Compare commits
No commits in common. "3ba4ec5dadf3398cdff9b50fb18347f57c70eeb1" and "1e45532183c06148fab264eb9da133602c1e6cab" have entirely different histories.
3ba4ec5dad
...
1e45532183
24 changed files with 204 additions and 144 deletions
|
@ -7,11 +7,11 @@ admin_email_address: amarpreet@minhas.io
|
||||||
hashi_arch: amd64
|
hashi_arch: amd64
|
||||||
|
|
||||||
# consul
|
# consul
|
||||||
consul_version: 1.12.2
|
consul_version: 1.10.1
|
||||||
consul_domain: masked.name
|
consul_domain: masked.name
|
||||||
|
|
||||||
# vault
|
# vault
|
||||||
vault_version: 1.10.4
|
vault_version: 1.8.1
|
||||||
vault_pki_policy: masked-dot-name
|
vault_pki_policy: masked-dot-name
|
||||||
vault_ca_cert_name: MaskedName_Root_CA.crt
|
vault_ca_cert_name: MaskedName_Root_CA.crt
|
||||||
vault_ca_cert_payload: |
|
vault_ca_cert_payload: |
|
||||||
|
@ -60,12 +60,12 @@ vault_ca_cert_payload: |
|
||||||
-----END CERTIFICATE-----
|
-----END CERTIFICATE-----
|
||||||
|
|
||||||
# nomad
|
# nomad
|
||||||
nomad_version: 1.3.1
|
nomad_version: 1.1.3
|
||||||
nomad_podman_driver_version: 0.3.0
|
nomad_podman_driver_version: 0.3.0
|
||||||
|
|
||||||
# lnd
|
# lnd
|
||||||
lnd_version: 0.15.0-beta
|
lnd_version: 0.14.2-beta
|
||||||
|
|
||||||
# lego
|
# lego
|
||||||
lego_version: 4.7.0
|
lego_version: 4.4.0
|
||||||
...
|
...
|
||||||
|
|
|
@ -3,5 +3,5 @@ hashi_arch: arm
|
||||||
consul_arch: arm64
|
consul_arch: arm64
|
||||||
nomad_arch: arm64
|
nomad_arch: arm64
|
||||||
docker_arch: arm64
|
docker_arch: arm64
|
||||||
k3s_version: v1.24.1+k3s1
|
k3s_version: v1.23.4+k3s1
|
||||||
k3s_role: 'client'
|
k3s_role: 'client'
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
hashi_arch: arm
|
hashi_arch: arm
|
||||||
consul_arch: arm
|
consul_arch: armhfv6
|
||||||
lnd_arch: armv7
|
lnd_arch: armv7
|
||||||
|
|
||||||
bitcoind_disk: /dev/sda1
|
bitcoind_disk: /dev/sda1
|
||||||
|
|
|
@ -23,7 +23,7 @@ hardtack[1:7].minhas.io
|
||||||
[lnd]
|
[lnd]
|
||||||
redwingcherokee.minhas.io
|
redwingcherokee.minhas.io
|
||||||
|
|
||||||
[docker-repo]
|
[nexus]
|
||||||
ivyking.minhas.io
|
ivyking.minhas.io
|
||||||
|
|
||||||
[nomad_client]
|
[nomad_client]
|
||||||
|
|
|
@ -1,5 +0,0 @@
|
||||||
---
|
|
||||||
- hosts: docker-repo
|
|
||||||
roles:
|
|
||||||
- role: docker-repo
|
|
||||||
...
|
|
5
ansible/playbooks/nexus.yml
Normal file
5
ansible/playbooks/nexus.yml
Normal file
|
@ -0,0 +1,5 @@
|
||||||
|
---
|
||||||
|
- hosts: nexus
|
||||||
|
roles:
|
||||||
|
- role: nexus
|
||||||
|
...
|
|
@ -6,7 +6,7 @@
|
||||||
- import_playbook: docker.yml
|
- import_playbook: docker.yml
|
||||||
- import_playbook: nomad.yml
|
- import_playbook: nomad.yml
|
||||||
- import_playbook: k3s.yml
|
- import_playbook: k3s.yml
|
||||||
- import_playbook: docker-repo.yml
|
- import_playbook: nexus.yml
|
||||||
- import_playbook: lnd.yml
|
- import_playbook: lnd.yml
|
||||||
- import_playbook: wekan.yml
|
- import_playbook: wekan.yml
|
||||||
- import_playbook: haproxy.yml
|
- import_playbook: haproxy.yml
|
||||||
|
|
|
@ -1,2 +0,0 @@
|
||||||
---
|
|
||||||
docker_repo_storage: /mnt/raid/docker-repo
|
|
|
@ -1,12 +0,0 @@
|
||||||
services {
|
|
||||||
id = "docker-repo"
|
|
||||||
name = "docker-repo"
|
|
||||||
port = 5000
|
|
||||||
checks = [
|
|
||||||
{
|
|
||||||
args = ["nc", "-z", "-v", "localhost", "5000"]
|
|
||||||
interval = "5s"
|
|
||||||
timeout = "20s"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
|
@ -1,94 +0,0 @@
|
||||||
---
|
|
||||||
- name: ensure docker repo cert directory exists
|
|
||||||
file:
|
|
||||||
path: /etc/docker-repo/certs
|
|
||||||
recurse: True
|
|
||||||
state: directory
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: 0755
|
|
||||||
|
|
||||||
- name: ensure docker data directory exists
|
|
||||||
file:
|
|
||||||
path: '{{ docker_repo_storage }}'
|
|
||||||
recurse: True
|
|
||||||
state: directory
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: 0755
|
|
||||||
|
|
||||||
- name: check if server cert is expiring in the next 5 days
|
|
||||||
shell: "openssl x509 -checkend 432000 -noout -in /etc/docker-repo/certs/docker-repo.crt"
|
|
||||||
args:
|
|
||||||
executable: /bin/bash
|
|
||||||
failed_when: False
|
|
||||||
check_mode: False
|
|
||||||
changed_when: False
|
|
||||||
register: exp
|
|
||||||
|
|
||||||
- name: get cert
|
|
||||||
shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=docker-repo.service.{{ consul_domain }} alt_names=docker-repo.service.{{ main_dc_name }}.{{ consul_domain }} ttl=43200m"
|
|
||||||
args:
|
|
||||||
executable: /bin/bash
|
|
||||||
environment:
|
|
||||||
VAULT_ADDR: https://vault.service.masked.name:8200
|
|
||||||
VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
|
|
||||||
VAULT_FORMAT: json
|
|
||||||
register: cert_data
|
|
||||||
when: exp.rc != 0
|
|
||||||
|
|
||||||
- name: write cert data to server
|
|
||||||
copy:
|
|
||||||
content: "{{ item.content }}"
|
|
||||||
dest: "/etc/docker-repo/{{ item.path }}"
|
|
||||||
mode: '{{ item.mode }}'
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
when: cert_data.changed
|
|
||||||
register: cert_written
|
|
||||||
loop:
|
|
||||||
- {
|
|
||||||
content: "{{ (cert_data.stdout | from_json).data.certificate }}",
|
|
||||||
path: "certs/docker-repo.crt",
|
|
||||||
mode: "0755"
|
|
||||||
}
|
|
||||||
- {
|
|
||||||
content: "{{ (cert_data.stdout | from_json).data.private_key }}",
|
|
||||||
path: "certs/docker-repo.key",
|
|
||||||
mode: "0600"
|
|
||||||
}
|
|
||||||
|
|
||||||
- name: ensure python-docker is installed
|
|
||||||
apt:
|
|
||||||
name: python3-docker
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: ensure docker repo data dir exists
|
|
||||||
file:
|
|
||||||
path: "{{ docker_repo_storage }}"
|
|
||||||
state: directory
|
|
||||||
mode: 0755
|
|
||||||
|
|
||||||
- name: run docker-repo
|
|
||||||
docker_container:
|
|
||||||
name: docker-repo
|
|
||||||
image: registry:2
|
|
||||||
env:
|
|
||||||
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/docker-repo.crt
|
|
||||||
REGISTRY_HTTP_TLS_KEY: /certs/docker-repo.key
|
|
||||||
ports:
|
|
||||||
- "5000:5000"
|
|
||||||
volumes:
|
|
||||||
- "{{ docker_repo_storage }}:/data"
|
|
||||||
- "/etc/docker-repo/certs:/certs"
|
|
||||||
restart_policy: always
|
|
||||||
|
|
||||||
- name: ensure docker repo service config exists
|
|
||||||
copy:
|
|
||||||
src: files/docker-repo.hcl
|
|
||||||
dest: /etc/consul.d/docker-repo.hcl
|
|
||||||
mode: 0750
|
|
||||||
owner: consul
|
|
||||||
group: consul
|
|
||||||
notify: reload consul
|
|
||||||
...
|
|
|
@ -1,5 +0,0 @@
|
||||||
---
|
|
||||||
- name: restart k3s
|
|
||||||
systemd:
|
|
||||||
name: k3s
|
|
||||||
state: restarted
|
|
|
@ -1,10 +1,4 @@
|
||||||
---
|
---
|
||||||
- name: get dependencies
|
|
||||||
apt:
|
|
||||||
name:
|
|
||||||
- apparmor
|
|
||||||
- apparmor-utils
|
|
||||||
|
|
||||||
- name: check k3s version
|
- name: check k3s version
|
||||||
shell:
|
shell:
|
||||||
cmd: "k3s --version | grep k3s | cut -d' ' -f3"
|
cmd: "k3s --version | grep k3s | cut -d' ' -f3"
|
||||||
|
@ -22,7 +16,6 @@
|
||||||
owner: root
|
owner: root
|
||||||
group: root
|
group: root
|
||||||
when: installed_k3s_version.stdout != k3s_version
|
when: installed_k3s_version.stdout != k3s_version
|
||||||
notify: restart k3s
|
|
||||||
|
|
||||||
- name: link k3s
|
- name: link k3s
|
||||||
file:
|
file:
|
||||||
|
|
24
ansible/roles/nexus/files/nexus.hcl
Normal file
24
ansible/roles/nexus/files/nexus.hcl
Normal file
|
@ -0,0 +1,24 @@
|
||||||
|
services {
|
||||||
|
id = "nexus"
|
||||||
|
name = "nexus"
|
||||||
|
port = 8081
|
||||||
|
checks = [
|
||||||
|
{
|
||||||
|
args = ["nc", "-z", "-v", "localhost", "8081"]
|
||||||
|
interval = "5s"
|
||||||
|
timeout = "20s"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
services {
|
||||||
|
id = "docker"
|
||||||
|
name = "docker"
|
||||||
|
port = 8082
|
||||||
|
checks = [
|
||||||
|
{
|
||||||
|
args = ["nc", "-z", "-v", "localhost", "8082"]
|
||||||
|
interval = "5s"
|
||||||
|
timeout = "20s"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
12
ansible/roles/nexus/files/nexus.properties
Normal file
12
ansible/roles/nexus/files/nexus.properties
Normal file
|
@ -0,0 +1,12 @@
|
||||||
|
# Jetty section
|
||||||
|
application-port-ssl=8081
|
||||||
|
application-host=0.0.0.0
|
||||||
|
nexus-args=${jetty.etc}/jetty.xml,${jetty.etc}/jetty-https.xml,${jetty.etc}/jetty-requestlog.xml
|
||||||
|
ssl.etc=/opt/sonatype/nexus/etc/ssl/
|
||||||
|
# nexus-context-path=/${NEXUS_CONTEXT}
|
||||||
|
|
||||||
|
# Nexus section
|
||||||
|
# nexus-edition=nexus-pro-edition
|
||||||
|
# nexus-features=\
|
||||||
|
# nexus-pro-feature
|
||||||
|
# nexus.clustered=false
|
|
@ -4,8 +4,8 @@
|
||||||
name: consul
|
name: consul
|
||||||
state: reloaded
|
state: reloaded
|
||||||
|
|
||||||
- name: restart docker
|
- name: restart nexus
|
||||||
docker_container:
|
docker_container:
|
||||||
name: docker-repo
|
name: nexus
|
||||||
image: registry:2
|
image: sonatype/nexus3
|
||||||
restart: True
|
restart: True
|
143
ansible/roles/nexus/tasks/main.yml
Normal file
143
ansible/roles/nexus/tasks/main.yml
Normal file
|
@ -0,0 +1,143 @@
|
||||||
|
---
|
||||||
|
- name: ensure pexpect exists
|
||||||
|
pip:
|
||||||
|
name: pexpect
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: check if server cert is expiring in the next 5 days
|
||||||
|
shell: "openssl x509 -checkend 432000 -noout -in /etc/pki/certs/nexus.crt"
|
||||||
|
args:
|
||||||
|
executable: /bin/bash
|
||||||
|
failed_when: False
|
||||||
|
check_mode: False
|
||||||
|
changed_when: False
|
||||||
|
register: exp
|
||||||
|
|
||||||
|
- name: get cert
|
||||||
|
shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=nexus.service.{{ consul_domain }} alt_names=nexus.service.{{ main_dc_name }}.{{ consul_domain }},docker.service.{{ consul_domain }},docker.service.{{ main_dc_name }}.{{ consul_domain }} ttl=43200m"
|
||||||
|
args:
|
||||||
|
executable: /bin/bash
|
||||||
|
environment:
|
||||||
|
VAULT_ADDR: https://vault.service.masked.name:8200
|
||||||
|
VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
|
||||||
|
VAULT_FORMAT: json
|
||||||
|
register: cert_data
|
||||||
|
when: exp.rc != 0
|
||||||
|
|
||||||
|
- name: write cert data to server
|
||||||
|
copy:
|
||||||
|
content: "{{ item.content }}"
|
||||||
|
dest: "/etc/pki/{{ item.path }}"
|
||||||
|
mode: '{{ item.mode }}'
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
when: cert_data.changed
|
||||||
|
register: cert_written
|
||||||
|
loop:
|
||||||
|
- {
|
||||||
|
content: "{{ (cert_data.stdout | from_json).data.certificate }}",
|
||||||
|
path: "certs/nexus.crt",
|
||||||
|
mode: "0755"
|
||||||
|
}
|
||||||
|
- {
|
||||||
|
content: "{{ (cert_data.stdout | from_json).data.private_key }}",
|
||||||
|
path: "keys/nexus.key",
|
||||||
|
mode: "0600"
|
||||||
|
}
|
||||||
|
|
||||||
|
# I hate this
|
||||||
|
- name: create cert for keystore
|
||||||
|
shell: for i in nexus.crt MaskedName_Root_CA.pem; do (cat "/etc/pki/certs/${i}"; echo) >> /tmp/keystore.crt; done
|
||||||
|
args:
|
||||||
|
executable: /bin/bash
|
||||||
|
when: cert_written.changed
|
||||||
|
|
||||||
|
- name: write keystore
|
||||||
|
expect:
|
||||||
|
command: "openssl pkcs12 -inkey /etc/pki/keys/nexus.key -in /tmp/keystore.crt -export -out {{ nexus_config_dir }}/etc/ssl/keystore.jks"
|
||||||
|
responses:
|
||||||
|
Enter Export Password:
|
||||||
|
- password
|
||||||
|
Verifying - Enter Export Password:
|
||||||
|
- password
|
||||||
|
when: cert_written.changed
|
||||||
|
notify: restart nexus
|
||||||
|
|
||||||
|
- name: remove tmp keystore
|
||||||
|
file:
|
||||||
|
path: /tmp/keystore.crt
|
||||||
|
state: absent
|
||||||
|
when: cert_written.changed
|
||||||
|
|
||||||
|
- name: ensure python-docker is installed
|
||||||
|
apt:
|
||||||
|
name: python3-docker
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: ensure nexus group exists
|
||||||
|
group:
|
||||||
|
name: nexus
|
||||||
|
state: present
|
||||||
|
gid: 200
|
||||||
|
|
||||||
|
- name: ensure nexus user exists
|
||||||
|
user:
|
||||||
|
name: nexus
|
||||||
|
group: nexus
|
||||||
|
uid: 200
|
||||||
|
create_home: False
|
||||||
|
|
||||||
|
- name: ensure nexus data dir exists
|
||||||
|
file:
|
||||||
|
path: "{{ nexus_storage }}"
|
||||||
|
state: directory
|
||||||
|
owner: nexus
|
||||||
|
group: nexus
|
||||||
|
mode: 0755
|
||||||
|
|
||||||
|
- name: ensure nexus data dir exists
|
||||||
|
file:
|
||||||
|
path: "{{ nexus_config_dir }}"
|
||||||
|
state: directory
|
||||||
|
owner: nexus
|
||||||
|
group: nexus
|
||||||
|
mode: 0755
|
||||||
|
|
||||||
|
- name: ensure nexus keystore dir exists
|
||||||
|
file:
|
||||||
|
path: "{{ nexus_config_dir }}/etc/ssl/"
|
||||||
|
state: directory
|
||||||
|
owner: nexus
|
||||||
|
group: nexus
|
||||||
|
mode: 0755
|
||||||
|
|
||||||
|
- name: copy nexus.properties
|
||||||
|
copy:
|
||||||
|
src: files/nexus.properties
|
||||||
|
dest: "{{ nexus_storage }}/etc/nexus.properties"
|
||||||
|
|
||||||
|
- name: run nexus3
|
||||||
|
docker_container:
|
||||||
|
name: nexus
|
||||||
|
image: sonatype/nexus3:latest
|
||||||
|
env:
|
||||||
|
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/nexus.crt
|
||||||
|
REGISTRY_HTTP_TLS_KEY: /certs/nexus.key
|
||||||
|
REGISTRY_HTTP_SECRET: "{{ lookup('hashi_vault', 'secret=kv/data/nexus:data')['REGISTRY_HTTP_SECRET'] }}"
|
||||||
|
ports:
|
||||||
|
- "8081:8081"
|
||||||
|
- "8082:8082"
|
||||||
|
volumes:
|
||||||
|
- "{{ nexus_storage }}:/nexus-data"
|
||||||
|
- "{{ nexus_config_dir }}/etc/ssl:/opt/sonatype/nexus/etc/ssl/"
|
||||||
|
restart_policy: always
|
||||||
|
|
||||||
|
- name: ensure nexus consul service config exists
|
||||||
|
copy:
|
||||||
|
src: files/nexus.hcl
|
||||||
|
dest: /etc/consul.d/nexus.hcl
|
||||||
|
mode: 0750
|
||||||
|
owner: consul
|
||||||
|
group: consul
|
||||||
|
notify: reload consul
|
||||||
|
...
|
|
@ -1,4 +1,5 @@
|
||||||
---
|
---
|
||||||
|
- import_tasks: podman.yml
|
||||||
- import_tasks: nomad.yml
|
- import_tasks: nomad.yml
|
||||||
- import_tasks: client_setup.yml
|
- import_tasks: client_setup.yml
|
||||||
...
|
...
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
FROM nextcloud:24.0-apache
|
FROM nextcloud:23.0-apache
|
||||||
|
|
||||||
# Copy masked.name root cert
|
# Copy masked.name root cert
|
||||||
COPY files/MaskedName_Root_CA.crt /usr/local/share/ca-certificates/MaskedName_Root_CA.crt
|
COPY files/MaskedName_Root_CA.crt /usr/local/share/ca-certificates/MaskedName_Root_CA.crt
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
FROM wallabag/wallabag:2.5.1
|
FROM wallabag/wallabag:2.4.2
|
||||||
|
|
||||||
# add ca-certificates package
|
# add ca-certificates package
|
||||||
RUN apk add --no-cache ca-certificates
|
RUN apk add --no-cache ca-certificates
|
||||||
|
|
|
@ -23,7 +23,7 @@ job "freshrss" {
|
||||||
}
|
}
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
config {
|
config {
|
||||||
image = "docker-repo.service.masked.name:5000/freshrss"
|
image = "docker.service.masked.name:8082/freshrss"
|
||||||
ports = ["http"]
|
ports = ["http"]
|
||||||
volumes = [
|
volumes = [
|
||||||
"/mnt/raid/rss:/var/www/FreshRSS/data"
|
"/mnt/raid/rss:/var/www/FreshRSS/data"
|
||||||
|
|
|
@ -23,7 +23,7 @@ job "gitea" {
|
||||||
}
|
}
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
config {
|
config {
|
||||||
image = "docker-repo.service.masked.name:5000/gitea:latest"
|
image = "docker.service.masked.name:8082/gitea:latest"
|
||||||
ports = ["http"]
|
ports = ["http"]
|
||||||
volumes = [
|
volumes = [
|
||||||
"/mnt/raid/gitea:/data"
|
"/mnt/raid/gitea:/data"
|
||||||
|
|
|
@ -23,7 +23,7 @@ job "nextcloud" {
|
||||||
}
|
}
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
config {
|
config {
|
||||||
image = "docker-repo.service.masked.name:5000/nextcloud:latest"
|
image = "docker.service.masked.name:8082/nextcloud:latest"
|
||||||
ports = ["nextcloud"]
|
ports = ["nextcloud"]
|
||||||
volumes = [
|
volumes = [
|
||||||
"/mnt/raid/nextcloud/:/var/www/html"
|
"/mnt/raid/nextcloud/:/var/www/html"
|
||||||
|
|
|
@ -24,7 +24,7 @@ job "sudoscientist-go-backend" {
|
||||||
}
|
}
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
config {
|
config {
|
||||||
image = "docker-repo.service.masked.name:5000/sudoscientist-go-backend"
|
image = "docker.service.masked.name:8082/sudoscientist-go-backend"
|
||||||
ports = ["http"]
|
ports = ["http"]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -18,7 +18,7 @@ job "wallabag" {
|
||||||
}
|
}
|
||||||
driver = "docker"
|
driver = "docker"
|
||||||
config {
|
config {
|
||||||
image = "docker-repo.service.masked.name:5000/wallabag"
|
image = "docker.service.masked.name:8082/wallabag"
|
||||||
ports = ["http"]
|
ports = ["http"]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue