ansible/group_vars/all/main.yml

@@ -7,11 +7,11 @@ admin_email_address: amarpreet@minhas.io
 hashi_arch: amd64
 
 # consul
-consul_version: 1.12.2
+consul_version: 1.10.1
 consul_domain: masked.name
 
 # vault
-vault_version: 1.10.4
+vault_version: 1.8.1
 vault_pki_policy: masked-dot-name
 vault_ca_cert_name: MaskedName_Root_CA.crt
 vault_ca_cert_payload: |
@@ -60,12 +60,12 @@ vault_ca_cert_payload: |
   -----END CERTIFICATE-----
 
 # nomad
-nomad_version: 1.3.1
+nomad_version: 1.1.3
 nomad_podman_driver_version: 0.3.0
 
 # lnd
-lnd_version: 0.15.0-beta
+lnd_version: 0.14.2-beta
 
 # lego
-lego_version: 4.7.0
+lego_version: 4.4.0
 ...

ansible/group_vars/hardtack/main.yml

@@ -3,5 +3,5 @@ hashi_arch: arm
 consul_arch: arm64
 nomad_arch: arm64
 docker_arch: arm64
-k3s_version: v1.24.1+k3s1
+k3s_version: v1.23.4+k3s1
 k3s_role: 'client'

ansible/host_vars/redwingcherokee.minhas.io/main.yml

@@ -1,6 +1,6 @@
 ---
 hashi_arch: arm
-consul_arch: arm
+consul_arch: armhfv6
 lnd_arch: armv7
 
 bitcoind_disk: /dev/sda1

ansible/inventory.txt

@@ -23,7 +23,7 @@ hardtack[1:7].minhas.io
 [lnd]
 redwingcherokee.minhas.io
 
-[docker-repo]
+[nexus]
 ivyking.minhas.io
 
 [nomad_client]

ansible/playbooks/docker-repo.yml

@@ -1,5 +0,0 @@
----
-- hosts: docker-repo
-  roles:
-    - role: docker-repo
-...

ansible/playbooks/nexus.yml

@@ -0,0 +1,5 @@
+---
+- hosts: nexus
+  roles:
+    - role: nexus
+...

ansible/playbooks/site.yml

@@ -6,7 +6,7 @@
 - import_playbook: docker.yml
 - import_playbook: nomad.yml
 - import_playbook: k3s.yml
-- import_playbook: docker-repo.yml
+- import_playbook: nexus.yml
 - import_playbook: lnd.yml
 - import_playbook: wekan.yml
 - import_playbook: haproxy.yml

ansible/roles/docker-repo/defaults/main.yml

@@ -1,2 +0,0 @@
----
-docker_repo_storage: /mnt/raid/docker-repo

ansible/roles/docker-repo/files/docker-repo.hcl

@@ -1,12 +0,0 @@
-services {
-  id = "docker-repo"
-  name = "docker-repo"
-  port = 5000
-  checks = [
-    {
-      args = ["nc", "-z", "-v", "localhost", "5000"]
-      interval = "5s"
-      timeout = "20s"
-    }
-  ]
-}

ansible/roles/docker-repo/tasks/main.yml

@@ -1,94 +0,0 @@
----
-- name: ensure docker repo cert directory exists
-  file:
-    path: /etc/docker-repo/certs
-    recurse: True
-    state: directory
-    owner: root
-    group: root
-    mode: 0755
-
-- name: ensure docker data directory exists
-  file:
-    path: '{{ docker_repo_storage }}'
-    recurse: True
-    state: directory
-    owner: root
-    group: root
-    mode: 0755
-
-- name: check if server cert is expiring in the next 5 days
-  shell: "openssl x509 -checkend 432000 -noout -in /etc/docker-repo/certs/docker-repo.crt"
-  args:
-    executable: /bin/bash
-  failed_when: False
-  check_mode: False
-  changed_when: False
-  register: exp
-
-- name: get cert
-  shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=docker-repo.service.{{ consul_domain }} alt_names=docker-repo.service.{{ main_dc_name }}.{{ consul_domain }} ttl=43200m"
-  args:
-    executable: /bin/bash
-  environment:
-    VAULT_ADDR: https://vault.service.masked.name:8200
-    VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
-    VAULT_FORMAT: json
-  register: cert_data
-  when: exp.rc != 0
-
-- name: write cert data to server
-  copy:
-    content: "{{ item.content }}"
-    dest: "/etc/docker-repo/{{ item.path }}"
-    mode: '{{ item.mode }}'
-    owner: root
-    group: root
-  when: cert_data.changed
-  register: cert_written
-  loop:
-    - {
-        content: "{{ (cert_data.stdout | from_json).data.certificate }}",
-        path: "certs/docker-repo.crt",
-        mode: "0755"
-    }
-    - {
-        content: "{{ (cert_data.stdout | from_json).data.private_key }}",
-        path: "certs/docker-repo.key",
-        mode: "0600"
-    }
-
-- name: ensure python-docker is installed
-  apt:
-    name: python3-docker
-    state: present
-
-- name: ensure docker repo data dir exists
-  file:
-    path: "{{ docker_repo_storage }}"
-    state: directory
-    mode: 0755
-
-- name: run docker-repo
-  docker_container:
-    name: docker-repo
-    image: registry:2
-    env:
-      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/docker-repo.crt
-      REGISTRY_HTTP_TLS_KEY: /certs/docker-repo.key
-    ports:
-      - "5000:5000"
-    volumes:
-      - "{{ docker_repo_storage }}:/data"
-      - "/etc/docker-repo/certs:/certs"
-    restart_policy: always
-
-- name: ensure docker repo service config exists
-  copy:
-    src: files/docker-repo.hcl
-    dest: /etc/consul.d/docker-repo.hcl
-    mode: 0750
-    owner: consul
-    group: consul
-  notify: reload consul
-...

ansible/roles/k3s/handlers/main.yml

@@ -1,5 +0,0 @@
----
-- name: restart k3s
-  systemd:
-    name: k3s
-    state: restarted

ansible/roles/k3s/tasks/get_k3s.yml

@@ -1,10 +1,4 @@
 ---
-- name: get dependencies
-  apt:
-    name:
-      - apparmor
-      - apparmor-utils
-
 - name: check k3s version
   shell:
     cmd: "k3s --version | grep k3s | cut -d' ' -f3"
@@ -22,7 +16,6 @@
     owner: root
     group: root
   when: installed_k3s_version.stdout != k3s_version
-  notify: restart k3s
 
 - name: link k3s
   file:

ansible/roles/nexus/files/nexus.hcl

@@ -0,0 +1,24 @@
+services {
+  id = "nexus"
+  name = "nexus"
+  port = 8081
+  checks = [
+    {
+      args = ["nc", "-z", "-v", "localhost", "8081"]
+      interval = "5s"
+      timeout = "20s"
+    }
+  ]
+}
+services {
+  id = "docker"
+  name = "docker"
+  port = 8082
+  checks = [
+    {
+      args = ["nc", "-z", "-v", "localhost", "8082"]
+      interval = "5s"
+      timeout = "20s"
+    }
+  ]
+}

ansible/roles/nexus/files/nexus.properties

@@ -0,0 +1,12 @@
+# Jetty section
+application-port-ssl=8081
+application-host=0.0.0.0
+nexus-args=${jetty.etc}/jetty.xml,${jetty.etc}/jetty-https.xml,${jetty.etc}/jetty-requestlog.xml
+ssl.etc=/opt/sonatype/nexus/etc/ssl/
+# nexus-context-path=/${NEXUS_CONTEXT}
+
+# Nexus section
+# nexus-edition=nexus-pro-edition
+# nexus-features=\
+#  nexus-pro-feature
+# nexus.clustered=false

ansible/roles/nexus/handlers/main.yml

@@ -4,8 +4,8 @@
     name: consul
     state: reloaded
 
-- name: restart docker
+- name: restart nexus
   docker_container:
-    name: docker-repo
-    image:  registry:2
+    name: nexus
+    image:  sonatype/nexus3
     restart: True

ansible/roles/nexus/tasks/main.yml

@@ -0,0 +1,143 @@
+---
+- name: ensure pexpect exists
+  pip:
+    name: pexpect
+    state: present
+
+- name: check if server cert is expiring in the next 5 days
+  shell: "openssl x509 -checkend 432000 -noout -in /etc/pki/certs/nexus.crt"
+  args:
+    executable: /bin/bash
+  failed_when: False
+  check_mode: False
+  changed_when: False
+  register: exp
+
+- name: get cert
+  shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=nexus.service.{{ consul_domain }} alt_names=nexus.service.{{ main_dc_name }}.{{ consul_domain }},docker.service.{{ consul_domain }},docker.service.{{ main_dc_name }}.{{ consul_domain }} ttl=43200m"
+  args:
+    executable: /bin/bash
+  environment:
+    VAULT_ADDR: https://vault.service.masked.name:8200
+    VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
+    VAULT_FORMAT: json
+  register: cert_data
+  when: exp.rc != 0
+
+- name: write cert data to server
+  copy:
+    content: "{{ item.content }}"
+    dest: "/etc/pki/{{ item.path }}"
+    mode: '{{ item.mode }}'
+    owner: root
+    group: root
+  when: cert_data.changed
+  register: cert_written
+  loop:
+    - {
+        content: "{{ (cert_data.stdout | from_json).data.certificate }}",
+        path: "certs/nexus.crt",
+        mode: "0755"
+    }
+    - {
+        content: "{{ (cert_data.stdout | from_json).data.private_key }}",
+        path: "keys/nexus.key",
+        mode: "0600"
+    }
+
+# I hate this
+- name: create cert for keystore
+  shell: for i in nexus.crt MaskedName_Root_CA.pem; do (cat "/etc/pki/certs/${i}"; echo) >> /tmp/keystore.crt; done
+  args:
+    executable: /bin/bash
+  when: cert_written.changed
+
+- name: write keystore
+  expect:
+    command: "openssl pkcs12 -inkey /etc/pki/keys/nexus.key -in /tmp/keystore.crt -export -out {{ nexus_config_dir }}/etc/ssl/keystore.jks"
+    responses:
+      Enter Export Password:
+        - password
+      Verifying - Enter Export Password:
+        - password
+  when: cert_written.changed
+  notify: restart nexus
+
+- name: remove tmp keystore
+  file:
+    path: /tmp/keystore.crt
+    state: absent
+  when: cert_written.changed
+
+- name: ensure python-docker is installed
+  apt:
+    name: python3-docker
+    state: present
+
+- name: ensure nexus group exists
+  group:
+    name: nexus
+    state: present
+    gid: 200
+
+- name: ensure nexus user exists
+  user:
+    name: nexus
+    group: nexus
+    uid: 200
+    create_home: False
+
+- name: ensure nexus data dir exists
+  file:
+    path: "{{ nexus_storage }}"
+    state: directory
+    owner: nexus
+    group: nexus
+    mode: 0755
+
+- name: ensure nexus data dir exists
+  file:
+    path: "{{ nexus_config_dir }}"
+    state: directory
+    owner: nexus
+    group: nexus
+    mode: 0755
+
+- name: ensure nexus keystore dir exists
+  file:
+    path: "{{ nexus_config_dir }}/etc/ssl/"
+    state: directory
+    owner: nexus
+    group: nexus
+    mode: 0755
+
+- name: copy nexus.properties
+  copy:
+    src: files/nexus.properties
+    dest: "{{ nexus_storage }}/etc/nexus.properties"
+
+- name: run nexus3
+  docker_container:
+    name: nexus
+    image:  sonatype/nexus3:latest
+    env:
+      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/nexus.crt
+      REGISTRY_HTTP_TLS_KEY: /certs/nexus.key
+      REGISTRY_HTTP_SECRET: "{{ lookup('hashi_vault', 'secret=kv/data/nexus:data')['REGISTRY_HTTP_SECRET'] }}"
+    ports:
+      - "8081:8081"
+      - "8082:8082"
+    volumes:
+      - "{{ nexus_storage }}:/nexus-data"
+      - "{{ nexus_config_dir }}/etc/ssl:/opt/sonatype/nexus/etc/ssl/"
+    restart_policy: always
+
+- name: ensure nexus consul service config exists
+  copy:
+    src: files/nexus.hcl
+    dest: /etc/consul.d/nexus.hcl
+    mode: 0750
+    owner: consul
+    group: consul
+  notify: reload consul
+...

ansible/roles/nomad_client/tasks/main.yml

@@ -1,4 +1,5 @@
 ---
+- import_tasks: podman.yml
 - import_tasks: nomad.yml
 - import_tasks: client_setup.yml
 ...

docker/nextcloud/Dockerfile

@@ -1,4 +1,4 @@
-FROM nextcloud:24.0-apache
+FROM nextcloud:23.0-apache
 
 # Copy masked.name root cert
 COPY files/MaskedName_Root_CA.crt /usr/local/share/ca-certificates/MaskedName_Root_CA.crt

docker/wallabag/Dockerfile

@@ -1,4 +1,4 @@
-FROM wallabag/wallabag:2.5.1
+FROM wallabag/wallabag:2.4.2
 
 # add ca-certificates package
 RUN apk add --no-cache ca-certificates

nomad/freshrss.nomad

@@ -23,7 +23,7 @@ job "freshrss" {
       }
       driver = "docker"
       config {
-        image   = "docker-repo.service.masked.name:5000/freshrss"
+        image   = "docker.service.masked.name:8082/freshrss"
         ports   = ["http"]
         volumes = [
             "/mnt/raid/rss:/var/www/FreshRSS/data"

nomad/gitea.nomad

@@ -23,7 +23,7 @@ job "gitea" {
       }
       driver = "docker"
       config {
-        image   = "docker-repo.service.masked.name:5000/gitea:latest"
+        image   = "docker.service.masked.name:8082/gitea:latest"
         ports   = ["http"]
         volumes = [
             "/mnt/raid/gitea:/data"

nomad/nextcloud.nomad

@@ -23,7 +23,7 @@ job "nextcloud" {
       }
       driver = "docker"
       config {
-        image   = "docker-repo.service.masked.name:5000/nextcloud:latest"
+        image   = "docker.service.masked.name:8082/nextcloud:latest"
         ports   = ["nextcloud"]
         volumes = [
             "/mnt/raid/nextcloud/:/var/www/html"

nomad/sudoscientist-go-backend.nomad

@@ -24,7 +24,7 @@ job "sudoscientist-go-backend" {
       }
       driver = "docker"
       config {
-        image   = "docker-repo.service.masked.name:5000/sudoscientist-go-backend"
+        image   = "docker.service.masked.name:8082/sudoscientist-go-backend"
         ports   = ["http"]
       }
 

nomad/wallabag.nomad

@@ -18,7 +18,7 @@ job "wallabag" {
       }
       driver = "docker"
       config {
-        image   = "docker-repo.service.masked.name:5000/wallabag"
+        image   = "docker.service.masked.name:8082/wallabag"
         ports   = ["http"]
       }