bastian/deploy_home
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

moved photoprism app to photos. from cloud.

Browse Source
This commit is contained in:
Bastian de Byl
2022-10-02 19:10:55 -04:00
parent 99a41d2a74
commit 0e9fc3edc3
11 changed files with 71 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
ansible/roles/podman/defaults/main.yml
View File

@@ -1,26 +1,28 @@
---
bookstack_path: "{{ podman_volumes }}/bookstack"
cloud_path: "{{ podman_volumes }}/cloud"
drone_path: "{{ podman_volumes }}/drone"
graylog_path: "{{ podman_volumes }}/graylog"
hass_path: "{{ podman_volumes }}/hass"
nginx_path: "{{ podman_volumes }}/nginx"
partkeepr_path: "{{ podman_volumes }}/partkeepr"
cloud_path: "{{ podman_volumes }}/cloud"
photos_path: "{{ podman_volumes }}/photos"
pihole_path: "{{ podman_volumes }}/pihole"
drone_server_proto: "https"
drone_runner_capacity: "4"
# nginx and modsec configuration
ci_server_name: ci.bdebyl.net
pi_server_name: pi.bdebyl.net
assistant_server_name: assistant.bdebyl.net
bookstack_server_name: wiki.skudakrennsport.com
ci_server_name: ci.bdebyl.net
cloud_server_name: cloud.bdebyl.net
home_server_name: home.bdebyl.net
parts_server_name: parts.bdebyl.net
video_server_name: video.bdebyl.net
logs_server_name: logs.bdebyl.net
parts_server_name: parts.bdebyl.net
photos_server_name: photos.bdebyl.net
pi_server_name: pi.bdebyl.net
video_server_name: video.bdebyl.net
nginx_conf_path: "{{ nginx_path }}/etc/conf"
modsec_log_path: /var/log/nginx/modsec_audit.log

4
ansible/roles/podman/tasks/configuration-nginx-http.yml
View File

@@ -68,7 +68,7 @@
- "{{ bookstack_server_name }}.conf"
- "{{ video_server_name }}.conf"
- "{{ parts_server_name }}.conf"
- "{{ cloud_server_name }}.conf"
- "{{ photos_server_name }}.conf"
- "{{ logs_server_name }}.conf"
notify:
- restorecon podman
@@ -87,7 +87,7 @@
- "{{ ci_server_name }}.http.conf"
- "{{ pi_server_name }}.conf"
- "{{ parts_server_name }}.conf"
- "{{ cloud_server_name }}.conf"
- "{{ photos_server_name }}.conf"
- "{{ home_server_name }}.conf"
- "{{ assistant_server_name }}.conf"
- "{{ bookstack_server_name }}.conf"

4
ansible/roles/podman/tasks/configuration-nginx-https.yml
View File

@@ -36,7 +36,7 @@
loop:
- "{{ ci_server_name }}.https.conf"
- "{{ parts_server_name }}.https.conf"
- "{{ cloud_server_name }}.https.conf"
- "{{ photos_server_name }}.https.conf"
- "{{ bookstack_server_name }}.https.conf"
notify:
- restorecon podman
@@ -54,7 +54,7 @@
loop:
- "{{ ci_server_name }}.https.conf"
- "{{ parts_server_name }}.https.conf"
- "{{ cloud_server_name }}.https.conf"
- "{{ photos_server_name }}.https.conf"
- "{{ bookstack_server_name }}.https.conf"
notify:
- restorecon podman

66
ansible/roles/podman/tasks/container-cloud.yml → ansible/roles/podman/tasks/container-photos.yml
View File

@@ -1,5 +1,5 @@
---
- name: create required cloud volumes
- name: create required photos volumes
become: true
ansible.builtin.file:
path: "{{ item }}"
@@ -9,29 +9,29 @@
mode: 0755
notify: restorecon podman
loop:
- "{{ cloud_path }}/mysql"
- "{{ cloud_path }}/storage"
tags: cloud
- "{{ photos_path }}/mysql"
- "{{ photos_path }}/storage"
tags: photos
- name: flush handlers
ansible.builtin.meta: flush_handlers
tags: cloud
tags: photos
- name: mount cloud cifs
- name: mount photos cifs
become: true
ansible.posix.mount:
src: "{{ cloud_cifs_src }}"
path: "{{ cloud_path }}/storage"
src: "{{ photos_cifs_src }}"
path: "{{ photos_path }}/storage"
fstype: cifs
opts: "username=cloud,password={{ cloud_cifs_pass }},uid={{ podman_subuid.stdout }},gid={{ podman_subuid.stdout }}"
opts: "username=photos,password={{ photos_cifs_pass }},uid={{ podman_subuid.stdout }},gid={{ podman_subuid.stdout }}"
state: mounted
tags: cloud
tags: photos
- name: create cloud-db container
- name: create photos-db container
become: true
become_user: "{{ podman_user }}"
containers.podman.podman_container:
name: cloud-db
name: photos-db
image: docker.io/mariadb:10.8
recreate: false
restart: false
@@ -41,25 +41,25 @@
- shared
env:
MARIADB_AUTO_UPGRADE: "1"
MYSQL_RANDOM_ROOT_PASSWORD: "yes"
MYSQL_DATABASE: cloud
MYSQL_USER: cloud
MYSQL_PASSWORD: "{{ cloud_db_pass }}"
MYSQL_ROOT_PASSWORD: "{{ photos_db_root_pass }}"
MYSQL_DATABASE: photos
MYSQL_USER: photos
MYSQL_PASSWORD: "{{ photos_db_pass }}"
volumes:
- "{{ cloud_path }}/mysql:/var/lib/mysql"
tags: cloud
- "{{ photos_path }}/mysql:/var/lib/mysql"
tags: photos
- name: create systemd startup job for cloud-db
- name: create systemd startup job for photos-db
include_tasks: systemd-generate.yml
vars:
container_name: cloud-db
tags: cloud
container_name: photos-db
tags: photos
- name: create cloud container
- name: create photos container
become: true
become_user: "{{ podman_user }}"
containers.podman.podman_container:
name: cloud
name: photos
image: docker.io/photoprism/photoprism:220901-bookworm
recreate: false
restart: false
@@ -68,7 +68,7 @@
network:
- shared
env:
PHOTOPRISM_ADMIN_PASSWORD: "{{ cloud_user_pass }}"
PHOTOPRISM_ADMIN_PASSWORD: "{{ photos_user_pass }}"
PHOTOPRISM_AUTH_MODE: "password"
PHOTOPRISM_SITE_URL: "http://localhost:2342/"
PHOTOPRISM_ORIGINALS_LIMIT: 5000
@@ -88,21 +88,21 @@
PHOTOPRISM_DETECT_NSFW: "false"
PHOTOPRISM_UPLOAD_NSFW: "true"
PHOTOPRISM_DATABASE_DRIVER: "mysql"
PHOTOPRISM_DATABASE_SERVER: "cloud-db:3306"
PHOTOPRISM_DATABASE_NAME: "cloud"
PHOTOPRISM_DATABASE_USER: "cloud"
PHOTOPRISM_DATABASE_PASSWORD: "{{ cloud_db_pass }}"
PHOTOPRISM_DATABASE_SERVER: "photos-db:3306"
PHOTOPRISM_DATABASE_NAME: "photos"
PHOTOPRISM_DATABASE_USER: "photos"
PHOTOPRISM_DATABASE_PASSWORD: "{{ photos_db_pass }}"
PHOTOPRISM_SITE_CAPTION: "AI-Powered Photos App"
PHOTOPRISM_SITE_DESCRIPTION: ""
PHOTOPRISM_SITE_AUTHOR: "Bastian D."
volumes:
- "{{ cloud_path }}/storage:/photoprism/"
- "{{ photos_path }}/storage:/photoprism/"
ports:
- "8088:2342"
tags: cloud
tags: photos
- name: create systemd startup job for cloud
- name: create systemd startup job for photos
include_tasks: systemd-generate.yml
vars:
container_name: cloud
tags: cloud
container_name: photos
tags: photos

3
ansible/roles/podman/tasks/container-pihole.yml
View File

@@ -4,8 +4,7 @@
ansible.builtin.file:
path: "{{ item }}"
state: directory
owner: "{{ podman_user }}"
group: "{{ podman_user }}"
owner: "{{ podman_subuid.stdout }}"
mode: 0755
notify: restorecon podman
loop:

17
ansible/roles/podman/tasks/firewall.yml
View File

@@ -20,3 +20,20 @@
- 80/tcp
notify: restart firewalld
tags: firewall
- name: unset non-required podman firewall rules
become: true
ansible.posix.firewalld:
port: "{{ item }}"
permanent: true
immediate: true
zone: "public"
state: disabled
loop:
- 9093/tcp
- 9092/tcp
- 9091/tcp
- 9091/udp
- 9092/udp
notify: restart firewalld
tags: firewall

2
ansible/roles/podman/tasks/main.yml
View File

@@ -9,5 +9,5 @@
- import_tasks: container-graylog.yml
- import_tasks: container-pihole.yml
- import_tasks: container-bookstack.yml
- import_tasks: container-cloud.yml
- import_tasks: container-photos.yml
- import_tasks: container-nginx.yml

7
ansible/roles/podman/templates/nginx/sites/cloud.bdebyl.net.conf.j2 → ansible/roles/podman/templates/nginx/sites/photos.bdebyl.net.conf.j2
View File

@@ -1,14 +1,9 @@
geo $whitelisted {
default 0;
192.168.1.0/24 1;
}
server {
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec_includes.conf;
listen 80;
server_name {{ cloud_server_name }};
server_name {{ photos_server_name }};
location '/.well-known/acme-challenge' {
default_type "text/plain";

17
ansible/roles/podman/templates/nginx/sites/cloud.bdebyl.net.https.conf.j2 → ansible/roles/podman/templates/nginx/sites/photos.bdebyl.net.https.conf.j2
View File

@@ -1,9 +1,4 @@
geo $whitelisted {
default 0;
192.168.1.0/24 1;
}
upstream cloud {
upstream photos {
server 127.0.0.1:8088;
}
@@ -14,12 +9,12 @@ server {
resolver 127.0.0.1 127.0.0.53 9.9.9.9 valid=60s;
listen 443 ssl http2;
server_name {{ cloud_server_name }};
server_name {{ photos_server_name }};
client_max_body_size 500M;
ssl_certificate /etc/letsencrypt/live/{{ cloud_server_name }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ cloud_server_name }}/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/{{ cloud_server_name }}/fullchain.pem;
ssl_certificate /etc/letsencrypt/live/{{ photos_server_name }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ photos_server_name }}/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/{{ photos_server_name }}/fullchain.pem;
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
@@ -42,6 +37,6 @@ server {
proxy_buffering off;
proxy_http_version 1.1;
proxy_pass http://cloud;
proxy_pass http://photos;
}
}