Compare commits

...

4 Commits

Author SHA1 Message Date
e1ed70b055 Reorganize inventory
This fixes an issue with localhost always becoming during one task which is delegated to localhost that explicitly specifes 'become: false'. Thanks, Ansible.
2021-01-18 05:18:39 -06:00
2febec023f Fix perms on playbook vars 2021-01-18 05:09:40 -06:00
dbc9f7d6ae Always become 2021-01-18 05:08:43 -06:00
e59f9ce63e Move a bunch of webhead variables to their own vars files 2021-01-18 05:03:46 -06:00
11 changed files with 230 additions and 169 deletions

View File

@ -2,6 +2,10 @@
all:
vars:
ansible_user: ansible
children:
desultd:
vars:
ansible_become: yes
children:
desktop:
hosts:

View File

@ -7,13 +7,11 @@
- role: backup
vars:
backup_script: s3pgdump
become: yes
tags: [ backup ]
- role: motd
vars:
motd_watch_services_extra:
- postgresql
become: yes
tags: [ motd ]
- role: postgresql
vars:
@ -37,20 +35,17 @@
owner: gitea-desultd
- name: nextcloud-desultd
owner: nextcloud-desultd
become: yes
tags: [ db, psql ]
- hosts: psql1.9iron.club
roles:
- role: backup
vars:
backup_script: s3pgdump
become: yes
tags: [ backup ]
- role: motd
vars:
motd_watch_services_extra:
- postgresql
become: yes
tags: [ motd ]
- role: postgresql
vars:
@ -86,5 +81,4 @@
lc_collate: C
lc_ctype: C
owner: matrix
become: yes
tags: [ db, psql ]

View File

@ -9,14 +9,12 @@
path: /etc/mono/config
insertafter: "<configuration>"
line: '<dllmap dll="lzo2.dll" target="liblzo2.so.2" os="!windows"/>'
become: yes
tags: [ desktop, mono ]
- name: give python3 cap_sys_ptrace
capabilities:
path: /usr/bin/python3.8
# Required for Randovania to access Dolphin memory
capability: cap_sys_ptrace=eip
become: yes
tags: [ desktop, python, cap ]
roles:
- role: backup
@ -24,27 +22,20 @@
backup_s3backup_tar_args_extra: h
backup_s3backup_list_extra:
- /home/salt/.backup/
become: yes
tags: [ backup ]
- role: motd
become: yes
tags: [ motd ]
- role: desktop
become: yes
tags: [ desktop ]
- role: grub
become: yes
tags: [ desktop, grub ]
- role: udev
vars:
udev_rules:
# Switch RCM stuff
- SUBSYSTEM=="usb", ATTR{idVendor}=="0955", MODE="0664", GROUP="plugdev"
become: yes
tags: [ desktop, udev ]
- role: pulseaudio
become: yes
tags: [ desktop, pulse, pulseaudio ]
- role: zerotier
become: yes
tags: [ desktop, zerotier ]

View File

@ -15,7 +15,6 @@
- /opt/minecraft/dammit/backups
- /opt/minecraft/valhelsia/backups
- /opt/minecraft/vanilla/backups
become: yes
tags: [ backup ]
- role: motd
vars:
@ -23,7 +22,6 @@
- minecraft@dammit
- minecraft@valhelsia
- minecraft@vanilla
become: yes
tags: [ motd ]
- role: minecraft
vars:
@ -49,7 +47,6 @@
- "https://media.forgecdn.net/files/3113/275/industrial-foregoing-1.16.4-3.2.2-daea863.jar"
minecraft_forge_mods_remove:
- industrial-foregoing-1.16.3-3.1.1-a834e76.jar
become: yes
tags: [ game, minecraft, forge, valhelsia ]
- role: factorio
vars:
@ -65,7 +62,6 @@
public: false
lan: false
admins: [ "rehashed_salt" ]
become: yes
tags: [ game, factorio ]
- hosts: game1.thefuck.how
roles:
@ -88,7 +84,6 @@
- opt: view-distance
value: 12
minecraft_paper_install: yes
become: yes
tags: [ game, minecraft, paper, vanilla ]
- hosts: game1.thefuck.how
roles:
@ -125,5 +120,4 @@
- Stellar+API-0.1.3.8.jar
- Stellar+Sky-0.1.5.7.jar
- World-Tooltips-1.7.10-1.2.3-79.jar
become: yes
tags: [ game, minecraft, forge, dammit ]

21
playbooks/vars/apache.yml Normal file
View File

@ -0,0 +1,21 @@
# vim:ft=ansible:
apache_remove_default_vhost: yes
apache_packages_state: latest
apache_mods_enabled:
- headers.load
- http2.load
- mpm_worker.load
- proxy.load
- proxy_fcgi.load
- proxy_http.load
- rewrite.load
- ssl.load
apache_mods_disabled:
- mpm_prefork.load
- php7.4.load
apache_global_vhost_settings: |
DirectoryIndex index.php index.html
Protocols h2 http/1.1
<FilesMatch \.php$>
SetHandler "proxy:fcgi://127.0.0.1:9000"
</FilesMatch>

View File

@ -0,0 +1,71 @@
# vim:ft=ansible:
apache_global_vhost_settings: |
DirectoryIndex index.php index.html
Protocols h2 http/1.1
<FilesMatch \.php$>
SetHandler "proxy:fcgi://127.0.0.1:9000"
</FilesMatch>
apache_vhosts:
# desu.ltd
- servername: desu.ltd
extra_parameters: |
Redirect permanent / https://desu.ltd/
- servername: git.desu.ltd
extra_parameters: |
Redirect permanent / https://git.desu.ltd/
- servername: nc.desu.ltd
extra_parameters: |
Redirect permanent / https://nc.desu.ltd/
# 9iron.club
- servername: 9iron.club
extra_parameters: |
Redirect permanent / https://www.9iron.club/
- servername: www.9iron.club
extra_parameters: |
Redirect permanent / https://www.9iron.club/
apache_vhosts_ssl:
# desu.ltd
- servername: desu.ltd
documentroot: /var/www/desu.ltd
certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
- servername: git.desu.ltd
extra_parameters: |
ProxyPreserveHost On
ProxyRequests Off
ProxyPass / http://127.0.0.1:3000/ nocanon retry=1
certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
- servername: nc.desu.ltd
extra_parameters: |
Header always set Strict-Transport-Security "max-age=31536000"
documentroot: /var/www/nc.desu.ltd
certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
# 9iron.club
- servername: 9iron.club
extra_parameters: |
Redirect permanent / https://www.9iron.club/
certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
- servername: www.9iron.club
documentroot: /var/www/www.9iron.club
certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
# otwstudios.org
- servername: otwstudios.org
extra_parameters: |
Redirect permanent / https://www.otwstudios.org/
certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
- servername: www.otwstudios.org
documentroot: /var/www/www.otwstudios.org
certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem

View File

@ -0,0 +1,15 @@
# vim:ft=ansible:
certbot_admin_email: rehashedsalt@cock.li
certbot_create_if_missing: yes
certbot_create_method: standalone
certbot_create_standalone_stop_services:
- apache2
certbot_certs:
- domains:
- desu.ltd
- git.desu.ltd
- nc.desu.ltd
- web1.desu.ltd
- 9iron.club
- www.9iron.club
- otwstudios.org

View File

@ -0,0 +1,20 @@
# vim:ft=ansible:
nextcloud_installation_dir: /var/www/nc.desu.ltd
nextcloud_data_dir: /srv/desu.ltd/nc
nextcloud_admin_user: admin
nextcloud_admin_pass: "{{ secret_nextcloud_admin_pass }}"
nextcloud_version: 19
nextcloud_urls:
- http://nc.desu.ltd:80
- https://nc.desu.ltd:443
nextcloud_config:
system:
trusted_domains:
"{{ nextcloud_urls | map('urlsplit', 'hostname') | list }}"
nextcloud_database:
backend: pgsql
name: nextcloud-desultd
user: nextcloud-desultd
pass: "{{ secret_nextcloud_db_pass }}"
host: 192.168.164.156
port: 5432

View File

@ -0,0 +1,18 @@
#!/usr/bin/env ansible-playbook
# vim:ft=ansible:
# Defaults for a simple php-fpm setup
php_enable_php_fpm: yes
php_memory_limit: 512M
php_packages_extra:
- libapache2-mod-php
- php-zip # For Nextcloud
- php-intl
- php-imagick
- php-redis
- php-bcmath
- php-gmp
- php-pgsql # For general DB stuff
# Nextcloud recommended opcache settings
php_opcache_max_accelerated_files: 10000
php_opcache_memory_consumption: 128
php_opcache_revalidate_freq: 2

View File

@ -6,8 +6,13 @@
tasks:
- name: configure nextcloud cronjob
cron: user=www-data name=nextcloud minute=*/5 job="php -f /var/www/nc.desu.ltd/cron.php"
become: yes
tags: [ nextcloud, cron ]
vars_files:
- vars/apache.yml
- vars/php-fpm.yml
- vars/desultd-apache.yml
- vars/desultd-certbot.yml
- vars/desultd-nextcloud.yml
roles:
- role: backup
vars:
@ -18,16 +23,55 @@
- /srv/desu.ltd
backup_s3backup_exclude_list_extra:
- /var/lib/gitea/log
become: yes
tags: [ backup ]
- role: motd
become: yes
vars:
motd_watch_services_extra:
- apache2
- gitea
- php7.4-fpm
tags: [ motd ]
- role: certbot
tags: [ web, certbot ]
- role: php
tags: [ web, php ]
- role: apache
tags: [ web, apache ]
- role: git
vars:
git_repos:
- repo: https://git.desu.ltd/salt/desultd
dest: /var/www/desu.ltd
- repo: https://git.desu.ltd/salt/9iron
dest: /var/www/www.9iron.club
- repo: https://git.desu.ltd/salt/gitea-custom
dest: /usr/local/bin/custom
tags: [ web, git ]
- role: nextcloud
tags: [ web, nextcloud ]
- role: gitea
vars:
# Look and feel
gitea_app_name: "Git Desu"
# Core config
gitea_db_type: postgres
gitea_db_host: 192.168.164.156:5432
gitea_db_name: gitea-desultd
gitea_db_user: gitea-desultd
gitea_db_password: "{{ secret_gitea_db_pass }}"
gitea_http_domain: git.desu.ltd
gitea_oauth2_enabled: no
gitea_repository_root: /srv/desu.ltd/git
gitea_require_signin: no
gitea_root_url: https://git.desu.ltd
gitea_shell: "/bin/bash"
gitea_ssh_domain: git.desu.ltd
gitea_ssh_port: 22
gitea_start_ssh: no
gitea_user: git
tags: [ web, gitea ]
- hosts: game1.thefuck.how
roles:
- role: certbot
vars:
certbot_admin_email: rehashedsalt@cock.li
@ -37,14 +81,8 @@
- apache2
certbot_certs:
- domains:
- desu.ltd
- git.desu.ltd
- nc.desu.ltd
- web1.desu.ltd
- 9iron.club
- www.9iron.club
- otwstudios.org
become: yes
- thefuck.how
- game1.thefuck.how
tags: [ web, certbot ]
- role: php
vars:
@ -52,18 +90,11 @@
php_memory_limit: 512M
php_packages_extra:
- libapache2-mod-php
- php-zip # For Nextcloud
- php-intl
- php-imagick
- php-redis
- php-bcmath
- php-gmp
- php-pgsql # For general DB stuff
# Nextcloud recommended opcache settings
php_opcache_max_accelerated_files: 10000
php_opcache_memory_consumption: 128
php_opcache_revalidate_freq: 2
become: yes
tags: [ web, php ]
- role: apache
vars:
@ -88,124 +119,28 @@
SetHandler "proxy:fcgi://127.0.0.1:9000"
</FilesMatch>
apache_vhosts:
# desu.ltd
- servername: desu.ltd
- servername: thefuck.how
extra_parameters: |
Redirect permanent / https://desu.ltd/
- servername: git.desu.ltd
Redirect permanent / https://thefuck.how/
- servername: game1.thefuck.how
extra_parameters: |
Redirect permanent / https://git.desu.ltd/
- servername: nc.desu.ltd
extra_parameters: |
Redirect permanent / https://nc.desu.ltd/
# 9iron.club
- servername: 9iron.club
extra_parameters: |
Redirect permanent / https://www.9iron.club/
- servername: www.9iron.club
extra_parameters: |
Redirect permanent / https://www.9iron.club/
Redirect permanent / https://thefuck.how/
apache_vhosts_ssl:
# desu.ltd
- servername: desu.ltd
documentroot: /var/www/desu.ltd
certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
- servername: git.desu.ltd
- servername: thefuck.how
documentroot: /var/www/thefuck.how
certificate_file: /etc/letsencrypt/live/thefuck.how/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/thefuck.how/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/thefuck.how/chain.pem
- servername: game1.thefuck.how
extra_parameters: |
ProxyPreserveHost On
ProxyRequests Off
ProxyPass / http://127.0.0.1:3000/ nocanon retry=1
certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
- servername: nc.desu.ltd
extra_parameters: |
Header always set Strict-Transport-Security "max-age=31536000"
documentroot: /var/www/nc.desu.ltd
certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
# 9iron.club
- servername: 9iron.club
extra_parameters: |
Redirect permanent / https://www.9iron.club/
certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
- servername: www.9iron.club
documentroot: /var/www/www.9iron.club
certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
# otwstudios.org
- servername: otwstudios.org
extra_parameters: |
Redirect permanent / https://www.otwstudios.org/
certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
- servername: www.otwstudios.org
documentroot: /var/www/www.otwstudios.org
certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
become: yes
Redirect permanent / https://thefuck.how/
certificate_file: /etc/letsencrypt/live/thefuck.how/fullchain.pem
certificate_key_file: /etc/letsencrypt/live/thefuck.how/privkey.pem
certificate_chain_file: /etc/letsencrypt/live/thefuck.how/chain.pem
tags: [ web, apache ]
- role: git
vars:
git_repos:
- repo: https://git.desu.ltd/salt/desultd
dest: /var/www/desu.ltd
- repo: https://git.desu.ltd/salt/9iron
dest: /var/www/www.9iron.club
- repo: https://git.desu.ltd/salt/gitea-custom
dest: /usr/local/bin/custom
become: yes
- repo: https://git.desu.ltd/salt/thefuckhow
dest: /var/www/thefuck.how
tags: [ web, git ]
- role: nextcloud
vars:
nextcloud_installation_dir: /var/www/nc.desu.ltd
nextcloud_data_dir: /srv/desu.ltd/nc
nextcloud_admin_user: admin
nextcloud_admin_pass: "{{ secret_nextcloud_admin_pass }}"
nextcloud_version: 19
nextcloud_urls:
- http://nc.desu.ltd:80
- https://nc.desu.ltd:443
nextcloud_config:
system:
trusted_domains:
"{{ nextcloud_urls | map('urlsplit', 'hostname') | list }}"
nextcloud_database:
backend: pgsql
name: nextcloud-desultd
user: nextcloud-desultd
pass: "{{ secret_nextcloud_db_pass }}"
host: 192.168.164.156
port: 5432
become: yes
tags: [ web, nextcloud ]
- role: gitea
vars:
# Look and feel
gitea_app_name: "Git Desu"
# Core config
gitea_db_type: postgres
gitea_db_host: 192.168.164.156:5432
gitea_db_name: gitea-desultd
gitea_db_user: gitea-desultd
gitea_db_password: "{{ secret_gitea_db_pass }}"
gitea_http_domain: git.desu.ltd
gitea_oauth2_enabled: no
gitea_repository_root: /srv/desu.ltd/git
gitea_require_signin: no
gitea_root_url: https://git.desu.ltd
gitea_shell: "/bin/bash"
gitea_ssh_domain: git.desu.ltd
gitea_ssh_port: 22
gitea_start_ssh: no
gitea_user: git
become: yes
tags: [ web, gitea ]

View File

@ -5,10 +5,8 @@
- hosts: all
roles:
- role: common
become: yes
tags: [ common ]
- role: ansible-pull
become: yes
tags: [ ansible, common ]
# Import specific playbooks
- import_playbook: playbooks/db.yml