salt/ansible
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Compare commits

base: salt:07ea9806da829fcdcf9f970900be5e2f37a690cf
Branches Tags
salt:master
salt:kopia
salt:cleanup
salt:rewrite
..
compare: salt:55304ac4d9b9a1a9734a9d474bb63df791b8bacb
Branches Tags
salt:master
salt:kopia
salt:cleanup
salt:rewrite

No commits in common. "07ea9806da829fcdcf9f970900be5e2f37a690cf" and "55304ac4d9b9a1a9734a9d474bb63df791b8bacb" have entirely different histories.
07ea9806da ... 55304ac4d9

22 changed files with 240 additions and 206 deletions
Show Stats Expand all files Collapse all files

2
inventory/host_vars/dsk-ryzen-0.desu.ltd.yml
View File

@ -1,2 +0,0 @@
# vim:ft=ansible
docker_apt_repository: "deb https://download.docker.com/linux/ubuntu focal stable"

5
playbooks/db.yml
View File

@ -6,6 +6,11 @@
roles:
- role: backup
tags: [ backup ]
- role: motd
vars:
motd_watch_services_extra:
- postgresql
tags: [ motd ]
- role: postgresql
vars:
postgresql_global_config_options:

8
playbooks/desktop.yml
View File

@ -25,6 +25,8 @@
backup_s3backup_list_extra:
- /home/salt/.backup/
tags: [ backup ]
- role: motd
tags: [ motd ]
- role: udev
vars:
udev_rules:
@ -37,6 +39,8 @@
tags: [ desktop, zerotier ]
- hosts: lap-s76-lemp9-0.desu.ltd
roles:
- role: docker
tags: [ desktop, docker, skip-pull ]
- role: desktop
vars:
desktop_apt_keys_url_extra:
@ -73,6 +77,10 @@
tags: [ desktop, grub ]
- hosts: dsk-ryzen-0.desu.ltd
roles:
- role: docker
vars:
docker_apt_repository: "deb https://download.docker.com/linux/ubuntu focal stable"
tags: [ desktop, docker, skip-pull ]
- role: desktop
tags: [ desktop, desktop-role ]
# - role: grub

18
playbooks/files/k8s/desu.local/ca.crt Normal file
View File

@ -0,0 +1,18 @@
-----BEGIN CERTIFICATE-----
MIIC5zCCAc+gAwIBAgIBADANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwprdWJl
cm5ldGVzMB4XDTIxMDIxOTAxMTMyNVoXDTMxMDIxNzAxMTMyNVowFTETMBEGA1UE
AxMKa3ViZXJuZXRlczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN9r
fEaETyWkO49xZIyw37JNcgbwixDN+cLvnKtKqCW7u573PU0cJ+7KBuefewM6Uf+6
Xjn/AO+vm8c1iSz41bWXcS2902SkmjWCi4H4XlxhJgSYmVJrRxL44yfrh/kNOU8T
WFtABhX2pc8HZLduvhx2CUoZSp+O3uITY3qiHaeoaoAF1eR99SCU8MAYYvRx21IO
oRK98vFAi9M2gN5/rteUXxkREdabpqDZHFgQfNUwQ7OfNMjZcOxOjY5FZc3ZYdz8
MuboYvAtbhXfwe6dADiZHoryuMypIpMO+6sf/NFQLRr6RozT01Tn6AeSryGG1Ycl
KmKVvvnolZy4oSbVtusCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB
/wQFMAMBAf8wHQYDVR0OBBYEFD5eBd3k5DosRSoQG9FawHPy3hKnMA0GCSqGSIb3
DQEBCwUAA4IBAQBWDw0Qn1EGV+ouigIQp8Te28dXA8tIO4jR5NawqTQPcLMU1QQV
/jjs5E5lpiHLECZ2vPFTSdUdmhHKbUiLwSHOn2IEI8pb43Lk8US+uiEy4K7wleu9
SgSAVmAW7fN6w8DyYFvwqLdCiYi84CmI6BTymaYzyA3NQ2FigPjBgV4QBw8VJqG5
bDh5Jfu/nDnxcibKt9x0BDTxS3d3OLzAnyjj5Ie9RBEYoku4Y8oHxMyWkFjeyTiT
kP07hN7Uf1Ui2+FEpcWai/WOLX3etqoT/SjLRiNWF4N4ZZPLGjpMsO+OnoqCi9Zu
vdr+IpCJrQjSuwwNiJHEphvkLtOuNOgkihky
-----END CERTIFICATE-----

1
playbooks/files/k8s/desu.local/client.crt Symbolic link
View File

@ -0,0 +1 @@
/home/salt/.kube/client.crt

1
playbooks/files/k8s/desu.local/client.key Symbolic link
View File

@ -0,0 +1 @@
/home/salt/.kube/client.key

1
playbooks/files/k8s/desu.local/kubeconfig Symbolic link
View File

@ -0,0 +1 @@
/home/salt/.kube/config

7
playbooks/game.yml
View File

@ -11,6 +11,13 @@
backup_s3backup_exclude_list_extra:
- /data/minecraft/valhelsia3/backups
tags: [ backup ]
- role: motd
vars:
motd_watch_services_extra:
- docker
tags: [ motd ]
- role: docker
tags: [ docker, skip-pull ]
- hosts: game1.desu.ltd
tasks:
- name: include tasks for gameservers

6
playbooks/pik8s.yml
View File

@ -7,6 +7,12 @@
roles:
- role: k8s
tags: [ k8s, skip-pull ]
- role: motd
vars:
motd_watch_services_extra:
- docker
- kubelet
tags: [ k8s, motd ]
- hosts: tags_pik8s-master
gather_facts: no
tasks:

2
playbooks/pis.yml
View File

@ -6,6 +6,8 @@
roles:
- role: zerotier
tags: [ pis, zerotier ]
- role: docker
tags: [ pis, docker, skip-pull ]
tasks:
- name: install basic packages
apt:

5
playbooks/pistorage.yml
View File

@ -35,6 +35,11 @@
- /srv/nfs/k8s/default/web-transmission-config-pvc
backup_time: "Mon *-*-* 02:00:00"
tags: [ backup ]
- role: motd
vars:
motd_watch_services_extra:
- docker
- postgresql
- role: postgresql
vars:
postgresql_global_config_options:

12
playbooks/tasks/app/gulagbot.yml
View File

@ -1,12 +0,0 @@
# vim:ft=ansible:
- name: docker deploy gulagbot
docker_container:
name: gulagbot
image: rehashedsalt/gulagbot:latest
env:
DISCORD_TOKEN: "{{ secret_gulagbot_discord_token }}"
PGHOST: 192.168.164.156
PGDATABASE: gulagbot-desultd
PGUSER: gulagbot-desultd
PGPASSWORD: "{{ secret_gulagbot_db_pass }}"
tags: [ docker, gulagbot, stalin ]

9
playbooks/tasks/app/redis.yml
View File

@ -1,9 +0,0 @@
# vim:ft=ansible:
- name: docker deploy redis
docker_container:
name: redis
image: redis:6-alpine
networks:
- name: web
aliases: [ "redis" ]
tags: [ docker, redis ]

11
playbooks/tasks/web/9iron.yml
View File

@ -1,11 +0,0 @@
# vim:ft=ansible:
- name: docker deploy 9iron
docker_container:
name: 9iron
image: rehashedsalt/9iron:latest
ports:
- 8001:80
volumes:
- /data/9iron/files:/var/www/html/files
- /data/9iron/packs:/var/www/html/minecraft/packs
tags: [ docker, 9iron ]

10
playbooks/tasks/web/desultd.yml
View File

@ -1,10 +0,0 @@
# vim:ft=ansible:
- name: docker deploy desultd
docker_container:
name: desultd
image: rehashedsalt/desultd:latest
ports:
- 8002:80
volumes:
- /data/9iron/files:/var/www/html/files
tags: [ docker, 9iron ]

22
playbooks/tasks/web/gitea.yml
View File

@ -1,22 +0,0 @@
# vim:ft=ansible:
- name: docker deploy gitea
docker_container:
name: gitea
image: gitea/gitea:1
env:
USER_UID: "1002"
USER_GID: "1002"
GITEA__database_DB_TYPE: postgres
GITEA__database_HOST: 192.168.164.156:5432
GITEA__database_NAME: gitea-desultd
GITEA__database_USER: gitea-desultd
GITEA__database_PASSWD: "{{ secret_gitea_db_pass }}"
ports:
- 3000:3000
- 127.0.0.1:2222:22
volumes:
- /data/gitea/data:/data
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
- /var/lib/gitea/.ssh:/data/git/.ssh
tags: [ docker, gitea ]

18
playbooks/tasks/web/ingress-generic.yml
View File

@ -1,18 +0,0 @@
# vim:ft=ansible:
- name: docker deploy nginx proxy
docker_container:
name: ingress
image: jonasal/nginx-certbot:2.2.0
env:
TZ: "America/Chicago"
CERTBOT_EMAIL: rehashedsalt@cock.li
networks:
- name: web
aliases: [ "ingress" ]
ports:
- "443:443"
- "80:80"
volumes:
- /data/nginx-certbot/letsencrypt:/etc/letsencrypt
- /data/nginx-certbot/user_conf.d:/etc/nginx/user_conf.d:ro
tags: [ docker, ingress ]

23
playbooks/tasks/web/netbox.yml
View File

@ -1,23 +0,0 @@
# vim:ft=ansible:
- name: docker deploy netbox
docker_container:
name: netbox
image: netboxcommunity/netbox:latest
env:
SUPERUSER_EMAIL: rehashedsalt@cock.li
SUPERUSER_PASSWORD: "{{ secret_netbox_user_pass }}"
SUPERUSER_API_TOKEN: "{{ secret_netbox_api_token }}"
SECRET_KEY: "{{ secret_netbox_secret_key }}"
ALLOWED_HOST: netbox.desu.ltd
DB_HOST: 192.168.164.156
DB_NAME: netbox-desultd
DB_USER: netbox-desultd
DB_PASSWORD: "{{ secret_netbox_db_pass }}"
REDIS_HOST: redis
REDIS_PORT: "6379"
networks:
- name: web
aliases: [ "netbox" ]
volumes:
- /data/netbox/config:/config
tags: [ docker, netbox ]

23
playbooks/tasks/web/peertube.yml
View File

@ -1,23 +0,0 @@
# vim:ft=ansible:
- name: docker deploy peertube
docker_container:
name: peertube
image: chocobozzz/peertube:production-buster
env:
POSTGRES_DB: peertube_cowfee
PEERTUBE_DB: peertube_cowfee
PEERTUBE_DB_USERNAME: peertube-cowfee
PEERTUBE_DB_PASSWORD: "{{ secret_peertube_db_pass }}"
PEERTUBE_DB_HOSTNAME: 192.168.164.156
PEERTUBE_ADMIN_EMAIL: rehashedsalt@cock.li
PEERTUBE_WEBSERVER_HOSTNAME: tube.cowfee.moe
PEERTUBE_TRUST_PROXY: '["127.0.0.0/16", "192.168.0.0/16", "172.16.0.0/12", "10.0.0.0/8"]'
networks:
- name: web
aliases: [ "peertube" ]
ports:
- "1935:1935"
volumes:
- /data/peertube/data:/data
- /data/peertube/config:/config
tags: [ docker, peertube ]

19
playbooks/tasks/web/pleroma.yml
View File

@ -1,19 +0,0 @@
# vim:ft=ansible:
- name: docker deploy pleroma
docker_container:
name: pleroma
image: jordemort/pleroma
env:
TZ: "America/Chicago"
POSTGRES_HOST: 192.168.164.156
POSTGRES_DB: pleroma_cowfee
POSTGRES_USER: pleroma-cowfee
POSTGRES_PASSWORD: "{{ secret_pleroma_9iron_db_pass }}"
networks:
- name: web
aliases: [ "pleroma" ]
volumes:
- /data/pleroma/etc:/etc/pleroma
- /data/pleroma/static:/var/lib/pleroma/static
- /data/pleroma/uploads:/var/lib/pleroma/uploads
tags: [ docker, pleroma ]

232
playbooks/web.yml
View File

@ -15,25 +15,60 @@
restart_policy: unless-stopped
pull: yes
tasks:
- name: include tasks for apps
include_tasks: tasks/app/{{ task }}
with_items:
- gulagbot.yml
loop_control:
loop_var: task
tags: [ always ]
- name: include tasks for web services
include_tasks: tasks/web/{{ task }}
with_items:
- 9iron.yml
- desultd.yml
- gitea.yml
loop_control:
loop_var: task
tags: [ always ]
- name: configure nextcloud cronjob
cron: user=www-data name=nextcloud minute=*/5 job="php -f /var/www/nc.desu.ltd/cron.php"
tags: [ nextcloud, cron ]
- name: docker deploy 9iron
docker_container:
name: 9iron
image: rehashedsalt/9iron:latest
ports:
- 8001:80
volumes:
- /data/9iron/files:/var/www/html/files
- /data/9iron/packs:/var/www/html/minecraft/packs
tags: [ docker, 9iron ]
- name: docker deploy desultd
docker_container:
name: desultd
image: rehashedsalt/desultd:latest
ports:
- 8002:80
volumes:
- /data/9iron/files:/var/www/html/files
tags: [ docker, 9iron ]
- name: docker deploy gitea
docker_container:
name: gitea
image: gitea/gitea:1
env:
USER_UID: "1002"
USER_GID: "1002"
GITEA__database_DB_TYPE: postgres
GITEA__database_HOST: 192.168.164.156:5432
GITEA__database_NAME: gitea-desultd
GITEA__database_USER: gitea-desultd
GITEA__database_PASSWD: "{{ secret_gitea_db_pass }}"
ports:
- 3000:3000
- 127.0.0.1:2222:22
volumes:
- /data/gitea/data:/data
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
- /var/lib/gitea/.ssh:/data/git/.ssh
tags: [ docker, gitea ]
- name: docker deploy gulagbot
docker_container:
name: gulagbot
image: rehashedsalt/gulagbot:latest
env:
DISCORD_TOKEN: "{{ secret_gulagbot_discord_token }}"
PGHOST: 192.168.164.156
PGDATABASE: gulagbot-desultd
PGUSER: gulagbot-desultd
PGPASSWORD: "{{ secret_gulagbot_db_pass }}"
tags: [ docker, gulagbot, stalin ]
roles:
- role: backup
vars:
@ -47,6 +82,15 @@
- /var/lib/gitea/log
- /data/gitea/data/gitea/log
tags: [ backup ]
- role: motd
vars:
motd_watch_services_extra:
- apache2
- docker
- php7.4-fpm
tags: [ motd ]
- role: docker
tags: [ web, docker, skip-pull ]
- role: certbot
tags: [ web, certbot ]
- role: php
@ -103,28 +147,84 @@
}
}
tags: [ docker, ingress ]
- name: include tasks for apps
include_tasks: tasks/app/{{ task }}
with_items:
- redis.yml
loop_control:
loop_var: task
tags: [ always ]
- name: include tasks for web services
include_tasks: tasks/web/{{ task }}
with_items:
- peertube.yml
- pleroma.yml
- ingress-generic.yml
loop_control:
loop_var: task
tags: [ always ]
- name: docker deploy pleroma
docker_container:
name: pleroma
image: jordemort/pleroma
env:
TZ: "America/Chicago"
POSTGRES_HOST: 192.168.164.156
POSTGRES_DB: pleroma_cowfee
POSTGRES_USER: pleroma-cowfee
POSTGRES_PASSWORD: "{{ secret_pleroma_9iron_db_pass }}"
networks:
- name: web
aliases: [ "pleroma" ]
volumes:
- /data/pleroma/etc:/etc/pleroma
- /data/pleroma/static:/var/lib/pleroma/static
- /data/pleroma/uploads:/var/lib/pleroma/uploads
tags: [ docker, pleroma ]
- name: docker deploy redis
docker_container:
name: redis
image: redis:6-alpine
networks:
- name: web
aliases: [ "redis" ]
tags: [ docker, redis ]
- name: docker deploy peertube
docker_container:
name: peertube
image: chocobozzz/peertube:production-buster
env:
POSTGRES_DB: peertube_cowfee
PEERTUBE_DB: peertube_cowfee
PEERTUBE_DB_USERNAME: peertube-cowfee
PEERTUBE_DB_PASSWORD: "{{ secret_peertube_db_pass }}"
PEERTUBE_DB_HOSTNAME: 192.168.164.156
PEERTUBE_ADMIN_EMAIL: rehashedsalt@cock.li
PEERTUBE_WEBSERVER_HOSTNAME: tube.cowfee.moe
PEERTUBE_TRUST_PROXY: '["127.0.0.0/16", "192.168.0.0/16", "172.16.0.0/12", "10.0.0.0/8"]'
networks:
- name: web
aliases: [ "peertube" ]
ports:
- "1935:1935"
volumes:
- /data/peertube/data:/data
- /data/peertube/config:/config
tags: [ docker, peertube ]
- name: docker deploy nginx proxy
docker_container:
name: ingress
image: jonasal/nginx-certbot:2.2.0
env:
TZ: "America/Chicago"
CERTBOT_EMAIL: rehashedsalt@cock.li
networks:
- name: web
aliases: [ "ingress" ]
ports:
- "443:443"
- "80:80"
volumes:
- /data/nginx-certbot/letsencrypt:/etc/letsencrypt
- /data/nginx-certbot/user_conf.d:/etc/nginx/user_conf.d:ro
tags: [ docker, ingress ]
roles:
- role: backup
vars:
backup_s3backup_list_extra:
- /data
tags: [ backup ]
- role: motd
vars:
motd_watch_services_extra:
- docker
tags: [ motd ]
- role: docker
tags: [ web, docker, skip-pull ]
- hosts: web3.desu.ltd
module_defaults:
docker_container:
@ -154,23 +254,63 @@
}
}
tags: [ docker, ingress ]
- name: include tasks for apps
include_tasks: tasks/app/{{ task }}
with_items:
- redis.yml
loop_control:
loop_var: task
tags: [ always ]
- name: include tasks for web services
include_tasks: tasks/web/{{ task }}
with_items:
- netbox.yml
loop_control:
loop_var: task
tags: [ always ]
- name: docker deploy redis
docker_container:
name: redis
image: redis:6-alpine
networks:
- name: web
aliases: [ "redis" ]
tags: [ docker, redis ]
- name: docker deploy netbox
docker_container:
name: netbox
image: netboxcommunity/netbox:latest
env:
SUPERUSER_EMAIL: rehashedsalt@cock.li
SUPERUSER_PASSWORD: "{{ secret_netbox_user_pass }}"
SUPERUSER_API_TOKEN: "{{ secret_netbox_api_token }}"
SECRET_KEY: "{{ secret_netbox_secret_key }}"
ALLOWED_HOST: netbox.desu.ltd
DB_HOST: 192.168.164.156
DB_NAME: netbox-desultd
DB_USER: netbox-desultd
DB_PASSWORD: "{{ secret_netbox_db_pass }}"
REDIS_HOST: redis
REDIS_PORT: "6379"
networks:
- name: web
aliases: [ "netbox" ]
volumes:
- /data/netbox/config:/config
tags: [ docker, netbox ]
- name: docker deploy nginx proxy
docker_container:
name: ingress
image: jonasal/nginx-certbot:2.2.0
env:
TZ: "America/Chicago"
CERTBOT_EMAIL: rehashedsalt@cock.li
networks:
- name: web
aliases: [ "ingress" ]
ports:
- "443:443"
- "80:80"
volumes:
- /data/nginx-certbot/letsencrypt:/etc/letsencrypt
- /data/nginx-certbot/user_conf.d:/etc/nginx/user_conf.d:ro
tags: [ docker, ingress ]
roles:
- role: backup
vars:
backup_s3backup_list_extra:
- /data
tags: [ backup ]
- role: motd
vars:
motd_watch_services_extra:
- docker
tags: [ motd ]
- role: docker
tags: [ web, docker, skip-pull ]

11
site.yml
View File

@ -8,17 +8,6 @@
tags: [ common ]
- role: adminuser
tags: [ adminuser, common ]
- role: docker
tags: [ docker, common, skip-pull ]
- role: motd
vars:
motd_watch_services_extra:
- apache2
- docker
- kubelet
- php7.4-fpm
- postgresql
tags: [ motd, common ]
- role: sshd
vars:
sshd: