deprecate sedan, add vault to ivyking

This commit is contained in:
Amarpreet Minhas 2023-07-17 16:02:13 -04:00
parent c8c32a7cca
commit ada5186e3d
8 changed files with 4 additions and 116 deletions

View file

@ -1,3 +1,2 @@
--- ---
docker_repo_storage: /tank0/docker-repo
minio_volume: /tank0/minio minio_volume: /tank0/minio

View file

@ -2,7 +2,6 @@
hardtack[1:7].minhas.io hardtack[1:7].minhas.io
ranger.minhas.io ranger.minhas.io
redwingcherokee.minhas.io redwingcherokee.minhas.io
sedan.minhas.io
fishbowl.minhas.io fishbowl.minhas.io
teapot[01:06].minhas.io teapot[01:06].minhas.io
ivyking.minhas.io ivyking.minhas.io
@ -21,15 +20,15 @@ teapot[01:06].minhas.io
redwingcherokee.minhas.io redwingcherokee.minhas.io
[docker_repo] [docker_repo]
sedan.minhas.io ivyking.minhas.io
[vault_server] [vault_server]
ranger.minhas.io ranger.minhas.io
sedan.minhas.io ivyking.minhas.io
hardtack1.minhas.io hardtack1.minhas.io
[wekan] [wekan]
sedan.minhas.io ivyking.minhas.io
[bitcoind] [bitcoind]
ivyking.minhas.io ivyking.minhas.io

View file

@ -1,5 +0,0 @@
---
- hosts: docker_repo
roles:
- role: docker-repo
...

View file

@ -1,8 +1,8 @@
--- ---
- import_playbook: common.yml - import_playbook: common.yml
- import_playbook: vault-server.yml - import_playbook: vault-server.yml
- import_playbook: minio.yml
- import_playbook: k3s.yml - import_playbook: k3s.yml
#- import_playbook: docker-repo.yml
- import_playbook: lnd.yml - import_playbook: lnd.yml
- import_playbook: wekan.yml - import_playbook: wekan.yml
... ...

View file

@ -1,2 +0,0 @@
---
docker_repo_storage: /tank0/docker-repo

View file

@ -1,12 +0,0 @@
services {
id = "docker-repo"
name = "docker-repo"
port = 5000
checks = [
{
args = ["nc", "-z", "-v", "localhost", "5000"]
interval = "5s"
timeout = "20s"
}
]
}

View file

@ -1,6 +0,0 @@
---
- name: restart docker
docker_container:
name: docker-repo
image: registry:2
restart: True

View file

@ -1,85 +0,0 @@
---
- name: ensure docker repo cert directory exists
file:
path: /etc/docker-repo/certs
recurse: True
state: directory
owner: root
group: root
mode: 0755
- name: ensure docker data directory exists
file:
path: '{{ docker_repo_storage }}'
recurse: True
state: directory
owner: root
group: root
mode: 0755
- name: check if server cert is expiring in the next 5 days
shell: "openssl x509 -checkend 432000 -noout -in /etc/docker-repo/certs/docker-repo.crt"
args:
executable: /bin/bash
failed_when: False
check_mode: False
changed_when: False
register: exp
- name: get cert
shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=docker-repo.service.masked.name ttl=43200m"
args:
executable: /bin/bash
environment:
VAULT_ADDR: https://vault.service.masked.name:8200
VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
VAULT_FORMAT: json
register: cert_data
when: exp.rc != 0
- name: write cert data to server
copy:
content: "{{ item.content }}"
dest: "/etc/docker-repo/{{ item.path }}"
mode: '{{ item.mode }}'
owner: root
group: root
when: cert_data.changed
register: cert_written
loop:
- {
content: "{{ (cert_data.stdout | from_json).data.certificate }}",
path: "certs/docker-repo.crt",
mode: "0755"
}
- {
content: "{{ (cert_data.stdout | from_json).data.private_key }}",
path: "certs/docker-repo.key",
mode: "0600"
}
- name: ensure python-docker is installed
apt:
name: python3-docker
state: present
- name: ensure docker repo data dir exists
file:
path: "{{ docker_repo_storage }}"
state: directory
mode: 0755
- name: run docker-repo
docker_container:
name: docker-repo
image: registry:2
env:
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/docker-repo.crt
REGISTRY_HTTP_TLS_KEY: /certs/docker-repo.key
ports:
- "5000:5000"
volumes:
- "{{ docker_repo_storage }}:/data"
- "/etc/docker-repo/certs:/certs"
restart_policy: always
...