Update README

Still have a ways to go

README.md

@@ -10,6 +10,8 @@ This branch is kinda-sorta a port of master, so it still needs to reach some for
 
 * Matrix(? Do I still want to keep this around? Is there a better alternative? Will my friends even use it?)
 
+* Port over fedi1 (Requires resolution of the above two issues)
+
 * Monitoring (Doesn't necessarily have to be grafana)
 
 ## Initialization

inventory/hosts.yml

@@ -3,7 +3,7 @@ all:
   vars:
     ansible_user: ansible
   children:
-    desultd:
+    prod:
       vars:
         ansible_become: yes
       children:
@@ -19,6 +19,7 @@ all:
             psql1.desu.ltd:
         web:
           hosts:
+            web1.9iron.club:
             web1.desu.ltd:
         game:
           hosts:

playbooks/vars/9iron-apache.yml

@@ -0,0 +1,30 @@
+# vim:ft=ansible:
+apache_global_vhost_settings: |
+  DirectoryIndex index.php index.html
+  Protocols h2 http/1.1
+  <FilesMatch \.php$>
+  SetHandler "proxy:fcgi://127.0.0.1:9000"
+  </FilesMatch>
+apache_vhosts:
+  - servername: nc.9iron.club
+    extra_parameters: |
+      Redirect permanent / https://nc.9iron.club/
+  - servername: git.9iron.club
+    extra_parameters: |
+      Redirect permanent / https://git.9iron.club/
+apache_vhosts_ssl:
+  - servername: git.9iron.club
+    extra_parameters: |
+      ProxyPreserveHost On
+      ProxyRequests Off
+      ProxyPass / http://127.0.0.1:3000/ nocanon retry=1
+    certificate_file: /etc/letsencrypt/live/nc.9iron.club/fullchain.pem
+    certificate_key_file: /etc/letsencrypt/live/nc.9iron.club/privkey.pem
+    certificate_chain_file: /etc/letsencrypt/live/nc.9iron.club/chain.pem
+  - servername: nc.9iron.club
+    extra_parameters: |
+      Header always set Strict-Transport-Security "max-age=31536000"
+    documentroot: /var/www/nextcloud
+    certificate_file: /etc/letsencrypt/live/nc.9iron.club/fullchain.pem
+    certificate_key_file: /etc/letsencrypt/live/nc.9iron.club/privkey.pem
+    certificate_chain_file: /etc/letsencrypt/live/nc.9iron.club/chain.pem

playbooks/vars/9iron-certbot.yml

@@ -0,0 +1,10 @@
+# vim:ft=ansible:
+certbot_admin_email: rehashedsalt@cock.li
+certbot_create_if_missing: yes
+certbot_create_method: standalone
+certbot_create_standalone_stop_services:
+  - apache2
+certbot_certs:
+  - domains:
+    - nc.9iron.club
+    - git.9iron.club

playbooks/vars/9iron-gitea.yml

@@ -0,0 +1,19 @@
+# vim:ft=ansible:
+# Look and feel
+gitea_app_name: "9iron Gitea"
+# Core config
+gitea_db_type: postgres
+gitea_db_host: 172.31.47.215:5432
+gitea_db_name: gitea
+gitea_db_user: gitea
+gitea_db_password: "{{ secret_gitea_9iron_db_pass }}"
+gitea_http_domain: git.9iron.club
+gitea_oauth2_enabled: no
+gitea_repository_root: /var/gitea
+gitea_require_signin: no
+gitea_root_url: https://git.9iron.club
+gitea_shell: "/bin/bash"
+gitea_ssh_domain: git.9iron.club
+gitea_ssh_port: 22
+gitea_start_ssh: no
+gitea_user: git

playbooks/vars/desultd-gitea.yml

@@ -0,0 +1,19 @@
+# vim:ft=ansible:
+# Look and feel
+gitea_app_name: "Git Desu"
+# Core config
+gitea_db_type: postgres
+gitea_db_host: 192.168.164.156:5432
+gitea_db_name: gitea-desultd
+gitea_db_user: gitea-desultd
+gitea_db_password: "{{ secret_gitea_db_pass }}"
+gitea_http_domain: git.desu.ltd
+gitea_oauth2_enabled: no
+gitea_repository_root: /srv/desu.ltd/git
+gitea_require_signin: no
+gitea_root_url: https://git.desu.ltd
+gitea_shell: "/bin/bash"
+gitea_ssh_domain: git.desu.ltd
+gitea_ssh_port: 22
+gitea_start_ssh: no
+gitea_user: git

playbooks/web.yml

@@ -12,6 +12,7 @@
     - vars/php-fpm.yml
     - vars/desultd-apache.yml
     - vars/desultd-certbot.yml
+    - vars/desultd-gitea.yml
     - vars/desultd-nextcloud.yml
   roles:
     - role: backup
@@ -50,25 +51,67 @@
     - role: nextcloud
       tags: [ web, nextcloud ]
     - role: gitea
+      tags: [ web, gitea ]
+- hosts: web1.9iron.club
+  tasks:
+    - name: configure nextcloud cronjob
+      cron: user=www-data name=nextcloud minute=*/5 job="php -f /var/www/nextcloud/cron.php"
+      tags: [ nextcloud, cron ]
+    - name: register nextcloud efs
+      efs:
+        name: 9iron-gitea
+        region: us-east-2
+        targets:
+          - subnet_id: subnet-852935ed
+            security_groups: [ "sg-4f4b692c" ]
+      register: ncefs
+      tags: [ nextcloud, efs ]
+    - name: mount nextcloud efs
+      mount: path=/var/nextcloud src={{ ncefs.efs.filesystem_address }} fstype=nfs4 opts="nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport" state=mounted
+      tags: [ nextcloud, efs ]
+    - name: register gitea efs
+      efs:
+        name: 9iron-gitea
+        region: us-east-2
+        targets:
+          - subnet_id: subnet-852935ed
+            security_groups: [ "sg-4f4b692c" ]
+      register: gitefs
+      tags: [ gitea, efs ]
+    - name: mount gitea efs
+      mount: path=/var/gitea src={{ gitefs.efs.filesystem_address }} fstype=nfs4 opts="nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport" state=mounted
+      tags: [ gitea, efs ]
+  vars_files:
+    - vars/apache.yml
+    - vars/php-fpm.yml
+    - vars/9iron-apache.yml
+    - vars/9iron-certbot.yml
+    - vars/9iron-gitea.yml
+  roles:
+    - role: backup
       vars:
-        # Look and feel
-        gitea_app_name: "Git Desu"
-        # Core config
-        gitea_db_type: postgres
-        gitea_db_host: 192.168.164.156:5432
-        gitea_db_name: gitea-desultd
-        gitea_db_user: gitea-desultd
-        gitea_db_password: "{{ secret_gitea_db_pass }}"
-        gitea_http_domain: git.desu.ltd
-        gitea_oauth2_enabled: no
-        gitea_repository_root: /srv/desu.ltd/git
-        gitea_require_signin: no
-        gitea_root_url: https://git.desu.ltd
-        gitea_shell: "/bin/bash"
-        gitea_ssh_domain: git.desu.ltd
-        gitea_ssh_port: 22
-        gitea_start_ssh: no
-        gitea_user: git
+        backup_s3backup_list_extra:
+          - /var/gitea
+          - /var/lib/gitea
+          - /var/nextcloud
+          - /var/www/nextcloud
+        backup_s3backup_exclude_list_extra:
+          - /var/lib/gitea/log
+      tags: [ backup ]
+    - role: motd
+      vars:
+        motd_watch_services_extra:
+          - apache2
+          - gitea
+          - php7.4-fpm
+      tags: [ motd ]
+    - role: certbot
+      tags: [ web, certbot ]
+    - role: php
+      tags: [ web, php ]
+    - role: apache
+      tags: [ web, apache ]
+    - role: gitea
       tags: [ web, gitea ]
 - hosts: game1.thefuck.how
   roles: