This commit is contained in:
parent
97311b4589
commit
f56cebf02e
GPG key ID:
CBBBE7371E81C4EA
120
.ansible-lint
120
.ansible-lint
|
|
@ -1,120 +0,0 @@
|
|||
---
|
||||
# .ansible-lint
|
||||
|
||||
profile: null # min, basic, moderate,safety, shared, production
|
||||
|
||||
# exclude_paths included in this file are parsed relative to this file's location
|
||||
# and not relative to the CWD of execution. CLI arguments passed to the --exclude
|
||||
# option are parsed relative to the CWD of execution.
|
||||
exclude_paths:
|
||||
- .cache/ # implicit unless exclude_paths is defined in config
|
||||
- .github/
|
||||
- test/fixtures/formatting-before/
|
||||
- test/fixtures/formatting-prettier/
|
||||
# parseable: true
|
||||
# quiet: true
|
||||
# strict: true
|
||||
# verbosity: 1
|
||||
|
||||
# Mock modules or roles in order to pass ansible-playbook --syntax-check
|
||||
mock_modules:
|
||||
- zuul_return
|
||||
# note the foo.bar is invalid as being neither a module or a collection
|
||||
- fake_namespace.fake_collection.fake_module
|
||||
- fake_namespace.fake_collection.fake_module.fake_submodule
|
||||
mock_roles:
|
||||
- mocked_role
|
||||
- author.role_name # old standalone galaxy role
|
||||
- fake_namespace.fake_collection.fake_role # role within a collection
|
||||
|
||||
# Enable checking of loop variable prefixes in roles
|
||||
# loop_var_prefix: "{role}_"
|
||||
|
||||
# Enforce variable names to follow pattern below, in addition to Ansible own
|
||||
# requirements, like avoiding python identifiers. To disable add `var-naming`
|
||||
# to skip_list.
|
||||
# var_naming_pattern: "^[a-z_][a-z0-9_]*$"
|
||||
|
||||
use_default_rules: true
|
||||
# Load custom rules from this specific folder
|
||||
# rulesdir:
|
||||
# - ./rule/directory/
|
||||
|
||||
# Ansible-lint completely ignores rules or tags listed below
|
||||
# skip_list:
|
||||
# - skip_this_tag
|
||||
|
||||
# Ansible-lint does not automatically load rules that have the 'opt-in' tag.
|
||||
# You must enable opt-in rules by listing each rule 'id' below.
|
||||
enable_list:
|
||||
- empty-string-compare # opt-in
|
||||
- no-log-password # opt-in
|
||||
- no-same-owner # opt-in
|
||||
# add yaml here if you want to avoid ignoring yaml checks when yamllint
|
||||
# library is missing. Normally its absence just skips using that rule.
|
||||
- yaml
|
||||
# Report only a subset of tags and fully ignore any others
|
||||
# tags:
|
||||
# - jinja[spacing]
|
||||
|
||||
# Ansible-lint does not fail on warnings from the rules or tags listed below
|
||||
warn_list:
|
||||
- skip_this_tag
|
||||
- experimental # experimental is included in the implicit list
|
||||
- no-changed-when
|
||||
- latest[git]
|
||||
- var-naming[no-role-prefix]
|
||||
# - role-name
|
||||
# - yaml[document-start] # you can also use sub-rule matches
|
||||
|
||||
# skip_list:
|
||||
# - fqcn[action-core]
|
||||
# - fqcn[action]
|
||||
|
||||
# Some rules can transform files to fix (or make it easier to fix) identified
|
||||
# errors. `ansible-lint --write` will reformat YAML files and run these transforms.
|
||||
# By default it will run all transforms (effectively `write_list: ["all"]`).
|
||||
# You can disable running transforms by setting `write_list: ["none"]`.
|
||||
# Or only enable a subset of rule transforms by listing rules/tags here.
|
||||
# write_list:
|
||||
# - all
|
||||
|
||||
# Offline mode disables installation of requirements.yml
|
||||
offline: false
|
||||
|
||||
# Return success if number of violations compared with previous git
|
||||
# commit has not increased. This feature works only in git
|
||||
# repositories.
|
||||
progressive: false
|
||||
|
||||
# Define required Ansible's variables to satisfy syntax check
|
||||
extra_vars:
|
||||
foo: bar
|
||||
multiline_string_variable: |
|
||||
line1
|
||||
line2
|
||||
complex_variable: ":{;\t$()"
|
||||
|
||||
# Uncomment to enforce action validation with tasks, usually is not
|
||||
# needed as Ansible syntax check also covers it.
|
||||
# skip_action_validation: false
|
||||
|
||||
# List of additional kind:pattern to be added at the top of the default
|
||||
# match list, first match determines the file kind.
|
||||
kinds:
|
||||
# - playbook: "**/examples/*.{yml,yaml}"
|
||||
# - galaxy: "**/folder/galaxy.yml"
|
||||
# - tasks: "**/tasks/*.yml"
|
||||
# - vars: "**/vars/*.yml"
|
||||
# - meta: "**/meta/main.yml"
|
||||
- yaml: "**/*.yaml-too"
|
||||
|
||||
# List of additional collections to allow in only-builtins rule.
|
||||
# only_builtins_allow_collections:
|
||||
# - example_ns.example_collection
|
||||
|
||||
# List of additions modules to allow in only-builtins rule.
|
||||
# only_builtins_allow_modules:
|
||||
# - example_module
|
||||
|
||||
# vim:ft=yaml
|
||||
2
.gitignore
vendored
2
.gitignore
vendored
|
|
@ -1,2 +0,0 @@
|
|||
# ---> Ansible
|
||||
*.retry
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
# cpx-ansible
|
||||
|
||||
This is the Ansible playbook I use to provision my VPS, where I
|
||||
self-host various stuff. The VPS is a CPX21 from Hetzner Cloud.
|
||||
|
||||
### Credits
|
||||
|
||||
This project is in large part inspired by the work over on [data.coop's
|
||||
Ansible setup](https://git.data.coop/data.coop/ansible).
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
[defaults]
|
||||
ask_vault_pass = True
|
||||
remote_user = sysadm
|
||||
remote_tmp = /tmp/.ansible
|
||||
inventory = inventory
|
||||
use_persistent_connections = True
|
||||
0
decommissioned
Normal file
0
decommissioned
Normal file
|
|
@ -1,55 +0,0 @@
|
|||
$ANSIBLE_VAULT;1.1;AES256
|
||||
39343338616331646134303961373936666330613365386436303430343461303038363636316337
|
||||
6165383039383366653834383338356538356264623565630a633466656662376331396537613661
|
||||
35343139323632643635336363303961373232353733313064393461336435323136663230346461
|
||||
6565666162346361610a373134643735376635303039376137633138376463653864356166626564
|
||||
32323364386139363534343966306464326539356263636461636232633536313635373965373638
|
||||
66383837383730316563303538343533343437623162383438656131313363303434303063353365
|
||||
63323262343937656539313765373039306131353161663535663861363838333963343932316231
|
||||
33323935653261373432353638663462663534653934376661376438363239383362663763376165
|
||||
37356333356536363535333564633534646136616331653465613934643862653465623035366137
|
||||
35326562343765376132306133343835323137373232646361376565363934393866656634343561
|
||||
64313037623133383164663662313362643832373436643133366261343465386533633936356563
|
||||
66613934653261653239303230666264626461363565316465366331353138383836653561353535
|
||||
35643233386336356632623939666432376263326231336661313038306164393234653264623231
|
||||
30343130303738633137616531666365653163373230643535623063376334336632386136303932
|
||||
30323066656464326261643038303062656562366432323732393162613739363266636438323138
|
||||
34363636626234653039356437363666346166323834366437633535623230636432663263636632
|
||||
35306666393733353038616464343431333938326266356464333737636233323564353630356434
|
||||
32616539336633613132393834376338323536383361343430386538393734623134356634623162
|
||||
35323066343464346661303963646430336332343631326133333162353638636639346537663232
|
||||
35316166633638306364613162623934353735383834303234653033646432343835353864636132
|
||||
39336563646162623566326434613137633531616663386236386333313532326234383433653838
|
||||
35313066653766393736383631313837353532333833393833643264643932363531356363666165
|
||||
33616431343733363230656263376539393232386161346331386530323464656464303463393831
|
||||
34666461636138373666646563316132353766383365303535663033316330663738343265616233
|
||||
64633734366630643835653236353362386137386636656234396462626565336365346139363239
|
||||
61373137626631373337373365646362633665316137656335313531316366393730313935383866
|
||||
66396466386236626134333163393637373030326666313536353764336437326363656563646134
|
||||
35666330383037383936666137636633633635336366386636373865393331316239666266353365
|
||||
30633034326262323462626335643637303730626333343638336635613635626633323534393935
|
||||
33366439323165356164396538363263656466366465666263363637323934623261383833323534
|
||||
63623862613038366536323761366565653565306430626231366135316532356261383739313930
|
||||
32343633363664653661333236323931383464346232316136323033376630303733383064663832
|
||||
33653864393933316133666664653938383336346635336564633937373861666631346432643233
|
||||
31373262653361633837653764363837366562366530306661373866303166656539323561386161
|
||||
30353338663430613833313837663636333637363535316339636161383333653562313864633938
|
||||
65656164363535376366646635643536666233333531646466663863363565383464353639653639
|
||||
31353438313336663236323035626231383139323762626339323539633439366433623662383864
|
||||
38643236333539633336636264353863343239663132633939366534343630333238346536303837
|
||||
30393739353330336539386466633763333863316639396130633061666661666431323636363831
|
||||
37323533356366623136303665313064363961636231653131356538643138636538386438393962
|
||||
32346663613836656165373231656562393265653234623032633265373832636464396166643761
|
||||
37663066633138303332323665303662353630383039353564633233383536336666636161663962
|
||||
66663066333432306133306431353731646132303239666330383831303937623430666266383939
|
||||
33366631373264643361323836646462393730323731336164623136613432333134396436356630
|
||||
31356438343636623133623730663933626335353963386639383830323062666661396534306537
|
||||
62643137343664383563636633376234343739306362343438313266376331636665646564363165
|
||||
38616133323864393031383434313863363361626430653537663637303966663437623633343163
|
||||
31323165353230303733363633316338363164306336383030663433313363323632653564666134
|
||||
64646631373635316261393632366534323166653061303634316138633066636232303331333730
|
||||
65376331396665353336373438646336636565643564336133353937353731356437633061663565
|
||||
35623132366263306664613061373832653363313134326432353737353466663265313833336539
|
||||
32663330313136393332653262373235653764613435653365346561313062303766373039363765
|
||||
35626233663333646664646632303338336637623764353963383365396234653833323165363931
|
||||
3532636438643665326661393164366232353764346634616532
|
||||
|
|
@ -1,31 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
hostname: cpx
|
||||
timezone: Europe/Berlin
|
||||
|
||||
users:
|
||||
- name: sysadm
|
||||
comment: System Administration
|
||||
password: $6$Q2WHaFPAPgndQSz4$F6py94HemVpE/cgtTU0cRKkI/Si5Vjl/aSCniVr8WtbkViBOtt.dpDDWwhjbOOX/o6R22w1tFiciBmF.UA9HH0
|
||||
groups:
|
||||
- sudo
|
||||
ssh_keys:
|
||||
- sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIFWZGLov8wPBNxuvnaPK+8vv6wK5hHUVEFzXKsN9QeuBAAAADHNzaDpzYW1zYXB0aQ== ssh:samsapti
|
||||
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPd/4fQV7CL8/KVwbo/phiV5UdXFBIDlkZ+ps8C7FeRf cardno:14 336 332
|
||||
|
||||
- name: cicd
|
||||
comment: CI/CD user
|
||||
password: '!'
|
||||
groups: []
|
||||
ssh_keys:
|
||||
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBN7XhL364LZ4rnEnmpV59Qehw3ldqEb7XX5DWTAb/XH cicd
|
||||
- sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIFWZGLov8wPBNxuvnaPK+8vv6wK5hHUVEFzXKsN9QeuBAAAADHNzaDpzYW1zYXB0aQ== ssh:samsapti
|
||||
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPd/4fQV7CL8/KVwbo/phiV5UdXFBIDlkZ+ps8C7FeRf cardno:14 336 332
|
||||
|
||||
open_ports:
|
||||
- { port: '22', proto: 'tcp', comment: 'SSH' }
|
||||
- { port: '80', proto: 'tcp', comment: 'HTTP' }
|
||||
- { port: '443', proto: 'tcp', comment: 'HTTPS' }
|
||||
- { port: '5223', proto: 'tcp', comment: 'SMP server' }
|
||||
- { port: '5443', proto: 'tcp', comment: 'XFTP server' }
|
||||
- { port: '10000', proto: 'udp', comment: 'Jitsi Videobridge' }
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
# CPX21
|
||||
cpx.servers.sapti.me ansible_python_interface=/usr/bin/python3
|
||||
13
playbook.yml
13
playbook.yml
|
|
@ -1,13 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Deploy self-hosted services
|
||||
hosts: all
|
||||
gather_facts: false
|
||||
become: true
|
||||
roles:
|
||||
- role: os_config
|
||||
tags:
|
||||
- os
|
||||
- role: docker_services
|
||||
tags:
|
||||
- docker
|
||||
86
provision.sh
86
provision.sh
|
|
@ -1,86 +0,0 @@
|
|||
#!/usr/bin/env sh
|
||||
|
||||
set -e
|
||||
|
||||
usage() {
|
||||
printf '%s\n' "Usage:"
|
||||
printf '$ %s\n' "$0 [--help]"
|
||||
printf '$ %s\n' "$0 [--dry] os"
|
||||
printf '$ %s\n' "$0 [--dry] base"
|
||||
printf '$ %s\n' "$0 [--dry] firewall"
|
||||
printf '$ %s\n' "$0 [--dry] ssh"
|
||||
printf '$ %s\n' "$0 [--dry] docker"
|
||||
printf '$ %s\n' "$0 [--dry] docker_config"
|
||||
printf '$ %s\n' "$0 [--dry] users [--init]"
|
||||
printf '$ %s\n' "$0 [--dry] reboot"
|
||||
printf '$ %s\n' "$0 [--dry] services [--down|--restart|--recreate] [SINGLE_SERVICE]"
|
||||
}
|
||||
|
||||
install_modules() {
|
||||
if [ -z "$(ansible-galaxy collection list community.general 2>/dev/null)" ]; then
|
||||
ansible-galaxy collection install community.general
|
||||
fi
|
||||
}
|
||||
|
||||
BASE_CMD="ansible-playbook playbook.yml --ask-become-pass"
|
||||
cd "$(dirname "$0")" || exit 255
|
||||
|
||||
if [ "$1" = "--dry" ]; then
|
||||
EXEC="echo"
|
||||
shift
|
||||
else
|
||||
EXEC="eval"
|
||||
fi
|
||||
|
||||
if [ "$#" -gt 0 ]; then
|
||||
TAG="$1"
|
||||
shift
|
||||
fi
|
||||
|
||||
case $TAG in
|
||||
"")
|
||||
install_modules; $EXEC "$BASE_CMD" ;;
|
||||
os|base|firewall|ssh|docker|docker_config)
|
||||
install_modules; $EXEC "$BASE_CMD --tags '$TAG'" ;;
|
||||
users)
|
||||
install_modules
|
||||
|
||||
if [ "$1" = "--init" ]; then
|
||||
$EXEC "$BASE_CMD --user root --tags '$TAG'"
|
||||
else
|
||||
$EXEC "$BASE_CMD --tags '$TAG'"
|
||||
fi
|
||||
;;
|
||||
reboot)
|
||||
install_modules; $EXEC "$BASE_CMD --tags '$TAG' --extra-vars 'do_reboot=true'" ;;
|
||||
services)
|
||||
install_modules
|
||||
|
||||
if [ "$1" = "--down" ]; then
|
||||
ACTION="down"
|
||||
shift
|
||||
elif [ "$1" = "--restart" ]; then
|
||||
ACTION="restart"
|
||||
shift
|
||||
elif [ "$1" = "--recreate" ]; then
|
||||
ACTION="recreate"
|
||||
shift
|
||||
fi
|
||||
|
||||
SINGLE_SERVICE="$1"
|
||||
|
||||
if [ -z "$ACTION" ] && [ -n "$SINGLE_SERVICE" ]; then
|
||||
VARS="single_service=$SINGLE_SERVICE"
|
||||
elif [ -n "$ACTION" ] && [ -z "$SINGLE_SERVICE" ]; then
|
||||
VARS="$ACTION=true"
|
||||
elif [ -n "$ACTION" ] && [ -n "$SINGLE_SERVICE" ]; then
|
||||
VARS='{"'$ACTION'": true, "single_service": "'$SINGLE_SERVICE'"}'
|
||||
fi
|
||||
|
||||
$EXEC "$BASE_CMD --tags '$TAG' $(test -z "$VARS" || echo "--extra-vars '$VARS'")"
|
||||
;;
|
||||
--help)
|
||||
usage ;;
|
||||
*)
|
||||
usage >&2; exit 1 ;;
|
||||
esac
|
||||
|
|
@ -1,51 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
base_domain: sapti.me
|
||||
base_volume: /opt/docker
|
||||
|
||||
services:
|
||||
caddy:
|
||||
volume: "{{ base_volume }}/caddy"
|
||||
version: 2-alpine
|
||||
|
||||
jitsi_meet:
|
||||
domain: meet.{{ base_domain }}
|
||||
volume: "{{ base_volume }}/jitsi-meet"
|
||||
username: samsapti
|
||||
version: stable
|
||||
|
||||
samsapti_dev:
|
||||
domain: samsapti.dev
|
||||
onion: mldhltdackluvnqso7vk2azcg3ghjxbpw4im6alubymqkonb4kppqcqd.onion
|
||||
volume: "{{ base_volume }}/samsapti.dev"
|
||||
version: 1-alpine
|
||||
|
||||
simplexmq_smp:
|
||||
domain: smp01.simplex.{{ base_domain }}
|
||||
onion: pcexmrs4eod35vdvidq47jce7mnsfm26j27anttoy4zprc25pulkcfyd.onion
|
||||
volume: "{{ base_volume }}/smp-server"
|
||||
version: v5
|
||||
|
||||
simplexmq_xftp:
|
||||
domain: xftp01.simplex.{{ base_domain }}
|
||||
onion: n5vct5tnf4zoaigmfj4ppxzhgrslg3n4a4sp5yjppp6lfwvq7m2vn2id.onion
|
||||
volume: "{{ base_volume }}/xftp-server"
|
||||
quota: 50gb
|
||||
version: v5
|
||||
|
||||
searxng:
|
||||
domain: search.{{ base_domain }}
|
||||
volume: "{{ base_volume }}/searxng"
|
||||
version: latest
|
||||
redis_version: 7-alpine
|
||||
|
||||
wkd:
|
||||
domain: "{{ base_domain }}"
|
||||
volume: "{{ base_volume }}/wkd"
|
||||
version: 1-alpine
|
||||
|
||||
tor:
|
||||
version: latest
|
||||
|
||||
watchtower:
|
||||
version: '1.7.1'
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
{
|
||||
"default-address-pools": [
|
||||
{
|
||||
"base": "172.17.0.0/16",
|
||||
"size": 24
|
||||
}
|
||||
],
|
||||
"experimental": true,
|
||||
"ip6tables": true
|
||||
}
|
||||
|
|
@ -1,52 +0,0 @@
|
|||
user nginx;
|
||||
worker_processes auto;
|
||||
|
||||
error_log /dev/null crit;
|
||||
pid /var/run/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
access_log off;
|
||||
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
gzip on;
|
||||
server_tokens off;
|
||||
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
|
||||
keepalive_timeout 65;
|
||||
|
||||
|
||||
### HTTP headers
|
||||
|
||||
# TCP Keep-Alive
|
||||
add_header Connection "Keep-Alive" always;
|
||||
|
||||
# CSP
|
||||
add_header Content-Security-Policy "default-src 'none'; child-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self'; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self'; img-src 'self'; manifest-src 'self'" always;
|
||||
|
||||
# Enable cross-site filter (XSS) and tell browser to block detected attacks
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
# Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
|
||||
# Disallow the site to be rendered within a frame (clickjacking protection)
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
|
||||
# Disable some features
|
||||
add_header Permissions-Policy "accelerometer=(),ambient-light-sensor=(),autoplay=(),camera=(),encrypted-media=(),focus-without-user-activation=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),speaker=(),sync-xhr=(),usb=(),vr=(),interest-cohort=()" always;
|
||||
|
||||
# Disable referrer
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
|
||||
# Cache control policy
|
||||
add_header Cache-Control "max-age=15552000" always;
|
||||
}
|
||||
Binary file not shown.
|
|
@ -1,8 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Reload Docker daemon
|
||||
ansible.builtin.service:
|
||||
name: docker
|
||||
enabled: true
|
||||
state: reloaded
|
||||
listen: reload-dockerd
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Copy Docker daemon config file
|
||||
ansible.builtin.copy:
|
||||
src: dockerd/daemon.json
|
||||
dest: /etc/docker/daemon.json
|
||||
owner: root
|
||||
mode: u=rw,g=r,o=r
|
||||
notify: reload-dockerd
|
||||
|
||||
- name: Configure cron job to prune unused Docker data weekly
|
||||
ansible.builtin.cron:
|
||||
name: Prune unused Docker data
|
||||
cron_file: ansible_docker_prune
|
||||
job: 'docker system prune -fa && docker volume prune -fa'
|
||||
special_time: weekly
|
||||
user: root
|
||||
state: present
|
||||
|
|
@ -1,52 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Add Docker PGP key
|
||||
ansible.builtin.apt_key:
|
||||
keyserver: keyserver.ubuntu.com
|
||||
id: '0x8D81803C0EBFCD88'
|
||||
state: present
|
||||
|
||||
- name: Add Docker apt repository
|
||||
ansible.builtin.apt_repository:
|
||||
repo: 'deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian bullseye stable'
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Install Docker
|
||||
ansible.builtin.apt:
|
||||
name: "{{ pkgs }}"
|
||||
state: present
|
||||
vars:
|
||||
pkgs:
|
||||
- docker-ce
|
||||
- docker-compose-plugin
|
||||
|
||||
- name: Create docker-compose symlink
|
||||
ansible.builtin.file:
|
||||
path: /usr/local/bin/docker-compose
|
||||
src: /usr/libexec/docker/cli-plugins/docker-compose
|
||||
state: link
|
||||
|
||||
- name: Install Python bindings for Docker
|
||||
ansible.builtin.pip:
|
||||
name: "{{ pkgs }}"
|
||||
state: present
|
||||
executable: pip3
|
||||
vars:
|
||||
pkgs:
|
||||
- docker
|
||||
- docker-compose
|
||||
|
||||
- name: Configure Docker
|
||||
ansible.builtin.import_tasks: config.yml
|
||||
tags:
|
||||
- docker_config
|
||||
|
||||
- name: Flush handlers
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
||||
- name: Set up Docker services
|
||||
ansible.builtin.import_tasks: services.yml
|
||||
tags:
|
||||
- services
|
||||
- reboot
|
||||
|
|
@ -1,43 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Create Docker network for services
|
||||
community.docker.docker_network:
|
||||
name: services
|
||||
enable_ipv6: true
|
||||
ipam_config:
|
||||
- subnet: 172.17.2.0/24
|
||||
- subnet: fd02::/64
|
||||
state: present
|
||||
|
||||
- name: Create Docker network for Tor
|
||||
community.docker.docker_network:
|
||||
name: tor
|
||||
enable_ipv6: true
|
||||
ipam_config:
|
||||
- subnet: 172.17.3.0/24
|
||||
- subnet: fd03::/64
|
||||
state: present
|
||||
|
||||
- name: Create base directory for Docker volumes
|
||||
ansible.builtin.file:
|
||||
path: "{{ base_volume }}"
|
||||
owner: root
|
||||
mode: u=rwx,g=rx,o=rx
|
||||
state: directory
|
||||
|
||||
- name: Copy nginx.conf to shared location
|
||||
ansible.builtin.copy:
|
||||
src: shared/nginx.conf
|
||||
dest: "{{ base_volume }}/nginx.conf"
|
||||
owner: root
|
||||
mode: u=rw,g=r,o=r
|
||||
|
||||
- name: Deploy services
|
||||
ansible.builtin.include_tasks: services/{{ item.key }}.yml
|
||||
loop: "{{ services | dict2items }}"
|
||||
when: single_service is not defined
|
||||
|
||||
- name: Deploy single service
|
||||
ansible.builtin.include_tasks: services/{{ single_service }}.yml
|
||||
when: single_service is defined and
|
||||
single_service in services
|
||||
|
|
@ -1,45 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Create Caddy volume directories
|
||||
ansible.builtin.file:
|
||||
path: "{{ services.caddy.volume }}/{{ dir }}"
|
||||
owner: root
|
||||
mode: u=rwx,g=rx,o=rx
|
||||
state: directory
|
||||
loop:
|
||||
- config
|
||||
- data
|
||||
loop_control:
|
||||
loop_var: dir
|
||||
|
||||
- name: Copy Caddyfile
|
||||
ansible.builtin.template:
|
||||
src: caddy/Caddyfile.j2
|
||||
dest: "{{ services.caddy.volume }}/Caddyfile"
|
||||
owner: root
|
||||
mode: u=rw,g=r,o=r
|
||||
|
||||
- name: Deploy Caddy Docker container
|
||||
community.docker.docker_container:
|
||||
name: caddy
|
||||
state: "{{ 'absent' if down is defined and down else 'started' }}"
|
||||
restart: "{{ restart is defined and restart }}"
|
||||
recreate: "{{ recreate is defined and recreate }}"
|
||||
image: caddy:{{ services.caddy.version }}
|
||||
restart_policy: always
|
||||
default_host_ip: ''
|
||||
networks:
|
||||
- name: services
|
||||
published_ports:
|
||||
- 80:80/tcp
|
||||
- 443:443/tcp
|
||||
- 443:443/udp
|
||||
volumes:
|
||||
- "{{ services.caddy.volume }}/Caddyfile:/etc/caddy/Caddyfile:ro"
|
||||
- "{{ services.caddy.volume }}/config:/config:rw"
|
||||
- "{{ services.caddy.volume }}/data:/data:rw"
|
||||
capabilities:
|
||||
- net_bind_service
|
||||
- dac_override
|
||||
cap_drop:
|
||||
- all
|
||||
|
|
@ -1,118 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Create Jitsi Meet volume directories
|
||||
ansible.builtin.file:
|
||||
path: "{{ services.jitsi_meet.volume }}/{{ dir }}"
|
||||
owner: root
|
||||
mode: u=rwx,g=rx,o=rx
|
||||
state: directory
|
||||
loop:
|
||||
- web/transcripts
|
||||
- prosody
|
||||
loop_control:
|
||||
loop_var: dir
|
||||
|
||||
- name: Create Jitsi Meet volume directories for Prosody
|
||||
ansible.builtin.file:
|
||||
path: "{{ services.jitsi_meet.volume }}/{{ dir }}"
|
||||
owner: '101'
|
||||
group: root
|
||||
mode: u=rwx,g=rx,o=rx
|
||||
state: directory
|
||||
loop:
|
||||
- prosody/plugins
|
||||
- prosody/config
|
||||
loop_control:
|
||||
loop_var: dir
|
||||
|
||||
- name: Deploy Jitsi Meet with Docker Compose
|
||||
community.docker.docker_compose:
|
||||
project_name: jitsi_meet
|
||||
state: "{{ 'absent' if down is defined and down else 'present' }}"
|
||||
restarted: "{{ restart is defined and restart }}"
|
||||
recreate: "{{ 'always' if recreate is defined and recreate else 'smart' }}"
|
||||
remove_orphans: true
|
||||
pull: true
|
||||
definition:
|
||||
version: '3.8'
|
||||
|
||||
services:
|
||||
web:
|
||||
image: jitsi/web:{{ services.jitsi_meet.version }}
|
||||
restart: always
|
||||
environment:
|
||||
DISABLE_HTTPS: 1
|
||||
PUBLIC_URL: "{{ services.jitsi_meet.domain }}"
|
||||
ENABLE_AUTH: '1'
|
||||
ENABLE_GUESTS: '1'
|
||||
networks:
|
||||
meet.jitsi:
|
||||
services:
|
||||
aliases:
|
||||
- jitsi_meet
|
||||
volumes:
|
||||
- "{{ services.jitsi_meet.volume }}/web/transcripts:/usr/share/jitsi-meet/transcripts:rw"
|
||||
|
||||
prosody:
|
||||
image: jitsi/prosody:{{ services.jitsi_meet.version }}
|
||||
restart: always
|
||||
environment:
|
||||
JICOFO_AUTH_PASSWORD: "{{ secrets.jitsi_meet.jicofo_auth_password }}"
|
||||
JVB_AUTH_PASSWORD: "{{ secrets.jitsi_meet.jvb_auth_password }}"
|
||||
ENABLE_AUTH: '1'
|
||||
ENABLE_GUESTS: '1'
|
||||
AUTH_TYPE: internal
|
||||
networks:
|
||||
meet.jitsi:
|
||||
aliases:
|
||||
- xmpp.meet.jitsi
|
||||
volumes:
|
||||
- "{{ services.jitsi_meet.volume }}/prosody/plugins:/prosody-plugins-custom:rw"
|
||||
- "{{ services.jitsi_meet.volume }}/prosody/config:/config:rw"
|
||||
expose:
|
||||
- 5222
|
||||
- 5280
|
||||
- 5347
|
||||
|
||||
jicofo:
|
||||
image: jitsi/jicofo:{{ services.jitsi_meet.version }}
|
||||
restart: always
|
||||
environment:
|
||||
JICOFO_AUTH_PASSWORD: "{{ secrets.jitsi_meet.jicofo_auth_password }}"
|
||||
ENABLE_AUTH: '1'
|
||||
AUTH_TYPE: internal
|
||||
networks:
|
||||
meet.jitsi:
|
||||
depends_on:
|
||||
- prosody
|
||||
|
||||
jvb:
|
||||
image: jitsi/jvb:{{ services.jitsi_meet.version }}
|
||||
restart: always
|
||||
environment:
|
||||
JVB_AUTH_PASSWORD: "{{ secrets.jitsi_meet.jvb_auth_password }}"
|
||||
JVB_WS_DOMAIN: "{{ services.jitsi_meet.domain }}"
|
||||
networks:
|
||||
meet.jitsi:
|
||||
ports:
|
||||
- 10000:10000/udp
|
||||
depends_on:
|
||||
- prosody
|
||||
|
||||
networks:
|
||||
meet.jitsi:
|
||||
services:
|
||||
external: true
|
||||
|
||||
- name: Check if Jitsi Meet user is registered
|
||||
ansible.builtin.stat:
|
||||
path: "{{ services.jitsi_meet.volume }}/prosody/config/data/meet%2ejitsi/accounts/{{ services.jitsi_meet.username }}.dat"
|
||||
register: jitsi_meet_user
|
||||
|
||||
- name: Register Jitsi Meet user
|
||||
community.docker.docker_container_exec:
|
||||
container: jitsi_meet_prosody_1
|
||||
command: |
|
||||
/usr/bin/prosodyctl --config /config/prosody.cfg.lua register {{ services.jitsi_meet.username }} meet.jitsi {{ secrets.jitsi_meet.password }}
|
||||
when: (down is undefined or not down) and
|
||||
not jitsi_meet_user.stat.exists
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Create samsapti.dev volume directories
|
||||
ansible.builtin.file:
|
||||
path: "{{ services.samsapti_dev.volume }}/public"
|
||||
owner: cicd
|
||||
mode: u=rwx,g=rx,o=rx
|
||||
state: directory
|
||||
|
||||
- name: Deploy samsapti.dev Docker container
|
||||
community.docker.docker_container:
|
||||
name: samsapti.dev
|
||||
state: "{{ 'absent' if down is defined and down else 'started' }}"
|
||||
restart: "{{ restart is defined and restart }}"
|
||||
recreate: "{{ recreate is defined and recreate }}"
|
||||
image: nginx:{{ services.samsapti_dev.version }}
|
||||
restart_policy: always
|
||||
networks:
|
||||
- name: services
|
||||
aliases:
|
||||
- samsapti
|
||||
- name: tor
|
||||
aliases:
|
||||
- samsapti
|
||||
volumes:
|
||||
- "{{ services.samsapti_dev.volume }}/public:/usr/share/nginx/html:ro"
|
||||
- "{{ base_volume }}/nginx.conf:/etc/nginx/nginx.conf:ro"
|
||||
|
|
@ -1,79 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Create SearXNG volume directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ services.searxng.volume }}/searxng"
|
||||
owner: root
|
||||
mode: u=rwx,g=rx,o=rx
|
||||
state: directory
|
||||
|
||||
- name: Create SearXNG volume directory for Redis
|
||||
ansible.builtin.file:
|
||||
path: "{{ services.searxng.volume }}/redis"
|
||||
owner: '999'
|
||||
group: '1000'
|
||||
mode: u=rwx,g=rx,o=rx
|
||||
state: directory
|
||||
|
||||
- name: Copy SearXNG settings.yml file
|
||||
ansible.builtin.template:
|
||||
src: searxng/settings.yml.j2
|
||||
dest: "{{ services.searxng.volume }}/searxng/settings.yml"
|
||||
owner: root
|
||||
mode: u=rw,g=r,o=r
|
||||
|
||||
- name: Deploy SearXNG with Docker Compose
|
||||
community.docker.docker_compose:
|
||||
project_name: searxng
|
||||
state: "{{ 'absent' if down is defined and down else 'present' }}"
|
||||
restarted: "{{ restart is defined and restart }}"
|
||||
recreate: "{{ 'always' if recreate is defined and recreate else 'smart' }}"
|
||||
remove_orphans: true
|
||||
pull: true
|
||||
definition:
|
||||
version: '3.8'
|
||||
|
||||
services:
|
||||
app:
|
||||
image: searxng/searxng:{{ services.searxng.version }}
|
||||
restart: always
|
||||
environment:
|
||||
SEARXNG_BASE_URL: https://{{ services.searxng.domain }}
|
||||
networks:
|
||||
default:
|
||||
services:
|
||||
aliases:
|
||||
- searxng
|
||||
volumes:
|
||||
- "{{ services.searxng.volume }}/searxng/settings.yml:/etc/searxng/settings.yml:ro"
|
||||
cap_add:
|
||||
- chown
|
||||
- dac_override
|
||||
- setuid
|
||||
- setgid
|
||||
cap_drop:
|
||||
- all
|
||||
logging:
|
||||
driver: json-file
|
||||
options:
|
||||
max-size: 1m
|
||||
max-file: '1'
|
||||
|
||||
redis:
|
||||
image: redis:{{ services.searxng.redis_version }}
|
||||
restart: always
|
||||
command: redis-server --save 60 1 --appendonly no
|
||||
volumes:
|
||||
- "{{ services.searxng.volume }}/redis:/data:rw"
|
||||
cap_add:
|
||||
- dac_override
|
||||
- setuid
|
||||
- setgid
|
||||
cap_drop:
|
||||
- all
|
||||
|
||||
networks:
|
||||
services:
|
||||
external: true
|
||||
tor:
|
||||
external: true
|
||||
|
|
@ -1,36 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Create SMP server volume directories
|
||||
ansible.builtin.file:
|
||||
name: "{{ services.simplexmq_smp.volume }}/{{ dir }}"
|
||||
owner: root
|
||||
mode: u=rwx,g=rx,o=rx
|
||||
state: directory
|
||||
loop:
|
||||
- config
|
||||
- logs
|
||||
loop_control:
|
||||
loop_var: dir
|
||||
|
||||
- name: Deploy SMP server Docker container
|
||||
community.docker.docker_container:
|
||||
name: smp-server
|
||||
state: "{{ 'absent' if down is defined and down else 'started' }}"
|
||||
restart: "{{ restart is defined and restart }}"
|
||||
recreate: "{{ recreate is defined and recreate }}"
|
||||
image: simplexchat/smp-server:{{ services.simplexmq_smp.version }}
|
||||
restart_policy: always
|
||||
default_host_ip: ''
|
||||
networks:
|
||||
- name: tor
|
||||
aliases:
|
||||
- smp-server
|
||||
env:
|
||||
ADDR: "{{ services.simplexmq_smp.domain }}"
|
||||
volumes:
|
||||
- "{{ services.simplexmq_smp.volume }}/config:/etc/opt/simplex:rw"
|
||||
- "{{ services.simplexmq_smp.volume }}/logs:/var/opt/simplex:rw"
|
||||
published_ports:
|
||||
- 5223:5223/tcp
|
||||
labels:
|
||||
com.centurylinklabs.watchtower.stop-signal: SIGINT
|
||||
|
|
@ -1,39 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Create XFTP server volume directories
|
||||
ansible.builtin.file:
|
||||
name: "{{ services.simplexmq_xftp.volume }}/{{ dir }}"
|
||||
owner: root
|
||||
mode: u=rwx,g=rx,o=rx
|
||||
state: directory
|
||||
loop:
|
||||
- config
|
||||
- logs
|
||||
- files
|
||||
loop_control:
|
||||
loop_var: dir
|
||||
|
||||
- name: Deploy XFTP server Docker container
|
||||
community.docker.docker_container:
|
||||
name: xftp-server
|
||||
state: "{{ 'absent' if down is defined and down else 'started' }}"
|
||||
restart: "{{ restart is defined and restart }}"
|
||||
recreate: "{{ recreate is defined and recreate }}"
|
||||
image: simplexchat/xftp-server:{{ services.simplexmq_xftp.version }}
|
||||
restart_policy: always
|
||||
default_host_ip: ''
|
||||
networks:
|
||||
- name: tor
|
||||
aliases:
|
||||
- xftp-server
|
||||
env:
|
||||
ADDR: "{{ services.simplexmq_xftp.domain }}"
|
||||
QUOTA: "{{ services.simplexmq_xftp.quota }}"
|
||||
volumes:
|
||||
- "{{ services.simplexmq_xftp.volume }}/config:/etc/opt/simplex-xftp:rw"
|
||||
- "{{ services.simplexmq_xftp.volume }}/logs:/var/opt/simplex-xftp:rw"
|
||||
- "{{ services.simplexmq_xftp.volume }}/files:/srv/xftp:rw"
|
||||
published_ports:
|
||||
- 5443:443/tcp
|
||||
labels:
|
||||
com.centurylinklabs.watchtower.stop-signal: SIGINT
|
||||
|
|
@ -1,29 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Deploy Tor Docker container
|
||||
community.docker.docker_container:
|
||||
name: tor
|
||||
state: "{{ 'absent' if down is defined and down else 'started' }}"
|
||||
restart: "{{ restart is defined and restart }}"
|
||||
recreate: "{{ recreate is defined and recreate }}"
|
||||
image: goldy/tor-hidden-service:{{ services.tor.version }}
|
||||
restart_policy: always
|
||||
env:
|
||||
# Required by SMP/XFTP server (we're not hosting anonymous services anyway)
|
||||
TOR_EXTRA_OPTIONS: |
|
||||
HiddenServiceNonAnonymousMode 1
|
||||
HiddenServiceSingleHopMode 1
|
||||
|
||||
SAMSAPTIDEV_TOR_SERVICE_HOSTS: 80:samsapti:80
|
||||
SAMSAPTIDEV_TOR_SERVICE_VERSION: '3'
|
||||
SAMSAPTIDEV_TOR_SERVICE_KEY: "{{ secrets.tor.samsapti_dev_key }}"
|
||||
|
||||
SMPSERVER_TOR_SERVICE_HOSTS: 5223:smp-server:5223
|
||||
SMPSERVER_TOR_SERVICE_VERSION: '3'
|
||||
SMPSERVER_TOR_SERVICE_KEY: "{{ secrets.tor.simplexmq_smp_key }}"
|
||||
|
||||
XFTPSERVER_TOR_SERVICE_HOSTS: 5443:xftp-server:443
|
||||
XFTPSERVER_TOR_SERVICE_VERSION: '3'
|
||||
XFTPSERVER_TOR_SERVICE_KEY: "{{ secrets.tor.simplexmq_xftp_key }}"
|
||||
networks:
|
||||
- name: tor
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Create Docker network for Watchtower
|
||||
community.docker.docker_network:
|
||||
name: watchtower
|
||||
state: present
|
||||
|
||||
- name: Deploy Watchtower Docker container
|
||||
community.docker.docker_container:
|
||||
name: watchtower
|
||||
state: "{{ 'absent' if down is defined and down else 'started' }}"
|
||||
restart: "{{ restart is defined and restart }}"
|
||||
recreate: "{{ recreate is defined and recreate }}"
|
||||
image: containrrr/watchtower:{{ services.watchtower.version }}
|
||||
restart_policy: always
|
||||
networks:
|
||||
- name: watchtower
|
||||
env:
|
||||
WATCHTOWER_POLL_INTERVAL: '3600'
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:rw
|
||||
|
|
@ -1,31 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Create WKD volume directories
|
||||
ansible.builtin.file:
|
||||
path: "{{ services.wkd.volume }}/.well-known/openpgpkey/hu"
|
||||
owner: root
|
||||
mode: u=rwx,g=rx,o=rx
|
||||
state: directory
|
||||
|
||||
- name: Copy PGP key to WKD volume directory
|
||||
ansible.builtin.copy:
|
||||
src: wkd/6fi64ioaua1j93gkt5eow8skha8e34sy
|
||||
dest: "{{ services.wkd.volume }}/.well-known/openpgpkey/hu/6fi64ioaua1j93gkt5eow8skha8e34sy"
|
||||
owner: root
|
||||
mode: u=rw,g=r,o=r
|
||||
|
||||
- name: Deploy WKD Docker container
|
||||
community.docker.docker_container:
|
||||
name: wkd
|
||||
state: "{{ 'absent' if down is defined and down else 'started' }}"
|
||||
restart: "{{ restart is defined and restart }}"
|
||||
recreate: "{{ recreate is defined and recreate }}"
|
||||
image: nginx:{{ services.wkd.version }}
|
||||
restart_policy: always
|
||||
networks:
|
||||
- name: services
|
||||
aliases:
|
||||
- wkd
|
||||
volumes:
|
||||
- "{{ services.wkd.volume }}:/usr/share/nginx/html:ro"
|
||||
- "{{ base_volume }}/nginx.conf:/etc/nginx/nginx.conf:ro"
|
||||
|
|
@ -1,137 +0,0 @@
|
|||
{
|
||||
admin off
|
||||
}
|
||||
|
||||
www.{{ services.samsapti_dev.domain }} {
|
||||
tls {{ secrets.tls_email }}
|
||||
|
||||
log {
|
||||
output discard
|
||||
}
|
||||
|
||||
redir https://{{ services.samsapti_dev.domain }}{uri}
|
||||
}
|
||||
|
||||
{{ services.samsapti_dev.domain }} {
|
||||
tls {{ secrets.tls_email }}
|
||||
|
||||
log {
|
||||
output discard
|
||||
}
|
||||
|
||||
header {
|
||||
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
||||
Onion-Location "http://{{ services.samsapti_dev.onion }}{uri}"
|
||||
-Server
|
||||
}
|
||||
|
||||
reverse_proxy samsapti:80
|
||||
}
|
||||
|
||||
{{ services.wkd.domain }} {
|
||||
tls {{ secrets.tls_email }}
|
||||
|
||||
log {
|
||||
output discard
|
||||
}
|
||||
|
||||
header {
|
||||
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
||||
-Server
|
||||
}
|
||||
|
||||
reverse_proxy wkd:80
|
||||
}
|
||||
|
||||
{{ services.jitsi_meet.domain }} {
|
||||
tls {{ secrets.tls_email }}
|
||||
|
||||
log {
|
||||
output discard
|
||||
}
|
||||
|
||||
header {
|
||||
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
||||
-Server
|
||||
}
|
||||
|
||||
reverse_proxy jitsi_meet:80
|
||||
}
|
||||
|
||||
{{ services.searxng.domain }} {
|
||||
tls {{ secrets.tls_email }}
|
||||
|
||||
log {
|
||||
output discard
|
||||
}
|
||||
|
||||
@api {
|
||||
path /config
|
||||
path /healthz
|
||||
path /stats/errors
|
||||
path /stats/checker
|
||||
}
|
||||
|
||||
@static {
|
||||
path /static/*
|
||||
}
|
||||
|
||||
@notstatic {
|
||||
not path /static/*
|
||||
}
|
||||
|
||||
@imageproxy {
|
||||
path /image_proxy
|
||||
}
|
||||
|
||||
@notimageproxy {
|
||||
not path /image_proxy
|
||||
}
|
||||
|
||||
header {
|
||||
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
||||
X-XSS-Protection "1; mode=block"
|
||||
X-Content-Type-Options "nosniff"
|
||||
Permissions-Policy "accelerometer=(),ambient-light-sensor=(),autoplay=(),camera=(),encrypted-media=(),focus-without-user-activation=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),speaker=(),sync-xhr=(),usb=(),vr=(),interest-cohort=()"
|
||||
Referrer-Policy "no-referrer"
|
||||
X-Robots-Tag "noindex, noarchive, nofollow"
|
||||
-Server
|
||||
}
|
||||
|
||||
header @api {
|
||||
Access-Control-Allow-Methods "GET, OPTIONS"
|
||||
Access-Control-Allow-Origin "*"
|
||||
}
|
||||
|
||||
# Cache
|
||||
header @static {
|
||||
# Cache
|
||||
Cache-Control "public, max-age=31536000"
|
||||
defer
|
||||
}
|
||||
|
||||
header @notstatic {
|
||||
# No Cache
|
||||
Cache-Control "no-cache, no-store"
|
||||
Pragma "no-cache"
|
||||
}
|
||||
|
||||
# CSP (see http://content-security-policy.com/ )
|
||||
header @imageproxy {
|
||||
Content-Security-Policy "default-src 'none'; img-src 'self' data:"
|
||||
}
|
||||
|
||||
header @notimageproxy {
|
||||
Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https://github.com/searxng/searxng/issues/new; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src 'self' data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com"
|
||||
}
|
||||
|
||||
# SearXNG
|
||||
handle {
|
||||
encode zstd gzip
|
||||
|
||||
reverse_proxy searxng:8080 {
|
||||
header_up X-Forwarded-Port {http.request.port}
|
||||
header_up X-Forwarded-Proto {http.request.scheme}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -1,97 +0,0 @@
|
|||
# vim: ft=yaml
|
||||
---
|
||||
use_default_settings: true
|
||||
|
||||
general:
|
||||
debug: false
|
||||
instance_name: Sam's SearXNG
|
||||
privacypolicy_url: https://{{ services.samsapti_dev.domain }}/privacy
|
||||
contact_url: https://{{ services.samsapti_dev.domain }}/contact
|
||||
enable_metrics: true
|
||||
|
||||
server:
|
||||
secret_key: "{{ secrets.searxng.secret_key }}"
|
||||
image_proxy: true
|
||||
http_protocol_version: '1.1'
|
||||
method: GET
|
||||
limiter: true
|
||||
public_instance: true
|
||||
|
||||
ui:
|
||||
results_on_new_tab: false
|
||||
center_alignment: true
|
||||
theme_args:
|
||||
simple_style: auto
|
||||
|
||||
redis:
|
||||
url: redis://redis:6379/0
|
||||
|
||||
search:
|
||||
formats:
|
||||
- html
|
||||
safe_search: 2
|
||||
suspended_times:
|
||||
SearxEngineAccessDenied: 0
|
||||
SearxEngineCaptcha: 600
|
||||
SearxEngineTooManyRequests: 600
|
||||
cf_SearxEngineCaptcha: 600
|
||||
cf_SearxEngineAccessDenied: 1200
|
||||
recaptcha_SearxEngineCaptcha: 600
|
||||
|
||||
outgoing:
|
||||
enable_http2: true
|
||||
source_ips:
|
||||
- 0.0.0.0
|
||||
|
||||
enabled_plugins:
|
||||
- 'Hash plugin'
|
||||
- 'Self Informations'
|
||||
- 'Tracker URL remover'
|
||||
- 'Hostname replace'
|
||||
|
||||
hostname_replace:
|
||||
'^(.*\.)?youtube\.com$': 'yewtu.be'
|
||||
'^(.*\.)?youtu\.be$': 'yewtu.be'
|
||||
'^(.*\.)?youtube-noocookie\.com$': 'yewtu.be'
|
||||
'^(www\.)?twitter\.com$': 'nitter.net'
|
||||
'^(.*\.)?(m\.)?wiktionary\.org$': '\1m.wiktionary.org'
|
||||
|
||||
engines:
|
||||
- name: bing
|
||||
disabled: false
|
||||
|
||||
- name: brave
|
||||
disabled: true
|
||||
|
||||
- name: ddg definitions
|
||||
disabled: false
|
||||
|
||||
- name: duckduckgo
|
||||
disabled: false
|
||||
|
||||
- name: duckduckgo images
|
||||
disabled: false
|
||||
|
||||
- name: google
|
||||
disabled: false
|
||||
|
||||
- name: mojeek
|
||||
disabled: true
|
||||
|
||||
- name: qwant
|
||||
disabled: true
|
||||
|
||||
- name: qwant images
|
||||
disabled: false
|
||||
|
||||
- name: startpage
|
||||
disabled: true
|
||||
|
||||
- name: wikidata
|
||||
disabled: true
|
||||
|
||||
- name: wikinews
|
||||
disabled: true
|
||||
|
||||
- name: yahoo
|
||||
disabled: false
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Create .env for apt-update-push
|
||||
ansible.builtin.template:
|
||||
src: env.j2
|
||||
dest: /home/{{ ansible_user }}/apt-update-push/.env
|
||||
owner: root
|
||||
mode: u=rw,go=
|
||||
listen: apt-update-push
|
||||
|
||||
- name: Install apt-update-push
|
||||
ansible.builtin.command: /home/{{ ansible_user }}/apt-update-push/install.sh
|
||||
listen: apt-update-push
|
||||
|
||||
- name: Restart sshd
|
||||
ansible.builtin.service:
|
||||
name: sshd
|
||||
state: restarted
|
||||
listen: sshd
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Set hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ hostname }}"
|
||||
|
||||
- name: Set timezone
|
||||
community.general.timezone:
|
||||
name: "{{ timezone }}"
|
||||
|
||||
- name: Upgrade system packages
|
||||
ansible.builtin.apt:
|
||||
update_cache: true
|
||||
upgrade: full
|
||||
|
||||
- name: Install packages via apt
|
||||
ansible.builtin.apt:
|
||||
name: "{{ pkgs }}"
|
||||
state: present
|
||||
vars:
|
||||
pkgs:
|
||||
- apparmor
|
||||
- curl
|
||||
- git
|
||||
- haveged
|
||||
- needrestart
|
||||
- python3-pip
|
||||
- ufw
|
||||
- unattended-upgrades
|
||||
|
||||
- name: Clone apt-update-push
|
||||
ansible.builtin.git:
|
||||
dest: /home/{{ ansible_user }}/apt-update-push
|
||||
repo: https://github.com/samsapti/apt-update-push.git
|
||||
clone: true
|
||||
update: true
|
||||
single_branch: true
|
||||
depth: 1
|
||||
become: false
|
||||
notify: apt-update-push
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Allow necessary ports in UFW
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "{{ item.port }}"
|
||||
proto: "{{ item.proto }}"
|
||||
comment: "{{ item.comment }}"
|
||||
loop: "{{ open_ports }}"
|
||||
|
||||
- name: Enable UFW
|
||||
community.general.ufw:
|
||||
state: enabled
|
||||
policy: deny
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Configure user accounts
|
||||
ansible.builtin.import_tasks: users.yml
|
||||
tags:
|
||||
- users
|
||||
|
||||
- name: Configure system base
|
||||
ansible.builtin.import_tasks: base.yml
|
||||
tags:
|
||||
- base
|
||||
|
||||
- name: Reboot if needed
|
||||
ansible.builtin.import_tasks: reboot.yml
|
||||
tags:
|
||||
- reboot
|
||||
|
||||
- name: Configure firewall
|
||||
ansible.builtin.import_tasks: firewall.yml
|
||||
tags:
|
||||
- firewall
|
||||
|
||||
- name: Configure SSH
|
||||
ansible.builtin.import_tasks: ssh.yml
|
||||
tags:
|
||||
- ssh
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Check if a reboot is needed
|
||||
ansible.builtin.stat:
|
||||
path: /var/run/reboot-required
|
||||
register: needs_reboot
|
||||
|
||||
- name: Include docker_services role for service shutdown
|
||||
ansible.builtin.include_role:
|
||||
name: docker_services
|
||||
tasks_from: services.yml
|
||||
apply:
|
||||
ignore_errors: true
|
||||
vars:
|
||||
down: true
|
||||
when: needs_reboot.stat.exists or
|
||||
(do_reboot is defined and do_reboot)
|
||||
|
||||
- name: Reboot host
|
||||
ansible.builtin.reboot:
|
||||
when: needs_reboot.stat.exists or
|
||||
(do_reboot is defined and do_reboot)
|
||||
register: rebooted
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Allow SSH login with public keys
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^#?PubkeyAuthentication '
|
||||
line: PubkeyAuthentication yes
|
||||
state: present
|
||||
notify: sshd
|
||||
|
||||
- name: Disallow SSH login with password
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^#?PasswordAuthentication '
|
||||
line: PasswordAuthentication no
|
||||
state: present
|
||||
notify: sshd
|
||||
|
||||
- name: Disallow root login over SSH
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^#?PermitRootLogin '
|
||||
line: PermitRootLogin no
|
||||
state: present
|
||||
notify: sshd
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
# vim: ft=yaml.ansible
|
||||
---
|
||||
- name: Add users
|
||||
ansible.builtin.user:
|
||||
name: "{{ item.name }}"
|
||||
comment: "{{ item.comment }}"
|
||||
password: "{{ item.password }}"
|
||||
groups: "{{ item.groups }}"
|
||||
shell: /bin/bash
|
||||
update_password: always
|
||||
loop: "{{ users }}"
|
||||
|
||||
- name: Add ssh authorized_keys
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ item.name }}"
|
||||
key: "{{ item.ssh_keys | join('\n') }}"
|
||||
exclusive: true
|
||||
loop: "{{ users }}"
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
topic={{ secrets.ntfy_topic }}
|
||||
hour=20
|
||||
Reference in a new issue