diff options
Diffstat (limited to 'playbooks')
| -rw-r--r-- | playbooks/deploy.yaml | 226 | ||||
| -rw-r--r-- | playbooks/vps.yaml | 26 |
2 files changed, 252 insertions, 0 deletions
diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml new file mode 100644 index 0000000..9ba8c3b --- /dev/null +++ b/playbooks/deploy.yaml @@ -0,0 +1,226 @@ +# Usage: +# ansible-playbook -i hosts playbooks/deploy.yaml --vault-id vaultid --tags base +# +# Tags: +# base, ddclient, wireguard, nginx, website, samba +# nextcloud, monitoring (these all depend on the nginx tag) +# +# Install: +# git submodule update --remote --merge +# python3 -m venv ~/venv/ansible +# source $HOME/venv/ansible/bin/activate +# pip install --upgrade pip +# pip install 'ansible<2.10' 'jmespath' +# ansible-galaxy install -r requirements.yml +# ansible-galaxy collection install -r requirements.yml +# +# Assumptions: +# Run apt update, upgrade +# Run rpi-update +# HD, SSD formatted appropriately. +--- + + +- hosts: compute + gather_facts: false + tags: 'ddclient' + become: true + roles: + - role: ddclient + vars: + ddclient_proto: 'freedns' + ddclient_user: '{{ vault_ddclient_user }}' + ddclient_password: '{{ vault_ddclient_password }}' + ddclient_domain: '{{ vpn_domain }}' + +- hosts: compute + gather_facts: false + tags: 'wireguard' + become: true + roles: + - role: wireguard + vars: + wireguard_server_priv_key: '{{ vault_wireguard_server_priv_key }}' + wireguard_server_pub_key: 'iwsriL3AUn4dgKfsSNgJtj/G808k4jXvSC+mM70YnAw=' + wireguard_server_listen_port: 51820 + wireguard_server_ip: '192.168.10.1/24' + wireguard_peers: + - peer_ip: '192.168.10.2/32' # my phone + peer_key: '/mFv6y9QA8dhX/A9fFn+mzg/SZq4BZPeNofm1w754y8=' + - peer_ip: '192.168.10.3/32' # personal laptop + peer_key: '6+t6FbEHSAOuzBtQwb0bDqfFa5Kvfkb2QIUGpRKA5Eg=' + - peer_ip: '192.168.10.4/32' # vps + peer_key: 'oz2jxeSUWD4r5g3y7XuSItqSiqOOJz8vulYYVXAsKS8=' + +- hosts: compute + gather_facts: false + tags: 'nginx' + become: true + roles: + - role: nginx + vars: + nginx_website_domains: '{{ ["default"] + (nginx_websites | map(attribute="name") | list) }}' + nginx_global_apps_domain: '{{ apps_domain }}' + nginx_apps_confs: '{{ apps_conf_map | dict2items(key_name="app", value_name="conf") }}' + +- hosts: compute + gather_facts: false + tags: 'website' + become: true + roles: + - role: website + vars: + websites: '{{ nginx_websites }}' + git_user: '{{ vault_git_user }}' + git_pass: '{{ vault_git_password }}' + +- hosts: compute + gather_facts: false + tags: 'nextcloud' + become: true + roles: + - role: nextcloud + vars: + nextcloud_domain: '{{ apps_conf_map["nextcloud"]["access_domain"] }}' + nextcloud_host_port: '{{ apps_conf_map["nextcloud"]["port"] }}' + nextcloud_data_root: '{{ data_vol_hdd }}/nextcloud' + nextcloud_postgres_password: '{{ vault_nextcloud_postgres_password }}' + +- hosts: compute + gather_facts: false + tags: 'bitwarden' + become: true + roles: + - role: bitwarden + vars: + bitwarden_host_port: '{{ apps_conf_map["bitwarden"]["port"] }}' + bitwarden_data_dir: '{{ data_vol_hdd }}/bitwarden' + +# Access: http://art-jr/data +- hosts: compute + gather_facts: false + tags: 'samba' + become: true + roles: + - role: samba + vars: + samba_user: '{{ vault_samba_user }}' + samba_user_pass: '{{ vault_samba_password }}' + +- hosts: compute + become: true + tags: 'monitoring' + roles: + - role: 'cloudalchemy.node_exporter' + vars: + node_exporter_version: '1.2.2' + node_exporter_web_listen_address: '0.0.0.0:9100' + node_exporter_web_telemetry_path: '/metrics' + + # monitor cpu temp. stats for the rpi. + - role: 'rpi_exporter' + + - role: 'cloudalchemy.prometheus' + vars: + prometheus_version: 'latest' + prometheus_skip_install: false + prometheus_db_dir: '{{ data_vol_hdd }}/prometheus' + prometheus_web_listen_address: '0.0.0.0:{{ apps_conf_map["prometheus"]["port"] }}' + prometheus_web_external_url: 'https://{{ apps_conf_map["prometheus"]["access_domain"] }}' + prometheus_storage_retention: '15d' + prometheus_global: + scrape_interval: '30s' + evaluation_interval: '30s' + prometheus_targets: + node: + - targets: + - localhost:9100 + - localhost:9243 + labels: + env: prod + prometheus_scrape_configs: + - job_name: "prometheus" + metrics_path: "{{ prometheus_metrics_path }}" + static_configs: + - targets: + - "{{ ansible_fqdn | default(ansible_host) | default('localhost') }}:9090" + - job_name: "node" + file_sd_configs: + - files: + - "{{ prometheus_config_dir }}/file_sd/node.yml" + - job_name: 'blackbox' + metrics_path: /probe + params: + module: [http_2xx] + static_configs: + # all apps, nginx websites, prefixed with "https://" + - targets: '{{ ["https://"] | product((apps_conf_map | dict2items(key_name="app", value_name="conf") | map(attribute="conf") | map(attribute="access_domain") | list)+(nginx_websites | map(attribute="name") | list)) | map("join") | list }}' # noqa yaml + relabel_configs: + - source_labels: [__address__] + target_label: __param_target + - source_labels: [__param_target] + target_label: instance + - target_label: __address__ + replacement: 127.0.0.1:9115 # Blackbox exporter. + + - role: 'cloudalchemy.blackbox-exporter' + vars: + blackbox_exporter_web_listen_address: '0.0.0.0:9115' + +- hosts: compute + become: true + tags: 'base' + roles: + - role: geerlingguy.pip + vars: + pip_package: python3-pip + pip_install_packages: + - name: docker + - name: pexpect + + - role: geerlingguy.docker_arm + vars: + docker_install_recommends: true + docker_install_compose: true + docker_users: + - pi + docker_pip_executable: pip3 + docker_version_armv7: 5:20.10.10~3-0~raspbian-bullseye + + - role: geerlingguy.nfs + vars: + nfs_exports: + - '{{ data_vol_ssd }} *(rw,sync,no_root_squash)' + - '{{ data_vol_hdd }} *(rw,sync,no_root_squash)' + pre_tasks: + - name: 'Install quality of life packages are present' + apt: + name: + - 'git' + - 'net-tools' + - 'neofetch' + - 'neovim' + - 'nnn' + - 'nmap' + update_cache: true + + - name: 'Ensure that mount for data vol exists' + mount: + state: 'mounted' + path: '{{ item.vol_path }}' + src: 'UUID="{{ item.vol_uuid }}"' + boot: true + fstype: '{{ item.vol_fstype }}' + opts: 'rw,user,exec' + loop: + - vol_path: '{{ data_vol_ssd }}' + vol_uuid: '734d1190-b222-4979-91c8-0582e030fd1a' + vol_fstype: 'ext4' + - vol_path: '{{ data_vol_hdd }}' + vol_uuid: 'aa392d86-bc93-4ad4-9e9e-c1274384bbfb' + vol_fstype: 'ext4' + + - name: 'Set python3 as default python' + alternatives: + name: 'python' + path: '/bin/python3' diff --git a/playbooks/vps.yaml b/playbooks/vps.yaml new file mode 100644 index 0000000..67780d2 --- /dev/null +++ b/playbooks/vps.yaml @@ -0,0 +1,26 @@ +# Usage: +# ansible-playbook -i hosts playbooks/vps.yaml --vault-id vaultid +# +# Install: +# ansible-galaxy install -r requirements.yml +# ansible-galaxy role install -r requirements.yml +# +--- + +- hosts: vps + gather_facts: false + become: true + pre_tasks: + - name: 'Set python3 as default python' # noqa no-changed-when + command: 'update-alternatives --install /bin/python python /bin/python3 3' + roles: + - role: wireguard_client + vars: + wireguard_client_server_pub_key: 'iwsriL3AUn4dgKfsSNgJtj/G808k4jXvSC+mM70YnAw=' + wireguard_client_server_endpoint: 'kdvpn.crabdance.com' + wireguard_client_server_allowed_ips: '192.168.10.0/24' + wireguard_client_peer_ip: '192.168.10.4/24' + wireguard_client_server_listen_port: 51820 + wireguard_client_port_forwards: + - 80 # webserver + - 443 # webserver |