switched to alpine initial commit

1 files changed, 69 insertions, 143 deletions

diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml
index 270416d..53c315a 100644
--- a/playbooks/deploy.yaml
+++ b/playbooks/deploy.yaml
@@ -1,9 +1,9 @@
 # Usage:
-#   ansible-playbook -i hosts playbooks/deploy.yaml --vault-id vaultid --tags base
+#   ansible-playbook -i hosts playbooks/deploy.yaml --vault-id vaultid --tags []
 #
 # Tags:
-#   base, ddclient, wireguard, nginx, website, samba
-#   nextcloud, monitoring (these all depend on the nginx tag)
+#   ddclient, wireguard, nginx, websites, samba
+#   nextcloud, bitwarden, searxng, monitoring (these all depend on the nginx tag)
 #
 # Install:
 #   git submodule update --remote --merge
@@ -14,17 +14,15 @@
 #   ansible-galaxy install -r requirements.yml
 #   ansible-galaxy collection install -r requirements.yml
 #
-# Assumptions:
-# Run apt update, upgrade
-# Run rpi-update
-# HD, SSD formatted appropriately.
 ---
 
+## Non Docker Services ##
 
 - hosts: compute
-  gather_facts: false
+  gather_facts: true
   tags: 'ddclient'
   become: true
+  become_method: 'doas'
   roles:
     - role: ddclient
       vars:
@@ -34,16 +32,17 @@
         ddclient_domain: '{{ vpn_domain }}'
 
 - hosts: compute
-  gather_facts: false
+  gather_facts: true
   tags: 'wireguard'
   become: true
+  become_method: 'doas'
   roles:
     - role: wireguard
       vars:
         wireguard_server_priv_key: '{{ vault_wireguard_server_priv_key }}'
         wireguard_server_pub_key: 'iwsriL3AUn4dgKfsSNgJtj/G808k4jXvSC+mM70YnAw='
         wireguard_server_listen_port: 51820
-        wireguard_server_ip: '192.168.10.1/24'
+        wireguard_server_ip: '192.168.10.1/32'
         wireguard_peers:
           - peer_ip: '192.168.10.2/32'  # my phone
             peer_key: '/mFv6y9QA8dhX/A9fFn+mzg/SZq4BZPeNofm1w754y8='
@@ -54,185 +53,112 @@
 
 - hosts: compute
   gather_facts: false
-  tags: 'nginx'
+  tags: 'websites'
+  become: false
+  roles:
+    - role: website
+      vars:
+        websites: '{{ nginx_websites }}'
+        git_user: '{{ vault_git_user }}'
+        git_pass: '{{ vault_git_password }}'
+        sites_data_root: '{{ vol_data }}/sites'
+
+# Access: http://art-jr/data
+- hosts: compute
+  gather_facts: true
+  tags: 'samba'
   become: true
+  become_method: 'doas'
   roles:
-    - role: nginx
+    - role: samba
       vars:
-        nginx_website_domains: '{{ ["default"] + (nginx_websites | map(attribute="name") | list) }}'
-        nginx_global_apps_domain: '{{ apps_domain }}'
-        nginx_apps_confs: '{{ apps_conf_map | dict2items(key_name="app", value_name="conf") }}'
+        samba_user: '{{ vault_samba_user }}'
+        samba_user_pass: '{{ vault_samba_password }}'
+        samba_data_root: '{{ vol_media }}'
+
+
+## Docker Services ##
 
 - hosts: compute
   gather_facts: false
-  tags: 'website'
-  become: true
+  tags: 'nginx'
+  become: false
   roles:
-    - role: website
+    - role: nginx_docker
       vars:
-        websites: '{{ nginx_websites }}'
-        git_user: '{{ vault_git_user }}'
-        git_pass: '{{ vault_git_password }}'
+        nginx_website_domains: '{{ ["default"] + (nginx_websites | map(attribute="name") | list) }}'
+        nginx_global_apps_domain: '{{ apps_domain }}'
+        nginx_apps_confs: '{{ apps_conf_map | dict2items(key_name="app", value_name="conf") }}'
+        nginx_conf_root: '{{ vol_data }}/nginx'
+        nginx_static_html_root: '{{ vol_data }}/sites'
+        nginx_certs_root: '{{ vol_data }}/letsencrypt'
 
 - hosts: compute
   gather_facts: false
   tags: 'nextcloud'
-  become: true
+  become: false
   roles:
     - role: nextcloud
       vars:
         nextcloud_domain: '{{ apps_conf_map["nextcloud"]["access_domain"] }}'
         nextcloud_host_port: '{{ apps_conf_map["nextcloud"]["port"] }}'
-        nextcloud_data_root: '{{ data_vol_hdd }}/nextcloud'
+        nextcloud_data_root: '{{ vol_data }}/nextcloud'
         nextcloud_postgres_password: '{{ vault_nextcloud_postgres_password }}'
 
 - hosts: compute
   gather_facts: false
   tags: 'searxng'
-  become: true
+  become: false
   roles:
     - role: searxng
       vars:
         searxng_domain: '{{ apps_conf_map["searxng"]["access_domain"] }}'
         searxng_host_port: '{{ apps_conf_map["searxng"]["port"] }}'
-        searxng_data_root: '{{ data_vol_hdd }}/searxng'
+        searxng_data_root: '{{ vol_data }}/searxng'
         searxng_secret_key: '{{ vault_searxng_secret_key }}'
 
 - hosts: compute
   gather_facts: false
   tags: 'bitwarden'
-  become: true
+  become: false
   roles:
     - role: bitwarden
       vars:
         bitwarden_host_port: '{{ apps_conf_map["bitwarden"]["port"] }}'
-        bitwarden_data_dir: '{{ data_vol_hdd }}/bitwarden'
+        bitwarden_data_dir: '{{ vol_data }}/bitwarden'
 
-# Access: http://art-jr/data
 - hosts: compute
   gather_facts: false
-  tags: 'samba'
-  become: true
+  tags: 'transmission'
+  become: false
   roles:
-    - role: samba
+    - role: transmission
       vars:
-        samba_user: '{{ vault_samba_user }}'
-        samba_user_pass: '{{ vault_samba_password }}'
+        transmission_host_port: '{{ apps_conf_map["transmission"]["port"] }}'
+        transmission_user: '{{ vault_transmission_user }}'
+        transmission_password: '{{ vault_transmission_password }}'
+        transmission_root_dir: '{{ vol_media }}/transmission'
 
 - hosts: compute
-  become: true
-  tags: 'monitoring'
+  gather_facts: false
+  tags: 'media_downloader'
+  become: false
   roles:
-    - role: 'cloudalchemy.node_exporter'
+    - role: media_downloader
       vars:
-        node_exporter_version: '1.2.2'
-        node_exporter_web_listen_address: '0.0.0.0:9100'
-        node_exporter_web_telemetry_path: '/metrics'
-
-    # monitor cpu temp. stats for the rpi.
-    - role: 'rpi_exporter'
-
-    - role: 'cloudalchemy.prometheus'
-      vars:
-        prometheus_version: 'latest'
-        prometheus_skip_install: false
-        prometheus_db_dir: '{{ data_vol_hdd }}/prometheus'
-        prometheus_web_listen_address: '0.0.0.0:{{ apps_conf_map["prometheus"]["port"] }}'
-        prometheus_web_external_url: 'https://{{ apps_conf_map["prometheus"]["access_domain"] }}'
-        prometheus_storage_retention: '15d'
-        prometheus_global:
-          scrape_interval: '30s'
-          evaluation_interval: '30s'
-        prometheus_targets:
-          node:
-            - targets:
-                - localhost:9100
-                - localhost:9243
-              labels:
-                env: prod
-        prometheus_scrape_configs:
-          - job_name: "prometheus"
-            metrics_path: "{{ prometheus_metrics_path }}"
-            static_configs:
-              - targets:
-                  - "{{ ansible_fqdn | default(ansible_host) | default('localhost') }}:9090"
-          - job_name: "node"
-            file_sd_configs:
-              - files:
-                  - "{{ prometheus_config_dir }}/file_sd/node.yml"
-          - job_name: 'blackbox'
-            metrics_path: /probe
-            params:
-              module: [http_2xx]
-            static_configs:
-              # all apps, nginx websites, prefixed with "https://"
-              - targets: '{{ ["https://"] | product((apps_conf_map | dict2items(key_name="app", value_name="conf") | map(attribute="conf") | map(attribute="access_domain") | list)+(nginx_websites | map(attribute="name") | list)) | map("join") | list }}' # noqa yaml
-            relabel_configs:
-              - source_labels: [__address__]
-                target_label: __param_target
-              - source_labels: [__param_target]
-                target_label: instance
-              - target_label: __address__
-                replacement: 127.0.0.1:9115  # Blackbox exporter.
-
-    - role: 'cloudalchemy.blackbox-exporter'
-      vars:
-        blackbox_exporter_web_listen_address: '0.0.0.0:9115'
+        media_downloader_sonarr_host_port: '{{ apps_conf_map["sonarr"]["port"] }}'
+        media_downloader_radarr_host_port: '{{ apps_conf_map["radarr"]["port"] }}'
+        media_downloader_prowlarr_host_port: '{{ apps_conf_map["prowlarr"]["port"] }}'
+        media_downloader_bazarr_host_port: '{{ apps_conf_map["bazarr"]["port"] }}'
+        media_downloader_transmission_root_dir: '{{ vol_media }}/transmission'
+        media_downloader_media_root_dir: '{{ vol_media }}/media'
 
 - hosts: compute
-  become: true
-  tags: 'base'
+  gather_facts: true
+  tags: 'monitoring'
   roles:
-    - role: geerlingguy.pip
+    - role: 'monitoring'
       vars:
-        pip_package: python3-pip
-        pip_install_packages:
-          - name: docker
-          - name: pexpect
-
-    - role: geerlingguy.docker_arm
-      vars:
-        docker_install_recommends: true
-        docker_install_compose: true
-        docker_users:
-          - pi
-        docker_pip_executable: pip3
-        docker_version_armv7: 5:20.10.10~3-0~raspbian-bullseye
-
-    - role: geerlingguy.nfs
-      vars:
-        nfs_exports:
-          - '{{ data_vol_ssd }} *(rw,sync,no_root_squash)'
-          - '{{ data_vol_hdd }} *(rw,sync,no_root_squash)'
-  pre_tasks:
-    - name: 'Install quality of life packages are present'
-      apt:
-        name:
-          - 'git'
-          - 'net-tools'
-          - 'neofetch'
-          - 'neovim'
-          - 'nnn'
-          - 'nmap'
-        update_cache: true
-
-    - name: 'Ensure that mount for data vol exists'
-      mount:
-        state: 'mounted'
-        path: '{{ item.vol_path }}'
-        src: 'UUID="{{ item.vol_uuid }}"'
-        boot: true
-        fstype: '{{ item.vol_fstype }}'
-        opts: 'rw,user,exec'
-      loop:
-        - vol_path: '{{ data_vol_ssd }}'
-          vol_uuid: '734d1190-b222-4979-91c8-0582e030fd1a'
-          vol_fstype: 'ext4'
-        - vol_path: '{{ data_vol_hdd }}'
-          vol_uuid: 'aa392d86-bc93-4ad4-9e9e-c1274384bbfb'
-          vol_fstype: 'ext4'
-
-    - name: 'Set python3 as default python'
-      alternatives:
-        name: 'python'
-        path: '/bin/python3'
+        monitoring_root_dir: '{{ vol_data }}/monitoring'
+        monitoring_apps_confs: '{{ apps_conf_map | dict2items(key_name="app", value_name="conf") }}'
+        monitoring_static_sites: '{{ nginx_websites }}'