mirror of
https://github.com/MatteZ02/infra.git
synced 2025-07-02 01:03:37 +00:00
Initial Commit
This commit is contained in:
Christer Warén
152
tasks/deployer.yml
Normal file
152
tasks/deployer.yml
Normal file
@ -0,0 +1,152 @@
|
||||
---
|
||||
- name: "Deployer - Certbot - Renew Certificates"
|
||||
command: "certbot renew"
|
||||
register: task
|
||||
changed_when: task.stdout.find("No renewals were attempted.") == -1
|
||||
tags:
|
||||
- certbot
|
||||
- tls
|
||||
|
||||
- name: "Deployer - Certbot - Copy Certificates"
|
||||
copy:
|
||||
src: "/etc/letsencrypt/live/mkj/"
|
||||
dest: "/root/certs/mkj/"
|
||||
follow: true
|
||||
register: task
|
||||
tags:
|
||||
- certbot
|
||||
- tls
|
||||
|
||||
- name: "Deployer - MariaDB - Pull Image"
|
||||
containers.podman.podman_image:
|
||||
name: docker.io/mariadb
|
||||
tag: latest
|
||||
force: on
|
||||
register: deployerTask101
|
||||
|
||||
- name: "Deployer - MariaDB - Run Container"
|
||||
containers.podman.podman_container:
|
||||
name: mariadb
|
||||
image: docker.io/mariadb:latest
|
||||
state: started
|
||||
restart: on
|
||||
network: host
|
||||
volumes:
|
||||
- "/root/mariadb:/var/lib/mysql"
|
||||
restart_policy: always
|
||||
env:
|
||||
MYSQL_ROOT_PASSWORD: "{{ secrets.mariadb.root.password }}"
|
||||
register: deployerTask102
|
||||
when:
|
||||
- (deployerTask101 is defined and deployerTask101.changed) or deployerTask101 is undefined
|
||||
tags:
|
||||
- mariadb
|
||||
|
||||
- name: "Deployer - MariaDB - Wait"
|
||||
wait_for:
|
||||
host: "127.0.0.1"
|
||||
port: "3306"
|
||||
delay: 10
|
||||
when:
|
||||
- (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
|
||||
tags:
|
||||
- mariadb
|
||||
|
||||
- name: "Deployer - MariaDB - Upgrade"
|
||||
containers.podman.podman_container_exec:
|
||||
name: mariadb
|
||||
command: "mariadb-upgrade --host=127.0.0.1 --user=root --password={{ secrets.mariadb.root.password }}"
|
||||
register: task
|
||||
ignore_errors: yes
|
||||
changed_when:
|
||||
- task.stdout is defined
|
||||
- task.stdout.find("This installation of MariaDB is already upgraded") == -1
|
||||
when:
|
||||
- (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
|
||||
tags:
|
||||
- mariadb
|
||||
|
||||
- name: "Deployer - MariaDB - Create Users"
|
||||
mysql_user:
|
||||
login_host: "127.0.0.1"
|
||||
login_user: root
|
||||
login_password: "{{ secrets.mariadb.root.password }}"
|
||||
name: "mkj"
|
||||
host: "%"
|
||||
password: "{{ secrets.mariadb.mkj.password }}"
|
||||
priv: "mkj.*:ALL"
|
||||
vars:
|
||||
ansible_python_interpreter: "/opt/ansible/bin/python3"
|
||||
when:
|
||||
- (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
|
||||
tags:
|
||||
- mariadb
|
||||
|
||||
- name: "Deployer - MariaDB - Create Database"
|
||||
mysql_db:
|
||||
login_host: "127.0.0.1"
|
||||
login_user: "mkj"
|
||||
login_password: "{{ secrets.mariadb.mkj.password }}"
|
||||
name: "mkj"
|
||||
vars:
|
||||
ansible_python_interpreter: "/opt/ansible/bin/python3"
|
||||
when:
|
||||
- (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
|
||||
tags:
|
||||
- mariadb
|
||||
|
||||
- name: "Deployer - Nginx - Configure - Create Folder"
|
||||
file:
|
||||
path: "/root/nginx/"
|
||||
state: directory
|
||||
tags:
|
||||
- nginx
|
||||
|
||||
- name: "Deployer - Nginx - Configure - Create Subfolders"
|
||||
file:
|
||||
dest: '/root/nginx/{{ item.path }}'
|
||||
state: directory
|
||||
with_filetree: './files/nginx/'
|
||||
loop_control:
|
||||
label: "{{ item.path }}"
|
||||
when:
|
||||
- item.state == 'directory'
|
||||
tags:
|
||||
- nginx
|
||||
|
||||
- name: "Deployer - Nginx - Configure - Generating & Transferring Files"
|
||||
template:
|
||||
src: '{{ item.src }}'
|
||||
dest: '/root/nginx/{{ item.path }}'
|
||||
with_filetree: './files/nginx/'
|
||||
loop_control:
|
||||
label: "{{ item.path }}"
|
||||
when:
|
||||
- item.state == 'file'
|
||||
tags:
|
||||
- nginx
|
||||
|
||||
- name: "Deployer - Nginx - Pull Image"
|
||||
containers.podman.podman_image:
|
||||
name: docker.io/nginx
|
||||
tag: latest
|
||||
force: on
|
||||
register: deployerTask3
|
||||
|
||||
- name: "Deployer - Nginx - Run Container"
|
||||
containers.podman.podman_container:
|
||||
name: nginx
|
||||
image: docker.io/nginx
|
||||
state: started
|
||||
recreate: on
|
||||
network: host
|
||||
volumes:
|
||||
- "/root/nginx/html:/usr/share/nginx/html:ro"
|
||||
- "/root/nginx/config.conf:/etc/nginx/nginx.conf:ro"
|
||||
- "/root/nginx/conf/:/etc/nginx/conf.d/:ro"
|
||||
- "/root/certs/:/etc/nginx/certs/:ro"
|
||||
restart_policy: always
|
||||
when:
|
||||
- (deployerTask3 is defined and deployerTask3.changed) or deployerTask3 is undefined
|
||||
tags:
|
||||
- nginx
|
||||
184
tasks/installer.yml
Normal file
184
tasks/installer.yml
Normal file
@ -0,0 +1,184 @@
|
||||
---
|
||||
- name: "Installer - Ansible - Python Library"
|
||||
pip:
|
||||
name: ansible
|
||||
state: latest
|
||||
extra_args: --upgrade
|
||||
virtualenv: /opt/ansible
|
||||
virtualenv_command: "python3 -m venv"
|
||||
tags:
|
||||
- ansible
|
||||
|
||||
- name: "Installer - Ansible - Create Symbolic Links"
|
||||
ansible.builtin.file:
|
||||
src: /opt/ansible/bin/{{ binary }}
|
||||
dest: /usr/bin/{{ binary }}
|
||||
state: link
|
||||
vars:
|
||||
binaries:
|
||||
- ansible
|
||||
- ansible-community
|
||||
- ansible-config
|
||||
- ansible-connection
|
||||
- ansible-console
|
||||
- ansible-doc
|
||||
- ansible-galaxy
|
||||
- ansible-inventory
|
||||
- ansible-playbook
|
||||
- ansible-pull
|
||||
- ansible-test
|
||||
- ansible-vault
|
||||
loop: "{{ binaries }}"
|
||||
loop_control:
|
||||
label: "{{ binary }}"
|
||||
loop_var: "binary"
|
||||
tags:
|
||||
- ansible
|
||||
|
||||
- name: "Installer - Ansible - Dependencies / Python Library : hvac"
|
||||
pip:
|
||||
name: hvac
|
||||
state: latest
|
||||
extra_args: --upgrade
|
||||
virtualenv: /opt/ansible
|
||||
virtualenv_command: "python3 -m venv"
|
||||
tags:
|
||||
- ansible
|
||||
|
||||
- name: "Installer - Ansible - Dependencies / Python Library : netaddr"
|
||||
pip:
|
||||
name: netaddr
|
||||
state: latest
|
||||
extra_args: --upgrade
|
||||
virtualenv: /opt/ansible
|
||||
virtualenv_command: "python3 -m venv"
|
||||
tags:
|
||||
- ansible
|
||||
|
||||
- name: "Installer - Ansible - Dependencies / Python Library : jmespath"
|
||||
pip:
|
||||
name: jmespath
|
||||
state: latest
|
||||
extra_args: --upgrade
|
||||
virtualenv: /opt/ansible
|
||||
virtualenv_command: "python3 -m venv"
|
||||
tags:
|
||||
- ansible
|
||||
|
||||
- name: "Installer - Ansible - Dependencies / Python Library : pexpect"
|
||||
pip:
|
||||
name: pexpect
|
||||
state: latest
|
||||
extra_args: --upgrade
|
||||
virtualenv: /opt/ansible
|
||||
virtualenv_command: "python3 -m venv"
|
||||
tags:
|
||||
- ansible
|
||||
|
||||
- name: "Installer - Podman"
|
||||
apt:
|
||||
name: podman
|
||||
state: latest
|
||||
tags:
|
||||
- podman
|
||||
|
||||
- name: "Installer : Podman : Configure - Subordinate Ids : Users : root"
|
||||
lineinfile:
|
||||
path: /etc/subuid
|
||||
regexp: "^root"
|
||||
line: "root:100000:65536"
|
||||
|
||||
- name: "Installer : Podman : Configure - Subordinate Ids : Groups : root"
|
||||
lineinfile:
|
||||
path: /etc/subgid
|
||||
regexp: "^root"
|
||||
line: "root:100000:65536"
|
||||
|
||||
- name: "Installer - Certbot - Python Library"
|
||||
pip:
|
||||
name: certbot
|
||||
state: latest
|
||||
extra_args: --upgrade
|
||||
virtualenv: /opt/ansible
|
||||
virtualenv_command: "python3 -m venv"
|
||||
tags:
|
||||
- certbot
|
||||
|
||||
- name: "Installer - Certbot - Create Symbolic Links"
|
||||
ansible.builtin.file:
|
||||
src: /opt/ansible/bin/{{ binary }}
|
||||
dest: /usr/bin/{{ binary }}
|
||||
state: link
|
||||
vars:
|
||||
binaries:
|
||||
- certbot
|
||||
loop: "{{ binaries }}"
|
||||
loop_control:
|
||||
label: "{{ binary }}"
|
||||
loop_var: "binary"
|
||||
tags:
|
||||
- certbot
|
||||
|
||||
- name: "Installer - Certbot - Auth Hook"
|
||||
copy:
|
||||
src: "../files/certbot/nginx.sh"
|
||||
dest: "/etc/letsencrypt/renewal-hooks/pre/nginx.sh"
|
||||
mode: '700'
|
||||
force: true
|
||||
tags:
|
||||
- certbot
|
||||
|
||||
- name: "Installer - Certbot - Create Certificates"
|
||||
command: "certbot certonly --cert-name {{ cert.name }} --manual --preferred-challenges http-01 --email {{ cert.email }} --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -n --manual-auth-hook /etc/letsencrypt/renewal-hooks/pre/nginx.sh --debug-challenges --preferred-chain='ISRG Root X1' --key-type rsa -d {{ cert.domains | join(' -d ') }}"
|
||||
register: task
|
||||
changed_when: task.stdout.find("Certificate not yet due for renewal; no action taken.") == -1
|
||||
vars:
|
||||
cert:
|
||||
name: mkj
|
||||
email: "{{ config.certbot.email }}"
|
||||
domains:
|
||||
- "{{ ansible_facts.fqdn }}"
|
||||
tags:
|
||||
- certbot
|
||||
|
||||
- name: "Installer - MariaDB - Dependencies / Python Library : pymysql"
|
||||
pip:
|
||||
name: pymysql
|
||||
state: latest
|
||||
extra_args: --upgrade
|
||||
virtualenv: /opt/ansible
|
||||
virtualenv_command: "python3 -m venv"
|
||||
tags:
|
||||
- mariadb
|
||||
|
||||
- name: "Installer - MariaDB - Dependencies / Package : mariadb-client"
|
||||
apt:
|
||||
name: "mariadb-client"
|
||||
state: latest
|
||||
when:
|
||||
- ansible_facts.distribution == "Debian" or ansible_facts.distribution == "Ubuntu" or ansible_facts.distribution == "Linux Mint"
|
||||
tags:
|
||||
- mariadb
|
||||
|
||||
- name: "Installer - Schedule - Setup"
|
||||
cron:
|
||||
name: PATH
|
||||
env: yes
|
||||
value: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||
|
||||
- name: "Installer - Schedule - Maintenance"
|
||||
cron:
|
||||
name: Maintenance
|
||||
hour: "*/3"
|
||||
minute: "0"
|
||||
job: "/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mkj-infra --accept-host-key --vault-password-file ~/.ansible/vault.yml --private-key ~/.ssh/id_rsa tasks.yml -t maintenance"
|
||||
tags:
|
||||
- cron
|
||||
|
||||
- name: "Installer - Schedule - Deployer"
|
||||
cron:
|
||||
name: Deployer
|
||||
minute: "*/5"
|
||||
job: "/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mkj-infra --accept-host-key --vault-password-file ~/.ansible/vault.yml --private-key ~/.ssh/id_rsa tasks.yml -t deployer"
|
||||
tags:
|
||||
- cron
|
||||
37
tasks/maintenance.yml
Normal file
37
tasks/maintenance.yml
Normal file
@ -0,0 +1,37 @@
|
||||
---
|
||||
- name: "Maintenance - OS Update"
|
||||
apt:
|
||||
upgrade: dist
|
||||
update_cache: yes
|
||||
|
||||
- name: "Maintenance - Ansible : Dependencies - Python Library : hvac"
|
||||
pip:
|
||||
name: hvac
|
||||
state: latest
|
||||
extra_args: --upgrade
|
||||
virtualenv: /opt/ansible
|
||||
virtualenv_command: "python3 -m venv"
|
||||
|
||||
- name: "Maintenance - Ansible : Dependencies - Python Library : netaddr"
|
||||
pip:
|
||||
name: netaddr
|
||||
state: latest
|
||||
extra_args: --upgrade
|
||||
virtualenv: /opt/ansible
|
||||
virtualenv_command: "python3 -m venv"
|
||||
|
||||
- name: "Maintenance - Ansible : Dependencies - Python Library : jmespath"
|
||||
pip:
|
||||
name: jmespath
|
||||
state: latest
|
||||
extra_args: --upgrade
|
||||
virtualenv: /opt/ansible
|
||||
virtualenv_command: "python3 -m venv"
|
||||
|
||||
- name: "Maintenance - Ansible : Dependencies - Python Library : pexpect"
|
||||
pip:
|
||||
name: pexpect
|
||||
state: latest
|
||||
extra_args: --upgrade
|
||||
virtualenv: /opt/ansible
|
||||
virtualenv_command: "python3 -m venv"
|
||||
Reference in New Issue
Block a user