From b232b894c3cbe087c8d504e91637dcf62199eed1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Romain=20Gon=C3=A7alves?= Date: Thu, 29 Jul 2021 17:00:20 +0200 Subject: Bump to third revision of homelab --- ansible.cfg | 5 +- group_vars/all.yml | 3 + host_vars/st0cld0.yml | 30 +- host_vars/st0dc1.yml | 20 + host_vars/st0dev0.yml | 20 +- host_vars/st0dev1.yml | 13 - host_vars/st0gme0.yml | 6 +- host_vars/stack0.yml | 14 +- playbooks/dc0.rgoncalves.se.yml | 19 +- playbooks/extra/prerequisites.yml | 10 +- playbooks/network/grafana.yml | 10 +- playbooks/network/nfs.yml | 14 - playbooks/network/templates | 1 + playbooks/st0cld0.rgoncalves.se.yml | 10 +- playbooks/st0dc1.rgoncalves.se.yml | 12 + playbooks/st0dev0.rgoncalves.se.yml | 9 +- playbooks/st0dev1.rgoncalves.se.yml | 14 - playbooks/stack0.rgoncalves.se.yml | 3 +- playbooks/utils/nfsd-hypervisor.yml | 6 + playbooks/workstation.yml | 8 - roles/_workstation/env/tasks/main.yml | 7 + roles/_workstation/sshdns/defaults/main.yml | 3 - roles/_workstation/sshdns/tasks/main.yml | 17 - roles/_workstation/sshdns/templates/sshdns.j2 | 20 - roles/acme/defaults/main.yml | 6 + roles/acme/tasks/main.yml | 14 +- roles/acme/vars/main.yml | 6 - roles/bhyve/templates/openbsd.conf.j2 | 2 +- roles/cgit/defaults/main.yml | 7 +- roles/cgit/meta/main.yml | 12 +- roles/cgit/tasks/main.yml | 48 +- roles/cgit/templates/conf-cgitrc.j2 | 41 + roles/cgit/templates/conf-footer.html.j2 | 3 + roles/cgit/templates/etc-httpd.d-cgit.conf.j2 | 10 +- roles/cgit/templates/var-www-conf-cgitrc.j2 | 39 - roles/common/tasks/main.yml | 1 - roles/git/defaults/main.yml | 12 + roles/git/tasks/main.yml | 53 +- roles/git/templates/gitconfig.j2 | 2 + roles/git/vars/main.yml | 11 - roles/grafana/defaults/main.yml | 8 + roles/grafana/tasks/main.yml | 47 +- roles/grafana/templates/datasources-default.yml.j2 | 16 + roles/grafana/templates/etc-grafana.ini.j2 | 246 ++++++ roles/grafana/templates/grafana.conf.nginx.j2 | 9 - roles/grafana/templates/grafana.ini.j2 | 852 --------------------- roles/grafana/vars/main.yml | 14 - roles/htpasswd/defaults/main.yml | 4 + roles/htpasswd/tasks/main.yml | 11 + roles/httpd/defaults/main.yml | 3 + roles/httpd/tasks/main.yml | 1 - roles/httpd/templates/httpd.conf.j2 | 2 +- roles/httpd_pre/tasks/main.yml | 16 +- roles/ldapd/defaults/main.yml | 3 + roles/ldapd/tasks/main.yml | 22 + roles/ldapd/templates/etc-ldapd.conf.j2 | 23 + roles/loki/tasks/main.yml | 10 + roles/miniflux/meta/main.yml | 9 +- roles/miniflux/tasks/main.yml | 36 +- roles/miniflux/vars/main.yml | 2 + roles/nfsclient/defaults/main.yml | 3 + roles/nfsclient/tasks/main.yml | 50 +- roles/nfsd/defaults/main.yml | 7 +- roles/nfsd/tasks/main.yml | 22 +- roles/nfsd/templates/etc-exports.j2 | 2 +- roles/pf/templates/pf.conf.j2 | 4 +- roles/postgres/defaults/main.yml | 5 + roles/postgres/tasks/create_db.yml | 4 + roles/postgres/tasks/create_user.yml | 4 + roles/postgres/tasks/main.yml | 31 +- roles/postgres/vars/main.yml | 10 - roles/repositories/defaults/main.yml | 14 + roles/repositories/vars/main.yml | 14 - roles/sshd/tasks/main.yml | 70 +- roles/sshd/tasks/sync_keys.yml | 68 ++ roles/sshdns/defaults/main.yml | 1 + roles/sshdns/tasks/main.yml | 25 + roles/sshdns/templates/sshdns.j2 | 20 + roles/tools/defaults/main.yml | 34 + roles/tools/vars/main.yml | 34 - roles/wireguard/tasks/main.yml | 29 +- roles/wireguard/tasks/server.yml | 28 +- roles/wireguard/tasks/service.yml | 17 + roles/wireguard/templates/dcontroller.conf.j2 | 2 +- roles/wireguard/templates/hostname.j2 | 3 +- 85 files changed, 879 insertions(+), 1497 deletions(-) create mode 100644 host_vars/st0dc1.yml delete mode 100644 host_vars/st0dev1.yml create mode 120000 playbooks/network/templates create mode 100644 playbooks/st0dc1.rgoncalves.se.yml delete mode 100644 playbooks/st0dev1.rgoncalves.se.yml create mode 100644 playbooks/utils/nfsd-hypervisor.yml delete mode 100644 roles/_workstation/sshdns/defaults/main.yml delete mode 100644 roles/_workstation/sshdns/tasks/main.yml delete mode 100644 roles/_workstation/sshdns/templates/sshdns.j2 create mode 100644 roles/acme/defaults/main.yml delete mode 100644 roles/acme/vars/main.yml create mode 100644 roles/cgit/templates/conf-cgitrc.j2 create mode 100644 roles/cgit/templates/conf-footer.html.j2 delete mode 100644 roles/cgit/templates/var-www-conf-cgitrc.j2 create mode 100644 roles/git/defaults/main.yml create mode 100644 roles/git/templates/gitconfig.j2 delete mode 100644 roles/git/vars/main.yml create mode 100644 roles/grafana/defaults/main.yml create mode 100644 roles/grafana/templates/datasources-default.yml.j2 create mode 100644 roles/grafana/templates/etc-grafana.ini.j2 delete mode 100644 roles/grafana/templates/grafana.conf.nginx.j2 delete mode 100644 roles/grafana/templates/grafana.ini.j2 delete mode 100644 roles/grafana/vars/main.yml create mode 100644 roles/htpasswd/defaults/main.yml create mode 100644 roles/htpasswd/tasks/main.yml create mode 100644 roles/httpd/defaults/main.yml create mode 100644 roles/ldapd/defaults/main.yml create mode 100644 roles/ldapd/tasks/main.yml create mode 100644 roles/ldapd/templates/etc-ldapd.conf.j2 create mode 100644 roles/loki/tasks/main.yml create mode 100644 roles/postgres/defaults/main.yml create mode 100644 roles/postgres/tasks/create_db.yml create mode 100644 roles/postgres/tasks/create_user.yml delete mode 100644 roles/postgres/vars/main.yml create mode 100644 roles/repositories/defaults/main.yml delete mode 100644 roles/repositories/vars/main.yml create mode 100644 roles/sshd/tasks/sync_keys.yml create mode 100644 roles/sshdns/defaults/main.yml create mode 100644 roles/sshdns/tasks/main.yml create mode 100644 roles/sshdns/templates/sshdns.j2 create mode 100644 roles/tools/defaults/main.yml delete mode 100644 roles/tools/vars/main.yml create mode 100644 roles/wireguard/tasks/service.yml diff --git a/ansible.cfg b/ansible.cfg index 65e74eb..6975f69 100644 --- a/ansible.cfg +++ b/ansible.cfg @@ -12,8 +12,9 @@ default_fact_path = /etc/ansible/facts.d/:facts.d/ stdout_callback = yaml stderr_callback = yaml -timeout = 4 -command_warnings=False +timeout = 20 +system_warnings = True +deprecation_warnings = True [ssh_connection] pipelining = True diff --git a/group_vars/all.yml b/group_vars/all.yml index e5b47b0..729f89a 100644 --- a/group_vars/all.yml +++ b/group_vars/all.yml @@ -9,6 +9,9 @@ ansible_become_method: "su" path_prometheusconfig: "/etc/prometheus/prometheus.yml" +#nfsclient_server: "stack0" +#nfsclient_server_dir: "/data/nfs" + global: dcontroller: "dc0" diff --git a/host_vars/st0cld0.yml b/host_vars/st0cld0.yml index bb85530..b2812e7 100644 --- a/host_vars/st0cld0.yml +++ b/host_vars/st0cld0.yml @@ -1,27 +1,23 @@ _groups: openbsd ip: - in: 10.10.0.61 - out: 192.168.5.61 + in: 10.10.0.62 + out: 192.168.5.62 virtual: true services: - - name: "ssh" - proto: "tcp" - port: "22" + - name: ssh + proto: tcp + port: 22 - - name: "grafana" - proto: "tcp" - port: "3000" + - name: nextcloud + proto: tcp + port: 8080 + domain: cloud - - name: "nextcloud" - proto: "tcp" - port: "8080" - domain: "cloud" - - - name: "miniflux" - proto: "tcp" - port: "8010" - domain: "miniflux" + - name: miniflux + proto: tcp + port: 8010 + domain: miniflux diff --git a/host_vars/st0dc1.yml b/host_vars/st0dc1.yml new file mode 100644 index 0000000..ad9ad6b --- /dev/null +++ b/host_vars/st0dc1.yml @@ -0,0 +1,20 @@ +_groups: openbsd + +virtual: true + +ip: + in: 10.10.0.60 + out: 192.168.5.60 + +services: + - name: ssh + proto: tcp + port: 22 + + - name: grafana + proto: tcp + port: 3000 + domain: status + +cgit_config_root_desc: private - development hub +cgit_authenticate: true diff --git a/host_vars/st0dev0.yml b/host_vars/st0dev0.yml index b15794b..86731bf 100644 --- a/host_vars/st0dev0.yml +++ b/host_vars/st0dev0.yml @@ -1,17 +1,17 @@ _groups: openbsd + ip: - in: 10.10.0.60 - out: 192.168.5.60 + in: 10.10.0.61 + out: 192.168.5.61 virtual: true services: + - name: ssh + proto: tcp + port: 22 - - name: "ssh" - proto: "tcp" - port: "22" - - - name: "cgit" - proto: "tcp" - port: "1235" - domain: "git" + - name: git + proto: tcp + port: 1235 + domain: git diff --git a/host_vars/st0dev1.yml b/host_vars/st0dev1.yml deleted file mode 100644 index fd92220..0000000 --- a/host_vars/st0dev1.yml +++ /dev/null @@ -1,13 +0,0 @@ -_groups: openbsd -ip: - in: 10.10.0.63 - out: 192.168.5.63 - -virtual: true - -services: - - - name: "ssh" - proto: "tcp" - port: "22" - diff --git a/host_vars/st0gme0.yml b/host_vars/st0gme0.yml index f193f2a..4f25d74 100644 --- a/host_vars/st0gme0.yml +++ b/host_vars/st0gme0.yml @@ -1,12 +1,12 @@ _groups: alpine + ip: - in: 10.10.0.62 - out: 192.168.5.62 + in: 10.10.0.63 + out: 192.168.5.63 virtual: true services: - - name: "ssh" proto: "tcp" port: "22" diff --git a/host_vars/stack0.yml b/host_vars/stack0.yml index 5a6e27d..1fe5d47 100644 --- a/host_vars/stack0.yml +++ b/host_vars/stack0.yml @@ -7,31 +7,29 @@ ip: virtual: false services: - - name: "ssh" proto: "tcp" port: "22" vms: - - - name: st0dev0 + - name: st0dc1 image: openbsd memory: 4G - cpu: 4 + cpu: 2 disks: - { id: 0, size: "8G" } - - name: st0dev1 + - name: st0dev0 image: openbsd - memory: 4G + memory: 2G cpu: 2 disks: - { id: 0, size: "8G" } - name: st0cld0 image: openbsd - memory: 8G - cpu: 4 + memory: 4G + cpu: 2 disks: - { id: 0, size: "8G" } diff --git a/playbooks/dc0.rgoncalves.se.yml b/playbooks/dc0.rgoncalves.se.yml index 53ba6aa..d54df56 100644 --- a/playbooks/dc0.rgoncalves.se.yml +++ b/playbooks/dc0.rgoncalves.se.yml @@ -6,10 +6,15 @@ - hosts: dc0 roles: - - - { role: znc, tags: "role_znc" } - - { role: website, tags: "role_website" } - - { role: httpd, tags: "role_httpd" } - - { role: acme, tags: "role_acme" } - - { role: relayd, tags: "role_relayd" } - - { role: pf, tags: "role_pf" } + - role: znc + tags: role_znc + - role: website + tags: role_website + - role: httpd + tags: role_httpd + - role: acme + tags: role_acme + - role: relayd + tags: role_relayd + - role: pf + tags: role_pf diff --git a/playbooks/extra/prerequisites.yml b/playbooks/extra/prerequisites.yml index a80d85e..eddb418 100644 --- a/playbooks/extra/prerequisites.yml +++ b/playbooks/extra/prerequisites.yml @@ -10,10 +10,10 @@ tasks: - name: bruteforce python installation with all packages possiblity - raw: "{{ item }}" + raw: | + pkg_add python3 + pkg install python3 + apk add python ignore_errors: true - loop: - - pkg_add python3 - - pkg install python3 - - apk add python + failed_when: false poll: 0 diff --git a/playbooks/network/grafana.yml b/playbooks/network/grafana.yml index 30bc0f4..4c039bd 100644 --- a/playbooks/network/grafana.yml +++ b/playbooks/network/grafana.yml @@ -6,8 +6,12 @@ - hosts: servers roles: - - { role: prometheus } + - role: loki + tags: role_loki + - role: prometheus + tags: role_prometheus -- hosts: st0cld0 +- hosts: st0dc1 roles: - - { role: grafana } + - role: grafana + tags: role_grafana diff --git a/playbooks/network/nfs.yml b/playbooks/network/nfs.yml index 1b8717e..9d1f73b 100644 --- a/playbooks/network/nfs.yml +++ b/playbooks/network/nfs.yml @@ -1,17 +1,3 @@ - -# network/nfs ~~ playbooks/nfs/network.yml -# nfs network playbook - ---- - -- name: ensure installation and configuration on server side - hosts: stack0 - roles: - - role: nfsd - vars: - nfsd_dirs: "{% for vm in vms %}{{ vm.name }} {% endfor %}" - tags: play_network_nfsserver - - name: ensure installation and configuration on client side hosts: ~st[0-9].* roles: diff --git a/playbooks/network/templates b/playbooks/network/templates new file mode 120000 index 0000000..07531b7 --- /dev/null +++ b/playbooks/network/templates @@ -0,0 +1 @@ +../../templates \ No newline at end of file diff --git a/playbooks/st0cld0.rgoncalves.se.yml b/playbooks/st0cld0.rgoncalves.se.yml index 2286395..2870e3a 100644 --- a/playbooks/st0cld0.rgoncalves.se.yml +++ b/playbooks/st0cld0.rgoncalves.se.yml @@ -6,7 +6,9 @@ - hosts: st0cld0 roles: - - { role: nextcloud, tags: "role_nextcloud" } - - { role: miniflux, tags: "role_miniflux" } - - { role: syncthing, tags: "role_syncthing" } - - { role: httpd, tags: "role_httpd" } + - role: miniflux + tags: role_miniflux + - role: syncthing + tags: role_syncthing + - role: httpd + tags: role_httpd diff --git a/playbooks/st0dc1.rgoncalves.se.yml b/playbooks/st0dc1.rgoncalves.se.yml new file mode 100644 index 0000000..e99768f --- /dev/null +++ b/playbooks/st0dc1.rgoncalves.se.yml @@ -0,0 +1,12 @@ +- hosts: st0dc1 + roles: + - role: ldapd + tags: role_ldapd + - role: postgres + tags: role_postgres + - role: grafana + tags: role_grafana + - role: cgit + tags: role_cgit + - role: httpd + tags: role_httpd diff --git a/playbooks/st0dev0.rgoncalves.se.yml b/playbooks/st0dev0.rgoncalves.se.yml index fbee649..5fd98aa 100644 --- a/playbooks/st0dev0.rgoncalves.se.yml +++ b/playbooks/st0dev0.rgoncalves.se.yml @@ -6,8 +6,7 @@ - hosts: st0dev0 roles: - - { role: gitdaemon } - - { role: cgit } - - { role: jenkins } - - { role: httpd } - - { role: sshd } + - role: cgit + tags: role_cgit + - role: httpd + tags_role: httpd diff --git a/playbooks/st0dev1.rgoncalves.se.yml b/playbooks/st0dev1.rgoncalves.se.yml deleted file mode 100644 index 5d568d5..0000000 --- a/playbooks/st0dev1.rgoncalves.se.yml +++ /dev/null @@ -1,14 +0,0 @@ - -# st0dev1 ~~ playbooks/st0dev0.rgoncalves.se.yml -# openbsd based development system -- private operations - ---- - -- hosts: st0dev1 - vars: - cgit_config_root_desc: "private - development hub" - cgit_authenticate: true - - roles: - - { role: cgit } - - { role: httpd } diff --git a/playbooks/stack0.rgoncalves.se.yml b/playbooks/stack0.rgoncalves.se.yml index 2fcf803..e8af5d1 100644 --- a/playbooks/stack0.rgoncalves.se.yml +++ b/playbooks/stack0.rgoncalves.se.yml @@ -6,5 +6,6 @@ - hosts: stack0 roles: - - { role: bhyve } + - role: nfsd + nfsd_dirs: "{{ vms | flatten | map(attribute='name') | flatten }}" diff --git a/playbooks/utils/nfsd-hypervisor.yml b/playbooks/utils/nfsd-hypervisor.yml new file mode 100644 index 0000000..df59645 --- /dev/null +++ b/playbooks/utils/nfsd-hypervisor.yml @@ -0,0 +1,6 @@ +--- + +- roles: + - role: nfsd + vars: + nfsd_dirs: "{% for vm in vms %}{{ vm.name }} {% endfor %}" diff --git a/playbooks/workstation.yml b/playbooks/workstation.yml index 2a3534e..1b1acc3 100644 --- a/playbooks/workstation.yml +++ b/playbooks/workstation.yml @@ -5,11 +5,6 @@ --- - hosts: localhost - pre_tasks: - - fail: - msg: must be run as root! - when: lookup('env', 'USER') != "root" - roles: - role: _workstation/env tags: env, always @@ -22,6 +17,3 @@ - role: _workstation/sysconf tags: sysconf - - - role: update - tags: update diff --git a/roles/_workstation/env/tasks/main.yml b/roles/_workstation/env/tasks/main.yml index 261170e..ff9acd2 100644 --- a/roles/_workstation/env/tasks/main.yml +++ b/roles/_workstation/env/tasks/main.yml @@ -12,6 +12,13 @@ shell: cat /etc/passwd | cut -d ":" -f 1 register: result +- name: retrieve current user + shell: whoami + register: result_ + +- set_fact: + _ws_user: "{{ result_.stdout_lines[0] }}" + - name: check if target user exists fail: msg: _ws_user is not a valid user diff --git a/roles/_workstation/sshdns/defaults/main.yml b/roles/_workstation/sshdns/defaults/main.yml deleted file mode 100644 index 9427f1d..0000000 --- a/roles/_workstation/sshdns/defaults/main.yml +++ /dev/null @@ -1,3 +0,0 @@ ---- - -sshdns_waittime: 2 diff --git a/roles/_workstation/sshdns/tasks/main.yml b/roles/_workstation/sshdns/tasks/main.yml deleted file mode 100644 index daf8f61..0000000 --- a/roles/_workstation/sshdns/tasks/main.yml +++ /dev/null @@ -1,17 +0,0 @@ ---- - -- name: create config directory - file: - path: '/home/{{ _ws_user }}/.ssh/config.d' - state: directory - group: '{{ _ws_user }}' - owner: '{{ _ws_user }}' - mode: '0700' - -- name: generate template to localhost - template: - src: templates/sshdns.j2 - dest: '/home/{{ _ws_user }}//.ssh/config.d/ssh_dns' - owner: '{{ _ws_user }}' - group: '{{ _ws_user }}' - mode: '0600' diff --git a/roles/_workstation/sshdns/templates/sshdns.j2 b/roles/_workstation/sshdns/templates/sshdns.j2 deleted file mode 100644 index 1778215..0000000 --- a/roles/_workstation/sshdns/templates/sshdns.j2 +++ /dev/null @@ -1,20 +0,0 @@ -{% import 'macros.j2' as macros with context %} - -# ssh configuration for dns ~~ ~/.ssh/.config.d/ -# managed by Ansible - -{% set dcontroller = hostvars[global.dcontroller] %} -{% call(h) macros.loop_hosts("servers") %} -{% if h.ip is defined and h.services is defined %} -{% set _port = h.services | selectattr("name", "equalto", "ssh") | map(attribute="port") | list | join(' ') %} -# {{ h.ansible_host }} -Match originalhost {{ h.ansible_host }} exec "ping -c 1 -w {{ sshdns_waittime }} {{ dcontroller.ip.in }} && ! ping -c 1 -w {{ sshdns_waittime }} {{ h.ip.out }}" - HostName {{ h.ip.in }} - Port {{ _port }} -Match originalhost {{ h.ansible_host }} - HostName {{ h.ip.out }} - Port {{ _port }} - User root - -{% endif %} -{% endcall %} diff --git a/roles/acme/defaults/main.yml b/roles/acme/defaults/main.yml new file mode 100644 index 0000000..a67c5c6 --- /dev/null +++ b/roles/acme/defaults/main.yml @@ -0,0 +1,6 @@ + +# acme ~~ roles/acme/tasks/main.yml +# acme variables + +--- + diff --git a/roles/acme/tasks/main.yml b/roles/acme/tasks/main.yml index 9d413b0..e7eb9bf 100644 --- a/roles/acme/tasks/main.yml +++ b/roles/acme/tasks/main.yml @@ -1,15 +1,3 @@ - -# acme ~~ roles/acme/tasks/main.yml -# acme-client initialization -# OPENBSD-ONLY - ---- - -- name: ensure acme-client is installed - package: - name: acme-client - state: present - - name: generate acme-client configuration template: src: acme-client.conf.j2 @@ -26,7 +14,7 @@ shell: acme-client -v {{ item }} loop: "{{ subdomains.stdout_lines }}" register: result - failed_when: result.rc not in [ 0, 2 ] + failed_when: result.rc not in [0, 2] - name: show acme-client output debug: diff --git a/roles/acme/vars/main.yml b/roles/acme/vars/main.yml deleted file mode 100644 index a67c5c6..0000000 --- a/roles/acme/vars/main.yml +++ /dev/null @@ -1,6 +0,0 @@ - -# acme ~~ roles/acme/tasks/main.yml -# acme variables - ---- - diff --git a/roles/bhyve/templates/openbsd.conf.j2 b/roles/bhyve/templates/openbsd.conf.j2 index c791c6c..de67cdb 100644 --- a/roles/bhyve/templates/openbsd.conf.j2 +++ b/roles/bhyve/templates/openbsd.conf.j2 @@ -8,7 +8,7 @@ network0_switch="{{ guest_switch }}" disk0_type="virtio-blk" disk0_name="disk0.img" -grub_install0="kopenbsd -h com0 /6.8/amd64/bsd.rd" +grub_install0="kopenbsd -h com0 /6.9/amd64/bsd.rd" grub_run0="kopenbsd -h com0 -r sd0a /bsd" bhyve_options="-w" diff --git a/roles/cgit/defaults/main.yml b/roles/cgit/defaults/main.yml index ffbca1d..9fe8961 100644 --- a/roles/cgit/defaults/main.yml +++ b/roles/cgit/defaults/main.yml @@ -6,8 +6,12 @@ cgit_user: "git" cgit_group: "git" +cgit_instance: "cgit" + cgit_git_dir: "/data/git" -cgit_git_dir_chroot: "/htdocs/cgit" +cgit_chroot_dir: "/var/www" + +cgit_ip: 0.0.0.0 cgit_port: 1235 cgit_authenticate: false @@ -16,3 +20,4 @@ cgit__logo: "http://rgoncalves.se/logo.png" cgit__css: "http://rgoncalves.se/style/cgit.css" cgit__root_desc: "development hub" cgit__root_readme: "http://rgoncalves.se" +cgit__footer: "/conf/footer.html" diff --git a/roles/cgit/meta/main.yml b/roles/cgit/meta/main.yml index 02b67be..a25f289 100644 --- a/roles/cgit/meta/main.yml +++ b/roles/cgit/meta/main.yml @@ -1,9 +1,5 @@ - -# cgit ~~ roles/cgit/meta/main.yml -# Meta parameters - ---- - dependencies: - - { role: git, tags: "dependency" } - - { role: httpd_pre, tags: "dependency" } + - role: git + tags: dependency + - role: httpd_pre + tags: dependency diff --git a/roles/cgit/tasks/main.yml b/roles/cgit/tasks/main.yml index 6b52bd7..fa68415 100644 --- a/roles/cgit/tasks/main.yml +++ b/roles/cgit/tasks/main.yml @@ -1,21 +1,22 @@ - -# cgit ~~ roles/cgit/tasks/main.yml -# cgit web interface - ---- - - name: ensure cgit is installed package: name: cgit state: present -- name: generate cgit configuration file +- name: generate cgit configuration files template: - src: var-www-conf-cgitrc.j2 - dest: /var/www/conf/cgitrc + src: "{{ item.template }}" + dest: "{{ item.file }}" owner: "0" group: "0" mode: "0644" + loop: + - template: conf-cgitrc.j2 + file: "{{ cgit_chroot_dir }}/conf/cgitrc" + - template: conf-footer.html.j2 + file: "{{ cgit_chroot_dir }}/conf/footer.html" + - template: etc-httpd.d-cgit.conf.j2 + file: /etc/httpd.d/cgit.conf - name: generate cgit configuration for httpd template: @@ -28,7 +29,7 @@ - name: copy utility in httpd chroot copy: src: "/bin/{{ item }}" - dest: /var/www/bin + dest: "{{ cgit_chroot_dir }}/bin" mode: preserve remote_src: true loop: @@ -38,34 +39,11 @@ - name: copy about-filter generator copy: src: about-filter.sh - dest: /var/www/bin/about-filter.sh + dest: "{{ cgit_chroot_dir }}/bin/about-filter.sh" owner: "0" group: "0" mode: "0755" -- name: ensure cgit web directory exists - file: - path: /var/www/{{ cgit_git_dir_chroot }} - owner: "{{ cgit_user }}" - group: daemon - state: directory - mode: "0755" - -- name: include nfsclient for remote dir - include_role: - name: nfsclient - vars: - nfsclient_dir: "/var/www/{{ cgit_git_dir_chroot }}" - nfsclient_server_dir: "{{ global.nfs_server_dir }}/{{ ansible_host }}/git" - #nfsclient_server: "{{ global.nfs_server }}" - -- name: chown git directory to git - file: - path: /data/git - owner: "{{ cgit_user }}" - group: "{{ cgit_group }}" - state: directory - - name: start and enable slowcgi service service: name: slowcgi @@ -76,5 +54,5 @@ debug: msg: | Please provide a password using htpasswd, - in /htpasswd/cgit + in "{{ cgit_chroot_dir }}/htpasswd/cgit" when: cgit_authenticate diff --git a/roles/cgit/templates/conf-cgitrc.j2 b/roles/cgit/templates/conf-cgitrc.j2 new file mode 100644 index 0000000..1fc283f --- /dev/null +++ b/roles/cgit/templates/conf-cgitrc.j2 @@ -0,0 +1,41 @@ + +# cgit ~~ /var/www/conf/cgitrc +# managed by Ansible + +# visuals +css={{ cgit__css }} +logo={{ cgit__logo }} +favicon={{ cgit__favicon }} +footer={{ cgit__footer }} + +# readme +readme=:README.md +readme=:README.org +readme=:README +readme=:.README.md +readme=:.README +about-filter=/bin/about-filter.sh + +# features +enable-commit-graph=1 +enable-http-clone=1 +enable-index-links=1 +max-stats=quarter +robots=noindex, nofollow +localtime=1 + +# git +clone-url=git://git.{{ global.domain_name }}/$CGIT_REPO_URL ssh://git@git.{{ global.domain_name }}/$CGIT_REPO_URL http://git.{{ global.domain_name }}/$CGIT_REPO_URL + +# instance id +root-title=git.{{ global.domain_name }} +root-desc={{ cgit__root_desc }} +root-readme={{ cgit__root_readme }} + +# archives +snapshots=tar.gz + +# sections +section-from-path=1 +section-sort=1 +scan-path={{ cgit_git_dir }} diff --git a/roles/cgit/templates/conf-footer.html.j2 b/roles/cgit/templates/conf-footer.html.j2 new file mode 100644 index 0000000..66ca627 --- /dev/null +++ b/roles/cgit/templates/conf-footer.html.j2 @@ -0,0 +1,3 @@ + +remember that computers suck. + diff --git a/roles/cgit/templates/etc-httpd.d-cgit.conf.j2 b/roles/cgit/templates/etc-httpd.d-cgit.conf.j2 index 6fb8e98..b77ca35 100644 --- a/roles/cgit/templates/etc-httpd.d-cgit.conf.j2 +++ b/roles/cgit/templates/etc-httpd.d-cgit.conf.j2 @@ -2,19 +2,19 @@ # httpd ~~ /etc/httpd.d/cgit.conf" # managed by Ansible -ext_ip="0.0.0.0" server "cgit" { - listen on $ext_ip port {{ cgit_port }} + listen on "{{ cgit_ip }}" port {{ cgit_port }} {% if cgit_authenticate %} authenticate "realm" with "/htpasswd/cgit" {% endif %} - # serve cgit static files directly: cgit.css and cgit.png + # cgit location "/cgit.*" { root "/cgit" - no fastcgi + no fastcgi } - # cgit CGI + + # fastcgi root "/cgi-bin/cgit.cgi" fastcgi socket "/run/slowcgi.sock" } diff --git a/roles/cgit/templates/var-www-conf-cgitrc.j2 b/roles/cgit/templates/var-www-conf-cgitrc.j2 deleted file mode 100644 index 8be36ce..0000000 --- a/roles/cgit/templates/var-www-conf-cgitrc.j2 +++ /dev/null @@ -1,39 +0,0 @@ - -# cgit ~~ /var/www/conf/cgitrc -# managed by Ansible - -# visuals -css={{ cgit__css }} -logo={{ cgit__logo }} -favicon={{ cgit__favicon }} - -# readme -readme=:README.md -readme=:README.org -readme=:README -readme=:.README.md -readme=:.README -about-filter=/bin/about-filter.sh - -# features -enable-commit-graph=1 -enable-http-clone=1 -enable-index-links=1 -max-stats=quarter -robots=noindex, nofollow - -# git -clone-url=git://git.{{ global.domain_name }}/$CGIT_REPO_URL ssh://git@git.{{ global.domain_name }}/$CGIT_REPO_URL http://git.{{ global.domain_name }}/$CGIT_REPO_URL - -# instance id -root-title=git.{{ global.domain_name }} -root-desc={{ cgit__root_desc }} -root-readme={{ cgit__root_readme }} - -# archives -snapshots=tar.gz - -# sections -section-from-path=1 -section-sort=1 -scan-path={{ cgit_git_dir_chroot }} diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml index b562e88..1558f02 100644 --- a/roles/common/tasks/main.yml +++ b/roles/common/tasks/main.yml @@ -46,4 +46,3 @@ - name: synchronize host hostname with config hostname hostname: name="{{ inventory_hostname }}" - diff --git a/roles/git/defaults/main.yml b/roles/git/defaults/main.yml new file mode 100644 index 0000000..2128abb --- /dev/null +++ b/roles/git/defaults/main.yml @@ -0,0 +1,12 @@ + +# git ~~ roles/git/tasks/vars.yml +# default vars for git role + +--- + +git_user: "git" +git_group: "git" +git_dir: "/data/git" + +git_shell: "/bin/sh" +git_default_branch: "trunk" diff --git a/roles/git/tasks/main.yml b/roles/git/tasks/main.yml index 5600e2d..a421ad0 100644 --- a/roles/git/tasks/main.yml +++ b/roles/git/tasks/main.yml @@ -5,7 +5,9 @@ --- - name: ensure git package is present - package: name=git state=present + package: + name: git + state: present - name: ensure git group exists group: @@ -17,43 +19,38 @@ name: "{{ git_user }}" group: "{{ git_group }}" shell: "{{ git_shell }}" - home: "/home/{{ git_user }}" + home: "{{ git_dir }}" create_home: false -- name: ensure git home directory is not created - file: path="/home/{{ git_user }}" state=absent - -- name: ensure git-only directory exists - file: - path: "{{ git_dir }}" - owner: "{{ git_user }}" - group: "{{ git_group }}" - state: directory - mode: 0755 - -- name: link git user home directory with git root repository - file: - src: "{{ git_dir }}" - dest: "/home/{{ git_user }}" - owner: "{{ git_user }}" - group: "{{ git_group }}" - mode: 0750 - force: true - state: link - -- name: ensure git-shell-commands directory exists +- name: ensure git directories exist file: - path: "/home/{{ git_user }}/git-shell-commands" + path: "{{ item }}" owner: "{{ git_user }}" group: "{{ git_group }}" state: directory - mode: 0755 + mode: "0755" + loop: + - "{{ git_dir }}" + - "{{ git_dir }}/git-shell-commands" - name: generate git-shell no-login prompt template: src: no-interactive-login.j2 - dest: "/home/{{ git_user }}/git-shell-commands/no-interactive-login" + dest: "{{ git_dir }}/git-shell-commands/no-interactive-login" owner: "{{ git_user }}" group: "{{ git_group }}" - mode: 0744 + mode: "0744" when: git_nologin is defined and git_nologin + +- name: generate gitconfig + template: + src: gitconfig.j2 + dest: "{{ git_dir }}/.gitconfig" + owner: "{{ git_user }}" + group: "{{ git_group }}" + mode: "0644" + +- name: synchronize ssh key + include_role: + name: sshd + tasks_from: sync_keys diff --git a/roles/git/templates/gitconfig.j2 b/roles/git/templates/gitconfig.j2 new file mode 100644 index 0000000..b9923a2 --- /dev/null +++ b/roles/git/templates/gitconfig.j2 @@ -0,0 +1,2 @@ +[init] + defaultBranch = {{ git_default_branch }} diff --git a/roles/git/vars/main.yml b/roles/git/vars/main.yml deleted file mode 100644 index 6f7ffb8..0000000 --- a/roles/git/vars/main.yml +++ /dev/null @@ -1,11 +0,0 @@ - -# git ~~ roles/git/tasks/vars.yml -# default vars for git role - ---- - -git_user: "git" -git_group: "git" -git_dir: "/data/git" - -git_shell: "/bin/sh" diff --git a/roles/grafana/defaults/main.yml b/roles/grafana/defaults/main.yml new file mode 100644 index 0000000..f415110 --- /dev/null +++ b/roles/grafana/defaults/main.yml @@ -0,0 +1,8 @@ +grafana_dir: /data/grafana +grafana_port: 3001 +grafana_port_out: 3000 +grafana_user: _grafana +grafana_group: _grafana + +grafana_db: sqlite +grafana_instance_name: "rgoncalves.se monitoring" diff --git a/roles/grafana/tasks/main.yml b/roles/grafana/tasks/main.yml index 919f15e..d002b51 100644 --- a/roles/grafana/tasks/main.yml +++ b/roles/grafana/tasks/main.yml @@ -1,36 +1,39 @@ - -# grafana ~~ roles/grafana/tasks/main.yml -# grafana setup - ---- - - name: install grafana - package: name=grafana state=present + package: + name: grafana + state: present -- name: ensure grafana dir exists +- name: ensure grafana directories exists file: - path: "{{ grafana_dir }}" + path: "{{ grafana_dir }}/{{ item }}" owner: "{{ grafana_user }}" group: "{{ grafana_group }}" - mode: 0640 + mode: "0640" state: directory + loop: + - "" + - "data" + - "logs" + - "plugins" - name: generate grafana configuration template: - src: grafana.ini.j2 + src: etc-grafana.ini.j2 dest: /etc/grafana.ini - owner: "{{ user_root }}" - group: "{{ group_root }}" - mode: 0644 + owner: "0" + group: "0" + mode: "0644" -- name: generate reverse proxy configuration for nginx +- name: generate grafana data sources template: - src: grafana.conf.nginx.j2 - dest: /etc/nginx/conf.d/grafana.conf - owner: "{{ user_root }}" - group: "{{ group_root }}" - mode: 0644 - when: ansible_distribution != "OpenBSD" + src: datasources-default.yml.j2 + dest: /etc/grafana/provisioning/datasources/default.yml + owner: "{{ grafana_user }}" + group: "{{ grafana_group }}" + mode: "0640" - name: start and enable grafana service - service: name=grafana state=restarted enabled=true + service: + name: grafana + state: restarted + enabled: true diff --git a/roles/grafana/templates/datasources-default.yml.j2 b/roles/grafana/templates/datasources-default.yml.j2 new file mode 100644 index 0000000..690487f --- /dev/null +++ b/roles/grafana/templates/datasources-default.yml.j2 @@ -0,0 +1,16 @@ +{% import 'macros.j2' as macros with context %} + +# datasources for grafana +# managed by Ansible + +apiVersion: 1 + +datasources: +{% call(h) macros.loop_valid_hosts("servers") %} + - name: {{ h.ansible_host }}-prometheus + type: prometheus + url: http://{{ h.ip.in }}:9090 + - name: {{ h.ansible_host }}-loki + type: prometheus + +{% endcall %} diff --git a/roles/grafana/templates/etc-grafana.ini.j2 b/roles/grafana/templates/etc-grafana.ini.j2 new file mode 100644 index 0000000..8bcad25 --- /dev/null +++ b/roles/grafana/templates/etc-grafana.ini.j2 @@ -0,0 +1,246 @@ + +# grafana configuration +# managed by Ansible + +app_mode = production +instance_name = + +[paths] +data = {{ grafana_dir }}/data +logs = {{ grafana_dir }}/logs +plugins = {{ grafana_dir }}/plugins +provisioning = provisioning +temp_data_lifetime = 24h + +[server] +protocol = http +http_addr = +http_port = {{ grafana_port }} +;domain = 0.0.0.0 + +# The full public facing url you use in browser, used for redirects and emails +# If you use reverse proxy and sub path specify full url (with sub path) +;root_url = %(protocol)s://%(domain)s:%(http_port)s/ + +# Log web requests +router_logging = true +enable_gzip = true + +[database] + +;type = sqlite3 +;host = 127.0.0.1:3306 +;name = grafana +;user = root +# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;""" +;password = + +path = grafana.db +max_idle_conn = 2 +log_queries = true +cache_mode = shared + +[remote_cache] +type = database + +[dataproxy] + +[analytics] + +[security] +disable_initial_admin_creation = true +disable_gravatar = true +allow_embedding = true + +strict_transport_security = false + +[snapshots] +# snapshot sharing options +external_enabled = true +;external_snapshot_url = https://snapshots-origin.raintank.io +;external_snapshot_name = Publish to snapshot.raintank.io + +public_mode = false + +[dashboards] +versions_to_keep = 20 +min_refresh_interval = 5s +default_home_dashboard_path = + +[users] +allow_sign_up = false +allow_org_create = false +auto_assign_org = false +auto_assign_org_role = Viewer +verify_email_enabled = false +login_hint = email or username +password_hint = password +viewers_can_edit = true +editors_can_admin = false +user_invite_max_lifetime_duration = 24h + +default_theme = dark + +[auth] +login_cookie_name = grafana_session + +[auth.anonymous] +enabled = false + +[auth.github] +enabled = false + +[auth.gitlab] +enabled = false + +[auth.google] +enabled = false + +[auth.grafana_com] +enabled = false + +[auth.azuread] +enabled = false + +[auth.okta] +enabled = false + +[auth.generic_oauth] +enabled = false + +[auth.basic] +enabled = true + +[auth.proxy] +enabled = false + +[auth.ldap] +enabled = false +config_file = /etc/grafana/ldap.toml +allow_sign_up = true + +[smtp] +enabled = false + +[emails] +welcome_email_on_sign_up = false +templates_pattern = emails/*.html + +[log] +mode = console file +level = info +filters = + +[log.console] +level = +format = console + +[log.file] +level = +format = text + +log_rotate = true +max_lines = 1000000 +max_size_shift = 28 + +daily_rotate = true +max_days = 7 + +[log.syslog] +level = +format = text +network = +address = + +facility = +tag = + +[quota] +enabled = false + +[alerting] +enabled = true +execute_alerts = true +error_or_timeout = alerting +nodata_or_nullvalues = no_data + +concurrent_render_limit = 5 + +;evaluation_timeout_seconds = 30 +;notification_timeout_seconds = 30 +;max_attempts = 3 +;min_interval_seconds = 1 + +[annotations.dashboard] + +[explore] +enabled = true + +# Metrics available at HTTP API Url /metrics +[metrics] +enabled = true +interval_seconds = 10 +disable_total_stats = false + +; basic_auth_username = +; basic_auth_password = + +[metrics.environment_info] + +[metrics.graphite] +;address = +;prefix = prod.grafana.%(instance_name)s. + +[grafana_com] +;url = https://grafana.com + +[tracing.jaeger] + +[external_image_storage] +;provider = + +[external_image_storage.s3] +;endpoint = +;path_style_access = +;bucket = +;region = +;path = +;access_key = +;secret_key = + +[external_image_storage.webdav] +;url = +;public_url = +;username = +;password = + +[external_image_storage.gcs] +;key_file = +;bucket = +;path = + +[external_image_storage.azure_blob] +;account_name = +;account_key = +;container_name = + +[external_image_storage.local] + +[rendering] + +[panels] +disable_sanitize_html = false + +[plugins] +enable_alpha = true + +[plugin.grafana-image-renderer] + +[enterprise] +;license_path = + +[feature_toggles] +;enable = + +[date_formats] +default_timezone = browser diff --git a/roles/grafana/templates/grafana.conf.nginx.j2 b/roles/grafana/templates/grafana.conf.nginx.j2 deleted file mode 100644 index c0f926c..0000000 --- a/roles/grafana/templates/grafana.conf.nginx.j2 +++ /dev/null @@ -1,9 +0,0 @@ -server { - listen {{ grafana_port_out }}; - root /usr/share/nginx/html; - index index.html index.htm; - - location / { - proxy_pass http://127.0.0.1:{{ grafana_port }}/; - } -} diff --git a/roles/grafana/templates/grafana.ini.j2 b/roles/grafana/templates/grafana.ini.j2 deleted file mode 100644 index 75de264..0000000 --- a/roles/grafana/templates/grafana.ini.j2 +++ /dev/null @@ -1,852 +0,0 @@ - -# grafana configuration ~~ /etc/grafana.ini - -##################### Grafana Configuration Example ##################### -# -# Everything has defaults so you only need to uncomment things you want to -# change - -# possible values : production, development -;app_mode = production - -# instance name, defaults to HOSTNAME environment variable value or hostname if HOSTNAME var is empty -instance_name = - -#################################### Paths #################################### -[paths] -# Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used) -data = {{ grafana_dir }} - -# Temporary files in `data` directory older than given duration will be removed -;temp_data_lifetime = 24h - -# Directory where grafana can store logs -;logs = /var/log/grafana - -# Directory where grafana will automatically scan and look for plugins -;plugins = {{ grafana_dir }}/plugins - -# folder that contains provisioning config files that grafana will apply on startup and while running. -;provisioning = conf/provisioning - -#################################### Server #################################### -[server] -# Protocol (http, https, h2, socket) -;protocol = http - -# The ip address to bind to, empty will bind to all interfaces -http_addr = - -# The http port to use -http_port = {{ grafana_port }} - -# The public facing domain name used to access grafana from a browser -;domain = 0.0.0.0 - -# Redirect to correct domain if host header does not match domain -# Prevents DNS rebinding attacks -;enforce_domain = false - -# The full public facing url you use in browser, used for redirects and emails -# If you use reverse proxy and sub path specify full url (with sub path) -;root_url = %(protocol)s://%(domain)s:%(http_port)s/ - -# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons. -;serve_from_sub_path = false - -# Log web requests -;router_logging = false - -# the path relative working path -;static_root_path = public - -# enable gzip -;enable_gzip = false - -# https certs & key file -;cert_file = -;cert_key = - -# Unix socket path -;socket = - -#################################### Database #################################### -[database] -# You can configure the database connection by specifying type, host, name, user and password -# as separate properties or as on string using the url properties. - -# Either "mysql", "postgres" or "sqlite3", it's your choice -;type = sqlite3 -;host = 127.0.0.1:3306 -;name = grafana -;user = root -# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;""" -;password = - -# Use either URL or the previous fields to configure the database -# Example: mysql://user:secret@host:port/database -;url = - -# For "postgres" only, either "disable", "require" or "verify-full" -;ssl_mode = disable - -;ca_cert_path = -;client_key_path = -;client_cert_path = -;server_cert_name = - -# For "sqlite3" only, path relative to data_path setting -;path = grafana.db - -# Max idle conn setting default is 2 -;max_idle_conn = 2 - -# Max conn setting default is 0 (mean not set) -;max_open_conn = - -# Connection Max Lifetime default is 14400 (means 14400 seconds or 4 hours) -;conn_max_lifetime = 14400 - -# Set to true to log the sql calls and execution times. -;log_queries = - -# For "sqlite3" only. cache mode setting used for connecting to the database. (private, shared) -;cache_mode = private - -#################################### Cache server ############################# -[remote_cache] -# Either "redis", "memcached" or "database" default is "database" -;type = database - -# cache connectionstring options -# database: will use Grafana primary database. -# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0,ssl=false`. Only addr is required. ssl may be 'true', 'false', or 'insecure'. -# memcache: 127.0.0.1:11211 -;connstr = - -#################################### Data proxy ########################### -[dataproxy] - -# This enables data proxy logging, default is false -;logging = false - -# How long the data proxy waits before timing out, default is 30 seconds. -# This setting also applies to core backend HTTP data sources where query requests use an HTTP client with timeout set. -;timeout = 30 - -# How many seconds the data proxy waits before sending a keepalive probe request. -;keep_alive_seconds = 30 - -# How many seconds the data proxy waits for a successful TLS Handshake before timing out. -;tls_handshake_timeout_seconds = 10 - -# How many seconds the data proxy will wait for a server's first response headers after -# fully writing the request headers if the request has an "Expect: 100-continue" -# header. A value of 0 will result in the body being sent immediately, without -# waiting for the server to approve. -;expect_continue_timeout_seconds = 1 - -# The maximum number of idle connections that Grafana will keep alive. -;max_idle_connections = 100 - -# How many seconds the data proxy keeps an idle connection open before timing out. -;idle_conn_timeout_seconds = 90 - -# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request, default is false. -;send_user_header = false - -#################################### Analytics #################################### -[analytics] -# Server reporting, sends usage counters to stats.grafana.org every 24 hours. -# No ip addresses are being tracked, only simple counters to track -# running instances, dashboard and error counts. It is very helpful to us. -# Change this option to false to disable reporting. -;reporting_enabled = true - -# Set to false to disable all checks to https://grafana.net -# for new versions (grafana itself and plugins), check is used -# in some UI views to notify that grafana or plugin update exists -# This option does not cause any auto updates, nor send any information -# only a GET request to http://grafana.com to get latest versions -;check_for_updates = true - -# Google Analytics universal tracking code, only enabled if you specify an id here -;google_analytics_ua_id = - -# Google Tag Manager ID, only enabled if you specify an id here -;google_tag_manager_id = - -#################################### Security #################################### -[security] -# disable creation of admin user on first start of grafana -;disable_initial_admin_creation = false - -# default admin user, created on startup -;admin_user = admin - -# default admin password, can be changed before first start of grafana, or in profile settings -;admin_password = admin - -# used for signing -;secret_key = SW2YcwTIb9zpOOhoPsMm - -# disable gravatar profile images -;disable_gravatar = false - -# data source proxy whitelist (ip_or_domain:port separated by spaces) -;data_source_proxy_whitelist = - -# disable protection against brute force login attempts -;disable_brute_force_login_protection = false - -# set to true if you host Grafana behind HTTPS. default is false. -;cookie_secure = false - -# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled" -;cookie_samesite = lax - -# set to true if you want to allow browsers to render Grafana in a ,