ansible/playbooks/prod_web.yml

#!/usr/bin/env ansible-playbook
# vim:ft=ansible:
# Webservers
---
- hosts: web1.desu.ltd
  module_defaults:
    docker_container:
      state: started
      restart_policy: unless-stopped
      pull: yes
  tasks:
    - name: ensure docker network
      docker_network: name=web
      tags: [ docker ]
    - name: include tasks for applications
      include_tasks: tasks/{{ item }}
      with_items:
        - app/gulagbot.yml
        - app/redis.yml
        - web/9iron.yml
        - web/desultd.yml
        - web/gitea.yml
        - web/nextcloud.yml
        - web/srv.yml
      tags: [ always ]
  roles:
    - role: backup
      vars:
        backup_s3backup_list_extra:
          - /app/gitea/gitea
          - /data
          - /srv/desu.ltd
        backup_s3backup_exclude_list_extra:
          - /var/lib/gitea/log
          - /data/gitea/data/gitea/log
      tags: [ backup ]
    - role: git
      vars:
        git_repos:
          - repo: https://git.desu.ltd/salt/gitea-custom
            dest: /data/gitea/data/gitea/custom
      tags: [ web, git ]
    - role: ingress
      vars:
        ingress_servers:
          # desu.ltd
          - name: desu.ltd
            proxy_pass: http://desultd:80
            locations:
              - location: /.well-known/matrix/server
                contents: |
                  default_type application/json;
                  return 200 '{"m.server":"matrix.desu.ltd:443"}';
              - location: /.well-known/matrix/client
                contents: |
                  default_type application/json;
                  return 200 '{"m.homeserver":{"base_url":"https://matrix.desu.ltd"}}';
          - name: git.desu.ltd
            proxy_pass: http://gitea:3000
          - name: nc.desu.ltd
            directives:
              - "add_header Strict-Transport-Security \"max-age=31536000\""
              - "client_max_body_size 0"
            proxy_pass: http://nextcloud:80
            locations:
              - location: "^~ /.well-known"
                contents: |
                  location = /.well-known/carddav { return 301 /remote.php/dav/; }
                  location = /.well-known/caldav  { return 301 /remote.php/dav/; }
                  location ^~ /.well-known        { return 301 /index.php$uri; }
                  try_files $uri $uri/ =404;
          # 9iron
          - name: www.9iron.club
            directives:
              - "return 301 $scheme://9iron.club$request_uri"
          - name: 9iron.club
            proxy_pass: http://9iron:80
          - name: srv.9iron.club
            proxy_pass: http://srv:80
      tags: [ web, docker, ingress ]
- hosts: web2.desu.ltd
  module_defaults:
    docker_container:
      state: started
      restart_policy: unless-stopped
      pull: yes
  tasks:
    - name: ensure docker network
      docker_network: name=web
      tags: [ docker ]
    - name: include tasks for applications
      include_tasks: tasks/{{ item }}
      with_items:
        - app/redis.yml
        - web/peertube.yml
        - web/pleroma.yml
      tags: [ always ]
  roles:
    - role: backup
      vars:
        backup_s3backup_list_extra:
          - /data
      tags: [ backup ]
    - role: ingress
      vars:
        ingress_servers:
          - name: cowfee.moe
            proxy_pass: http://pleroma:4000
          - name: tube.cowfee.moe
            proxy_pass: http://peertube:9000
      tags: [ web, docker, ingress ]
- hosts: web3.desu.ltd
  module_defaults:
    docker_container:
      state: started
      restart_policy: unless-stopped
      pull: yes
  tasks:
    - name: ensure docker network
      docker_network: name=web
      tags: [ docker ]
    - name: include tasks for applications
      include_tasks: tasks/{{ item }}
      with_items:
        - app/redis.yml
        - web/movienight.yml
        - web/netbox.yml
          # TODO: Replace this with Naemon(?)
        - web/nagios.yml
      tags: [ always ]
  roles:
    - role: backup
      vars:
        backup_s3backup_list_extra:
          - /data
      tags: [ backup ]
    - role: ingress
      vars:
        ingress_servers:
          - name: netbox.desu.ltd
            proxy_pass: http://netbox:8080
          - name: nagios.desu.ltd
            proxy_pass: http://nagios:80
          - name: movie.desu.ltd
            proxy_pass: http://movienight:8089
      tags: [ web, docker, ingress ]
Add game1.thefuck.how, separate playbooks out 2020-12-21 01:18:32 -06:00			`#!/usr/bin/env ansible-playbook`
			`# vim:ft=ansible:`
			`# Webservers`
			`---`
			`- hosts: web1.desu.ltd`
Use module_defaults on web1 2021-06-18 12:39:21 -05:00			`module_defaults:`
			`docker_container:`
			`state: started`
			`restart_policy: unless-stopped`
			`pull: yes`
Deploy 9iron container to production 2021-03-25 12:59:40 -05:00			`tasks:`
Move web1 over to a containerized setup, containerize Nextcloud 2021-08-24 00:31:11 -05:00			`- name: ensure docker network`
			`docker_network: name=web`
			`tags: [ docker ]`
Simplify task includes 2021-09-18 07:23:03 -05:00			`- name: include tasks for applications`
			`include_tasks: tasks/{{ item }}`
Divide webservices into task files 2021-08-07 16:49:24 -05:00			`with_items:`
Simplify task includes 2021-09-18 07:23:03 -05:00			`- app/gulagbot.yml`
			`- app/redis.yml`
			`- web/9iron.yml`
			`- web/desultd.yml`
			`- web/gitea.yml`
			`- web/nextcloud.yml`
			`- web/srv.yml`
Divide webservices into task files 2021-08-07 16:49:24 -05:00			`tags: [ always ]`
Add game1.thefuck.how, separate playbooks out 2020-12-21 01:18:32 -06:00			`roles:`
Define machine-specific backups 2020-12-24 09:19:12 -06:00			`- role: backup`
			`vars:`
			`backup_s3backup_list_extra:`
Back up our jank shell script ew 2021-06-14 17:16:48 -05:00			`- /app/gitea/gitea`
Deploy docker to web1.desu.ltd Also adds docker libs to all hosts 2021-03-25 12:46:53 -05:00			`- /data`
Move data directories for NC and Gitea to /srv Allows for mountpoints yadda yadda 2020-12-30 18:05:57 -06:00			`- /srv/desu.ltd`
Exclude gitea logs in web1 backups 2021-01-14 18:06:13 -06:00			`backup_s3backup_exclude_list_extra:`
			`- /var/lib/gitea/log`
Move Gitea to a container Getting there 2021-06-14 17:16:26 -05:00			`- /data/gitea/data/gitea/log`
Define machine-specific backups 2020-12-24 09:19:12 -06:00			`tags: [ backup ]`
Move a bunch of webhead variables to their own vars files 2021-01-18 05:03:46 -06:00			`- role: git`
			`vars:`
			`git_repos:`
			`- repo: https://git.desu.ltd/salt/gitea-custom`
Move Gitea to a container Getting there 2021-06-14 17:16:26 -05:00			`dest: /data/gitea/data/gitea/custom`
Move a bunch of webhead variables to their own vars files 2021-01-18 05:03:46 -06:00			`tags: [ web, git ]`
Add role for ingress controller, move configuration into it and its data structures 2021-09-18 00:04:05 -05:00			`- role: ingress`
			`vars:`
			`ingress_servers:`
			`# desu.ltd`
			`- name: desu.ltd`
Allow for the definition of a singular proxy_pass on ingress_servers to simplify configuration 2021-09-18 07:19:26 -05:00			`proxy_pass: http://desultd:80`
Correct errors in nginx configuration 2021-10-02 21:53:44 -05:00			`locations:`
			`- location: /.well-known/matrix/server`
Configure web1.desu.ltd for Matrix delegation Big things a comin 2021-10-02 21:46:32 -05:00			`contents: \|`
Correct errors in nginx configuration 2021-10-02 21:53:44 -05:00			`default_type application/json;`
			`return 200 '{"m.server":"matrix.desu.ltd:443"}';`
			`- location: /.well-known/matrix/client`
Configure web1.desu.ltd for Matrix delegation Big things a comin 2021-10-02 21:46:32 -05:00			`contents: \|`
Correct errors in nginx configuration 2021-10-02 21:53:44 -05:00			`default_type application/json;`
			`return 200 '{"m.homeserver":{"base_url":"https://matrix.desu.ltd"}}';`
Add role for ingress controller, move configuration into it and its data structures 2021-09-18 00:04:05 -05:00			`- name: git.desu.ltd`
Allow for the definition of a singular proxy_pass on ingress_servers to simplify configuration 2021-09-18 07:19:26 -05:00			`proxy_pass: http://gitea:3000`
Add role for ingress controller, move configuration into it and its data structures 2021-09-18 00:04:05 -05:00			`- name: nc.desu.ltd`
			`directives:`
			`- "add_header Strict-Transport-Security \"max-age=31536000\""`
			`- "client_max_body_size 0"`
Allow for the definition of a singular proxy_pass on ingress_servers to simplify configuration 2021-09-18 07:19:26 -05:00			`proxy_pass: http://nextcloud:80`
Add role for ingress controller, move configuration into it and its data structures 2021-09-18 00:04:05 -05:00			`locations:`
			`- location: "^~ /.well-known"`
			`contents: \|`
			`location = /.well-known/carddav { return 301 /remote.php/dav/; }`
			`location = /.well-known/caldav { return 301 /remote.php/dav/; }`
			`location ^~ /.well-known { return 301 /index.php$uri; }`
			`try_files $uri $uri/ =404;`
			`# 9iron`
			`- name: www.9iron.club`
			`directives:`
			`- "return 301 $scheme://9iron.club$request_uri"`
			`- name: 9iron.club`
Allow for the definition of a singular proxy_pass on ingress_servers to simplify configuration 2021-09-18 07:19:26 -05:00			`proxy_pass: http://9iron:80`
Add role for ingress controller, move configuration into it and its data structures 2021-09-18 00:04:05 -05:00			`- name: srv.9iron.club`
Allow for the definition of a singular proxy_pass on ingress_servers to simplify configuration 2021-09-18 07:19:26 -05:00			`proxy_pass: http://srv:80`
Add role for ingress controller, move configuration into it and its data structures 2021-09-18 00:04:05 -05:00			`tags: [ web, docker, ingress ]`
Move Pleroma to a desu.ltd box WEW 2021-01-26 04:25:27 -06:00			`- hosts: web2.desu.ltd`
Employ defaults on web2 2021-06-07 00:45:52 -05:00			`module_defaults:`
			`docker_container:`
			`state: started`
			`restart_policy: unless-stopped`
			`pull: yes`
Migrate Pleroma into a Docker container This greatly simplifies configuration on web2, oddly enough 2021-06-03 20:34:48 -05:00			`tasks:`
			`- name: ensure docker network`
			`docker_network: name=web`
			`tags: [ docker ]`
Simplify task includes 2021-09-18 07:23:03 -05:00			`- name: include tasks for applications`
			`include_tasks: tasks/{{ item }}`
Divide webservices into task files 2021-08-07 16:49:24 -05:00			`with_items:`
Simplify task includes 2021-09-18 07:23:03 -05:00			`- app/redis.yml`
			`- web/peertube.yml`
			`- web/pleroma.yml`
Divide webservices into task files 2021-08-07 16:49:24 -05:00			`tags: [ always ]`
Move fedi1 over, add Pleroma role 2021-01-25 22:19:31 -06:00			`roles:`
			`- role: backup`
			`vars:`
			`backup_s3backup_list_extra:`
Migrate Pleroma into a Docker container This greatly simplifies configuration on web2, oddly enough 2021-06-03 20:34:48 -05:00			`- /data`
Move fedi1 over, add Pleroma role 2021-01-25 22:19:31 -06:00			`tags: [ backup ]`
Add role for ingress controller, move configuration into it and its data structures 2021-09-18 00:04:05 -05:00			`- role: ingress`
			`vars:`
			`ingress_servers:`
			`- name: cowfee.moe`
Allow for the definition of a singular proxy_pass on ingress_servers to simplify configuration 2021-09-18 07:19:26 -05:00			`proxy_pass: http://pleroma:4000`
Add role for ingress controller, move configuration into it and its data structures 2021-09-18 00:04:05 -05:00			`- name: tube.cowfee.moe`
Allow for the definition of a singular proxy_pass on ingress_servers to simplify configuration 2021-09-18 07:19:26 -05:00			`proxy_pass: http://peertube:9000`
Add role for ingress controller, move configuration into it and its data structures 2021-09-18 00:04:05 -05:00			`tags: [ web, docker, ingress ]`
Provision (read: move) Netbox to desu.ltd 2021-08-01 21:35:41 -05:00			`- hosts: web3.desu.ltd`
			`module_defaults:`
			`docker_container:`
			`state: started`
			`restart_policy: unless-stopped`
			`pull: yes`
			`tasks:`
			`- name: ensure docker network`
			`docker_network: name=web`
			`tags: [ docker ]`
Simplify task includes 2021-09-18 07:23:03 -05:00			`- name: include tasks for applications`
			`include_tasks: tasks/{{ item }}`
Divide webservices into task files 2021-08-07 16:49:24 -05:00			`with_items:`
Simplify task includes 2021-09-18 07:23:03 -05:00			`- app/redis.yml`
			`- web/movienight.yml`
			`- web/netbox.yml`
Add note to replace Nagios with naemon(?) 2021-09-26 10:40:35 -05:00			`# TODO: Replace this with Naemon(?)`
Simplify task includes 2021-09-18 07:23:03 -05:00			`- web/nagios.yml`
Divide webservices into task files 2021-08-07 16:49:24 -05:00			`tags: [ always ]`
Provision (read: move) Netbox to desu.ltd 2021-08-01 21:35:41 -05:00			`roles:`
			`- role: backup`
			`vars:`
			`backup_s3backup_list_extra:`
			`- /data`
			`tags: [ backup ]`
Add role for ingress controller, move configuration into it and its data structures 2021-09-18 00:04:05 -05:00			`- role: ingress`
			`vars:`
			`ingress_servers:`
			`- name: netbox.desu.ltd`
Allow for the definition of a singular proxy_pass on ingress_servers to simplify configuration 2021-09-18 07:19:26 -05:00			`proxy_pass: http://netbox:8080`
Add role for ingress controller, move configuration into it and its data structures 2021-09-18 00:04:05 -05:00			`- name: nagios.desu.ltd`
Allow for the definition of a singular proxy_pass on ingress_servers to simplify configuration 2021-09-18 07:19:26 -05:00			`proxy_pass: http://nagios:80`
Add role for ingress controller, move configuration into it and its data structures 2021-09-18 00:04:05 -05:00			`- name: movie.desu.ltd`
Allow for the definition of a singular proxy_pass on ingress_servers to simplify configuration 2021-09-18 07:19:26 -05:00			`proxy_pass: http://movienight:8089`
Add role for ingress controller, move configuration into it and its data structures 2021-09-18 00:04:05 -05:00			`tags: [ web, docker, ingress ]`