diff options
| -rw-r--r-- | .gitignore | 1 | ||||
| -rw-r--r-- | .gitmodules | 0 | ||||
| -rw-r--r-- | Makefile | 82 | ||||
| -rw-r--r-- | README.md | 39 | ||||
| -rw-r--r-- | group_vars/all/vault | 22 | ||||
| -rw-r--r-- | hosts.vault | 26 | ||||
| -rw-r--r-- | requirements.txt | 2 |
7 files changed, 151 insertions, 21 deletions
@@ -1,6 +1,5 @@ roles/*.* collections/ hosts -vault vaultid migration/ diff --git a/.gitmodules b/.gitmodules deleted file mode 100644 index e69de29..0000000 --- a/.gitmodules +++ /dev/null diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..ebb1574 --- /dev/null +++ b/Makefile @@ -0,0 +1,82 @@ +# ANSIBLE-MAKEFILE + +SHELL:=/bin/bash + +## +# VARIABLES +## +playbook ?= setup +roles_path ?= "roles/" +env_path ?= "inventories/" +group ?= all +venv_path := "${HOME}/.venv/vps/" + +mkfile_dir ?= $(dir $(abspath $(lastword $(MAKEFILE_LIST)))) +ifeq ("$(wildcard $(mkfile_dir)/vaultid)", "") + opts ?= $(args) +else # Handle vault password if any + opts ?= $(args) --vault-password-file=$(mkfile_dir)/vaultid +endif + +ifneq ("$(limit)", "") + opts := $(opts) --limit="$(limit)" +endif + +ifneq ("$(tags)", "") + opts := $(opts) --tags="$(tags)" +endif + +ifneq ("$(skip)", "") + opts := $(opts) --skip-tags="$(skip)" +endif + +## +# TASKS +## +.PHONY: install +install: ## make install # Install ansible, ansible-lint, and required collections. Reveal vaultid file. + @test -d ${venv_path} || (python3 -m venv ${venv_path} --system-site-packages) + @source ${venv_path}/bin/activate && pip install -r requirements.txt + @source ${venv_path}/bin/activate && ansible-galaxy install -r requirements.yml + @source ${venv_path}/bin/activate && ansible-galaxy collection install --ignore-errors -r requirements.yml + @[ -f "vaultid" ] && source ${venv_path}/bin/activate && ansible-vault decrypt --vault-id vaultid --output hosts hosts.vault || echo "Nothing to decrypt with. Bye." + +.PHONY: lint +lint: mandatory-file-param ## make lint file=playbooks/template_playbook.yaml # Run ansible-lint on a playbook or tasks file. + @[ -f "$(file)" ] && ANSIBLE_VAULT_PASSWORD_FILE=vaultid ansible-lint -c ansible-lint.yaml "$(file)" + +.PHONY: syntax +syntax: mandatory-file-param ## make syntax file=playbooks/template_playbook.yaml [args=<ansible-playbook arguments>] # Check syntax of a playbook. + @[ -f "$(file)" ] && ansible-playbook --inventory-file="hosts" --syntax-check $(opts) "$(file)" + +.PHONY: dry-run +dry-run: mandatory-file-param ## make dry-run file=playbooks/template_playbook.yaml [tags=<ansible tags>] [limit=<ansible host limit>] [args=<ansible-playbook arguments>] # Run a playbook in dry run mode. + @[ -f "$(file)" ] && source ${venv_path}/bin/activate && ansible-playbook --inventory-file="hosts" --diff --check $(opts) "$(file)" + +.PHONY: run +run: mandatory-file-param ## make run file=playbooks/template_playbook.yaml [tags=<ansible tags>] [limit=<ansible host limit>] [args=<ansible-playbook arguments>] # Run a playbook. + @[ -f "$(file)" ] && source ${venv_path}/bin/activate && ansible-playbook --inventory-file="hosts" --diff $(opts) "$(file)" + +.PHONY: vault-view +vault-view: ## make vault-view [group=all] [args=<ansible-vault arguments>] # View a vaulted file. + @[ -f "group_vars/${group}/vault" ] && source ${venv_path}/bin/activate && ansible-vault view $(opts) "group_vars/${group}/vault" + +.PHONY: vault-edit +vault-edit: ## make vault-edit [group=all] [args=<ansible-vault arguments>] # Edit a vaulted file. + @[ -f "group_vars/${group}/vault" ] && source ${venv_path}/bin/activate && ansible-vault edit $(opts) "group_vars/${group}/vault" + +.PHONY: facts +facts: ## make facts [group=all] [args=<ansible arguments>] # Gather facts from your hosts. + @source ${venv_path}/bin/activate && ansible --module-name="setup" --inventory-file="hosts" $(opts) --tree="out/" $(group) + +.PHONY: mandatory-host-param mandatory-file-param +mandatory-host-param: + @[ ! -z $(host) ] +mandatory-file-param: + @[ ! -z $(file) ] + +.PHONY: help +help: ## make help # Print this help message. + @grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}' + +.DEFAULT_GOAL := help @@ -45,38 +45,37 @@ You can get this dashboard [here](https://grafana.com/grafana/dashboards/15980). 3. Change directory to this repo `cd vps`. 4. Setup repo by running all of the following: ``` -python3 -m venv ~/venv/vps -source $HOME/venv/vps/bin/activate -pip install --upgrade pip -pip install 'ansible<2.10' 'jmespath' -ansible-galaxy install -r requirements.yml -ansible-galaxy collection install -r requirements.yml +make install +# copy all the example files cp -a vaultid.example vaultid cp -a hosts.example hosts cp -a group_vars/all/vault.example group_vars/all/vault ``` ## Develop -1. Modify the [playbooks](./playbooks/) per your needs. -2. Modify the vault per your needs: `ansible-vault edit group_vars/all/vault --vault-id vaultid`. -3. Modify the [hosts](./hosts/) file per your needs. -4. Modify the [vars](./group_vars/all/vars.yaml/) file per your needs. +1. Set your vaultid value to your password. Default: `test`. +2. Modify the [playbooks](./playbooks/) per your needs. +3. Modify the vault per your needs: `make vault-edit group=all`. +4. Modify the [hosts](./hosts/) file per your needs. +5. Modify the [vars](./group_vars/all/vars.yaml/) file per your needs. + +Encrypt your hosts file, and secret vars before uploading to git: +``` +ansible-vault encrypt --vault-id vaultid --output hosts.vault hosts +ansible-vault encrypt --vault-id vaultid --output group_vars/all/vault group_vars/all/vault +``` ## Deploy ``` -# activate venv -source $HOME/venv/vps/bin/activate # run main playbook with "base" tag -ansible-playbook -i hosts playbooks/deploy.yaml --vault-id vaultid --tags base +make file=playbooks/deploy.yaml tags="base" # run main playbook with your apps -ansible-playbook -i hosts playbooks/deploy.yaml --vault-id vaultid [--tags []] +make file=playbooks/deploy.yaml tags="[csv list]" # (and if applicable secondary playbook) -ansible-playbook -i hosts playbooks/vps.yaml --vault-id vaultid +make file=playbooks/vps.yaml ``` ## Future Plans -1. Install a Job executor (Awx, or Rundeck) that will auto-deploy hosted websites upon new commits using the `--tags website` arg. -2. Simplify install. -3. Documentation for each role. -4. Backups. -5. Redundancy. +1. Documentation for each role. +2. Backups. +3. Redundancy. diff --git a/group_vars/all/vault b/group_vars/all/vault new file mode 100644 index 0000000..dc9ea53 --- /dev/null +++ b/group_vars/all/vault @@ -0,0 +1,22 @@ +$ANSIBLE_VAULT;1.1;AES256 +61313937646535376164373732663565313030623462656561303936653432313733643430376663 +3838336661336338383633333565386635663532653861630a386136616565396234363531336234 +65346162313632336331343832643338376431343761313731323039363637626533643562366362 +6433663639353066630a616230663162633463323435336361383238333031653930316637393836 +36626662653563383936666662346130613835343231613030373532363331373735373636376363 +35373963353465313930323765396362356166646166623832613930633565393838616365336362 +38323639666333623539373830643232653432633963373733663436373436393832386231366262 +39343661326131623031626565333835663730643831333263336134333630376338633261633835 +63306138393439326430613338643066366461323330643837346130623465366335343831396437 +33393939323264663163643935656663386537393265643364333132623830373766623933353865 +63323638383164353435323161363339333966663466333832396162383230313732656366643430 +66343163366164626438303432346331386165313037353532383939663038343766313736323930 +62653932396430373337653862353965623135323632666630303337636566623738346261666338 +37626364343764623333613030653130646662613930383462343664643737336533646235306437 +65376566353331623737323036613638333831633039373430653430386636346538346335623566 +61333735396431633566303265613135366437646164626437353139396235383133383436306235 +66626433613535333061363466333865333736383238353534653765393937663731623138616164 +35663161323735613563376463333539333062346463326564353736646639636535313236323736 +37383230336434633035633563646638666333373730633431313864336462656139336134383438 +66353039393931363831323164653964666662613062333765306435363533643063353033326631 +3064 diff --git a/hosts.vault b/hosts.vault new file mode 100644 index 0000000..c1f6198 --- /dev/null +++ b/hosts.vault @@ -0,0 +1,26 @@ +$ANSIBLE_VAULT;1.1;AES256 +62633833343239643262636634646532636164643635323561623232313335396439363537376230 +3762303334616432393964353037316230623039356361660a383135343237376465376133353037 +62313363363736393832313230393039353732346462356636346334373666666464386433363934 +6132316665373234350a306363376465376464653237383938396331643064376437366339356362 +30396166643262353431396462333933396235353933326231333966653939663562653362613361 +30616330613633616539373136663832376531313532303364326435393963626436353262623534 +61353064366538623138323735633036353532343631656431636166333132643938376163326631 +66383431373330316365666437343064306436373339303663356532326561623238636634353436 +38616133353234363838613032636133393062333761643934353935653638633863343562643165 +38663562623035316662636461353538616164643130646637316231383439383831666636663664 +36353337363833353931636637623636363332393738366664313963653635313238633338623963 +66313932656236346533633266646433626431643635616664336234313962656230353266663336 +34326266313139633137396265373062333766323065393232386663383439383630356330366238 +38333164613134303337643365616464306537313762393336386661363662333865643135393566 +62346339393439613633383263326264653162303437336336626330613664666462663931356363 +30346532616239303138616138396366626232666534313535333932393063636436656136393034 +34666335653735373334643766393333633562643766636335666264376661653733316630616332 +62353935643439383236363133386366383730373539323932323333303731316236366235383665 +34316432313866343465633463353462313162333939663938353762613037386666643033636436 +30656130363764333463626266393932656432333333316263636431333366633461636439666361 +36343537663833323431393838396237623831383533373763353135626632373165356232656662 +32663563613335313737393237353133323064663930346532396664313036386435316261643537 +38383262336538303830613166363765393431363265333861383031333733663363623135373764 +36373635393138306138323165356265316337363033643735646333613361393266323061333163 +6236 diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000..0d1629b --- /dev/null +++ b/requirements.txt @@ -0,0 +1,2 @@ +ansible<2.10 +jmespath |