From 2b1ca2d5be523a2e1d340c035bc6067956b5816c Mon Sep 17 00:00:00 2001 From: Matzman Date: Tue, 24 Mar 2026 08:19:29 +0100 Subject: [PATCH] Initial commit --- README.md | 60 +++++ group_vars/all | 3 + group_vars/vhosts | 2 + host_vars/localhost | 3 + host_vars/vhost0.homelan | 1 + host_vars/vhost1.homelan | 1 + inventory | 10 + playbook.yml | 30 +++ roles/common/README.md | 38 ++++ roles/common/defaults/main.yml | 2 + roles/common/handlers/main.yml | 2 + roles/common/meta/main.yml | 122 ++++++++++ roles/common/tasks/main.yml | 2 + .../common/templates/example-template.conf.j2 | 0 roles/common/vars/main.yml | 2 + roles/docker-arcane/README.md | 38 ++++ roles/docker-arcane/defaults/main.yml | 14 ++ roles/docker-arcane/handlers/main.yml | 3 + roles/docker-arcane/meta/main.yml | 35 +++ roles/docker-arcane/tasks/main.yml | 20 ++ .../docker-arcane/templates/docker-compose.j2 | 40 ++++ roles/docker-arcane/tests/inventory | 3 + roles/docker-arcane/tests/test.yml | 6 + roles/docker-arcane/vars/main.yml | 3 + roles/docker-comic-utils/README.md | 38 ++++ roles/docker-comic-utils/defaults/main.yml | 18 ++ roles/docker-comic-utils/handlers/main.yml | 3 + roles/docker-comic-utils/meta/main.yml | 35 +++ roles/docker-comic-utils/tasks/main.yml | 22 ++ .../templates/docker-compose.j2 | 60 +++++ roles/docker-comic-utils/tests/inventory | 3 + roles/docker-comic-utils/tests/test.yml | 6 + roles/docker-comic-utils/vars/main.yml | 3 + roles/docker-common/defaults/main.yml | 3 + roles/docker-common/handlers/main.yml | 3 + .../docker-common/tasks/compose-app-init.yml | 14 ++ .../docker-common/tasks/compose-app-start.yml | 10 + .../docker-common/tasks/compose-app-stop.yml | 7 + roles/docker-common/tasks/main.yml | 3 + roles/docker-host/README.md | 38 ++++ roles/docker-host/defaults/main.yml | 3 + roles/docker-host/handlers/main.yml | 7 + roles/docker-host/meta/main.yml | 35 +++ roles/docker-host/tasks/configure-daemon.yml | 16 ++ roles/docker-host/tasks/main.yml | 8 + roles/docker-host/templates/daemon.j2 | 12 + roles/docker-host/tests/inventory | 3 + roles/docker-host/tests/test.yml | 6 + roles/docker-host/vars/main.yml | 3 + roles/docker-pihole/README.md | 38 ++++ roles/docker-pihole/defaults/main.yml | 13 ++ roles/docker-pihole/handlers/main.yml | 3 + roles/docker-pihole/meta/main.yml | 35 +++ roles/docker-pihole/tasks/main.yml | 26 +++ .../docker-pihole/templates/docker-compose.j2 | 44 ++++ roles/docker-pihole/tests/inventory | 3 + roles/docker-pihole/tests/test.yml | 6 + roles/docker-pihole/vars/main.yml | 3 + roles/docker-socket-proxy/README.md | 38 ++++ roles/docker-socket-proxy/defaults/main.yml | 10 + roles/docker-socket-proxy/handlers/main.yml | 3 + roles/docker-socket-proxy/meta/main.yml | 35 +++ roles/docker-socket-proxy/tasks/main.yml | 20 ++ .../templates/docker-compose.j2 | 40 ++++ roles/docker-socket-proxy/tests/inventory | 3 + roles/docker-socket-proxy/tests/test.yml | 6 + roles/docker-socket-proxy/vars/main.yml | 3 + roles/docker-traefik-proxy/README.md | 38 ++++ roles/docker-traefik-proxy/defaults/main.yml | 14 ++ roles/docker-traefik-proxy/handlers/main.yml | 3 + roles/docker-traefik-proxy/meta/main.yml | 35 +++ .../docker-traefik-proxy/tasks/create-app.yml | 41 ++++ roles/docker-traefik-proxy/tasks/main.yml | 25 +++ .../templates/docker-compose.j2 | 26 +++ .../templates/rules_dashboard.j2 | 16 ++ .../templates/rules_middleware.j2 | 6 + .../templates/static_traefik.j2 | 49 ++++ roles/docker-traefik-proxy/tests/inventory | 3 + roles/docker-traefik-proxy/tests/test.yml | 6 + roles/docker-traefik-proxy/vars/main.yml | 3 + roles/ubuntu-docker-host/defaults/main.yml | 16 ++ roles/ubuntu-docker-host/handlers/main.yml | 28 +++ .../tasks/install-ubuntu-docker.yml | 52 +++++ roles/ubuntu-docker-host/tasks/main.yml | 13 ++ .../ubuntu-docker-host/tasks/setup-ubuntu.yml | 209 ++++++++++++++++++ .../ubuntu-docker-host/templates/rules.v4.j2 | 55 +++++ .../ubuntu-docker-host/templates/rules.v6.j2 | 55 +++++ .../ubuntu-docker-host/templates/wg0.conf.j2 | 23 ++ roles/wireguard/defaults/main.yml | 23 ++ roles/wireguard/handlers/main.yml | 7 + roles/wireguard/tasks/main.yml | 33 +++ roles/wireguard/templates/wg0.conf.j2 | 22 ++ site.yml | 13 ++ test01.yml | 46 ++++ testing | 5 + 95 files changed, 1993 insertions(+) create mode 100644 README.md create mode 100644 group_vars/all create mode 100644 group_vars/vhosts create mode 100644 host_vars/localhost create mode 100644 host_vars/vhost0.homelan create mode 100644 host_vars/vhost1.homelan create mode 100644 inventory create mode 100644 playbook.yml create mode 100644 roles/common/README.md create mode 100644 roles/common/defaults/main.yml create mode 100644 roles/common/handlers/main.yml create mode 100644 roles/common/meta/main.yml create mode 100644 roles/common/tasks/main.yml create mode 100644 roles/common/templates/example-template.conf.j2 create mode 100644 roles/common/vars/main.yml create mode 100644 roles/docker-arcane/README.md create mode 100644 roles/docker-arcane/defaults/main.yml create mode 100644 roles/docker-arcane/handlers/main.yml create mode 100644 roles/docker-arcane/meta/main.yml create mode 100644 roles/docker-arcane/tasks/main.yml create mode 100644 roles/docker-arcane/templates/docker-compose.j2 create mode 100644 roles/docker-arcane/tests/inventory create mode 100644 roles/docker-arcane/tests/test.yml create mode 100644 roles/docker-arcane/vars/main.yml create mode 100644 roles/docker-comic-utils/README.md create mode 100644 roles/docker-comic-utils/defaults/main.yml create mode 100644 roles/docker-comic-utils/handlers/main.yml create mode 100644 roles/docker-comic-utils/meta/main.yml create mode 100644 roles/docker-comic-utils/tasks/main.yml create mode 100644 roles/docker-comic-utils/templates/docker-compose.j2 create mode 100644 roles/docker-comic-utils/tests/inventory create mode 100644 roles/docker-comic-utils/tests/test.yml create mode 100644 roles/docker-comic-utils/vars/main.yml create mode 100644 roles/docker-common/defaults/main.yml create mode 100644 roles/docker-common/handlers/main.yml create mode 100644 roles/docker-common/tasks/compose-app-init.yml create mode 100644 roles/docker-common/tasks/compose-app-start.yml create mode 100644 roles/docker-common/tasks/compose-app-stop.yml create mode 100644 roles/docker-common/tasks/main.yml create mode 100644 roles/docker-host/README.md create mode 100644 roles/docker-host/defaults/main.yml create mode 100644 roles/docker-host/handlers/main.yml create mode 100644 roles/docker-host/meta/main.yml create mode 100644 roles/docker-host/tasks/configure-daemon.yml create mode 100644 roles/docker-host/tasks/main.yml create mode 100644 roles/docker-host/templates/daemon.j2 create mode 100644 roles/docker-host/tests/inventory create mode 100644 roles/docker-host/tests/test.yml create mode 100644 roles/docker-host/vars/main.yml create mode 100644 roles/docker-pihole/README.md create mode 100644 roles/docker-pihole/defaults/main.yml create mode 100644 roles/docker-pihole/handlers/main.yml create mode 100644 roles/docker-pihole/meta/main.yml create mode 100644 roles/docker-pihole/tasks/main.yml create mode 100644 roles/docker-pihole/templates/docker-compose.j2 create mode 100644 roles/docker-pihole/tests/inventory create mode 100644 roles/docker-pihole/tests/test.yml create mode 100644 roles/docker-pihole/vars/main.yml create mode 100644 roles/docker-socket-proxy/README.md create mode 100644 roles/docker-socket-proxy/defaults/main.yml create mode 100644 roles/docker-socket-proxy/handlers/main.yml create mode 100644 roles/docker-socket-proxy/meta/main.yml create mode 100644 roles/docker-socket-proxy/tasks/main.yml create mode 100644 roles/docker-socket-proxy/templates/docker-compose.j2 create mode 100644 roles/docker-socket-proxy/tests/inventory create mode 100644 roles/docker-socket-proxy/tests/test.yml create mode 100644 roles/docker-socket-proxy/vars/main.yml create mode 100644 roles/docker-traefik-proxy/README.md create mode 100644 roles/docker-traefik-proxy/defaults/main.yml create mode 100644 roles/docker-traefik-proxy/handlers/main.yml create mode 100644 roles/docker-traefik-proxy/meta/main.yml create mode 100644 roles/docker-traefik-proxy/tasks/create-app.yml create mode 100644 roles/docker-traefik-proxy/tasks/main.yml create mode 100644 roles/docker-traefik-proxy/templates/docker-compose.j2 create mode 100644 roles/docker-traefik-proxy/templates/rules_dashboard.j2 create mode 100644 roles/docker-traefik-proxy/templates/rules_middleware.j2 create mode 100644 roles/docker-traefik-proxy/templates/static_traefik.j2 create mode 100644 roles/docker-traefik-proxy/tests/inventory create mode 100644 roles/docker-traefik-proxy/tests/test.yml create mode 100644 roles/docker-traefik-proxy/vars/main.yml create mode 100644 roles/ubuntu-docker-host/defaults/main.yml create mode 100644 roles/ubuntu-docker-host/handlers/main.yml create mode 100644 roles/ubuntu-docker-host/tasks/install-ubuntu-docker.yml create mode 100644 roles/ubuntu-docker-host/tasks/main.yml create mode 100644 roles/ubuntu-docker-host/tasks/setup-ubuntu.yml create mode 100644 roles/ubuntu-docker-host/templates/rules.v4.j2 create mode 100644 roles/ubuntu-docker-host/templates/rules.v6.j2 create mode 100644 roles/ubuntu-docker-host/templates/wg0.conf.j2 create mode 100644 roles/wireguard/defaults/main.yml create mode 100644 roles/wireguard/handlers/main.yml create mode 100644 roles/wireguard/tasks/main.yml create mode 100644 roles/wireguard/templates/wg0.conf.j2 create mode 100644 site.yml create mode 100644 test01.yml create mode 100644 testing diff --git a/README.md b/README.md new file mode 100644 index 0000000..400531a --- /dev/null +++ b/README.md @@ -0,0 +1,60 @@ +# About This Repo # +This is a skeleton of an Ansible home directory. You can control all of your application environments from this directory. If you work with multiple customers, you probably want to create a separate copy of this repo for each customer. + +This repo was designed to help new Ansible users to get up and running quickly. Feel free to add to it and add additional tips and tricks. Pull requests welcome. + +# Ansible Tips # +In your roles directory, type ansible-galaxy init role_name in order to generate an empty skeleton for a new role you are working on. + +Example: +
+ansible-galaxy init nginx
+
+ +Check out [Ansible Examples](https://github.com/ansible/ansible-examples) for example playbooks. + +# Best Practices Directory Layout # + +Based on [Ansible Best Practices](https://docs.ansible.com/ansible/playbooks_best_practices.html#directory-layout) + +
+production                # inventory file for production servers
+staging                   # inventory file for staging environment
+
+group_vars/
+   group1                 # here we assign variables to particular groups
+   group2                 # ""
+host_vars/
+   hostname1              # if systems need specific variables, put them here
+   hostname2              # ""
+
+library/                  # if any custom modules, put them here (optional)
+filter_plugins/           # if any custom filter plugins, put them here (optional)
+
+site.yml                  # master playbook
+webservers.yml            # playbook for webserver tier
+dbservers.yml             # playbook for dbserver tier
+
+roles/
+    common/               # this hierarchy represents a "role"
+        tasks/            #
+            main.yml      #  <-- tasks file can include smaller files if warranted
+        handlers/         #
+            main.yml      #  <-- handlers file
+        templates/        #  <-- files for use with the template resource
+            ntp.conf.j2   #  <------- templates end in .j2
+        files/            #
+            bar.txt       #  <-- files for use with the copy resource
+            foo.sh        #  <-- script files for use with the script resource
+        vars/             #
+            main.yml      #  <-- variables associated with this role
+        defaults/         #
+            main.yml      #  <-- default lower priority variables for this role
+        meta/             #
+            main.yml      #  <-- role dependencies
+
+    webtier/              # same kind of structure as "common" was above, done for the webtier role
+    monitoring/           # ""
+    fooapp/               # ""
+
+ diff --git a/group_vars/all b/group_vars/all new file mode 100644 index 0000000..529198e --- /dev/null +++ b/group_vars/all @@ -0,0 +1,3 @@ +# A place to put variables that apply to all groups +# Create a file in this directory called "webservers" to set variables +# for the "webservers" group. diff --git a/group_vars/vhosts b/group_vars/vhosts new file mode 100644 index 0000000..572aac9 --- /dev/null +++ b/group_vars/vhosts @@ -0,0 +1,2 @@ +docker_apps_dir: "/opt/docker-apps/" +docker_socket_path: "/var/run/docker.sock" diff --git a/host_vars/localhost b/host_vars/localhost new file mode 100644 index 0000000..26e3c3b --- /dev/null +++ b/host_vars/localhost @@ -0,0 +1,3 @@ +docker_apps_dir: "/home/matzman/tmp/ansible-test/docker-apps-dir" +docker_socket_path: "/var/run/docker.sock" + diff --git a/host_vars/vhost0.homelan b/host_vars/vhost0.homelan new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/host_vars/vhost0.homelan @@ -0,0 +1 @@ + diff --git a/host_vars/vhost1.homelan b/host_vars/vhost1.homelan new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/host_vars/vhost1.homelan @@ -0,0 +1 @@ + diff --git a/inventory b/inventory new file mode 100644 index 0000000..8ec5599 --- /dev/null +++ b/inventory @@ -0,0 +1,10 @@ + +localhost ansible_connection=local ansible_python_interpreter="{{ansible_playbook_python}}" host_ip_addr="10.61.1.20" host_base_domain="localhost" + +[vhosts] +vhost0.homelan host_ip_addr="10.61.0.100" host_base_domain="vhost0.homelan" +vhost1.homelan host_ip_addr="10.61.0.110" host_base_domain="vhost1.homelan" + +[vservers] +vserver0.homelan +vserver1.homelan diff --git a/playbook.yml b/playbook.yml new file mode 100644 index 0000000..72ade5e --- /dev/null +++ b/playbook.yml @@ -0,0 +1,30 @@ +--- + +- hosts: vhost0.homelan + roles: + - role: docker-host + - role: docker-traefik-proxy + vars: + app_name: "traefik-vhost0" + - role: docker-arcane + vars: + app_name: "arcane-vhost0" + - role: docker-socket-proxy + + +- hosts: vhost1.homelan + roles: + - role: docker-host + - role: docker-traefik-proxy + vars: + app_name: "traefik-vhost1" + - role: docker-arcane + vars: + app_name: "arcane-vhost1" + - role: docker-socket-proxy + - role: docker-comic-utils + vars: + comicutils_data_extramounts: + Comics: "/storage/files/Multimedia/Comics" + Comics_Staging: "/storage/files/Multimedia/Comics_Staging" + tmp3x: "/storage/files/Sonstiges/tmp/tmp3x" diff --git a/roles/common/README.md b/roles/common/README.md new file mode 100644 index 0000000..54af02f --- /dev/null +++ b/roles/common/README.md @@ -0,0 +1,38 @@ +Role Name +======== + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +------------------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/roles/common/defaults/main.yml b/roles/common/defaults/main.yml new file mode 100644 index 0000000..205c4a1 --- /dev/null +++ b/roles/common/defaults/main.yml @@ -0,0 +1,2 @@ +--- +# defaults file for common diff --git a/roles/common/handlers/main.yml b/roles/common/handlers/main.yml new file mode 100644 index 0000000..2662adc --- /dev/null +++ b/roles/common/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for common diff --git a/roles/common/meta/main.yml b/roles/common/meta/main.yml new file mode 100644 index 0000000..a829c79 --- /dev/null +++ b/roles/common/meta/main.yml @@ -0,0 +1,122 @@ +--- +galaxy_info: + author: your name + description: + company: your company (optional) + # Some suggested licenses: + # - BSD (default) + # - MIT + # - GPLv2 + # - GPLv3 + # - Apache + # - CC-BY + license: license (GPLv2, CC-BY, etc) + min_ansible_version: 1.2 + # + # Below are all platforms currently available. Just uncomment + # the ones that apply to your role. If you don't see your + # platform on this list, let us know and we'll get it added! + # + #platforms: + #- name: EL + # versions: + # - all + # - 5 + # - 6 + #- name: GenericUNIX + # versions: + # - all + # - any + #- name: Fedora + # versions: + # - all + # - 16 + # - 17 + # - 18 + # - 19 + # - 20 + #- name: opensuse + # versions: + # - all + # - 12.1 + # - 12.2 + # - 12.3 + # - 13.1 + # - 13.2 + #- name: Amazon + # versions: + # - all + # - 2013.03 + # - 2013.09 + #- name: GenericBSD + # versions: + # - all + # - any + #- name: FreeBSD + # versions: + # - all + # - 8.0 + # - 8.1 + # - 8.2 + # - 8.3 + # - 8.4 + # - 9.0 + # - 9.1 + # - 9.1 + # - 9.2 + #- name: Ubuntu + # versions: + # - all + # - lucid + # - maverick + # - natty + # - oneiric + # - precise + # - quantal + # - raring + # - saucy + # - trusty + #- name: SLES + # versions: + # - all + # - 10SP3 + # - 10SP4 + # - 11 + # - 11SP1 + # - 11SP2 + # - 11SP3 + #- name: GenericLinux + # versions: + # - all + # - any + #- name: Debian + # versions: + # - all + # - etch + # - lenny + # - squeeze + # - wheezy + # + # Below are all categories currently available. Just as with + # the platforms above, uncomment those that apply to your role. + # + #categories: + #- cloud + #- cloud:ec2 + #- cloud:gce + #- cloud:rax + #- database + #- database:nosql + #- database:sql + #- development + #- monitoring + #- networking + #- packaging + #- system + #- web +dependencies: [] + # List your role dependencies here, one per line. Only + # dependencies available via galaxy should be listed here. + # Be sure to remove the '[]' above if you add dependencies + # to this list. + diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml new file mode 100644 index 0000000..7b72b3d --- /dev/null +++ b/roles/common/tasks/main.yml @@ -0,0 +1,2 @@ +--- +# tasks file for common diff --git a/roles/common/templates/example-template.conf.j2 b/roles/common/templates/example-template.conf.j2 new file mode 100644 index 0000000..e69de29 diff --git a/roles/common/vars/main.yml b/roles/common/vars/main.yml new file mode 100644 index 0000000..fed6035 --- /dev/null +++ b/roles/common/vars/main.yml @@ -0,0 +1,2 @@ +--- +# vars file for common diff --git a/roles/docker-arcane/README.md b/roles/docker-arcane/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/roles/docker-arcane/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/roles/docker-arcane/defaults/main.yml b/roles/docker-arcane/defaults/main.yml new file mode 100644 index 0000000..96df700 --- /dev/null +++ b/roles/docker-arcane/defaults/main.yml @@ -0,0 +1,14 @@ +#SPDX-License-Identifier: MIT-0 +--- +# defaults file for docker-arcane +app_name: "arcane" +app_dns_name: "arcane" +app_base_dir: "{{ (docker_apps_dir, app_name) | path_join }}" +app_base_domain: "{{ app_dns_name ~ '.' ~ host_base_domain }}" +app_proxy_network: "traefik-proxy-net" + +arcane_image_name: "ghcr.io/getarcaneapp/arcane" +arcane_webui_port: 3552 +arcane_data_dir: "arcane-data" +arcane_encrypt_key: "513862f9ece8e28e27cbe78773f0ea6fafe8f8d168f58302c29e611796238780" +arcane_swt_key: "526bd35af00be1f3fe8547482c0eefe2180dd59a1add6244efce5fe7e7e4f256" diff --git a/roles/docker-arcane/handlers/main.yml b/roles/docker-arcane/handlers/main.yml new file mode 100644 index 0000000..33f0a2c --- /dev/null +++ b/roles/docker-arcane/handlers/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# handlers file for docker-arcane diff --git a/roles/docker-arcane/meta/main.yml b/roles/docker-arcane/meta/main.yml new file mode 100644 index 0000000..6f91fd3 --- /dev/null +++ b/roles/docker-arcane/meta/main.yml @@ -0,0 +1,35 @@ +#SPDX-License-Identifier: MIT-0 +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.2 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/roles/docker-arcane/tasks/main.yml b/roles/docker-arcane/tasks/main.yml new file mode 100644 index 0000000..2d73603 --- /dev/null +++ b/roles/docker-arcane/tasks/main.yml @@ -0,0 +1,20 @@ +#SPDX-License-Identifier: MIT-0 +--- + +- name: Run Compose App Init + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-init + tags: [create, docker-arcane] + +- name: Run Compose App Start + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-start + tags: [create, docker-arcane] + +- name: Run Compose App Stop + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-stop + tags: [never, stop-docker-arcane] diff --git a/roles/docker-arcane/templates/docker-compose.j2 b/roles/docker-arcane/templates/docker-compose.j2 new file mode 100644 index 0000000..4aabbaa --- /dev/null +++ b/roles/docker-arcane/templates/docker-compose.j2 @@ -0,0 +1,40 @@ + +services: + {{ app_name }}: + image: {{ arcane_image_name }} + container_name: {{ app_name }} + ports: + - {{ arcane_webui_port }}:3552 + networks: +{% if app_proxy_network is not none %} + {{ app_proxy_network }}: +{% else %} + {{ app_name ~ "-net" }}: +{% endif %} + volumes: + - {{ docker_socket_path }}:/var/run/docker.sock + - ./{{ arcane_data_dir }}:/app/data + - {{ docker_apps_dir }}:/app/data/projects + environment: + - APP_URL=http://{{ app_base_domain }}:{{ arcane_webui_port }} + - PUID=1000 + - PGID=1000 + - ENCRYPTION_KEY={{ arcane_encrypt_key }} + - JWT_SECRET={{ arcane_swt_key }} + restart: unless-stopped +{% if app_proxy_network is not none %} + labels: + traefik.enable: true + traefik.docker.network: "{{ app_proxy_network }}" + traefik.http.routers.{{ app_name }}-http.rule: "Host(`{{ app_base_domain }}`)" + traefik.http.routers.{{ app_name }}-http.entryPoints: web + traefik.http.services.{{ app_name }}.loadbalancer.server.port: 3552 +{% endif %} + +networks: +{% if app_proxy_network is not none %} + {{ app_proxy_network }}: + external: true +{% else %} + {{ app_name ~ "-net" }}: +{% endif %} diff --git a/roles/docker-arcane/tests/inventory b/roles/docker-arcane/tests/inventory new file mode 100644 index 0000000..03ca42f --- /dev/null +++ b/roles/docker-arcane/tests/inventory @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +localhost + diff --git a/roles/docker-arcane/tests/test.yml b/roles/docker-arcane/tests/test.yml new file mode 100644 index 0000000..5234cdb --- /dev/null +++ b/roles/docker-arcane/tests/test.yml @@ -0,0 +1,6 @@ +#SPDX-License-Identifier: MIT-0 +--- +- hosts: localhost + remote_user: root + roles: + - docker-arcane diff --git a/roles/docker-arcane/vars/main.yml b/roles/docker-arcane/vars/main.yml new file mode 100644 index 0000000..9626835 --- /dev/null +++ b/roles/docker-arcane/vars/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# vars file for docker-arcane diff --git a/roles/docker-comic-utils/README.md b/roles/docker-comic-utils/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/roles/docker-comic-utils/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/roles/docker-comic-utils/defaults/main.yml b/roles/docker-comic-utils/defaults/main.yml new file mode 100644 index 0000000..295cba0 --- /dev/null +++ b/roles/docker-comic-utils/defaults/main.yml @@ -0,0 +1,18 @@ +#SPDX-License-Identifier: MIT-0 +--- +# defaults file for docker-comic-utils +app_name: "comic-utils" +app_dns_name: "comic-utils" +app_base_dir: "{{ (docker_apps_dir, app_name) | path_join }}" +app_base_domain: "{{ app_dns_name ~ '.' ~ host_base_domain }}" +app_extra_domains: ["comic-utils.homelan"] +app_proxy_network: "traefik-proxy-net" + +comicutils_image_name: "allaboutduncan/comic-utils-web:latest" +comicutils_config_dir: "config" +comicutils_data_dir: "data" +comicutils_cache_dir: "cache" +comicutils_downloads_dir: "downloads" +comicutils_data_extramounts: + Comics: "./data/Comics" + Comics_Staging: "./data/Comics_Staging" diff --git a/roles/docker-comic-utils/handlers/main.yml b/roles/docker-comic-utils/handlers/main.yml new file mode 100644 index 0000000..5473c36 --- /dev/null +++ b/roles/docker-comic-utils/handlers/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# handlers file for docker-comic-utils diff --git a/roles/docker-comic-utils/meta/main.yml b/roles/docker-comic-utils/meta/main.yml new file mode 100644 index 0000000..6f91fd3 --- /dev/null +++ b/roles/docker-comic-utils/meta/main.yml @@ -0,0 +1,35 @@ +#SPDX-License-Identifier: MIT-0 +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.2 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/roles/docker-comic-utils/tasks/main.yml b/roles/docker-comic-utils/tasks/main.yml new file mode 100644 index 0000000..11a15c5 --- /dev/null +++ b/roles/docker-comic-utils/tasks/main.yml @@ -0,0 +1,22 @@ +#SPDX-License-Identifier: MIT-0 +--- +# tasks file for docker-comic-utils + +- name: Run Compose App Init + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-init + tags: [create, docker-comic-utils] + +- name: Run Compose App Start + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-start + tags: [create, docker-comic-utils] + +- name: Run Compose App Stop + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-stop + tags: [never, stop-docker-comic-utils] + diff --git a/roles/docker-comic-utils/templates/docker-compose.j2 b/roles/docker-comic-utils/templates/docker-compose.j2 new file mode 100644 index 0000000..eea88c7 --- /dev/null +++ b/roles/docker-comic-utils/templates/docker-compose.j2 @@ -0,0 +1,60 @@ + +services: + {{ app_name }}: + image: {{ comicutils_image_name }} + container_name: {{ app_name }} + logging: + options: + max-size: 20m # Reduce log size to 20MB + max-file: "3" # Keep only 3 rotated files + restart: unless-stopped +{% if app_proxy_network is none %} + ports: + - 5577:5577 +{% endif %} + networks: +{% if app_proxy_network is not none %} + {{ app_proxy_network }}: +{% else %} + {{ app_name ~ "-net" }}: +{% endif %} + volumes: + - {{ docker_socket_path }}:/tmp/docker.sock:ro + - ./{{ comicutils_config_dir }}:/config + - ./{{ comicutils_cache_dir }}:/cache + ## Additional folder is you want to use Folder Monitoring. + - ./{{ comicutils_downloads_dir }}:/downloads + - ./{{ comicutils_data_dir }}:/data +{% for m in comicutils_data_extramounts %} + {{ "- " ~ comicutils_data_extramounts[m] ~ ":/data/" ~ m}} +{% endfor %} + environment: + - FLASK_ENV=development + ## Set to 'yes' if you want to use folder monitoring. + - MONITOR=no + ## Set the User ID (PUID) and Group ID (PGID) for the container. + ## This is often needed to resolve permission issues, especially on systems like Unraid + ## where a specific user/group owns the files. + ## For Unraid, PUID is typically 99 (user 'nobody') and PGID is typically 100 (group 'users'). + ## For Windows/WSL, you need to set these to match your Windows user ID (see WINDOWS_WSL_SETUP.md) + - PUID=1000 + - PGID=1000 + ## Set the file creation mask (UMASK). 022 is a common value. + # - UMASK=022 +{% if app_proxy_network is not none %} + labels: + traefik.enable: true + traefik.docker.network: "{{ app_proxy_network }}" + traefik.http.routers.{{ app_name }}-http.rule: "Host(`{{ app_base_domain }}`){%- for d in app_extra_domains %}{{ "||Host(`" ~ d ~ "`)" }}{% endfor %}" + traefik.http.routers.{{ app_name }}-http.entryPoints: web + traefik.http.services.{{ app_name }}.loadbalancer.server.port: 5577 +{% endif %} + + +networks: +{% if app_proxy_network is not none %} + {{ app_proxy_network }}: + external: true +{% else %} + {{ app_name ~ "-net" }}: +{% endif %} diff --git a/roles/docker-comic-utils/tests/inventory b/roles/docker-comic-utils/tests/inventory new file mode 100644 index 0000000..03ca42f --- /dev/null +++ b/roles/docker-comic-utils/tests/inventory @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +localhost + diff --git a/roles/docker-comic-utils/tests/test.yml b/roles/docker-comic-utils/tests/test.yml new file mode 100644 index 0000000..72681e5 --- /dev/null +++ b/roles/docker-comic-utils/tests/test.yml @@ -0,0 +1,6 @@ +#SPDX-License-Identifier: MIT-0 +--- +- hosts: localhost + remote_user: root + roles: + - docker-comic-utils diff --git a/roles/docker-comic-utils/vars/main.yml b/roles/docker-comic-utils/vars/main.yml new file mode 100644 index 0000000..4fcb619 --- /dev/null +++ b/roles/docker-comic-utils/vars/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# vars file for docker-comic-utils diff --git a/roles/docker-common/defaults/main.yml b/roles/docker-common/defaults/main.yml new file mode 100644 index 0000000..f183d3e --- /dev/null +++ b/roles/docker-common/defaults/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# defaults file for docker-common diff --git a/roles/docker-common/handlers/main.yml b/roles/docker-common/handlers/main.yml new file mode 100644 index 0000000..6840ae8 --- /dev/null +++ b/roles/docker-common/handlers/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# handlers file for docker-common diff --git a/roles/docker-common/tasks/compose-app-init.yml b/roles/docker-common/tasks/compose-app-init.yml new file mode 100644 index 0000000..09d0e48 --- /dev/null +++ b/roles/docker-common/tasks/compose-app-init.yml @@ -0,0 +1,14 @@ +--- + +- name: Create app dir {{ app_base_dir }} + ansible.builtin.file: + path: "{{ app_base_dir }}" + state: directory + +- name: Write the docker compose file to {{ app_base_dir }} + ansible.builtin.template: + src: docker-compose.j2 + dest: "{{ (app_base_dir, 'docker-compose.yaml') | path_join }}" + mode: 0644 + owner: matzman + group: matzman diff --git a/roles/docker-common/tasks/compose-app-start.yml b/roles/docker-common/tasks/compose-app-start.yml new file mode 100644 index 0000000..a6d8e60 --- /dev/null +++ b/roles/docker-common/tasks/compose-app-start.yml @@ -0,0 +1,10 @@ +--- + +- name: Pull images for {{ app_name }} + community.docker.docker_compose_v2_pull: + project_src: "{{ app_base_dir }}" + + +- name: create and start docker compose services for {{ app_name }} + community.docker.docker_compose_v2: + project_src: "{{ app_base_dir }}" diff --git a/roles/docker-common/tasks/compose-app-stop.yml b/roles/docker-common/tasks/compose-app-stop.yml new file mode 100644 index 0000000..b1b424d --- /dev/null +++ b/roles/docker-common/tasks/compose-app-stop.yml @@ -0,0 +1,7 @@ +--- + +- name: stop and remove docker compose services for {{ app_name }} + community.docker.docker_compose_v2: + project_src: "{{ app_base_dir }}" + state: absent + diff --git a/roles/docker-common/tasks/main.yml b/roles/docker-common/tasks/main.yml new file mode 100644 index 0000000..224f42e --- /dev/null +++ b/roles/docker-common/tasks/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# tasks file for docker-common diff --git a/roles/docker-host/README.md b/roles/docker-host/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/roles/docker-host/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/roles/docker-host/defaults/main.yml b/roles/docker-host/defaults/main.yml new file mode 100644 index 0000000..5163b88 --- /dev/null +++ b/roles/docker-host/defaults/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# defaults file for docker-host diff --git a/roles/docker-host/handlers/main.yml b/roles/docker-host/handlers/main.yml new file mode 100644 index 0000000..0640a21 --- /dev/null +++ b/roles/docker-host/handlers/main.yml @@ -0,0 +1,7 @@ +#SPDX-License-Identifier: MIT-0 +--- +# handlers file for docker-host +- name: restart docker + ansible.builtin.service: + name: docker + state: restarted diff --git a/roles/docker-host/meta/main.yml b/roles/docker-host/meta/main.yml new file mode 100644 index 0000000..6f91fd3 --- /dev/null +++ b/roles/docker-host/meta/main.yml @@ -0,0 +1,35 @@ +#SPDX-License-Identifier: MIT-0 +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.2 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/roles/docker-host/tasks/configure-daemon.yml b/roles/docker-host/tasks/configure-daemon.yml new file mode 100644 index 0000000..a40090c --- /dev/null +++ b/roles/docker-host/tasks/configure-daemon.yml @@ -0,0 +1,16 @@ +--- + +- name: Create Docker config directory + ansible.builtin.file: + path: /etc/docker + state: directory + mode: 0755 + + +- name: Write daemon.json + ansible.builtin.template: + src: daemon.j2 + dest: /etc/docker/daemon.json + mode: 0644 + backup: true + notify: restart docker diff --git a/roles/docker-host/tasks/main.yml b/roles/docker-host/tasks/main.yml new file mode 100644 index 0000000..d5bf3a5 --- /dev/null +++ b/roles/docker-host/tasks/main.yml @@ -0,0 +1,8 @@ +#SPDX-License-Identifier: MIT-0 +--- +# tasks file for docker-host + +- name: Configure Docker Daemon + ansible.builtin.import_tasks: configure-daemon.yml + tags: [create, docker-host] + become: true diff --git a/roles/docker-host/templates/daemon.j2 b/roles/docker-host/templates/daemon.j2 new file mode 100644 index 0000000..b88ea56 --- /dev/null +++ b/roles/docker-host/templates/daemon.j2 @@ -0,0 +1,12 @@ +{ + "ipv6":true,"fixed-cidr-v6":"fc30:0882:4321:10::/64","ip6tables":true, + "default-address-pools":[ + {"base":"172.16.0.0/16","size":24}, + {"base":"172.17.0.0/16","size":24}, + {"base":"172.18.0.0/16","size":24}, + {"base":"172.19.0.0/16","size":24}, + {"base":"172.20.0.0/16","size":24}, + {"base":"fc30:882:4322::/48","size":64}, + {"base":"fc30:882:4323::/48","size":64} + ] +} diff --git a/roles/docker-host/tests/inventory b/roles/docker-host/tests/inventory new file mode 100644 index 0000000..03ca42f --- /dev/null +++ b/roles/docker-host/tests/inventory @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +localhost + diff --git a/roles/docker-host/tests/test.yml b/roles/docker-host/tests/test.yml new file mode 100644 index 0000000..79f1cd4 --- /dev/null +++ b/roles/docker-host/tests/test.yml @@ -0,0 +1,6 @@ +#SPDX-License-Identifier: MIT-0 +--- +- hosts: localhost + remote_user: root + roles: + - docker-host diff --git a/roles/docker-host/vars/main.yml b/roles/docker-host/vars/main.yml new file mode 100644 index 0000000..d917488 --- /dev/null +++ b/roles/docker-host/vars/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# vars file for docker-host diff --git a/roles/docker-pihole/README.md b/roles/docker-pihole/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/roles/docker-pihole/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/roles/docker-pihole/defaults/main.yml b/roles/docker-pihole/defaults/main.yml new file mode 100644 index 0000000..597cc56 --- /dev/null +++ b/roles/docker-pihole/defaults/main.yml @@ -0,0 +1,13 @@ +#SPDX-License-Identifier: MIT-0 +--- +# defaults file for docker-pihole +app_name: "pihole" +app_dns_name: "pihole" +app_base_dir: "{{ (docker_apps_dir, app_name) | path_join }}" +app_base_domain: "{{ app_dns_name ~ '.' ~ host_base_domain }}" +app_proxy_network: "traefik-proxy-net" + +pihole_image_name: "pihole/pihole:latest" +pihole_timezone: "Europe/Vienna" +pihole_webapi_password: "letmein123" +pihole_etc_dir: "pihole-etc" diff --git a/roles/docker-pihole/handlers/main.yml b/roles/docker-pihole/handlers/main.yml new file mode 100644 index 0000000..0a5e120 --- /dev/null +++ b/roles/docker-pihole/handlers/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# handlers file for docker-pihole diff --git a/roles/docker-pihole/meta/main.yml b/roles/docker-pihole/meta/main.yml new file mode 100644 index 0000000..6f91fd3 --- /dev/null +++ b/roles/docker-pihole/meta/main.yml @@ -0,0 +1,35 @@ +#SPDX-License-Identifier: MIT-0 +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.2 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/roles/docker-pihole/tasks/main.yml b/roles/docker-pihole/tasks/main.yml new file mode 100644 index 0000000..69d3590 --- /dev/null +++ b/roles/docker-pihole/tasks/main.yml @@ -0,0 +1,26 @@ +#SPDX-License-Identifier: MIT-0 +--- +# tasks file for docker-pihole + +- name: Run Compose App Init + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-init + tags: [create, docker-pihole] + +- name: Run Compose App Start + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-start + tags: [create, docker-pihole] + +- name: "Print API Password" + debug: + msg: "PiHole Web API Password: {{ pihole_webapi_password }}" + tags: [create, docker-pihole] + +- name: Run Compose App Stop + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-stop + tags: [never, stop-docker-pihole] diff --git a/roles/docker-pihole/templates/docker-compose.j2 b/roles/docker-pihole/templates/docker-compose.j2 new file mode 100644 index 0000000..f526b3a --- /dev/null +++ b/roles/docker-pihole/templates/docker-compose.j2 @@ -0,0 +1,44 @@ +# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/ +services: + {{ app_name }}: + container_name: {{ app_name }} + image: {{ pihole_image_name }} + ports: + # DNS Ports + - "{{ host_ip_addr | ansible.utils.ipaddr }}:53:53/tcp" + - "{{ host_ip_addr | ansible.utils.ipaddr }}:53:53/udp" +{% if app_proxy_network is none %} + - "{{ host_ip_addr | ansible.utils.ipaddr }}:83:80/tcp" +{% endif %} + networks: +{% if app_proxy_network is not none %} + {{ app_proxy_network }}: +{% else %} + {{ app_name ~ "-net" }}: +{% endif %} + environment: + TZ: '{{ pihole_timezone }}' + FTLCONF_webserver_api_password: '{{ pihole_webapi_password }}' + volumes: + - './{{ pihole_etc_dir }}:/etc/pihole' + cap_add: + - CAP_SYS_NICE + restart: unless-stopped +{% if app_proxy_network is not none %} + labels: + traefik.enable: true + traefik.docker.network: "{{ app_proxy_network }}" + traefik.http.routers.{{ app_name }}-http.rule: "Host(`{{ app_base_domain }}`)" + traefik.http.routers.{{ app_name }}-http.entryPoints: web + traefik.http.services.{{ app_name }}.loadbalancer.server.port: 80 +{% endif %} + + +networks: +{% if app_proxy_network is not none %} + {{ app_proxy_network }}: + external: true +{% else %} + {{ app_name ~ "-net" }}: +{% endif %} + diff --git a/roles/docker-pihole/tests/inventory b/roles/docker-pihole/tests/inventory new file mode 100644 index 0000000..03ca42f --- /dev/null +++ b/roles/docker-pihole/tests/inventory @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +localhost + diff --git a/roles/docker-pihole/tests/test.yml b/roles/docker-pihole/tests/test.yml new file mode 100644 index 0000000..d5e3e7b --- /dev/null +++ b/roles/docker-pihole/tests/test.yml @@ -0,0 +1,6 @@ +#SPDX-License-Identifier: MIT-0 +--- +- hosts: localhost + remote_user: root + roles: + - docker-pihole diff --git a/roles/docker-pihole/vars/main.yml b/roles/docker-pihole/vars/main.yml new file mode 100644 index 0000000..a8af199 --- /dev/null +++ b/roles/docker-pihole/vars/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# vars file for docker-pihole diff --git a/roles/docker-socket-proxy/README.md b/roles/docker-socket-proxy/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/roles/docker-socket-proxy/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/roles/docker-socket-proxy/defaults/main.yml b/roles/docker-socket-proxy/defaults/main.yml new file mode 100644 index 0000000..7d9dc9f --- /dev/null +++ b/roles/docker-socket-proxy/defaults/main.yml @@ -0,0 +1,10 @@ +#SPDX-License-Identifier: MIT-0 +--- +# defaults file for docker-pihole +app_name: "docker-socket-proxy" +app_dns_name: "docker-socket-proxy" +app_base_dir: "{{ (docker_apps_dir, app_name) | path_join }}" +app_base_domain: "{{ app_dns_name ~ '.' ~ host_base_domain }}" +app_proxy_network: "traefik-proxy-net" + +dsp_image_name: "ghcr.io/tecnativa/docker-socket-proxy:latest" diff --git a/roles/docker-socket-proxy/handlers/main.yml b/roles/docker-socket-proxy/handlers/main.yml new file mode 100644 index 0000000..820e2e6 --- /dev/null +++ b/roles/docker-socket-proxy/handlers/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# handlers file for docker-socket-proxy diff --git a/roles/docker-socket-proxy/meta/main.yml b/roles/docker-socket-proxy/meta/main.yml new file mode 100644 index 0000000..6f91fd3 --- /dev/null +++ b/roles/docker-socket-proxy/meta/main.yml @@ -0,0 +1,35 @@ +#SPDX-License-Identifier: MIT-0 +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.2 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/roles/docker-socket-proxy/tasks/main.yml b/roles/docker-socket-proxy/tasks/main.yml new file mode 100644 index 0000000..0a2bee2 --- /dev/null +++ b/roles/docker-socket-proxy/tasks/main.yml @@ -0,0 +1,20 @@ +#SPDX-License-Identifier: MIT-0 +--- + +- name: Run Compose App Init + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-init + tags: [create, docker-socket-proxy] + +- name: Run Compose App Start + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-start + tags: [create, docker-socket-proxy] + +- name: Run Compose App Stop + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-stop + tags: [never, stop-docker-socket-proxy] diff --git a/roles/docker-socket-proxy/templates/docker-compose.j2 b/roles/docker-socket-proxy/templates/docker-compose.j2 new file mode 100644 index 0000000..c73a7d0 --- /dev/null +++ b/roles/docker-socket-proxy/templates/docker-compose.j2 @@ -0,0 +1,40 @@ + +services: + {{ app_name }}: + image: {{ dsp_image_name }} + container_name: {{ app_name }} + environment: + - CONTAINERS=1 # Allow access to viewing containers + - SERVICES=1 # Allow access to viewing services (necessary when using Docker Swarm) + - TASKS=1 # Allow access to viewing tasks (necessary when using Docker Swarm) + - POST=0 # Disallow any POST operations (effectively read-only) +{% if app_proxy_network is none %} + ports: + - "{{ host_ip_addr}}:2375:2375/tcp" +{% endif %} + networks: +{% if app_proxy_network is not none %} + {{ app_proxy_network }}: +{% else %} + {{ app_name ~ "-net" }}: +{% endif %} + volumes: + - {{ docker_socket_path }}:/var/run/docker.sock:ro # Mounted as read-only + restart: unless-stopped +{% if app_proxy_network is not none %} + labels: + traefik.enable: true + traefik.docker.network: "{{ app_proxy_network }}" + traefik.http.routers.{{ app_name }}-http.rule: "Host(`{{ app_base_domain }}`)" + traefik.http.routers.{{ app_name }}-http.entryPoints: web + traefik.http.services.{{ app_name }}.loadbalancer.server.port: 2375 +{% endif %} + +networks: +{% if app_proxy_network is not none %} + {{ app_proxy_network }}: + external: true +{% else %} + {{ app_name ~ "-net" }}: +{% endif %} + diff --git a/roles/docker-socket-proxy/tests/inventory b/roles/docker-socket-proxy/tests/inventory new file mode 100644 index 0000000..03ca42f --- /dev/null +++ b/roles/docker-socket-proxy/tests/inventory @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +localhost + diff --git a/roles/docker-socket-proxy/tests/test.yml b/roles/docker-socket-proxy/tests/test.yml new file mode 100644 index 0000000..4482268 --- /dev/null +++ b/roles/docker-socket-proxy/tests/test.yml @@ -0,0 +1,6 @@ +#SPDX-License-Identifier: MIT-0 +--- +- hosts: localhost + remote_user: root + roles: + - docker-socket-proxy diff --git a/roles/docker-socket-proxy/vars/main.yml b/roles/docker-socket-proxy/vars/main.yml new file mode 100644 index 0000000..d51fd1d --- /dev/null +++ b/roles/docker-socket-proxy/vars/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# vars file for docker-socket-proxy diff --git a/roles/docker-traefik-proxy/README.md b/roles/docker-traefik-proxy/README.md new file mode 100644 index 0000000..225dd44 --- /dev/null +++ b/roles/docker-traefik-proxy/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/roles/docker-traefik-proxy/defaults/main.yml b/roles/docker-traefik-proxy/defaults/main.yml new file mode 100644 index 0000000..dc81368 --- /dev/null +++ b/roles/docker-traefik-proxy/defaults/main.yml @@ -0,0 +1,14 @@ +#SPDX-License-Identifier: MIT-0 +--- + +app_name: "traefik" +app_dns_name: "traefik" +app_base_dir: "{{ (docker_apps_dir, app_name) | path_join }}" +app_base_domain: "{{ app_dns_name ~ '.' ~ host_base_domain }}" + +traefik_image_name: "ghcr.io/traefik/traefik" +traefik_proxy_net: "traefik-proxy-net" +traefik_config_dir: "traefik_config" +traefik_log_dir: "traefik_logs" +traefik_net_ip_addr: "172.31.0.2" + diff --git a/roles/docker-traefik-proxy/handlers/main.yml b/roles/docker-traefik-proxy/handlers/main.yml new file mode 100644 index 0000000..c4a1ad5 --- /dev/null +++ b/roles/docker-traefik-proxy/handlers/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# handlers file for docker-traefik-proxy diff --git a/roles/docker-traefik-proxy/meta/main.yml b/roles/docker-traefik-proxy/meta/main.yml new file mode 100644 index 0000000..6f91fd3 --- /dev/null +++ b/roles/docker-traefik-proxy/meta/main.yml @@ -0,0 +1,35 @@ +#SPDX-License-Identifier: MIT-0 +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.2 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/roles/docker-traefik-proxy/tasks/create-app.yml b/roles/docker-traefik-proxy/tasks/create-app.yml new file mode 100644 index 0000000..50a07af --- /dev/null +++ b/roles/docker-traefik-proxy/tasks/create-app.yml @@ -0,0 +1,41 @@ +--- + +- name: Create traefik config dir + ansible.builtin.file: + path: "{{ item }}" + state: directory + loop: + - "{{ (app_base_dir, traefik_config_dir, 'certs') | path_join }}" + - "{{ (app_base_dir, traefik_config_dir, 'letsencrypt') | path_join }}" + - "{{ (app_base_dir, traefik_config_dir, 'plugins') | path_join }}" + - "{{ (app_base_dir, traefik_config_dir, 'rules') | path_join }}" + - "{{ (app_base_dir, traefik_config_dir, 'static') | path_join }}" + + +- name: Write traefik config files + ansible.builtin.template: + src: "{{ item.src }}" + dest: "{{ item.dest }}" + mode: 0644 + owner: matzman + group: matzman + loop: + - { src: "static_traefik.j2", dest: "{{ (app_base_dir, traefik_config_dir, 'static', 'traefik.yml') | path_join }}" } + - { src: "rules_dashboard.j2", dest: "{{ (app_base_dir, traefik_config_dir, 'rules', 'dashboard.yml') | path_join }}" } + - { src: "rules_middleware.j2", dest: "{{ (app_base_dir, traefik_config_dir, 'rules', 'middleware.yml') | path_join }}" } + + +- name: Create traefik-proxy net + community.docker.docker_network: + name: "{{ traefik_proxy_net }}" + driver: bridge + enable_ipv6: true + ipam_config: + - subnet: 172.31.0.0/16 + gateway: 172.31.0.1 + iprange: 172.31.128.0/17 + - subnet: fc30:0882:4324:1::/64 + gateway: fc30:0882:4324:1::1 + iprange: fc30:0882:4324:1:8000::/65 + driver_options: + com.docker.network.bridge.name: br-traefik0 diff --git a/roles/docker-traefik-proxy/tasks/main.yml b/roles/docker-traefik-proxy/tasks/main.yml new file mode 100644 index 0000000..f7f0946 --- /dev/null +++ b/roles/docker-traefik-proxy/tasks/main.yml @@ -0,0 +1,25 @@ +#SPDX-License-Identifier: MIT-0 +--- + +- name: Run Compose App Init + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-init + tags: [create, docker-traefik-proxy] + +- name: Create Docker App + ansible.builtin.import_tasks: create-app.yml + tags: [create, docker-traefik-proxy] + become: true + +- name: Run Compose App Start + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-start + tags: [create, docker-traefik-proxy] + +- name: Run Compose App Stop + ansible.builtin.import_role: + name: docker-common + tasks_from: compose-app-stop + tags: [never, stop-docker-traefik-proxy] diff --git a/roles/docker-traefik-proxy/templates/docker-compose.j2 b/roles/docker-traefik-proxy/templates/docker-compose.j2 new file mode 100644 index 0000000..6336059 --- /dev/null +++ b/roles/docker-traefik-proxy/templates/docker-compose.j2 @@ -0,0 +1,26 @@ + +services: + {{ app_name }}: + image: {{ traefik_image_name }} + container_name: {{ app_name }} + restart: unless-stopped + ports: + - 80:80 + - 443:443 + command: + - --configFile=/etc/traefik/traefik.yml + volumes: + - {{ docker_socket_path }}:/var/run/docker.sock:ro + - ./{{ traefik_config_dir }}/static:/etc/traefik # For traefik.yml + - ./{{ traefik_config_dir }}/rules:/rules # For dynamic configurations + - ./{{ traefik_config_dir }}/letsencrypt:/letsencrypt + - ./{{ traefik_config_dir }}/plugins:/plugins-storage # For Traefik v2 plugins + - ./{{ traefik_log_dir }}:/logfiles + networks: + {{ traefik_proxy_net }}: + ipv4_address: {{ traefik_net_ip_addr }} + + +networks: + {{ traefik_proxy_net }}: + external: true diff --git a/roles/docker-traefik-proxy/templates/rules_dashboard.j2 b/roles/docker-traefik-proxy/templates/rules_dashboard.j2 new file mode 100644 index 0000000..3e4dddc --- /dev/null +++ b/roles/docker-traefik-proxy/templates/rules_dashboard.j2 @@ -0,0 +1,16 @@ +http: + routers: + traefik-dashboard: + rule: Host(`{{ app_base_domain }}`)&&PathPrefix(`/`) + entrypoints: + - web + - websecure + service: dashboard@internal + priority: 10 + traefik-api: + rule: Host(`{{ app_base_domain }}`)&&PathPrefix(`/api`) + entrypoints: + - web + - websecure + service: api@internal + priority: 15 diff --git a/roles/docker-traefik-proxy/templates/rules_middleware.j2 b/roles/docker-traefik-proxy/templates/rules_middleware.j2 new file mode 100644 index 0000000..c8d0f7d --- /dev/null +++ b/roles/docker-traefik-proxy/templates/rules_middleware.j2 @@ -0,0 +1,6 @@ +http: + middlewares: + httpsredirect: + redirectScheme: + scheme: https + permanent: true diff --git a/roles/docker-traefik-proxy/templates/static_traefik.j2 b/roles/docker-traefik-proxy/templates/static_traefik.j2 new file mode 100644 index 0000000..3d65e7d --- /dev/null +++ b/roles/docker-traefik-proxy/templates/static_traefik.j2 @@ -0,0 +1,49 @@ +global: + sendanonymoususage: false + +api: + dashboard: true + disabledashboardad: false + insecure: false + +log: + level: INFO + filePath: "/logfiles/traefik.log" + format: common + +accesslog: + filePath: "/logfiles/access-log.json" + format: json + fields: + headers: + defaultMode: keep + +#tracing: +# otlp: +# http: +# endpoint: http://opentelemetry-collector:4318/v1/traces + +entryPoints: + web: + address: ":80" + observability: + accessLogs: false + websecure: + address: ":443" + http: + tls: true + observability: + accessLogs: false +providers: + docker: + exposedByDefault: false + network: "{{ traefik_proxy_net }}" + file: + directory: /rules + watch: true + +experimental: + plugins: + rewriteHeaders: + modulename: "github.com/vincentinttsh/rewriteheaders" + version: "v1.0.0" diff --git a/roles/docker-traefik-proxy/tests/inventory b/roles/docker-traefik-proxy/tests/inventory new file mode 100644 index 0000000..03ca42f --- /dev/null +++ b/roles/docker-traefik-proxy/tests/inventory @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +localhost + diff --git a/roles/docker-traefik-proxy/tests/test.yml b/roles/docker-traefik-proxy/tests/test.yml new file mode 100644 index 0000000..e4d6243 --- /dev/null +++ b/roles/docker-traefik-proxy/tests/test.yml @@ -0,0 +1,6 @@ +#SPDX-License-Identifier: MIT-0 +--- +- hosts: localhost + remote_user: root + roles: + - docker-traefik-proxy diff --git a/roles/docker-traefik-proxy/vars/main.yml b/roles/docker-traefik-proxy/vars/main.yml new file mode 100644 index 0000000..28a559b --- /dev/null +++ b/roles/docker-traefik-proxy/vars/main.yml @@ -0,0 +1,3 @@ +#SPDX-License-Identifier: MIT-0 +--- +# vars file for docker-traefik-proxy diff --git a/roles/ubuntu-docker-host/defaults/main.yml b/roles/ubuntu-docker-host/defaults/main.yml new file mode 100644 index 0000000..3083b15 --- /dev/null +++ b/roles/ubuntu-docker-host/defaults/main.yml @@ -0,0 +1,16 @@ +#SPDX-License-Identifier: MIT-0 +--- + +# SSH port allowed through INPUT chain +firewall_ssh_port: 22 + +# Additional host-level ports to allow through INPUT chain +firewall_allowed_tcp_ports: [] +firewall_allowed_udp_ports: [] + +# Ports to allow through to Docker containers via DOCKER-USER chain +docker_user_allowed_tcp_ports: [] +docker_user_allowed_udp_ports: [] + +wg_if: wg0 + diff --git a/roles/ubuntu-docker-host/handlers/main.yml b/roles/ubuntu-docker-host/handlers/main.yml new file mode 100644 index 0000000..77bbaf9 --- /dev/null +++ b/roles/ubuntu-docker-host/handlers/main.yml @@ -0,0 +1,28 @@ +#SPDX-License-Identifier: MIT-0 +--- + +- name: Reload iptables + ansible.builtin.service: + name: netfilter-persistent + state: restarted + +- name: Reload ip6tables + ansible.builtin.service: + name: netfilter-persistent + state: restarted + +- name: Restart wg0 + ansible.builtin.systemd: + name: wg-quick@wg0 + state: restarted + become: true + +- name: Restart SSH + ansible.builtin.service: + name: ssh + state: restarted + +- name: Restart Docker + ansible.builtin.service: + name: docker + state: restarted diff --git a/roles/ubuntu-docker-host/tasks/install-ubuntu-docker.yml b/roles/ubuntu-docker-host/tasks/install-ubuntu-docker.yml new file mode 100644 index 0000000..e55889f --- /dev/null +++ b/roles/ubuntu-docker-host/tasks/install-ubuntu-docker.yml @@ -0,0 +1,52 @@ +--- +- name: Ensure dependencies are installed + ansible.builtin.package: + name: + - curl + - ca-certificates + - python3-requests + state: present + +- name: Create Docker GPG key directory + ansible.builtin.file: + path: /etc/apt/keyrings + state: directory + mode: "0755" + +- name: Download Docker's official GPG key + ansible.builtin.get_url: + url: https://download.docker.com/linux/ubuntu/gpg + dest: /etc/apt/keyrings/docker.asc + mode: "0644" + +- name: Add Docker repository to Apt sources + ansible.builtin.apt_repository: + repo: "deb [signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu {{ ansible_facts['distribution_release'] }} stable" + state: present + filename: docker + +- name: Update apt cache after adding Docker repository + ansible.builtin.apt: + update_cache: yes + +- name: Install Docker and Docker Compose + ansible.builtin.package: + name: + - docker-ce + - docker-ce-cli + - containerd.io + - docker-buildx-plugin + - docker-compose-plugin + state: present + +- name: Ensure Docker service is enabled and started + ansible.builtin.service: + name: docker + state: started + enabled: yes + +- name: Add matzman user to docker group + ansible.builtin.user: + name: matzman + groups: docker + append: yes diff --git a/roles/ubuntu-docker-host/tasks/main.yml b/roles/ubuntu-docker-host/tasks/main.yml new file mode 100644 index 0000000..b3c04cc --- /dev/null +++ b/roles/ubuntu-docker-host/tasks/main.yml @@ -0,0 +1,13 @@ +#SPDX-License-Identifier: MIT-0 +--- +# tasks file for ubuntu-docker-base + +- name: Setup Ubuntu for Docker host + ansible.builtin.import_tasks: setup-ubuntu.yml + tags: [ setup-ubuntu ] + become: true + +- name: Install Docker on Ubuntu + ansible.builtin.import_tasks: install-ubuntu-docker.yml + tags: [ install-ubuntu-docker-base ] + become: true diff --git a/roles/ubuntu-docker-host/tasks/setup-ubuntu.yml b/roles/ubuntu-docker-host/tasks/setup-ubuntu.yml new file mode 100644 index 0000000..6c05e8b --- /dev/null +++ b/roles/ubuntu-docker-host/tasks/setup-ubuntu.yml @@ -0,0 +1,209 @@ +--- +- name: Show host IP + ansible.builtin.debug: + msg: "{{ ansible_facts['default_ipv4'] }}" + + +# --- Users & group --- + +- name: Add group matzman + ansible.builtin.group: + name: matzman + state: present + gid: 1000 + +- name: Add user matzman + ansible.builtin.user: + name: matzman + uid: 1000 + group: matzman + create_home: yes + + +# --- Install required packages --- + +- name: Update apt cache + ansible.builtin.apt: + update_cache: yes + become: true + +- name: Upgrade all packages + ansible.builtin.apt: + upgrade: dist + update_cache: yes + +- name: Check if reboot is required + ansible.builtin.stat: + path: /var/run/reboot-required + register: reboot_required + +- name: Reboot if required + ansible.builtin.reboot: + reboot_timeout: 300 + when: reboot_required.stat.exists + +- name: Install custom packages + ansible.builtin.package: + name: + # Required by an ansible task later + - python3-requests + state: present + + +# --- Unattended upgrades --- + +- name: Install unattended-upgrades + ansible.builtin.package: + name: + - unattended-upgrades + - apt-listchanges + state: present + +- name: Enable automatic security upgrades + ansible.builtin.copy: + dest: /etc/apt/apt.conf.d/20auto-upgrades + content: | + APT::Periodic::Update-Package-Lists "1"; + APT::Periodic::Unattended-Upgrade "1"; + mode: "0644" + + +# --- SSH setup --- + +- name: Set authorized key for matzman + ansible.posix.authorized_key: + user: matzman + state: present + key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBi8TS/s2X7W7gb+rGm7A2PG9hRDLa3kYdNM9hLNY0w matzman+2025@matzman.net" + +- name: Set authorized key for root + ansible.posix.authorized_key: + user: root + state: present + key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBi8TS/s2X7W7gb+rGm7A2PG9hRDLa3kYdNM9hLNY0w matzman+2025@matzman.net" + + +# --- SSH hardening --- + +- name: Disable SSH password authentication + ansible.builtin.lineinfile: + path: /etc/ssh/sshd_config + regexp: '^#?PasswordAuthentication' + line: 'PasswordAuthentication no' + notify: Restart SSH + +#- name: Disable SSH root login +# ansible.builtin.lineinfile: +# path: /etc/ssh/sshd_config +# regexp: '^#?PermitRootLogin' +# line: 'PermitRootLogin no' +# notify: Restart SSH + +# --- fail2ban --- + +- name: Install fail2ban + ansible.builtin.package: + name: fail2ban + state: present + +- name: Enable and start fail2ban + ansible.builtin.service: + name: fail2ban + state: started + enabled: yes + + +# --- Wireguard --- + +- name: Install wireguard packages + ansible.builtin.package: + name: + - wireguard-tools + state: present + +- name: Ensure /etc/wireguard directory exists + ansible.builtin.file: + path: /etc/wireguard + state: directory + owner: root + group: root + mode: "0700" + tags: wireguard + +- name: "Deploy {{ wg_if }} config" + ansible.builtin.template: + src: "{{ wg_if }}.conf.j2" + dest: "/etc/wireguard/{{ wg_if }}.conf" + owner: root + group: root + mode: "0600" + notify: Restart wg0 + tags: wireguard + +- name: "Enable and start wg-quick@{{ wg_if }}" + ansible.builtin.systemd: + name: "wg-quick@{{ wg_if }}" + enabled: yes + state: started + tags: wireguard + + +# --- Firewall --- + +- name: Install iptables-persistent + ansible.builtin.package: + name: + - iptables-persistent + - netfilter-persistent + state: present + +- name: Deploy iptables rules (IPv4) + ansible.builtin.template: + src: rules.v4.j2 + dest: /etc/iptables/rules.v4 + mode: "0640" + notify: + - Reload iptables + - Restart Docker + +- name: Deploy iptables rules (IPv6) + ansible.builtin.template: + src: rules.v6.j2 + dest: /etc/iptables/rules.v6 + mode: "0640" + notify: + - Reload ip6tables + - Restart Docker + +# --- sysctl hardening --- + +- name: Configure sysctl security settings + ansible.posix.sysctl: + name: "{{ item.name }}" + value: "{{ item.value }}" + state: present + reload: yes + loop: + - { name: 'net.ipv4.conf.all.rp_filter', value: '1' } + - { name: 'net.ipv4.conf.default.rp_filter', value: '1' } + - { name: 'net.ipv4.conf.all.accept_redirects', value: '0' } + - { name: 'net.ipv4.conf.default.accept_redirects', value: '0' } + - { name: 'net.ipv4.conf.all.send_redirects', value: '0' } + - { name: 'net.ipv4.conf.default.send_redirects', value: '0' } + + +# --- Audit logging --- + +- name: Install auditd + ansible.builtin.package: + name: auditd + state: present + +- name: Enable and start auditd + ansible.builtin.service: + name: auditd + state: started + enabled: yes + + + diff --git a/roles/ubuntu-docker-host/templates/rules.v4.j2 b/roles/ubuntu-docker-host/templates/rules.v4.j2 new file mode 100644 index 0000000..a2ac67f --- /dev/null +++ b/roles/ubuntu-docker-host/templates/rules.v4.j2 @@ -0,0 +1,55 @@ +# Managed by Ansible — do not edit manually + +*filter + +:INPUT DROP [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER-USER - [0:0] + + +# --- INPUT --- + +# Allow loopback +-A INPUT -i lo -j ACCEPT + +# Allow established/related connections +-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + +# Allow SSH +-A INPUT -p tcp --dport {{ firewall_ssh_port }} -j ACCEPT + +# Allow additional host ports +{% for port in firewall_allowed_tcp_ports %} +-A INPUT -p tcp --dport {{ port }} -j ACCEPT +{% endfor %} +{% for port in firewall_allowed_udp_ports %} +-A INPUT -p udp --dport {{ port }} -j ACCEPT +{% endfor %} + + +# --- DOCKER-USER --- + +# Allow loopback +-A DOCKER-USER -i lo -j RETURN + +# Allow outgoing from Docker IP range +-A DOCKER-USER -s 172.16.0.0/12 -j RETURN + +# Whitelist specific TCP ports to containers +{% for port in docker_user_allowed_tcp_ports %} +-A DOCKER-USER -p tcp --dport {{ port }} -j RETURN +{% endfor %} + +# Whitelist specific UDP ports to containers +{% for port in docker_user_allowed_udp_ports %} +-A DOCKER-USER -p udp --dport {{ port }} -j RETURN +{% endfor %} + +# Allow all already established connections +-A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN + +# Drop everything else to containers +-A DOCKER-USER -j DROP + +COMMIT diff --git a/roles/ubuntu-docker-host/templates/rules.v6.j2 b/roles/ubuntu-docker-host/templates/rules.v6.j2 new file mode 100644 index 0000000..a2ac67f --- /dev/null +++ b/roles/ubuntu-docker-host/templates/rules.v6.j2 @@ -0,0 +1,55 @@ +# Managed by Ansible — do not edit manually + +*filter + +:INPUT DROP [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:DOCKER-USER - [0:0] + + +# --- INPUT --- + +# Allow loopback +-A INPUT -i lo -j ACCEPT + +# Allow established/related connections +-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + +# Allow SSH +-A INPUT -p tcp --dport {{ firewall_ssh_port }} -j ACCEPT + +# Allow additional host ports +{% for port in firewall_allowed_tcp_ports %} +-A INPUT -p tcp --dport {{ port }} -j ACCEPT +{% endfor %} +{% for port in firewall_allowed_udp_ports %} +-A INPUT -p udp --dport {{ port }} -j ACCEPT +{% endfor %} + + +# --- DOCKER-USER --- + +# Allow loopback +-A DOCKER-USER -i lo -j RETURN + +# Allow outgoing from Docker IP range +-A DOCKER-USER -s 172.16.0.0/12 -j RETURN + +# Whitelist specific TCP ports to containers +{% for port in docker_user_allowed_tcp_ports %} +-A DOCKER-USER -p tcp --dport {{ port }} -j RETURN +{% endfor %} + +# Whitelist specific UDP ports to containers +{% for port in docker_user_allowed_udp_ports %} +-A DOCKER-USER -p udp --dport {{ port }} -j RETURN +{% endfor %} + +# Allow all already established connections +-A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN + +# Drop everything else to containers +-A DOCKER-USER -j DROP + +COMMIT diff --git a/roles/ubuntu-docker-host/templates/wg0.conf.j2 b/roles/ubuntu-docker-host/templates/wg0.conf.j2 new file mode 100644 index 0000000..5d3349f --- /dev/null +++ b/roles/ubuntu-docker-host/templates/wg0.conf.j2 @@ -0,0 +1,23 @@ +# Managed by Ansible — do not edit manually + +[Interface] +Address = {{ wg_nets[wg_if].hosts[inventory_hostname].address }} +ListenPort = {{ wg_nets[wg_if].hosts[inventory_hostname].port }} +PrivateKey = {{ wg_nets[wg_if].secrect[inventory_hostname].private_key }} +{% if wg_nets[wg_if].hosts[inventory_hostname].dnsserver is defined %} +DNS = {{ wg_nets[wg_if].hosts[inventory_hostname].dnsserver }} +{% endif %} + +{% for peer, data in wg_nets[wg_if].hosts[inventory_hostname].peers.items() %} +# {{ peer }} +[Peer] +PublicKey = {{ wg_nets[wg_if].hosts[peer].public_key }} +AllowedIPs = {{ data.allowed_ips }} +{% if data.preshared_key is defined %} +PresharedKey = {{ data.preshared_key }} +{% endif %} +{% if data.keepalive is defined %} +PersistentKeepalive = {{ data.keepalive }} +{% endif %} + +{% endfor %} diff --git a/roles/wireguard/defaults/main.yml b/roles/wireguard/defaults/main.yml new file mode 100644 index 0000000..fc2af08 --- /dev/null +++ b/roles/wireguard/defaults/main.yml @@ -0,0 +1,23 @@ +#SPDX-License-Identifier: MIT-0 +--- +wireguard_port: 51820 +wireguard_interface: wg0 + +# Server private key — store in Ansible Vault in host_vars +# wireguard_private_key: "YOUR_PRIVATE_KEY" + +# Server address in the WireGuard subnet, e.g. "10.0.0.1/24" +# wireguard_address: "10.0.0.1/24" + +# Optional: DNS server pushed to clients +# wireguard_dns: "1.1.1.1" + +# Peers — defined per host in host_vars +# wireguard_peers: +# - name: client1 +# public_key: "CLIENT_PUBLIC_KEY" +# allowed_ips: "10.0.0.2/32" +# - name: client2 +# public_key: "CLIENT_PUBLIC_KEY" +# allowed_ips: "10.0.0.3/32" +wireguard_peers: [] diff --git a/roles/wireguard/handlers/main.yml b/roles/wireguard/handlers/main.yml new file mode 100644 index 0000000..1adf95a --- /dev/null +++ b/roles/wireguard/handlers/main.yml @@ -0,0 +1,7 @@ +#SPDX-License-Identifier: MIT-0 +--- +- name: Restart wg0 + ansible.builtin.systemd: + name: wg-quick@wg0 + state: restarted + become: true diff --git a/roles/wireguard/tasks/main.yml b/roles/wireguard/tasks/main.yml new file mode 100644 index 0000000..a374e90 --- /dev/null +++ b/roles/wireguard/tasks/main.yml @@ -0,0 +1,33 @@ +#SPDX-License-Identifier: MIT-0 +--- +- name: Install wireguard-tools + ansible.builtin.package: + name: wireguard-tools + state: present + become: true + +- name: Ensure /etc/wireguard directory exists + ansible.builtin.file: + path: /etc/wireguard + state: directory + owner: root + group: root + mode: "0700" + become: true + +- name: Deploy wg0 config + ansible.builtin.template: + src: wg0.conf.j2 + dest: /etc/wireguard/wg0.conf + owner: root + group: root + mode: "0600" + become: true + notify: Restart wg0 + +- name: Enable and start wg-quick@wg0 + ansible.builtin.systemd: + name: wg-quick@wg0 + enabled: yes + state: started + become: true diff --git a/roles/wireguard/templates/wg0.conf.j2 b/roles/wireguard/templates/wg0.conf.j2 new file mode 100644 index 0000000..a16cc70 --- /dev/null +++ b/roles/wireguard/templates/wg0.conf.j2 @@ -0,0 +1,22 @@ +# Managed by Ansible — do not edit manually +[Interface] +Address = {{ wireguard_address }} +ListenPort = {{ wireguard_port }} +PrivateKey = {{ wireguard_private_key }} +{% if wireguard_dns is defined %} +DNS = {{ wireguard_dns }} +{% endif %} + +{% for peer in wireguard_peers %} +# {{ peer.name }} +[Peer] +PublicKey = {{ peer.public_key }} +AllowedIPs = {{ peer.allowed_ips }} +{% if peer.preshared_key is defined %} +PresharedKey = {{ peer.preshared_key }} +{% endif %} +{% if peer.keepalive is defined %} +PersistentKeepalive = {{ peer.keepalive }} +{% endif %} + +{% endfor %} diff --git a/site.yml b/site.yml new file mode 100644 index 0000000..7a52066 --- /dev/null +++ b/site.yml @@ -0,0 +1,13 @@ +# This is your main playbook you will run with: +# ansible-playbook site.yml +# You can kick off everything from this playbook. +# Or, you can create separate playbooks in this directory for specific orchestration events. + +--- +- name: apply common configuration to all nodes + hosts: all + user: root + + roles: + - common + diff --git a/test01.yml b/test01.yml new file mode 100644 index 0000000..1fa518c --- /dev/null +++ b/test01.yml @@ -0,0 +1,46 @@ +--- + +- hosts: vserver1.matzman.net + roles: + - role: ubuntu-docker-host + vars: + firewall_allowed_tcp_ports: + - 80 + - 443 + firewall_allowed_udp_ports: [] + docker_user_allowed_tcp_ports: + - 80 + - 443 + docker_user_allowed_udp_ports: [] + + wg_nets: + wg0: + secrect: + vserver1.matzman.net: + private_key: "oJOaTfNDU5dxj3aUpTOHE98FCg/Dx4agwV6pXg8OTWc=" + + hosts: + vserver1.matzman.net: + address: "10.0.0.1/24" + port: 51432 + public_key: "IGo70n2CfouTLUSrzqRiCfU9iU++sJ1cJSuPO6tsoGw=" + endpoint: "vserver.matzman.net" + peers: + client1: + allowed_ips: "10.0.0.2/32" + + client1: + address: "10.0.0.2/24" + public_key: "IGo70n2CfouTLUSrzqRiCfU9iU++sJ1cJSuPO6tsoGw=" + peers: + vserver1.matzman.net: + allowed_ips: "0.0.0.0/0" + + - role: docker-host + - role: docker-traefik-proxy + vars: + app_name: "traefik-vserver1" + - role: docker-arcane + vars: + app_name: "arcane-vserver1" + - role: docker-socket-proxy diff --git a/testing b/testing new file mode 100644 index 0000000..6ac57cf --- /dev/null +++ b/testing @@ -0,0 +1,5 @@ + +localhost ansible_connection=local ansible_python_interpreter="{{ansible_playbook_python}}" host_ip_addr="10.61.1.20" host_base_domain="localhost" + +[vhosts] +vserver1.matzman.net ansible_connection=ssh ansible_user=root host_ip_addr="185.242.113.24" host_base_domain="vserver1.matzman.net"