asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ansible cleanup

Browse source
This commit is contained in:
Sergei Poljanski 2025-11-04 14:23:16 +02:00
commit 8ef380bc9b
15 changed files with 163 additions and 420 deletions
Download patch file Download diff file Expand all files Collapse all files

21
ansible/inventory/group_vars/all/main.yaml
View file

@ -1,21 +0,0 @@
---
# Shared configuration for all servers
# Docker network for Traefik
traefik_network: traefik
# Forgejo configuration
forgejo_version: "12"
forgejo_domain: git.asxp.io
forgejo_http_port: 3000
forgejo_ssh_port: 2222 # External port (container uses 22)
# Forgejo Runner configuration
forgejo_runner_version: "11"
forgejo_runner_capacity: 1
forgejo_runner_timeout: 3h
forgejo_runner_token: "{{ vault_forgejo_runner_token }}"
# Backup configuration
backup_dest_dir: /opt/forgejo-backup
backup_old_server: asxpio-old

5
ansible/inventory/group_vars/all/paths.yaml Normal file
View file

@ -0,0 +1,5 @@
---
# Base paths for all services
# Base directory for all service installations
services_base_path: "/opt"

30
ansible/inventory/group_vars/all/services.yaml
View file

@ -1,30 +0,0 @@
---
# Service configuration for all hosts
# Centralized service definitions to avoid hardcoding paths and ports
# Base paths for services
services_base_path: "/opt"
# Service-specific paths (derived from base path)
traefik_base_path: "{{ services_base_path }}/traefik"
forgejo_base_path: "{{ services_base_path }}/forgejo"
forgejo_runner_base_path: "{{ services_base_path }}/forgejo-runner"
# Service ports
traefik_http_port: 80
traefik_https_port: 443
traefik_dashboard_port: 8080
forgejo_http_port: 3000
forgejo_ssh_port: 2222 # External SSH port for Git operations
forgejo_internal_ssh_port: 22 # Internal container SSH port
# WireGuard configuration
wireguard_port: 60101
wireguard_interface: "wg0"
# SSH configuration
ssh_port: 22
# Docker configuration
docker_network_name: "asxpio-net"

38
ansible/inventory/group_vars/all/wireguard.yaml Normal file
View file

@ -0,0 +1,38 @@
---
# WireGuard VPN configuration
# Centralized configuration for all WireGuard settings
# WireGuard network interface and port
wireguard_port: 60101
wireguard_interface: "wg0"
# WireGuard server configuration (asxpio-ops)
wireguard_ipv4: 10.20.0.10
wireguard_ipv6: fd69:69:69::1
wireguard_ipv4_network: 10.20.0.0/24
wireguard_ipv6_network: fd69:69:69::/64
# Enable UFW firewall rules (set to false to use iptables PostUp/PostDown)
wireguard_enable_ufw: false
# WireGuard clients
wireguard_clients:
- name: asxpio-services
ipv4: 10.20.0.20
ipv6: fd69:69:69::20
preshared_key: true
persistent_keepalive: 25
- name: laptop
ipv4: 10.20.0.2
ipv6: fd69:69:69::2
preshared_key: true
persistent_keepalive: 25
# DNS servers for VPN clients
wireguard_dns_servers:
- 1.1.1.1
- 1.0.0.1
# Optional: Additional routes for split tunneling
# wireguard_additional_routes:
# - 192.168.1.0/24

25
ansible/inventory/group_vars/ops_servers/forgejo.yaml Normal file
View file

@ -0,0 +1,25 @@
---
# Forgejo Git server configuration
# Forgejo version and domain
forgejo_version: "12"
forgejo_domain: git.asxp.io
# Forgejo installation path
forgejo_base_path: "{{ services_base_path }}/forgejo"
# Forgejo ports
forgejo_http_port: 3000
# Forgejo secrets (stored in encrypted vault)
forgejo_secret_key: "{{ vault_forgejo_secret_key }}"
forgejo_internal_token: "{{ vault_forgejo_internal_token }}"
forgejo_jwt_secret: "{{ vault_forgejo_jwt_secret }}"
forgejo_lfs_jwt_secret: "{{ vault_forgejo_lfs_jwt_secret }}"
# Backup configuration
backup_dest_dir: /opt/forgejo-backup
backup_old_server: asxpio-old
# Docker network for Traefik integration
traefik_network: traefik

11
ansible/inventory/group_vars/ops_servers/traefik.yaml Normal file
View file

@ -0,0 +1,11 @@
---
# Traefik reverse proxy configuration
# Traefik installation path
traefik_base_path: "{{ services_base_path }}/traefik"
# Traefik ports
traefik_dashboard_port: 8080
# SSL/TLS configuration
letsencrypt_email: "{{ vault_letsencrypt_email }}"

11
ansible/inventory/group_vars/services_servers/forgejo_runner.yaml Normal file
View file

@ -0,0 +1,11 @@
---
# Forgejo Runner (CI/CD) configuration
# Runner version and settings
forgejo_runner_version: "11"
forgejo_runner_capacity: 1
forgejo_runner_timeout: 3h
forgejo_runner_token: "{{ vault_forgejo_runner_token }}"
# Runner installation path
forgejo_runner_base_path: "{{ services_base_path }}/forgejo-runner"

60
ansible/inventory/host_vars/asxpio-ops.yaml
View file

@ -2,66 +2,8 @@
# Host-specific configuration for asxpio-ops
# Operations server: Forgejo, Traefik, WireGuard VPN hub
# ============================================================================
# WireGuard VPN Configuration
# ============================================================================
wireguard_port: 60101
wireguard_interface: wg0
wireguard_ipv4: 10.20.0.10
wireguard_ipv6: fd69:69:69::1
wireguard_ipv4_network: 10.20.0.0/24
wireguard_ipv6_network: fd69:69:69::/64
# Enable UFW firewall rules (set to false to use iptables PostUp/PostDown)
wireguard_enable_ufw: false
# WireGuard clients
wireguard_clients:
- name: asxpio-services
ipv4: 10.20.0.20
ipv6: fd69:69:69::20
preshared_key: true
persistent_keepalive: 25
- name: laptop
ipv4: 10.20.0.2
ipv6: fd69:69:69::2
preshared_key: true
persistent_keepalive: 25
# Optional: DNS servers for clients
wireguard_dns_servers:
- 1.1.1.1
- 1.0.0.1
# Optional: Additional routes for split tunneling
# wireguard_additional_routes:
# - 192.168.1.0/24
# ============================================================================
# SSH Hardening Configuration
# ============================================================================
# Allow public SSH access for Forgejo git operations
ssh_allow_public_git: true
ssh_git_user: git
# ============================================================================
# Forgejo Configuration
# ============================================================================
# Secrets are stored in encrypted vault (group_vars/all/vault.yaml)
forgejo_secret_key: "{{ vault_forgejo_secret_key }}"
forgejo_internal_token: "{{ vault_forgejo_internal_token }}"
forgejo_jwt_secret: "{{ vault_forgejo_jwt_secret }}"
forgejo_lfs_jwt_secret: "{{ vault_forgejo_lfs_jwt_secret }}"
# ============================================================================
# SSL/TLS Configuration
# ============================================================================
letsencrypt_email: "{{ vault_letsencrypt_email }}"
# ============================================================================
# S3FS Configuration
# ============================================================================
# ops server: CX22 with 40GB disk, limit cache to 10GB
# Formula: Total_Disk - Desired_Cache_Size = ensure_diskfree
# 40GB - 10GB = 30GB free
s3fs_ensure_diskfree: 30720 # 30GB free = max 10GB cache
s3fs_ensure_diskfree: 20000 # Total:40GB Keep:20GB free = ~15GB for Cache

10
ansible/inventory/host_vars/asxpio-services.yaml
View file

@ -2,16 +2,8 @@
# Host-specific configuration for asxpio-services
# Services server: Forgejo Runner, Immich, game servers, XMPP
# ============================================================================
# SSH Hardening Configuration
# ============================================================================
# Restrict SSH to VPC and WireGuard networks only
ssh_allow_public_git: false
# ============================================================================
# S3FS Configuration
# ============================================================================
# services server: CX43 with 160GB disk, limit cache to 80GB
# Formula: Total_Disk - Desired_Cache_Size = ensure_diskfree
# 160GB - 80GB = 80GB free
s3fs_ensure_diskfree: 81920 # 80GB free = max 80GB cache

16
ansible/inventory/hosts.yaml
View file

@ -8,9 +8,10 @@ all:
ansible_python_interpreter: /usr/bin/python3
children:
# Production asxpio infrastructure (excludes legacy servers)
asxpio:
vars:
# Common variables for all asxpio servers
# Common variables for all asxpio production servers
timezone: UTC
locale: en_US.UTF-8
@ -56,9 +57,10 @@ all:
- prosody
- coturn
old_servers:
hosts:
asxpio-old:
ansible_host: asxp.io
server_role: legacy
ansible_user: asxpi
# Legacy servers (standalone, not part of asxpio group)
old_servers:
hosts:
asxpio-old:
ansible_host: asxp.io
server_role: legacy
ansible_user: asxpi