diff options
Diffstat (limited to 'playbooks/deploy.yaml')
| -rw-r--r-- | playbooks/deploy.yaml | 212 |
1 files changed, 69 insertions, 143 deletions
diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml index 270416d..53c315a 100644 --- a/playbooks/deploy.yaml +++ b/playbooks/deploy.yaml @@ -1,9 +1,9 @@ # Usage: -# ansible-playbook -i hosts playbooks/deploy.yaml --vault-id vaultid --tags base +# ansible-playbook -i hosts playbooks/deploy.yaml --vault-id vaultid --tags [] # # Tags: -# base, ddclient, wireguard, nginx, website, samba -# nextcloud, monitoring (these all depend on the nginx tag) +# ddclient, wireguard, nginx, websites, samba +# nextcloud, bitwarden, searxng, monitoring (these all depend on the nginx tag) # # Install: # git submodule update --remote --merge @@ -14,17 +14,15 @@ # ansible-galaxy install -r requirements.yml # ansible-galaxy collection install -r requirements.yml # -# Assumptions: -# Run apt update, upgrade -# Run rpi-update -# HD, SSD formatted appropriately. --- +## Non Docker Services ## - hosts: compute - gather_facts: false + gather_facts: true tags: 'ddclient' become: true + become_method: 'doas' roles: - role: ddclient vars: @@ -34,16 +32,17 @@ ddclient_domain: '{{ vpn_domain }}' - hosts: compute - gather_facts: false + gather_facts: true tags: 'wireguard' become: true + become_method: 'doas' roles: - role: wireguard vars: wireguard_server_priv_key: '{{ vault_wireguard_server_priv_key }}' wireguard_server_pub_key: 'iwsriL3AUn4dgKfsSNgJtj/G808k4jXvSC+mM70YnAw=' wireguard_server_listen_port: 51820 - wireguard_server_ip: '192.168.10.1/24' + wireguard_server_ip: '192.168.10.1/32' wireguard_peers: - peer_ip: '192.168.10.2/32' # my phone peer_key: '/mFv6y9QA8dhX/A9fFn+mzg/SZq4BZPeNofm1w754y8=' @@ -54,185 +53,112 @@ - hosts: compute gather_facts: false - tags: 'nginx' + tags: 'websites' + become: false + roles: + - role: website + vars: + websites: '{{ nginx_websites }}' + git_user: '{{ vault_git_user }}' + git_pass: '{{ vault_git_password }}' + sites_data_root: '{{ vol_data }}/sites' + +# Access: http://art-jr/data +- hosts: compute + gather_facts: true + tags: 'samba' become: true + become_method: 'doas' roles: - - role: nginx + - role: samba vars: - nginx_website_domains: '{{ ["default"] + (nginx_websites | map(attribute="name") | list) }}' - nginx_global_apps_domain: '{{ apps_domain }}' - nginx_apps_confs: '{{ apps_conf_map | dict2items(key_name="app", value_name="conf") }}' + samba_user: '{{ vault_samba_user }}' + samba_user_pass: '{{ vault_samba_password }}' + samba_data_root: '{{ vol_media }}' + + +## Docker Services ## - hosts: compute gather_facts: false - tags: 'website' - become: true + tags: 'nginx' + become: false roles: - - role: website + - role: nginx_docker vars: - websites: '{{ nginx_websites }}' - git_user: '{{ vault_git_user }}' - git_pass: '{{ vault_git_password }}' + nginx_website_domains: '{{ ["default"] + (nginx_websites | map(attribute="name") | list) }}' + nginx_global_apps_domain: '{{ apps_domain }}' + nginx_apps_confs: '{{ apps_conf_map | dict2items(key_name="app", value_name="conf") }}' + nginx_conf_root: '{{ vol_data }}/nginx' + nginx_static_html_root: '{{ vol_data }}/sites' + nginx_certs_root: '{{ vol_data }}/letsencrypt' - hosts: compute gather_facts: false tags: 'nextcloud' - become: true + become: false roles: - role: nextcloud vars: nextcloud_domain: '{{ apps_conf_map["nextcloud"]["access_domain"] }}' nextcloud_host_port: '{{ apps_conf_map["nextcloud"]["port"] }}' - nextcloud_data_root: '{{ data_vol_hdd }}/nextcloud' + nextcloud_data_root: '{{ vol_data }}/nextcloud' nextcloud_postgres_password: '{{ vault_nextcloud_postgres_password }}' - hosts: compute gather_facts: false tags: 'searxng' - become: true + become: false roles: - role: searxng vars: searxng_domain: '{{ apps_conf_map["searxng"]["access_domain"] }}' searxng_host_port: '{{ apps_conf_map["searxng"]["port"] }}' - searxng_data_root: '{{ data_vol_hdd }}/searxng' + searxng_data_root: '{{ vol_data }}/searxng' searxng_secret_key: '{{ vault_searxng_secret_key }}' - hosts: compute gather_facts: false tags: 'bitwarden' - become: true + become: false roles: - role: bitwarden vars: bitwarden_host_port: '{{ apps_conf_map["bitwarden"]["port"] }}' - bitwarden_data_dir: '{{ data_vol_hdd }}/bitwarden' + bitwarden_data_dir: '{{ vol_data }}/bitwarden' -# Access: http://art-jr/data - hosts: compute gather_facts: false - tags: 'samba' - become: true + tags: 'transmission' + become: false roles: - - role: samba + - role: transmission vars: - samba_user: '{{ vault_samba_user }}' - samba_user_pass: '{{ vault_samba_password }}' + transmission_host_port: '{{ apps_conf_map["transmission"]["port"] }}' + transmission_user: '{{ vault_transmission_user }}' + transmission_password: '{{ vault_transmission_password }}' + transmission_root_dir: '{{ vol_media }}/transmission' - hosts: compute - become: true - tags: 'monitoring' + gather_facts: false + tags: 'media_downloader' + become: false roles: - - role: 'cloudalchemy.node_exporter' + - role: media_downloader vars: - node_exporter_version: '1.2.2' - node_exporter_web_listen_address: '0.0.0.0:9100' - node_exporter_web_telemetry_path: '/metrics' - - # monitor cpu temp. stats for the rpi. - - role: 'rpi_exporter' - - - role: 'cloudalchemy.prometheus' - vars: - prometheus_version: 'latest' - prometheus_skip_install: false - prometheus_db_dir: '{{ data_vol_hdd }}/prometheus' - prometheus_web_listen_address: '0.0.0.0:{{ apps_conf_map["prometheus"]["port"] }}' - prometheus_web_external_url: 'https://{{ apps_conf_map["prometheus"]["access_domain"] }}' - prometheus_storage_retention: '15d' - prometheus_global: - scrape_interval: '30s' - evaluation_interval: '30s' - prometheus_targets: - node: - - targets: - - localhost:9100 - - localhost:9243 - labels: - env: prod - prometheus_scrape_configs: - - job_name: "prometheus" - metrics_path: "{{ prometheus_metrics_path }}" - static_configs: - - targets: - - "{{ ansible_fqdn | default(ansible_host) | default('localhost') }}:9090" - - job_name: "node" - file_sd_configs: - - files: - - "{{ prometheus_config_dir }}/file_sd/node.yml" - - job_name: 'blackbox' - metrics_path: /probe - params: - module: [http_2xx] - static_configs: - # all apps, nginx websites, prefixed with "https://" - - targets: '{{ ["https://"] | product((apps_conf_map | dict2items(key_name="app", value_name="conf") | map(attribute="conf") | map(attribute="access_domain") | list)+(nginx_websites | map(attribute="name") | list)) | map("join") | list }}' # noqa yaml - relabel_configs: - - source_labels: [__address__] - target_label: __param_target - - source_labels: [__param_target] - target_label: instance - - target_label: __address__ - replacement: 127.0.0.1:9115 # Blackbox exporter. - - - role: 'cloudalchemy.blackbox-exporter' - vars: - blackbox_exporter_web_listen_address: '0.0.0.0:9115' + media_downloader_sonarr_host_port: '{{ apps_conf_map["sonarr"]["port"] }}' + media_downloader_radarr_host_port: '{{ apps_conf_map["radarr"]["port"] }}' + media_downloader_prowlarr_host_port: '{{ apps_conf_map["prowlarr"]["port"] }}' + media_downloader_bazarr_host_port: '{{ apps_conf_map["bazarr"]["port"] }}' + media_downloader_transmission_root_dir: '{{ vol_media }}/transmission' + media_downloader_media_root_dir: '{{ vol_media }}/media' - hosts: compute - become: true - tags: 'base' + gather_facts: true + tags: 'monitoring' roles: - - role: geerlingguy.pip + - role: 'monitoring' vars: - pip_package: python3-pip - pip_install_packages: - - name: docker - - name: pexpect - - - role: geerlingguy.docker_arm - vars: - docker_install_recommends: true - docker_install_compose: true - docker_users: - - pi - docker_pip_executable: pip3 - docker_version_armv7: 5:20.10.10~3-0~raspbian-bullseye - - - role: geerlingguy.nfs - vars: - nfs_exports: - - '{{ data_vol_ssd }} *(rw,sync,no_root_squash)' - - '{{ data_vol_hdd }} *(rw,sync,no_root_squash)' - pre_tasks: - - name: 'Install quality of life packages are present' - apt: - name: - - 'git' - - 'net-tools' - - 'neofetch' - - 'neovim' - - 'nnn' - - 'nmap' - update_cache: true - - - name: 'Ensure that mount for data vol exists' - mount: - state: 'mounted' - path: '{{ item.vol_path }}' - src: 'UUID="{{ item.vol_uuid }}"' - boot: true - fstype: '{{ item.vol_fstype }}' - opts: 'rw,user,exec' - loop: - - vol_path: '{{ data_vol_ssd }}' - vol_uuid: '734d1190-b222-4979-91c8-0582e030fd1a' - vol_fstype: 'ext4' - - vol_path: '{{ data_vol_hdd }}' - vol_uuid: 'aa392d86-bc93-4ad4-9e9e-c1274384bbfb' - vol_fstype: 'ext4' - - - name: 'Set python3 as default python' - alternatives: - name: 'python' - path: '/bin/python3' + monitoring_root_dir: '{{ vol_data }}/monitoring' + monitoring_apps_confs: '{{ apps_conf_map | dict2items(key_name="app", value_name="conf") }}' + monitoring_static_sites: '{{ nginx_websites }}' |