#!/usr/bin/env ansible-playbook # vim:ft=ansible: --- # Home media storage Pi - hosts: pi-media-1.desu.ltd module_defaults: docker_container: state: started restart_policy: unless-stopped pull: yes tasks: - name: assure mount directory file: path=/data state=directory mode=0755 tags: [ pis, storage ] - name: assure mount mount: path=/data src=LABEL=mass state=mounted fstype=ext4 tags: [ pis, storage ] - name: assure directories in mount file: path=/data/{{ item }} state=directory mode=0755 with_items: - nfs - postgresql tags: [ pis, storage ] - name: assure symlinks to directories in mount file: path={{ item.path }} src=/data/{{ item.src }} state=link with_items: - { path: /var/lib/postgresql, src: postgresql } - { path: /srv/nfs, src: nfs } tags: [ pis, storage ] - name: ensure docker network docker_network: name=web tags: [ docker ] - name: ensure docker nginx config copy: dest: /data/nginx/conf.d/vhosts.conf mode: "0644" content: | server { listen 80 default_server; server_name transmission.local.desu.ltd; location / { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_pass http://transmission:9091; } } server { listen 80; server_name jackett.local.desu.ltd; location / { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_pass http://jackett:9117; } } server { listen 80; server_name sonarr.local.desu.ltd; location / { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_pass http://sonarr:8989; } } server { listen 80; server_name radarr.local.desu.ltd; location / { proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_pass http://radarr:7878; } } tags: [ docker, ingress ] - name: include tasks for apps include_tasks: tasks/app/{{ task }} with_items: - redis.yml loop_control: loop_var: task tags: [ always ] - name: include tasks for web services include_tasks: tasks/web/{{ task }} with_items: - transmission.yml - jackett.yml - sonarr.yml - radarr.yml - ingress-insecure.yml loop_control: loop_var: task tags: [ always ] roles: - role: backup vars: backup_s3backup_list_extra: - /data/transmisson - /data/jackett - /data/sonarr backup_time: "Mon *-*-* 02:00:00" tags: [ backup ] - role: postgresql vars: postgresql_global_config_options: - option: listen_addresses value: 192.168.103.1,172.23.103.1,127.0.0.1 postgresql_hba_entries: - { type: local, database: all, user: postgres, auth_method: peer } - { type: local, database: all, user: all, auth_method: md5 } - { type: host, database: all, user: all, address: '127.0.0.0/8', auth_method: md5 } - { type: host, database: all, user: all, address: '::1/128', auth_method: md5 } # Used for internal access from other nodes - { type: host, database: all, user: all, address: '192.168.0.0/16', auth_method: md5 } # Allow hosts over zerotier - { type: host, database: all, user: all, address: '172.23.0.0/16', auth_method: md5 } postgresql_users: - name: grafana password: "{{ secret_grafana_local_db_pass }}" - name: gulagbot password: "{{ secret_gulagbot_local_db_pass }}" - name: firefly password: "{{ secret_firefly_db_pass }}" - name: nagios password: "{{ secret_postgresql_monitoring_password }}" postgresql_databases: - name: gulagbot owner: gulagbot - name: grafana owner: grafana - name: firefly owner: firefly tags: [ pis, storage, psql ] - role: nfs vars: nfs_exports: - "/srv/nfs 192.168.0.0/16(ro,no_root_squash,sync) 172.23.0.0/16(ro,no_root_squash,sync)" - "/srv/nfs/bulk 192.168.0.0/16(rw,no_root_squash,sync) 172.23.0.0/16(rw,no_root_squash,sync)" - "/srv/nfs/bulk/media 192.168.0.0/16(rw,no_root_squash,sync) 172.23.0.0/16(rw,no_root_squash,sync)" - "/srv/nfs/k8s 192.168.0.0/16(rw,no_root_squash,sync) 172.23.0.0/16(ro,no_root_squash,sync)" tags: [ pis, storage, nfs ]