Merge branch 'adguard' into 'master'

Adguard

See merge request kdam0/vps!3

25 files changed, 301 insertions, 25 deletions

diff --git a/roles/adguard/defaults/main.yaml b/roles/adguard/defaults/main.yaml
new file mode 100644
index 0000000..91abefa
--- /dev/null
+++ b/roles/adguard/defaults/main.yaml
@@ -0,0 +1,4 @@
+# Default Values
+---
+
+adguard_docker_network_name: 'adguard_network'
diff --git a/roles/adguard/handlers/main.yaml b/roles/adguard/handlers/main.yaml
new file mode 100644
index 0000000..cd21505
--- /dev/null
+++ b/roles/adguard/handlers/main.yaml
@@ -0,0 +1,2 @@
+---
+
diff --git a/roles/adguard/tasks/main.yaml b/roles/adguard/tasks/main.yaml
new file mode 100644
index 0000000..018b067
--- /dev/null
+++ b/roles/adguard/tasks/main.yaml
@@ -0,0 +1,38 @@
+# https://docs.photoprism.app/getting-started/docker-compose/
+---
+
+- name: 'Create the AdGuard network'
+  community.docker.docker_network:
+    name: '{{ adguard_docker_network_name }}'
+    state: 'present'
+
+- name: 'Create the required dirs'
+  file:
+    state: 'directory'
+    path: '{{ item }}'
+    mode: '755'
+  loop:
+    - '{{ adguard_data_root }}'
+    - '{{ adguard_data_root }}/data'
+    - '{{ adguard_data_root }}/conf'
+
+- name: 'Start the AdGuard container'
+  community.docker.docker_container:
+    name: 'adguard'
+    image: 'adguard/adguardhome'
+    pull: true
+    state: 'started'
+    recreate: false
+    networks:
+      - name:  '{{ adguard_docker_network_name }}'
+    ports:
+      # DNS
+      - '53:53/tcp'
+      - '53:53/udp'
+      # Web
+      - '{{ adguard_host_port }}:3000'
+    volumes:
+      - '{{ adguard_data_root }}/data:/opt/adguardhome/work'
+      - '{{ adguard_data_root }}/conf:/opt/adguardhome/conf'
+    # restart_policy: 'unless-stopped'
+    restart_policy: 'no'
diff --git a/roles/base/defaults/main.yaml b/roles/base/defaults/main.yaml
new file mode 100644
index 0000000..9a163d4
--- /dev/null
+++ b/roles/base/defaults/main.yaml
@@ -0,0 +1,2 @@
+# Default Values
+---
diff --git a/roles/base/handlers/main.yaml b/roles/base/handlers/main.yaml
new file mode 100644
index 0000000..cd21505
--- /dev/null
+++ b/roles/base/handlers/main.yaml
@@ -0,0 +1,2 @@
+---
+
diff --git a/roles/base/tasks/base_alpine.yaml b/roles/base/tasks/base_alpine.yaml
new file mode 100644
index 0000000..ed97d53
--- /dev/null
+++ b/roles/base/tasks/base_alpine.yaml
@@ -0,0 +1 @@
+---
diff --git a/roles/base/tasks/base_debian.yaml b/roles/base/tasks/base_debian.yaml
new file mode 100644
index 0000000..9d25ea6
--- /dev/null
+++ b/roles/base/tasks/base_debian.yaml
@@ -0,0 +1,62 @@
+---
+
+- name: 'Install base packages for Debian'
+  apt:
+    name:
+      - '{{ item }}'
+    state: 'present'
+    update_cache: true
+  loop:
+    - 'less'
+    - 'vim'
+    - 'tmux'
+    - 'neofetch'
+    - 'iotop-c'
+    - 'tcpdump'
+    - 'rsync'
+    - 'python3-pip'
+    - 'docker.io'
+    - 'docker-compose'
+
+- name: 'Install base packages for Python'
+  pip:
+    name: '{{ item }}'
+  loop:
+    - 'docker'
+    - 'pexpect'
+
+- name: "Create the user '{{ base_user }}'"
+  user:
+    name: '{{ base_user }}'
+    state: 'present'
+    shell: '/bin/bash'
+    uid: 1001
+    password: '{{ base_user_password | password_hash("sha512") }}'
+    create_home: true
+    generate_ssh_key: true
+    groups: 'sudo, docker'
+    append: true
+
+- name: 'Allow passwordless sudo for this {{ base_user }}'
+  lineinfile:
+    path: '/etc/sudoers'
+    state: 'present'
+    regexp: '^%{{ base_user }}\s+ALL='
+    line: '%{{ base_user }} ALL=(ALL) NOPASSWD: ALL'
+    validate: '/usr/sbin/visudo -cf %s'
+
+- block:
+    - name: 'Install kernel headers for currently installed kernel'
+      apt:
+        name: 'linux-headers-current-rockchip64'
+        state: 'present'
+
+    - name: 'Install zfs modules and package'
+      apt:
+        name: '{{ item }}'
+        state: 'present'
+        default_release: 'bullseye-backports'
+      loop:
+        - 'zfs-dkms'
+        - 'zfsutils-linux'
+  when: 'base_hardware == "rockchip64"'
diff --git a/roles/base/tasks/main.yaml b/roles/base/tasks/main.yaml
new file mode 100644
index 0000000..4930d10
--- /dev/null
+++ b/roles/base/tasks/main.yaml
@@ -0,0 +1,9 @@
+---
+
+- name: 'Run base install for Alpine'
+  import_tasks: 'base_alpine.yaml'
+  when: 'ansible_os_family == "Alpine"'
+
+- name: 'Run base install for Debian'
+  import_tasks: 'base_debian.yaml'
+  when: 'ansible_os_family == "Debian"'
diff --git a/roles/ddclient/tasks/main.yaml b/roles/ddclient/tasks/main.yaml
index d780a3f..defcef8 100644
--- a/roles/ddclient/tasks/main.yaml
+++ b/roles/ddclient/tasks/main.yaml
@@ -15,9 +15,16 @@
     update_cache: true
   when: 'ansible_os_family == "Debian"'
 
+# - name: 'Update ddclient conf'
+#   template:
+#     dest: '/etc/ddclient/ddclient.conf'
+#     src: 'ddclient.conf.j2'
+#     mode: '644'
+#   notify: 'restart ddclient'
+
 - name: 'Update ddclient conf'
   template:
-    dest: '/etc/ddclient/ddclient.conf'
+    dest: '/etc/ddclient.conf'
     src: 'ddclient.conf.j2'
     mode: '644'
   notify: 'restart ddclient'
diff --git a/roles/media_downloader/tasks/main.yaml b/roles/media_downloader/tasks/main.yaml
index d3840a5..5f6c8c8 100644
--- a/roles/media_downloader/tasks/main.yaml
+++ b/roles/media_downloader/tasks/main.yaml
@@ -15,8 +15,8 @@
     state: 'started'
     recreate: false
     env:
-      "PUID": '1000'
-      "PGID": '1000'
+      "PUID": '1001'
+      "PGID": '1001'
       "TZ": 'America/Toronto'
     networks:
       - name:  '{{ media_downloader_docker_network_name }}'
@@ -36,8 +36,8 @@
     state: 'started'
     recreate: false
     env:
-      "PUID": '1000'
-      "PGID": '1000'
+      "PUID": '1001'
+      "PGID": '1001'
       "TZ": 'America/Toronto'
     networks:
       - name:  '{{ media_downloader_docker_network_name }}'
@@ -57,8 +57,8 @@
     state: 'started'
     recreate: false
     env:
-      "PUID": '1000'
-      "PGID": '1000'
+      "PUID": '1001'
+      "PGID": '1001'
       "TZ": 'America/Toronto'
     networks:
       - name:  '{{ media_downloader_docker_network_name }}'
@@ -76,8 +76,8 @@
     state: 'started'
     recreate: false
     env:
-      "PUID": '1000'
-      "PGID": '1000'
+      "PUID": '1001'
+      "PGID": '1001'
       "TZ": 'America/Toronto'
       "UMASK": '002'
     networks:
diff --git a/roles/monitoring/files/zfs-exporter.service b/roles/monitoring/files/zfs-exporter.service
new file mode 100644
index 0000000..8982723
--- /dev/null
+++ b/roles/monitoring/files/zfs-exporter.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=ZFS Exporter
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/zfs_exporter
+LimitNOFILE=infinity
+User=root
+Group=root
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/monitoring/tasks/node.yaml b/roles/monitoring/tasks/node.yaml
index 5d38f1f..632ceb8 100644
--- a/roles/monitoring/tasks/node.yaml
+++ b/roles/monitoring/tasks/node.yaml
@@ -21,3 +21,18 @@
         state: 'started'
         enabled: true
   when: 'ansible_os_family == "Alpine"'
+
+- block:
+    - name: 'Install node-exporter'
+      become: true
+      package:
+        name: 'prometheus-node-exporter'
+        state: 'present'
+
+    - name: 'Start and enable node-exporter service'
+      become: true
+      service:
+        name: 'prometheus-node-exporter'
+        state: 'started'
+        enabled: true
+  when: 'ansible_os_family == "Debian"'
diff --git a/roles/monitoring/tasks/zfs.yaml b/roles/monitoring/tasks/zfs.yaml
index 2f18e32..a30a7ac 100644
--- a/roles/monitoring/tasks/zfs.yaml
+++ b/roles/monitoring/tasks/zfs.yaml
@@ -17,13 +17,13 @@
     mode: '755'
 
 - name: 'Extract ZFS exporter to dir'
-  command: 'tar -xf zfs_exporter-2.2.5.linux-arm64.tar.gz'
+  command: 'tar -xf zfs_exporter.tar.gz'
   args:
     chdir: '{{ monitoring_root_dir }}'
 
 - name: 'Copy the executable to /usr/bin'
   become: true
-  become_method: 'doas'
+  # become_method: 'doas'
   copy:
     src: '{{ monitoring_root_dir }}/zfs_exporter-2.2.5.linux-arm64/zfs_exporter'
     dest: '/usr/bin/zfs_exporter'
@@ -31,18 +31,31 @@
     owner: 'root'
     remote_src: true
 
-- name: 'Create service file to start zfs_exporter on boot'
+# - name: 'Create service file to start zfs_exporter on boot'
+#   become: true
+#   # become_method: 'doas'
+#   copy:
+#     src: 'zfs-exporter'
+#     dest: '/etc/init.d/zfs-exporter'
+#     mode: '0755'
+#     owner: 'root'
+#
+- name: 'Create systemd services'
   become: true
-  become_method: 'doas'
   copy:
-    src: 'zfs-exporter'
-    dest: '/etc/init.d/zfs-exporter'
-    mode: '0755'
-    owner: 'root'
+    src: 'zfs-exporter.service'
+    dest: '/etc/systemd/system/zfs-exporter.service'
+    mode: '644'
+  # notify:
+  #   - 'zfs-exporter restart'
+
+- name: 'Reload systemd units'
+  become: true
+  systemd:
+    daemon_reload: true
 
 - name: 'Start and enable the zfs-exporter service'
   become: true
-  become_method: 'doas'
   service:
     name: 'zfs-exporter'
     state: 'started'
diff --git a/roles/nextcloud/defaults/main.yaml b/roles/nextcloud/defaults/main.yaml
index cd11c66..b0c20f3 100644
--- a/roles/nextcloud/defaults/main.yaml
+++ b/roles/nextcloud/defaults/main.yaml
@@ -1,8 +1,8 @@
 # Default Values
 ---
 
-nextcloud_uid: "1000"
-nextcloud_gid: "1000"
+nextcloud_uid: "1001"
+nextcloud_gid: "1001"
 nextcloud_tz: 'America/Toronto'
 nextcloud_data_root: ''
 nextcloud_host_port: ''
diff --git a/roles/nextcloud/tasks/main.yaml b/roles/nextcloud/tasks/main.yaml
index c1d91aa..2354d4b 100644
--- a/roles/nextcloud/tasks/main.yaml
+++ b/roles/nextcloud/tasks/main.yaml
@@ -35,7 +35,7 @@
 - name: 'Make sure the Nextcloud container is created and running'
   community.docker.docker_container:
     name: '{{ nextcloud_container_name }}'
-    image: 'ghcr.io/linuxserver/nextcloud:php8-24.0.4-ls81'
+    image: 'lscr.io/linuxserver/nextcloud:25.0.2'
     pull: true
     state: 'started'
     env:
diff --git a/roles/nginx_docker/templates/app.nginx.conf.j2 b/roles/nginx_docker/templates/app.nginx.conf.j2
index 82c3610..f6f92de 100644
--- a/roles/nginx_docker/templates/app.nginx.conf.j2
+++ b/roles/nginx_docker/templates/app.nginx.conf.j2
@@ -1,5 +1,6 @@
 server {
     listen 443 ssl;
+    client_max_body_size 500M;
     root _;
     server_name {{ item.conf.access_domain }};
     ssl_certificate     /etc/letsencrypt/live/{{ nginx_global_apps_domain }}/fullchain.pem;
@@ -18,8 +19,13 @@ server {
         proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header   X-Forwarded-Host $server_name;
         proxy_set_header   X-Forwarded-Proto https;
+{% if item.app == "photoprism" %} {# Photoprism requires websockets #}
+        proxy_buffering off;
+        proxy_http_version 1.1;
+        proxy_set_header   Upgrade $http_upgrade;
+        proxy_set_header   Connection "upgrade";
+{% endif %}
         proxy_read_timeout  1200s;
-        client_max_body_size 0;
         error_log       /var/log/nginx/{{ item.app }}.error.log;
     }
 }
diff --git a/roles/photoprism/defaults/main.yaml b/roles/photoprism/defaults/main.yaml
new file mode 100644
index 0000000..29e3605
--- /dev/null
+++ b/roles/photoprism/defaults/main.yaml
@@ -0,0 +1,4 @@
+# Default Values
+---
+
+photoprism_docker_network_name: 'photoprism_network'
diff --git a/roles/photoprism/handlers/main.yaml b/roles/photoprism/handlers/main.yaml
new file mode 100644
index 0000000..cd21505
--- /dev/null
+++ b/roles/photoprism/handlers/main.yaml
@@ -0,0 +1,2 @@
+---
+
diff --git a/roles/photoprism/tasks/main.yaml b/roles/photoprism/tasks/main.yaml
new file mode 100644
index 0000000..73d807c
--- /dev/null
+++ b/roles/photoprism/tasks/main.yaml
@@ -0,0 +1,52 @@
+# https://docs.photoprism.app/getting-started/docker-compose/
+---
+
+- name: 'Create the photoprism network'
+  community.docker.docker_network:
+    name: '{{ photoprism_docker_network_name }}'
+    state: 'present'
+
+- name: 'Install Photoprism'
+  community.docker.docker_container:
+    name: 'photoprism'
+    image: 'photoprism/photoprism:latest'
+    pull: true
+    state: 'started'
+    recreate: false
+    security_opts:
+      - 'seccomp:unconfined'
+      - 'apparmor:unconfined'
+    env:
+      PHOTOPRISM_ADMIN_PASSWORD: "{{ photoprism_admin_password }}"          # INITIAL PASSWORD FOR "admin" USER, MINIMUM 8 CHARACTERS
+      PHOTOPRISM_AUTH_MODE: "password"               # authentication mode (public, password)
+      PHOTOPRISM_SITE_URL: "https://photos.kumardamani.net/"  # public server URL incl http:// or https:// and /path, :port is optional
+      PHOTOPRISM_ORIGINALS_LIMIT: "5000"               # file size limit for originals in MB (increase for high-res video)
+      PHOTOPRISM_HTTP_COMPRESSION: "gzip"            # improves transfer speed and bandwidth utilization (none or gzip)
+      PHOTOPRISM_LOG_LEVEL: "info"                   # log level: trace, debug, info, warning, error, fatal, or panic
+      PHOTOPRISM_READONLY: "true"                   # do not modify originals directory (reduced functionality)
+      PHOTOPRISM_EXPERIMENTAL: "false"               # enables experimental features
+      PHOTOPRISM_DISABLE_CHOWN: "true"              # disables updating storage permissions via chmod and chown on startup
+      PHOTOPRISM_DISABLE_WEBDAV: "true"             # disables built-in WebDAV server
+      PHOTOPRISM_DISABLE_SETTINGS: "false"           # disables settings UI and API
+      PHOTOPRISM_DISABLE_TENSORFLOW: "true"         # disables all features depending on TensorFlow
+      PHOTOPRISM_DISABLE_FACES: "true"              # disables face detection and recognition (requires TensorFlow)
+      PHOTOPRISM_DISABLE_CLASSIFICATION: "true"     # disables image classification (requires TensorFlow)
+      PHOTOPRISM_DISABLE_RAW: "true"                # disables indexing and conversion of RAW files
+      PHOTOPRISM_RAW_PRESETS: "false"                # enables applying user presets when converting RAW files (reduces performance)
+      PHOTOPRISM_JPEG_QUALITY: "85"                    # a higher value increases the quality and file size of JPEG images and thumbnails (25-100)
+      PHOTOPRISM_DETECT_NSFW: "false"                # automatically flags photos as private that MAY be offensive (requires TensorFlow)
+      PHOTOPRISM_UPLOAD_NSFW: "false"                 # allows uploads that MAY be offensive (no effect without TensorFlow)
+      PHOTOPRISM_DATABASE_DRIVER: "sqlite"         # SQLite is an embedded database that doesn't require a server
+      PHOTOPRISM_SITE_CAPTION: "Photos App"
+      PHOTOPRISM_SITE_DESCRIPTION: "Some of our pics"                # meta site description
+      PHOTOPRISM_SITE_AUTHOR: "Kumar"                     # meta site author
+      PHOTOPRISM_INIT: "gpu tensorflow"
+    working_dir: "/photoprism"
+    networks:
+      - name:  '{{ photoprism_docker_network_name }}'
+    ports:
+      - '{{ photoprism_host_port }}:2342'
+    volumes:
+      - '{{ photoprism_pics_root_dir }}:/photoprism/originals:ro'
+      - '{{ photoprism_data_dir }}:/photoprism/storage'
+    restart_policy: "unless-stopped"
diff --git a/roles/plex/defaults/main.yaml b/roles/plex/defaults/main.yaml
new file mode 100644
index 0000000..57e1fc7
--- /dev/null
+++ b/roles/plex/defaults/main.yaml
@@ -0,0 +1,4 @@
+# Default Values
+---
+
+plex_docker_network_name: 'plex_network'
diff --git a/roles/plex/handlers/main.yaml b/roles/plex/handlers/main.yaml
new file mode 100644
index 0000000..cd21505
--- /dev/null
+++ b/roles/plex/handlers/main.yaml
@@ -0,0 +1,2 @@
+---
+
diff --git a/roles/plex/tasks/main.yaml b/roles/plex/tasks/main.yaml
new file mode 100644
index 0000000..7cbb531
--- /dev/null
+++ b/roles/plex/tasks/main.yaml
@@ -0,0 +1,22 @@
+---
+
+- name: 'Install Plex'
+  community.docker.docker_container:
+    name: 'plex'
+    image: 'lscr.io/linuxserver/plex:latest'
+    pull: true
+    state: 'started'
+    recreate: false
+    env:
+      PUID: "1001"
+      PGID: "1001"
+      VERSION: "docker"
+      PLEX_CLAIM: "{{ plex_claim }}"
+    network_mode: 'host' # will use 32400
+    volumes:
+      - '{{ plex_library_dir }}:/config'
+      - '{{ plex_tv_dir }}:/tv'
+      - '{{ plex_mov_dir }}:/movies'
+      - '{{ plex_pic_dir }}:/pics'
+      - '{{ plex_music_dir }}:/music'
+    restart_policy: "unless-stopped"
diff --git a/roles/transmission/tasks/main.yaml b/roles/transmission/tasks/main.yaml
index 91d3971..229184f 100644
--- a/roles/transmission/tasks/main.yaml
+++ b/roles/transmission/tasks/main.yaml
@@ -14,8 +14,8 @@
     state: 'started'
     recreate: true
     env:
-      "PUID": '1000'
-      "PGID": '1000'
+      "PUID": '1001'
+      "PGID": '1001'
       "TZ": 'America/Toronto'
       USER: '{{ transmission_user }}'
       PASS: '{{ transmission_password }}'
diff --git a/roles/website/tasks/main.yaml b/roles/website/tasks/main.yaml
index 66bc955..07780b5 100644
--- a/roles/website/tasks/main.yaml
+++ b/roles/website/tasks/main.yaml
@@ -2,11 +2,19 @@
 
 - name: 'Install git'
   become: true
-  become_method: 'doas'
+  # become_method: 'doas'
   package:
     name: 'git'
     state: 'present'
 
+- name: 'Remove domain level dir'
+  file:
+    path: '{{ sites_data_root }}/{{ item.name }}/html'
+    state: 'absent'
+  when: 'item.git_url is defined'
+  loop: '{{ websites }}'
+
+
 - name: 'Create domain level dir'
   file:
     path: '{{ sites_data_root }}/{{ item.name }}/html'
@@ -33,3 +41,10 @@
     remote_src: true
   when: 'item.git_url is defined'
   loop: '{{ websites }}'
+
+- name: 'Remove git checkout'
+  file:
+    path: '/home/{{ ansible_user }}/{{ item.name }}'
+    state: 'absent'
+  when: 'item.git_url is defined'
+  loop: '{{ websites }}'
diff --git a/roles/wireguard/tasks/main.yaml b/roles/wireguard/tasks/main.yaml
index c3f0942..aa8b20d 100644
--- a/roles/wireguard/tasks/main.yaml
+++ b/roles/wireguard/tasks/main.yaml
@@ -9,6 +9,7 @@
       loop:
         - 'iptables'
         - 'wireguard-tools'
+        - 'libqrencode'
 
     - name: 'Enable iptables'
       service: