350 lines
11 KiB
YAML
350 lines
11 KiB
YAML
---
|
|
- hosts: pottwal.n39.eu
|
|
become: true
|
|
|
|
vars:
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
|
|
data_dir: "/srv/data"
|
|
|
|
|
|
openhab_image: openhab/openhab:2.5.11
|
|
openhab_data: "{{ data_dir }}/openhab"
|
|
openhab_host_port: 8081
|
|
openhab_configuration_source: https://github.com/netz39/n39-openhab.git
|
|
openhab_configuration_version: master
|
|
|
|
gitea_host_port: 9091
|
|
uritools_host_port: 8080
|
|
entities_validation_svc_host_port: 8082
|
|
shlink_host_port: 8083
|
|
shlink_domain_name: sl.n39.eu
|
|
|
|
hedgedoc_host_port: 8084
|
|
hedgedoc_image: quay.io/hedgedoc/hedgedoc:1.9.3
|
|
|
|
openldap_image_version: 1.5.0
|
|
openldap_data: "{{ data_dir }}/openldap"
|
|
openldap_domain: "ldap.n39.eu"
|
|
|
|
roles:
|
|
- role: docker_setup
|
|
vars:
|
|
docker_data_root: "/srv/docker"
|
|
- role: apache
|
|
|
|
tasks:
|
|
|
|
- name: Check if gitea data dir exists
|
|
ansible.builtin.stat:
|
|
path: "{{ data_dir }}/gitea"
|
|
register: gitea_dir
|
|
- name: Fail if gitea data dir does not exist
|
|
ansible.builtin.fail:
|
|
msg: "Gitea data dir is missing, please restore from the backup!"
|
|
when: not gitea_dir.stat.exists
|
|
|
|
# If port 2222 is changed here, it must also be adapted
|
|
# in the gitea config file (see application volume)!!
|
|
- name: Setup the docker container for gitea
|
|
docker_container:
|
|
name: gitea
|
|
image: "gitea/gitea:1.16.8"
|
|
pull: true
|
|
state: started
|
|
restart_policy: unless-stopped
|
|
detach: yes
|
|
ports:
|
|
# - 127.0.0.1:{{ gitea_host_port }}:3000
|
|
- "{{ gitea_host_port }}:3000"
|
|
- 2222:2222
|
|
env:
|
|
APP_NAME="Netz39 Gitea"
|
|
RUN_MODE="prod"
|
|
SSH_DOMAIN="gitea.n39.eu"
|
|
SSH_PORT="2222"
|
|
SSH_START_SERVER="false"
|
|
ROOT_URL="https://gitea.n39.eu"
|
|
DISABLE_REGISTRATION="true"
|
|
USER_UID=1000
|
|
USER_GID=1000
|
|
volumes:
|
|
- "{{ data_dir }}/gitea:/data:rw"
|
|
|
|
- name: Setup proxy site gitea.n39.eu
|
|
include_role:
|
|
name: setup-http-site-proxy
|
|
vars:
|
|
site_name: "gitea.n39.eu"
|
|
proxy_port: "{{ gitea_host_port }}"
|
|
|
|
- name: Ensure apt-cacher container is running
|
|
docker_container:
|
|
name: apt_cacher_ng
|
|
image: "mrtux/apt-cacher-ng"
|
|
pull: true
|
|
state: started
|
|
restart_policy: unless-stopped
|
|
detach: yes
|
|
ports:
|
|
- 3142:3142
|
|
|
|
- name: Ensure the openhab directories exist
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
with_items:
|
|
- "{{ openhab_data }}/addons"
|
|
- "{{ openhab_data }}/conf"
|
|
- "{{ openhab_data }}/userdata"
|
|
|
|
- name: Clone or update configuration
|
|
git:
|
|
repo: "{{ openhab_configuration_source }}"
|
|
version: "{{ openhab_configuration_version }}"
|
|
dest: "{{ openhab_data }}/conf"
|
|
clone: yes
|
|
update: yes
|
|
|
|
- name: ensure openhab is up and running
|
|
docker_container:
|
|
name: openhab
|
|
image: "{{ openhab_image }}"
|
|
pull: true
|
|
state: started
|
|
detach: yes
|
|
interactive: yes
|
|
tty: yes
|
|
ports:
|
|
- "{{ openhab_host_port }}:8080"
|
|
volumes:
|
|
- /etc/localtime:/etc/localtime:ro
|
|
- /etc/timezone:/etc/timezone:ro
|
|
- "{{ openhab_data }}/addons:/openhab/addons:rw"
|
|
- "{{ openhab_data }}/conf:/openhab/conf:rw"
|
|
- "{{ openhab_data }}/userdata:/openhab/userdata:rw"
|
|
keep_volumes: yes
|
|
restart_policy: unless-stopped
|
|
env: EXTRA_JAVA_OPTS="-Duser.timezone=Europe/Berlin"
|
|
|
|
- name: Setup proxy site openhab.n39.eu
|
|
include_role:
|
|
name: setup-http-site-proxy
|
|
vars:
|
|
site_name: openhab.n39.eu
|
|
proxy_port: "{{ openhab_host_port }}"
|
|
|
|
- name: Ensure container for URI tools is running
|
|
docker_container:
|
|
name: uritools
|
|
image: mrtux/clean_uri
|
|
pull: true
|
|
state: started
|
|
detach: yes
|
|
ports:
|
|
- "{{ uritools_host_port }}:8080"
|
|
restart_policy: unless-stopped
|
|
|
|
- name: Setup proxy site uritools.n39.eu
|
|
include_role:
|
|
name: setup-http-site-proxy
|
|
vars:
|
|
site_name: uritools.n39.eu
|
|
proxy_port: "{{ uritools_host_port }}"
|
|
|
|
- name: Ensure container for entities validation service is running
|
|
docker_container:
|
|
name: entities_validation_svc
|
|
image: netz39/entities_validation_svc:v1.0.0
|
|
pull: true
|
|
state: started
|
|
detach: yes
|
|
ports:
|
|
- "{{ entities_validation_svc_host_port }}:8080"
|
|
restart_policy: unless-stopped
|
|
|
|
- name: Setup proxy site entities-validation.svc.n39.eu
|
|
include_role:
|
|
name: setup-http-site-proxy
|
|
vars:
|
|
site_name: entities-validation.svc.n39.eu
|
|
proxy_port: "{{ entities_validation_svc_host_port }}"
|
|
|
|
- name: Ensure container for shlink is running
|
|
docker_container:
|
|
name: shlink
|
|
image: shlinkio/shlink:2.6.2
|
|
pull: true
|
|
state: started
|
|
detach: yes
|
|
ports:
|
|
- "{{ shlink_host_port }}:8080"
|
|
restart_policy: unless-stopped
|
|
env:
|
|
SHORT_DOMAIN_HOST: "{{ shlink_domain_name }}"
|
|
SHORT_DOMAIN_SCHEMA: https
|
|
GEOLITE_LICENSE_KEY: "{{ shlink_geolite_license_key }}"
|
|
|
|
- name: Setup proxy site {{ shlink_domain_name }}
|
|
include_role:
|
|
name: setup-http-site-proxy
|
|
vars:
|
|
site_name: "{{ shlink_domain_name }}"
|
|
proxy_port: "{{ shlink_host_port }}"
|
|
|
|
- name: Check if hedgedoc data dir exists
|
|
ansible.builtin.stat:
|
|
path: "{{ data_dir }}/hedgedoc"
|
|
register: hedgedoc_dir
|
|
- name: Fail if hedgedoc data dir does not exist
|
|
ansible.builtin.fail:
|
|
msg: "hedgedoc data dir is missing, please restore from the backup!"
|
|
when: not hedgedoc_dir.stat.exists
|
|
|
|
- name: Ensure the hedgedoc directories exist
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
with_items:
|
|
- "{{ data_dir }}/hedgedoc/data/database"
|
|
- "{{ data_dir }}/hedgedoc/data/uploads"
|
|
|
|
- name: Setup docker network
|
|
docker_network:
|
|
name: hedgedocnet
|
|
state: present
|
|
internal: true
|
|
|
|
- name: Install HedgeDoc database container
|
|
docker_container:
|
|
name: hedgedocdb
|
|
image: "postgres:11.6-alpine"
|
|
pull: true
|
|
state: started
|
|
restart_policy: unless-stopped
|
|
detach: yes
|
|
env:
|
|
POSTGRES_USER: "hedgedoc"
|
|
POSTGRES_PASSWORD: "{{ hedgedoc_postgres_password }}"
|
|
POSTGRES_DB: "hedgedoc"
|
|
volumes:
|
|
- "{{ data_dir }}/hedgedoc/data/database:/var/lib/postgresql/data"
|
|
networks:
|
|
- name: hedgedocnet
|
|
|
|
- name: Ensure container for hedgedoc is running
|
|
docker_container:
|
|
name: hedgedoc
|
|
image: "{{ hedgedoc_image }}"
|
|
pull: true
|
|
state: started
|
|
detach: yes
|
|
ports:
|
|
- "{{ hedgedoc_host_port }}:3000"
|
|
restart_policy: unless-stopped
|
|
env:
|
|
NODE_ENV: "production"
|
|
CMD_PROTOCOL_USESSL: "true"
|
|
CMD_DOMAIN: "pad.n39.eu"
|
|
CMD_URL_ADDPORT: "false"
|
|
CMD_DB_HOST: "hedgedocdb"
|
|
CMD_DB_PORT: "5432"
|
|
CMD_DB_DIALECT: "postgres"
|
|
CMD_DB_DATABASE: "hedgedoc"
|
|
CMD_DB_USERNAME: "hedgedoc"
|
|
CMD_DB_PASSWORD: "{{ hedgedoc_postgres_password }}"
|
|
volumes:
|
|
- "{{ data_dir }}/hedgedoc/data/uploads:/hedgedoc/public/uploads"
|
|
networks:
|
|
- name: hedgedocnet
|
|
|
|
- name: Setup proxy site pad.n39.eu
|
|
include_role:
|
|
name: setup-http-site-proxy
|
|
vars:
|
|
site_name: pad.n39.eu
|
|
proxy_port: "{{ hedgedoc_host_port }}"
|
|
|
|
- name: Setup dehydrated challenge endpoint for {{ openldap_domain }}
|
|
include_role:
|
|
name: setup-http-dehydrated
|
|
vars:
|
|
site_name: "{{ openldap_domain }}"
|
|
|
|
- name: Ensure openLDAP directories are present.
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
with_items:
|
|
- "{{ openldap_data }}/ldap"
|
|
- "{{ openldap_data }}/slapd"
|
|
- "{{ openldap_data }}/ldif"
|
|
- "{{ dehydrated_certs_dir }}/certs/{{ openldap_domain }}"
|
|
|
|
- name: Ensure container for openLDAP is running.
|
|
docker_container:
|
|
name: openLDAP
|
|
image: "osixia/openldap:{{ openldap_image_version }}"
|
|
detach: yes
|
|
state: started
|
|
restart_policy: unless-stopped
|
|
container_default_behavior: no_defaults
|
|
pull: true
|
|
env:
|
|
LDAP_LOG_LEVEL: "256"
|
|
LDAP_ORGANISATION: "{{ldap_org}}"
|
|
LDAP_DOMAIN: "{{ldap_domain}}"
|
|
LDAP_BASE_DN: "{{ldap_base_dn}}"
|
|
LDAP_READONLY_USER: "false"
|
|
|
|
LDAP_ADMIN_PASSWORD: "{{ldap_admin_password}}"
|
|
LDAP_CONFIG_PASSWORD: "{{ldap_config_password}}"
|
|
|
|
LDAP_RFC2307BIS_SCHEMA: "true"
|
|
|
|
LDAP_TLS_CIPHER_SUITE: "SECURE256:-VERS-SSL3.0"
|
|
|
|
LDAP_REPLICATION: "{{ldap_replication_enable}}"
|
|
LDAP_REPLICATION_CONFIG_SYNCPROV: "{{ldap_replication_config_syncprov}}"
|
|
LDAP_REPLICATION_DB_SYNCPROV: "{{ldap_replication_db_syncprov}}"
|
|
LDAP_REPLICATION_HOSTS: "{{ldap_replication_hosts}}"
|
|
|
|
KEEP_EXISTING_CONFIG: "false"
|
|
LDAP_REMOVE_CONFIG_AFTER_SETUP: "true"
|
|
published_ports:
|
|
- "{{ldap_ip}}:389:389" # unencrypted/STARTTLS
|
|
- "{{ldap_ip}}:636:636" # SSL
|
|
volumes:
|
|
- "{{ openldap_data }}/ldap:/var/lib/ldap"
|
|
- "{{ openldap_data }}/slapd:/etc/ldap/slapd.d"
|
|
- "{{ dehydrated_certs_dir }}/certs/{{ openldap_domain }}:/container/service/slapd/assets/certs"
|
|
- "{{ openldap_data }}/ldif/custom-element.ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom/01_netz39.ldif"
|
|
timeout: 500
|
|
# For replication to work correctly, domainname and hostname must be
|
|
# set correctly so that "hostname"."domainname" equates to the
|
|
# fully-qualified domain name for the host.
|
|
domainname: "{{ldap_domainname}}"
|
|
hostname: "{{ldap_hostname}}"
|
|
command: "--copy-service --loglevel debug"
|
|
|
|
- name: Allow access to openLDAP from local docker container [1/2]
|
|
become: true
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: '389'
|
|
proto: tcp
|
|
from: "{{ item }}"
|
|
comment: LDAP Docker Access
|
|
loop: "{{ docker_ip_ranges }}"
|
|
|
|
- name: Allow access to openLDAP from local docker container [2/2]
|
|
become: true
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: '636'
|
|
proto: tcp
|
|
from: "{{ item }}"
|
|
comment: LDAP Docker Access
|
|
loop: "{{ docker_ip_ranges }}"
|
|
|
|
handlers:
|