deprecate sedan, add vault to ivyking

ansible/host_vars/ivyking.minhas.io/main.yml

@@ -1,3 +1,2 @@
 ---
-docker_repo_storage: /tank0/docker-repo
 minio_volume: /tank0/minio

ansible/inventory.txt

@@ -2,7 +2,6 @@
 hardtack[1:7].minhas.io
 ranger.minhas.io
 redwingcherokee.minhas.io
-sedan.minhas.io
 fishbowl.minhas.io
 teapot[01:06].minhas.io
 ivyking.minhas.io
@@ -21,15 +20,15 @@ teapot[01:06].minhas.io
 redwingcherokee.minhas.io
 
 [docker_repo]
-sedan.minhas.io
+ivyking.minhas.io
 
 [vault_server]
 ranger.minhas.io
-sedan.minhas.io
+ivyking.minhas.io
 hardtack1.minhas.io
 
 [wekan]
-sedan.minhas.io
+ivyking.minhas.io
 
 [bitcoind]
 ivyking.minhas.io

ansible/playbooks/docker-repo.yml

@@ -1,5 +0,0 @@
----
-- hosts: docker_repo
-  roles:
-    - role: docker-repo
-...

ansible/playbooks/site.yml

@@ -1,8 +1,8 @@
 ---
 - import_playbook: common.yml
 - import_playbook: vault-server.yml
+- import_playbook: minio.yml
 - import_playbook: k3s.yml
-  #- import_playbook: docker-repo.yml
 - import_playbook: lnd.yml
 - import_playbook: wekan.yml
 ...

ansible/roles/docker-repo/defaults/main.yml

@@ -1,2 +0,0 @@
----
-docker_repo_storage: /tank0/docker-repo

ansible/roles/docker-repo/files/docker-repo.hcl

@@ -1,12 +0,0 @@
-services {
-  id = "docker-repo"
-  name = "docker-repo"
-  port = 5000
-  checks = [
-    {
-      args = ["nc", "-z", "-v", "localhost", "5000"]
-      interval = "5s"
-      timeout = "20s"
-    }
-  ]
-}

ansible/roles/docker-repo/handlers/main.yml

@@ -1,6 +0,0 @@
----
-- name: restart docker
-  docker_container:
-    name: docker-repo
-    image:  registry:2
-    restart: True

ansible/roles/docker-repo/tasks/main.yml

@@ -1,85 +0,0 @@
----
-- name: ensure docker repo cert directory exists
-  file:
-    path: /etc/docker-repo/certs
-    recurse: True
-    state: directory
-    owner: root
-    group: root
-    mode: 0755
-
-- name: ensure docker data directory exists
-  file:
-    path: '{{ docker_repo_storage }}'
-    recurse: True
-    state: directory
-    owner: root
-    group: root
-    mode: 0755
-
-- name: check if server cert is expiring in the next 5 days
-  shell: "openssl x509 -checkend 432000 -noout -in /etc/docker-repo/certs/docker-repo.crt"
-  args:
-    executable: /bin/bash
-  failed_when: False
-  check_mode: False
-  changed_when: False
-  register: exp
-
-- name: get cert
-  shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=docker-repo.service.masked.name ttl=43200m"
-  args:
-    executable: /bin/bash
-  environment:
-    VAULT_ADDR: https://vault.service.masked.name:8200
-    VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
-    VAULT_FORMAT: json
-  register: cert_data
-  when: exp.rc != 0
-
-- name: write cert data to server
-  copy:
-    content: "{{ item.content }}"
-    dest: "/etc/docker-repo/{{ item.path }}"
-    mode: '{{ item.mode }}'
-    owner: root
-    group: root
-  when: cert_data.changed
-  register: cert_written
-  loop:
-    - {
-        content: "{{ (cert_data.stdout | from_json).data.certificate }}",
-        path: "certs/docker-repo.crt",
-        mode: "0755"
-    }
-    - {
-        content: "{{ (cert_data.stdout | from_json).data.private_key }}",
-        path: "certs/docker-repo.key",
-        mode: "0600"
-    }
-
-- name: ensure python-docker is installed
-  apt:
-    name: python3-docker
-    state: present
-
-- name: ensure docker repo data dir exists
-  file:
-    path: "{{ docker_repo_storage }}"
-    state: directory
-    mode: 0755
-
-- name: run docker-repo
-  docker_container:
-    name: docker-repo
-    image: registry:2
-    env:
-      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/docker-repo.crt
-      REGISTRY_HTTP_TLS_KEY: /certs/docker-repo.key
-    ports:
-      - "5000:5000"
-    volumes:
-      - "{{ docker_repo_storage }}:/data"
-      - "/etc/docker-repo/certs:/certs"
-    restart_policy: always
-...