asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ansible: describe what runs on the servers

Browse source 
The roles had drifted far from production: Forgejo was pinned at 12
while 15.0.11 runs, its config lacked the mailer, packages and the real
database path, and several services existed only on the hosts. Running
a role would have rolled production back. Take the servers as the truth
and make the repository match them.

site.yaml now holds the desired state of both hosts:

 - base: unattended upgrades, fail2ban, Docker daemon config and the
   weekly image prune, as found on the hosts. New: a 500M journal cap,
   and the Docker systemd override is kept absent. That override once
   opened dockerd on tcp/2375 without authentication.
 - traefik: templates as deployed, version in a variable (v3.7.18).
   The Coraza WAF files are removed; no router ever used them.
 - forgejo: 15.0.11, app.ini generated from the live file with the
   secrets taken from the vault.
 - crawler_alert, sillytavern, minecraft, minecraft_fossils: added
   from the hosts.

Forgejo's canonical name becomes git.asxp.io; git.czsk.it stays as an
alias on the same router.

docker_service restarts a stack when its config changes, no longer
forces ownership on existing data directories, and hides template
diffs because they carry secrets. Containers listed in
service_graceful_stop are saved and stopped with a long timeout before
compose recreates them: Docker's 10 s default is too short for a
Minecraft world. Both game servers get stop_grace_period for the same
reason.

Removed: the full-deployment and runner playbooks with their prompts,
the Forgejo backup and restore roles for the old bare-metal host, and
inventory entries for services that were never deployed. SSH hardening
stays a manual playbook, since a mistake there locks everyone out.

New secrets (SMTP, RCON, CurseForge key) went into the vault.

Assisted-by: Claude:fable-5-2
This commit is contained in:
Sergei Poljanski 2026-11-12 06:47:08 +04:00
commit 27ccdc4255
52 changed files with 1554 additions and 1031 deletions
Download patch file Download diff file Expand all files Collapse all files

256
ansible/playbooks/02-full-deployment.yaml
View file

@ -1,256 +0,0 @@
---
# Stage 2: Full Infrastructure Deployment
#
# PREREQUISITES:
# 1. Stage 1 (01-wireguard-setup.yaml) must be completed
# 2. inventory/hosts.yaml must be updated to use WireGuard IPs (10.20.0.x)
# 3. You must be connected via WireGuard VPN
#
# This playbook deploys the complete infrastructure in one go:
# - SSH hardening (with connection recovery)
# - Traefik reverse proxy
# - Forgejo Git server
# - Forgejo CI/CD runner
#
# Usage:
# ansible-playbook playbooks/02-full-deployment.yaml
#
- name: Verify prerequisites
hosts: localhost
gather_facts: false
tasks:
- name: Test WireGuard connectivity
ansible.builtin.wait_for:
host: "{{ asxpio_ops_wireguard_ip }}"
port: 22
timeout: 10
state: started
register: wg_test
failed_when: false
- name: Verify WireGuard is reachable
ansible.builtin.assert:
that:
- not wg_test.failed
fail_msg: |
❌ ERROR: Cannot reach servers via WireGuard!
Tested: {{ asxpio_ops_wireguard_ip }}:22
Result: Connection failed
Stage 2 automatically uses WireGuard IPs and REQUIRES an active VPN connection.
To fix:
1. Ensure Stage 1 is complete:
ansible-playbook playbooks/01-wireguard-setup.yaml
2. Import WireGuard config:
playbooks/wireguard-configs/<hostname>/<client>.conf
3. Start WireGuard:
- Linux/Mac: sudo wg-quick up <config>.conf
- Windows: Import in WireGuard GUI and activate
4. Test connectivity:
ping {{ asxpio_ops_wireguard_ip }}
ping {{ asxpio_services_wireguard_ip }}
5. Re-run this playbook
Aborting deployment for safety...
success_msg: "✅ WireGuard connectivity verified"
- name: Display pre-deployment checklist
ansible.builtin.debug:
msg: |
========================================
Pre-Deployment Checklist
========================================
✅ WireGuard connectivity verified
✅ Ready for deployment
This playbook will:
1. Verify common setup
2. Harden SSH (will restrict access to WireGuard/VPC only)
3. Deploy Traefik reverse proxy
4. Deploy Forgejo Git server
5. Deploy Forgejo CI/CD runner (requires manual token setup)
⚠️ IMPORTANT: This playbook uses WireGuard IPs automatically.
After SSH hardening, you will ONLY be able to
access servers via WireGuard VPN!
========================================
- name: Pause for confirmation
ansible.builtin.pause:
prompt: "Press ENTER to continue or Ctrl+C to abort"
- name: Harden SSH configuration
hosts: asxpio
become: true
gather_facts: true
vars:
# Force WireGuard IPs for Stage 2 (SSH hardening requires it)
ansible_host: "{{ wireguard_ip }}"
pre_tasks:
- name: Display SSH hardening notice
ansible.builtin.debug:
msg: |
========================================
SSH Hardening - {{ inventory_hostname }}
========================================
SSH will be restarted asynchronously.
Connection may drop briefly but will automatically recover.
Trusted networks:
- WireGuard: {{ wireguard_network }}
- VPC: {{ vpc_network }}
========================================
roles:
- role: ssh_hardening
post_tasks:
- name: Verify SSH connection after hardening
ansible.builtin.debug:
msg: "SSH hardening complete and connection verified on {{ inventory_hostname }}"
- name: Deploy Traefik reverse proxy
hosts: asxpio-ops
become: true
gather_facts: true
vars:
# Force WireGuard IPs for Stage 2
ansible_host: "{{ wireguard_ip }}"
roles:
- role: traefik
post_tasks:
- name: Display Traefik status
ansible.builtin.debug:
msg: |
Traefik deployed successfully on {{ inventory_hostname }}
Dashboard: http://{{ asxpio_ops_wireguard_ip }}:{{ traefik_dashboard_port }}
- name: Deploy Forgejo Git server
hosts: asxpio-ops
become: true
gather_facts: true
vars:
# Force WireGuard IPs for Stage 2
ansible_host: "{{ wireguard_ip }}"
roles:
- role: forgejo
post_tasks:
- name: Display Forgejo status
ansible.builtin.debug:
msg: |
Forgejo deployed successfully on {{ inventory_hostname }}
Web UI: http://{{ asxpio_ops_wireguard_ip }}:{{ forgejo_http_port }}
SSH: ssh://git@{{ asxpio_ops_wireguard_ip }}
⚠️ IMPORTANT: Before deploying the runner, you must:
1. Access Forgejo web UI
2. Complete initial setup (create admin user)
3. Go to: Site Administration → Actions → Runners
4. Generate a runner registration token
5. Update forgejo_runner_token in inventory/group_vars/all.yaml (or vault)
- name: Pause for Forgejo runner token generation
ansible.builtin.pause:
prompt: |
========================================
Forgejo Runner Registration Token Required
========================================
The runner cannot be deployed without a registration token from Forgejo.
Steps to generate the token:
1. Open Forgejo: http://{{ asxpio_ops_wireguard_ip }}:{{ forgejo_http_port }}
2. Complete initial setup if not done (create admin account)
3. Login as admin
4. Navigate to: Site Administration → Actions → Runners
5. Click "Create new Runner" or "Generate Token"
6. Copy the registration token
7. Update forgejo_runner_token in inventory/group_vars/all.yaml
OR better: ansible-vault edit inventory/group_vars/vault.yaml
Press ENTER when ready to continue with runner deployment, or Ctrl+C to abort
========================================
- name: Deploy Forgejo CI/CD Runner
hosts: asxpio-services
become: true
gather_facts: true
vars:
# Force WireGuard IPs for Stage 2
ansible_host: "{{ wireguard_ip }}"
pre_tasks:
- name: Verify runner token is configured
ansible.builtin.assert:
that:
- forgejo_runner_token is defined
- forgejo_runner_token | length > 0
- forgejo_runner_token != "REPLACE_WITH_ACTUAL_TOKEN"
fail_msg: |
ERROR: forgejo_runner_token is not properly configured!
You must set a valid runner registration token from Forgejo:
1. Get token from: Site Administration → Actions → Runners
2. Set in inventory/group_vars/all.yaml or vault.yaml
3. Re-run this playbook
success_msg: "Runner token validated"
roles:
- role: forgejo_runner
post_tasks:
- name: Display runner status
ansible.builtin.debug:
msg: |
Forgejo Runner deployed successfully on {{ inventory_hostname }}
Check status: docker logs forgejo-runner
- name: Display deployment summary
hosts: localhost
gather_facts: false
tasks:
- name: Show final status
ansible.builtin.debug:
msg: |
========================================
Full Infrastructure Deployment Complete!
========================================
Services deployed:
Traefik (asxpio-services):
- Dashboard: http://{{ asxpio_services_wireguard_ip }}:8080
Forgejo (asxpio-ops):
- Web UI: http://{{ asxpio_ops_wireguard_ip }}:3000
- Git SSH: ssh://git@{{ asxpio_ops_wireguard_ip }}:2222
Forgejo Runner (asxpio-services):
- Status: docker logs forgejo-runner
SSH Access:
- Restricted to WireGuard (10.20.0.0/24) and VPC (10.10.0.0/20)
- Connect via WireGuard VPN to access servers
Next steps:
- Configure Forgejo admin account
- Set up repositories
- Test CI/CD pipeline
========================================

15
ansible/playbooks/02-ssh-hardening.yaml Normal file
View file

@ -0,0 +1,15 @@
---
# Restricts SSH to the WireGuard and VPC networks (plus the public git
# user on asxpio-ops). Run by hand over WireGuard: a mistake here locks
# everyone out, so it is deliberately not part of site.yaml.
#
# ansible-playbook playbooks/02-ssh-hardening.yaml --check --diff
- name: Harden SSH configuration
hosts: asxpio
become: true
gather_facts: true
vars:
ansible_host: "{{ wireguard_ip }}"
roles:
- role: ssh_hardening

226
ansible/playbooks/deploy-forgejo-runner-standalone.yaml
View file

@ -1,226 +0,0 @@
---
# Standalone Forgejo Runner Deployment
#
# PREREQUISITES:
# 1. Forgejo must be deployed and running
# 2. You must have created an admin account in Forgejo
# 3. You must generate a runner registration token from Forgejo UI
#
# To get the registration token:
# 1. Login to Forgejo as admin
# 2. Go to: Site Administration → Actions → Runners
# 3. Click "Create new Runner" or "Generate Token"
# 4. Copy the token and update forgejo_runner_token variable
#
# Usage:
# ansible-playbook playbooks/deploy-forgejo-runner-standalone.yaml
#
- name: Verify Forgejo is accessible
hosts: localhost
gather_facts: false
tasks:
- name: Check Forgejo is running
ansible.builtin.uri:
url: "http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}/"
status_code: 200
timeout: 10
register: forgejo_check
failed_when: false
delegate_to: localhost
- name: Display Forgejo status
ansible.builtin.debug:
msg: |
{% if forgejo_check.status == 200 %}
✅ Forgejo is accessible at http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
{% else %}
❌ ERROR: Cannot reach Forgejo!
Please ensure:
1. Forgejo is deployed and running
2. You can access: http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
3. You are connected to the VPC network or WireGuard VPN
Deploy Forgejo first:
ansible-playbook playbooks/02-full-deployment.yaml
Or deploy just Forgejo:
ansible-playbook playbooks/legacy/deploy-forgejo.yaml
{% endif %}
- name: Fail if Forgejo is not accessible
ansible.builtin.fail:
msg: "Forgejo is not accessible. Please deploy Forgejo first."
when: forgejo_check.status != 200
- name: Get runner registration token
hosts: localhost
gather_facts: false
tasks:
- name: Prompt for runner token configuration
ansible.builtin.pause:
prompt: |
========================================
Forgejo Runner Registration Token Required
========================================
Before deploying the runner, you MUST generate a registration token from Forgejo.
Steps to generate the token:
1. Open Forgejo: http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
2. Login as administrator
3. Navigate to: Site Administration → Actions → Runners
(Click your profile icon → Site Administration → Actions → Runners)
4. Click "Create new Runner" or "Generate registration token"
5. Copy the generated token (it looks like: "eyJhbGc...")
6. Update the token in one of these locations:
Option A - Plaintext (NOT RECOMMENDED):
Edit: inventory/group_vars/all.yaml
Set: forgejo_runner_token: "YOUR-TOKEN-HERE"
Option B - Ansible Vault (RECOMMENDED):
ansible-vault edit inventory/group_vars/vault.yaml
Set: vault_forgejo_runner_token: "YOUR-TOKEN-HERE"
Then in all.yaml: forgejo_runner_token: "{{ vault_forgejo_runner_token }}"
7. Save the file
8. Press ENTER to continue with runner deployment
Or press Ctrl+C to abort and configure the token first
========================================
- name: Deploy Forgejo CI/CD Runner
hosts: asxpio-services
become: true
gather_facts: true
pre_tasks:
- name: Verify runner token is configured
ansible.builtin.assert:
that:
- forgejo_runner_token is defined
- forgejo_runner_token | length > 0
- forgejo_runner_token != "REPLACE_WITH_ACTUAL_TOKEN"
- forgejo_runner_token != "***REDACTED***" # Old token from git
fail_msg: |
❌ ERROR: forgejo_runner_token is not properly configured!
Current value: {{ forgejo_runner_token | default('NOT SET') }}
You must set a valid runner registration token from Forgejo:
1. Get token from Forgejo UI:
Site Administration → Actions → Runners → Generate Token
2. Update in inventory/group_vars/all.yaml:
forgejo_runner_token: "YOUR-TOKEN-HERE"
OR better, use Ansible Vault (recommended):
ansible-vault edit inventory/group_vars/vault.yaml
vault_forgejo_runner_token: "YOUR-TOKEN-HERE"
3. Re-run this playbook
Aborting deployment...
success_msg: "✅ Runner token validated (length: {{ forgejo_runner_token | length }} chars)"
- name: Display deployment information
ansible.builtin.debug:
msg: |
========================================
Deploying Forgejo Runner
========================================
Target: {{ inventory_hostname }}
Forgejo instance: http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
Runner name: runner-{{ inventory_hostname }}
This will:
1. Deploy runner container
2. Register with Forgejo instance
3. Start accepting CI/CD jobs
========================================
roles:
- role: forgejo_runner
post_tasks:
- name: Wait for runner registration
ansible.builtin.pause:
seconds: 5
prompt: "Waiting for runner to register with Forgejo..."
- name: Display runner status
ansible.builtin.debug:
msg: |
========================================
Forgejo Runner Deployment Complete!
========================================
Runner deployed successfully on {{ inventory_hostname }}
Check status:
docker logs forgejo-runner
Verify in Forgejo UI:
1. Login to Forgejo
2. Go to: Site Administration → Actions → Runners
3. You should see: runner-{{ inventory_hostname }} (idle/active)
Test the runner:
1. Create a repository with .forgejo/workflows/test.yml
2. Push a commit
3. Check Actions tab for workflow run
Runner supports these labels:
- ubuntu-latest, ubuntu-22.04, ubuntu-24.04
- debian-latest, debian-12, debian-11
- node-20, node-22
- python-3.11, python-3.12
- alpine-latest, arch-latest
- nginx-latest, nginx-alpine
Example workflow:
.forgejo/workflows/test.yml:
---
name: Test
on: [push]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: echo "Hello from Forgejo Actions!"
========================================
- name: Verify runner in Forgejo
hosts: localhost
gather_facts: false
tasks:
- name: Reminder to check Forgejo UI
ansible.builtin.debug:
msg: |
⚠️ FINAL STEP: Verify runner in Forgejo UI
1. Open: http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
2. Login as admin
3. Go to: Site Administration → Actions → Runners
4. Verify runner-asxpio-services appears in the list
5. Status should be "idle" (green) or "active"
If the runner doesn't appear:
- Check logs: docker logs forgejo-runner
- Verify token is correct
- Ensure runner can reach Forgejo at {{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}

6
ansible/playbooks/legacy/backup-forgejo.yaml
View file

@ -1,6 +0,0 @@
---
- name: Backup Forgejo from old server
hosts: asxpio-old
become: true
roles:
- forgejo_backup

6
ansible/playbooks/legacy/restore-forgejo.yaml
View file

@ -1,6 +0,0 @@
---
- name: Restore Forgejo to new server
hosts: asxpio-ops
become: true
roles:
- forgejo_restore