ansible

ansible/playbooks/backup-forgejo.yaml

@@ -0,0 +1,8 @@
+---
+- name: Backup Forgejo from old server
+  hosts: "{{ backup_old_server }}"
+  become: true
+  vars:
+    ansible_host: "{{ backup_old_server }}"
+  roles:
+    - forgejo_backup

ansible/playbooks/deploy-forgejo-runner.yaml

@@ -0,0 +1,6 @@
+---
+- name: Deploy Forgejo Runner
+  hosts: asxpio-services
+  become: true
+  roles:
+    - forgejo_runner

ansible/playbooks/deploy-forgejo.yaml

@@ -0,0 +1,6 @@
+---
+- name: Deploy Forgejo Git server
+  hosts: asxpio-ops
+  become: true
+  roles:
+    - forgejo

ansible/playbooks/deploy-traefik.yaml

@@ -0,0 +1,6 @@
+---
+- name: Deploy Traefik reverse proxy
+  hosts: asxpio-ops
+  become: true
+  roles:
+    - traefik

ansible/playbooks/restore-forgejo.yaml

@@ -0,0 +1,6 @@
+---
+- name: Restore Forgejo to new server
+  hosts: asxpio-ops
+  become: true
+  roles:
+    - forgejo_restore

ansible/playbooks/setup-servers.yaml

@@ -0,0 +1,32 @@
+---
+# Main playbook for setting up asxpio servers
+# Usage: ansible-playbook playbooks/setup-servers.yml
+#
+# NOTE: Cloud-init handles base system setup:
+# - System packages (fail2ban, curl, htop, ncdu, tree, etc.)
+# - User management (asxpi + deploy users with sudo and docker access)
+# - SSH hardening (key-only auth, prohibit root password)
+# - Docker installation (docker-ce, docker-ce-cli, containerd.io, docker-compose-plugin)
+# - Bash prompt styling for asxpi user
+# - Docker image pruning cron job
+# - Directory structure creation
+#
+# This playbook handles post-cloud-init verification and additional configuration.
+# Application deployment (Traefik, Forgejo, monitoring, etc.)
+# will be handled via Forgejo Actions pipelines
+
+- name: Setup asxpio infrastructure servers
+  hosts: asxpio
+  become: yes
+  gather_facts: yes
+
+  roles:
+    - common
+
+  post_tasks:
+    - name: Display server info
+      debug:
+        msg: |
+          Server {{ inventory_hostname }} post-cloud-init setup complete!
+          Role: {{ server_role }}
+          Next: Deploy services via Forgejo Actions pipelines

ansible/playbooks/ssh-harden.yaml

@@ -0,0 +1,6 @@
+---
+- name: Harden SSH configuration
+  hosts: asxpio
+  become: true
+  roles:
+    - ssh_hardening

ansible/playbooks/wireguard-client.yaml

@@ -0,0 +1,59 @@
+---
+- name: Deploy WireGuard client configuration
+  hosts: services_servers
+  become: true
+  vars:
+    # Map each server to its client config name
+    wireguard_client_configs:
+      asxpio-services: asxpio-services
+  tasks:
+    - name: Get client config name for this host
+      ansible.builtin.set_fact:
+        client_config_name: "{{ wireguard_client_configs[inventory_hostname] }}"
+      when: inventory_hostname in wireguard_client_configs
+
+    - name: Install WireGuard
+      ansible.builtin.apt:
+        name:
+          - wireguard
+          - wireguard-tools
+        state: present
+        update_cache: true
+
+    - name: Create WireGuard config directory
+      ansible.builtin.file:
+        path: /etc/wireguard
+        state: directory
+        mode: '0700'
+        owner: root
+        group: root
+
+    - name: Copy WireGuard client configuration
+      ansible.builtin.copy:
+        src: "../playbooks/wireguard-configs/asxpio-ops/{{ client_config_name }}.conf"
+        dest: "/etc/wireguard/{{ client_config_name }}.conf"
+        mode: '0600'
+        owner: root
+        group: root
+      when: client_config_name is defined
+      notify: restart wireguard client
+
+    - name: Enable WireGuard interface
+      ansible.builtin.systemd:
+        name: "wg-quick@{{ client_config_name }}"
+        enabled: true
+      when: client_config_name is defined
+
+    - name: Start WireGuard interface
+      ansible.builtin.systemd:
+        name: "wg-quick@{{ client_config_name }}"
+        state: started
+      when: client_config_name is defined
+
+  handlers:
+    - name: restart wireguard client
+      ansible.builtin.shell: |
+        wg-quick down {{ client_config_name }} || true
+        wg-quick up {{ client_config_name }}
+      args:
+        executable: /bin/bash

ansible/playbooks/wireguard-configs/.gitignore

@@ -0,0 +1,2 @@
+*
+!.gitignore

ansible/playbooks/wireguard.yaml

@@ -0,0 +1,6 @@
+---
+- name: Setup WireGuard VPN
+  hosts: ops_servers
+  become: true
+  roles:
+    - wireguard