bastian/deploy_home
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

noticket - added skudak cloud (nextcloud)

Browse Source
This commit is contained in:
Bastian de Byl
2023-10-05 12:08:22 -04:00
parent 0e40b29329
commit 8bd4ee9dd2
10 changed files with 173 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ansible/roles/podman/defaults/main.yml
View File

@@ -1,6 +1,7 @@
---
bookstack_path: "{{ podman_volumes }}/bookstack"
cloud_path: "{{ podman_volumes }}/cloud"
cloud_skudak_path: "{{ podman_volumes }}/skudakcloud"
debyltech_path: "{{ podman_volumes }}/debyltech"
drone_path: "{{ podman_volumes }}/drone"
factorio_path: "{{ podman_volumes }}/factorio"
@@ -23,6 +24,7 @@ assistant_server_name: assistant.bdebyl.net
bookstack_server_name: wiki.skudakrennsport.com
ci_server_name: ci.bdebyl.net
cloud_server_name: cloud.bdebyl.net
cloud_skudak_server_name: cloud.skudakrennsport.com
fulfillr_server_name: fulfillr.debyltech.com
home_server_name: home.bdebyl.net
logs_server_name: logs.bdebyl.net

2
ansible/roles/podman/tasks/configuration-nginx-http.yml
View File

@@ -65,6 +65,7 @@
- "{{ bookstack_server_name }}.conf"
- "{{ ci_server_name }}.http.conf"
- "{{ cloud_server_name }}.conf"
- "{{ cloud_skudak_server_name }}.conf"
- "{{ fulfillr_server_name }}.conf"
- "{{ home_server_name }}.conf"
- "{{ logs_server_name }}.conf"
@@ -88,6 +89,7 @@
- "{{ bookstack_server_name }}.conf"
- "{{ ci_server_name }}.http.conf"
- "{{ cloud_server_name }}.conf"
- "{{ cloud_skudak_server_name }}.conf"
- "{{ fulfillr_server_name }}.conf"
- "{{ home_server_name }}.conf"
- "{{ logs_server_name }}.conf"

2
ansible/roles/podman/tasks/configuration-nginx-https.yml
View File

@@ -37,6 +37,7 @@
- "{{ bookstack_server_name }}.https.conf"
- "{{ ci_server_name }}.https.conf"
- "{{ cloud_server_name }}.https.conf"
- "{{ cloud_skudak_server_name }}.https.conf"
- "{{ fulfillr_server_name }}.https.conf"
- "{{ parts_server_name }}.https.conf"
- "{{ photos_server_name }}.https.conf"
@@ -57,6 +58,7 @@
- "{{ bookstack_server_name }}.https.conf"
- "{{ ci_server_name }}.https.conf"
- "{{ cloud_server_name }}.https.conf"
- "{{ cloud_skudak_server_name }}.https.conf"
- "{{ fulfillr_server_name }}.https.conf"
- "{{ parts_server_name }}.https.conf"
- "{{ photos_server_name }}.https.conf"

100
ansible/roles/podman/tasks/container-cloud-skudak.yml Normal file
View File

@@ -0,0 +1,100 @@
---
- name: create required skudak cloud volumes
become: true
ansible.builtin.file:
path: "{{ item }}"
state: directory
owner: "{{ podman_subuid.stdout }}"
group: "{{ podman_subuid.stdout }}"
mode: 0755
notify: restorecon podman
loop:
- "{{ cloud_skudak_path }}/apps"
- "{{ cloud_skudak_path }}/config"
- "{{ cloud_skudak_path }}/data"
- "{{ cloud_skudak_path }}/mysql"
- name: unshare chown the skudak cloud volumes
become: true
become_user: "{{ podman_user }}"
changed_when: false
ansible.builtin.command: |
podman unshare chown -R 33:33 {{ cloud_skudak_path }}/apps {{ cloud_skudak_path }}/data {{ cloud_skudak_path}}/config
- name: get user/group id from unshare
become: true
ansible.builtin.stat:
path: "{{ cloud_skudak_path }}/data"
register: cloud_skudak_owner
- name: mount cloud cifs
become: true
ansible.posix.mount:
src: "{{ cloud_skudak_cifs_src }}"
path: "{{ cloud_skudak_path }}/data"
fstype: cifs
opts: "username=skucloud,password={{ cloud_skudak_cifs_pass }},uid={{ cloud_skudak_owner.stat.uid }},gid={{ cloud_skudak_owner.stat.uid }},file_mode=0770,dir_mode=0770"
state: mounted
- name: flush handlers
ansible.builtin.meta: flush_handlers
- import_tasks: podman/podman-check.yml
vars:
container_name: skudak-cloud-db
container_image: "{{ db_image }}"
- name: create skudak-cloud-db container
become: true
become_user: "{{ podman_user }}"
containers.podman.podman_container:
name: skudak-cloud-db
image: "{{ db_image }}"
restart_policy: on-failure:3
log_driver: journald
network:
- shared
env:
MYSQL_ROOT_PASSWORD: "{{ cloud_skudak_db_root_pass }}"
MYSQL_DATABASE: skucloud
MYSQL_PASSWORD: "{{ cloud_skudak_db_pass }}"
MYSQL_USER: skucloud
volumes:
- "{{ cloud_skudak_path }}/mysql:/var/lib/mysql"
- name: create systemd startup job for skudak-cloud-db
include_tasks: podman/systemd-generate.yml
vars:
container_name: skudak-cloud-db
- import_tasks: podman/podman-check.yml
vars:
container_name: skudak-cloud
container_image: "{{ image }}"
- name: create skudak cloud container
become: true
become_user: "{{ podman_user }}"
containers.podman.podman_container:
name: skudak-cloud
image: "{{ image }}"
restart_policy: on-failure:3
log_driver: journald
network:
- shared
env:
MYSQL_PASSWORD: "{{ cloud_skudak_db_pass }}"
MYSQL_DATABASE: skucloud
MYSQL_HOST: skudak-cloud-db
MYSQL_USER: skucloud
volumes:
- "{{ cloud_skudak_path }}/apps:/var/www/html/custom_apps"
- "{{ cloud_skudak_path }}/data:/var/www/html/data"
- "{{ cloud_skudak_path }}/config:/var/www/html/config"
ports:
- "8090:80"
- name: create systemd startup job for cloud
include_tasks: podman/systemd-generate.yml
vars:
container_name: skudak-cloud

4
ansible/roles/podman/tasks/container-cloud.yml
View File

@@ -19,7 +19,7 @@
become_user: "{{ podman_user }}"
changed_when: false
ansible.builtin.command: |
podman unshare chown -R 33:33 {{ cloud_path }}/data {{ cloud_path}}/config
podman unshare chown -R 33:33 {{ cloud_path }}/apps {{ cloud_path }}/data {{ cloud_path}}/config
- name: get user/group id from unshare
become: true
@@ -33,7 +33,7 @@
src: "{{ cloud_cifs_src }}"
path: "{{ cloud_path }}/data"
fstype: cifs
opts: "username=cloud,password={{ cloud_cifs_pass }},uid={{ cloud_owner.stat.uid }},gid={{ cloud_owner.stat.uid }}"
opts: "username=cloud,password={{ cloud_cifs_pass }},uid={{ cloud_owner.stat.uid }},gid={{ cloud_owner.stat.uid }},file_mode=0770,dir_mode=0770"
state: mounted
- name: flush handlers

6
ansible/roles/podman/tasks/main.yml
View File

@@ -49,6 +49,12 @@
image: docker.io/library/nextcloud:24.0.5-apache
tags: cloud
- import_tasks: container-cloud-skudak.yml
vars:
db_image: docker.io/library/mariadb:10.5
image: docker.io/library/nextcloud:24.0.5-apache
tags: skucloud
- import_tasks: container-fulfillr.yml
vars:
image: "{{ aws_ecr_endpoint }}/fulfillr:20231005.1415"

16
ansible/roles/podman/templates/nginx/sites/cloud.skudakrennsport.com.conf.j2 Normal file
View File

@@ -0,0 +1,16 @@
server {
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec_includes.conf;
listen 80;
server_name {{ cloud_skudak_server_name }};
location '/.well-known/acme-challenge' {
default_type "text/plain";
root /srv/http/letsencrypt;
}
location / {
return 302 https://$host$request_uri;
}
}

42
ansible/roles/podman/templates/nginx/sites/cloud.skudakrennsport.com.https.conf.j2 Normal file
View File

@@ -0,0 +1,42 @@
upstream skucloud {
server 127.0.0.1:8090;
}
server {
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec_includes.conf;
resolver 127.0.0.1 127.0.0.53 9.9.9.9 valid=60s;
listen 443 ssl http2;
server_name {{ cloud_skudak_server_name }};
client_max_body_size 500M;
ssl_certificate /etc/letsencrypt/live/{{ cloud_skudak_server_name }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ cloud_skudak_server_name }}/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/{{ cloud_skudak_server_name }}/fullchain.pem;
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_session_timeout 1d;
ssl_stapling on;
ssl_stapling_verify on;
location / {
add_header Referrer-Policy "same-origin" always;
add_header Strict-Transport-Security "max-age=630720000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_buffering off;
proxy_http_version 1.1;
proxy_pass http://skucloud;
}
}

1
ansible/roles/ssl/tasks/certbot.yml
View File

@@ -11,6 +11,7 @@
- "{{ bookstack_server_name }}"
- "{{ ci_server_name }}"
- "{{ cloud_server_name }}"
- "{{ cloud_skudak_server_name }}"
- "{{ fulfillr_server_name }}"
- "{{ parts_server_name }}"
- "{{ photos_server_name }}"

BIN
ansible/vars/vault.yml
View File

Binary file not shown.