWcjb4ga02kuzWGSXjm40Vf0jSadIrJ33M4SeJHTByDGoeYPQBQ7n+qHdwcqJADBQygBuc5sRzxm8i0sbmzF3DJDDVeTJjEY5pfR4vnJlpmU8SC2d1ZkhCjmKCsL0PShntTIt1ztCt0yO71KoHKaNPu1jutGxcU9u7J1pEqcPT6EzU/cQJ4DMVzrGp26nIV0msRl3NeGNjukwXOzAh6KmsmXG7yWFyQmLRqgc/bjUeyhuWJ10vwUbaYVeIef7YrgEOgnkYLIFeWRMhdnwtL/W8g1D66SFx7+iYJj180eTi8Lc8rZm2NaiGynvWlFcJ4PGdTYZsWcFzQ+SaDziNMw1H3IixxdlD8Shw9mxpijJ+A4dH2kkUXyGVsc13zRIU7hq9ax8nrw6HVLGFLn09rEPig+SkyWrqRpRGMBWyqTRJywIV6jk0ll+i8rJZA2McY0rABbACrzXT5VBj5dLKnnRITLDicAYgt7YuEiQ0ffErQrPXXHUVeI0QKnJgplSHxH5QsX9a1Y+NoaoditdMT2bjvEqROi+/JYRycLR/BQV/d2nFPhqwq1x1AFvL4f8UvVH/hxp3PXWw== reynir yubikey
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPR8t/wNRp7Dt3wr9uZKVTofTDVYrcoQNru5ETxL+37t reynir@spurv
  - name: samsapti
    comment: Sam Al-Sapti
    password: $6$18dN367fG162hQ9A$Aqkf3O24Ve1btzh1PPOPg3uyydv/AQYUxethcoB4klotebJq3/XsydYT7XBuarxfDccVwyPTMlsP3U8VfQpG60
    groups:
      - sudo
    ssh_keys:
      - sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIFWZGLov8wPBNxuvnaPK+8vv6wK5hHUVEFzXKsN9QeuBAAAADHNzaDpzYW1zYXB0aQ== ssh:samsapti
      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPd/4fQV7CL8/KVwbo/phiV5UdXFBIDlkZ+ps8C7FeRf cardno:14 336 332
--- a/playbook.yml
+++ b/playbook.yml
@ -1,27 +1,36 @@
 # vim: ft=yaml.ansible
 ---
- hosts: production
+- hosts: all
-  gather_facts: true
+  gather_facts: False
  become: true
  vars:
    base_domain: data.coop
    letsencrypt_email: bestyrelsen@data.coop
    ldap_dn: "dc=data,dc=coop"
-    vagrant: "{{ from_vagrant is defined and from_vagrant }}"
+    services:
-    letsencrypt_enabled: "{{ not vagrant }}"
+      - nginx-proxy
      - openldap
      - thelounge
      - nextcloud
      - fider
      - passit
      - gitea
      - postfix
      - matrix_riot
      - privatebin
      - codimd
      - netdata
      - docker_registry
      - drone
      - websites
      - ouroboros
      - mailu
-    base_domain: "{{ 'datacoop.devel' if vagrant else 'data.coop' }}"
+    smtp_host: postfix
-    letsencrypt_email: "admin@{{ base_domain }}"
+    smtp_port: 587
    smtp_host: "postfix"
    smtp_port: "587"
    services_exclude:
      - uptime_kuma
  tasks:
    - import_role:
        name: ubuntu_base
      tags:
        - base_only
    - import_role:
        name: docker
--- a/roles/docker/defaults/main.yml
+++ b/roles/docker/defaults/main.yml
@ -1,229 +1,64 @@
-# vim: ft=yaml.ansible
+nginx:
 ---
 volume_root_folder: "/docker-volumes"
 volume_website_folder: "{{ volume_root_folder }}/websites"
 services:
  ### Internal services ###
  postfix:
    domain: "smtp.{{ base_domain }}"
    volume_folder: "{{ volume_root_folder }}/postfix"
    pre_deploy_tasks: true
    version: "v3.6.1-alpine"
  nginx_proxy:
  volume_folder: "{{ volume_root_folder }}/nginx"
    pre_deploy_tasks: true
    version: "1.3-alpine"
    acme_companion_version: "2.2"
-  openldap:
+ldap:
  domain: "ldap.{{ base_domain }}"
  volume_folder: "{{ volume_root_folder }}/openldap"
    pre_deploy_tasks: true
    version: "1.5.0"
    phpldapadmin_version: "0.9.0"
-  netdata:
+thelounge:
-    domain: "netdata.{{ base_domain }}"
+  domain: "irc.{{ base_domain }}"
    volume_folder: "{{ volume_root_folder }}/netdata"
    version: "v1"
-  portainer:
+nextcloud:
    domain: "portainer.{{ base_domain }}"
    volume_folder: "{{ volume_root_folder }}/portainer"
    version: "2.19.0"
  keycloak:
    domain: sso.{{ base_domain }}
    volume_folder: "{{ volume_root_folder }}/keycloak"
    version: "22.0"
    postgres_version: "10"
    allowed_sender_domain: true
  restic:
    volume_folder: "{{ volume_root_folder }}/restic"
    pre_deploy_tasks: true
    remote_user: dc-user
    remote_domain: rynkeby.skovgaard.tel
    host_key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBLGol2G+a87ssy0nu/STKBZSiGyhZhZKx/ujfe9IeFo
    repository: restic
    version: "1.7.0"
    disabled_in_vagrant: true
    # mail dance
    domain: "noreply.{{ base_domain }}"
    allowed_sender_domain: true
    mail_from: "backup@noreply.{{ base_domain }}"
  docker_registry:
    domain: "docker.{{ base_domain }}"
    volume_folder: "{{ volume_root_folder }}/docker-registry"
    pre_deploy_tasks: true
    post_deploy_tasks: true
    username: "docker"
    password: "{{ docker_password }}"
    version: "2"
  ### External services ###
  nextcloud:
  domain: "cloud.{{ base_domain }}"
    volume_folder: "{{ volume_root_folder }}/nextcloud"
    pre_deploy_tasks: true
    version: 28-apache
    postgres_version: "10"
    redis_version: 7-alpine
    allowed_sender_domain: true
-  forgejo:
+gitea:
  domain: "git.{{ base_domain }}"
-    volume_folder: "{{ volume_root_folder }}/forgejo"
+  volume_folder: "{{ volume_root_folder }}/gitea"
    version: "7.0.5"
    allowed_sender_domain: true
-  passit:
+passit:
  domain: "passit.{{ base_domain }}"
    volume_folder: "{{ volume_root_folder }}/passit"
    version: stable
    postgres_version: 15-alpine
    allowed_sender_domain: true
-  matrix:
+fider:
  domain: "feedback.{{ base_domain }}"
 matrix:
  domain: "matrix.{{ base_domain }}"
  volume_folder: "{{ volume_root_folder }}/matrix"
    pre_deploy_tasks: true
    version: v1.114.0
    postgres_version: 15-alpine
    allowed_sender_domain: true
-  element:
+riot:
-    domain: "element.{{ base_domain }}"
+  domain: "riot.{{ base_domain }}"
-    volume_folder: "{{ volume_root_folder }}/element"
+  volume_folder: "{{ volume_root_folder }}/riot"
    pre_deploy_tasks: true
    version: v1.11.80
-  privatebin:
+privatebin:
  domain: "paste.{{ base_domain }}"
  volume_folder: "{{ volume_root_folder }}/privatebin"
    pre_deploy_tasks: true
    version: "20221009"
-  hedgedoc:
+codimd:
  domain: "pad.{{ base_domain }}"
-    volume_folder: "{{ volume_root_folder }}/hedgedoc"
+  volume_folder: "{{ volume_root_folder }}/codimd"
    pre_deploy_tasks: true
    version: 1.9.9-alpine
    postgres_version: 10-alpine
-  data_coop_website:
+netdata:
  domain: "netdata.{{ base_domain }}"
 docker_registry:
  domain: "docker.{{ base_domain }}"
  volume_folder: "{{ volume_root_folder }}/docker-registry"
  username: "docker"
  password: "{{ docker_password }}"
 data_coop_website:
  domain: "{{ base_domain }}"
    www_domain: "www.{{ base_domain }}"
    volume_folder: "{{ volume_website_folder }}/datacoop"
    pre_deploy_tasks: true
    version: stable
    staging_domain: "staging.{{ base_domain }}"
    staging_version: staging
-  slides_2022_website:
+cryptohagen_website:
-    domain: "2022.slides.{{ base_domain }}"
+  domain: "cryptohagen.dk"
    volume_folder: "{{ volume_website_folder }}/slides-2022"
    version: latest
-  fedi_dk_website:
+drone:
    domain: fedi.dk
    volume_folder: "{{ volume_website_folder }}/fedidk"
    version: latest
  vhs_website:
    domain: vhs.data.coop
    volume_folder: "{{ volume_website_folder }}/vhs"
    version: latest
  cryptohagen_website:
    domains:
      - "cryptohagen.dk"
      - "www.cryptohagen.dk"
    volume_folder: "{{ volume_website_folder }}/cryptohagen"
  ulovliglogning_website:
    domains:
      - "ulovliglogning.dk"
      - "www.ulovliglogning.dk"
      - "ulovlig-logning.dk"
      - "www.ulovlig-logning.dk"
    volume_folder: "{{ volume_website_folder }}/ulovliglogning"
  cryptoaarhus_website:
    domains:
      - "cryptoaarhus.dk"
      - "www.cryptoaarhus.dk"
    volume_folder: "{{ volume_website_folder }}/cryptoaarhus"
  drone:
  domain: "drone.{{ base_domain }}"
  volume_folder: "{{ volume_root_folder }}/drone"
    version: "1"
-  mailu:
+mailu:
  domain: "mail.{{ base_domain }}"
    volume_folder: "{{ volume_root_folder }}/mailu"
    pre_deploy_tasks: true
  dns: 192.168.203.254
  subnet: 192.168.203.0/24
-    version: "2.0"
+  volume_folder: "{{ volume_root_folder }}/mailu"
    postgres_version: 14-alpine
    redis_version: alpine
  mastodon:
    domain: "social.{{ base_domain }}"
    volume_folder: "{{ volume_root_folder }}/mastodon"
    pre_deploy_tasks: true
    post_deploy_tasks: true
    version: v4.2.10
    postgres_version: 14-alpine
    redis_version: 6-alpine
    allowed_sender_domain: true
  rallly:
    domain: "when.{{ base_domain }}"
    volume_folder: "{{ volume_root_folder }}/rallly"
    pre_deploy_tasks: true
    version: "2"
    postgres_version: 14-alpine
    allowed_sender_domain: true
  membersystem:
    domain: "member.{{ base_domain }}"
    django_admins: "Vidir:valberg@orn.li,Balder:benjaoming@data.coop"
    volume_folder: "{{ volume_root_folder }}/membersystem"
    version: latest
    postgres_version: 13-alpine
    allowed_sender_domain: true
  writefreely:
    domain: "write.{{ base_domain }}"
    volume_folder: "{{ volume_root_folder }}/writefreely"
    pre_deploy_tasks: true
    version: v0.15.0
    mariadb_version: "11.2"
    allowed_sender_domain: true
  watchtower:
    volume_folder: "{{ volume_root_folder }}/watchtower"
    version: "1.5.3"
  diun:
    version: "4.28"
    volume_folder: "{{ volume_root_folder }}/diun"
    matrix_user: "@diun:data.coop"
    matrix_room: "#datacoop-services-update:data.coop"
  ### Uptime monitoring ###
  uptime_kuma:
    domain: "uptime.{{ base_domain }}"
    status_domain: "status.{{ base_domain }}"
    volume_folder: "{{ volume_root_folder }}/uptime_kuma"
    pre_deploy_tasks: true
    version: "latest"
 services_exclude: []
 services_include: "{{ services | dict2items | map(attribute='key') | list | difference(services_exclude) }}"
--- a/roles/docker/files/configs/docker_registry/nginx.conf
+++ b/roles/docker/files/configs/docker_registry/nginx.conf
--- a/roles/docker/files/configs/matrix/vhost-matrix
+++ b/roles/docker/files/configs/matrix/vhost-matrix
@ -0,0 +1 @@
 listen 8008;
--- a/roles/docker/files/configs/matrix/vhost-root
+++ b/roles/docker/files/configs/matrix/vhost-root
--- a/roles/docker/files/configs/privatebin-conf.php
+++ b/roles/docker/files/configs/privatebin-conf.php
--- a/roles/docker/templates/element/config.json.j2
+++ b/roles/docker/templates/element/config.json.j2
@ -1,13 +1,7 @@
 {
-    "default_server_config": {
+    "default_hs_url": "https://{{ matrix.domain }}",
-        "m.homeserver": {
+    "default_is_url": "https://vector.im",
-           "base_url": "https://{{ services.matrix.domain }}"
+    "brand": "riot.data.coop",
        },
        "m.identity_server": {
           "base_url": "https://vector.im"
        }
     },
    "brand": "element.data.coop",
    "integrations_ui_url": "https://scalar.vector.im/",
    "integrations_rest_url": "https://scalar.vector.im/api",
    "integrations_widgets_urls": [
@ -37,7 +31,7 @@
        ]
    },
    "enable_presence_by_hs_url": {
-        "https://{{ services.matrix.domain }}": false
+        "https://{{ matrix.domain }}": false
    },
    "terms_and_conditions_links": [
        {
--- a/roles/docker/files/configs/riot/riot.im.conf
+++ b/roles/docker/files/configs/riot/riot.im.conf
--- a/roles/docker/files/configs/thelounge.js
+++ b/roles/docker/files/configs/thelounge.js
@ -0,0 +1,511 @@
 "use strict";
 module.exports = {
        //
        // Set the server mode.
        // Public servers does not require authentication.
        //
        // Set to 'false' to enable users.
        //
        // @type     boolean
        // @default  false
        //
        public: false,
        //
        // IP address or hostname for the web server to listen on.
        // Setting this to undefined will listen on all interfaces.
        //
        // For UNIX domain sockets, use unix:/absolute/path/to/file.sock.
        //
        // @type     string
        // @default  undefined
        //
        host: undefined,
        //
        // Set the port to listen on.
        //
        // @type     int
        // @default  9000
        //
        port: 9000,
        //
        // Set the local IP to bind to for outgoing connections. Leave to undefined
        // to let the operating system pick its preferred one.
        //
        // @type     string
        // @default  undefined
        //
        bind: undefined,
        //
        // Sets whether the server is behind a reverse proxy and should honor the
        // X-Forwarded-For header or not.
        //
        // @type     boolean
        // @default  false
        //
        reverseProxy: false,
        //
        // Set the default theme.
        // Find out how to add new themes at https://thelounge.github.io/docs/plugins/themes.html
        //
        // @type     string
        // @default  "example"
        //
        theme: "example",
        //
        // Prefetch URLs
        //
        // If enabled, The Lounge will try to load thumbnails and site descriptions from
        // URLs posted in channels.
        //
        // @type     boolean
        // @default  false
        //
        prefetch: false,
        //
        // Store and proxy prefetched images and thumbnails.
        // This improves security and privacy by not exposing client IP address,
        // and always loading images from The Lounge instance and making all assets secure,
        // which in result fixes mixed content warnings.
        //
        // If storage is enabled, The Lounge will fetch and store images and thumbnails
        // in the `${THELOUNGE_HOME}/storage` folder.
        //
        // Images are deleted when they are no longer referenced by any message (controlled by maxHistory),
        // and the folder is cleaned up on every The Lounge restart.
        //
        // @type     boolean
        // @default  false
        //
        prefetchStorage: false,
        //
        // Prefetch URLs Image Preview size limit
        //
        // If prefetch is enabled, The Lounge will only display content under the maximum size.
        // Specified value is in kilobytes. Default value is 2048 kilobytes.
        //
        // @type     int
        // @default  2048
        //
        prefetchMaxImageSize: 2048,
        //
        // Display network
        //
        // If set to false network settings will not be shown in the login form.
        //
        // @type     boolean
        // @default  true
        //
        displayNetwork: true,
        //
        // Lock network
        //
        // If set to true, users will not be able to modify host, port and tls
        // settings and will be limited to the configured network.
        //
        // @type     boolean
        // @default  false
        //
        lockNetwork: false,
        //
        // Hex IP
        //
        // If enabled, clients' username will be set to their IP encoded has hex.
        // This is done to share the real user IP address with the server for host masking purposes.
        //
        // @type     boolean
        // @default  false
        //
        useHexIp: false,
        //
        // WEBIRC support
        //
        // If enabled, The Lounge will pass the connecting user's host and IP to the
        // IRC server. Note that this requires to obtain a password from the IRC network
        // The Lounge will be connecting to and generally involves a lot of trust from the
        // network you are connecting to.
        //
        // Format (standard): {"irc.example.net": "hunter1", "irc.example.org": "passw0rd"}
        // Format (function):
        //   {"irc.example.net": function(client, args, trusted) {
        //       // here, we return a webirc object fed directly to `irc-framework`
        //       return {username: "thelounge", password: "hunter1", address: args.ip, hostname: "webirc/"+args.hostname};
        //   }}
        //
        // @type     string | function(client, args):object(webirc)
        // @default  null
        webirc: null,
        //
        // Log settings
        //
        // Logging has to be enabled per user. If enabled, logs will be stored in
        // the 'logs/<user>/<network>/' folder.
        //
        // @type     object
        // @default  {}
        //
        logs: {
                //
                // Timestamp format
                //
                // @type     string
                // @default  "YYYY-MM-DD HH:mm:ss"
                //
                format: "YYYY-MM-DD HH:mm:ss",
                //
                // Timezone
                //
                // @type     string
                // @default  "UTC+00:00"
                //
                timezone: "UTC+00:00",
        },
        //
        // Maximum number of history lines per channel
        //
        // Defines the maximum number of history lines that will be kept in
        // memory per channel/query, in order to reduce the memory usage of
        // the server. Setting this to -1 will keep unlimited amount.
        //
        // @type     integer
        // @default  10000
        maxHistory: 10000,
        //
        // Default values for the 'Connect' form.
        //
        // @type     object
        // @default  {}
        //
        defaults: {
                //
                // Name
                //
                // @type     string
                // @default  "Freenode"
                //
                name: "Freenode",
                //
                // Host
                //
                // @type     string
                // @default  "chat.freenode.net"
                //
                host: "chat.freenode.net",
                //
                // Port
                //
                // @type     int
                // @default  6697
                //
                port: 6697,
                //
                // Password
                //
                // @type     string
                // @default  ""
                //
                password: "",
                //
                // Enable TLS/SSL
                //
                // @type     boolean
                // @default  true
                //
                tls: true,
                //
                // Nick
                //
                // @type     string
                // @default  "lounge-user"
                //
                nick: "lounge-user",
                //
                // Username
                //
                // @type     string
                // @default  "lounge-user"
                //
                username: "lounge-user",
                //
                // Real Name
                //
                // @type     string
                // @default  "The Lounge User"
                //
                realname: "The Lounge User",
                //
                // Channels
                // This is a comma-separated list.
                //
                // @type     string
                // @default  "#thelounge"
                //
                join: "#thelounge",
        },
        //
        // Set socket.io transports
        //
        // @type     array
        // @default  ["polling", "websocket"]
        //
        transports: ["polling", "websocket"],
        //
        // Run The Lounge using encrypted HTTP/2.
        // This will fallback to regular HTTPS if HTTP/2 is not supported.
        //
        // @type     object
        // @default  {}
        //
        https: {
                //
                // Enable HTTP/2 / HTTPS support.
                //
                // @type     boolean
                // @default  false
                //
                enable: false,
                //
                // Path to the key.
                //
                // @type     string
                // @example  "sslcert/key.pem"
                // @default  ""
                //
                key: "",
                //
                // Path to the certificate.
                //
                // @type     string
                // @example  "sslcert/key-cert.pem"
                // @default  ""
                //
                certificate: "",
                //
                // Path to the CA bundle.
                //
                // @type     string
                // @example  "sslcert/bundle.pem"
                // @default  ""
                //
                ca: "",
        },
        //
        // Default quit and part message if none is provided.
        //
        // @type     string
        // @default  "The Lounge - https://thelounge.github.io"
        //
        leaveMessage: "The Lounge - https://thelounge.github.io",
        //
        // Run The Lounge with identd support.
        //
        // @type     object
        // @default  {}
        //
        identd: {
                //
                // Run the identd daemon on server start.
                //
                // @type     boolean
                // @default  false
                //
                enable: false,
                //
                // Port to listen for ident requests.
                //
                // @type     int
                // @default  113
                //
                port: 113,
        },
        //
        // Enable oidentd support using the specified file
        //
        // Example: oidentd: "~/.oidentd.conf",
        //
        // @type     string
        // @default  null
        //
        oidentd: null,
        //
        // LDAP authentication settings (only available if public=false)
        // @type    object
        // @default {}
        //
        // The authentication process works as follows:
        //
        //   1. Lounge connects to the LDAP server with its system credentials
        //   2. It performs a LDAP search query to find the full DN associated to the
        //      user requesting to log in.
        //   3. Lounge tries to connect a second time, but this time using the user's
        //      DN and password. Auth is validated iff this connection is successful.
        //
        // The search query takes a couple of parameters in `searchDN`:
        //   - a base DN `searchDN/base`. Only children nodes of this DN will be likely
        //     to be returned;
        //   - a search scope `searchDN/scope` (see LDAP documentation);
        //   - the query itself, build as (&(<primaryKey>=<username>) <filter>)
        //     where <username> is the user name provided in the log in request,
        //     <primaryKey> is provided by the config and <fitler> is a filtering complement
        //     also given in the config, to filter for instance only for nodes of type
        //     inetOrgPerson, or whatever LDAP search allows.
        //
        // Alternatively, you can specify the `bindDN` parameter. This will make the lounge
        // ignore searchDN options and assume that the user DN is always:
        //     <bindDN>,<primaryKey>=<username>
        // where <username> is the user name provided in the log in request, and <bindDN>
        // and <primaryKey> are provided by the config.
        //
        ldap: {
                //
                // Enable LDAP user authentication
                //
                // @type     boolean
                // @default  false
                //
                enable: true,
                //
                // LDAP server URL
                //
                // @type     string
                //
                url: "ldap://{{ ldap.domain }}",
                //
                // LDAP connection tls options (only used if scheme is ldaps://)
                //
                // @type     object (see nodejs' tls.connect() options)
                // @default {}
                //
                // Example:
                //   You can use this option in order to force the use of IPv6:
                //   {
                //     host: 'my::ip::v6',
                //     servername: 'example.com'
                //   }
                tlsOptions: {},
                //
                // LDAP base dn, alternative to searchDN
                //
                // @type     string
                //
                // baseDN: "",
                //
                // LDAP primary key
                //
                // @type     string
                // @default  "uid"
                //
                primaryKey: "uid",
                //
                // LDAP search dn settings. This defines the procedure by which the
                // lounge first look for user DN before authenticating her.
                // Ignored if baseDN is specified
                //
                // @type     object
                //
                searchDN: {
                        //
                        // LDAP searching bind DN
                        // This bind DN is used to query the server for the DN of the user.
                        // This is supposed to be a system user that has access in read only to
                        // the DNs of the people that are allowed to log in.
                        //
                        // @type     string
                        //
                        rootDN: "cn=admin,dc=data,dc=coop",
                        //
                        // Password of the lounge LDAP system user
                        //
                        // @type     string
                        //
                        rootPassword: "{{ ldap_admin_password }}",
                        //
                        // LDAP filter
                        //
                        // @type     string
                        // @default  "uid"
                        //
                        //filter: "(objectClass=inetOrgPerson)(memberOf=ou=members,dc=data,dc=coop)",
                        filter: "(objectClass=inetOrgPerson)",
                        //
                        // LDAP search base (search only within this node)
                        //
                        // @type     string
                        //
                        base: "{{ ldap_dn }}",
                        //
                        // LDAP search scope
                        //
                        // @type     string
                        // @default  "sub"
                        //
                        scope: "sub",
                },
        },
        // Extra debugging
        //
        // @type     object
        // @default  {}
        //
        debug: {
                // Enables extra debugging output provided by irc-framework.
                //
                // @type     boolean
                // @default  false
                //
                ircFramework: false,
                // Enables logging raw IRC messages into each server window.
                //
                // @type     boolean
                // @default  false
                //
                raw: false,
        },
 };
--- a/roles/docker/files/mastodon/postgresql.conf
+++ b/roles/docker/files/mastodon/postgresql.conf
@ -1,20 +0,0 @@
 # DB Version: 14
 # OS Type: linux
 # DB Type: oltp
 # Total Memory (RAM): 16 GB
 # Connections num: 300
 # Data Storage: hdd
 listen_addresses = '*'
 max_connections = 300
 shared_buffers = 4GB
 effective_cache_size = 12GB
 maintenance_work_mem = 1GB
 checkpoint_completion_target = 0.9
 wal_buffers = 16MB
 default_statistics_target = 100
 random_page_cost = 4
 effective_io_concurrency = 2
 work_mem = 6990kB
 min_wal_size = 2GB
 max_wal_size = 8GB
--- a/roles/docker/files/matrix/log.config
+++ b/roles/docker/files/matrix/log.config
@ -1,37 +0,0 @@
 version: 1
 formatters:
    precise:
        format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
 filters:
    context:
        (): synapse.util.logcontext.LoggingContextFilter
        request: ""
 handlers:
    file:
        class: logging.handlers.RotatingFileHandler
        formatter: precise
        filename: /data/homeserver.log
        maxBytes: 104857600
        backupCount: 10
        filters: [context]
        encoding: utf8
    console:
        class: logging.StreamHandler
        formatter: precise
        filters: [context]
 loggers:
    synapse:
        level: WARN
    synapse.storage.SQL:
        # beware: increasing this to DEBUG will make synapse log sensitive
        # information such as access tokens.
        level: INFO
 root:
    level: INFO
    handlers: [file, console]
--- a/roles/docker/files/sso/sso.data.coop.pem
+++ b/roles/docker/files/sso/sso.data.coop.pem
@ -1 +0,0 @@
 MIICszCCAZsCBgF8WpKKwTANBgkqhkiG9w0BAQsFADAdMRswGQYDVQQDDBJkYXRhLmNvb3Agc2VydmljZXMwHhcNMjExMDA3MTE0MzQ1WhcNMzExMDA3MTE0NTI1WjAdMRswGQYDVQQDDBJkYXRhLmNvb3Agc2VydmljZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCdV0stfU8aA1bi+GYd/a5DOyoox01BgzWwBFqVjlo80frsOsH8g814eDuMuff/UJy+2YxaozYQGxP+DcOVXi+0Fts9zjRj6wa6HCQqiR/SNUa69fGHcyAo2Tr0faxOyf3QMBqIngTRZB99quNMuAM96RCg25LtDaaWjNVxdHlj78+kU1bQXExp0ZfELlKGtllWP07cyz4nGfZmuK1AiWSsRbDIbyK5dvzw/pMS1kexh6ylnQu1iLqD3vYZBUDX9lPNkavTYZNCEL4ElUvR81S0ko2zkYAUiuVTtTUKucc98dTRhkuV4YCiiW6UQGY/jzmXYBfpzAY3n5eH5iUu/tRXAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFQc8ytexKiXOIGrSYYtFaF/lxv8AwMgsndv8YxJ+x/cUwN9tdmA8IAZDIS13qBrCOdZE4pJ/09VkYdErcpbtV7PWC3LDv/c2qakyiBUYZj4WgJio+oD0GCqXsby3aqJeVt9cJr4gSsXxn1c+7GV7p/gc/2FFmlWcqMN/2F7LvFvObu55QlppWZrn8kreaUQmRuTTIviFQRmvrmwKyK52LEcK7qoh/v1aHyYDl91gu3nLMEluz6hy3UEPYgpdH1t2C7K0Kjri25pJNGCFrpKjWWveteKazUeDd4adHMiw2MVfeEyTCXEFoaxQS9QmbmhSMRhiHjbdffL7xi//aSh1bo=
--- a/roles/docker/files/vhost/element
+++ b/roles/docker/files/vhost/element
@ -1 +0,0 @@
 client_max_body_size 1G; # default is 1M
--- a/roles/docker/files/vhost/mastodon
+++ b/roles/docker/files/vhost/mastodon
@ -1,2 +0,0 @@
 listen 3000;
 client_max_body_size 50M; # default is 1M
--- a/roles/docker/files/vhost/matrix
+++ b/roles/docker/files/vhost/matrix
@ -1,2 +0,0 @@
 listen 8008;
 client_max_body_size 1G; # default is 1M
--- a/roles/docker/files/vhost/nextcloud
+++ b/roles/docker/files/vhost/nextcloud
@ -1 +0,0 @@
 client_max_body_size 1G; # default is 1M
--- a/roles/docker/files/vhost/uptime_kuma
+++ b/roles/docker/files/vhost/uptime_kuma
@ -1,4 +0,0 @@
 proxy_set_header   Upgrade $http_upgrade;
 proxy_set_header   Connection "upgrade";
 proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header   Host $host;
--- a/roles/docker/files/vhost/www.base_domain
+++ b/roles/docker/files/vhost/www.base_domain
@ -1,2 +0,0 @@
 server_name www.data.coop;
 return 301 $scheme://data.coop$request_uri;
--- a/roles/docker/handlers/main.yml
+++ b/roles/docker/handlers/main.yml
@ -1,6 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: restart nginx
  command: docker compose restart proxy
  args:
    chdir: "{{ services.nginx_proxy.volume_folder }}"
--- a/roles/docker/tasks/block.yml
+++ b/roles/docker/tasks/block.yml
@ -1,26 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Create volume folder for service {{ service.name }}
  file:
    name: "{{ service.vars.volume_folder }}"
    state: directory
 - name: Upload Compose file for service {{ service.name }}
  template:
    src: compose-files/{{ service.name }}.yml.j2
    dest: "{{ service.vars.volume_folder }}/docker-compose.yml"
    owner: root
    mode: u=rw,go=
 - name: Run pre-deployment tasks for service {{ service.name }}
  include_tasks: pre_deploy/{{ service.name }}.yml
  when: service.vars.pre_deploy_tasks is defined and service.vars.pre_deploy_tasks
 - name: Deploy Compose stack for service {{ service.name }}
  command: docker compose up -d --remove-orphans --pull always
  args:
    chdir: "{{ service.vars.volume_folder }}"
 - name: Run post-deployment tasks for service {{ service.name }}
  include_tasks: post_deploy/{{ service.name }}.yml
  when: service.vars.post_deploy_tasks is defined and service.vars.post_deploy_tasks
--- a/roles/docker/tasks/main.yml
+++ b/roles/docker/tasks/main.yml
@ -1,44 +1,33 @@
 # vim: ft=yaml.ansible
 ---
- name: Add Docker PGP key
+- name: add docker gpg key
  apt_key:
    keyserver: pgp.mit.edu
    id: 8D81803C0EBFCD88
    state: present
- name: Add Docker apt repository
+- name: add docker apt repository
  apt_repository:
    repo: deb https://download.docker.com/linux/ubuntu bionic stable
    state: present
    update_cache: yes
- name: Install Docker
+- name: install docker-ce
  apt:
-    name: "{{ pkgs }}"
+    name: docker-ce
    state: present
  vars:
    pkgs:
      - docker-ce
      - docker-compose-plugin
 - name: Configure cron job to prune unused Docker data weekly
  cron:
    name: Prune unused Docker data
    cron_file: ansible_docker_prune
    job: 'docker system prune -fa && docker volume prune -fa'
    special_time: weekly
    user: root
    state: present
- name: Create folder structure for bind mounts
+- name: install docker python bindings
  pip:
    executable: "pip3"
    name: "docker-compose"
    state: present
 - name: create folder structure for bind mounts
  file:
-    name: "{{ item }}"
+    name: "{{ volume_root_folder }}"
    state: directory
  loop:
    - "{{ volume_root_folder }}"
    - "{{ volume_website_folder }}"
- name: Set up services
+- name: setup services
  import_tasks: services.yml
  tags:
    - setup_services
--- a/roles/docker/tasks/post_deploy/docker_registry.yml
+++ b/roles/docker/tasks/post_deploy/docker_registry.yml
@ -1,13 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Generate htpasswd file
  shell: docker compose exec registry htpasswd -Bbn docker {{ docker_password }} > auth/htpasswd
  args:
    chdir: "{{ services.docker_registry.volume_folder }}"
    creates: "{{ services.docker_registry.volume_folder }}/auth/htpasswd"
 - name: log in to registry
  docker_login:
    registry: "{{ 'docker.data.coop' if vagrant else services.docker_registry.domain }}"
    username: docker
    password: "{{ docker_password }}"
--- a/roles/docker/tasks/post_deploy/mastodon.yml
+++ b/roles/docker/tasks/post_deploy/mastodon.yml
@ -1,19 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Configure cron job to remove old Mastodon media daily
  cron:
    name: Clean Mastodon media data older than a week
    cron_file: ansible_mastodon_clean_media
    job: docker exec mastodon-web-1 tootctl media remove --days 7
    special_time: daily
    user: root
    state: present
 - name: Configure cron job to remove old Mastodon preview cards daily
  cron:
    name: Clean Mastodon preview card data older than two weeks
    cron_file: ansible_mastodon_clean_preview_cards
    job: docker exec mastodon-web-1 tootctl preview_cards remove --days 14
    special_time: daily
    user: root
    state: present
--- a/roles/docker/tasks/pre_deploy/data_coop_website.yml
+++ b/roles/docker/tasks/pre_deploy/data_coop_website.yml
@ -1,11 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Upload vhost config for root domain
  copy:
    src: vhost/base_domain
    dest: "{{ services.nginx_proxy.volume_folder }}/vhost/{{ services.data_coop_website.domain }}"
 - name: Upload vhost config for WWW domain
  copy:
    src: vhost/www.base_domain
    dest: "{{ services.nginx_proxy.volume_folder }}/vhost/{{ services.data_coop_website.www_domain }}"
--- a/roles/docker/tasks/pre_deploy/docker_registry.yml
+++ b/roles/docker/tasks/pre_deploy/docker_registry.yml
@ -1,17 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Create subfolders
  file:
    path: "{{ services.docker_registry.volume_folder }}/{{ volume }}"
    state: directory
  loop:
    - auth
    - registry
  loop_control:
    loop_var: volume
 - name: Copy docker registry vhost configuration
  copy:
    src: vhost/docker_registry
    dest: "{{ services.nginx_proxy.volume_folder }}/vhost/{{ services.docker_registry.domain }}"
    mode: "0644"
--- a/roles/docker/tasks/pre_deploy/element.yml
+++ b/roles/docker/tasks/pre_deploy/element.yml
@ -1,21 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Create subfolder
  file:
    name: "{{ services.element.volume_folder }}/data"
    state: directory
 - name: Upload config.json
  template:
    src: element/config.json.j2
    dest: "{{ services.element.volume_folder }}/data/config.json"
 - name: Upload riot.im.conf
  copy:
    src: element/riot.im.conf
    dest: "{{ services.element.volume_folder }}/data/riot.im.conf"
 - name: Upload vhost config for Element domain
  copy:
    src: vhost/element
    dest: "{{ services.nginx_proxy.volume_folder }}/vhost/{{ services.element.domain }}"
--- a/roles/docker/tasks/pre_deploy/hedgedoc.yml
+++ b/roles/docker/tasks/pre_deploy/hedgedoc.yml
@ -1,17 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Create subfolders
  file:
    name: "{{ services.hedgedoc.volume_folder }}/{{ volume }}"
    state: directory
  loop:
    - db
    - hedgedoc/uploads
  loop_control:
    loop_var: volume
 - name: Copy SSO certificate
  copy:
    src: sso/sso.data.coop.pem
    dest: "{{ services.hedgedoc.volume_folder }}/sso.data.coop.pem"
    mode: "0644"
--- a/roles/docker/tasks/pre_deploy/mailu.yml
+++ b/roles/docker/tasks/pre_deploy/mailu.yml
@ -1,45 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Create subfolders
  file:
    name: "{{ services.mailu.volume_folder }}/{{ volume }}"
    state: directory
  loop:
    - redis
    - certs
    - data
    - dkim
    - mail
    - mailqueue
    - filter
    - postgres
    - webmail
    - overrides
    - overrides/nginx
    - overrides/dovecot
    - overrides/postfix
    - overrides/rspamd
    - overrides/snappymail
  loop_control:
    loop_var: volume
 - name: Upload mailu.env file
  template:
    src: mailu/env.j2
    dest: "{{ services.mailu.volume_folder }}/mailu.env"
 - name: Hard link to Let's Encrypt TLS certificate
  file:
    src: "{{ services.nginx_proxy.volume_folder }}/certs/{{ services.mailu.domain }}/fullchain.pem"
    dest: "{{ services.mailu.volume_folder }}/certs/cert.pem"
    state: hard
    force: true
  when: letsencrypt_enabled
 - name: Hard link to Let's Encrypt TLS key
  file:
    src: "{{ services.nginx_proxy.volume_folder }}/certs/{{ services.mailu.domain }}/key.pem"
    dest: "{{ services.mailu.volume_folder }}/certs/key.pem"
    state: hard
    force: true
  when: letsencrypt_enabled
--- a/roles/docker/tasks/pre_deploy/mastodon.yml
+++ b/roles/docker/tasks/pre_deploy/mastodon.yml
@ -1,45 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Create subfolder for Mastodon data
  file:
    name: "{{ services.mastodon.volume_folder }}/mastodon_data"
    state: directory
    owner: "991"
    mode: u=rwx,g=rx,o=rx
 - name: Create subfolder for PostgreSQL data
  file:
    name: "{{ services.mastodon.volume_folder }}/postgres_data"
    state: directory
    owner: "70"
    mode: u=rwx,go=
 - name: Create subfolder for PostgreSQL config
  file:
    name: "{{ services.mastodon.volume_folder }}/postgres_config"
    state: directory
    owner: root
    mode: u=rwx,g=rx,o=rx
 - name: Create subfolder for Redis data
  file:
    name: "{{ services.mastodon.volume_folder }}/redis_data"
    state: directory
    owner: "999"
    group: "1000"
    mode: u=rwx,g=rx,o=rx
 - name: Upload mastodon.env file
  template:
    src: mastodon/env.j2
    dest: "{{ services.mastodon.volume_folder }}/mastodon.env"
 - name: Upload vhost config for Mastodon domain
  copy:
    src: vhost/mastodon
    dest: "{{ services.nginx_proxy.volume_folder }}/vhost/{{ services.mastodon.domain }}"
 - name: Upload PostgreSQL config
  copy:
    src: mastodon/postgresql.conf
    dest: "{{ services.mastodon.volume_folder }}/postgres_config/postgresql.conf"
--- a/roles/docker/tasks/pre_deploy/matrix.yml
+++ b/roles/docker/tasks/pre_deploy/matrix.yml
@ -1,34 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Create subfolders
  file:
    name: "{{ services.matrix.volume_folder }}/{{ volume }}"
    state: directory
    owner: "991"
    group: "991"
  loop:
    - data
    - data/uploads
    - data/media
  loop_control:
    loop_var: volume
 - name: Create Matrix DB subfolder
  file:
    name: "{{ services.matrix.volume_folder }}/db"
    state: directory
 - name: Upload vhost config for Matrix domain
  copy:
    src: vhost/matrix
    dest: "{{ services.nginx_proxy.volume_folder }}/vhost/{{ services.matrix.domain }}"
 - name: Upload homeserver.yaml
  template:
    src: matrix/homeserver.yaml.j2
    dest: "{{ services.matrix.volume_folder }}/data/homeserver.yaml"
 - name: Upload Matrix logging config
  copy:
    src: matrix/log.config
    dest: "{{ services.matrix.volume_folder }}/data/matrix.data.coop.log.config"
--- a/roles/docker/tasks/pre_deploy/nextcloud.yml
+++ b/roles/docker/tasks/pre_deploy/nextcloud.yml
@ -1,17 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Create subfolders
  file:
    path: "{{ services.nextcloud.volume_folder }}/{{ volume }}"
    state: directory
  loop:
    - app
    - postgres
  loop_control:
    loop_var: volume
 - name: Upload vhost config for Nextcloud domain
  copy:
    src: vhost/nextcloud
    dest: "{{ services.nginx_proxy.volume_folder }}/vhost/{{ services.nextcloud.domain }}"
  notify: "restart nginx"
--- a/roles/docker/tasks/pre_deploy/nginx_proxy.yml
+++ b/roles/docker/tasks/pre_deploy/nginx_proxy.yml
@ -1,14 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Create subfolders
  file:
    name: "{{ services.nginx_proxy.volume_folder }}/{{ volume }}"
    state: directory
  loop:
    - conf
    - vhost
    - html
    - dhparam
    - certs
  loop_control:
    loop_var: volume
--- a/roles/docker/tasks/pre_deploy/openldap.yml
+++ b/roles/docker/tasks/pre_deploy/openldap.yml
@ -1,12 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Create subfolders
  file:
    name: "{{ services.openldap.volume_folder }}/{{ volume }}"
    state: directory
  loop:
    - var/lib/ldap
    - etc/slapd
    - certs
  loop_control:
    loop_var: volume
--- a/roles/docker/tasks/pre_deploy/postfix.yml
+++ b/roles/docker/tasks/pre_deploy/postfix.yml
@ -1,13 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Set up network for Postfix
  docker_network:
    name: postfix
    ipam_config:
      - subnet: '172.16.0.0/16'
        gateway: 172.16.0.1
 - name: Create subfolder
  file:
    name: "{{ services.postfix.volume_folder }}/dkim"
    state: directory
--- a/roles/docker/tasks/pre_deploy/privatebin.yml
+++ b/roles/docker/tasks/pre_deploy/privatebin.yml
@ -1,16 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Create subfolders
  file:
    name: "{{ services.privatebin.volume_folder }}/{{ volume }}"
    state: directory
  loop:
    - cfg
    - data
  loop_control:
    loop_var: volume
 - name: Upload PrivateBin config
  copy:
    src: privatebin/conf.php
    dest: "{{ services.privatebin.volume_folder }}/cfg/conf.php"
--- a/roles/docker/tasks/pre_deploy/rallly.yml
+++ b/roles/docker/tasks/pre_deploy/rallly.yml
@ -1,11 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Create subfolder
  file:
    name: "{{ services.rallly.volume_folder }}/postgres"
    state: directory
 - name: Copy rallly.env file
  template:
    src: rallly/env.j2
    dest: "{{ services.rallly.volume_folder }}/rallly.env"
--- a/roles/docker/tasks/pre_deploy/restic.yml
+++ b/roles/docker/tasks/pre_deploy/restic.yml
@ -1,72 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Create SSH directory
  file:
    path: "{{ services.restic.volume_folder }}/ssh"
    owner: root
    group: root
    mode: '0755'
    state: directory
 - name: Upload private SSH key
  copy:
    dest: "{{ services.restic.volume_folder }}/ssh/id_ed25519"
    owner: root
    group: root
    mode: '0600'
    content: "{{ restic_secrets.ssh_privkey }}"
 - name: Derive public SSH key
  shell: >-
    ssh-keygen -f {{ services.restic.volume_folder }}/ssh/id_ed25519 -y
      > {{ services.restic.volume_folder }}/ssh/id_ed25519.pub
  args:
    creates: "{{ services.restic.volume_folder }}/ssh/id_ed25519.pub"
 - name: Set file permissions on public SSH key
  file:
    path: "{{ services.restic.volume_folder }}/ssh/id_ed25519.pub"
    owner: root
    group: root
    mode: '0644'
    state: touch
 - name: Upload SSH config
  template:
    src: restic/ssh.config.j2
    dest: "{{ services.restic.volume_folder }}/ssh/config"
    owner: root
    group: root
    mode: '0600'
 - name: Upload SSH known_hosts file
  template:
    src: restic/ssh.known_hosts.j2
    dest: "{{ services.restic.volume_folder }}/ssh/known_hosts"
    owner: root
    group: root
    mode: '0600'
 - name: Create scripts directory
  file:
    path: "{{ services.restic.volume_folder }}/scripts"
    owner: root
    group: root
    mode: '0755'
    state: directory
 - name: Upload failure.sh script
  template:
    src: restic/failure.sh.j2
    dest: "{{ services.restic.volume_folder }}/scripts/failure.sh"
    owner: root
    group: root
    mode: '0755'
 - name: Upload success.sh script
  template:
    src: restic/success.sh.j2
    dest: "{{ services.restic.volume_folder }}/scripts/success.sh"
    owner: root
    group: root
    mode: '0755'
--- a/roles/docker/tasks/pre_deploy/uptime_kuma.yml
+++ b/roles/docker/tasks/pre_deploy/uptime_kuma.yml
@ -1,9 +0,0 @@
 - name: Upload vhost config for uptime domain
  copy:
    src: vhost/uptime_kuma
    dest: "{{ services.nginx_proxy.volume_folder }}/vhost/{{ services.uptime_kuma.domain }}_location"
 - name: Upload vhost config for status domain
  copy:
    src: vhost/uptime_kuma
    dest: "{{ services.nginx_proxy.volume_folder }}/vhost/{{ services.uptime_kuma.status_domain }}_location"
--- a/roles/docker/tasks/pre_deploy/writefreely.yml
+++ b/roles/docker/tasks/pre_deploy/writefreely.yml
@ -1,20 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 - name: Create subfolder for MariaDB data
  file:
    name: "{{ services.writefreely.volume_folder }}/db"
    owner: "999"
    group: "999"
    state: directory
 - name: Create subfolder for encryption keys
  file:
    name: "{{ services.writefreely.volume_folder }}/keys"
    owner: "2"
    group: "2"
    state: directory
 - name: Upload config.ini
  template:
    src: "writefreely/config.ini.j2"
    dest: "{{ services.writefreely.volume_folder }}/config.ini"
--- a/roles/docker/tasks/services.yml
+++ b/roles/docker/tasks/services.yml
@ -1,28 +1,16 @@
 # vim: ft=yaml.ansible
 ---
- name: Set up external services network
+- name: setup external services network
  docker_network:
    name: external_services
- name: Deploy all services
+- name: setup network for postfix
-  include_tasks:
+  docker_network:
-    file: block.yml
+    name: postfix
-  vars:
+    ipam_options:
-    service:
+      subnet: '172.16.0.0/16'
-      name: "{{ item }}"
+      gateway: 172.16.0.1
      vars: "{{ services[item] }}"
  loop: "{{ services_include }}"
  when: single_service is not defined and
        (item.vars.disabled_in_vagrant is not defined or
        not (item.vars.disabled_in_vagrant and vagrant))
- name: Deploy single service
+
-  include_tasks:
+- name: setup services
-    file: block.yml
+  include_tasks: "services/{{ item }}.yml"
-  vars:
+  with_items: "{{ services }}"
    service:
      name: "{{ single_service }}"
      vars: "{{ services[single_service] }}"
  when: single_service is defined and single_service in services and
        (services[single_service].disabled_in_vagrant is not defined or
        not (services[single_service].disabled_in_vagrant and vagrant))
--- a/roles/docker/tasks/services/codimd.yml
+++ b/roles/docker/tasks/services/codimd.yml
@ -0,0 +1,57 @@
 ---
 - name: codimd network
  docker_network:
    name: codimd
 - name: create codimd volume folders
  file:
    name: "{{ codimd.volume_folder }}/{{ volume }}"
    state: directory
  loop:
    - "db"
    - "codimd/uploads"
  loop_control:
    loop_var: volume
 - name: codimd database container
  docker_container:
    name: codimd_db
    image: postgres:10
    state: started
    restart_policy: unless-stopped
    networks:
      - name: codimd
    volumes:
      - "{{ codimd.volume_folder }}/db:/var/lib/postgresql/data"
    env:
      POSTGRES_USER: "codimd"
      POSTGRES_PASSWORD: "{{ postgres_passwords.codimd }}"
 - name: codimd app container
  docker_container:
    name: codimd_app
    image: hackmdio/hackmd:1.3.0
    restart_policy: unless-stopped
    networks:
      - name: codimd
      - name: ldap
      - name: external_services
    volumes:
      - "{{ codimd.volume_folder }}/codimd/uploads:/codimd/public/uploads"
    env:
      CMD_DB_URL: "postgres://codimd:{{ postgres_passwords.codimd }}@codimd_db:5432/codimd"
      CMD_ALLOW_EMAIL_REGISTER: "False"
      CMD_IMAGE_UPLOAD_TYPE: "filesystem"
      CMD_EMAIL: "False"
      CMD_LDAP_URL: "ldap://openldap"
      CMD_LDAP_BINDDN: "cn=admin,dc=data,dc=coop"
      CMD_LDAP_BINDCREDENTIALS: "{{ ldap_admin_password }}"
      CMD_LDAP_SEARCHBASE: "dc=data,dc=coop"
      CMD_LDAP_SEARCHFILTER: "(&(uid={{ '{{username}}' }})(objectClass=inetOrgPerson))"
      CMD_USECDN: "false"
      VIRTUAL_HOST: "{{ codimd.domain }}"
      LETSENCRYPT_HOST: "{{ codimd.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
--- a/roles/docker/tasks/services/docker_registry.yml
+++ b/roles/docker/tasks/services/docker_registry.yml
@ -0,0 +1,35 @@
 ---
 - name: copy docker registry nginx configuration
  copy:
    src: "files/configs/docker_registry/nginx.conf"
    dest: "/docker-volumes/nginx/vhost/{{ docker_registry.domain }}"
    mode: "0644"
 - name: docker registry container
  docker_container:
    name: registry
    image: registry:2
    restart_policy: always
    volumes:
      - "{{ docker_registry.volume_folder }}/registry:/var/lib/registry"
      - "{{ docker_registry.volume_folder }}/auth:/auth"
    networks:
      - name: external_services
    env:
      VIRTUAL_HOST: "{{ docker_registry.domain }}"
      LETSENCRYPT_HOST: "{{ docker_registry.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
      REGISTRY_AUTH: "htpasswd"
      REGISTRY_AUTH_HTPASSWD_PATH: "/auth/htpasswd"
      REGISTRY_AUTH_HTPASSWD_REALM: "data.coop docker registry"
 - name: generate htpasswd file
  shell: "docker exec -it registry htpasswd -Bbn docker {{ docker_password }} > {{ docker_registry.volume_folder }}/auth/htpasswd"
  args:
    creates: "{{ docker_registry.volume_folder }}/auth/htpasswd"
 - name: log in to local registry
  docker_login:
    registry: "{{ docker_registry.domain }}"
    username: "docker"
    password: "{{ docker_password }}"
--- a/roles/docker/tasks/services/drone.yml
+++ b/roles/docker/tasks/services/drone.yml
@ -0,0 +1,21 @@
 ---
 - name: Drone container
  docker_container:
    name: drone
    image: drone/drone:latest
    restart_policy: unless-stopped
    networks:
      - name: external_services
    volumes:
      - "{{ drone.volume_folder }}:/data"
      - "/var/run/docker.sock:/var/run/docker.sock"
    env:
      DRONE_GITEA_SERVER: "https://{{ gitea.domain }}"
      DRONE_GITEA_ALWAYS_AUTH: "False"
      DRONE_RUNNER_CAPACITY: "2"
      DRONE_SERVER_HOST: "{{ drone.domain }}"
      DRONE_SERVER_PROTO: "https"
      PLUGIN_CUSTOM_DNS: "91.239.100.100"
      VIRTUAL_HOST: "{{ drone.domain }}"
      LETSENCRYPT_HOST: "{{ drone.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
--- a/roles/docker/tasks/services/fider.yml
+++ b/roles/docker/tasks/services/fider.yml
@ -0,0 +1,47 @@
 ---
 - name: fider network
  docker_network:
    name: fider
 - name: fider database volume
  docker_volume:
    name: fider_db
 - name: fider database container
  docker_container:
    name: fider_db
    image: postgres:10
    state: started
    restart_policy: always
    networks:
      - name: fider
    volumes:
      - fider_db:/var/lib/postgresql/data
    env:
      POSTGRES_USER: fider
      POSTGRES_PASSWORD: "{{ postgres_passwords.fider }}"
 - name: fider app container
  docker_container:
    name: fider
    image: getfider/fider:stable
    restart_policy: always
    networks:
      - name: fider
      - name: external_services
      - name: postfix
    env:
      GO_ENV: "production"
      DATABASE_URL: "postgres://fider:{{ postgres_passwords.fider }}@fider_db:5432/fider?sslmode=disable"
      JWT_SECRET: "{{ fider_jwt_secret }}"
      EMAIL_NOREPLY: noreply@{{ fider.domain }}
      EMAIL_SMTP_HOST: "{{ smtp_host }}"
      EMAIL_SMTP_PORT: "{{ smtp_port }}"
      EMAIL_SMTP_USERNAME: "noop"
      EMAIL_SMTP_PASSWORD: "noop"
      VIRTUAL_HOST: "{{ fider.domain }}"
      LETSENCRYPT_HOST: "{{ fider.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email}}"
--- a/roles/docker/tasks/services/gitea.yml
+++ b/roles/docker/tasks/services/gitea.yml
@ -0,0 +1,19 @@
 ---
 # old DNS: 138.68.71.153
 - name: gitea container
  docker_container:
    name: gitea
    image: gitea/gitea:latest
    restart_policy: unless-stopped
    networks:
      - name: gitea
      - name: external_services
    volumes:
      - "{{ gitea.volume_folder }}:/data"
    published_ports:
      - "22:22"
    env:
      VIRTUAL_HOST: "{{ gitea.domain }}"
      VIRTUAL_PORT: "3000"
      LETSENCRYPT_HOST: "{{ gitea.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
--- a/roles/docker/tasks/services/mailu.yml
+++ b/roles/docker/tasks/services/mailu.yml
@ -0,0 +1,144 @@
 ---
 - name: create mailu volume folders
  file:
    name: "{{ mailu.volume_folder }}/{{ volume }}"
    state: directory
  loop:
    - redis
    - certs
    - overrides
    - data
    - dkim
    - mail
    - filter
    - dav
    - webmail
  loop_control:
    loop_var: volume
 - name: upload mailu.env file
  template:
    src: mailu.env.j2
    dest: "{{ mailu.volume_folder}}/mailu.env"
 - name: run mail server containers
  docker_service:
    project_name: mail_server
    pull: yes
    definition:
      version: '3.6'
      services:
        redis:
          image: redis:alpine
          restart: always
          volumes:
            - "{{ mailu.volume_folder }}/redis:/data"
        postgresql:
          image: mailu/postgresql:1.6
          restart: always
          env_file: "{{ mailu.volume_folder}}/mailu.env"
          volumes:
            - "{{ mailu.volume_folder }}/data/psql_db:/data"
            - "{{ mailu.volume_folder }}/data/psql_backup:/backup"
          networks:
            - name: mailu
        front:
          image: mailu/nginx:{{ mail_server_mailu_version }}
          restart: always
          env_file: "{{ mailu.volume_folder}}/mailu.env"
          environment:
            VIRTUAL_HOST: "{{ mailu.domain }}"
            LETSENCRYPT_HOST: "{{ mailu.domain }}"
            LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
          volumes:
            - "{{ mailu.volume_folder }}/certs:/certs"
            - "{{ mailu.volume_folder }}/overrides/nginx:/overrides"
          expose:
            - "80"
          ports:
            - "993:993"
            - "25:25"
            - "587:587"
          networks:
            - default
            - external_services
        resolver:
          image: mailu/unbound:{{ mail_server_mailu_version }}
          restart: always
          env_file: "{{ mailu.volume_folder}}/mailu.env"
          networks:
            default:
              ipv4_address: "{{ mailu.dns }}"
        admin:
          image: mailu/admin:{{ mail_server_mailu_version }}
          restart: always
          env_file: "{{ mailu.volume_folder}}/mailu.env"
          volumes:
            - "{{ mailu.volume_folder }}/data:/data"
            - "{{ mailu.volume_folder }}/dkim:/dkim"
          depends_on:
            - redis
        imap:
          image: mailu/dovecot:{{ mail_server_mailu_version }}
          restart: always
          env_file: "{{ mailu.volume_folder}}/mailu.env"
          volumes:
            - "{{ mailu.volume_folder }}/mail:/mail"
            - "{{ mailu.volume_folder }}/overrides:/overrides"
          depends_on:
            - front
        smtp:
          image: mailu/postfix:{{ mail_server_mailu_version }}
          restart: always
          env_file: "{{ mailu.volume_folder}}/mailu.env"
          volumes:
            - "{{ mailu.volume_folder }}/overrides:/overrides"
          depends_on:
            - front
            - resolver
          dns:
            - "{{ mailu.dns }}"
        antispam:
          image: mailu/rspamd:{{ mail_server_mailu_version }}
          restart: always
          env_file: "{{ mailu.volume_folder}}/mailu.env"
          volumes:
            - "{{ mailu.volume_folder }}/filter:/var/lib/rspamd"
            - "{{ mailu.volume_folder }}/dkim:/dkim"
            - "{{ mailu.volume_folder }}/overrides/rspamd:/etc/rspamd/override.d"
          depends_on:
            - front
            - resolver
          dns:
            - "{{ mailu.dns }}"
        webmail:
          image: mailu/rainloop:1.6
          restart: always
          env_file: "{{ mailu.volume_folder}}/mailu.env"
          volumes:
            - "{{ mailu.volume_folder }}/webmail:/data"
          depends_on:
            - front
            - resolver
          dns:
            - "{{ mailu.dns }}"
      networks:
        default:
          driver: bridge
          ipam:
            driver: default
            config:
              - subnet: "{{ mailu.subnet }}"
        external_services:
          external:
            name: external_services
--- a/roles/docker/tasks/services/matrix_riot.yml
+++ b/roles/docker/tasks/services/matrix_riot.yml
@ -0,0 +1,98 @@
 ---
 - name: create matrix volume folders
  file:
    name: "{{ matrix.volume_folder }}/{{ volume }}"
    state: directory
  loop:
    - "db"
  loop_control:
    loop_var: volume
 - name: create riot volume folders
  file:
    name: "{{ riot.volume_folder }}/{{ volume }}"
    state: directory
  loop:
    - "data"
  loop_control:
    loop_var: volume
 - name: matrix network
  docker_network:
    name: matrix
 - name: upload riot config.json
  template:
    src: files/configs/riot/config.json
    dest: "{{ riot.volume_folder }}/data/config.json"
 - name: upload riot.im.conf
  template:
    src: files/configs/riot/riot.im.conf
    dest: "{{ riot.volume_folder }}/data/riot.im.conf"
 - name: upload vhost config for root domain
  template:
    src: files/configs/matrix/vhost-root
    dest: "{{ nginx.volume_folder }}/vhost/{{ base_domain }}"
 - name: upload vhost config for matrix domain
  template:
    src: files/configs/matrix/vhost-matrix
    dest: "{{ nginx.volume_folder }}/vhost/{{ matrix.domain }}"
 - name: matrix database container
  docker_container:
    name: matrix_db
    image: postgres:10
    state: started
    restart_policy: always
    networks:
      - name: matrix
    volumes:
      - "{{ matrix.volume_folder }}/db:/var/lib/postgresql/data"
    env:
      POSTGRES_USER: "synapse"
      POSTGRES_PASSWORD: "{{ postgres_passwords.matrix }}"
 - name: matrix container
  docker_container:
    name: matrix
    image: matrixdotorg/synapse:latest
    restart_policy: unless-stopped
    networks:
      - name: matrix
    published_ports:
      - "8008"
    env:
      SYNAPSE_SERVER_NAME: "{{ base_domain }}"
      SYNAPSE_REPORT_STATS: "False"
      SYNAPSE_ENABLE_REGISTRATION: "True"
      SYNAPSE_LOG_LEVEL: "INFO"
      SYNAPSE_NO_TLS: "1"
      POSTGRES_HOST: "matrix_db"
      POSTGRES_USER: "synapse"
      POSTGRES_PASSWORD: "{{ postgres_passwords.matrix }}"
      VIRTUAL_HOST: "{{ matrix.domain }}"
      VIRTUAL_PORT: "8008"
      LETSENCRYPT_HOST: "{{ matrix.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 - name: riot container
  docker_container:
    name: riot_app
    image: avhost/docker-matrix-riot:v1.0.1
    state: started
    restart_policy: always
    networks:
      - name: matrix
      - name: external_services
    published_ports:
      - "8080"
    volumes:
      - "{{ riot.volume_folder }}/data:/data"
    env:
      VIRTUAL_HOST: "{{ riot.domain }}"
      VIRTUAL_PORT: "8080"
      LETSENCRYPT_HOST: "{{ riot.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
--- a/roles/docker/tasks/services/netdata.yml
+++ b/roles/docker/tasks/services/netdata.yml
@ -0,0 +1,25 @@
 ---
 - name: setup netdata docker container for system monitoring
  docker_container:
    name: netdata
    image: netdata/netdata
    restart_policy: unless-stopped
    hostname: "hevonen.servers.{{ base_domain }}"
    capabilities:
      - SYS_PTRACE
    security_opts:
      - apparmor:unconfined
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - name: external_services
    env:
      VIRTUAL_HOST : "{{ netdata.domain }}"
      LETSENCRYPT_HOST: "{{ netdata.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
      PGID: "999"
--- a/roles/docker/tasks/services/nextcloud.yml
+++ b/roles/docker/tasks/services/nextcloud.yml
@ -0,0 +1,48 @@
 ---
 - name: nextcloud network
  docker_network:
    name: nextcloud
 - name: nextcloud database volume
  docker_volume:
    name: nextcloud_db
 - name: nextcloud database container
  docker_container:
    name: nextcloud_db
    image: postgres:10
    state: started
    restart_policy: always
    networks:
      - name: nextcloud
    volumes:
      - nextcloud_db:/var/lib/postgresql/data
    env:
      POSTGRES_DB: somethingelse
      POSTGRES_USER: nextcloud
      POSTGRES_PASSWORD: "{{ postgres_passwords.nextcloud }}"
 - name: nextcloud app volume
  docker_volume:
    name: nextcloud_app
 - name: nextcloud app container
  docker_container:
    name: nextcloud_app
    image: nextcloud:apache
    state: started
    restart_policy: always
    networks:
      - name: nextcloud
      - name: external_services
    volumes:
      - nextcloud_app:/var/www/html
    env:
      VIRTUAL_HOST: "{{ nextcloud.domain }}"
      LETSENCRYPT_HOST: "{{ nextcloud.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
      POSTGRES_HOST: nextcloud_db
      POSTGRES_DB: nextcloud
      POSTGRES_USER: nextcloud
      POSTGRES_PASSWORD: "{{ postgres_passwords.nextcloud }}"
--- a/roles/docker/tasks/services/nginx-proxy.yml
+++ b/roles/docker/tasks/services/nginx-proxy.yml
@ -0,0 +1,47 @@
 ---
 - name: create nginx-proxy volume folders
  file:
    name: "{{ nginx.volume_folder }}/{{ volume }}"
    state: directory
  loop:
    - conf
    - vhost
    - html
    - dhparam
    - certs
  loop_control:
    loop_var: volume
 - name: nginx proxy container
  docker_container:
    name: nginx-proxy
    image: jwilder/nginx-proxy
    restart_policy: always
    networks:
      - name: external_services
    published_ports:
      - "80:80"
      - "443:443"
    volumes:
      - "{{ nginx.volume_folder }}/conf:/etc/nginx/conf.d"
      - "{{ nginx.volume_folder }}/vhost:/etc/nginx/vhost.d"
      - "{{ nginx.volume_folder }}/html:/usr/share/nginx/html"
      - "{{ nginx.volume_folder }}/dhparam:/etc/nginx/dhparam"
      - "{{ nginx.volume_folder }}/certs:/etc/nginx/certs:ro"
      - /var/run/docker.sock:/tmp/docker.sock:ro
 - name: nginx letsencrypt container
  docker_container:
    name: nginx-proxy-le
    image: jrcs/letsencrypt-nginx-proxy-companion
    restart_policy: always
    volumes:
      - "{{ nginx.volume_folder }}/vhost:/etc/nginx/vhost.d"
      - "{{ nginx.volume_folder }}/html:/usr/share/nginx/html"
      - "{{ nginx.volume_folder }}/dhparam:/etc/nginx/dhparam:ro"
      - "{{ nginx.volume_folder }}/certs:/etc/nginx/certs"
      - /var/run/docker.sock:/var/run/docker.sock:ro
    env:
      NGINX_PROXY_CONTAINER: nginx-proxy
--- a/roles/docker/tasks/services/openldap.yml
+++ b/roles/docker/tasks/services/openldap.yml
@ -0,0 +1,71 @@
 ---
 - name: create ldap volume folders
  file:
    name: "{{ ldap.volume_folder }}/{{ volume }}"
    state: directory
  loop:
    - "var/lib/ldap"
    - "etc/slapd"
    - "certs"
  loop_control:
    loop_var: volume
 - name: Create a network for ldap
  docker_network:
    name: ldap
 - name: openLDAP container
  docker_container:
    name: openldap
    image: osixia/openldap:1.2.2
    tty: true
    interactive: true
    volumes:
      - "{{ ldap.volume_folder }}/var/lib/ldap:/var/lib/ldap"
      - "{{ ldap.volume_folder }}/etc/slapd.d:/etc/ldap/slapd.d"
      - "{{ ldap.volume_folder }}/certs:/container/service/slapd/assets/certs/"
    published_ports:
      - "389:389"
      - "636:636"
    hostname: "{{ ldap.domain }}"
    domainname: "{{ ldap.domain }}" # important: same as hostname
    networks:
      - name: ldap
    env:
      LDAP_LOG_LEVEL: "256"
      LDAP_ORGANISATION: "{{ base_domain }}"
      LDAP_DOMAIN: "{{ base_domain }}"
      LDAP_BASE_DN: ""
      LDAP_ADMIN_PASSWORD: "{{ ldap_admin_password }}"
      LDAP_CONFIG_PASSWORD: "{{ ldap_config_password }}"
      LDAP_READONLY_USER: "false"
      LDAP_RFC2307BIS_SCHEMA: "false"
      LDAP_BACKEND: "mdb"
      LDAP_TLS: "true"
      LDAP_TLS_CRT_FILENAME: "ldap.crt"
      LDAP_TLS_KEY_FILENAME: "ldap.key"
      LDAP_TLS_CA_CRT_FILENAME: "ca.crt"
      LDAP_TLS_ENFORCE: "false"
      LDAP_TLS_CIPHER_SUITE: "SECURE256:-VERS-SSL3.0"
      LDAP_TLS_PROTOCOL_MIN: "3.1"
      LDAP_TLS_VERIFY_CLIENT: "demand"
      LDAP_REPLICATION: "false"
      KEEP_EXISTING_CONFIG: "false"
      LDAP_REMOVE_CONFIG_AFTER_SETUP: "true"
      LDAP_SSL_HELPER_PREFIX: "ldap"
 - name: phpLDAPadmin container
  docker_container:
    name: phpldapadmin
    image: osixia/phpldapadmin:latest
    networks:
      - name: external_services
      - name: ldap
    env:
      PHPLDAPADMIN_LDAP_HOSTS: "openldap"
      PHPLDAPADMIN_HTTPS: "false"
      PHPLDAPADMIN_TRUST_PROXY_SSL: "true"
      VIRTUAL_HOST: "{{ ldap.domain }}"
      LETSENCRYPT_HOST: "{{ ldap.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
--- a/roles/docker/tasks/services/ouroboros.yml
+++ b/roles/docker/tasks/services/ouroboros.yml
@ -0,0 +1,18 @@
 ---
 - name: ouroboros container
  docker_container:
    name: ouroboros
    image: pyouroboros/ouroboros
    restart_policy: unless-stopped
    networks:
      - name: external_services
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /root/.docker/config.json:/root/.docker/config.json
    env:
      LABEL_ENABLE: "true"
      LABELS_ONLY: "true"
      CLEANUP: "true"
      LATEST: "true"
      CRON: "*/1 * * * *"
--- a/roles/docker/tasks/services/passit.yml
+++ b/roles/docker/tasks/services/passit.yml
@ -0,0 +1,45 @@
 ---
 - name: passit network
  docker_network:
    name: passit
 - name: passit database volume
  docker_volume:
    name: passit_db
 - name: passit database container
  docker_container:
    name: passit_db
    image: postgres:10
    state: started
    restart_policy: always
    networks:
      - name: passit
    volumes:
      - passit_db:/var/lib/postgresql/data
    env:
      POSTGRES_USER: passit
      POSTGRES_PASSWORD: "{{ postgres_passwords.passit }}"
 - name: passit app container
  docker_container:
    name: passit
    image: passit/passit:stable
    command: bin/start.sh
    restart_policy: always
    networks:
      - name: passit
      - name: postfix
      - name: external_services
    env:
      DATABASE_URL: "postgres://passit:{{ postgres_passwords.passit }}@passit_db:5432/passit"
      SECRET_KEY: "{{ passit_secret_key }}"
      IS_DEBUG: 'False'
      EMAIL_URL: smtp://noop@{{ smtp_host }}:{{ smtp_port }}
      DEFAULT_FROM_EMAIL: "noreply@{{ passit.domain }}"
      EMAIL_CONFIRMATION_HOST: "https://{{ passit.domain }}"
      VIRTUAL_HOST: "{{ passit.domain }}"
      LETSENCRYPT_HOST: "{{ passit.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
--- a/roles/docker/tasks/services/postfix.yml
+++ b/roles/docker/tasks/services/postfix.yml
@ -0,0 +1,12 @@
 ---
 - name: setup postfix docker container for outgoing mail
  docker_container:
    name: postfix
    image: boky/postfix
    restart_policy: unless-stopped
    networks:
      - name: postfix
    env:
      ALLOWED_SENDER_DOMAINS: "{{ base_domain }}"
--- a/roles/docker/tasks/services/privatebin.yml
+++ b/roles/docker/tasks/services/privatebin.yml
@ -0,0 +1,31 @@
 ---
 - name: create privatebin volume folders
  file:
    name: "{{ privatebin.volume_folder }}/{{ volume }}"
    state: directory
  loop:
    - cfg
    - data
  loop_control:
    loop_var: volume
 - name: upload privatebin config
  template:
    src: files/configs/privatebin-conf.php
    dest: "{{ privatebin.volume_folder }}/cfg/conf.php"
 - name: privatebin app container
  docker_container:
    name: privatebin
    image: jgeusebroek/privatebin:latest
    restart_policy: unless-stopped
    volumes:
      - "{{ privatebin.volume_folder }}/cfg:/privatebin/cfg"
      - "{{ privatebin.volume_folder }}/data:/privatebin/data"
    networks:
      - name: external_services
    env:
      VIRTUAL_HOST: "{{ privatebin.domain }}"
      LETSENCRYPT_HOST: "{{ privatebin.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
--- a/roles/docker/tasks/services/thelounge.yml
+++ b/roles/docker/tasks/services/thelounge.yml
@ -0,0 +1,25 @@
 ---
 - name: thelounge volume
  docker_volume:
    name: thelounge
 - name: upload thelounge config
  template:
    src: files/configs/thelounge.js
    dest: /var/lib/docker/volumes/thelounge/_data/config.js
 - name: thelounge container
  docker_container:
    name: thelounge
    image: thelounge/lounge:latest
    restart_policy: always
    volumes:
      - thelounge:/home/lounge/data
    networks:
      - name: external_services
      - name: ldap
    env:
      VIRTUAL_HOST: "{{ thelounge.domain }}"
      LETSENCRYPT_HOST: "{{ thelounge.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
--- a/roles/docker/tasks/services/websites.yml
+++ b/roles/docker/tasks/services/websites.yml
@ -0,0 +1,29 @@
 ---
 - name: setup data.coop website docker container
  docker_container:
    name: data.coop_website
    image: docker.data.coop/data-coop-website
    restart_policy: unless-stopped
    networks:
      - name: external_services
    env:
      VIRTUAL_HOST : "{{ data_coop_website.domain }}"
      LETSENCRYPT_HOST: "{{ data_coop_website.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
    labels:
      com.ouroboros.enable: "true"    
 - name: setup cryptohagen.dk website docker container
  docker_container:
    name: cryptohagen_website
    restart_policy: unless-stopped
    image: docker.data.coop/cryptohagen-website
    networks:
      - name: external_services
    env:
      VIRTUAL_HOST : "{{ cryptohagen_website.domain }}"
      LETSENCRYPT_HOST: "{{ cryptohagen_website.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
    labels:
      com.ouroboros.enable: "true"  
--- a/roles/docker/templates/compose-files/cryptoaarhus_website.yml.j2
+++ b/roles/docker/templates/compose-files/cryptoaarhus_website.yml.j2
@ -1,17 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  web:
    image: docker.data.coop/cryptoaarhus-website
    restart: unless-stopped
    networks:
      - external_services
    environment:
      VIRTUAL_HOST : "{{ services.cryptoaarhus_website.domains | join(',') }}"
      LETSENCRYPT_HOST: "{{ services.cryptoaarhus_website.domains | join(',') }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/cryptohagen_website.yml.j2
+++ b/roles/docker/templates/compose-files/cryptohagen_website.yml.j2
@ -1,17 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  web:
    image: docker.data.coop/cryptohagen-website
    restart: unless-stopped
    networks:
      - external_services
    environment:
      VIRTUAL_HOST : "{{ services.cryptohagen_website.domains | join(',') }}"
      LETSENCRYPT_HOST: "{{ services.cryptohagen_website.domains | join(',') }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/data_coop_website.yml.j2
+++ b/roles/docker/templates/compose-files/data_coop_website.yml.j2
@ -1,27 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  prod-web:
    image: docker.data.coop/data-coop-website:{{ services.data_coop_website.version }}
    restart: unless-stopped
    networks:
      - external_services
    environment:
      VIRTUAL_HOST: "{{ services.data_coop_website.domain }},{{ services.data_coop_website.www_domain }}"
      LETSENCRYPT_HOST: "{{ services.data_coop_website.domain }},{{ services.data_coop_website.www_domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
  staging-web:
    image: docker.data.coop/data-coop-website:{{ services.data_coop_website.staging_version }}
    restart: unless-stopped
    networks:
      - external_services
    environment:
      VIRTUAL_HOST: "{{ services.data_coop_website.staging_domain }}"
      LETSENCRYPT_HOST: "{{ services.data_coop_website.staging_domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/diun.yml.j2
+++ b/roles/docker/templates/compose-files/diun.yml.j2
@ -1,26 +0,0 @@
 # vim: ft=yaml.ansible
 ---
 version: "3.5"
 services:
  diun:
    image: "ghcr.io/crazy-max/diun:{{ services.diun.version }}"
    command: serve
    volumes:
      - "./data:/data"
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      - "TZ=Europe/Paris"
      - "DIUN_WATCH_WORKERS=20"
      - "DIUN_WATCH_SCHEDULE=0 */6 * * *"
      - "DIUN_WATCH_JITTER=30s"
      - "DIUN_PROVIDERS_DOCKER=true"
      - "DIUN_PROVIDERS_DOCKER_WATCHBYDEFAULT=true"
      - "DIUN_NOTIF_MATRIX_HOMESERVERURL=https://{{ services.matrix.domain }}"
      - "DIUN_NOTIF_MATRIX_USER={{ services.diun.matrix_user }}"
      - "DIUN_NOTIF_MATRIX_ROOMID={{ services.diun.matrix_room }}"
      - "DIUN_NOTIF_MATRIX_PASSWORD={{ diun_secrets.matrix_password }}"
      - "DIUN_NOTIF_MATRIX_MSGTYPE=text"
    labels:
      - "diun.enable=true"
    restart: always
--- a/roles/docker/templates/compose-files/docker_registry.yml.j2
+++ b/roles/docker/templates/compose-files/docker_registry.yml.j2
@ -1,23 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  app:
    image: registry:{{ services.docker_registry.version }}
    restart: always
    networks:
      - external_services
    volumes:
      - "./registry:/var/lib/registry"
      - "./auth:/auth"
    environment:
      VIRTUAL_HOST: "{{ services.docker_registry.domain }}"
      LETSENCRYPT_HOST: "{{ services.docker_registry.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
      REGISTRY_AUTH: "htpasswd"
      REGISTRY_AUTH_HTPASSWD_PATH: "/auth/htpasswd"
      REGISTRY_AUTH_HTPASSWD_REALM: "data.coop docker registry"
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/drone.yml.j2
+++ b/roles/docker/templates/compose-files/drone.yml.j2
@ -1,40 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  app:
    image: drone/drone:{{ services.drone.version }}
    restart: unless-stopped
    networks:
      - default
      - external_services
    volumes:
      - ".:/data"
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      DRONE_GITEA_SERVER: https://{{ services.forgejo.domain }}
      DRONE_GITEA_CLIENT_ID: "{{ drone_secrets.oauth_client_id }}"
      DRONE_GITEA_CLIENT_SECRET: "{{ drone_secrets.oauth_client_secret }}"
      DRONE_GIT_ALWAYS_AUTH: true
      DRONE_SERVER_HOST: "{{ services.drone.domain }}"
      DRONE_SERVER_PROTO: https
      DRONE_RPC_SECRET: "{{ drone_secrets.rpc_shared_secret }}"
      VIRTUAL_HOST: "{{ services.drone.domain }}"
      LETSENCRYPT_HOST: "{{ services.drone.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
  runner:
    image: drone/drone-runner-docker:{{ services.drone.version }}
    restart: unless-stopped
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      DRONE_RPC_HOST: "{{ services.drone.domain }}"
      DRONE_RPC_PROTO: https
      DRONE_RPC_SECRET: "{{ drone_secrets.rpc_shared_secret }}"
      DRONE_RUNNER_CAPACITY: 2
      DRONE_RUNNER_NAME: data.coop_drone_runner
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/element.yml.j2
+++ b/roles/docker/templates/compose-files/element.yml.j2
@ -1,22 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  app:
    image: avhost/docker-matrix-element:{{ services.element.version }}
    restart: unless-stopped
    networks:
      - external_services
    expose:
      - "8080"
    volumes:
      - "./data:/data"
    environment:
      VIRTUAL_HOST: "{{ services.element.domain }}"
      VIRTUAL_PORT: "8080"
      LETSENCRYPT_HOST: "{{ services.element.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/fedi_dk_website.yml.j2
+++ b/roles/docker/templates/compose-files/fedi_dk_website.yml.j2
@ -1,22 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  web:
    image: docker.data.coop/unipi:{{ services.fedi_dk_website.version }}
    restart: unless-stopped
    networks:
      - external_services
    environment:
      VIRTUAL_HOST: "{{ services.fedi_dk_website.domain }}"
      LETSENCRYPT_HOST: "{{ services.fedi_dk_website.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
    command: --remote=https://git.data.coop/fedi.dk/website.git#main
    cap_add:
      - NET_ADMIN
    devices:
      - "/dev/net/tun"
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/forgejo.yml.j2
+++ b/roles/docker/templates/compose-files/forgejo.yml.j2
@ -1,38 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  app:
    image: codeberg.org/forgejo/forgejo:{{ services.forgejo.version }}
    restart: unless-stopped
    networks:
      - external_services
      - postfix
    volumes:
      - ".:/data"
    ports:
      - "22:22"
    environment:
      VIRTUAL_HOST: "{{ services.forgejo.domain }}"
      VIRTUAL_PORT: "3000"
      LETSENCRYPT_HOST: "{{ services.forgejo.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
      # Forgejo customization, see: https://docs.gitea.io/en-us/install-with-docker/#customization
      # https://docs.gitea.io/en-us/config-cheat-sheet/#security-security
      FORGEJO__mailer__ENABLED: true
      FORGEJO__mailer__FROM: noreply@{{ services.forgejo.domain }}
      FORGEJO__mailer__PROTOCOL: smtp
      FORGEJO__mailer__SMTP_ADDR: "{{ smtp_host }}"
      FORGEJO__mailer__SMTP_PORT: "{{ smtp_port }}"
      FORGEJO__security__LOGIN_REMEMBER_DAYS: "60"
      FORGEJO__security__PASSWORD_COMPLEXITY: off
      FORGEJO__security__MIN_PASSWORD_LENGTH: "8"
      FORGEJO__security__PASSWORD_CHECK_PWN: true
      FORGEJO__service__ENABLE_NOTIFY_MAIL: true
      FORGEJO__service__REGISTER_EMAIL_CONFIRM: true
 networks:
  external_services:
    external: true
  postfix:
    external: true
--- a/roles/docker/templates/compose-files/hedgedoc.yml.j2
+++ b/roles/docker/templates/compose-files/hedgedoc.yml.j2
@ -1,44 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  db:
    image: postgres:{{ services.hedgedoc.postgres_version }}
    restart: unless-stopped
    volumes:
      - "./db:/var/lib/postgresql/data"
    environment:
      POSTGRES_USER: codimd
      POSTGRES_PASSWORD: "{{ postgres_passwords.hedgedoc }}"
      POSTGRES_DB: codimd
  app:
    image: quay.io/hedgedoc/hedgedoc:{{ services.hedgedoc.version }}
    volumes:
      - "./hedgedoc/uploads:/hedgedoc/public/uploads"
      - "./sso.data.coop.pem:/sso.data.coop.pem"
    restart: unless-stopped
    networks:
      - default
      - external_services
    environment:
      CMD_DB_URL: postgres://codimd:{{ postgres_passwords.hedgedoc }}@db:5432/codimd
      CMD_DOMAIN: "{{ services.hedgedoc.domain }}"
      CMD_ALLOW_EMAIL_REGISTER: False
      CMD_IMAGE_UPLOAD_TYPE: filesystem
      CMD_EMAIL: False
      CMD_SAML_IDPCERT: /sso.data.coop.pem
      CMD_SAML_IDPSSOURL: https://{{ services.keycloak.domain }}/auth/realms/datacoop/protocol/saml
      CMD_SAML_ISSUER: hedgedoc
      CMD_SAML_IDENTIFIERFORMAT: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
      CMD_USECDN: false
      CMD_PROTOCOL_USESSL: true
      VIRTUAL_HOST: "{{ services.hedgedoc.domain }}"
      LETSENCRYPT_HOST: "{{ services.hedgedoc.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
    depends_on:
      - db
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/keycloak.yml.j2
+++ b/roles/docker/templates/compose-files/keycloak.yml.j2
@ -1,42 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  db:
    image: postgres:{{ services.keycloak.postgres_version }}
    restart: unless-stopped
    volumes:
      - "./data:/var/lib/postgresql/data"
    environment:
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: "{{ postgres_passwords.keycloak }}"
      POSTGRES_DB: keycloak
  app:
    image: quay.io/keycloak/keycloak:{{ services.keycloak.version }}
    restart: unless-stopped
    networks:
      - default
      - postfix
      - external_services
    command:
      - "start"
      - "--db=postgres"
      - "--db-url=jdbc:postgresql://db:5432/keycloak"
      - "--db-username=keycloak"
      - "--db-password={{ postgres_passwords.keycloak }}"
      - "--hostname={{ services.keycloak.domain }}"
      - "--proxy=edge"
      - "--https-port=8080"
      - "--http-relative-path=/auth"
    environment:
      VIRTUAL_HOST: "{{ services.keycloak.domain }}"
      VIRTUAL_PORT: "8080"
      LETSENCRYPT_HOST: "{{ services.keycloak.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 networks:
  postfix:
    external: true
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/mailu.yml.j2
+++ b/roles/docker/templates/compose-files/mailu.yml.j2
@ -1,146 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  postgres:
    image: postgres:{{ services.mailu.postgres_version }}
    restart: unless-stopped
    environment:
      POSTGRES_DB: mailu
      POSTGRES_USER: mailu
      POSTGRES_PASSWORD: "{{ postgres_passwords.mailu }}"
    volumes:
      - "./postgres:/var/lib/postgresql/data"
    dns:
      - "{{ services.mailu.dns }}"
  redis:
    image: redis:{{ services.mailu.redis_version }}
    restart: unless-stopped
    volumes:
      - "./redis:/data"
    depends_on:
      - resolver
    dns:
      - "{{ services.mailu.dns }}"
  front:
    image: ghcr.io/mailu/nginx:{{ services.mailu.version }}
    restart: unless-stopped
    env_file: mailu.env
    environment:
      VIRTUAL_HOST: "{{ services.mailu.domain }}"
      LETSENCRYPT_HOST: "{{ services.mailu.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
    volumes:
      - "./certs:/certs"
      - "./overrides/nginx:/overrides:ro"
    expose:
      - "80"
    ports:
      - "25:25"
      - "465:465"
      - "587:587"
      - "110:110"
      - "995:995"
      - "143:143"
      - "993:993"
    networks:
      - default
      - webmail
      - external_services
    depends_on:
      - resolver
    dns:
      - "{{ services.mailu.dns }}"
  resolver:
    image: ghcr.io/mailu/unbound:{{ services.mailu.version }}
    restart: unless-stopped
    env_file: mailu.env
    networks:
      default:
        ipv4_address: "{{ services.mailu.dns }}"
  admin:
    image: ghcr.io/mailu/admin:{{ services.mailu.version }}
    restart: unless-stopped
    env_file: mailu.env
    volumes:
      - "./data:/data"
      - "./dkim:/dkim"
    networks:
      default:
        aliases:
          - admin.mailu
    depends_on:
      - redis
      - resolver
    dns:
      - "{{ services.mailu.dns }}"
  imap:
    image: ghcr.io/mailu/dovecot:{{ services.mailu.version }}
    restart: unless-stopped
    env_file: mailu.env
    volumes:
      - "./mail:/mail"
      - "./overrides/dovecot:/overrides:ro"
    depends_on:
      - front
      - resolver
    dns:
      - "{{ services.mailu.dns }}"
  smtp:
    image: ghcr.io/mailu/postfix:{{ services.mailu.version }}
    restart: unless-stopped
    env_file: mailu.env
    volumes:
      - "./mailqueue:/queue"
      - "./overrides/postfix:/overrides:ro"
    depends_on:
      - front
      - resolver
    dns:
      - "{{ services.mailu.dns }}"
  antispam:
    image: ghcr.io/mailu/rspamd:{{ services.mailu.version }}
    hostname: antispam
    restart: unless-stopped
    env_file: mailu.env
    volumes:
      - "./filter:/var/lib/rspamd"
      - "./overrides/rspamd:/overrides:ro"
    depends_on:
      - front
      - redis
      - resolver
    dns:
      - "{{ services.mailu.dns }}"
  webmail:
    image: ghcr.io/mailu/webmail:{{ services.mailu.version }}
    restart: unless-stopped
    env_file: mailu.env
    volumes:
      - "./webmail:/data"
      - "./overrides/snappymail:/overrides:ro"
    networks:
      - webmail
    depends_on:
      - front
 networks:
  default:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: "{{ services.mailu.subnet }}"
  webmail:
    driver: bridge
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/mastodon.yml.j2
+++ b/roles/docker/templates/compose-files/mastodon.yml.j2
@ -1,146 +0,0 @@
 # vim: ft=yaml.docker-compose
 x-sidekiq: &sidekiq
  image: tootsuite/mastodon:{{ services.mastodon.version }}
  restart: always
  env_file: mastodon.env
  networks:
    - default
    - postfix
    - external_services
  volumes:
    - "./mastodon_data:/mastodon/public/system"
  healthcheck:
    test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]
  depends_on:
    db:
      condition: service_healthy
    redis:
      condition: service_healthy
 version: "3.8"
 services:
  db:
    restart: always
    image: postgres:{{ services.mastodon.postgres_version }}
    shm_size: 256mb
    volumes:
      - "./postgres_data:/var/lib/postgresql/data"
      - "./postgres_config:/config:ro"
    command: postgres -c config_file=/config/postgresql.conf
    environment:
      POSTGRES_HOST_AUTH_METHOD: trust
    healthcheck:
      test: ['CMD', 'pg_isready', '-U', 'postgres']
  redis:
    restart: always
    image: redis:{{ services.mastodon.redis_version }}
    volumes:
      - "./redis_data:/data"
    healthcheck:
      test: ['CMD', 'redis-cli', 'ping']
  web:
    image: tootsuite/mastodon:{{ services.mastodon.version }}
    restart: always
    env_file: mastodon.env
    command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"
    networks:
      - default
      - external_services
    volumes:
      - "./mastodon_data:/mastodon/public/system"
    environment:
      MAX_THREADS: 10
      WEB_CONCURRENCY: 3
      VIRTUAL_HOST: "{{ services.mastodon.domain }}"
      VIRTUAL_PORT: "3000"
      VIRTUAL_PATH: /
      LETSENCRYPT_HOST: "{{ services.mastodon.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
    healthcheck:
      test: ['CMD-SHELL', 'wget -q --spider --proxy=off localhost:3000/health || exit 1']
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
  streaming:
    image: tootsuite/mastodon:{{ services.mastodon.version }}
    restart: always
    env_file: mastodon.env
    command: node ./streaming
    networks:
      - default
      - external_services
    ports:
      - "127.0.0.1:4000:4000"
    environment:
      DB_POOL: 15
      VIRTUAL_HOST: "{{ services.mastodon.domain }}"
      VIRTUAL_PORT: "4000"
      VIRTUAL_PATH: "/api/v1/streaming"
    healthcheck:
      test: ['CMD-SHELL', 'wget -q --spider --proxy=off localhost:4000/api/v1/streaming/health || exit 1']
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
  # sidekiq-default-push-pull: DB_POOL = 25, -c 25 for 25 connections
  sidekiq-default-push-pull:
    <<: *sidekiq
    command: bundle exec sidekiq -c 25 -q default -q push -q pull
    environment:
      DB_POOL: 25
  # sidekiq-default-pull-push: DB_POOL = 25, -c 25 for 25 connections
  sidekiq-default-pull-push:
    <<: *sidekiq
    command: bundle exec sidekiq -c 25 -q default -q pull -q push
    environment:
      DB_POOL: 25
  # sidekiq-pull-default-push: DB_POOL = 25, -c 25 for 25 connections
  sidekiq-pull-default-push:
    <<: *sidekiq
    command: bundle exec sidekiq -c 25 -q pull -q default -q push
    environment:
      DB_POOL: 25
  # sidekiq-push-default-pull: DB_POOL = 25, -c 25 for 25 connections
  sidekiq-push-default-pull:
    <<: *sidekiq
    command: bundle exec sidekiq -c 25 -q push -q default -q pull
    environment:
      DB_POOL: 25
  # sidekiq-push-scheduler: DB_POOL = 5, -c 5 for 5 connections
  sidekiq-push-scheduler:
    <<: *sidekiq
    command: bundle exec sidekiq -c 5 -q push -q scheduler
    environment:
      DB_POOL: 5
  # sidekiq-push-mailers: DB_POOL = 5, -c 5 for 5 connections
  sidekiq-push-mailers:
    <<: *sidekiq
    command: bundle exec sidekiq -c 5 -q push -q mailers
    environment:
      DB_POOL: 5
  # sidekiq-push-ingress: DB_POOL = 10, -c 10 for 10 connections
  sidekiq-push-ingress:
    <<: *sidekiq
    command: bundle exec sidekiq -c 10 -q push -q ingress
    environment:
      DB_POOL: 10
 networks:
  external_services:
    external: true
  postfix:
    external: true
--- a/roles/docker/templates/compose-files/matrix.yml.j2
+++ b/roles/docker/templates/compose-files/matrix.yml.j2
@ -1,36 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  postgres:
    image: postgres:{{ services.matrix.postgres_version }}
    restart: unless-stopped
    volumes:
      - "./db:/var/lib/postgresql/data"
    environment:
      POSTGRES_USER: synapse
      POSTGRES_PASSWORD: "{{ postgres_passwords.matrix }}"
  synapse:
    image: ghcr.io/element-hq/synapse:{{ services.matrix.version }}
    restart: unless-stopped
    networks:
      - default
      - external_services
      - postfix
    volumes:
      - "./data:/data"
    environment:
      SYNAPSE_CONFIG_PATH: /data/homeserver.yaml
      SYNAPSE_CACHE_FACTOR: "2"
      SYNAPSE_LOG_LEVEL: INFO
      VIRTUAL_HOST: "{{ services.matrix.domain }}"
      VIRTUAL_PORT: "8008"
      LETSENCRYPT_HOST: "{{ services.matrix.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 networks:
  external_services:
    external: true
  postfix:
    external: true
--- a/roles/docker/templates/compose-files/membersystem.yml.j2
+++ b/roles/docker/templates/compose-files/membersystem.yml.j2
@ -1,46 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  app:
    image: docker.data.coop/membersystem:{{ services.membersystem.version }}
    restart: always
    user: "$UID:$GID"
    tty: true
    networks:
      - default
      - external_services
      - postfix
    environment:
      SECRET_KEY: "{{ membersystem_secrets.secret_key }}"
      DATABASE_URL: postgres://postgres:{{ postgres_passwords.membersystem }}@postgres:5432/postgres
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      EMAIL_BACKEND: django.core.mail.backends.smtp.EmailBackend
      EMAIL_URL: smtp://noop@{{ smtp_host }}:{{ smtp_port }}
      VIRTUAL_HOST: "{{ services.membersystem.domain }}"
      VIRTUAL_PORT: "8000"
      LETSENCRYPT_HOST: "{{ services.membersystem.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
      ALLOWED_HOSTS: "{{ services.membersystem.domain }}"
      CSRF_TRUSTED_ORIGINS: https://{{ services.membersystem.domain }}
      DJANGO_ADMINS: "{{ services.membersystem.django_admins }}"
      DEFAULT_FROM_EMAIL: noreply@{{ services.membersystem.domain }}
      STRIPE_API_KEY: "{{ membersystem_secrets.stripe_api_key }}"
      STRIPE_ENDPOINT_SECRET: "{{ membersystem_secrets.stripe_endpoint_secret }}"
    depends_on:
      - postgres
  postgres:
    image: postgres:{{ services.membersystem.postgres_version }}
    restart: always
    volumes:
      - "./postgres/data:/var/lib/postgresql/data"
    environment:
      POSTGRES_PASSWORD: "{{ postgres_passwords.membersystem }}"
 networks:
  external_services:
    external: true
  postfix:
    external: true
--- a/roles/docker/templates/compose-files/netdata.yml.j2
+++ b/roles/docker/templates/compose-files/netdata.yml.j2
@ -1,36 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services: 
  app:
    image: netdata/netdata:{{ services.netdata.version }}
    restart: unless-stopped
    hostname: hevonen.servers.{{ base_domain }}
    volumes: 
      - "/proc:/host/proc:ro"
      - "/sys:/host/sys:ro"
      - "/etc/os-release:/host/etc/os-release:ro"
    networks:
      - default
      - external_services
    environment:
      VIRTUAL_HOST : "{{ services.netdata.domain }}"
      LETSENCRYPT_HOST: "{{ services.netdata.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
      PGID: "999"
      DOCKER_HOST: "socket_proxy:2375"
    cap_add:
      - SYS_PTRACE
    security_opt:
      - apparmor:unconfined
  socket-proxy:
    image: tecnativa/docker-socket-proxy:latest
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    environment:
      CONTAINERS: 1
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/nextcloud.yml.j2
+++ b/roles/docker/templates/compose-files/nextcloud.yml.j2
@ -1,59 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  postgres:
    image: postgres:{{ services.nextcloud.postgres_version }}
    restart: unless-stopped
    volumes:
      - "./postgres:/var/lib/postgresql/data"
    environment:
      POSTGRES_DB: nextcloud
      POSTGRES_PASSWORD: "{{ postgres_passwords.nextcloud }}"
      POSTGRES_USER: nextcloud
  redis:
    image: redis:{{ services.nextcloud.redis_version }}
    restart: unless-stopped
    command: redis-server --requirepass {{ nextcloud_secrets.redis_password }}
    tmpfs:
      - /var/lib/redis
  cron:
    image: nextcloud:{{ services.nextcloud.version }}
    restart: unless-stopped
    entrypoint: /cron.sh
    volumes:
      - "./app:/var/www/html"
    depends_on:
      - postgres
      - redis
  app:
    image: nextcloud:{{ services.nextcloud.version }}
    restart: unless-stopped
    networks:
      - default
      - postfix
      - external_services
    volumes:
      - "./app:/var/www/html"
    environment:
      VIRTUAL_HOST: "{{ services.nextcloud.domain }}"
      LETSENCRYPT_HOST: "{{ services.nextcloud.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
      POSTGRES_HOST: postgres
      POSTGRES_DB: nextcloud
      POSTGRES_USER: nextcloud
      POSTGRES_PASSWORD: "{{ postgres_passwords.nextcloud }}"
      REDIS_HOST: redis
      REDIS_HOST_PASSWORD: "{{ nextcloud_secrets.redis_password }}"
    depends_on:
      - postgres
      - redis
 networks:
  postfix:
    external: true
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/nginx_proxy.yml.j2
+++ b/roles/docker/templates/compose-files/nginx_proxy.yml.j2
@ -1,38 +0,0 @@
 version: "3.8"
 services:
  proxy:
    image: nginxproxy/nginx-proxy:{{ services.nginx_proxy.version }}
    restart: always
    networks:
      - external_services
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./conf:/etc/nginx/conf.d"
      - "./vhost:/etc/nginx/vhost.d"
      - "./html:/usr/share/nginx/html"
      - "./dhparam:/etc/nginx/dhparam"
      - "./certs:/etc/nginx/certs:ro"
      - "/var/run/docker.sock:/tmp/docker.sock:ro"
    labels:
      - com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy
 {% if letsencrypt_enabled %}
  acme:
    image: nginxproxy/acme-companion:{{ services.nginx_proxy.acme_companion_version }}
    restart: always
    volumes:
      - "./vhost:/etc/nginx/vhost.d"
      - "./html:/usr/share/nginx/html"
      - "./dhparam:/etc/nginx/dhparam:ro"
      - "./certs:/etc/nginx/certs"
      - /var/run/docker.sock:/var/run/docker.sock:ro
    depends_on:
      - proxy
 {% endif %}
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/openldap.yml.j2
+++ b/roles/docker/templates/compose-files/openldap.yml.j2
@ -1,58 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  app:
    image: osixia/openldap:{{ services.openldap.version }}
    restart: unless-stopped
    tty: true
    stdin_open: true
    volumes:
      - "./var/lib/ldap:/var/lib/ldap"
      - "./etc/slapd.d:/etc/ldap/slapd.d"
      - "./certs:/container/service/slapd/assets/certs/"
    ports:
      - "389:389"
      - "636:636"
    hostname: "{{ services.openldap.domain }}"
    domainname: "{{ services.openldap.domain }}" # important: same as hostname
    environment:
      LDAP_LOG_LEVEL: "256"
      LDAP_ORGANISATION: "{{ base_domain }}"
      LDAP_DOMAIN: "{{ base_domain }}"
      LDAP_BASE_DN: ""
      LDAP_ADMIN_PASSWORD: "{{ ldap_admin_password }}"
      LDAP_CONFIG_PASSWORD: "{{ ldap_config_password }}"
      LDAP_READONLY_USER: false
      LDAP_RFC2307BIS_SCHEMA: false
      LDAP_BACKEND: mdb
      LDAP_TLS: true
      LDAP_TLS_CRT_FILENAME: ldap.crt
      LDAP_TLS_KEY_FILENAME: ldap.key
      LDAP_TLS_CA_CRT_FILENAME: ca.crt
      LDAP_TLS_ENFORCE: false
      LDAP_TLS_CIPHER_SUITE: SECURE256:-VERS-SSL3.0
      LDAP_TLS_PROTOCOL_MIN: "3.1"
      LDAP_TLS_VERIFY_CLIENT: demand
      LDAP_REPLICATION: false
      KEEP_EXISTING_CONFIG: false
      LDAP_REMOVE_CONFIG_AFTER_SETUP: true
      LDAP_SSL_HELPER_PREFIX: ldap
  admin:
    image: osixia/phpldapadmin:{{ services.openldap.phpldapadmin_version }}
    restart: unless-stopped
    networks:
      - default
      - external_services
    environment:
      PHPLDAPADMIN_LDAP_HOSTS: app
      PHPLDAPADMIN_HTTPS: false
      PHPLDAPADMIN_TRUST_PROXY_SSL: true
      VIRTUAL_HOST: "{{ services.openldap.domain }}"
      LETSENCRYPT_HOST: "{{ services.openldap.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/passit.yml.j2
+++ b/roles/docker/templates/compose-files/passit.yml.j2
@ -1,38 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  db:
    image: postgres:{{ services.passit.postgres_version }}
    restart: always
    volumes:
      - "./data:/var/lib/postgresql/data"
    environment:
      POSTGRES_USER: passit
      POSTGRES_PASSWORD: "{{ postgres_passwords.passit }}"
  app:
    image: passit/passit:{{ services.passit.version }}
    command: bin/start.sh
    restart: always
    networks:
      - default
      - postfix
      - external_services
    environment:
      DATABASE_URL: postgres://passit:{{ postgres_passwords.passit }}@db:5432/passit
      SECRET_KEY: "{{ passit_secret_key }}"
      IS_DEBUG: "False"
      EMAIL_URL: smtp://noop@{{ smtp_host }}:{{ smtp_port }}
      DEFAULT_FROM_EMAIL: noreply@{{ services.passit.domain }}
      EMAIL_CONFIRMATION_HOST: https://{{ services.passit.domain }}
      FIDO_SERVER_ID: "{{ services.passit.domain }}"
      VIRTUAL_HOST: "{{ services.passit.domain }}"
      LETSENCRYPT_HOST: "{{ services.passit.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 networks:
  postfix:
    external: true
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/portainer.yml.j2
+++ b/roles/docker/templates/compose-files/portainer.yml.j2
@ -1,21 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  app:
    image: portainer/portainer-ee:{{ services.portainer.version }}
    restart: always
    networks:
      - external_services
    volumes:
      - ".:/data"
      - "/var/run/docker.sock:/var/run/docker.sock:rw"
    environment:
      VIRTUAL_HOST: "{{ services.portainer.domain }}"
      VIRTUAL_PORT: "9000"
      LETSENCRYPT_HOST: "{{ services.portainer.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/postfix.yml.j2
+++ b/roles/docker/templates/compose-files/postfix.yml.j2
@ -1,22 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  app:
    image: boky/postfix:{{ services.postfix.version }}
    restart: always
    networks:
      postfix:
        aliases:
          - postfix
    volumes:
      - "./dkim:/etc/opendkim/keys"
    environment:
      # Get all services which have allowed_sender_domain defined
      ALLOWED_SENDER_DOMAINS: "data.coop {{ services | dict2items | selectattr('value.allowed_sender_domain', 'true') | map(attribute='value.domain') | join(' ') }}"
      HOSTNAME: "{{ services.postfix.domain }}" # the name the smtp server will identify itself as
      DKIM_AUTOGENERATE: true
 networks:
  postfix:
    external: true
--- a/roles/docker/templates/compose-files/privatebin.yml.j2
+++ b/roles/docker/templates/compose-files/privatebin.yml.j2
@ -1,20 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  app:
    image: jgeusebroek/privatebin:{{ services.privatebin.version }}
    restart: unless-stopped
    volumes:
      - "./cfg:/privatebin/cfg"
      - "./data:/privatebin/data"
    networks:
      - external_services
    environment:
      VIRTUAL_HOST: "{{ services.privatebin.domain }}"
      LETSENCRYPT_HOST: "{{ services.privatebin.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/rallly.yml.j2
+++ b/roles/docker/templates/compose-files/rallly.yml.j2
@ -1,41 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  db:
    image: postgres:{{ services.rallly.postgres_version }}
    restart: always
    shm_size: 256mb
    volumes:
      - "./postgres:/var/lib/postgresql/data"
    environment:
      POSTGRES_PASSWORD: "{{ postgres_passwords.rallly }}"
      POSTGRES_DB: rallly_db
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 5
  app:
    image: lukevella/rallly:{{ services.rallly.version }}
    restart: always
    networks:
      - default
      - external_services
      - postfix
    env_file: rallly.env
    environment:
      VIRTUAL_HOST: "{{ services.rallly.domain }}"
      VIRTUAL_PORT: "3000"
      LETSENCRYPT_HOST: "{{ services.rallly.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
    depends_on:
      db:
        condition: service_healthy
 networks:
  external_services:
    external: true
  postfix:
    external: true
--- a/roles/docker/templates/compose-files/restic.yml.j2
+++ b/roles/docker/templates/compose-files/restic.yml.j2
@ -1,50 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  backup:
    image: mazzolino/restic:{{ services.restic.version }}
    restart: always
    hostname: {{ inventory_hostname_short }}
    domainname: {{ inventory_hostname }}
    environment:
      RUN_ON_STARTUP: false
      BACKUP_CRON: "0 30 3 * * *"
      RESTIC_REPOSITORY: sftp:{{ services.restic.remote_user }}@{{ services.restic.remote_domain }}:{{ services.restic.repository }}
      RESTIC_PASSWORD: "{{ restic_secrets.repository_password }}"
      RESTIC_BACKUP_SOURCES: /mnt/volumes
      RESTIC_BACKUP_ARGS: >-
        --tag datacoop-volumes
        --exclude '*.tmp'
        --exclude '/mnt/volumes/mastodon/mastodon_data/cache/'
        --exclude '/mnt/volumes/restic/'
        --verbose
      RESTIC_FORGET_ARGS: >-
        --keep-last 10
        --keep-daily 7
        --keep-weekly 5
        --keep-monthly 12
      TZ: Europe/Copenhagen
      POST_COMMANDS_FAILURE: /run/libexec/failure.sh
      POST_COMMANDS_SUCCESS: /run/libexec/success.sh
    volumes:
      - "./ssh:/run/secrets/.ssh:ro"
      - "./scripts:/run/libexec:ro"
      - "/docker-volumes:/mnt/volumes:ro"
    networks:
      - postfix
  prune:
    image: mazzolino/restic:{{ services.restic.version }}
    environment:
      RUN_ON_STARTUP: false
      PRUNE_CRON: "0 30 4 * * *"
      RESTIC_REPOSITORY: sftp:{{ services.restic.remote_user }}@{{ services.restic.remote_domain }}:{{ services.restic.repository }}
      RESTIC_PASSWORD: "{{ restic_secrets.repository_password }}"
      TZ: Europe/copenhagen
    volumes:
      - "./ssh:/run/secrets/.ssh:ro"
 networks:
  postfix:
    external: true
--- a/roles/docker/templates/compose-files/slides_2022_website.yml.j2
+++ b/roles/docker/templates/compose-files/slides_2022_website.yml.j2
@ -1,22 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  web:
    image: docker.data.coop/unipi:{{ services.slides_2022_website.version }}
    restart: unless-stopped
    networks:
      - external_services
    environment:
      VIRTUAL_HOST: "{{ services.slides_2022_website.domain }}"
      LETSENCRYPT_HOST: "{{ services.slides_2022_website.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
    command: --remote=https://git.data.coop/data.coop/slides.git#slides2022
    cap_add:
      - NET_ADMIN
    devices:
      - "/dev/net/tun"
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/ulovliglogning_website.yml.j2
+++ b/roles/docker/templates/compose-files/ulovliglogning_website.yml.j2
@ -1,17 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  web:
    image: ulovliglogning/ulovliglogning.dk:latest
    restart: unless-stopped
    networks:
      - external_services
    environment:
      VIRTUAL_HOST: "{{ services.ulovliglogning_website.domains | join(',') }}"
      LETSENCRYPT_HOST: "{{ services.ulovliglogning_website.domains | join(',') }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/uptime_kuma.yml.j2
+++ b/roles/docker/templates/compose-files/uptime_kuma.yml.j2
@ -1,21 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: '3.3'
 services:
  uptime-kuma:
    image: "louislam/uptime-kuma:{{ services.uptime_kuma.version }}"
    restart: always
    container_name: uptime-kuma
    networks:
        - external_services
    volumes:
      - "./uptime-kuma-data:/app/data"
    environment:
      VIRTUAL_HOST: "{{ services.uptime_kuma.domain }},{{ services.uptime_kuma.status_domain }}"
      LETSENCRYPT_HOST: "{{ services.uptime_kuma.domain }},{{ services.uptime_kuma.status_domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/vhs_website.yml.j2
+++ b/roles/docker/templates/compose-files/vhs_website.yml.j2
@ -1,22 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  web:
    image: docker.data.coop/unipi:{{ services.vhs_website.version }}
    restart: unless-stopped
    networks:
      - external_services
    environment:
      VIRTUAL_HOST: "{{ services.vhs_website.domain }}"
      LETSENCRYPT_HOST: "{{ services.vhs_website.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
    command: --remote=https://git.data.coop/vhs.data.coop/website.git#main
    cap_add:
      - NET_ADMIN
    devices:
      - "/dev/net/tun"
 networks:
  external_services:
    external: true
--- a/roles/docker/templates/compose-files/watchtower.yml.j2
+++ b/roles/docker/templates/compose-files/watchtower.yml.j2
@ -1,12 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  app:
    image: containrrr/watchtower:{{ services.watchtower.version }}
    restart: unless-stopped
    environment:
      WATCHTOWER_POLL_INTERVAL: "60"
    volumes:
      - "/root/.docker/config.json:/config.json:ro"
      - "/var/run/docker.sock:/var/run/docker.sock"
--- a/roles/docker/templates/compose-files/writefreely.yml.j2
+++ b/roles/docker/templates/compose-files/writefreely.yml.j2
@ -1,32 +0,0 @@
 # vim: ft=yaml.docker-compose
 version: "3.8"
 services:
  db:
    image: mariadb:{{ services.writefreely.mariadb_version }}
    restart: unless-stopped
    volumes:
      - "./db:/var/lib/mysql"
    environment:
      MYSQL_DATABASE: writefreely
      MYSQL_ROOT_PASSWORD: {{ writefreely_secrets.db_password }}
  app:
    image: ghcr.io/writefreely/writefreely:{{ services.writefreely.version }}
    restart: unless-stopped
    networks:
      - default
      - external_services
    volumes:
      - "./keys:/go/keys"
      - "./config.ini:/go/config.ini"
    environment:
      VIRTUAL_HOST: "{{ services.writefreely.domain }}"
      LETSENCRYPT_HOST: "{{ services.writefreely.domain }}"
      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
    depends_on:
      - db
 networks:
  external_services:
    external: true
--- a/Show more
+++ b/Show more
		`@ -1 +0,0 @@`
			MIICszCCAZsCBgF8WpKKwTANBgkqhkiG9w0BAQsFADAdMRswGQYDVQQDDBJkYXRhLmNvb3Agc2VydmljZXMwHhcNMjExMDA3MTE0MzQ1WhcNMzExMDA3MTE0NTI1WjAdMRswGQYDVQQDDBJkYXRhLmNvb3Agc2VydmljZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCdV0stfU8aA1bi+GYd/a5DOyoox01BgzWwBFqVjlo80frsOsH8g814eDuMuff/UJy+2YxaozYQGxP+DcOVXi+0Fts9zjRj6wa6HCQqiR/SNUa69fGHcyAo2Tr0faxOyf3QMBqIngTRZB99quNMuAM96RCg25LtDaaWjNVxdHlj78+kU1bQXExp0ZfELlKGtllWP07cyz4nGfZmuK1AiWSsRbDIbyK5dvzw/pMS1kexh6ylnQu1iLqD3vYZBUDX9lPNkavTYZNCEL4ElUvR81S0ko2zkYAUiuVTtTUKucc98dTRhkuV4YCiiW6UQGY/jzmXYBfpzAY3n5eH5iUu/tRXAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFQc8ytexKiXOIGrSYYtFaF/lxv8AwMgsndv8YxJ+x/cUwN9tdmA8IAZDIS13qBrCOdZE4pJ/09VkYdErcpbtV7PWC3LDv/c2qakyiBUYZj4WgJio+oD0GCqXsby3aqJeVt9cJr4gSsXxn1c+7GV7p/gc/2FFmlWcqMN/2F7LvFvObu55QlppWZrn8kreaUQmRuTTIviFQRmvrmwKyK52LEcK7qoh/v1aHyYDl91gu3nLMEluz6hy3UEPYgpdH1t2C7K0Kjri25pJNGCFrpKjWWveteKazUeDd4adHMiw2MVfeEyTCXEFoaxQS9QmbmhSMRhiHjbdffL7xi//aSh1bo=
		`@ -1,2 +0,0 @@`
			`listen 3000;`
			`client_max_body_size 50M; # default is 1M`
		`@ -1,2 +0,0 @@`
			`listen 8008;`
			`client_max_body_size 1G; # default is 1M`
		`@ -1,2 +0,0 @@`
			`server_name www.data.coop;`
			`return 301 $scheme://data.coop$request_uri;`