asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ansible cleanup

Browse source
This commit is contained in:
Sergei Poljanski 2025-11-04 14:23:16 +02:00
commit 8ef380bc9b
15 changed files with 163 additions and 420 deletions
Download patch file Download diff file Expand all files Collapse all files

60
ansible/inventory/host_vars/asxpio-ops.yaml
View file

@ -2,66 +2,8 @@
# Host-specific configuration for asxpio-ops
# Operations server: Forgejo, Traefik, WireGuard VPN hub
# ============================================================================
# WireGuard VPN Configuration
# ============================================================================
wireguard_port: 60101
wireguard_interface: wg0
wireguard_ipv4: 10.20.0.10
wireguard_ipv6: fd69:69:69::1
wireguard_ipv4_network: 10.20.0.0/24
wireguard_ipv6_network: fd69:69:69::/64
# Enable UFW firewall rules (set to false to use iptables PostUp/PostDown)
wireguard_enable_ufw: false
# WireGuard clients
wireguard_clients:
- name: asxpio-services
ipv4: 10.20.0.20
ipv6: fd69:69:69::20
preshared_key: true
persistent_keepalive: 25
- name: laptop
ipv4: 10.20.0.2
ipv6: fd69:69:69::2
preshared_key: true
persistent_keepalive: 25
# Optional: DNS servers for clients
wireguard_dns_servers:
- 1.1.1.1
- 1.0.0.1
# Optional: Additional routes for split tunneling
# wireguard_additional_routes:
# - 192.168.1.0/24
# ============================================================================
# SSH Hardening Configuration
# ============================================================================
# Allow public SSH access for Forgejo git operations
ssh_allow_public_git: true
ssh_git_user: git
# ============================================================================
# Forgejo Configuration
# ============================================================================
# Secrets are stored in encrypted vault (group_vars/all/vault.yaml)
forgejo_secret_key: "{{ vault_forgejo_secret_key }}"
forgejo_internal_token: "{{ vault_forgejo_internal_token }}"
forgejo_jwt_secret: "{{ vault_forgejo_jwt_secret }}"
forgejo_lfs_jwt_secret: "{{ vault_forgejo_lfs_jwt_secret }}"
# ============================================================================
# SSL/TLS Configuration
# ============================================================================
letsencrypt_email: "{{ vault_letsencrypt_email }}"
# ============================================================================
# S3FS Configuration
# ============================================================================
# ops server: CX22 with 40GB disk, limit cache to 10GB
# Formula: Total_Disk - Desired_Cache_Size = ensure_diskfree
# 40GB - 10GB = 30GB free
s3fs_ensure_diskfree: 30720 # 30GB free = max 10GB cache
s3fs_ensure_diskfree: 20000 # Total:40GB Keep:20GB free = ~15GB for Cache

10
ansible/inventory/host_vars/asxpio-services.yaml
View file

@ -2,16 +2,8 @@
# Host-specific configuration for asxpio-services
# Services server: Forgejo Runner, Immich, game servers, XMPP
# ============================================================================
# SSH Hardening Configuration
# ============================================================================
# Restrict SSH to VPC and WireGuard networks only
ssh_allow_public_git: false
# ============================================================================
# S3FS Configuration
# ============================================================================
# services server: CX43 with 160GB disk, limit cache to 80GB
# Formula: Total_Disk - Desired_Cache_Size = ensure_diskfree
# 160GB - 80GB = 80GB free
s3fs_ensure_diskfree: 81920 # 80GB free = max 80GB cache