Tasks Update: Adding Backup tasks

README.md

@@ -0,0 +1 @@
+# MatteZ02 - Infra

ansible.cfg

@@ -1,12 +1,12 @@
 [defaults]
-inventory = inventories/mkj
+inventory = inventories/matte
 hash_behaviour = merge
 gathering = smart
 transport = local
 display_skipped_hosts = false
 interpreter_python = auto_silent
 localhost_warning = false
-collections_path = collections
+collections_path = collections:~/.ansible/collections
 inject_facts_as_vars = false
 force_handlers = true
 action_warnings = false

files/certbot/nginx.sh

@@ -1,5 +0,0 @@
-#!/bin/bash
-
-echo -n "$CERTBOT_VALIDATION" > /root/nginx/html/.well-known/acme-challenge/$CERTBOT_TOKEN
-mkdir -p /root/nginx/html/.well-known/acme-challenge
-/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mkj-infra --accept-host-key --private-key ~/.ssh/id_rsa --vault-password-file ~/.ansible/vault.yml tasks.yml -t nginx &> /dev/null

files/nginx/conf/000-default.conf

@@ -1,84 +0,0 @@
-server {
-
-    listen  80 default_server;
-    listen  [::]:80 default_server;
-
-    server_name _;
-
-    expires off;
-    etag off;
-    if_modified_since off;
-
-    gzip on;
-    gzip_min_length 1000;
-    gzip_proxied any;
-    gzip_types *;
-    gunzip on;
-
-    location / {
-        root   /usr/share/nginx/html;
-        index  index.html index.htm;
-
-        return 301 https://$host$request_uri;
-    }
-
-    location /.well-known/acme-challenge/ {
-        root   /usr/share/nginx/html;
-        index  index.html index.htm;
-    }
-
-    if ($request_method !~ ^(GET|HEAD|POST)$ )
-    {
-       return 405;
-    }
-}
-
-server {
-
-    listen  443 ssl default_server;
-    listen  [::]:443 ssl default_server;
-
-    server_name _;
-
-    http2 on;
-
-    ssl_certificate /etc/nginx/certs/mkj/fullchain.pem;
-    ssl_certificate_key /etc/nginx/certs/mkj/privkey.pem;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES256-CCM8:DHE-RSA-AES256-CCM:ECDHE-ARIA256-GCM-SHA384:DHE-RSA-ARIA256-GCM-SHA384:ECDHE-ARIA128-GCM-SHA256:DHE-RSA-ARIA128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-CCM8:DHE-RSA-AES128-CCM';
-    ssl_prefer_server_ciphers on;
-    ssl_session_cache shared:SSL:20m;
-    ssl_session_timeout 180m;
-
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    ssl_trusted_certificate /etc/nginx/certs/mkj/chain.pem;
-
-    expires off;
-    etag off;
-    if_modified_since off;
-
-    gzip on;
-    gzip_min_length 1000;
-    gzip_proxied any;
-    gzip_types *;
-    gunzip on;
-
-    client_max_body_size 256M;
-
-    location / {
-        proxy_pass http://127.0.0.1:8080/;
-        proxy_set_header Host $http_host;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    if ($request_method !~ ^(GET|HEAD|POST|PUT|DELETE)$ )
-    {
-       return 405;
-    }
-}

files/nginx/config.conf

@@ -1,31 +0,0 @@
-user  nginx;
-worker_processes  1;
-
-error_log  /var/log/nginx/error.log error;
-pid        /var/run/nginx.pid;
-
-events {
-    worker_connections  1024;
-}
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    log_format  main  '[$time_local] $host - $remote_addr - $remote_user "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log  /var/log/nginx/access.log  main;
-
-    server_tokens off;
-
-    sendfile        off;
-    #tcp_nopush     on;
-
-    keepalive_timeout  65;
-
-    resolver 1.1.1.1;
-
-    include /etc/nginx/conf.d/*.conf;
-}

files/wordpress/conf/000-default.conf

@@ -1,29 +0,0 @@
-<VirtualHost *:8080>
-	# The ServerName directive sets the request scheme, hostname and port that
-	# the server uses to identify itself. This is used when creating
-	# redirection URLs. In the context of virtual hosts, the ServerName
-	# specifies what hostname must appear in the request's Host: header to
-	# match this virtual host. For the default virtual host (this file) this
-	# value is not decisive as it is used as a last resort host regardless.
-	# However, you must set it for any further virtual host explicitly.
-	#ServerName www.example.com
-
-	ServerAdmin webmaster@localhost
-	DocumentRoot /var/www/html
-
-	# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
-	# error, crit, alert, emerg.
-	# It is also possible to configure the loglevel for particular
-	# modules, e.g.
-	#LogLevel info ssl:warn
-
-	ErrorLog ${APACHE_LOG_DIR}/error.log
-	CustomLog ${APACHE_LOG_DIR}/access.log combined
-
-	# For most configuration files from conf-available/, which are
-	# enabled or disabled at a global level, it is possible to
-	# include a line for only one particular virtual host. For example the
-	# following line enables the CGI configuration for this host only
-	# after it has been globally disabled with "a2disconf".
-	#Include conf-available/serve-cgi-bin.conf
-</VirtualHost>

files/wordpress/conf/ports.conf

@@ -1 +0,0 @@
-Listen 8080

init.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+
+if [ ! "$BASH_VERSION" ] ; then
+    exit 1
+fi
+
+echo "
+==============================
+
+MatteZ02 - Infra
+Install Script
+
+------------------------------
+"
+
+stop () {
+
+echo "
+==============================
+"
+
+exit 1
+
+}
+
+mkdir -p ~/.ssh/keys/matte &> /dev/null
+if [[ ! -f ~/.ssh/keys/matte/infra ]]
+then
+    ssh-keygen -f ~/.ssh/keys/matte/infra -t ed25519 -N '' &> /dev/null
+fi
+
+python3 -m venv ~/.venv/ansible &> /dev/null
+~/.venv/ansible/bin/pip3 install cryptography dnspython hvac jmespath netaddr pexpect &> /dev/null
+~/.venv/ansible/bin/pip3 install ansible &> /dev/null
+
+~/.venv/ansible/bin/ansible-galaxy collection install ansible.posix containers.podman --upgrade &> /dev/null
+
+
+mkdir -p ~/.ansible &> /dev/null
+
+if [[ ! -f ~/.ansible/vault/matte.yml ]]
+then
+    echo -n "Vault Password: "
+    read PASSWORD
+    echo "$PASSWORD" > ~/.ansible/vault/matte.yml
+fi
+
+~/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/infra -d ~/.ansible/pull/matte/infra --accept-host-key --private-key ~/.ssh/keys/matte/infra --vault-password-file ~/.ansible/vault/matte.yml tasks.yml -t installer
+
+echo "
+==============================
+"

install.sh

@@ -1,51 +0,0 @@
-#!/bin/bash
-
-if [ ! "$BASH_VERSION" ] ; then
-    exit 1
-fi
-
-echo "
-==============================
-
-MKJ - Infra
-Install Script
-
-------------------------------
-"
-
-stop () {
-
-echo "
-==============================
-"
-
-exit 1
-
-}
-
-mkdir -p ~/.ssh &> /dev/null
-
-apt-get update &> /dev/null
-apt-get install -y python3-pip python3-venv jq git curl &> /dev/null
-python3 -m venv /opt/ansible &> /dev/null
-/opt/ansible/bin/pip3 install ansible hvac netaddr jmespath pexpect &> /dev/null
-
-/opt/ansible/bin/ansible-galaxy collection install -r requirements.yml --upgrade &> /dev/null
-
-mkdir -p ~/.ansible &> /dev/null
-
-if [[ ! -f ~/.ansible/vault.yml ]]
-then
-    echo -n "Vault Password: "
-    read PASSWORD
-    echo "$PASSWORD" > ~/.ansible/vault.yml
-fi
-
-ssh-keyscan github.com 1> ~/.ssh/known_hosts 2> /dev/null
-
-/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mkj-infra --accept-host-key --private-key ~/.ssh/id_rsa --vault-password-file ~/.ansible/vault.yml tasks.yml -t installer
-
-
-echo "
-==============================
-"

inventories/matte/group_vars/arcadiamc.yml

@@ -0,0 +1,6 @@
+$ANSIBLE_VAULT;1.2;AES256;matte
+62346136653335363162326162383931386537613938323936313137303431373664326165613562
+3833613232666134346465313164393265313866396438640a396463376165633535636261656161
+65666130663862303234623932643131353539623635306266663330626666383533363039653737
+3736626335343832360a373961343766633963363766393333396366343737333630636531646362
+6564

inventories/matte/host_vars/rainbow.devices.waren.io.yml

@@ -0,0 +1,6 @@
+$ANSIBLE_VAULT;1.2;AES256;matte
+65326434306632636332646164346332366430303930656231353538613062323762303131346630
+3264653933373331373638363134633562643932326333660a393065303336306162373733316634
+61333437313261393336353235323862353538386563356132393532623439383231653665323163
+3665323733306635640a353366346639346133646331653637353530653431623132343932616465
+3466

inventories/matte/hosts.yml

@@ -0,0 +1,9 @@
+---
+matte:
+  children:
+    arcadiamc:
+      hosts:
+        rainbow.devices.waren.io:
+      vars:
+        ansible_user: wxl62975
+        ansible_ssh_common_args: "-o StrictHostKeyChecking=accept-new -o LogLevel=error"

inventories/mkj/host_vars/mkj.northeurope.cloudapp.azure.com

@@ -1,53 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-66363232363931306633333430653534616464316564663262363735636564353937346163323931
-3537373061346336363038636230666634333131636465330a383863336332396562666663326262
-64356239303366666165646238633236663137363265356263646537313764313530663566353035
-6266663030616234650a316232373564356139353139396135643233313637656537643432663265
-39626332346238373034333832613561646438663366353863363166323836363534363537336438
-39303735616665346638643938306235336361343737333466636634623132613162393539656537
-63303435363331303332373338616331646139383566623636336166656631393232303761313137
-32316433643962613336366562333061383134376462663831363238623862313464373130656631
-31616563633535316230653231343263643062373666373830636635393061383964333337376166
-30656435613234623431333138313837373731366264373461346638386661616539663437333834
-37306433366464633137366236636330666435353435386238343865396135353531666637323663
-36663461393162643131663030666461313562643666633735393235333163386664336339313562
-66336633613133313265653830353464396461383964363139643435393833316263643564343863
-32353733323936653936366531663165633431326531336166393236333238633961353064336339
-63373334323733663865643338303934313863623534636433326666663961336235366531303862
-38303262626235313165663661336434373262333731666263646362636237313062393666376264
-34353738373365303062323931383964626336323937316166313066646138396435653831396332
-35663136373266376262306661656637353162366238363165376461333736316434636533623238
-35643732623166373238336436396361613766316534666130326631666538613166363338363538
-63333539336536616339313061386631623536646132653731626535333337353034316133303965
-65663563626634383937363364343639616162366232663036663936626263653666343235366465
-38336630316434643438353530636166663164373164343337383430663962613865333566663938
-63616134323762336330646430613863616266653465336139663165623237363264613430636565
-63323337366332306437343535646336663338663037663164393837656535326635373036636438
-33346635373264643561643533623364333065313930623164306561643865353830333232626538
-66653331306161363731396431343861636638626663343839383966346332613365303165386666
-38373865633138626565363464633536386361323464396565383135636131383034336238373830
-30653566633761386437353935616266303333626339346630623734353832353261363561336339
-34376633636562343066356238396337363365353464313734626664346338323135383934316361
-31636233323661666563613764613362613031636436323139616630633331306337306261346130
-32393234353438353966313566306366656262353264396165393366636432383566376634313438
-34343066353936363431313731393434646434336330326331336430383733356134393638666464
-37313337663532633632636336306366653332343265643733336335386663393037336636396331
-61663230326263386535373631623733356666313261333864343463363933376233373331346164
-62633464383934613233393031383164336461353234313039346533346438383865356164326335
-31363832353466313632376433383039616539613036386133663062663537346435376339323664
-37386337313037663338356134346462653739386138313235373037396330363039313537616438
-36616232336436646266333133616335643764623838613561323366353631633532326634383934
-30616562376531613137636434333539353639313566633463346233313432346233366334353937
-30323937316533636637346438313938373535316464323536326264366261343130353963343830
-35333364626131373435643164313632663132653933343565353963383362643365326264653933
-63633931313131366632376132373837636232383437323039333539653563383832636238316234
-34663637646264666162626664653037316136343431666133333532616137663733346364336163
-65336634613366353738373466386131303931346539333331383932313961633636613563663131
-39356438396631363263353638663066633533306662626330616133363565373030346238666466
-63383265366636616134316139646530363365323237316664313837363030626132393033626539
-63363665663936376637313238616131653061643736373164626566636566343734633664323137
-63356665373563356263623439373935633431626134626162303264393138663665303138623762
-38663931343638646633663834373664643263363830616232336439346534396139316334633762
-39306361366264353939623233613735373964373032303330636163363336656566393735313963
-63626231316634643362393938393762313933336637646434383035303838376161356264616231
-66643565386130633963

inventories/mkj/hosts

@@ -1,7 +0,0 @@
----
-all:
-  hosts:
-    mkj.northeurope.cloudapp.azure.com:
-      vars:
-        ansible_connection: local
-        ansible_python_interpreter: "{{ansible_playbook_python}}"

protect.sh

@@ -5,17 +5,17 @@ nounderline=`tput rmul`
 bold=$(tput bold)
 normal=$(tput sgr0)
 
-echo "${bold}MKJ / Infra / Protect${normal}"
+echo "${bold}MatteZ02 / Infra / Protect${normal}"
 action=$1
 
 encrypt() {
     echo "${underline}Encrypting...${nounderline}"
-    execute "ansible-vault encrypt --vault-id default@vault/mkj"
+    execute "ansible-vault encrypt --vault-id matte@vault/matte"
 }
 
 decrypt() {
     echo "${underline}Decrypting...${nounderline}"
-    execute "ansible-vault decrypt --vault-id default@vault/mkj"
+    execute "ansible-vault decrypt --vault-id matte@vault/matte"
 }
 
 list() {

requirements.yml

@@ -1,3 +1,4 @@
 ---
 collections:
+  - community.general
   - containers.podman

tasks.yml

@@ -8,18 +8,32 @@
   tasks:
     - name: "Installer"
       import_tasks: tasks/installer.yml
+      vars:
+        ansible_python_interpreter: "{{ ansible_facts.user_dir }}/.venv/ansible/bin/python3"
       tags:
         - installer
         - never
 
     - name: "Maintenance"
       import_tasks: tasks/maintenance.yml
+      vars:
+        ansible_python_interpreter: "{{ ansible_facts.user_dir }}/.venv/ansible/bin/python3"
       tags:
         - maintenance
         - never
 
     - name: "Deployer"
       import_tasks: tasks/deployer.yml
+      vars:
+        ansible_python_interpreter: "{{ ansible_facts.user_dir }}/.venv/ansible/bin/python3"
       tags:
         - deployer
         - never
+
+    - name: "Backup"
+      import_tasks: tasks/backup.yml
+      vars:
+        ansible_python_interpreter: "{{ ansible_facts.user_dir }}/.venv/ansible/bin/python3"
+      tags:
+        - backup
+        - never

tasks/backup.yml

@@ -0,0 +1,19 @@
+---
+- name: "Backup - Minecraft - Stop"
+  containers.podman.podman_container:
+    name: minecraft
+    state: stopped
+
+- name: "Backup - Minecraft - Save"
+  community.general.archive:
+    path:
+      - "~/data/minecraft"
+    exclude_path:
+      - "~/data/minecraft/plugins/dynmap/web/tiles"
+    dest: "~/data/backups/minecraft-{{ ansible_facts.date_time.date }}.zip"
+    format: zip
+
+- name: "Backup - Minecraft - Start"
+  containers.podman.podman_container:
+    name: minecraft
+    state: started

tasks/deployer.yml

@@ -1,245 +1,34 @@
 ---
 - name: "Deployer - Certbot - Renew Certificates"
-  command: "certbot renew"
+  containers.podman.podman_container:
+    name: certbot
+    image: "docker.io/certbot/certbot:latest"
+    state: started
+    network: host
+    volumes:
+      - "{{ ansible_facts.user_dir }}/data/certbot:/etc/letsencrypt"
+    command: "renew"
+    detach: false
   register: task
-  changed_when: task.stdout.find("No renewals were attempted.") == -1
+  changed_when:
+    - task.stdout.find("No renewals were attempted.") == -1
   tags:
     - certbot
     - tls
 
 - name: "Deployer - Certbot - Copy Certificates"
   copy:
-    src: "/etc/letsencrypt/live/mkj/"
-    dest: "/root/certs/mkj/"
+    src: "~/data/certbot/live/{{ cert }}/"
+    dest: "~/data/certificates/{{ cert }}/"
     follow: true
+  loop: "{{ certs }}"
+  loop_control:
+    label: "{{ cert }}"
+    loop_var: "cert"
+  vars:
+    certs:
+      - arcadiamc
   register: task
   tags:
     - certbot
     - tls
-
-- name: "Deployer - MariaDB - Create Folder"
-  file:
-    path: "/root/mariadb"
-    state: directory
-  tags:
-    - mariadb
-
-- name: "Deployer - MariaDB - Pull Image"
-  containers.podman.podman_image:
-    name: docker.io/library/mariadb
-    tag: latest
-    force: on
-  register: deployerTask101
-
-- name: "Deployer - MariaDB - Run Container"
-  containers.podman.podman_container:
-    name: mariadb
-    image: docker.io/library/mariadb:latest
-    state: started
-    restart: on
-    network: host
-    volumes:
-      - "/root/mariadb:/var/lib/mysql"
-    env:
-      MYSQL_ROOT_PASSWORD: "{{ secrets.mariadb.users.root.password }}"
-    restart_policy: always
-  register: deployerTask102
-  when:
-    - (deployerTask101 is defined and deployerTask101.changed) or deployerTask101 is undefined
-  tags:
-    - mariadb
-
-- name: "Deployer - MariaDB - Wait"
-  wait_for:
-    host: "127.0.0.1"
-    port: "3306"
-    delay: 10
-  when:
-    - (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
-  tags:
-    - mariadb
-
-- name: "Deployer - MariaDB - Upgrade"
-  containers.podman.podman_container_exec:
-    name: mariadb
-    command: "mariadb-upgrade --host=127.0.0.1 --user=root --password={{ secrets.mariadb.users.root.password }}"
-  register: task
-  ignore_errors: yes
-  changed_when:
-    - task.stdout is defined
-    - task.stdout.find("This installation of MariaDB is already upgraded") == -1
-  when:
-    - (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
-  tags:
-    - mariadb
-
-- name: "Deployer - MariaDB - Create Users"
-  mysql_user:
-    login_host: "127.0.0.1"
-    login_user: root
-    login_password: "{{ secrets.mariadb.users.root.password }}"
-    name: "mkj"
-    host: "%"
-    password: "{{ secrets.mariadb.users.mkj.password }}"
-    priv: "mkj.*:ALL"
-  vars:
-    ansible_python_interpreter: "/opt/ansible/bin/python3"
-  when:
-    - (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
-  tags:
-    - mariadb
-
-- name: "Deployer - MariaDB - Create Database"
-  mysql_db:
-    login_host: "127.0.0.1"
-    login_user: "mkj"
-    login_password: "{{ secrets.mariadb.users.mkj.password }}"
-    name: "mkj"
-  vars:
-    ansible_python_interpreter: "/opt/ansible/bin/python3"
-  when:
-    - (deployerTask102 is defined and deployerTask102.changed) or deployerTask102 is undefined
-  tags:
-    - mariadb
-
-- name: "Deployer - Nginx - Configure - Create Folder"
-  file:
-    path: "/root/nginx/"
-    state: directory
-  tags:
-    - nginx
-
-- name: "Deployer - Nginx - Configure - Create Subfolders"
-  file:
-    dest: '/root/nginx/{{ item.path }}'
-    state: directory
-  with_filetree: './files/nginx/'
-  loop_control:
-    label: "{{ item.path }}"
-  when:
-    - item.state == 'directory'
-  tags:
-    - nginx
-
-- name: "Deployer - Nginx - Configure - Generating & Transferring Files"
-  template:
-    src: '{{ item.src }}'
-    dest: '/root/nginx/{{ item.path }}'
-  with_filetree: './files/nginx/'
-  loop_control:
-    label: "{{ item.path }}"
-  when:
-    - item.state == 'file'
-  tags:
-    - nginx
-
-- name: "Deployer - Nginx - Pull Image"
-  containers.podman.podman_image:
-    name: docker.io/library/nginx
-    tag: latest
-    force: on
-  register: deployerTask3
-
-- name: "Deployer - Nginx - Run Container"
-  containers.podman.podman_container:
-    name: nginx
-    image: docker.io/library/nginx:latest
-    state: started
-    recreate: on
-    network: host
-    volumes:
-      - "/root/nginx/html:/usr/share/nginx/html:ro"
-      - "/root/nginx/config.conf:/etc/nginx/nginx.conf:ro"
-      - "/root/nginx/conf/:/etc/nginx/conf.d/:ro"
-      - "/root/certs/:/etc/nginx/certs/:ro"
-    restart_policy: always
-  when:
-    - (deployerTask3 is defined and deployerTask3.changed) or deployerTask3 is undefined
-  tags:
-    - nginx
-
-- name: "Deployer - Wordpress - Create Folder"
-  file:
-    path: "{{ path }}"
-    state: directory
-  vars:
-    paths:
-      - /root/wordpress/data/wp-content/plugins
-      - /root/wordpress/data/wp-content/uploads
-  loop: "{{ paths }}"
-  loop_control:
-    label: "{{ path }}"
-    loop_var: "path"
-  tags:
-    - wordpress
-
-- name: "Deployer - Wordpress - Configure - Create Subfolders"
-  file:
-    dest: '/root/wordpress/{{ item.path }}'
-    state: directory
-  with_filetree: './files/wordpress/'
-  loop_control:
-    label: "{{ item.path }}"
-  when:
-    - item.state == 'directory'
-  tags:
-    - wordpress
-
-- name: "Deployer - Wordpress - Configure - Generating & Transferring Files"
-  template:
-    src: '{{ item.src }}'
-    dest: '/root/wordpress/{{ item.path }}'
-  with_filetree: './files/wordpress/'
-  loop_control:
-    label: "{{ item.path }}"
-  when:
-    - item.state == 'file'
-  tags:
-    - wordpress
-
-- name: "Deployer - Wordpress - Configure - Theme - Git Operations"
-  git:
-    repo: https://github.com/MatteZ02/wp-smarter-inside.git
-    dest: /root/wordpress/data/wp-content/themes/smarter-inside
-    version: main
-  tags:
-    - wordpress
-
-- name: "Deployer - Wordpress - Pull Image"
-  containers.podman.podman_image:
-    name: docker.io/library/wordpress
-    tag: latest
-    force: on
-  register: deployerTask4
-
-- name: "Deployer - Wordpress - Run Container"
-  containers.podman.podman_container:
-    name: wordpress
-    image: docker.io/library/wordpress:latest
-    state: started
-    recreate: on
-    network: host
-    volumes:
-      - "/root/wordpress/data/wp-content/themes/smarter-inside:/var/www/html/wp-content/themes/smarter-inside"
-      - "/root/wordpress/data/wp-content/plugins:/var/www/html/wp-content/plugins"
-      - "/root/wordpress/data/wp-content/uploads:/var/www/html/wp-content/uploads"
-      - "/root/wordpress/conf/000-default.conf:/etc/apache2/sites-enabled/000-default.conf"
-      - "/root/wordpress/conf/ports.conf:/etc/apache2/ports.conf"
-    env:
-      WORDPRESS_DB_HOST: "127.0.0.1"
-      WORDPRESS_DB_USER: "mkj"
-      WORDPRESS_DB_PASSWORD: "{{ secrets.mariadb.users.mkj.password }}"
-      WORDPRESS_DB_NAME: "mkj"
-      WORDPRESS_AUTH_KEY: "{{ secrets.wordpress['keys'].auth }}"
-      WORDPRESS_SECURE_AUTH_KEY: "{{ secrets.wordpress['keys'].secure_auth }}"
-      WORDPRESS_LOGGED_IN_KEY: "{{ secrets.wordpress['keys'].logged_in }}"
-      WORDPRESS_NONCE_KEY: "{{ secrets.wordpress['keys'].nonce }}"
-      WORDPRESS_AUTH_SALT: "{{ secrets.wordpress.salt.auth }}"
-      WORDPRESS_SECURE_AUTH_SALT: "{{ secrets.wordpress.salt.secure_auth }}"
-      WORDPRESS_LOGGED_IN_SALT: "{{ secrets.wordpress.salt.logged_in }}"
-      WORDPRESS_NONCE_SALT: "{{ secrets.wordpress.salt.nonce }}"
-    restart_policy: always
-  when:
-    - (deployerTask4 is defined and deployerTask4.changed) or deployerTask4 is undefined
-  tags:
-    - wordpress

tasks/installer.yml

@@ -4,22 +4,28 @@
     name: ansible
     state: latest
     extra_args: --upgrade
-    virtualenv: /opt/ansible
+    virtualenv: ~/.venv/ansible
     virtualenv_command: "python3 -m venv"
   tags:
     - ansible
 
-- name: "Installer - Ansible - Create Symbolic Links"
+- name: "Installer : Ansible : Create Folder"
+  file:
+    path: ~/bin
+    state: directory
+  tags:
+    - ansible
+
+- name: "Installer : Ansible : Create Symbolic Links"
   ansible.builtin.file:
-    src: /opt/ansible/bin/{{ binary }}
-    dest: /usr/bin/{{ binary }}
+    src: ~/.venv/ansible/bin/{{ binary }}
+    dest: ~/bin/{{ binary }}
     state: link
   vars:
     binaries:
       - ansible
       - ansible-community
       - ansible-config
-      - ansible-connection
       - ansible-console
       - ansible-doc
       - ansible-galaxy
@@ -35,199 +41,90 @@
   tags:
     - ansible
 
-- name: "Installer - Ansible - Dependencies / Python Library : hvac"
+- name: "Installer - Ansible - Dependencies / Python Libraries"
   pip:
-    name: hvac
+    name: "{{ library }}"
     state: latest
     extra_args: --upgrade
-    virtualenv: /opt/ansible
+    virtualenv: ~/.venv/ansible
     virtualenv_command: "python3 -m venv"
-  tags:
-    - ansible
+  vars:
+    libraries:
+      - cryptography
+      - dnspython
+      - hvac
+      - jmespath
+      - netaddr
+      - pexpect
+  loop: "{{ libraries }}"
+  loop_control:
+    label: "{{ library }}"
+    loop_var: "library"
 
-- name: "Installer - Ansible - Dependencies / Python Library : netaddr"
-  pip:
-    name: netaddr
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
-  tags:
-    - ansible
-
-- name: "Installer - Ansible - Dependencies / Python Library : jmespath"
-  pip:
-    name: jmespath
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
-  tags:
-    - ansible
-
-- name: "Installer - Ansible - Dependencies / Python Library : pexpect"
-  pip:
-   name: pexpect
-   state: latest
-   extra_args: --upgrade
-   virtualenv: /opt/ansible
-   virtualenv_command: "python3 -m venv"
-  tags:
-    - ansible
-
-- name: "Installer - Podman"
-  apt:
-     name: podman
-     state: latest
-  tags:
-    - podman
-
-- name: "Installer : Podman : Configure - Subordinate Ids : Users : root"
-  lineinfile:
-    path: /etc/subuid
-    regexp: "^root"
-    line: "root:100000:65536"
-
-- name: "Installer : Podman : Configure - Subordinate Ids : Groups : root"
-  lineinfile:
-    path: /etc/subgid
-    regexp: "^root"
-    line: "root:100000:65536"
-
-- name: "Installer - Certbot - Create Folder"
+- name: "Installer : Certbot : Auth Hook - Create Folder"
   file:
-    path: "{{ path }}"
+    path: ~/data/certbot/auth-hooks
     state: directory
-  vars:
-    paths:
-      - /root/certs/mkj
-      - /etc/letsencrypt/renewal-hooks/pre
-  loop: "{{ paths }}"
-  loop_control:
-    label: "{{ path }}"
-    loop_var: "path"
   tags:
     - certbot
 
-- name: "Installer - Certbot - Python Library"
-  pip:
-    name: certbot
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
-  tags:
-    - certbot
-
-- name: "Installer - Certbot - Create Symbolic Links"
-  ansible.builtin.file:
-    src: /opt/ansible/bin/{{ binary }}
-    dest: /usr/bin/{{ binary }}
-    state: link
-  vars:
-    binaries:
-      - certbot
-  loop: "{{ binaries }}"
-  loop_control:
-    label: "{{ binary }}"
-    loop_var: "binary"
-  tags:
-    - certbot
-
-- name: "Installer - Certbot - Self-Signed Certificates - Generate Private Key"
-  community.crypto.openssl_privatekey:
-    path: "/root/certs/mkj/privkey.pem"
-    type: RSA
-    size: 2048
-    regenerate: never
-  tags:
-    - certbot
-
-- name: "Installer - Certbot - Self-Signed Certificates - Create Certificate Signing Request"
-  community.crypto.openssl_csr:
-    common_name: "{{ ansible_facts.fqdn }}"
-    privatekey_path: "/root/certs/mkj/privkey.pem"
-    path: "/root/certs/mkj/csr.pem"
-  tags:
-    - certbot
-
-- name: "Installer - Certbot - Self-Signed Certificates - Generate Certificate"
-  community.crypto.x509_certificate:
-    path: "/root/certs/mkj/fullchain.pem"
-    privatekey_path: "/root/certs/mkj/privkey.pem"
-    csr_path: "/root/certs/mkj/csr.pem"
-    provider: selfsigned
-  tags:
-    - certbot
-
-- name: "Installer - Certbot - Self-Signed Certificates - Copy Certificate"
-  copy:
-    src: "/root/certs/mkj/fullchain.pem"
-    dest: "/root/certs/mkj/chain.pem"
-    force: true
-  tags:
-    - certbot
-
-- name: "Installer - Certbot - Auth Hook"
-  copy:
-    src: "../files/certbot/nginx.sh"
-    dest: "/etc/letsencrypt/renewal-hooks/pre/nginx.sh"
+- name: "Installer : Certbot : Auth Hook - Download"
+  get_url:
+    url: "https://git.waren.io/warengroup/acme-dns-auth/raw/branch/master/acme-dns-auth.py"
+    dest: "~/data/certbot/auth-hooks/acme-dns.py"
     mode: '700'
     force: true
   tags:
     - certbot
 
-- name: "Installer - Certbot - Create Certificates"
-  command: "certbot certonly --cert-name {{ cert.name }} --manual --preferred-challenges http-01 --email {{ cert.email }} --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -n --manual-auth-hook /etc/letsencrypt/renewal-hooks/pre/nginx.sh --debug-challenges --preferred-chain='ISRG Root X1' --key-type rsa -d {{ cert.domains | join(' -d ') }}"
+- name: "Installer : Certbot : Create Certificates"
+  containers.podman.podman_container:
+    name: certbot
+    image: "docker.io/certbot/certbot:latest"
+    state: started
+    network: host
+    volumes:
+      - "{{ ansible_facts.user_dir }}/data/certbot:/etc/letsencrypt"
+    command: "certonly --cert-name {{ cert.name }} --manual --preferred-challenges dns-01 --email {{ cert.email }} --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -n --manual-auth-hook /etc/letsencrypt/auth-hooks/acme-dns.py --debug-challenges --key-type rsa -d {{ cert.domains | join(' -d ') }}"
+    detach: false
   register: task
-  changed_when: task.stdout.find("Certificate not yet due for renewal; no action taken.") == -1
+  changed_when:
+    - task.stdout.find("Certificate not yet due for renewal; no action taken.") == -1
+  loop: "{{ certs }}"
+  loop_control:
+    label: "{{ cert.name }}"
+    loop_var: "cert"
   vars:
-    cert:
-      name: mkj
-      email: "{{ secrets.certbot.email }}"
+    certs:
+      - name: arcadiamc
+        email: mattez02.contact@gmail.com
         domains:
-        - "{{ ansible_facts.fqdn }}"
+          - arcadiamc.wgi.fi
   tags:
     - certbot
 
-- name: "Installer - MariaDB - Dependencies / Python Library : pymysql"
-  pip:
-    name: pymysql
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
-  tags:
-    - mariadb
-
-- name: "Installer - MariaDB - Dependencies / Package : mariadb-client"
-  apt:
-     name: "mariadb-client"
-     state: latest
-  when:
-    - ansible_facts.distribution == "Debian" or ansible_facts.distribution == "Ubuntu" or ansible_facts.distribution == "Linux Mint"
-  tags:
-    - mariadb
-
-- name: "Installer - Schedule - Setup"
+- name: "Installer : Schedule : Maintenance"
   cron:
-    name: PATH
-    env: yes
-    value: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-
-- name: "Installer - Schedule - Maintenance"
-  cron:
-    name: Maintenance
+    name: "Matte - Infra - Maintenance"
     hour: "*/3"
     minute: "0"
-    job: "/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mkj-infra --accept-host-key --private-key ~/.ssh/id_rsa --vault-password-file ~/.ansible/vault.yml tasks.yml -t maintenance"
+    job: "~/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/infra -d ~/.ansible/pull/matte/infra --accept-host-key --private-key ~/.ssh/keys/matte/infra --vault-password-file ~/.ansible/vault/matte.yml tasks.yml -t maintenance"
   tags:
     - cron
 
-- name: "Installer - Schedule - Deployer"
+- name: "Installer : Schedule : Deployer"
   cron:
-    name: Deployer
+    name: "Matte - Infra - Deployer"
     minute: "*/5"
-    job: "/opt/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/mkj-infra --accept-host-key --private-key ~/.ssh/id_rsa --vault-password-file ~/.ansible/vault.yml tasks.yml -t deployer"
+    job: "~/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/infra -d ~/.ansible/pull/matte/infra --accept-host-key --private-key ~/.ssh/keys/matte/infra --vault-password-file ~/.ansible/vault/matte.yml tasks.yml -t deployer"
+  tags:
+    - cron
+
+- name: "Installer : Schedule : Backup"
+  cron:
+    name: "Matte - Infra - Backup"
+    hour: "5"
+    minute: "0"
+    job: "~/.venv/ansible/bin/ansible-pull -U ssh://git@github.com/MatteZ02/infra -d ~/.ansible/pull/matte/infra --accept-host-key --private-key ~/.ssh/keys/matte/infra --vault-password-file ~/.ansible/vault/matte.yml tasks.yml -t backup"
   tags:
     - cron

tasks/maintenance.yml

@@ -1,37 +1,36 @@
 ---
-- name: "Maintenance - OS Update"
-  apt:
-    upgrade: dist
-    update_cache: yes
-
-- name: "Maintenance - Ansible : Dependencies - Python Library : hvac"
+- name: "Installer - Ansible - Dependencies / Python Libraries"
   pip:
-    name: hvac
+    name: "{{ library }}"
     state: latest
     extra_args: --upgrade
-    virtualenv: /opt/ansible
+    virtualenv: ~/.venv/ansible
     virtualenv_command: "python3 -m venv"
+  vars:
+    libraries:
+      - cryptography
+      - dnspython
+      - hvac
+      - jmespath
+      - netaddr
+      - pexpect
+  loop: "{{ libraries }}"
+  loop_control:
+    label: "{{ library }}"
+    loop_var: "library"
 
-- name: "Maintenance - Ansible : Dependencies - Python Library : netaddr"
+- name: "Maintenance : Ansible : Update"
   pip:
-    name: netaddr
+    name: ansible
     state: latest
     extra_args: --upgrade
-    virtualenv: /opt/ansible
+    virtualenv: ~/.venv/ansible
     virtualenv_command: "python3 -m venv"
 
-- name: "Maintenance - Ansible : Dependencies - Python Library : jmespath"
-  pip:
-    name: jmespath
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
-
-- name: "Maintenance - Ansible : Dependencies - Python Library : pexpect"
-  pip:
-    name: pexpect
-    state: latest
-    extra_args: --upgrade
-    virtualenv: /opt/ansible
-    virtualenv_command: "python3 -m venv"
+- name: "Maintenance : Podman : Prune"
+  containers.podman.podman_prune:
+    container: yes
+    image: yes
+    image_filters:
+        dangling_only: no
+    volume: yes