Docker goes on everything

inventory/host_vars/dsk-ryzen-0.desu.ltd.yml

@@ -0,0 +1,2 @@
+# vim:ft=ansible
+docker_apt_repository: "deb https://download.docker.com/linux/ubuntu focal stable"

playbooks/db.yml

@@ -6,11 +6,6 @@
   roles:
     - role: backup
       tags: [ backup ]
-    - role: motd
-      vars:
-        motd_watch_services_extra:
-          - postgresql
-      tags: [ motd ]
     - role: postgresql
       vars:
         postgresql_global_config_options:

playbooks/desktop.yml

@@ -25,8 +25,6 @@
         backup_s3backup_list_extra:
           - /home/salt/.backup/
       tags: [ backup ]
-    - role: motd
-      tags: [ motd ]
     - role: udev
       vars:
         udev_rules:
@@ -39,8 +37,6 @@
       tags: [ desktop, zerotier ]
 - hosts: lap-s76-lemp9-0.desu.ltd
   roles:
-    - role: docker
-      tags: [ desktop, docker, skip-pull ]
     - role: desktop
       vars:
         desktop_apt_keys_url_extra:
@@ -77,10 +73,6 @@
       tags: [ desktop, grub ]
 - hosts: dsk-ryzen-0.desu.ltd
   roles:
-    - role: docker
-      vars:
-        docker_apt_repository: "deb https://download.docker.com/linux/ubuntu focal stable"
-      tags: [ desktop, docker, skip-pull ]
     - role: desktop
       tags: [ desktop, desktop-role ]
 #    - role: grub

playbooks/files/k8s/desu.local/ca.crt

@@ -1,18 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC5zCCAc+gAwIBAgIBADANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwprdWJl
-cm5ldGVzMB4XDTIxMDIxOTAxMTMyNVoXDTMxMDIxNzAxMTMyNVowFTETMBEGA1UE
-AxMKa3ViZXJuZXRlczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN9r
-fEaETyWkO49xZIyw37JNcgbwixDN+cLvnKtKqCW7u573PU0cJ+7KBuefewM6Uf+6
-Xjn/AO+vm8c1iSz41bWXcS2902SkmjWCi4H4XlxhJgSYmVJrRxL44yfrh/kNOU8T
-WFtABhX2pc8HZLduvhx2CUoZSp+O3uITY3qiHaeoaoAF1eR99SCU8MAYYvRx21IO
-oRK98vFAi9M2gN5/rteUXxkREdabpqDZHFgQfNUwQ7OfNMjZcOxOjY5FZc3ZYdz8
-MuboYvAtbhXfwe6dADiZHoryuMypIpMO+6sf/NFQLRr6RozT01Tn6AeSryGG1Ycl
-KmKVvvnolZy4oSbVtusCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB
-/wQFMAMBAf8wHQYDVR0OBBYEFD5eBd3k5DosRSoQG9FawHPy3hKnMA0GCSqGSIb3
-DQEBCwUAA4IBAQBWDw0Qn1EGV+ouigIQp8Te28dXA8tIO4jR5NawqTQPcLMU1QQV
-/jjs5E5lpiHLECZ2vPFTSdUdmhHKbUiLwSHOn2IEI8pb43Lk8US+uiEy4K7wleu9
-SgSAVmAW7fN6w8DyYFvwqLdCiYi84CmI6BTymaYzyA3NQ2FigPjBgV4QBw8VJqG5
-bDh5Jfu/nDnxcibKt9x0BDTxS3d3OLzAnyjj5Ie9RBEYoku4Y8oHxMyWkFjeyTiT
-kP07hN7Uf1Ui2+FEpcWai/WOLX3etqoT/SjLRiNWF4N4ZZPLGjpMsO+OnoqCi9Zu
-vdr+IpCJrQjSuwwNiJHEphvkLtOuNOgkihky
------END CERTIFICATE-----

playbooks/files/k8s/desu.local/client.crt

@@ -1 +0,0 @@
-/home/salt/.kube/client.crt

playbooks/files/k8s/desu.local/client.key

@@ -1 +0,0 @@
-/home/salt/.kube/client.key

playbooks/files/k8s/desu.local/kubeconfig

@@ -1 +0,0 @@
-/home/salt/.kube/config

playbooks/game.yml

@@ -11,13 +11,6 @@
         backup_s3backup_exclude_list_extra:
           - /data/minecraft/valhelsia3/backups
       tags: [ backup ]
-    - role: motd
-      vars:
-        motd_watch_services_extra:
-          - docker
-      tags: [ motd ]
-    - role: docker
-      tags: [ docker, skip-pull ]
 - hosts: game1.desu.ltd
   tasks:
     - name: include tasks for gameservers

playbooks/pik8s.yml

@@ -7,12 +7,6 @@
   roles:
     - role: k8s
       tags: [ k8s, skip-pull ]
-    - role: motd
-      vars:
-        motd_watch_services_extra:
-          - docker
-          - kubelet
-      tags: [ k8s, motd ]
 - hosts: tags_pik8s-master
   gather_facts: no
   tasks:

playbooks/pis.yml

@@ -6,8 +6,6 @@
   roles:
     - role: zerotier
       tags: [ pis, zerotier ]
-    - role: docker
-      tags: [ pis, docker, skip-pull ]
   tasks:
     - name: install basic packages
       apt:

playbooks/pistorage.yml

@@ -35,11 +35,6 @@
           - /srv/nfs/k8s/default/web-transmission-config-pvc
         backup_time: "Mon *-*-* 02:00:00"
       tags: [ backup ]
-    - role: motd
-      vars:
-        motd_watch_services_extra:
-          - docker
-          - postgresql
     - role: postgresql
       vars:
         postgresql_global_config_options:

playbooks/tasks/app/gulagbot.yml

@@ -0,0 +1,12 @@
+# vim:ft=ansible:
+- name: docker deploy gulagbot
+  docker_container:
+    name: gulagbot
+    image: rehashedsalt/gulagbot:latest
+    env:
+      DISCORD_TOKEN: "{{ secret_gulagbot_discord_token }}"
+      PGHOST: 192.168.164.156
+      PGDATABASE: gulagbot-desultd
+      PGUSER: gulagbot-desultd
+      PGPASSWORD: "{{ secret_gulagbot_db_pass }}"
+  tags: [ docker, gulagbot, stalin ]

playbooks/tasks/app/redis.yml

@@ -0,0 +1,9 @@
+# vim:ft=ansible:
+- name: docker deploy redis
+  docker_container:
+    name: redis
+    image: redis:6-alpine
+    networks:
+      - name: web
+        aliases: [ "redis" ]
+  tags: [ docker, redis ]

playbooks/tasks/web/9iron.yml

@@ -0,0 +1,11 @@
+# vim:ft=ansible:
+- name: docker deploy 9iron
+  docker_container:
+    name: 9iron
+    image: rehashedsalt/9iron:latest
+    ports:
+      - 8001:80
+    volumes:
+      - /data/9iron/files:/var/www/html/files
+      - /data/9iron/packs:/var/www/html/minecraft/packs
+  tags: [ docker, 9iron ]

playbooks/tasks/web/desultd.yml

@@ -0,0 +1,10 @@
+# vim:ft=ansible:
+- name: docker deploy desultd
+  docker_container:
+    name: desultd
+    image: rehashedsalt/desultd:latest
+    ports:
+      - 8002:80
+    volumes:
+      - /data/9iron/files:/var/www/html/files
+  tags: [ docker, 9iron ]

playbooks/tasks/web/gitea.yml

@@ -0,0 +1,22 @@
+# vim:ft=ansible:
+- name: docker deploy gitea
+  docker_container:
+    name: gitea
+    image: gitea/gitea:1
+    env:
+      USER_UID: "1002"
+      USER_GID: "1002"
+      GITEA__database_DB_TYPE: postgres
+      GITEA__database_HOST: 192.168.164.156:5432
+      GITEA__database_NAME: gitea-desultd
+      GITEA__database_USER: gitea-desultd
+      GITEA__database_PASSWD: "{{ secret_gitea_db_pass }}"
+    ports:
+      - 3000:3000
+      - 127.0.0.1:2222:22
+    volumes:
+      - /data/gitea/data:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+      - /var/lib/gitea/.ssh:/data/git/.ssh
+  tags: [ docker, gitea ]

playbooks/tasks/web/ingress-generic.yml

@@ -0,0 +1,18 @@
+# vim:ft=ansible:
+- name: docker deploy nginx proxy
+  docker_container:
+    name: ingress
+    image: jonasal/nginx-certbot:2.2.0
+    env:
+      TZ: "America/Chicago"
+      CERTBOT_EMAIL: rehashedsalt@cock.li
+    networks:
+      - name: web
+        aliases: [ "ingress" ]
+    ports:
+      - "443:443"
+      - "80:80"
+    volumes:
+      - /data/nginx-certbot/letsencrypt:/etc/letsencrypt
+      - /data/nginx-certbot/user_conf.d:/etc/nginx/user_conf.d:ro
+  tags: [ docker, ingress ]

playbooks/tasks/web/netbox.yml

@@ -0,0 +1,23 @@
+# vim:ft=ansible:
+- name: docker deploy netbox
+  docker_container:
+    name: netbox
+    image: netboxcommunity/netbox:latest
+    env:
+      SUPERUSER_EMAIL: rehashedsalt@cock.li
+      SUPERUSER_PASSWORD: "{{ secret_netbox_user_pass }}"
+      SUPERUSER_API_TOKEN: "{{ secret_netbox_api_token }}"
+      SECRET_KEY: "{{ secret_netbox_secret_key }}"
+      ALLOWED_HOST: netbox.desu.ltd
+      DB_HOST: 192.168.164.156
+      DB_NAME: netbox-desultd
+      DB_USER: netbox-desultd
+      DB_PASSWORD: "{{ secret_netbox_db_pass }}"
+      REDIS_HOST: redis
+      REDIS_PORT: "6379"
+    networks:
+      - name: web
+        aliases: [ "netbox" ]
+    volumes:
+      - /data/netbox/config:/config
+  tags: [ docker, netbox ]

playbooks/tasks/web/peertube.yml

@@ -0,0 +1,23 @@
+# vim:ft=ansible:
+- name: docker deploy peertube
+  docker_container:
+    name: peertube
+    image: chocobozzz/peertube:production-buster
+    env:
+      POSTGRES_DB: peertube_cowfee
+      PEERTUBE_DB: peertube_cowfee
+      PEERTUBE_DB_USERNAME: peertube-cowfee
+      PEERTUBE_DB_PASSWORD: "{{ secret_peertube_db_pass }}"
+      PEERTUBE_DB_HOSTNAME: 192.168.164.156
+      PEERTUBE_ADMIN_EMAIL: rehashedsalt@cock.li
+      PEERTUBE_WEBSERVER_HOSTNAME: tube.cowfee.moe
+      PEERTUBE_TRUST_PROXY: '["127.0.0.0/16", "192.168.0.0/16", "172.16.0.0/12", "10.0.0.0/8"]'
+    networks:
+      - name: web
+        aliases: [ "peertube" ]
+    ports:
+      - "1935:1935"
+    volumes:
+      - /data/peertube/data:/data
+      - /data/peertube/config:/config
+  tags: [ docker, peertube ]

playbooks/tasks/web/pleroma.yml

@@ -0,0 +1,19 @@
+# vim:ft=ansible:
+- name: docker deploy pleroma
+  docker_container:
+    name: pleroma
+    image: jordemort/pleroma
+    env:
+      TZ: "America/Chicago"
+      POSTGRES_HOST: 192.168.164.156
+      POSTGRES_DB: pleroma_cowfee
+      POSTGRES_USER: pleroma-cowfee
+      POSTGRES_PASSWORD: "{{ secret_pleroma_9iron_db_pass }}"
+    networks:
+      - name: web
+        aliases: [ "pleroma" ]
+    volumes:
+      - /data/pleroma/etc:/etc/pleroma
+      - /data/pleroma/static:/var/lib/pleroma/static
+      - /data/pleroma/uploads:/var/lib/pleroma/uploads
+  tags: [ docker, pleroma ]

playbooks/web.yml

@@ -15,60 +15,25 @@
       restart_policy: unless-stopped
       pull: yes
   tasks:
+    - name: include tasks for apps
+      include_tasks: tasks/app/{{ task }}
+      with_items:
+        - gulagbot.yml
+      loop_control:
+        loop_var: task
+      tags: [ always ]
+    - name: include tasks for web services
+      include_tasks: tasks/web/{{ task }}
+      with_items:
+        - 9iron.yml
+        - desultd.yml
+        - gitea.yml
+      loop_control:
+        loop_var: task
+      tags: [ always ]
     - name: configure nextcloud cronjob
       cron: user=www-data name=nextcloud minute=*/5 job="php -f /var/www/nc.desu.ltd/cron.php"
       tags: [ nextcloud, cron ]
-    - name: docker deploy 9iron
-      docker_container:
-        name: 9iron
-        image: rehashedsalt/9iron:latest
-        ports:
-          - 8001:80
-        volumes:
-          - /data/9iron/files:/var/www/html/files
-          - /data/9iron/packs:/var/www/html/minecraft/packs
-      tags: [ docker, 9iron ]
-    - name: docker deploy desultd
-      docker_container:
-        name: desultd
-        image: rehashedsalt/desultd:latest
-        ports:
-          - 8002:80
-        volumes:
-          - /data/9iron/files:/var/www/html/files
-      tags: [ docker, 9iron ]
-    - name: docker deploy gitea
-      docker_container:
-        name: gitea
-        image: gitea/gitea:1
-        env:
-          USER_UID: "1002"
-          USER_GID: "1002"
-          GITEA__database_DB_TYPE: postgres
-          GITEA__database_HOST: 192.168.164.156:5432
-          GITEA__database_NAME: gitea-desultd
-          GITEA__database_USER: gitea-desultd
-          GITEA__database_PASSWD: "{{ secret_gitea_db_pass }}"
-        ports:
-          - 3000:3000
-          - 127.0.0.1:2222:22
-        volumes:
-          - /data/gitea/data:/data
-          - /etc/timezone:/etc/timezone:ro
-          - /etc/localtime:/etc/localtime:ro
-          - /var/lib/gitea/.ssh:/data/git/.ssh
-      tags: [ docker, gitea ]
-    - name: docker deploy gulagbot
-      docker_container:
-        name: gulagbot
-        image: rehashedsalt/gulagbot:latest
-        env:
-          DISCORD_TOKEN: "{{ secret_gulagbot_discord_token }}"
-          PGHOST: 192.168.164.156
-          PGDATABASE: gulagbot-desultd
-          PGUSER: gulagbot-desultd
-          PGPASSWORD: "{{ secret_gulagbot_db_pass }}"
-      tags: [ docker, gulagbot, stalin ]
   roles:
     - role: backup
       vars:
@@ -82,15 +47,6 @@
           - /var/lib/gitea/log
           - /data/gitea/data/gitea/log
       tags: [ backup ]
-    - role: motd
-      vars:
-        motd_watch_services_extra:
-          - apache2
-          - docker
-          - php7.4-fpm
-      tags: [ motd ]
-    - role: docker
-      tags: [ web, docker, skip-pull ]
     - role: certbot
       tags: [ web, certbot ]
     - role: php
@@ -147,84 +103,28 @@
             }
           }
       tags: [ docker, ingress ]
-    - name: docker deploy pleroma
-      docker_container:
-        name: pleroma
-        image: jordemort/pleroma
-        env:
-          TZ: "America/Chicago"
-          POSTGRES_HOST: 192.168.164.156
-          POSTGRES_DB: pleroma_cowfee
-          POSTGRES_USER: pleroma-cowfee
-          POSTGRES_PASSWORD: "{{ secret_pleroma_9iron_db_pass }}"
-        networks:
-          - name: web
-            aliases: [ "pleroma" ]
-        volumes:
-          - /data/pleroma/etc:/etc/pleroma
-          - /data/pleroma/static:/var/lib/pleroma/static
-          - /data/pleroma/uploads:/var/lib/pleroma/uploads
-      tags: [ docker, pleroma ]
-    - name: docker deploy redis
-      docker_container:
-        name: redis
-        image: redis:6-alpine
-        networks:
-          - name: web
-            aliases: [ "redis" ]
-      tags: [ docker, redis ]
-    - name: docker deploy peertube
-      docker_container:
-        name: peertube
-        image: chocobozzz/peertube:production-buster
-        env:
-          POSTGRES_DB: peertube_cowfee
-          PEERTUBE_DB: peertube_cowfee
-          PEERTUBE_DB_USERNAME: peertube-cowfee
-          PEERTUBE_DB_PASSWORD: "{{ secret_peertube_db_pass }}"
-          PEERTUBE_DB_HOSTNAME: 192.168.164.156
-          PEERTUBE_ADMIN_EMAIL: rehashedsalt@cock.li
-          PEERTUBE_WEBSERVER_HOSTNAME: tube.cowfee.moe
-          PEERTUBE_TRUST_PROXY: '["127.0.0.0/16", "192.168.0.0/16", "172.16.0.0/12", "10.0.0.0/8"]'
-        networks:
-          - name: web
-            aliases: [ "peertube" ]
-        ports:
-          - "1935:1935"
-        volumes:
-          - /data/peertube/data:/data
-          - /data/peertube/config:/config
-      tags: [ docker, peertube ]
-    - name: docker deploy nginx proxy
-      docker_container:
-        name: ingress
-        image: jonasal/nginx-certbot:2.2.0
-        env:
-          TZ: "America/Chicago"
-          CERTBOT_EMAIL: rehashedsalt@cock.li
-        networks:
-          - name: web
-            aliases: [ "ingress" ]
-        ports:
-          - "443:443"
-          - "80:80"
-        volumes:
-          - /data/nginx-certbot/letsencrypt:/etc/letsencrypt
-          - /data/nginx-certbot/user_conf.d:/etc/nginx/user_conf.d:ro
-      tags: [ docker, ingress ]
+    - name: include tasks for apps
+      include_tasks: tasks/app/{{ task }}
+      with_items:
+        - redis.yml
+      loop_control:
+        loop_var: task
+      tags: [ always ]
+    - name: include tasks for web services
+      include_tasks: tasks/web/{{ task }}
+      with_items:
+        - peertube.yml
+        - pleroma.yml
+        - ingress-generic.yml
+      loop_control:
+        loop_var: task
+      tags: [ always ]
   roles:
     - role: backup
       vars:
         backup_s3backup_list_extra:
           - /data
       tags: [ backup ]
-    - role: motd
-      vars:
-        motd_watch_services_extra:
-          - docker
-      tags: [ motd ]
-    - role: docker
-      tags: [ web, docker, skip-pull ]
 - hosts: web3.desu.ltd
   module_defaults:
     docker_container:
@@ -254,63 +154,23 @@
             }
           }
       tags: [ docker, ingress ]
-    - name: docker deploy redis
-      docker_container:
-        name: redis
-        image: redis:6-alpine
-        networks:
-          - name: web
-            aliases: [ "redis" ]
-      tags: [ docker, redis ]
-    - name: docker deploy netbox
-      docker_container:
-        name: netbox
-        image: netboxcommunity/netbox:latest
-        env:
-          SUPERUSER_EMAIL: rehashedsalt@cock.li
-          SUPERUSER_PASSWORD: "{{ secret_netbox_user_pass }}"
-          SUPERUSER_API_TOKEN: "{{ secret_netbox_api_token }}"
-          SECRET_KEY: "{{ secret_netbox_secret_key }}"
-          ALLOWED_HOST: netbox.desu.ltd
-          DB_HOST: 192.168.164.156
-          DB_NAME: netbox-desultd
-          DB_USER: netbox-desultd
-          DB_PASSWORD: "{{ secret_netbox_db_pass }}"
-          REDIS_HOST: redis
-          REDIS_PORT: "6379"
-        networks:
-          - name: web
-            aliases: [ "netbox" ]
-        volumes:
-          - /data/netbox/config:/config
-      tags: [ docker, netbox ]
-    - name: docker deploy nginx proxy
-      docker_container:
-        name: ingress
-        image: jonasal/nginx-certbot:2.2.0
-        env:
-          TZ: "America/Chicago"
-          CERTBOT_EMAIL: rehashedsalt@cock.li
-        networks:
-          - name: web
-            aliases: [ "ingress" ]
-        ports:
-          - "443:443"
-          - "80:80"
-        volumes:
-          - /data/nginx-certbot/letsencrypt:/etc/letsencrypt
-          - /data/nginx-certbot/user_conf.d:/etc/nginx/user_conf.d:ro
-      tags: [ docker, ingress ]
+    - name: include tasks for apps
+      include_tasks: tasks/app/{{ task }}
+      with_items:
+        - redis.yml
+      loop_control:
+        loop_var: task
+      tags: [ always ]
+    - name: include tasks for web services
+      include_tasks: tasks/web/{{ task }}
+      with_items:
+        - netbox.yml
+      loop_control:
+        loop_var: task
+      tags: [ always ]
   roles:
     - role: backup
       vars:
         backup_s3backup_list_extra:
           - /data
       tags: [ backup ]
-    - role: motd
-      vars:
-        motd_watch_services_extra:
-          - docker
-      tags: [ motd ]
-    - role: docker
-      tags: [ web, docker, skip-pull ]

site.yml

@@ -8,6 +8,17 @@
       tags: [ common ]
     - role: adminuser
       tags: [ adminuser, common ]
+    - role: docker
+      tags: [ docker, common, skip-pull ]
+    - role: motd
+      vars:
+        motd_watch_services_extra:
+          - apache2
+          - docker
+          - kubelet
+          - php7.4-fpm
+          - postgresql
+      tags: [ motd, common ]
     - role: sshd
       vars:
         sshd: