diff options
Diffstat (limited to 'roles')
54 files changed, 1206 insertions, 0 deletions
diff --git a/roles/bitwarden/defaults/main.yaml b/roles/bitwarden/defaults/main.yaml new file mode 100644 index 0000000..cc46411 --- /dev/null +++ b/roles/bitwarden/defaults/main.yaml @@ -0,0 +1,6 @@ +# Default Values +--- + +bitwarden_data_dir: '' +bitwarden_host_port: '' +bitwarden_container_name: 'bitwarden' diff --git a/roles/bitwarden/handlers/main.yaml b/roles/bitwarden/handlers/main.yaml new file mode 100644 index 0000000..cd21505 --- /dev/null +++ b/roles/bitwarden/handlers/main.yaml @@ -0,0 +1,2 @@ +--- + diff --git a/roles/bitwarden/tasks/main.yaml b/roles/bitwarden/tasks/main.yaml new file mode 100644 index 0000000..5fd0ed4 --- /dev/null +++ b/roles/bitwarden/tasks/main.yaml @@ -0,0 +1,17 @@ +--- + +- name: 'Make sure the Vaultwarden container is created and running' + docker_container: + name: '{{ bitwarden_container_name }}' + image: 'vaultwarden/server' + pull: true + state: 'started' + env: + WEBSOCKET_ENABLED: 'true' + INVITATIONS_ALLOWED: 'true' + SIGNUPS_ALLOWED: 'false' + volumes: + - "{{ bitwarden_data_dir }}:/data" + ports: + - '{{ bitwarden_host_port }}:80' + restart_policy: unless-stopped diff --git a/roles/ddclient/defaults/main.yaml b/roles/ddclient/defaults/main.yaml new file mode 100644 index 0000000..9a163d4 --- /dev/null +++ b/roles/ddclient/defaults/main.yaml @@ -0,0 +1,2 @@ +# Default Values +--- diff --git a/roles/ddclient/handlers/main.yaml b/roles/ddclient/handlers/main.yaml new file mode 100644 index 0000000..be19365 --- /dev/null +++ b/roles/ddclient/handlers/main.yaml @@ -0,0 +1,7 @@ +--- + +- name: 'Restart ddclient' + systemd: + name: 'ddclient' + state: 'restarted' + listen: 'restart ddclient' diff --git a/roles/ddclient/tasks/main.yaml b/roles/ddclient/tasks/main.yaml new file mode 100644 index 0000000..8deffc2 --- /dev/null +++ b/roles/ddclient/tasks/main.yaml @@ -0,0 +1,22 @@ +# https://notthebe.ee/raspi.html +--- + +- name: 'Install required apt packages' + apt: + name: + - 'ddclient' + state: 'present' + update_cache: true + +- name: 'Update ddclient conf' + template: + dest: '/etc/ddclient.conf' + src: 'ddclient.conf.j2' + mode: '644' + notify: 'restart ddclient' + +- name: 'Start ddclient' + systemd: + name: 'ddclient' + state: 'started' + enabled: true diff --git a/roles/ddclient/templates/ddclient.conf.j2 b/roles/ddclient/templates/ddclient.conf.j2 new file mode 100644 index 0000000..99dab47 --- /dev/null +++ b/roles/ddclient/templates/ddclient.conf.j2 @@ -0,0 +1,9 @@ +# {{ ansible_managed }} +# +# /etc/ddclient.conf + +protocol={{ ddclient_proto }} \ +use=web, web=https://freedns.afraid.org/dynamic/check.php \ +login={{ ddclient_user }} \ +password='{{ ddclient_password }}' \ +{{ ddclient_domain }} diff --git a/roles/jellyfin/README.md b/roles/jellyfin/README.md new file mode 100644 index 0000000..79d061e --- /dev/null +++ b/roles/jellyfin/README.md @@ -0,0 +1,34 @@ +# Ansible - Jellyfin + +## Example Playbook +``` +# Direct Access: http://art-jr:8096/ +# Domain Access: http://kumardamani.xyz/media +# Create login from GUI. +# While doing initial setup set the base url to '/media' in Networking settings. +- hosts: compute + gather_facts: false + tags: 'jellyfin' + become: true + roles: + - role: jellyfin + vars: + jellyfin_domain: 'kumardamani.xyz' +``` + +## Nginx Conf +``` + location /media/ { + proxy_pass http://127.0.0.1:8096/media/; + proxy_pass_request_headers on; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $http_host; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $http_connection; + # Disable buffering when the nginx proxy gets very resource heavy upon streaming + proxy_buffering off; + } +``` diff --git a/roles/jellyfin/defaults/main.yaml b/roles/jellyfin/defaults/main.yaml new file mode 100644 index 0000000..9a163d4 --- /dev/null +++ b/roles/jellyfin/defaults/main.yaml @@ -0,0 +1,2 @@ +# Default Values +--- diff --git a/roles/jellyfin/handlers/main.yaml b/roles/jellyfin/handlers/main.yaml new file mode 100644 index 0000000..7613b54 --- /dev/null +++ b/roles/jellyfin/handlers/main.yaml @@ -0,0 +1,7 @@ +--- + +- name: 'Restart nginx' + systemd: + name: 'nginx' + state: 'restarted' + listen: 'nginx_restart' diff --git a/roles/jellyfin/tasks/main.yaml b/roles/jellyfin/tasks/main.yaml new file mode 100644 index 0000000..647c1f1 --- /dev/null +++ b/roles/jellyfin/tasks/main.yaml @@ -0,0 +1,45 @@ +# https://jellyfin.org/docs/general/administration/installing.html +# https://jellyfin.org/docs/general/networking/nginx.html +--- + +- name: 'Install required apt packages' + apt: + name: + - 'apt-transport-https' + - 'gnupg' + - 'lsb-release' + state: 'present' + update_cache: true + +- name: Add an Apt signing key, uses whichever key is at the URL + apt_key: + url: https://repo.jellyfin.org/debian/jellyfin_team.gpg.key + state: present + +- name: Add specified repository into sources list + apt_repository: + repo: deb [arch=armhf] https://repo.jellyfin.org/debian bullseye main + state: present + filename: jellyfin + +- name: 'Install Jellyfin' + apt: + name: + - 'jellyfin' + state: 'present' + update_cache: true + +- name: 'Add jellyfin user to video group' + user: + name: 'jellyfin' + groups: 'video' + append: true + state: 'present' + +- name: 'Start Jellyfin' + systemd: + name: '{{ item }}' + state: 'started' + enabled: true + loop: + - 'jellyfin' diff --git a/roles/navidrome/README.md b/roles/navidrome/README.md new file mode 100644 index 0000000..755d428 --- /dev/null +++ b/roles/navidrome/README.md @@ -0,0 +1,31 @@ +# Ansible - Navidrome + +## Example Playbook +``` +# Access: http://art-jr:4533/music/ +# Domain Access: http://kumardamani.xyz/music +# Create login from GUI +- hosts: compute + gather_facts: false + tags: 'navidrome' + become: true + roles: + - role: navidrome + vars: + navidrome_domain: 'kumardamani.xyz' + navidrome_data_root: '{{ data_vol_ssd }}/music' +``` + +## Nginx Conf +``` + location /music/ { + proxy_pass http://127.0.0.1:4533/music/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Protocol $scheme; + proxy_set_header X-Forwarded-Host $http_host; + proxy_buffering off; + } +``` diff --git a/roles/navidrome/defaults/main.yaml b/roles/navidrome/defaults/main.yaml new file mode 100644 index 0000000..a7c9858 --- /dev/null +++ b/roles/navidrome/defaults/main.yaml @@ -0,0 +1,6 @@ +# Default Values +--- + +navidrome_home_root: '/opt/navidrome' +navidrome_home_db: '/opt/navidrome/db' +navidrome_data_root: '' diff --git a/roles/navidrome/handlers/main.yaml b/roles/navidrome/handlers/main.yaml new file mode 100644 index 0000000..7613b54 --- /dev/null +++ b/roles/navidrome/handlers/main.yaml @@ -0,0 +1,7 @@ +--- + +- name: 'Restart nginx' + systemd: + name: 'nginx' + state: 'restarted' + listen: 'nginx_restart' diff --git a/roles/navidrome/tasks/main.yaml b/roles/navidrome/tasks/main.yaml new file mode 100644 index 0000000..72982c2 --- /dev/null +++ b/roles/navidrome/tasks/main.yaml @@ -0,0 +1,34 @@ +# https://www.navidrome.org/docs/installation/docker/ +--- + +- name: 'Ensure required vars exist' + assert: + that: item | mandatory + loop: + - '{{ navidrome_data_root }}' + no_log: true + +- name: 'Ensure Navidrome dirs exists' + file: + path: '{{ item }}' + state: 'directory' + owner: '{{ ansible_user }}' + group: '{{ ansible_user }}' + mode: '755' + loop: + - '{{ navidrome_home_root }}' + - '{{ navidrome_home_db }}' + - '{{ navidrome_data_root }}' + +- name: 'Copy Navidrome docker compose config to home dir' + become_user: '{{ ansible_user }}' + template: + dest: '{{ navidrome_home_root }}/docker-compose.yaml' + src: 'docker-compose.yaml.j2' + mode: '644' + +- name: 'Create and start services' + become_user: '{{ ansible_user }}' + community.docker.docker_compose: + project_src: '{{ navidrome_home_root }}' + state: 'present' diff --git a/roles/navidrome/templates/docker-compose.yaml.j2 b/roles/navidrome/templates/docker-compose.yaml.j2 new file mode 100644 index 0000000..cc9cf59 --- /dev/null +++ b/roles/navidrome/templates/docker-compose.yaml.j2 @@ -0,0 +1,18 @@ +version: "3" +services: + navidrome: + image: deluan/navidrome:latest + user: 1000:1000 + ports: + - "4533:4533" + restart: unless-stopped + environment: + # Optional: put your config options customization here. Examples: + ND_SCANSCHEDULE: 1h + ND_LOGLEVEL: info + ND_SESSIONTIMEOUT: 24h + ND_BASEURL: "/music" + volumes: + - "{{ navidrome_home_db }}:/data" + - "{{ navidrome_data_root }}:/music:ro" + diff --git a/roles/nextcloud/defaults/main.yaml b/roles/nextcloud/defaults/main.yaml new file mode 100644 index 0000000..cd11c66 --- /dev/null +++ b/roles/nextcloud/defaults/main.yaml @@ -0,0 +1,17 @@ +# Default Values +--- + +nextcloud_uid: "1000" +nextcloud_gid: "1000" +nextcloud_tz: 'America/Toronto' +nextcloud_data_root: '' +nextcloud_host_port: '' + +nextcloud_docker_network_name: 'nextcloud_network' + +nextcloud_postgres_db: 'nextcloud_db' +nextcloud_postgres_user: 'nextcloud' +nextcloud_postgres_password: '' + +nextcloud_container_name: 'nextcloud' +nextcloud_dashboard_url: 'https://{{ nextcloud_domain }}' diff --git a/roles/nextcloud/handlers/main.yaml b/roles/nextcloud/handlers/main.yaml new file mode 100644 index 0000000..7613b54 --- /dev/null +++ b/roles/nextcloud/handlers/main.yaml @@ -0,0 +1,7 @@ +--- + +- name: 'Restart nginx' + systemd: + name: 'nginx' + state: 'restarted' + listen: 'nginx_restart' diff --git a/roles/nextcloud/tasks/main.yaml b/roles/nextcloud/tasks/main.yaml new file mode 100644 index 0000000..593bfa3 --- /dev/null +++ b/roles/nextcloud/tasks/main.yaml @@ -0,0 +1,63 @@ +# https://docs.nextcloud.com/server/19/admin_manual/configuration_server/config_sample_php_parameters.html#default-parameters +# https://docs.nextcloud.com/server/19/admin_manual/configuration_server/caching_configuration.html#id2 +--- + +- name: 'Create the nextcloud network' + community.docker.docker_network: + name: '{{ nextcloud_docker_network_name }}' + +- name: Make sure the Postgres container is created and running + community.docker.docker_container: + name: 'nextcloud-postgres' + image: 'postgres:14.1-alpine' + pull: true + state: 'started' + labels: + "flame.type": "application" + "flame.name": "{{ nextcloud_container_name | title }}" + "flame.url": "{{ nextcloud_dashboard_url }}" + "flame.icon": "custom" + env: + "PUID": '{{ nextcloud_uid }}' + "PGID": '{{ nextcloud_gid }}' + "TZ": '{{ nextcloud_tz }}' + "POSTGRES_DB": "{{ nextcloud_postgres_db }}" + "POSTGRES_USER": "{{ nextcloud_postgres_user }}" + "POSTGRES_PASSWORD": "{{ nextcloud_postgres_password }}" + volumes: + - '{{ nextcloud_data_root }}/postgres:/var/lib/postgresql/data' + restart_policy: 'unless-stopped' + +- name: 'Make sure the Redis container is created and running' + community.docker.docker_container: + name: 'nextcloud-redis' + image: 'redis:alpine' + pull: true + state: 'started' + restart_policy: 'unless-stopped' + +- name: 'Make sure the Nextcloud container is created and running' + community.docker.docker_container: + name: '{{ nextcloud_container_name }}' + image: 'ghcr.io/linuxserver/nextcloud:php8' + pull: true + state: 'started' + env: + "PUID": '{{ nextcloud_uid }}' + "PGID": '{{ nextcloud_gid }}' + "TZ": '{{ nextcloud_tz }}' + volumes: + - '{{ nextcloud_data_root }}/config:/config' + - '{{ nextcloud_data_root }}/data:/data' + ports: + - '{{ nextcloud_host_port }}:443' + restart_policy: unless-stopped + +- name: 'Add {{ nextcloud_container_name }} to the docker network' + community.docker.docker_network: + name: '{{ nextcloud_docker_network_name }}' + connected: + - '{{ nextcloud_container_name }}' + - '{{ nextcloud_container_name }}-postgres' + - '{{ nextcloud_container_name }}-redis' + appends: true diff --git a/roles/nginx/defaults/main.yaml b/roles/nginx/defaults/main.yaml new file mode 100644 index 0000000..af90628 --- /dev/null +++ b/roles/nginx/defaults/main.yaml @@ -0,0 +1,7 @@ +# Default Values +--- + +nginx_port: '80' +nginx_website_domains: [] +nginx_global_apps_domain: '' +nginx_apps_confs: {} diff --git a/roles/nginx/handlers/main.yaml b/roles/nginx/handlers/main.yaml new file mode 100644 index 0000000..7613b54 --- /dev/null +++ b/roles/nginx/handlers/main.yaml @@ -0,0 +1,7 @@ +--- + +- name: 'Restart nginx' + systemd: + name: 'nginx' + state: 'restarted' + listen: 'nginx_restart' diff --git a/roles/nginx/tasks/main.yaml b/roles/nginx/tasks/main.yaml new file mode 100644 index 0000000..91fd8a5 --- /dev/null +++ b/roles/nginx/tasks/main.yaml @@ -0,0 +1,67 @@ +# References +# https://www.digitalocean.com/community/tutorials/how-to-install-nginx-on-debian-10 + +--- + +- name: 'Install nginx' + apt: + name: + - 'nginx' + state: 'present' + update_cache: true + notify: + - 'nginx_restart' + +- name: 'Copy the http nginx.conf files' + template: + src: 'http.nginx.conf.j2' + dest: '/etc/nginx/sites-available/{{ item }}' + mode: '644' + loop: + - 'default' + - 'kumardamani.xyz' + - 'amayastuff.com' + register: '_config_copy' + notify: + - 'nginx_restart' + +- name: 'Remove the old symbolic link' + file: + path: '/etc/nginx/sites-enabled/{{ item }}' + state: 'absent' + loop: '{{ nginx_website_domains }}' + +- name: 'Create a http symbolic link' + file: + src: '/etc/nginx/sites-available/{{ item }}' + dest: '/etc/nginx/sites-enabled/{{ item }}' + state: 'link' + loop: '{{ nginx_website_domains }}' + +- name: 'Check nginx config' # noqa no-changed-when + command: 'nginx -t' + +- name: 'Copy the http nginx.conf for apps' + template: + src: 'app.nginx.conf.j2' + dest: '/etc/nginx/sites-available/{{ item.app }}' + mode: '644' + loop: '{{ nginx_apps_confs }}' + notify: + - 'nginx_restart' + +- name: 'Remove the old symbolic link for apps' + file: + path: '/etc/nginx/sites-enabled/{{ item.app }}' + state: 'absent' + loop: '{{ nginx_apps_confs }}' + +- name: 'Create a http symbolic link for apps' + file: + src: '/etc/nginx/sites-available/{{ item.app }}' + dest: '/etc/nginx/sites-enabled/{{ item.app }}' + state: 'link' + loop: '{{ nginx_apps_confs }}' + +- name: 'Check nginx config' # noqa no-changed-when + command: 'nginx -t' diff --git a/roles/nginx/templates/app.nginx.conf.j2 b/roles/nginx/templates/app.nginx.conf.j2 new file mode 100644 index 0000000..c87fe29 --- /dev/null +++ b/roles/nginx/templates/app.nginx.conf.j2 @@ -0,0 +1,21 @@ +server { + listen 443 ssl; + root _; + server_name {{ item.conf.access_domain }}; + ssl_certificate /etc/letsencrypt/live/{{ nginx_global_apps_domain }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ nginx_global_apps_domain }}/privkey.pem; + ssl_protocols TLSv1.1 TLSv1.2; + ssl_ciphers HIGH:!aNULL:!MD5; + + location / { + proxy_pass http://127.0.0.1:{{ item.conf.port }}; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Host $server_name; + proxy_set_header X-Forwarded-Proto https; + proxy_read_timeout 1200s; + client_max_body_size 0; + error_log /var/log/nginx/{{ item.app }}.error.log; + } +} diff --git a/roles/nginx/templates/http.nginx.conf.j2 b/roles/nginx/templates/http.nginx.conf.j2 new file mode 100644 index 0000000..2d4c61b --- /dev/null +++ b/roles/nginx/templates/http.nginx.conf.j2 @@ -0,0 +1,24 @@ +server { + {% if item == "default" %} + listen 80 default_server; + server_name _; + return 301 https://$host$request_uri; + {% else %} + listen 443 ssl; + root /var/www/{{ item }}/html; + server_name {{ item }} www.{{ item }}; + ssl_certificate /etc/letsencrypt/live/{{ item }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ item }}/privkey.pem; + ssl_protocols TLSv1.1 TLSv1.2; + ssl_ciphers HIGH:!aNULL:!MD5; + index index.html index.htm index.nginx-debian.html; + + location ~ /.well-known { + allow all; + } + + location / { + try_files $uri $uri/ =404; + } + {% endif %} +} diff --git a/roles/rpi_exporter/defaults/main.yaml b/roles/rpi_exporter/defaults/main.yaml new file mode 100644 index 0000000..8a446ec --- /dev/null +++ b/roles/rpi_exporter/defaults/main.yaml @@ -0,0 +1,3 @@ +# Default Values +--- + diff --git a/roles/rpi_exporter/tasks/main.yaml b/roles/rpi_exporter/tasks/main.yaml new file mode 100644 index 0000000..9cf3052 --- /dev/null +++ b/roles/rpi_exporter/tasks/main.yaml @@ -0,0 +1,45 @@ +# https://github.com/lukasmalkmus/rpi_exporter +--- + +- name: 'download rpi_exporter binary package to local folder' + become: false + get_url: + url: "https://github.com/lukasmalkmus/rpi_exporter/releases/download/v0.8.0/rpi_exporter-0.8.0.linux-armv7.tar.gz" + dest: "/tmp/rpi_exporter.tar.gz" + register: _download_archive + until: _download_archive is succeeded + retries: 5 + delay: 2 + delegate_to: localhost + check_mode: false + +- name: 'unpack prometheus binaries' + become: false + unarchive: + src: "/tmp/rpi_exporter.tar.gz" + dest: "/tmp" + creates: "/tmp/rpi_exporter/rpi_exporter" + delegate_to: localhost + check_mode: false + +- name: 'propagate rpi_exporter bin' + copy: + src: "/tmp/rpi_exporter/rpi_exporter" + dest: "/usr/local/bin/rpi_exporter" + mode: 0755 + owner: root + group: root + +- name: 'propagate rpi_exporter service' + copy: + src: "/tmp/rpi_exporter/rpi_exporter.service" + dest: "/etc/systemd/system/rpi_exporter.service" + mode: 0755 + owner: root + group: root + +- name: 'Start rpi_exporter' + systemd: + name: 'rpi_exporter' + state: 'started' + enabled: true diff --git a/roles/samba/defaults/main.yaml b/roles/samba/defaults/main.yaml new file mode 100644 index 0000000..971a9c5 --- /dev/null +++ b/roles/samba/defaults/main.yaml @@ -0,0 +1,4 @@ +# Default Values +--- + +samba_user_pass: '' diff --git a/roles/samba/tasks/main.yaml b/roles/samba/tasks/main.yaml new file mode 100644 index 0000000..5207ac5 --- /dev/null +++ b/roles/samba/tasks/main.yaml @@ -0,0 +1,29 @@ +# https://pimylifeup.com/raspberry-pi-samba/ +--- + +- name: 'Install required apt packages' + apt: + name: + - 'samba' + - 'samba-common-bin' + state: 'present' + update_cache: true + +- name: 'Copy conf files' + template: + src: 'smb.conf' + dest: '/etc/samba/smb.conf' + mode: '644' + +- name: 'Add Samba user' + expect: + command: 'sudo smbpasswd -a {{ samba_user }}' + responses: + (?i)password: "{{ samba_user_pass }}" + +- name: 'Restart Samba' + systemd: + name: '{{ item }}' + state: 'restarted' + loop: + - 'smbd' diff --git a/roles/samba/templates/smb.conf b/roles/samba/templates/smb.conf new file mode 100644 index 0000000..eb5839a --- /dev/null +++ b/roles/samba/templates/smb.conf @@ -0,0 +1,6 @@ +[data] +path = {{ data_vol_ssd }} +writeable=Yes +create mask=0777 +directory mask=0777 +public=no diff --git a/roles/seafile_docker/defaults/main.yaml b/roles/seafile_docker/defaults/main.yaml new file mode 100644 index 0000000..ed7cad3 --- /dev/null +++ b/roles/seafile_docker/defaults/main.yaml @@ -0,0 +1,14 @@ +# Default Values +--- + +seafile_image_repo: 'docker.seadrive.org' +seafile_image_name: '{{ seafile_image_repo }}/seafileltd/seafile-pro-mc' +seafile_image_tag: 'latest' +seafile_image_user: 'seafile' +seafile_image_password: '' +seafile_data_root: '{{ data_vol_path }}/seafile' +seafile_mysql_root_password: '' +seafile_timezone: 'America/Toronto' +seafile_admin_email: '' +seafile_admin_password: '' +seafile_listen_port: '' diff --git a/roles/seafile_docker/files/ccnet.conf b/roles/seafile_docker/files/ccnet.conf new file mode 100644 index 0000000..b1b35fd --- /dev/null +++ b/roles/seafile_docker/files/ccnet.conf @@ -0,0 +1,2 @@ +[General] +SERVICE_URL = http://{{ inventory_hostname }}/seafile diff --git a/roles/seafile_docker/files/seafdav.conf b/roles/seafile_docker/files/seafdav.conf new file mode 100644 index 0000000..8ce50cf --- /dev/null +++ b/roles/seafile_docker/files/seafdav.conf @@ -0,0 +1,6 @@ +[WEBDAV] +enabled = true +port = 8080 +fastcgi = false +host = 0.0.0.0 +share_name = /seafdav diff --git a/roles/seafile_docker/files/seafile.service b/roles/seafile_docker/files/seafile.service new file mode 100644 index 0000000..593ae64 --- /dev/null +++ b/roles/seafile_docker/files/seafile.service @@ -0,0 +1,14 @@ +[Unit] +Description=Seafile +After=network.target + +[Service] +Type=forking +ExecStart=/opt/seafile/seafile-server-latest/seafile.sh start +ExecStop=/opt/seafile/seafile-server-latest/seafile.sh stop +LimitNOFILE=infinity +User=seafserver +Group=seafserver + +[Install] +WantedBy=multi-user.target diff --git a/roles/seafile_docker/files/seahub.service b/roles/seafile_docker/files/seahub.service new file mode 100644 index 0000000..83afd48 --- /dev/null +++ b/roles/seafile_docker/files/seahub.service @@ -0,0 +1,13 @@ +[Unit] +Description=Seahub +After=network.target seafile.service + +[Service] +Type=forking +ExecStart=/opt/seafile/seafile-server-latest/seahub.sh start +ExecStop=/opt/seafile/seafile-server-latest/seahub.sh stop +User=seafserver +Group=seafserver + +[Install] +WantedBy=multi-user.target diff --git a/roles/seafile_docker/tasks/main.yaml b/roles/seafile_docker/tasks/main.yaml new file mode 100644 index 0000000..b40e2fc --- /dev/null +++ b/roles/seafile_docker/tasks/main.yaml @@ -0,0 +1,49 @@ +# https://manual.seafile.com/docker/pro-edition/deploy_seafile_pro_with_docker/ +--- + +- name: 'Ensure required vars exist' + assert: + that: item | mandatory + loop: + - '{{ data_vol_path }}' + - '{{ seafile_image_repo }}' + - '{{ seafile_image_name }}' + - '{{ seafile_image_tag }}' + - '{{ seafile_image_user }}' + - '{{ seafile_image_password }}' + - '{{ seafile_data_root }}' + - '{{ seafile_mysql_root_password }}' + - '{{ seafile_timezone }}' + - '{{ seafile_admin_email }}' + - '{{ seafile_admin_password }}' + - '{{ seafile_listen_port }}' + no_log: true + +- name: 'Log into DockerHub' + community.docker.docker_login: + registry_url: '{{ seafile_image_repo }}' + username: '{{ seafile_image_user }}' + password: '{{ seafile_image_password }}' + +- name: 'Pull Seafile Pro image' + community.docker.docker_image: + name: '{{ seafile_image_name }}' + tag: '{{ seafile_image_tag }}' + state: 'present' + source: 'pull' + +- name: 'Ensure Seafile data dir exists' + file: + path: '{{ seafile_data_root }}' + state: 'directory' + mode: '755' + +- name: 'Copy Seafile docker compose config to seafile dir' + template: + dest: '{{ seafile_data_root }}/docker-compose.yaml' + src: 'docker-compose.yaml.j2' + mode: '644' + +- name: 'Create and start services' + community.docker.docker_compose: + project_src: '{{ seafile_data_root }}' diff --git a/roles/seafile_docker/templates/docker-compose.yaml.j2 b/roles/seafile_docker/templates/docker-compose.yaml.j2 new file mode 100644 index 0000000..3dd34b3 --- /dev/null +++ b/roles/seafile_docker/templates/docker-compose.yaml.j2 @@ -0,0 +1,61 @@ +version: '2.0' +services: + db: + image: mariadb:10.5 + container_name: seafile-mysql + environment: + - MYSQL_ROOT_PASSWORD={{ seafile_mysql_root_password }} + - MYSQL_LOG_CONSOLE=true + volumes: + - {{ seafile_data_root }}/seafile-mysql/db:/var/lib/mysql + networks: + - seafile-net + + memcached: + image: memcached:1.5.6 + container_name: seafile-memcached + entrypoint: memcached -m 256 + networks: + - seafile-net + + elasticsearch: + image: seafileltd/elasticsearch-with-ik:5.6.16 + container_name: seafile-elasticsearch + environment: + - discovery.type=single-node + - bootstrap.memory_lock=true + - "ES_JAVA_OPTS=-Xms1g -Xmx1g" + ulimits: + memlock: + soft: -1 + hard: -1 + mem_limit: 2g + volumes: + - {{ seafile_data_root }}/seafile-elasticsearch/data:/usr/share/elasticsearch/data + networks: + - seafile-net + + seafile: + image: {{ seafile_image_name }}:{{ seafile_image_tag }} + container_name: seafile + ports: + - "{{ seafile_listen_port }}:80" + volumes: + - {{ seafile_data_root }}/seafile-data:/shared + environment: + - DB_HOST=db + - DB_ROOT_PASSWD={{ seafile_mysql_root_password }} + - TIME_ZONE={{ seafile_timezone }} + - SEAFILE_ADMIN_EMAIL={{ seafile_admin_email }} + - SEAFILE_ADMIN_PASSWORD={{ seafile_admin_password }} + - SEAFILE_SERVER_LETSENCRYPT=false + #- SEAFILE_SERVER_HOSTNAME=example.seafile.com # Specifies your host name if https is enabled + depends_on: + - db + - memcached + - elasticsearch + networks: + - seafile-net + +networks: + seafile-net: diff --git a/roles/seafile_non_docker/README.md b/roles/seafile_non_docker/README.md new file mode 100644 index 0000000..e806c13 --- /dev/null +++ b/roles/seafile_non_docker/README.md @@ -0,0 +1,60 @@ +# Ansible - Seafile + +## Example Playbook +``` +# Direct Access: http://art-jr:8000/ +# Domain Access: http://kumardamani.xyz/files +- hosts: compute + gather_facts: false + tags: 'seafile' + become: true + roles: + - role: seafile_non_docker + vars: + seafile_user_email: 'kumar@kumardamani.xyz' + seafile_user_password: '{{ vault_seafile_user_password }}' + seafile_domain: 'kumardamani.xyz' + seafile_data_dir: '{{ data_vol_hdd }}/seafile' +``` + +## Nginx Conf +``` + location /files/ { + proxy_pass http://127.0.0.1:8000; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Host $server_name; + proxy_set_header X-Forwarded-Proto https; + proxy_read_timeout 1200s; + # used for view/edit office file via Office Online Server + client_max_body_size 0; + error_log /var/log/nginx/seahub.error.log; + } + location /seafhttp/ { + rewrite ^/seafhttp(.*)$ $1 break; + proxy_pass http://127.0.0.1:8082; + client_max_body_size 0; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_connect_timeout 36000s; + proxy_read_timeout 36000s; + proxy_send_timeout 36000s; + send_timeout 36000s; + error_log /var/log/nginx/seafhttp.error.log; + } + location /seafmedia/ { + rewrite ^/seafmedia(.*)$ /media$1 break; + root /opt/seafile/seafile-server-latest/seahub; + } + location /seafdav/ { + proxy_pass http://127.0.0.1:8080; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Host $server_name; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 1200s; + client_max_body_size 0; + error_log /var/log/nginx/seafdav.error.log; + } +``` diff --git a/roles/seafile_non_docker/defaults/main.yaml b/roles/seafile_non_docker/defaults/main.yaml new file mode 100644 index 0000000..9df3048 --- /dev/null +++ b/roles/seafile_non_docker/defaults/main.yaml @@ -0,0 +1,10 @@ +# Default Values +--- + +# https://github.com/haiwen/seafile-rpi/releases +seafile_version: '8.0.7' +seafile_download_url: 'https://github.com/haiwen/seafile-rpi/releases/download/v{{ seafile_version }}/seafile-server-{{ seafile_version }}-buster-armv7l.tar.gz' + +seafile_install_dir: '/opt/seafile' +seafile_data_dir: '' +seafile_user_grp: '{{ ansible_user }}' diff --git a/roles/seafile_non_docker/handlers/main.yaml b/roles/seafile_non_docker/handlers/main.yaml new file mode 100644 index 0000000..73f755f --- /dev/null +++ b/roles/seafile_non_docker/handlers/main.yaml @@ -0,0 +1,19 @@ +--- + +- name: 'Restart nginx' + systemd: + name: 'nginx' + state: 'restarted' + listen: 'nginx_restart' + +- name: 'Restart Seafile' + systemd: + name: 'seafile' + state: 'restarted' + listen: 'seafile restart' + +- name: 'Restart Seahub' + systemd: + name: 'seahub' + state: 'restarted' + listen: 'seahub restart' diff --git a/roles/seafile_non_docker/tasks/main.yaml b/roles/seafile_non_docker/tasks/main.yaml new file mode 100644 index 0000000..597c389 --- /dev/null +++ b/roles/seafile_non_docker/tasks/main.yaml @@ -0,0 +1,220 @@ +# https://seafile.readthedocs.io/en/latest/config/seafile/seadav/#seafdav-configuration +# https://manual.seafile.com/deploy/using_sqlite/ +# https://manual.seafile.com/deploy/using_sqlite/#setup-in-non-interactive-way +# https://manual.seafile.com/deploy/deploy_with_nginx +# https://manual.seafile.com/deploy/deploy_seahub_at_non-root_domain/ +# https://seafile.readthedocs.io/en/latest/installation/seafile/#enable-seafile-server-autostart-systemd +--- + +- name: 'install required apt packages' + apt: + name: + - 'libmemcached-dev' + - 'memcached' + - 'pwgen' + - 'python3' + - 'python3-setuptools' + - 'python3-pip' + - 'sqlite3' + - 'libopenjp2-7' + - 'libtiff5' + state: 'present' + update_cache: true + +- name: 'install required pip packages' + become_user: '{{ seafile_user_grp }}' + pip: + name: + - 'captcha' + - 'django==2.2.*' + - 'django-pylibmc' + - 'django-simple-captcha' + - 'future' + - 'jinja2' + - 'Pillow' + - 'psd-tools' + - 'pylibmc' + - 'pexpect' + state: 'present' + +- name: 'create seafile installation and data directories' + file: + path: '{{ item.path }}' + state: 'directory' + owner: '{{ item.owner }}' + group: '{{ item.group }}' + mode: '{{ item.mode }}' + loop: + - {path: '{{ seafile_install_dir }}/installed', owner: '{{ seafile_user_grp }}', group: '{{ seafile_user_grp }}', mode: '775'} + - {path: '{{ seafile_data_dir }}', owner: '{{ ansible_user }}', group: '{{ ansible_user }}', mode: '755'} + +- name: 'download seafile package to local folder' + become_user: '{{ seafile_user_grp }}' + get_url: + url: '{{ seafile_download_url }}' + dest: '{{ seafile_install_dir }}/installed/seafile-{{ seafile_version }}.tar.gz' + mode: '644' + register: '_download_archive' + until: '_download_archive is succeeded' + retries: 5 + delay: 2 + check_mode: false + +- name: 'unpack seafile binaries' + become_user: '{{ seafile_user_grp }}' + unarchive: + src: '{{ seafile_install_dir }}/installed/seafile-{{ seafile_version }}.tar.gz' + dest: '{{ seafile_install_dir }}' + remote_src: true + creates: '{{ seafile_install_dir }}/seafile-server-{{ seafile_version }}' + check_mode: false + +# this hack is needed for this version only +- name: 'Remove old PIL dir' + become_user: '{{ seafile_user_grp }}' + file: + path: '{{ seafile_install_dir }}/seafile-server-{{ seafile_version }}/seahub/thirdpart/PIL' + state: 'absent' + when: '"buster" in seafile_download_url' + +# RUN NON-INTERACTIVELY +- name: 'Run setup script' # noqa no-changed-when command-instead-of-shell + become_user: '{{ seafile_user_grp }}' + shell: './setup-seafile.sh auto -n "{{ inventory_hostname }}" -i "0.0.0.0"' + args: + executable: '/bin/bash' + chdir: '{{ seafile_install_dir }}/seafile-server-{{ seafile_version }}' + creates: '{{ seafile_install_dir }}/conf/ccnet.conf' + +- name: 'Get stats of the data object' + stat: + path: '{{ seafile_install_dir }}/seafile-data' + register: sym + +- block: + - name: 'Ensure Seafile is not running yet' # noqa command-instead-of-shell + become_user: '{{ seafile_user_grp }}' + shell: './seafile.sh stop' + args: + executable: '/bin/bash' + chdir: '{{ seafile_install_dir }}/seafile-server-{{ seafile_version }}' + + - name: 'Move old data to new data' # noqa risky-file-permissions + become_user: '{{ seafile_user_grp }}' + copy: + src: '{{ seafile_install_dir }}/seafile-data/' + dest: '{{ seafile_data_dir }}' + remote_src: true + + - name: 'Delete old data dir' + become_user: '{{ seafile_user_grp }}' + file: + path: '{{ seafile_install_dir }}/seafile-data' + state: 'absent' + + - name: 'Create symlink to new data dir' + become_user: '{{ seafile_user_grp }}' + file: + src: '{{ seafile_data_dir }}' + dest: '{{ seafile_install_dir }}/seafile-data' + state: 'link' + when: sym.stat.islnk is defined and (not sym.stat.islnk) # => first time setup + +- name: 'Copy conf files' + become_user: '{{ seafile_user_grp }}' + template: + src: '{{ item }}.j2' + dest: '{{ seafile_install_dir }}/conf/{{ item }}' + mode: '644' + loop: + - 'ccnet.conf' + - 'seafdav.conf' + notify: + - 'seafile restart' + - 'seahub restart' + +- name: 'Update gunicorn conf' + lineinfile: + path: '{{ seafile_install_dir }}/conf/gunicorn.conf.py' + regexp: '^bind' + line: 'bind = "127.0.0.1:8000"' + notify: + - 'seahub restart' + +# some stuff needed for nginx based install +- name: 'Update seahub_settings.py' + become_user: '{{ seafile_user_grp }}' + blockinfile: + path: '{{ seafile_install_dir }}/conf/seahub_settings.py' + insertafter: '^SECRET_KEY' + block: | + DEBUG = False + FILE_SERVER_ROOT = 'https://{{ seafile_domain }}/seafhttp' + SERVE_STATIC = False + MEDIA_URL = '/seafmedia/' + COMPRESS_URL = MEDIA_URL + STATIC_URL = MEDIA_URL + 'assets/' + SITE_ROOT = '/files/' + LOGIN_URL = '/files/accounts/login/' + notify: + - 'seahub restart' + +- block: + - name: 'Run Seafile start script' # noqa command-instead-of-shell + become_user: '{{ seafile_user_grp }}' + shell: './seafile.sh start' + args: + executable: '/bin/bash' + chdir: '{{ seafile_install_dir }}/seafile-server-{{ seafile_version }}' + + - name: 'Init Seahub with a user' + become_user: '{{ seafile_user_grp }}' + expect: + command: './seahub.sh start' + chdir: '{{ seafile_install_dir }}/seafile-server-{{ seafile_version }}' + responses: + (?i)email: "{{ seafile_user_email }}" + (?i)password: "{{ seafile_user_password }}" + + when: sym.stat.islnk is defined and (not sym.stat.islnk) # => first time setup + +- name: 'Create systemd services' + template: + src: '{{ item }}.j2' + dest: '/etc/systemd/system/{{ item }}' + mode: '644' + loop: + - 'seafile.service' + - 'seahub.service' + notify: + - 'seafile restart' + - 'seahub restart' + +- name: 'Reload systemd units' + systemd: + daemon_reload: true + +- block: + - name: 'Run Seahub start script' # noqa command-instead-of-shell + become_user: '{{ seafile_user_grp }}' + shell: './seahub.sh stop' + args: + executable: '/bin/bash' + chdir: '{{ seafile_install_dir }}/seafile-server-{{ seafile_version }}' + + - name: 'Run Seafile stop script' # noqa command-instead-of-shell + become_user: '{{ seafile_user_grp }}' + shell: './seafile.sh stop' + args: + executable: '/bin/bash' + chdir: '{{ seafile_install_dir }}/seafile-server-{{ seafile_version }}' + when: sym.stat.islnk is defined and (not sym.stat.islnk) # => first time setup + +- name: 'Start Seafile and Seahub' + systemd: + name: '{{ item }}' + state: 'started' + enabled: true + loop: + - 'seafile' + - 'seahub' diff --git a/roles/seafile_non_docker/templates/ccnet.conf.j2 b/roles/seafile_non_docker/templates/ccnet.conf.j2 new file mode 100644 index 0000000..d6d69cb --- /dev/null +++ b/roles/seafile_non_docker/templates/ccnet.conf.j2 @@ -0,0 +1,2 @@ +[General] +SERVICE_URL = https://{{ seafile_domain }}/files diff --git a/roles/seafile_non_docker/templates/seafdav.conf.j2 b/roles/seafile_non_docker/templates/seafdav.conf.j2 new file mode 100644 index 0000000..54712a1 --- /dev/null +++ b/roles/seafile_non_docker/templates/seafdav.conf.j2 @@ -0,0 +1,6 @@ +[WEBDAV] +enabled = true +port = 8080 +fastcgi = false +host = 127.0.0.1 +share_name = /seafdav diff --git a/roles/seafile_non_docker/templates/seafile.service.j2 b/roles/seafile_non_docker/templates/seafile.service.j2 new file mode 100644 index 0000000..8e4c94f --- /dev/null +++ b/roles/seafile_non_docker/templates/seafile.service.j2 @@ -0,0 +1,14 @@ +[Unit] +Description=Seafile +After=network.target + +[Service] +Type=forking +ExecStart={{ seafile_install_dir }}/seafile-server-latest/seafile.sh start +ExecStop={{ seafile_install_dir }}/seafile-server-latest/seafile.sh stop +LimitNOFILE=infinity +User={{ seafile_user_grp }} +Group={{ seafile_user_grp }} + +[Install] +WantedBy=multi-user.target diff --git a/roles/seafile_non_docker/templates/seahub.service.j2 b/roles/seafile_non_docker/templates/seahub.service.j2 new file mode 100644 index 0000000..aa61a83 --- /dev/null +++ b/roles/seafile_non_docker/templates/seahub.service.j2 @@ -0,0 +1,14 @@ +[Unit] +Description=Seahub +After=network.target seafile.service + +[Service] +Type=forking +ExecStart={{ seafile_install_dir }}/seafile-server-latest/seahub.sh start +ExecStop={{ seafile_install_dir }}/seafile-server-latest/seahub.sh stop +LimitNOFILE=infinity +User={{ seafile_user_grp }} +Group={{ seafile_user_grp }} + +[Install] +WantedBy=multi-user.target diff --git a/roles/website/defaults/main.yaml b/roles/website/defaults/main.yaml new file mode 100644 index 0000000..47cf58c --- /dev/null +++ b/roles/website/defaults/main.yaml @@ -0,0 +1,4 @@ +# Default Values +--- + +websites: [] diff --git a/roles/website/tasks/main.yaml b/roles/website/tasks/main.yaml new file mode 100644 index 0000000..6fdf7fa --- /dev/null +++ b/roles/website/tasks/main.yaml @@ -0,0 +1,24 @@ +--- + +- name: 'Install git' + package: + name: 'git' + state: 'present' + +- name: 'Create domain level dir' + file: + path: '/var/www/{{ item.name }}/html' + state: 'directory' + mode: '0755' + loop: '{{ websites }}' + +- name: 'Clone all the website project repos' + git: + repo: '{{ item.git_url }}' + dest: '/var/www/{{ item.name }}/html' + depth: 1 + update: true + force: true + version: '{{ item.git_version }}' + umask: '002' + loop: '{{ websites }}' diff --git a/roles/wireguard/defaults/main.yaml b/roles/wireguard/defaults/main.yaml new file mode 100644 index 0000000..9a163d4 --- /dev/null +++ b/roles/wireguard/defaults/main.yaml @@ -0,0 +1,2 @@ +# Default Values +--- diff --git a/roles/wireguard/handlers/main.yaml b/roles/wireguard/handlers/main.yaml new file mode 100644 index 0000000..bd5fc0d --- /dev/null +++ b/roles/wireguard/handlers/main.yaml @@ -0,0 +1,7 @@ +--- + +- name: 'Restart wireguard' + systemd: + name: 'wg-quick@wg0' + state: 'restarted' + listen: 'restart wireguard' diff --git a/roles/wireguard/tasks/main.yaml b/roles/wireguard/tasks/main.yaml new file mode 100644 index 0000000..d7e1e51 --- /dev/null +++ b/roles/wireguard/tasks/main.yaml @@ -0,0 +1,38 @@ +# https://dev.to/tangramvision/exploring-ansible-via-setting-up-a-wireguard-vpn-3389 +--- + +- name: 'install wireguard package' + apt: + name: 'wireguard' + state: 'present' + update_cache: true + +- name: 'create server wireguard config' + template: + dest: '/etc/wireguard/wg0.conf' + src: 'wg0.conf.j2' + owner: 'root' + group: 'root' + mode: '600' + notify: 'restart wireguard' + +- name: 'Enable IP Forwarding' + sysctl: + name: '{{ item.sysctl_key }}' + reload: true + state: 'present' + sysctl_set: true + value: '{{ item.sysctl_val }}' + loop: + - sysctl_key: 'net.ipv4.ip_forward' + sysctl_val: "1" + - sysctl_key: 'net.ipv6.conf.all.disable_ipv6' + sysctl_val: "0" + - sysctl_key: 'net.ipv6.conf.all.forwarding' + sysctl_val: "1" + +- name: 'start wireguard and enable on boot' + systemd: + name: 'wg-quick@wg0' + state: 'started' + enabled: true diff --git a/roles/wireguard/templates/wg0.conf.j2 b/roles/wireguard/templates/wg0.conf.j2 new file mode 100644 index 0000000..6e7bcc1 --- /dev/null +++ b/roles/wireguard/templates/wg0.conf.j2 @@ -0,0 +1,17 @@ +# {{ ansible_managed }} + +[Interface] +Address = {{ wireguard_server_ip }} +ListenPort = {{ wireguard_server_listen_port }} +PrivateKey = {{ wireguard_server_priv_key }} +PostUp = iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT +PostUp = iptables -w -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w -t nat -A POSTROUTING -o eth0 -j MASQUERADE +PostDown = iptables -w -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w -t nat -D POSTROUTING -o eth0 -j MASQUERADE + + +{% for peer in wireguard_peers %} +[Peer] +PublicKey = {{ peer.peer_key }} +AllowedIPs = {{ peer.peer_ip}} + +{% endfor %} diff --git a/roles/wireguard_client/defaults/main.yaml b/roles/wireguard_client/defaults/main.yaml new file mode 100644 index 0000000..9a163d4 --- /dev/null +++ b/roles/wireguard_client/defaults/main.yaml @@ -0,0 +1,2 @@ +# Default Values +--- diff --git a/roles/wireguard_client/handlers/main.yaml b/roles/wireguard_client/handlers/main.yaml new file mode 100644 index 0000000..bd5fc0d --- /dev/null +++ b/roles/wireguard_client/handlers/main.yaml @@ -0,0 +1,7 @@ +--- + +- name: 'Restart wireguard' + systemd: + name: 'wg-quick@wg0' + state: 'restarted' + listen: 'restart wireguard' diff --git a/roles/wireguard_client/tasks/main.yaml b/roles/wireguard_client/tasks/main.yaml new file mode 100644 index 0000000..04814ba --- /dev/null +++ b/roles/wireguard_client/tasks/main.yaml @@ -0,0 +1,36 @@ +# https://dev.to/tangramvision/exploring-ansible-via-setting-up-a-wireguard-vpn-3389 +--- + +- name: 'Enable Debian 10 buster backports repo' + shell: + cmd: 'echo "deb http://deb.debian.org/debian buster-backports main contrib non-free" > /etc/apt/sources.list.d/buster-backports.list' + creates: '/etc/apt/sources.list.d/buster-backports.list' + +- name: 'Install Wireguard' + apt: + name: 'wireguard' + state: 'present' + update_cache: true + +- name: 'enable and persist ip forwarding' + sysctl: + name: 'net.ipv4.ip_forward' + value: "1" + state: 'present' + sysctl_set: true + reload: true + +- name: 'generate private key' + shell: + cmd: 'umask 077 && wg genkey | tee privatekey | wg pubkey > publickey' + chdir: '/etc/wireguard' + creates: '/etc/wireguard/publickey' + +- name: 'create client wireguard config' + template: + dest: '/etc/wireguard/wg0.conf' + src: 'wg0.conf.j2' + owner: 'root' + group: 'root' + mode: '600' + notify: 'restart wireguard' diff --git a/roles/wireguard_client/templates/wg0.conf.j2 b/roles/wireguard_client/templates/wg0.conf.j2 new file mode 100644 index 0000000..d667d8a --- /dev/null +++ b/roles/wireguard_client/templates/wg0.conf.j2 @@ -0,0 +1,16 @@ +# {{ ansible_managed }} + +[Interface] +Address = {{ wireguard_client_peer_ip }} +PostUp = wg set %i private-key /etc/wireguard/privatekey +PostUp = ping -c1 192.168.10.1 +{% for port in wireguard_client_port_forwards %} +PostUp = iptables -t nat -A PREROUTING -p tcp --dport {{ port }} -j DNAT --to-destination 192.168.10.1:{{ port }} +{% endfor %} +PostUp = iptables -t nat -A POSTROUTING -j MASQUERADE + +[Peer] +PublicKey = {{ wireguard_client_server_pub_key }} +AllowedIPs = {{ wireguard_client_server_allowed_ips }} +Endpoint = {{ wireguard_client_server_endpoint }}:{{ wireguard_client_server_listen_port }} +PersistentKeepalive = 20 |