11 changed files with 169 additions and 230 deletions
--- a/inventory/hosts.yml
+++ b/inventory/hosts.yml
@ -3,23 +3,19 @@ all:
  vars:
    ansible_user: ansible
  children:
-    desultd:
-      vars:
-        ansible_become: yes
-      children:
-        desktop:
-          hosts:
-            #vm-rice-0:
-            #  ansible_host: 192.168.122.14
-            #dsk-cstm-0.desu.ltd:
-            lap-s76-lemp9-0.desu.ltd:
-        db:
-          hosts:
-            psql1.9iron.club:
-            psql1.desu.ltd:
-        web:
-          hosts:
-            web1.desu.ltd:
-        game:
-          hosts:
-            game1.thefuck.how:
+    desktop:
+      hosts:
+        #vm-rice-0:
+        #  ansible_host: 192.168.122.14
+        #dsk-cstm-0.desu.ltd:
+        lap-s76-lemp9-0.desu.ltd:
+    db:
+      hosts:
+        psql1.9iron.club:
+        psql1.desu.ltd:
+    web:
+      hosts:
+        web1.desu.ltd:
+    game:
+      hosts:
+        game1.thefuck.how:
--- a/playbooks/db.yml
+++ b/playbooks/db.yml
@ -7,11 +7,13 @@
    - role: backup
      vars:
        backup_script: s3pgdump
+      become: yes
      tags: [ backup ]
    - role: motd
      vars:
        motd_watch_services_extra:
          - postgresql
+      become: yes
      tags: [ motd ]
    - role: postgresql
      vars:
@ -35,17 +37,20 @@
            owner: gitea-desultd
          - name: nextcloud-desultd
            owner: nextcloud-desultd
+      become: yes
      tags: [ db, psql ]
 - hosts: psql1.9iron.club
  roles:
    - role: backup
      vars:
        backup_script: s3pgdump
+      become: yes
      tags: [ backup ]
    - role: motd
      vars:
        motd_watch_services_extra:
          - postgresql
+      become: yes
      tags: [ motd ]
    - role: postgresql
      vars:
@ -81,4 +86,5 @@
            lc_collate: C
            lc_ctype: C
            owner: matrix
+      become: yes
      tags: [ db, psql ]
--- a/playbooks/desktop.yml
+++ b/playbooks/desktop.yml
@ -9,12 +9,14 @@
        path: /etc/mono/config
        insertafter: "<configuration>"
        line: '<dllmap dll="lzo2.dll" target="liblzo2.so.2" os="!windows"/>'
+      become: yes
      tags: [ desktop, mono ]
    - name: give python3 cap_sys_ptrace
      capabilities:
        path: /usr/bin/python3.8
        # Required for Randovania to access Dolphin memory
        capability: cap_sys_ptrace=eip
+      become: yes
      tags: [ desktop, python, cap ]
  roles:
    - role: backup
@ -22,20 +24,27 @@
        backup_s3backup_tar_args_extra: h
        backup_s3backup_list_extra:
          - /home/salt/.backup/
+      become: yes
      tags: [ backup ]
    - role: motd
+      become: yes
      tags: [ motd ]
    - role: desktop
+      become: yes
      tags: [ desktop ]
    - role: grub
+      become: yes
      tags: [ desktop, grub ]
    - role: udev
      vars:
        udev_rules:
            # Switch RCM stuff
          - SUBSYSTEM=="usb", ATTR{idVendor}=="0955", MODE="0664", GROUP="plugdev"
+      become: yes
      tags: [ desktop, udev ]
    - role: pulseaudio
+      become: yes
      tags: [ desktop, pulse, pulseaudio ]
    - role: zerotier
+      become: yes
      tags: [ desktop, zerotier ]
--- a/playbooks/game.yml
+++ b/playbooks/game.yml
@ -15,6 +15,7 @@
          - /opt/minecraft/dammit/backups
          - /opt/minecraft/valhelsia/backups
          - /opt/minecraft/vanilla/backups
+      become: yes
      tags: [ backup ]
    - role: motd
      vars:
@ -22,6 +23,7 @@
          - minecraft@dammit
          - minecraft@valhelsia
          - minecraft@vanilla
+      become: yes
      tags: [ motd ]
    - role: minecraft
      vars:
@ -47,6 +49,7 @@
          - "https://media.forgecdn.net/files/3113/275/industrial-foregoing-1.16.4-3.2.2-daea863.jar"
        minecraft_forge_mods_remove:
          - industrial-foregoing-1.16.3-3.1.1-a834e76.jar
+      become: yes
      tags: [ game, minecraft, forge, valhelsia ]
    - role: factorio
      vars:
@ -62,6 +65,7 @@
            public: false
            lan: false
          admins: [ "rehashed_salt" ]
+      become: yes
      tags: [ game, factorio ]
 - hosts: game1.thefuck.how
  roles:
@ -84,6 +88,7 @@
          - opt: view-distance
            value: 12
        minecraft_paper_install: yes
+      become: yes
      tags: [ game, minecraft, paper, vanilla ]
 - hosts: game1.thefuck.how
  roles:
@ -120,4 +125,5 @@
          - Stellar+API-0.1.3.8.jar
          - Stellar+Sky-0.1.5.7.jar
          - World-Tooltips-1.7.10-1.2.3-79.jar
+      become: yes
      tags: [ game, minecraft, forge, dammit ]
--- a/playbooks/vars/apache.yml
+++ b/playbooks/vars/apache.yml
@ -1,21 +0,0 @@
-# vim:ft=ansible:
-apache_remove_default_vhost: yes
-apache_packages_state: latest
-apache_mods_enabled:
-  - headers.load
-  - http2.load
-  - mpm_worker.load
-  - proxy.load
-  - proxy_fcgi.load
-  - proxy_http.load
-  - rewrite.load
-  - ssl.load
-apache_mods_disabled:
-  - mpm_prefork.load
-  - php7.4.load
-apache_global_vhost_settings: |
-  DirectoryIndex index.php index.html
-  Protocols h2 http/1.1
-  <FilesMatch \.php$>
-  SetHandler "proxy:fcgi://127.0.0.1:9000"
-  </FilesMatch>
--- a/playbooks/vars/desultd-apache.yml
+++ b/playbooks/vars/desultd-apache.yml
@ -1,71 +0,0 @@
-# vim:ft=ansible:
-apache_global_vhost_settings: |
-  DirectoryIndex index.php index.html
-  Protocols h2 http/1.1
-  <FilesMatch \.php$>
-  SetHandler "proxy:fcgi://127.0.0.1:9000"
-  </FilesMatch>
-apache_vhosts:
-  # desu.ltd
-  - servername: desu.ltd
-    extra_parameters: |
-      Redirect permanent / https://desu.ltd/
-  - servername: git.desu.ltd
-    extra_parameters: |
-      Redirect permanent / https://git.desu.ltd/
-  - servername: nc.desu.ltd
-    extra_parameters: |
-      Redirect permanent / https://nc.desu.ltd/
-      # 9iron.club
-  - servername: 9iron.club
-    extra_parameters: |
-      Redirect permanent / https://www.9iron.club/
-  - servername: www.9iron.club
-    extra_parameters: |
-      Redirect permanent / https://www.9iron.club/
-apache_vhosts_ssl:
-  # desu.ltd
-  - servername: desu.ltd
-    documentroot: /var/www/desu.ltd
-    certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
-    certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
-    certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
-  - servername: git.desu.ltd
-    extra_parameters: |
-      ProxyPreserveHost On
-      ProxyRequests Off
-      ProxyPass / http://127.0.0.1:3000/ nocanon retry=1
-    certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
-    certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
-    certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
-  - servername: nc.desu.ltd
-    extra_parameters: |
-      Header always set Strict-Transport-Security "max-age=31536000"
-    documentroot: /var/www/nc.desu.ltd
-    certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
-    certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
-    certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
-    # 9iron.club
-  - servername: 9iron.club
-    extra_parameters: |
-      Redirect permanent / https://www.9iron.club/
-    certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
-    certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
-    certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
-  - servername: www.9iron.club
-    documentroot: /var/www/www.9iron.club
-    certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
-    certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
-    certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
-    # otwstudios.org
-  - servername: otwstudios.org
-    extra_parameters: |
-      Redirect permanent / https://www.otwstudios.org/
-    certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
-    certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
-    certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
-  - servername: www.otwstudios.org
-    documentroot: /var/www/www.otwstudios.org
-    certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
-    certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
-    certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
--- a/playbooks/vars/desultd-certbot.yml
+++ b/playbooks/vars/desultd-certbot.yml
@ -1,15 +0,0 @@
-# vim:ft=ansible:
-certbot_admin_email: rehashedsalt@cock.li
-certbot_create_if_missing: yes
-certbot_create_method: standalone
-certbot_create_standalone_stop_services:
-  - apache2
-certbot_certs:
-  - domains:
-    - desu.ltd
-    - git.desu.ltd
-    - nc.desu.ltd
-    - web1.desu.ltd
-    - 9iron.club
-    - www.9iron.club
-    - otwstudios.org
--- a/playbooks/vars/desultd-nextcloud.yml
+++ b/playbooks/vars/desultd-nextcloud.yml
@ -1,20 +0,0 @@
-# vim:ft=ansible:
-nextcloud_installation_dir: /var/www/nc.desu.ltd
-nextcloud_data_dir: /srv/desu.ltd/nc
-nextcloud_admin_user: admin
-nextcloud_admin_pass: "{{ secret_nextcloud_admin_pass }}"
-nextcloud_version: 19
-nextcloud_urls:
-  - http://nc.desu.ltd:80
-  - https://nc.desu.ltd:443
-nextcloud_config:
-  system:
-    trusted_domains:
-      "{{ nextcloud_urls | map('urlsplit', 'hostname') | list }}"
-nextcloud_database:
-  backend: pgsql
-  name: nextcloud-desultd
-  user: nextcloud-desultd
-  pass: "{{ secret_nextcloud_db_pass }}"
-  host: 192.168.164.156
-  port: 5432
--- a/playbooks/vars/php-fpm.yml
+++ b/playbooks/vars/php-fpm.yml
@ -1,18 +0,0 @@
-#!/usr/bin/env ansible-playbook
-# vim:ft=ansible:
-# Defaults for a simple php-fpm setup
-php_enable_php_fpm: yes
-php_memory_limit: 512M
-php_packages_extra:
-  - libapache2-mod-php
-  - php-zip # For Nextcloud
-  - php-intl
-  - php-imagick
-  - php-redis
-  - php-bcmath
-  - php-gmp
-  - php-pgsql # For general DB stuff
-# Nextcloud recommended opcache settings
-php_opcache_max_accelerated_files: 10000
-php_opcache_memory_consumption: 128
-php_opcache_revalidate_freq: 2
--- a/playbooks/web.yml
+++ b/playbooks/web.yml
@ -6,13 +6,8 @@
  tasks:
    - name: configure nextcloud cronjob
      cron: user=www-data name=nextcloud minute=*/5 job="php -f /var/www/nc.desu.ltd/cron.php"
+      become: yes
      tags: [ nextcloud, cron ]
-  vars_files:
-    - vars/apache.yml
-    - vars/php-fpm.yml
-    - vars/desultd-apache.yml
-    - vars/desultd-certbot.yml
-    - vars/desultd-nextcloud.yml
  roles:
    - role: backup
      vars:
@ -23,55 +18,16 @@
          - /srv/desu.ltd
        backup_s3backup_exclude_list_extra:
          - /var/lib/gitea/log
+      become: yes
      tags: [ backup ]
    - role: motd
+      become: yes
      vars:
        motd_watch_services_extra:
          - apache2
          - gitea
          - php7.4-fpm
      tags: [ motd ]
-    - role: certbot
-      tags: [ web, certbot ]
-    - role: php
-      tags: [ web, php ]
-    - role: apache
-      tags: [ web, apache ]
-    - role: git
-      vars:
-        git_repos:
-          - repo: https://git.desu.ltd/salt/desultd
-            dest: /var/www/desu.ltd
-          - repo: https://git.desu.ltd/salt/9iron
-            dest: /var/www/www.9iron.club
-          - repo: https://git.desu.ltd/salt/gitea-custom
-            dest: /usr/local/bin/custom
-      tags: [ web, git ]
-    - role: nextcloud
-      tags: [ web, nextcloud ]
-    - role: gitea
-      vars:
-        # Look and feel
-        gitea_app_name: "Git Desu"
-        # Core config
-        gitea_db_type: postgres
-        gitea_db_host: 192.168.164.156:5432
-        gitea_db_name: gitea-desultd
-        gitea_db_user: gitea-desultd
-        gitea_db_password: "{{ secret_gitea_db_pass }}"
-        gitea_http_domain: git.desu.ltd
-        gitea_oauth2_enabled: no
-        gitea_repository_root: /srv/desu.ltd/git
-        gitea_require_signin: no
-        gitea_root_url: https://git.desu.ltd
-        gitea_shell: "/bin/bash"
-        gitea_ssh_domain: git.desu.ltd
-        gitea_ssh_port: 22
-        gitea_start_ssh: no
-        gitea_user: git
-      tags: [ web, gitea ]
- hosts: game1.thefuck.how
-  roles:
    - role: certbot
      vars:
        certbot_admin_email: rehashedsalt@cock.li
@ -81,8 +37,14 @@
          - apache2
        certbot_certs:
          - domains:
-              - thefuck.how
-              - game1.thefuck.how
+              - desu.ltd
+              - git.desu.ltd
+              - nc.desu.ltd
+              - web1.desu.ltd
+              - 9iron.club
+              - www.9iron.club
+              - otwstudios.org
+      become: yes
      tags: [ web, certbot ]
    - role: php
      vars:
@ -90,11 +52,18 @@
        php_memory_limit: 512M
        php_packages_extra:
          - libapache2-mod-php
+          - php-zip # For Nextcloud
          - php-intl
          - php-imagick
          - php-redis
          - php-bcmath
          - php-gmp
+          - php-pgsql # For general DB stuff
+        # Nextcloud recommended opcache settings
+        php_opcache_max_accelerated_files: 10000
+        php_opcache_memory_consumption: 128
+        php_opcache_revalidate_freq: 2
+      become: yes
      tags: [ web, php ]
    - role: apache
      vars:
@ -119,28 +88,124 @@
            SetHandler "proxy:fcgi://127.0.0.1:9000"
          </FilesMatch>
        apache_vhosts:
-          - servername: thefuck.how
+            # desu.ltd
+          - servername: desu.ltd
            extra_parameters: |
-              Redirect permanent / https://thefuck.how/
-          - servername: game1.thefuck.how
+              Redirect permanent / https://desu.ltd/
+          - servername: git.desu.ltd
            extra_parameters: |
-              Redirect permanent / https://thefuck.how/
+              Redirect permanent / https://git.desu.ltd/
+          - servername: nc.desu.ltd
+            extra_parameters: |
+              Redirect permanent / https://nc.desu.ltd/
+            # 9iron.club
+          - servername: 9iron.club
+            extra_parameters: |
+              Redirect permanent / https://www.9iron.club/
+          - servername: www.9iron.club
+            extra_parameters: |
+              Redirect permanent / https://www.9iron.club/
        apache_vhosts_ssl:
-          - servername: thefuck.how
-            documentroot: /var/www/thefuck.how
-            certificate_file: /etc/letsencrypt/live/thefuck.how/fullchain.pem
-            certificate_key_file: /etc/letsencrypt/live/thefuck.how/privkey.pem
-            certificate_chain_file: /etc/letsencrypt/live/thefuck.how/chain.pem
-          - servername: game1.thefuck.how
+            # desu.ltd
+          - servername: desu.ltd
+            documentroot: /var/www/desu.ltd
+            certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
+            certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
+            certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
+          - servername: git.desu.ltd
            extra_parameters: |
-              Redirect permanent / https://thefuck.how/
-            certificate_file: /etc/letsencrypt/live/thefuck.how/fullchain.pem
-            certificate_key_file: /etc/letsencrypt/live/thefuck.how/privkey.pem
-            certificate_chain_file: /etc/letsencrypt/live/thefuck.how/chain.pem
+              ProxyPreserveHost On
+              ProxyRequests Off
+              ProxyPass / http://127.0.0.1:3000/ nocanon retry=1
+            certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
+            certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
+            certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
+          - servername: nc.desu.ltd
+            extra_parameters: |
+              Header always set Strict-Transport-Security "max-age=31536000"
+            documentroot: /var/www/nc.desu.ltd
+            certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
+            certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
+            certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
+            # 9iron.club
+          - servername: 9iron.club
+            extra_parameters: |
+              Redirect permanent / https://www.9iron.club/
+            certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
+            certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
+            certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
+          - servername: www.9iron.club
+            documentroot: /var/www/www.9iron.club
+            certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
+            certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
+            certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
+            # otwstudios.org
+          - servername: otwstudios.org
+            extra_parameters: |
+              Redirect permanent / https://www.otwstudios.org/
+            certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
+            certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
+            certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
+          - servername: www.otwstudios.org
+            documentroot: /var/www/www.otwstudios.org
+            certificate_file: /etc/letsencrypt/live/desu.ltd/fullchain.pem
+            certificate_key_file: /etc/letsencrypt/live/desu.ltd/privkey.pem
+            certificate_chain_file: /etc/letsencrypt/live/desu.ltd/chain.pem
+      become: yes
      tags: [ web, apache ]
    - role: git
      vars:
        git_repos:
-          - repo: https://git.desu.ltd/salt/thefuckhow
-            dest: /var/www/thefuck.how
+          - repo: https://git.desu.ltd/salt/desultd
+            dest: /var/www/desu.ltd
+          - repo: https://git.desu.ltd/salt/9iron
+            dest: /var/www/www.9iron.club
+          - repo: https://git.desu.ltd/salt/gitea-custom
+            dest: /usr/local/bin/custom
+      become: yes
      tags: [ web, git ]
+    - role: nextcloud
+      vars:
+        nextcloud_installation_dir: /var/www/nc.desu.ltd
+        nextcloud_data_dir: /srv/desu.ltd/nc
+        nextcloud_admin_user: admin
+        nextcloud_admin_pass: "{{ secret_nextcloud_admin_pass }}"
+        nextcloud_version: 19
+        nextcloud_urls:
+          - http://nc.desu.ltd:80
+          - https://nc.desu.ltd:443
+        nextcloud_config:
+          system:
+            trusted_domains:
+              "{{ nextcloud_urls | map('urlsplit', 'hostname') | list }}"
+        nextcloud_database:
+          backend: pgsql
+          name: nextcloud-desultd
+          user: nextcloud-desultd
+          pass: "{{ secret_nextcloud_db_pass }}"
+          host: 192.168.164.156
+          port: 5432
+      become: yes
+      tags: [ web, nextcloud ]
+    - role: gitea
+      vars:
+        # Look and feel
+        gitea_app_name: "Git Desu"
+        # Core config
+        gitea_db_type: postgres
+        gitea_db_host: 192.168.164.156:5432
+        gitea_db_name: gitea-desultd
+        gitea_db_user: gitea-desultd
+        gitea_db_password: "{{ secret_gitea_db_pass }}"
+        gitea_http_domain: git.desu.ltd
+        gitea_oauth2_enabled: no
+        gitea_repository_root: /srv/desu.ltd/git
+        gitea_require_signin: no
+        gitea_root_url: https://git.desu.ltd
+        gitea_shell: "/bin/bash"
+        gitea_ssh_domain: git.desu.ltd
+        gitea_ssh_port: 22
+        gitea_start_ssh: no
+        gitea_user: git
+      become: yes
+      tags: [ web, gitea ]
--- a/site.yml
+++ b/site.yml
@ -5,8 +5,10 @@
 - hosts: all
  roles:
    - role: common
+      become: yes
      tags: [ common ]
    - role: ansible-pull
+      become: yes
      tags: [ ansible, common ]
  # Import specific playbooks
 - import_playbook: playbooks/db.yml