diff options
Diffstat (limited to 'ansible/roles')
20 files changed, 640 insertions, 0 deletions
diff --git a/ansible/roles/base/tasks/main.yaml b/ansible/roles/base/tasks/main.yaml new file mode 100644 index 0000000..b5aaf97 --- /dev/null +++ b/ansible/roles/base/tasks/main.yaml @@ -0,0 +1,12 @@ +--- + +- tags: 'always' + # noqa: name[missing] + block: + - name: 'Install some useful packages' + ansible.builtin.apt: + name: + - 'tcpdump' + - 'curl' + state: 'present' + update_cache: true diff --git a/ansible/roles/caddy_add/tasks/main.yaml b/ansible/roles/caddy_add/tasks/main.yaml new file mode 100644 index 0000000..80382d4 --- /dev/null +++ b/ansible/roles/caddy_add/tasks/main.yaml @@ -0,0 +1,64 @@ +--- + +- tags: 'always' + # noqa: name[missing] + block: + - name: 'Ensure required vars are set' + ansible.builtin.assert: + that: + - item | mandatory + loop: + - '{{ caddy_add_hosts }}' + - '{{ caddy_add_upstream_host }}' + - '{{ caddy_add_upstream_port }}' + + - name: 'Call the Caddy API to add our new host' + ansible.builtin.uri: + url: 'http://rproxy:2019/config/apps/http/servers/serv0/routes' + method: 'PUT' + body_format: 'json' + status_code: 200 + body: | + { + "match": [ + { + "host": {{ caddy_add_hosts | to_json }} + } + ], + "handle": [ + { + "handler": "subroute", + "routes": [ + { + "handle": [ + { + "handler": "reverse_proxy", + "upstreams": [ + { + "dial": "{{ caddy_add_upstream_host }}:{{ caddy_add_upstream_port }}" + } + ] + } + ] + } + ] + } + ], + "terminal": true + } + + - name: 'Get a copy of the new Caddy config' + delegate_to: 'localhost' + ansible.builtin.uri: + url: 'http://rproxy:2019/config' + return_content: true + register: '_current_conf' + + - name: 'Save the new config to file' + delegate_to: 'localhost' + ansible.builtin.copy: + dest: 'artifacts/caddy/{{ _file_name }}' + content: '{{ _current_conf.json }}' + mode: '644' + vars: + _file_name: 'v{{ lookup("pipe", "date +%Y%m%dT%H%M%S") }}.json' diff --git a/ansible/roles/docker/tasks/main.yaml b/ansible/roles/docker/tasks/main.yaml new file mode 100644 index 0000000..bb5b55b --- /dev/null +++ b/ansible/roles/docker/tasks/main.yaml @@ -0,0 +1,34 @@ +--- + +- tags: 'always' + # noqa: name[missing] + block: + - name: 'Install some prereqs' + ansible.builtin.package: + name: + - 'ca-certificates' + - 'gnupg' + state: 'present' + + - name: 'Run Docker installer' + ansible.builtin.shell: + cmd: | + curl -fsSL https://get.docker.com | sh + creates: '/var/run/docker.sock' + + - name: 'Docker set MTU' + ansible.builtin.copy: + dest: '/etc/docker/daemon.json' + content: | + {"mtu": 1420} + mode: '644' + + - name: 'Restart Docker service' + ansible.builtin.service: + name: 'docker' + state: 'restarted' + + - name: 'Install docker-compose' + ansible.builtin.package: + name: 'docker-compose' + state: 'present' diff --git a/ansible/roles/med_dl/tasks/main.yaml b/ansible/roles/med_dl/tasks/main.yaml new file mode 100644 index 0000000..c4d4a7f --- /dev/null +++ b/ansible/roles/med_dl/tasks/main.yaml @@ -0,0 +1,5 @@ +--- + +- name: 'Run the setup tasks' + ansible.builtin.import_tasks: 'setup.yaml' + tags: 'med_dl' diff --git a/ansible/roles/med_dl/tasks/setup.yaml b/ansible/roles/med_dl/tasks/setup.yaml new file mode 100644 index 0000000..46affac --- /dev/null +++ b/ansible/roles/med_dl/tasks/setup.yaml @@ -0,0 +1,38 @@ +--- + +- name: 'setup | Ensure required vars are set' + ansible.builtin.assert: + that: + - item | mandatory + loop: + - '{{ med_dl_nas_mount_path }}' + no_log: true + +- name: 'setup | Install required pkgs' + ansible.builtin.package: + name: + - 'nfs-common' + +- name: 'setup | Create the mount dir' + ansible.builtin.file: + path: '/mnt/data' + state: 'directory' + mode: '755' + +- name: 'setup | Setup the NFS mount' + ansible.posix.mount: + src: '{{ med_dl_nas_mount_path }}' + path: '/mnt/data' + state: 'mounted' + fstype: 'nfs' + +- name: 'setup | Copy the docker-compose file' + ansible.builtin.template: + src: 'docker-compose.yaml.j2' + dest: 'docker-compose.yaml' + mode: '644' + +- name: 'setup | Start the service' + ansible.builtin.command: 'docker-compose up -d' + register: '_compose_up_cmd' + changed_when: '_compose_up_cmd.rc == 0' diff --git a/ansible/roles/med_dl/templates/docker-compose.yaml.j2 b/ansible/roles/med_dl/templates/docker-compose.yaml.j2 new file mode 100644 index 0000000..fa25db0 --- /dev/null +++ b/ansible/roles/med_dl/templates/docker-compose.yaml.j2 @@ -0,0 +1,67 @@ +{{ ansible_managed | comment }} +version: "3" +services: + prowlarr: + image: lscr.io/linuxserver/prowlarr:latest + restart: unless-stopped + container_name: prowlarr + volumes: + - prowlarr-config:/config + ports: + - 9696:9696 + environment: + - PUID=1001 + - PGID=1001 + - TZ=Etc/UTC + networks: + - med-dl + + radarr: + image: lscr.io/linuxserver/radarr:latest + restart: unless-stopped + container_name: radarr + volumes: + - radarr-config:/config + - /mnt/data/downloads:/mnt/data/downloads + - /mnt/data/mov:/mov + ports: + - 7878:7878 + environment: + - PUID=1001 + - PGID=1001 + - TZ=Etc/UTC + networks: + - med-dl + + sonarr: + image: lscr.io/linuxserver/sonarr:latest + restart: unless-stopped + container_name: sonarr + volumes: + - sonarr-config:/config + - /mnt/data/downloads:/mnt/data/downloads + - /mnt/data/tv:/tv + ports: + - 8989:8989 + environment: + - PUID=1001 + - PGID=1001 + - TZ=Etc/UTC + networks: + - med-dl + +volumes: + prowlarr-config: + name: prowlarr-config + radarr-config: + name: radarr-config + sonarr-config: + name: sonarr-config + +networks: + med-dl: + name: med-dl + driver: bridge + driver_opts: + com.docker.network.driver.mtu: 1420 + diff --git a/ansible/roles/monitoring/tasks/main.yaml b/ansible/roles/monitoring/tasks/main.yaml new file mode 100644 index 0000000..256a09f --- /dev/null +++ b/ansible/roles/monitoring/tasks/main.yaml @@ -0,0 +1,5 @@ +--- + +- name: 'Run the setup tasks' + ansible.builtin.import_tasks: 'setup.yaml' + tags: 'monitoring' diff --git a/ansible/roles/monitoring/tasks/setup.yaml b/ansible/roles/monitoring/tasks/setup.yaml new file mode 100644 index 0000000..824d2db --- /dev/null +++ b/ansible/roles/monitoring/tasks/setup.yaml @@ -0,0 +1,20 @@ +--- + +- name: 'setup | Install required pkgs' + ansible.builtin.package: + name: + - 'prometheus' + - 'prometheus-node-exporter' + - 'prometheus-blackbox-exporter' + +- name: 'setup | Set the Prom config' + ansible.builtin.template: + src: 'prometheus.yml.j2' + dest: '/etc/prometheus/prometheus.yml' + mode: '644' + +- name: 'setup | Start the service' + ansible.builtin.service: + name: 'prometheus' + state: 'restarted' + enabled: true diff --git a/ansible/roles/monitoring/templates/prometheus.yml.j2 b/ansible/roles/monitoring/templates/prometheus.yml.j2 new file mode 100644 index 0000000..a5f3b46 --- /dev/null +++ b/ansible/roles/monitoring/templates/prometheus.yml.j2 @@ -0,0 +1,47 @@ +{{ ansible_managed | comment }} +global: + scrape_interval: 1m + evaluation_interval: 1m + # scrape_timeout is set to the global default (10s). + + # Attach these labels to any time series or alerts when communicating with + # external systems (federation, remote storage, Alertmanager). + external_labels: + monitor: 'example' + +# Alertmanager configuration +alerting: + alertmanagers: + - static_configs: + - targets: ['localhost:9093'] + +# Load rules once and periodically evaluate them according to the global 'evaluation_interval'. +rule_files: + # - "first_rules.yml" + # - "second_rules.yml" + +# A scrape configuration containing exactly one endpoint to scrape: +# Here it's Prometheus itself. +scrape_configs: + # The job name is added as a label `job=<job_name>` to any timeseries scraped from this config. + - job_name: 'prometheus' + + # Override the global default and scrape targets from this job every 5 seconds. + # scrape_interval: 30s + # scrape_timeout: 30s + + # metrics_path defaults to '/metrics' + # scheme defaults to 'http'. + + static_configs: + - targets: ['localhost:9090'] + + - job_name: node + # If prometheus-node-exporter is installed, grab stats about the local + # machine by default. + static_configs: + - targets: ['localhost:9100'] + + - job_name: caddy + static_configs: + - targets: ['rproxy:2019', 'sites:2019'] diff --git a/ansible/roles/nextcloud/tasks/main.yaml b/ansible/roles/nextcloud/tasks/main.yaml new file mode 100644 index 0000000..0d3697b --- /dev/null +++ b/ansible/roles/nextcloud/tasks/main.yaml @@ -0,0 +1,5 @@ +--- + +- name: 'Run the setup tasks' + ansible.builtin.import_tasks: 'setup.yaml' + tags: 'nextcloud' diff --git a/ansible/roles/nextcloud/tasks/setup.yaml b/ansible/roles/nextcloud/tasks/setup.yaml new file mode 100644 index 0000000..ac17702 --- /dev/null +++ b/ansible/roles/nextcloud/tasks/setup.yaml @@ -0,0 +1,40 @@ +--- + +- name: 'setup | Ensure required vars are set' + ansible.builtin.assert: + that: + - item | mandatory + loop: + - '{{ nextcloud_nas_mount_path }}' + - '{{ nextcloud_php_max_mem_mb }}' + - '{{ nextcloud_php_max_upload_size_gb }}' + no_log: true + +- name: 'setup | Install required pkgs' + ansible.builtin.package: + name: + - 'nfs-common' + +- name: 'setup | Create the mount dir' + ansible.builtin.file: + path: '/mnt/data' + state: 'directory' + mode: '755' + +- name: 'setup | Setup the NFS mount' + ansible.posix.mount: + src: '{{ nextcloud_nas_mount_path }}' + path: '/mnt/data' + state: 'mounted' + fstype: 'nfs' + +- name: 'setup | Copy the docker-compose file' + ansible.builtin.template: + src: 'docker-compose.yaml.j2' + dest: 'docker-compose.yaml' + mode: '644' + +- name: 'setup | Start the service' + ansible.builtin.command: 'docker-compose up -d' + register: '_compose_up_cmd' + changed_when: '_compose_up_cmd.rc == 0' diff --git a/ansible/roles/nextcloud/templates/docker-compose.yaml.j2 b/ansible/roles/nextcloud/templates/docker-compose.yaml.j2 new file mode 100644 index 0000000..3571432 --- /dev/null +++ b/ansible/roles/nextcloud/templates/docker-compose.yaml.j2 @@ -0,0 +1,41 @@ +{{ ansible_managed | comment }} +version: "3" +services: + nextcloud: + image: nextcloud/all-in-one:latest + restart: always + container_name: nextcloud-aio-mastercontainer + volumes: + - nextcloud_aio_mastercontainer:/mnt/docker-aio-config + - /var/run/docker.sock:/var/run/docker.sock:ro + ports: + - 8080:8080 + environment: + - APACHE_PORT=11000 + - APACHE_IP_BINDING=0.0.0.0 + - COLLABORA_SECCOMP_DISABLED=true + - NEXTCLOUD_DATADIR=/mnt/data + - NEXTCLOUD_MOUNT=/mnt/ + - NEXTCLOUD_UPLOAD_LIMIT={{ nextcloud_php_max_upload_size_gb }}G + - NEXTCLOUD_MAX_TIME=3600 + - NEXTCLOUD_MEMORY_LIMIT={{ nextcloud_php_max_mem_mb }}M + - NEXTCLOUD_STARTUP_APPS=deck twofactor_totp tasks calendar contacts notes memories richdocuments -photos + - NEXTCLOUD_ADDITIONAL_APKS=imagemagick + - NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS=imagick + - NEXTCLOUD_ENABLE_DRI_DEVICE={{ nextcloud_enable_dri }} + - TALK_PORT=3478 + - WATCHTOWER_DOCKER_SOCKET_PATH=/var/run/docker.sock + - SKIP_DOMAIN_VALIDATION=true + networks: + - nextcloud-aio + +volumes: + nextcloud_aio_mastercontainer: + name: nextcloud_aio_mastercontainer + +networks: + nextcloud-aio: + name: nextcloud-aio + driver: bridge + driver_opts: + com.docker.network.driver.mtu: 1420 diff --git a/ansible/roles/plex/tasks/main.yaml b/ansible/roles/plex/tasks/main.yaml new file mode 100644 index 0000000..5469534 --- /dev/null +++ b/ansible/roles/plex/tasks/main.yaml @@ -0,0 +1,5 @@ +--- + +- name: 'Run the setup tasks' + ansible.builtin.import_tasks: 'setup.yaml' + tags: 'plex' diff --git a/ansible/roles/plex/tasks/setup.yaml b/ansible/roles/plex/tasks/setup.yaml new file mode 100644 index 0000000..de0eb69 --- /dev/null +++ b/ansible/roles/plex/tasks/setup.yaml @@ -0,0 +1,55 @@ +--- + +- name: 'setup | Ensure required vars are set' + ansible.builtin.assert: + that: + - item | mandatory + loop: + - '{{ plex_nas_mount_path }}' + no_log: true + +- name: 'setup | Install required pkgs' + ansible.builtin.package: + name: + - 'nfs-common' + - 'curl' + - 'gnupg' + +- name: 'setup | Create the mount dir' + ansible.builtin.file: + path: '/mnt/data' + state: 'directory' + mode: '755' + +- name: 'setup | Setup the NFS mount' + ansible.posix.mount: + src: '{{ plex_nas_mount_path }}' + path: '/mnt/data' + state: 'mounted' + fstype: 'nfs' + +- name: 'setup | Get the Plex signed keys' + ansible.builtin.shell: + # noqa: risky-shell-pipe command-instead-of-module + cmd: > + curl -sS https://downloads.plex.tv/plex-keys/PlexSign.key | gpg --dearmor | tee /usr/share/keyrings/plex.gpg > /dev/null + creates: '/usr/share/keyrings/plex.gpg' + +- name: 'setup | Set the Plex sources' + ansible.builtin.copy: + dest: '/etc/apt/sources.list.d/plexmediaserver.list' + content: | + deb [signed-by=/usr/share/keyrings/plex.gpg] https://downloads.plex.tv/repo/deb public main + mode: '644' + +- name: 'setup | Install the package' + ansible.builtin.apt: + name: 'plexmediaserver' + state: 'present' + update_cache: true + +- name: 'setup | Start the service' + ansible.builtin.service: + name: 'plexmediaserver' + state: 'stopped' + enabled: true diff --git a/ansible/roles/torrents/tasks/main.yaml b/ansible/roles/torrents/tasks/main.yaml new file mode 100644 index 0000000..806a4e3 --- /dev/null +++ b/ansible/roles/torrents/tasks/main.yaml @@ -0,0 +1,5 @@ +--- + +- name: 'Run the setup tasks' + ansible.builtin.import_tasks: 'setup.yaml' + tags: 'torrents' diff --git a/ansible/roles/torrents/tasks/setup.yaml b/ansible/roles/torrents/tasks/setup.yaml new file mode 100644 index 0000000..25f1fe8 --- /dev/null +++ b/ansible/roles/torrents/tasks/setup.yaml @@ -0,0 +1,79 @@ +--- + +- name: 'setup | Ensure required vars are set' + ansible.builtin.assert: + that: + - item | mandatory + loop: + - '{{ torrents_nas_mount_path }}' + - '{{ torrents_rpc_username }}' + - '{{ torrents_rpc_password }}' + no_log: true + +- name: 'setup | Install required pkgs' + ansible.builtin.package: + name: + - 'nfs-common' + - 'transmission-daemon' + +- name: 'setup | Stop the transmission-daemon service' + ansible.builtin.service: + name: 'transmission-daemon' + state: 'stopped' + +- name: 'setup | Create the mount dir' + ansible.builtin.file: + path: '/mnt/data' + state: 'directory' + mode: '755' + +- name: 'setup | Setup the NFS mount' + ansible.posix.mount: + src: '{{ torrents_nas_mount_path }}' + path: '/mnt/data' + state: 'mounted' + fstype: 'nfs' + +- name: 'setup | Create new user for transmission' + ansible.builtin.user: + name: 'transmission-user' + uid: 1001 + groups: 'users' + create_home: true + +- name: 'setup | Fix the service file to use our user' + ansible.builtin.lineinfile: + path: '/lib/systemd/system/transmission-daemon.service' + regexp: '^User=' + line: 'User=transmission-user' + +- name: 'setup | Reload systemd daemon' + ansible.builtin.systemd: + daemon_reload: true + +# THis is kind of a hack to force the generation of +# /home/transmission-user/.config/transmission-daemon dirs +# so that we can place our config file there. +- name: 'setup | Start the service' + ansible.builtin.service: + name: 'transmission-daemon' + state: 'started' + +# We still need to stop it to place the config file or else it will get overwritten +- name: 'setup | Stop the service' + ansible.builtin.service: + name: 'transmission-daemon' + state: 'stopped' + +- name: 'setup | Copy the transmission config' + ansible.builtin.template: + src: 'settings.json.j2' + dest: '/home/transmission-user/.config/transmission-daemon/settings.json' + owner: 'transmission-user' + mode: '644' + +- name: 'setup | Start the service' + ansible.builtin.service: + name: 'transmission-daemon' + state: 'started' + enabled: true diff --git a/ansible/roles/torrents/templates/settings.json.j2 b/ansible/roles/torrents/templates/settings.json.j2 new file mode 100644 index 0000000..cf5ea4b --- /dev/null +++ b/ansible/roles/torrents/templates/settings.json.j2 @@ -0,0 +1,73 @@ +{ + "alt-speed-down": 50, + "alt-speed-enabled": false, + "alt-speed-time-begin": 540, + "alt-speed-time-day": 127, + "alt-speed-time-enabled": false, + "alt-speed-time-end": 1020, + "alt-speed-up": 50, + "bind-address-ipv4": "0.0.0.0", + "bind-address-ipv6": "::", + "blocklist-enabled": false, + "blocklist-url": "http://www.example.com/blocklist", + "cache-size-mb": 4, + "dht-enabled": true, + "download-dir": "/mnt/data/downloads", + "download-limit": 100, + "download-limit-enabled": 0, + "download-queue-enabled": true, + "download-queue-size": 5, + "encryption": 1, + "idle-seeding-limit": 30, + "idle-seeding-limit-enabled": false, + "incomplete-dir": "/home/transmission-user/downloads", + "incomplete-dir-enabled": false, + "lpd-enabled": false, + "max-peers-global": 200, + "message-level": 1, + "peer-congestion-algorithm": "", + "peer-id-ttl-hours": 6, + "peer-limit-global": 200, + "peer-limit-per-torrent": 50, + "peer-port": 51413, + "peer-port-random-high": 65535, + "peer-port-random-low": 49152, + "peer-port-random-on-start": false, + "peer-socket-tos": "default", + "pex-enabled": true, + "port-forwarding-enabled": false, + "preallocation": 1, + "prefetch-enabled": true, + "queue-stalled-enabled": true, + "queue-stalled-minutes": 30, + "ratio-limit": 2, + "ratio-limit-enabled": false, + "rename-partial-files": true, + "rpc-authentication-required": true, + "rpc-bind-address": "0.0.0.0", + "rpc-enabled": true, + "rpc-host-whitelist": "", + "rpc-host-whitelist-enabled": true, + "rpc-password": "{{ torrents_rpc_password }}", + "rpc-port": 9091, + "rpc-url": "/transmission/", + "rpc-username": "{{ torrents_rpc_username }}", + "rpc-whitelist": "*", + "rpc-whitelist-enabled": true, + "scrape-paused-torrents-enabled": true, + "script-torrent-done-enabled": false, + "script-torrent-done-filename": "", + "seed-queue-enabled": false, + "seed-queue-size": 10, + "speed-limit-down": 100, + "speed-limit-down-enabled": false, + "speed-limit-up": 100, + "speed-limit-up-enabled": false, + "start-added-torrents": true, + "trash-original-torrent-files": false, + "umask": 18, + "upload-limit": 100, + "upload-limit-enabled": 0, + "upload-slots-per-torrent": 14, + "utp-enabled": true +} diff --git a/ansible/roles/vault/tasks/main.yaml b/ansible/roles/vault/tasks/main.yaml new file mode 100644 index 0000000..191bbc1 --- /dev/null +++ b/ansible/roles/vault/tasks/main.yaml @@ -0,0 +1,5 @@ +--- + +- name: 'Run the setup tasks' + ansible.builtin.import_tasks: 'setup.yaml' + tags: 'vault' diff --git a/ansible/roles/vault/tasks/setup.yaml b/ansible/roles/vault/tasks/setup.yaml new file mode 100644 index 0000000..f05aeee --- /dev/null +++ b/ansible/roles/vault/tasks/setup.yaml @@ -0,0 +1,12 @@ +--- + +- name: 'setup | Copy the docker-compose file' + ansible.builtin.template: + src: 'docker-compose.yaml.j2' + dest: 'docker-compose.yaml' + mode: '644' + +- name: 'setup | Start the service' + ansible.builtin.command: 'docker-compose up -d' + register: '_compose_up_cmd' + changed_when: '_compose_up_cmd.rc == 0' diff --git a/ansible/roles/vault/templates/docker-compose.yaml.j2 b/ansible/roles/vault/templates/docker-compose.yaml.j2 new file mode 100644 index 0000000..7c9d74c --- /dev/null +++ b/ansible/roles/vault/templates/docker-compose.yaml.j2 @@ -0,0 +1,28 @@ +{{ ansible_managed | comment }} +version: "3" +services: + vaultwarden: + image: vaultwarden/server:latest + restart: always + container_name: vaultwarden + volumes: + - vaultwarden:/data + ports: + - 8989:80 + environment: + - WEBSOCKET_ENABLED=true + - INVITATIONS_ALLOWED=true + - SIGNUPS_ALLOWED=true + networks: + - vaultwarden + +volumes: + vaultwarden: + name: vaultwarden + +networks: + vaultwarden: + name: vaultwarden + driver: bridge + driver_opts: + com.docker.network.driver.mtu: 1420 |