Merge branch 'alpine' into 'master'

switched to alpine initial commit

See merge request kdam0/vps!2

31 files changed, 583 insertions, 30 deletions

diff --git a/roles/bitwarden/tasks/main.yaml b/roles/bitwarden/tasks/main.yaml
index 5fd0ed4..0fd7b86 100644
--- a/roles/bitwarden/tasks/main.yaml
+++ b/roles/bitwarden/tasks/main.yaml
@@ -1,11 +1,18 @@
 ---
 
+- name: 'Ensure bitwarden data dir exists'
+  file:
+    path: "{{ bitwarden_data_dir }}"
+    state: "directory"
+    mode: '755'
+
 - name: 'Make sure the Vaultwarden container is created and running'
   docker_container:
     name: '{{ bitwarden_container_name }}'
     image: 'vaultwarden/server'
     pull: true
     state: 'started'
+    recreate: true
     env:
       WEBSOCKET_ENABLED: 'true'
       INVITATIONS_ALLOWED: 'true'
diff --git a/roles/ddclient/handlers/main.yaml b/roles/ddclient/handlers/main.yaml
index be19365..a2b6ea4 100644
--- a/roles/ddclient/handlers/main.yaml
+++ b/roles/ddclient/handlers/main.yaml
@@ -1,7 +1,7 @@
 ---
 
 - name: 'Restart ddclient'
-  systemd:
+  service:
     name: 'ddclient'
     state: 'restarted'
   listen: 'restart ddclient'
diff --git a/roles/ddclient/tasks/main.yaml b/roles/ddclient/tasks/main.yaml
index 8deffc2..d780a3f 100644
--- a/roles/ddclient/tasks/main.yaml
+++ b/roles/ddclient/tasks/main.yaml
@@ -1,22 +1,29 @@
-# https://notthebe.ee/raspi.html
+# https://wiki.alpinelinux.org/wiki/Ddclient
 ---
 
-- name: 'Install required apt packages'
+- name: 'Install ddclient for Alpine'
+  apk:
+    name: 'ddclient'
+    state: 'latest'
+  when: 'ansible_os_family == "Alpine"'
+
+- name: 'Install ddclient for Debian'
   apt:
     name:
       - 'ddclient'
     state: 'present'
     update_cache: true
+  when: 'ansible_os_family == "Debian"'
 
 - name: 'Update ddclient conf'
   template:
-    dest: '/etc/ddclient.conf'
+    dest: '/etc/ddclient/ddclient.conf'
     src: 'ddclient.conf.j2'
     mode: '644'
   notify: 'restart ddclient'
 
-- name: 'Start ddclient'
-  systemd:
+- name: 'Start and enable ddclient'
+  service:
     name: 'ddclient'
     state: 'started'
     enabled: true
diff --git a/roles/media_downloader/defaults/main.yaml b/roles/media_downloader/defaults/main.yaml
new file mode 100644
index 0000000..8fffe70
--- /dev/null
+++ b/roles/media_downloader/defaults/main.yaml
@@ -0,0 +1,7 @@
+# Default Values
+---
+
+media_downloader_uid: "1000"
+media_downloader_gid: "1000"
+media_downloader_tz: 'America/Toronto'
+media_downloader_docker_network_name: 'media_downloader_network'
diff --git a/roles/media_downloader/handlers/main.yaml b/roles/media_downloader/handlers/main.yaml
new file mode 100644
index 0000000..cd21505
--- /dev/null
+++ b/roles/media_downloader/handlers/main.yaml
@@ -0,0 +1,2 @@
+---
+
diff --git a/roles/media_downloader/tasks/main.yaml b/roles/media_downloader/tasks/main.yaml
new file mode 100644
index 0000000..d3840a5
--- /dev/null
+++ b/roles/media_downloader/tasks/main.yaml
@@ -0,0 +1,91 @@
+# https://wiki.servarr.com/
+# https://trash-guides.info/
+---
+
+- name: 'Create the media_downloader network'
+  community.docker.docker_network:
+    name: '{{ media_downloader_docker_network_name }}'
+    state: 'present'
+
+- name: 'Install radarr for movies'
+  community.docker.docker_container:
+    name: 'radarr'
+    image: 'lscr.io/linuxserver/radarr:4.1.0.6175-ls146'
+    pull: true
+    state: 'started'
+    recreate: false
+    env:
+      "PUID": '1000'
+      "PGID": '1000'
+      "TZ": 'America/Toronto'
+    networks:
+      - name:  '{{ media_downloader_docker_network_name }}'
+    ports:
+      - '{{ media_downloader_radarr_host_port }}:7878'
+    volumes:
+      - radarr-config:/config
+      - '{{ media_downloader_transmission_root_dir }}/downloads:/downloads'
+      - '{{ media_downloader_media_root_dir }}/mov:/mov'
+    restart_policy: "unless-stopped"
+
+- name: 'Install sonarr for tv'
+  community.docker.docker_container:
+    name: 'sonarr'
+    image: 'lscr.io/linuxserver/sonarr:3.0.9.1549-ls154'
+    pull: true
+    state: 'started'
+    recreate: false
+    env:
+      "PUID": '1000'
+      "PGID": '1000'
+      "TZ": 'America/Toronto'
+    networks:
+      - name:  '{{ media_downloader_docker_network_name }}'
+    ports:
+      - '{{ media_downloader_sonarr_host_port }}:8989'
+    volumes:
+      - sonarr-config:/config
+      - '{{ media_downloader_transmission_root_dir }}/downloads:/downloads'
+      - '{{ media_downloader_media_root_dir }}/tv:/tv'
+    restart_policy: "unless-stopped"
+
+- name: 'Install prowlarr for indexing sources'
+  community.docker.docker_container:
+    name: 'prowlarr'
+    image: 'linuxserver/prowlarr:develop-0.4.4.1947-ls65'
+    pull: true
+    state: 'started'
+    recreate: false
+    env:
+      "PUID": '1000'
+      "PGID": '1000'
+      "TZ": 'America/Toronto'
+    networks:
+      - name:  '{{ media_downloader_docker_network_name }}'
+    ports:
+      - '{{ media_downloader_prowlarr_host_port }}:9696'
+    volumes:
+      - prowlarr-config:/config
+    restart_policy: "unless-stopped"
+
+- name: 'Install bazarr for subtitles'
+  community.docker.docker_container:
+    name: 'bazarr'
+    image: 'cr.hotio.dev/hotio/bazarr:release-1.1.0'
+    pull: true
+    state: 'started'
+    recreate: false
+    env:
+      "PUID": '1000'
+      "PGID": '1000'
+      "TZ": 'America/Toronto'
+      "UMASK": '002'
+    networks:
+      - name:  '{{ media_downloader_docker_network_name }}'
+    ports:
+      - '{{ media_downloader_bazarr_host_port }}:6767'
+    volumes:
+      - bazaar-config:/config
+      - '{{ media_downloader_media_root_dir }}/tv:/tv'
+      - '{{ media_downloader_media_root_dir }}/mov:/mov'
+    restart_policy: "unless-stopped"
diff --git a/roles/monitoring/defaults/main.yaml b/roles/monitoring/defaults/main.yaml
new file mode 100644
index 0000000..cd11c66
--- /dev/null
+++ b/roles/monitoring/defaults/main.yaml
@@ -0,0 +1,17 @@
+# Default Values
+---
+
+nextcloud_uid: "1000"
+nextcloud_gid: "1000"
+nextcloud_tz: 'America/Toronto'
+nextcloud_data_root: ''
+nextcloud_host_port: ''
+
+nextcloud_docker_network_name: 'nextcloud_network'
+
+nextcloud_postgres_db: 'nextcloud_db'
+nextcloud_postgres_user: 'nextcloud'
+nextcloud_postgres_password: ''
+
+nextcloud_container_name: 'nextcloud'
+nextcloud_dashboard_url: 'https://{{ nextcloud_domain }}'
diff --git a/roles/monitoring/files/zfs-exporter b/roles/monitoring/files/zfs-exporter
new file mode 100644
index 0000000..7f5a09d
--- /dev/null
+++ b/roles/monitoring/files/zfs-exporter
@@ -0,0 +1,23 @@
+#!/sbin/openrc-run
+supervisor=supervise-daemon
+
+command="/usr/bin/zfs_exporter"
+command_args="$ARGS"
+command_background="yes"
+group="root"
+user="root"
+
+logdir="/var/log/prometheus"
+logfile="$logdir/${SVCNAME}.log"
+pidfile="/var/run/${SVCNAME}.pid"
+start_stop_daemon_args="--stderr $logfile --user $user --group $group"
+
+depend() {
+        need net
+        after firewall
+}
+
+start_pre() {
+        checkpath -d -o $user:$group -m755 $logdir
+        checkpath -f -o $user:$group -m644 $logfile
+}
diff --git a/roles/monitoring/handlers/main.yaml b/roles/monitoring/handlers/main.yaml
new file mode 100644
index 0000000..7613b54
--- /dev/null
+++ b/roles/monitoring/handlers/main.yaml
@@ -0,0 +1,7 @@
+---
+
+- name: 'Restart nginx'
+  systemd:
+    name: 'nginx'
+    state: 'restarted'
+  listen: 'nginx_restart'
diff --git a/roles/monitoring/tasks/blackbox.yaml b/roles/monitoring/tasks/blackbox.yaml
new file mode 100644
index 0000000..932b457
--- /dev/null
+++ b/roles/monitoring/tasks/blackbox.yaml
@@ -0,0 +1,21 @@
+---
+
+# Blackbox Exporter for service level monitoring
+- name: 'Copy the blackbox.yml config file to conf dir'
+  template:
+    src: 'blackbox.yml.j2'
+    dest: '{{ monitoring_root_dir }}/blackbox.yml'
+    mode: '0644'
+
+- name: 'Make sure the blackbox exporter container is created and running'
+  docker_container:
+    name: 'blackbox-exporter'
+    image: 'prom/blackbox-exporter:v0.22.0'
+    pull: true
+    state: 'started'
+    recreate: true
+    command: '--config.file=/config/blackbox.yml'
+    volumes:
+      - "{{ monitoring_root_dir }}/blackbox.yml:/config/blackbox.yml"
+    network_mode: 'host'
+    restart_policy: unless-stopped
diff --git a/roles/monitoring/tasks/main.yaml b/roles/monitoring/tasks/main.yaml
new file mode 100644
index 0000000..268659b
--- /dev/null
+++ b/roles/monitoring/tasks/main.yaml
@@ -0,0 +1,19 @@
+---
+
+- name: 'Ensure monitoring root dir exists'
+  file:
+    path: '{{ monitoring_root_dir }}'
+    state: 'directory'
+    mode: '755'
+
+- name: 'Setup the Node Exporter'
+  import_tasks: 'node.yaml'
+
+- name: 'Setup the Blackbox Exporter'
+  import_tasks: 'blackbox.yaml'
+
+- name: 'Setup the ZFS Exporter'
+  import_tasks: 'zfs.yaml'
+
+- name: 'Setup Prometheus'
+  import_tasks: 'prometheus.yaml'
diff --git a/roles/monitoring/tasks/node.yaml b/roles/monitoring/tasks/node.yaml
new file mode 100644
index 0000000..5d38f1f
--- /dev/null
+++ b/roles/monitoring/tasks/node.yaml
@@ -0,0 +1,23 @@
+# https://www.robustperception.io/temperature-and-hardware-monitoring-metrics-from-the-node-exporter/
+---
+
+# Need to install lm-sensors lm-sensors-detect
+# Run sensors, for configurations.
+
+# Node Exporter for OS level monitoring is recommneded to be installed w/o Docker.
+- block:
+    - name: 'Install node-exporter'
+      become: true
+      become_method: 'doas'
+      package:
+        name: 'prometheus-node-exporter'
+        state: 'present'
+
+    - name: 'Start and enable node-exporter service'
+      become: true
+      become_method: 'doas'
+      service:
+        name: 'node-exporter'
+        state: 'started'
+        enabled: true
+  when: 'ansible_os_family == "Alpine"'
diff --git a/roles/monitoring/tasks/prometheus.yaml b/roles/monitoring/tasks/prometheus.yaml
new file mode 100644
index 0000000..0fbfd89
--- /dev/null
+++ b/roles/monitoring/tasks/prometheus.yaml
@@ -0,0 +1,23 @@
+---
+
+# Install Prometheus as TSDB for monitoring metrics
+- name: 'Copy the prometheus.yml config file to conf dir'
+  template:
+    src: 'prometheus.yml.j2'
+    dest: '{{ monitoring_root_dir }}/prometheus.yml'
+    mode: '0644'
+
+- name: 'Make sure prometheus container is created and running'
+  docker_container:
+    name: 'prometheus'
+    image: 'prom/prometheus:v2.37.0'
+    pull: true
+    state: 'started'
+    recreate: true
+    command: '--config.file=/etc/prometheus/prometheus.yml --storage.tsdb.path=/data/prometheus'
+    user: 'root'
+    volumes:
+      - "{{ monitoring_root_dir }}/prometheus.yml:/etc/prometheus/prometheus.yml"
+      - "{{ monitoring_root_dir }}/prom_data:/data/prometheus"
+    network_mode: 'host'
+    restart_policy: unless-stopped
diff --git a/roles/monitoring/tasks/zfs.yaml b/roles/monitoring/tasks/zfs.yaml
new file mode 100644
index 0000000..2f18e32
--- /dev/null
+++ b/roles/monitoring/tasks/zfs.yaml
@@ -0,0 +1,49 @@
+# https://github.com/pdf/zfs_exporter
+
+---
+
+# ZFS Exporter for ZFS monitoring
+
+- name: 'Download zfs exporter tarball'
+  get_url:
+    url: 'https://github.com/pdf/zfs_exporter/releases/download/v2.2.5/zfs_exporter-2.2.5.linux-arm64.tar.gz'
+    dest: '{{ monitoring_root_dir }}/zfs_exporter.tar.gz'
+    mode: '644'
+
+- name: 'Ensure the zfs exporter dir exists'
+  file:
+    path: '{{ monitoring_root_dir }}/zfs_exporter-2.2.5.linux-arm64'
+    state: 'directory'
+    mode: '755'
+
+- name: 'Extract ZFS exporter to dir'
+  command: 'tar -xf zfs_exporter-2.2.5.linux-arm64.tar.gz'
+  args:
+    chdir: '{{ monitoring_root_dir }}'
+
+- name: 'Copy the executable to /usr/bin'
+  become: true
+  become_method: 'doas'
+  copy:
+    src: '{{ monitoring_root_dir }}/zfs_exporter-2.2.5.linux-arm64/zfs_exporter'
+    dest: '/usr/bin/zfs_exporter'
+    mode: '0755'
+    owner: 'root'
+    remote_src: true
+
+- name: 'Create service file to start zfs_exporter on boot'
+  become: true
+  become_method: 'doas'
+  copy:
+    src: 'zfs-exporter'
+    dest: '/etc/init.d/zfs-exporter'
+    mode: '0755'
+    owner: 'root'
+
+- name: 'Start and enable the zfs-exporter service'
+  become: true
+  become_method: 'doas'
+  service:
+    name: 'zfs-exporter'
+    state: 'started'
+    enabled: true
diff --git a/roles/monitoring/templates/blackbox.yml.j2 b/roles/monitoring/templates/blackbox.yml.j2
new file mode 100644
index 0000000..9dd359a
--- /dev/null
+++ b/roles/monitoring/templates/blackbox.yml.j2
@@ -0,0 +1,4 @@
+modules:
+  http_2xx:
+    prober: http
+    timeout: 5s
diff --git a/roles/monitoring/templates/prometheus.yml.j2 b/roles/monitoring/templates/prometheus.yml.j2
new file mode 100644
index 0000000..9bdbbe3
--- /dev/null
+++ b/roles/monitoring/templates/prometheus.yml.j2
@@ -0,0 +1,62 @@
+global:
+  scrape_interval: 15s
+  evaluation_interval: 30s
+
+scrape_configs:
+  - job_name: 'prometheus'
+    honor_labels: true
+    static_configs:
+      - targets: ["localhost:9090"]
+        labels:
+          env: prod
+
+  - job_name: 'node_exporter'
+    static_configs:
+      - targets: ["localhost:9100"]
+
+  - job_name: 'zfs_exporter'
+    metrics_path: /metrics
+    static_configs:
+        - targets: ["localhost:9134"]
+
+  - job_name: 'blackbox-service-status'
+    metrics_path: /probe
+    params:
+      module: [http_2xx]
+    static_configs:
+{% for t in monitoring_apps_confs %}
+{% if not t.conf.curl_requires_auth %}
+      - targets:
+{% if "access_domain" in t.conf %}
+          - 'https://{{ t.conf.access_domain }}{{ t.conf.status_endpoint }}'
+{% else %}
+          - 'http://0.0.0.0:{{ t.conf.port }}{{ t.conf.status_endpoint }}'
+{% endif %}
+        labels:
+          name: '{{ t.app }}'
+{% endif %}
+{% endfor %}
+    relabel_configs:
+      - source_labels: [__address__]
+        target_label: __param_target
+      - source_labels: [__param_target]
+        target_label: instance
+      - target_label: __address__
+        replacement: 127.0.0.1:9115  # Blackbox exporter.
+
+  - job_name: 'blackbox-ssl-sites'
+    metrics_path: /probe
+    params:
+      module: [http_2xx]
+    static_configs:
+      - targets:
+{% for t in monitoring_static_sites %}
+          - 'https://{{ t.name }}'
+{% endfor %}
+    relabel_configs:
+      - source_labels: [__address__]
+        target_label: __param_target
+      - source_labels: [__param_target]
+        target_label: instance
+      - target_label: __address__
+        replacement: 127.0.0.1:9115  # Blackbox exporter.
diff --git a/roles/nextcloud/tasks/main.yaml b/roles/nextcloud/tasks/main.yaml
index 593bfa3..c1d91aa 100644
--- a/roles/nextcloud/tasks/main.yaml
+++ b/roles/nextcloud/tasks/main.yaml
@@ -12,11 +12,7 @@
     image: 'postgres:14.1-alpine'
     pull: true
     state: 'started'
-    labels:
-      "flame.type": "application"
-      "flame.name": "{{ nextcloud_container_name | title }}"
-      "flame.url": "{{ nextcloud_dashboard_url }}"
-      "flame.icon": "custom"
+    recreate: true
     env:
       "PUID": '{{ nextcloud_uid }}'
       "PGID": '{{ nextcloud_gid }}'
@@ -39,7 +35,7 @@
 - name: 'Make sure the Nextcloud container is created and running'
   community.docker.docker_container:
     name: '{{ nextcloud_container_name }}'
-    image: 'ghcr.io/linuxserver/nextcloud:php8'
+    image: 'ghcr.io/linuxserver/nextcloud:php8-24.0.4-ls81'
     pull: true
     state: 'started'
     env:
diff --git a/roles/nginx_docker/defaults/main.yaml b/roles/nginx_docker/defaults/main.yaml
new file mode 100644
index 0000000..af90628
--- /dev/null
+++ b/roles/nginx_docker/defaults/main.yaml
@@ -0,0 +1,7 @@
+# Default Values
+---
+
+nginx_port: '80'
+nginx_website_domains: []
+nginx_global_apps_domain: ''
+nginx_apps_confs: {}
diff --git a/roles/nginx_docker/handlers/main.yaml b/roles/nginx_docker/handlers/main.yaml
new file mode 100644
index 0000000..cd21505
--- /dev/null
+++ b/roles/nginx_docker/handlers/main.yaml
@@ -0,0 +1,2 @@
+---
+
diff --git a/roles/nginx_docker/tasks/main.yaml b/roles/nginx_docker/tasks/main.yaml
new file mode 100644
index 0000000..bda276e
--- /dev/null
+++ b/roles/nginx_docker/tasks/main.yaml
@@ -0,0 +1,43 @@
+---
+
+- name: 'Ensure conf dir exists'
+  file:
+    path: '{{ item }}'
+    state: 'directory'
+    mode: '755'
+  loop:
+    - '{{ nginx_conf_root }}'
+    - '{{ nginx_static_html_root }}'
+    - '{{ nginx_certs_root }}'
+
+- name: 'Copy the http nginx.conf files'
+  template:
+    src: 'http.nginx.conf.j2'
+    dest: '{{ nginx_conf_root }}/{{ item }}.conf'
+    mode: '644'
+  loop: '{{ nginx_website_domains }}'
+
+- name: 'Copy the http nginx.conf for apps'
+  template:
+    src: 'app.nginx.conf.j2'
+    dest: '{{ nginx_conf_root }}/{{ item.app }}.conf'
+    mode: '644'
+  when: 'item.conf.access_domain is defined'
+  loop: '{{ nginx_apps_confs }}'
+
+- name: 'Start the Nginx container'
+  community.docker.docker_container:
+    name: 'nginx'
+    image: 'nginx:alpine'
+    pull: true
+    state: 'started'
+    recreate: false
+    volumes:
+      # configs
+      - '{{ nginx_conf_root }}:/etc/nginx/conf.d/:ro'
+      # static pages html
+      - '{{ nginx_static_html_root }}:/var/www/:ro'
+      # ssl certs
+      - '{{ nginx_certs_root }}:/etc/letsencrypt/:ro'
+    network_mode: 'host'
+    restart_policy: 'unless-stopped'
diff --git a/roles/nginx_docker/templates/app.nginx.conf.j2 b/roles/nginx_docker/templates/app.nginx.conf.j2
new file mode 100644
index 0000000..82c3610
--- /dev/null
+++ b/roles/nginx_docker/templates/app.nginx.conf.j2
@@ -0,0 +1,25 @@
+server {
+    listen 443 ssl;
+    root _;
+    server_name {{ item.conf.access_domain }};
+    ssl_certificate     /etc/letsencrypt/live/{{ nginx_global_apps_domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ nginx_global_apps_domain }}/privkey.pem;
+    ssl_protocols       TLSv1.1 TLSv1.2;
+    ssl_ciphers         HIGH:!aNULL:!MD5;
+
+    location / {
+{% if item.app == "nextcloud" %} {# Nextcloud requires https internally #}
+        proxy_pass         https://127.0.0.1:{{ item.conf.port }};
+{% else %}
+        proxy_pass         http://127.0.0.1:{{ item.conf.port }};
+{% endif %}
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header   X-Forwarded-Host $server_name;
+        proxy_set_header   X-Forwarded-Proto https;
+        proxy_read_timeout  1200s;
+        client_max_body_size 0;
+        error_log       /var/log/nginx/{{ item.app }}.error.log;
+    }
+}
diff --git a/roles/nginx_docker/templates/http.nginx.conf.j2 b/roles/nginx_docker/templates/http.nginx.conf.j2
new file mode 100644
index 0000000..2d4c61b
--- /dev/null
+++ b/roles/nginx_docker/templates/http.nginx.conf.j2
@@ -0,0 +1,24 @@
+server {
+    {% if item == "default" %}
+    listen 80 default_server;
+    server_name _;
+    return 301 https://$host$request_uri;
+    {% else %}
+    listen 443 ssl;
+    root /var/www/{{ item }}/html;
+    server_name {{ item }} www.{{ item }};
+    ssl_certificate     /etc/letsencrypt/live/{{ item }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ item }}/privkey.pem;
+    ssl_protocols       TLSv1.1 TLSv1.2;
+    ssl_ciphers         HIGH:!aNULL:!MD5;
+    index index.html index.htm index.nginx-debian.html;
+
+    location ~ /.well-known {
+        allow all;
+    }
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+    {% endif %}
+}
diff --git a/roles/samba/tasks/main.yaml b/roles/samba/tasks/main.yaml
index 5207ac5..c89d4bc 100644
--- a/roles/samba/tasks/main.yaml
+++ b/roles/samba/tasks/main.yaml
@@ -1,13 +1,19 @@
-# https://pimylifeup.com/raspberry-pi-samba/
 ---
 
-- name: 'Install required apt packages'
+- name: 'Install samba for Alpine'
+  apk:
+    name: 'samba'
+    state: 'latest'
+  when: 'ansible_os_family == "Alpine"'
+
+- name: 'Install samba for Debian'
   apt:
     name:
       - 'samba'
       - 'samba-common-bin'
     state: 'present'
     update_cache: true
+  when: 'ansible_os_family == "Debian"'
 
 - name: 'Copy conf files'
   template:
@@ -17,7 +23,7 @@
 
 - name: 'Add Samba user'
   expect:
-    command: 'sudo smbpasswd -a {{ samba_user }}'
+    command: 'smbpasswd -a {{ samba_user }}'
     responses:
       (?i)password: "{{ samba_user_pass }}"
 
@@ -27,3 +33,11 @@
     state: 'restarted'
   loop:
     - 'smbd'
+  when: 'ansible_os_family == "Debian"'
+
+- name: 'Start and enable samba'
+  service:
+    name: 'samba'
+    state: 'started'
+    enabled: true
+  when: 'ansible_os_family == "Alpine"'
diff --git a/roles/samba/templates/smb.conf b/roles/samba/templates/smb.conf
index eb5839a..5c1360a 100644
--- a/roles/samba/templates/smb.conf
+++ b/roles/samba/templates/smb.conf
@@ -1,5 +1,5 @@
 [data]
-path = {{ data_vol_ssd }}
+path = {{ samba_data_root }}
 writeable=Yes
 create mask=0777
 directory mask=0777
diff --git a/roles/transmission/defaults/main.yaml b/roles/transmission/defaults/main.yaml
new file mode 100644
index 0000000..cd11c66
--- /dev/null
+++ b/roles/transmission/defaults/main.yaml
@@ -0,0 +1,17 @@
+# Default Values
+---
+
+nextcloud_uid: "1000"
+nextcloud_gid: "1000"
+nextcloud_tz: 'America/Toronto'
+nextcloud_data_root: ''
+nextcloud_host_port: ''
+
+nextcloud_docker_network_name: 'nextcloud_network'
+
+nextcloud_postgres_db: 'nextcloud_db'
+nextcloud_postgres_user: 'nextcloud'
+nextcloud_postgres_password: ''
+
+nextcloud_container_name: 'nextcloud'
+nextcloud_dashboard_url: 'https://{{ nextcloud_domain }}'
diff --git a/roles/transmission/handlers/main.yaml b/roles/transmission/handlers/main.yaml
new file mode 100644
index 0000000..cd21505
--- /dev/null
+++ b/roles/transmission/handlers/main.yaml
@@ -0,0 +1,2 @@
+---
+
diff --git a/roles/transmission/tasks/main.yaml b/roles/transmission/tasks/main.yaml
new file mode 100644
index 0000000..91d3971
--- /dev/null
+++ b/roles/transmission/tasks/main.yaml
@@ -0,0 +1,32 @@
+---
+
+- name: 'Ensure transmission root dir exists'
+  file:
+    path: '{{ transmission_root_dir }}'
+    state: 'directory'
+    mode: '755'
+
+- name: 'Install transmission'
+  community.docker.docker_container:
+    name: 'transmission'
+    image: 'lscr.io/linuxserver/transmission:latest'
+    pull: true
+    state: 'started'
+    recreate: true
+    env:
+      "PUID": '1000'
+      "PGID": '1000'
+      "TZ": 'America/Toronto'
+      USER: '{{ transmission_user }}'
+      PASS: '{{ transmission_password }}'
+      # WHITELIST: '127.0.0.1,192.168.*.*'
+      HOST_WHITELIST: 'kdvpn.crabdance.com'
+    volumes:
+      - '{{ transmission_root_dir }}/data:/config'
+      - '{{ transmission_root_dir }}/downloads:/downloads'
+      - '{{ transmission_root_dir }}/watch:/watch'
+    ports:
+      - '{{ transmission_host_port }}:9091'
+      - 51413:51413
+      - 51413:51413/udp
+    restart_policy: 'unless-stopped'
diff --git a/roles/website/tasks/main.yaml b/roles/website/tasks/main.yaml
index 6fdf7fa..9725f2d 100644
--- a/roles/website/tasks/main.yaml
+++ b/roles/website/tasks/main.yaml
@@ -1,13 +1,15 @@
 ---
 
 - name: 'Install git'
+  become: true
+  become_method: 'doas'
   package:
     name: 'git'
     state: 'present'
 
 - name: 'Create domain level dir'
   file:
-    path: '/var/www/{{ item.name }}/html'
+    path: '{{ sites_data_root }}/{{ item.name }}/html'
     state: 'directory'
     mode: '0755'
   loop: '{{ websites }}'
@@ -15,10 +17,11 @@
 - name: 'Clone all the website project repos'
   git:
     repo: '{{ item.git_url }}'
-    dest: '/var/www/{{ item.name }}/html'
+    dest: '{{ sites_data_root }}/{{ item.name }}/html'
     depth: 1
     update: true
     force: true
     version: '{{ item.git_version }}'
     umask: '002'
+  when: 'item.git_url is defined'
   loop: '{{ websites }}'
diff --git a/roles/wireguard/handlers/main.yaml b/roles/wireguard/handlers/main.yaml
index bd5fc0d..cd21505 100644
--- a/roles/wireguard/handlers/main.yaml
+++ b/roles/wireguard/handlers/main.yaml
@@ -1,7 +1,2 @@
 ---
 
-- name: 'Restart wireguard'
-  systemd:
-    name: 'wg-quick@wg0'
-    state: 'restarted'
-  listen: 'restart wireguard'
diff --git a/roles/wireguard/tasks/main.yaml b/roles/wireguard/tasks/main.yaml
index d7e1e51..c3f0942 100644
--- a/roles/wireguard/tasks/main.yaml
+++ b/roles/wireguard/tasks/main.yaml
@@ -1,20 +1,35 @@
 # https://dev.to/tangramvision/exploring-ansible-via-setting-up-a-wireguard-vpn-3389
 ---
 
-- name: 'install wireguard package'
+- block:
+    - name: 'Install necessary pkgs for Alpine'
+      apk:
+        name: '{{ item }}'
+        state: 'latest'
+      loop:
+        - 'iptables'
+        - 'wireguard-tools'
+
+    - name: 'Enable iptables'
+      service:
+        name: 'iptables'
+        enabled: true
+  when: 'ansible_os_family == "Alpine"'
+
+- name: 'Install wireguard package for Debian'
   apt:
     name: 'wireguard'
     state: 'present'
     update_cache: true
+  when: 'ansible_os_family == "Debian"'
 
-- name: 'create server wireguard config'
+- name: 'Create server wireguard config'
   template:
     dest: '/etc/wireguard/wg0.conf'
     src: 'wg0.conf.j2'
     owner: 'root'
     group: 'root'
     mode: '600'
-  notify: 'restart wireguard'
 
 - name: 'Enable IP Forwarding'
   sysctl:
@@ -31,8 +46,23 @@
     - sysctl_key: 'net.ipv6.conf.all.forwarding'
       sysctl_val: "1"
 
-- name: 'start wireguard and enable on boot'
+- name: 'Start wireguard and enable on boot in Debian'
   systemd:
     name: 'wg-quick@wg0'
     state: 'started'
     enabled: true
+  when: 'ansible_os_family == "Debian"'
+
+- name: 'Ensure that wireguard interface starts on boot in Alpine'
+  blockinfile:
+    path: '/etc/network/interfaces'
+    block: |
+      auto wg0
+      iface wg0 inet static
+          requires eth0
+          address 192.168.10.1
+          pre-up ip link add dev wg0 type wireguard
+          pre-up wg setconf wg0 <(wg-quick strip wg0)
+          post-up iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o wg0 -j ACCEPT
+          post-down iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o wg0 -j ACCEPT
+  when: 'ansible_os_family == "Alpine"'
diff --git a/roles/wireguard/templates/wg0.conf.j2 b/roles/wireguard/templates/wg0.conf.j2
index 6e7bcc1..5201c32 100644
--- a/roles/wireguard/templates/wg0.conf.j2
+++ b/roles/wireguard/templates/wg0.conf.j2
@@ -1,12 +1,13 @@
 # {{ ansible_managed }}
 
 [Interface]
+{% if ansible_os_family == "Debian" %}
 Address = {{ wireguard_server_ip }}
+{% endif %}
 ListenPort = {{ wireguard_server_listen_port }}
 PrivateKey = {{ wireguard_server_priv_key }}
-PostUp = iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT
-PostUp = iptables -w -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w -t nat -A POSTROUTING -o eth0 -j MASQUERADE
-PostDown = iptables -w -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o %i -j ACCEPT
+PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o %i -j ACCEPT
 
 
 {% for peer in wireguard_peers %}