inventory/host_vars/dsk-ryzen-0.desu.ltd.yml

@@ -1,2 +0,0 @@
-# vim:ft=ansible
-docker_apt_repository: "deb https://download.docker.com/linux/ubuntu focal stable"

playbooks/db.yml

@@ -6,6 +6,11 @@
   roles:
     - role: backup
       tags: [ backup ]
+    - role: motd
+      vars:
+        motd_watch_services_extra:
+          - postgresql
+      tags: [ motd ]
     - role: postgresql
       vars:
         postgresql_global_config_options:

playbooks/desktop.yml

@@ -25,6 +25,8 @@
         backup_s3backup_list_extra:
           - /home/salt/.backup/
       tags: [ backup ]
+    - role: motd
+      tags: [ motd ]
     - role: udev
       vars:
         udev_rules:
@@ -37,6 +39,8 @@
       tags: [ desktop, zerotier ]
 - hosts: lap-s76-lemp9-0.desu.ltd
   roles:
+    - role: docker
+      tags: [ desktop, docker, skip-pull ]
     - role: desktop
       vars:
         desktop_apt_keys_url_extra:
@@ -73,6 +77,10 @@
       tags: [ desktop, grub ]
 - hosts: dsk-ryzen-0.desu.ltd
   roles:
+    - role: docker
+      vars:
+        docker_apt_repository: "deb https://download.docker.com/linux/ubuntu focal stable"
+      tags: [ desktop, docker, skip-pull ]
     - role: desktop
       tags: [ desktop, desktop-role ]
 #    - role: grub

playbooks/files/k8s/desu.local/ca.crt

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC5zCCAc+gAwIBAgIBADANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwprdWJl
+cm5ldGVzMB4XDTIxMDIxOTAxMTMyNVoXDTMxMDIxNzAxMTMyNVowFTETMBEGA1UE
+AxMKa3ViZXJuZXRlczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN9r
+fEaETyWkO49xZIyw37JNcgbwixDN+cLvnKtKqCW7u573PU0cJ+7KBuefewM6Uf+6
+Xjn/AO+vm8c1iSz41bWXcS2902SkmjWCi4H4XlxhJgSYmVJrRxL44yfrh/kNOU8T
+WFtABhX2pc8HZLduvhx2CUoZSp+O3uITY3qiHaeoaoAF1eR99SCU8MAYYvRx21IO
+oRK98vFAi9M2gN5/rteUXxkREdabpqDZHFgQfNUwQ7OfNMjZcOxOjY5FZc3ZYdz8
+MuboYvAtbhXfwe6dADiZHoryuMypIpMO+6sf/NFQLRr6RozT01Tn6AeSryGG1Ycl
+KmKVvvnolZy4oSbVtusCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB
+/wQFMAMBAf8wHQYDVR0OBBYEFD5eBd3k5DosRSoQG9FawHPy3hKnMA0GCSqGSIb3
+DQEBCwUAA4IBAQBWDw0Qn1EGV+ouigIQp8Te28dXA8tIO4jR5NawqTQPcLMU1QQV
+/jjs5E5lpiHLECZ2vPFTSdUdmhHKbUiLwSHOn2IEI8pb43Lk8US+uiEy4K7wleu9
+SgSAVmAW7fN6w8DyYFvwqLdCiYi84CmI6BTymaYzyA3NQ2FigPjBgV4QBw8VJqG5
+bDh5Jfu/nDnxcibKt9x0BDTxS3d3OLzAnyjj5Ie9RBEYoku4Y8oHxMyWkFjeyTiT
+kP07hN7Uf1Ui2+FEpcWai/WOLX3etqoT/SjLRiNWF4N4ZZPLGjpMsO+OnoqCi9Zu
+vdr+IpCJrQjSuwwNiJHEphvkLtOuNOgkihky
+-----END CERTIFICATE-----

playbooks/files/k8s/desu.local/client.crt

@@ -0,0 +1 @@
+/home/salt/.kube/client.crt

playbooks/files/k8s/desu.local/client.key

@@ -0,0 +1 @@
+/home/salt/.kube/client.key

playbooks/files/k8s/desu.local/kubeconfig

@@ -0,0 +1 @@
+/home/salt/.kube/config

playbooks/game.yml

@@ -11,6 +11,13 @@
         backup_s3backup_exclude_list_extra:
           - /data/minecraft/valhelsia3/backups
       tags: [ backup ]
+    - role: motd
+      vars:
+        motd_watch_services_extra:
+          - docker
+      tags: [ motd ]
+    - role: docker
+      tags: [ docker, skip-pull ]
 - hosts: game1.desu.ltd
   tasks:
     - name: include tasks for gameservers

playbooks/pik8s.yml

@@ -7,6 +7,12 @@
   roles:
     - role: k8s
       tags: [ k8s, skip-pull ]
+    - role: motd
+      vars:
+        motd_watch_services_extra:
+          - docker
+          - kubelet
+      tags: [ k8s, motd ]
 - hosts: tags_pik8s-master
   gather_facts: no
   tasks:

playbooks/pis.yml

@@ -6,6 +6,8 @@
   roles:
     - role: zerotier
       tags: [ pis, zerotier ]
+    - role: docker
+      tags: [ pis, docker, skip-pull ]
   tasks:
     - name: install basic packages
       apt:

playbooks/pistorage.yml

@@ -35,6 +35,11 @@
           - /srv/nfs/k8s/default/web-transmission-config-pvc
         backup_time: "Mon *-*-* 02:00:00"
       tags: [ backup ]
+    - role: motd
+      vars:
+        motd_watch_services_extra:
+          - docker
+          - postgresql
     - role: postgresql
       vars:
         postgresql_global_config_options:

playbooks/tasks/app/gulagbot.yml

@@ -1,12 +0,0 @@
-# vim:ft=ansible:
-- name: docker deploy gulagbot
-  docker_container:
-    name: gulagbot
-    image: rehashedsalt/gulagbot:latest
-    env:
-      DISCORD_TOKEN: "{{ secret_gulagbot_discord_token }}"
-      PGHOST: 192.168.164.156
-      PGDATABASE: gulagbot-desultd
-      PGUSER: gulagbot-desultd
-      PGPASSWORD: "{{ secret_gulagbot_db_pass }}"
-  tags: [ docker, gulagbot, stalin ]

playbooks/tasks/app/redis.yml

@@ -1,9 +0,0 @@
-# vim:ft=ansible:
-- name: docker deploy redis
-  docker_container:
-    name: redis
-    image: redis:6-alpine
-    networks:
-      - name: web
-        aliases: [ "redis" ]
-  tags: [ docker, redis ]

playbooks/tasks/web/9iron.yml

@@ -1,11 +0,0 @@
-# vim:ft=ansible:
-- name: docker deploy 9iron
-  docker_container:
-    name: 9iron
-    image: rehashedsalt/9iron:latest
-    ports:
-      - 8001:80
-    volumes:
-      - /data/9iron/files:/var/www/html/files
-      - /data/9iron/packs:/var/www/html/minecraft/packs
-  tags: [ docker, 9iron ]

playbooks/tasks/web/desultd.yml

@@ -1,10 +0,0 @@
-# vim:ft=ansible:
-- name: docker deploy desultd
-  docker_container:
-    name: desultd
-    image: rehashedsalt/desultd:latest
-    ports:
-      - 8002:80
-    volumes:
-      - /data/9iron/files:/var/www/html/files
-  tags: [ docker, 9iron ]

playbooks/tasks/web/gitea.yml

@@ -1,22 +0,0 @@
-# vim:ft=ansible:
-- name: docker deploy gitea
-  docker_container:
-    name: gitea
-    image: gitea/gitea:1
-    env:
-      USER_UID: "1002"
-      USER_GID: "1002"
-      GITEA__database_DB_TYPE: postgres
-      GITEA__database_HOST: 192.168.164.156:5432
-      GITEA__database_NAME: gitea-desultd
-      GITEA__database_USER: gitea-desultd
-      GITEA__database_PASSWD: "{{ secret_gitea_db_pass }}"
-    ports:
-      - 3000:3000
-      - 127.0.0.1:2222:22
-    volumes:
-      - /data/gitea/data:/data
-      - /etc/timezone:/etc/timezone:ro
-      - /etc/localtime:/etc/localtime:ro
-      - /var/lib/gitea/.ssh:/data/git/.ssh
-  tags: [ docker, gitea ]

playbooks/tasks/web/ingress-generic.yml

@@ -1,18 +0,0 @@
-# vim:ft=ansible:
-- name: docker deploy nginx proxy
-  docker_container:
-    name: ingress
-    image: jonasal/nginx-certbot:2.2.0
-    env:
-      TZ: "America/Chicago"
-      CERTBOT_EMAIL: rehashedsalt@cock.li
-    networks:
-      - name: web
-        aliases: [ "ingress" ]
-    ports:
-      - "443:443"
-      - "80:80"
-    volumes:
-      - /data/nginx-certbot/letsencrypt:/etc/letsencrypt
-      - /data/nginx-certbot/user_conf.d:/etc/nginx/user_conf.d:ro
-  tags: [ docker, ingress ]

playbooks/tasks/web/netbox.yml

@@ -1,23 +0,0 @@
-# vim:ft=ansible:
-- name: docker deploy netbox
-  docker_container:
-    name: netbox
-    image: netboxcommunity/netbox:latest
-    env:
-      SUPERUSER_EMAIL: rehashedsalt@cock.li
-      SUPERUSER_PASSWORD: "{{ secret_netbox_user_pass }}"
-      SUPERUSER_API_TOKEN: "{{ secret_netbox_api_token }}"
-      SECRET_KEY: "{{ secret_netbox_secret_key }}"
-      ALLOWED_HOST: netbox.desu.ltd
-      DB_HOST: 192.168.164.156
-      DB_NAME: netbox-desultd
-      DB_USER: netbox-desultd
-      DB_PASSWORD: "{{ secret_netbox_db_pass }}"
-      REDIS_HOST: redis
-      REDIS_PORT: "6379"
-    networks:
-      - name: web
-        aliases: [ "netbox" ]
-    volumes:
-      - /data/netbox/config:/config
-  tags: [ docker, netbox ]

playbooks/tasks/web/peertube.yml

@@ -1,23 +0,0 @@
-# vim:ft=ansible:
-- name: docker deploy peertube
-  docker_container:
-    name: peertube
-    image: chocobozzz/peertube:production-buster
-    env:
-      POSTGRES_DB: peertube_cowfee
-      PEERTUBE_DB: peertube_cowfee
-      PEERTUBE_DB_USERNAME: peertube-cowfee
-      PEERTUBE_DB_PASSWORD: "{{ secret_peertube_db_pass }}"
-      PEERTUBE_DB_HOSTNAME: 192.168.164.156
-      PEERTUBE_ADMIN_EMAIL: rehashedsalt@cock.li
-      PEERTUBE_WEBSERVER_HOSTNAME: tube.cowfee.moe
-      PEERTUBE_TRUST_PROXY: '["127.0.0.0/16", "192.168.0.0/16", "172.16.0.0/12", "10.0.0.0/8"]'
-    networks:
-      - name: web
-        aliases: [ "peertube" ]
-    ports:
-      - "1935:1935"
-    volumes:
-      - /data/peertube/data:/data
-      - /data/peertube/config:/config
-  tags: [ docker, peertube ]

playbooks/tasks/web/pleroma.yml

@@ -1,19 +0,0 @@
-# vim:ft=ansible:
-- name: docker deploy pleroma
-  docker_container:
-    name: pleroma
-    image: jordemort/pleroma
-    env:
-      TZ: "America/Chicago"
-      POSTGRES_HOST: 192.168.164.156
-      POSTGRES_DB: pleroma_cowfee
-      POSTGRES_USER: pleroma-cowfee
-      POSTGRES_PASSWORD: "{{ secret_pleroma_9iron_db_pass }}"
-    networks:
-      - name: web
-        aliases: [ "pleroma" ]
-    volumes:
-      - /data/pleroma/etc:/etc/pleroma
-      - /data/pleroma/static:/var/lib/pleroma/static
-      - /data/pleroma/uploads:/var/lib/pleroma/uploads
-  tags: [ docker, pleroma ]

playbooks/web.yml

@@ -15,25 +15,60 @@
       restart_policy: unless-stopped
       pull: yes
   tasks:
-    - name: include tasks for apps
-      include_tasks: tasks/app/{{ task }}
-      with_items:
-        - gulagbot.yml
-      loop_control:
-        loop_var: task
-      tags: [ always ]
-    - name: include tasks for web services
-      include_tasks: tasks/web/{{ task }}
-      with_items:
-        - 9iron.yml
-        - desultd.yml
-        - gitea.yml
-      loop_control:
-        loop_var: task
-      tags: [ always ]
     - name: configure nextcloud cronjob
       cron: user=www-data name=nextcloud minute=*/5 job="php -f /var/www/nc.desu.ltd/cron.php"
       tags: [ nextcloud, cron ]
+    - name: docker deploy 9iron
+      docker_container:
+        name: 9iron
+        image: rehashedsalt/9iron:latest
+        ports:
+          - 8001:80
+        volumes:
+          - /data/9iron/files:/var/www/html/files
+          - /data/9iron/packs:/var/www/html/minecraft/packs
+      tags: [ docker, 9iron ]
+    - name: docker deploy desultd
+      docker_container:
+        name: desultd
+        image: rehashedsalt/desultd:latest
+        ports:
+          - 8002:80
+        volumes:
+          - /data/9iron/files:/var/www/html/files
+      tags: [ docker, 9iron ]
+    - name: docker deploy gitea
+      docker_container:
+        name: gitea
+        image: gitea/gitea:1
+        env:
+          USER_UID: "1002"
+          USER_GID: "1002"
+          GITEA__database_DB_TYPE: postgres
+          GITEA__database_HOST: 192.168.164.156:5432
+          GITEA__database_NAME: gitea-desultd
+          GITEA__database_USER: gitea-desultd
+          GITEA__database_PASSWD: "{{ secret_gitea_db_pass }}"
+        ports:
+          - 3000:3000
+          - 127.0.0.1:2222:22
+        volumes:
+          - /data/gitea/data:/data
+          - /etc/timezone:/etc/timezone:ro
+          - /etc/localtime:/etc/localtime:ro
+          - /var/lib/gitea/.ssh:/data/git/.ssh
+      tags: [ docker, gitea ]
+    - name: docker deploy gulagbot
+      docker_container:
+        name: gulagbot
+        image: rehashedsalt/gulagbot:latest
+        env:
+          DISCORD_TOKEN: "{{ secret_gulagbot_discord_token }}"
+          PGHOST: 192.168.164.156
+          PGDATABASE: gulagbot-desultd
+          PGUSER: gulagbot-desultd
+          PGPASSWORD: "{{ secret_gulagbot_db_pass }}"
+      tags: [ docker, gulagbot, stalin ]
   roles:
     - role: backup
       vars:
@@ -47,6 +82,15 @@
           - /var/lib/gitea/log
           - /data/gitea/data/gitea/log
       tags: [ backup ]
+    - role: motd
+      vars:
+        motd_watch_services_extra:
+          - apache2
+          - docker
+          - php7.4-fpm
+      tags: [ motd ]
+    - role: docker
+      tags: [ web, docker, skip-pull ]
     - role: certbot
       tags: [ web, certbot ]
     - role: php
@@ -103,28 +147,84 @@
             }
           }
       tags: [ docker, ingress ]
-    - name: include tasks for apps
+    - name: docker deploy pleroma
-      include_tasks: tasks/app/{{ task }}
+      docker_container:
-      with_items:
+        name: pleroma
-        - redis.yml
+        image: jordemort/pleroma
-      loop_control:
+        env:
-        loop_var: task
+          TZ: "America/Chicago"
-      tags: [ always ]
+          POSTGRES_HOST: 192.168.164.156
-    - name: include tasks for web services
+          POSTGRES_DB: pleroma_cowfee
-      include_tasks: tasks/web/{{ task }}
+          POSTGRES_USER: pleroma-cowfee
-      with_items:
+          POSTGRES_PASSWORD: "{{ secret_pleroma_9iron_db_pass }}"
-        - peertube.yml
+        networks:
-        - pleroma.yml
+          - name: web
-        - ingress-generic.yml
+            aliases: [ "pleroma" ]
-      loop_control:
+        volumes:
-        loop_var: task
+          - /data/pleroma/etc:/etc/pleroma
-      tags: [ always ]
+          - /data/pleroma/static:/var/lib/pleroma/static
+          - /data/pleroma/uploads:/var/lib/pleroma/uploads
+      tags: [ docker, pleroma ]
+    - name: docker deploy redis
+      docker_container:
+        name: redis
+        image: redis:6-alpine
+        networks:
+          - name: web
+            aliases: [ "redis" ]
+      tags: [ docker, redis ]
+    - name: docker deploy peertube
+      docker_container:
+        name: peertube
+        image: chocobozzz/peertube:production-buster
+        env:
+          POSTGRES_DB: peertube_cowfee
+          PEERTUBE_DB: peertube_cowfee
+          PEERTUBE_DB_USERNAME: peertube-cowfee
+          PEERTUBE_DB_PASSWORD: "{{ secret_peertube_db_pass }}"
+          PEERTUBE_DB_HOSTNAME: 192.168.164.156
+          PEERTUBE_ADMIN_EMAIL: rehashedsalt@cock.li
+          PEERTUBE_WEBSERVER_HOSTNAME: tube.cowfee.moe
+          PEERTUBE_TRUST_PROXY: '["127.0.0.0/16", "192.168.0.0/16", "172.16.0.0/12", "10.0.0.0/8"]'
+        networks:
+          - name: web
+            aliases: [ "peertube" ]
+        ports:
+          - "1935:1935"
+        volumes:
+          - /data/peertube/data:/data
+          - /data/peertube/config:/config
+      tags: [ docker, peertube ]
+    - name: docker deploy nginx proxy
+      docker_container:
+        name: ingress
+        image: jonasal/nginx-certbot:2.2.0
+        env:
+          TZ: "America/Chicago"
+          CERTBOT_EMAIL: rehashedsalt@cock.li
+        networks:
+          - name: web
+            aliases: [ "ingress" ]
+        ports:
+          - "443:443"
+          - "80:80"
+        volumes:
+          - /data/nginx-certbot/letsencrypt:/etc/letsencrypt
+          - /data/nginx-certbot/user_conf.d:/etc/nginx/user_conf.d:ro
+      tags: [ docker, ingress ]
   roles:
     - role: backup
       vars:
         backup_s3backup_list_extra:
           - /data
       tags: [ backup ]
+    - role: motd
+      vars:
+        motd_watch_services_extra:
+          - docker
+      tags: [ motd ]
+    - role: docker
+      tags: [ web, docker, skip-pull ]
 - hosts: web3.desu.ltd
   module_defaults:
     docker_container:
@@ -154,23 +254,63 @@
             }
           }
       tags: [ docker, ingress ]
-    - name: include tasks for apps
+    - name: docker deploy redis
-      include_tasks: tasks/app/{{ task }}
+      docker_container:
-      with_items:
+        name: redis
-        - redis.yml
+        image: redis:6-alpine
-      loop_control:
+        networks:
-        loop_var: task
+          - name: web
-      tags: [ always ]
+            aliases: [ "redis" ]
-    - name: include tasks for web services
+      tags: [ docker, redis ]
-      include_tasks: tasks/web/{{ task }}
+    - name: docker deploy netbox
-      with_items:
+      docker_container:
-        - netbox.yml
+        name: netbox
-      loop_control:
+        image: netboxcommunity/netbox:latest
-        loop_var: task
+        env:
-      tags: [ always ]
+          SUPERUSER_EMAIL: rehashedsalt@cock.li
+          SUPERUSER_PASSWORD: "{{ secret_netbox_user_pass }}"
+          SUPERUSER_API_TOKEN: "{{ secret_netbox_api_token }}"
+          SECRET_KEY: "{{ secret_netbox_secret_key }}"
+          ALLOWED_HOST: netbox.desu.ltd
+          DB_HOST: 192.168.164.156
+          DB_NAME: netbox-desultd
+          DB_USER: netbox-desultd
+          DB_PASSWORD: "{{ secret_netbox_db_pass }}"
+          REDIS_HOST: redis
+          REDIS_PORT: "6379"
+        networks:
+          - name: web
+            aliases: [ "netbox" ]
+        volumes:
+          - /data/netbox/config:/config
+      tags: [ docker, netbox ]
+    - name: docker deploy nginx proxy
+      docker_container:
+        name: ingress
+        image: jonasal/nginx-certbot:2.2.0
+        env:
+          TZ: "America/Chicago"
+          CERTBOT_EMAIL: rehashedsalt@cock.li
+        networks:
+          - name: web
+            aliases: [ "ingress" ]
+        ports:
+          - "443:443"
+          - "80:80"
+        volumes:
+          - /data/nginx-certbot/letsencrypt:/etc/letsencrypt
+          - /data/nginx-certbot/user_conf.d:/etc/nginx/user_conf.d:ro
+      tags: [ docker, ingress ]
   roles:
     - role: backup
       vars:
         backup_s3backup_list_extra:
           - /data
       tags: [ backup ]
+    - role: motd
+      vars:
+        motd_watch_services_extra:
+          - docker
+      tags: [ motd ]
+    - role: docker
+      tags: [ web, docker, skip-pull ]

site.yml

@@ -8,17 +8,6 @@
       tags: [ common ]
     - role: adminuser
       tags: [ adminuser, common ]
-    - role: docker
-      tags: [ docker, common, skip-pull ]
-    - role: motd
-      vars:
-        motd_watch_services_extra:
-          - apache2
-          - docker
-          - kubelet
-          - php7.4-fpm
-          - postgresql
-      tags: [ motd, common ]
     - role: sshd
       vars:
         sshd: