ansible rework

ansible/inventory/group_vars/all/main.yaml

@@ -0,0 +1,21 @@
+---
+# Shared configuration for all servers
+
+# Docker network for Traefik
+traefik_network: traefik
+
+# Forgejo configuration
+forgejo_version: "12"
+forgejo_domain: git.asxp.io
+forgejo_http_port: 3000
+forgejo_ssh_port: 2222  # External port (container uses 22)
+
+# Forgejo Runner configuration
+forgejo_runner_version: "11"
+forgejo_runner_capacity: 1
+forgejo_runner_timeout: 3h
+forgejo_runner_token: "{{ vault_forgejo_runner_token }}"
+
+# Backup configuration
+backup_dest_dir: /opt/forgejo-backup
+backup_old_server: asxpio-old

ansible/inventory/group_vars/all/network.yaml

@@ -0,0 +1,24 @@
+---
+# Network configuration for all hosts
+# Centralized network definitions to avoid hardcoding IPs across the codebase
+
+# VPC Network (Hetzner private network)
+vpc_network: "10.10.0.0/20"
+vpc_network_cidr: "10.10.0.0/20"
+
+# WireGuard VPN Network
+wireguard_network: "10.20.0.0/24"
+wireguard_network_cidr: "10.20.0.0/24"
+
+# Host IP Addresses
+# These are used for service communication and should match inventory
+asxpio_ops_vpc_ip: "10.10.0.10"
+asxpio_ops_wireguard_ip: "10.20.0.10"
+
+asxpio_services_vpc_ip: "10.10.0.20"
+asxpio_services_wireguard_ip: "10.20.0.20"
+
+# Trusted Networks for SSH Access
+ssh_trusted_networks:
+  - "{{ wireguard_network }}"
+  - "{{ vpc_network }}"

ansible/inventory/group_vars/all/s3.yaml

@@ -0,0 +1,39 @@
+---
+# S3 Object Storage Configuration
+# These should be overridden in vault or environment-specific vars
+
+# S3 Endpoint Configuration
+s3_region: hel1
+s3_endpoint: "https://{{ s3_region }}.your-objectstorage.com"
+
+# S3 Credentials
+# WARNING: Store these in ansible-vault encrypted file!
+# Override these in group_vars/all/vault.yaml (encrypted)
+s3_access_key: "{{ vault_s3_access_key | default('') }}"
+s3_secret_key: "{{ vault_s3_secret_key | default('') }}"
+
+# S3 Bucket names
+s3_bucket_terraform_main: asxpio-terraform-main
+s3_bucket_terraform_repl: asxpio-terraform-repl
+s3_bucket_backups_main: asxpio-backups-main
+s3_bucket_backups_repl: asxpio-backups-repl
+s3_bucket_immich_main: asxpio-immich-main
+s3_bucket_immich_repl: asxpio-immich-repl
+
+# S3 Buckets to mount on servers (non-replication only)
+s3_buckets:
+  - name: "{{ s3_bucket_terraform_main }}"
+    mount_point: /mnt/s3/terraform
+    owner: root
+    group: root
+    mode: "0755"
+  - name: "{{ s3_bucket_backups_main }}"
+    mount_point: /mnt/s3/backups
+    owner: root
+    group: root
+    mode: "0755"
+  - name: "{{ s3_bucket_immich_main }}"
+    mount_point: /mnt/s3/immich
+    owner: root
+    group: docker
+    mode: "0775"

ansible/inventory/group_vars/all/services.yaml

@@ -0,0 +1,30 @@
+---
+# Service configuration for all hosts
+# Centralized service definitions to avoid hardcoding paths and ports
+
+# Base paths for services
+services_base_path: "/opt"
+
+# Service-specific paths (derived from base path)
+traefik_base_path: "{{ services_base_path }}/traefik"
+forgejo_base_path: "{{ services_base_path }}/forgejo"
+forgejo_runner_base_path: "{{ services_base_path }}/forgejo-runner"
+
+# Service ports
+traefik_http_port: 80
+traefik_https_port: 443
+traefik_dashboard_port: 8080
+
+forgejo_http_port: 3000
+forgejo_ssh_port: 2222  # External SSH port for Git operations
+forgejo_internal_ssh_port: 22  # Internal container SSH port
+
+# WireGuard configuration
+wireguard_port: 60101
+wireguard_interface: "wg0"
+
+# SSH configuration
+ssh_port: 22
+
+# Docker configuration
+docker_network_name: "asxpio-net"

ansible/inventory/group_vars/all/vault.yaml

@@ -0,0 +1,87 @@
+$ANSIBLE_VAULT;1.1;AES256
+62313564376664646635373735353930353765633834323532646230633033393738376335313666
+3537393466636230353539313938656537333665636136640a653338306635333331383932663965
+39643137366165623666636135646638623830633563313133326231623030643665633062616336
+3035386162363566660a373666353366393034306135373830356166373861633035346637333339
+32346466363162353663663966323635346338333265303565386166373837626437356632383162
+64666536316438346464666165616437376230343763343738363738373130363833393730303138
+62393736326562313230333331633232363362613839393330353133316536343235383464303634
+34396163626530383564396637336365633033373461623233633630626237336231333466346631
+37323439636239663861653065663532343730313130663663626361353835356662613232663062
+62386130313533613430303035653430313866623335303134383738316430346262633639346334
+63326333653761613239663932306135366236376335643733366535666430633938613966386164
+61633137383866396533323831666462346438633830376561623431333666313531623133656230
+30343862383534623062343537326463623731323435363837383038316539376131363534366164
+30323666663338613466626534376562613539383563633765626238633763396235356639393831
+35636138356435376132336365666363633965623965343165303261323831363366666164373061
+31656239356664623038376231363765386664336135373637383165653966373035353836363264
+39366161646334376430623261353230653930623966616535303565383962633339323563363666
+30343834323430333562666230313334366339313838643662376437323236633761386333373336
+36653132393564653431396662613936636639653231646365353836633830616430323430363561
+33313130313633356539303363613731383930623937643461613665626437623365303766353862
+34386566396530343638313334306530633962653235623561326234363639313233666332616130
+62663235663863666230653363663863663031323563383235356465626463303834623464383835
+61626463343638626530376564343333633738313937326662643133633364353232643135666462
+66363965663436303638363535363332363033313766313335393235363230666234643764653732
+62653261656332326461363961353863346563323638326161656331323538643934383665393536
+37323265396662646163363066643237656235616462373337633338623661363037316131323762
+62653562626237316139363833633039636365643438656230656134363634393139386334376431
+36373534326439323130336431303531366565653263323364323139383632643436613839326434
+35643136363664626630346436656562626363633864356132393035343037633632366436393866
+65616363343062656336303463313431363333336365613632393163356531323838333062613664
+65393430313732346364323736333361363363396433313666636433626139353766346165363637
+34616634313833393162393738376466613338616433393235663930663630356561643237663063
+35363832363365653137313830356666323631653535363063366134303164303364643366613466
+66613030383131633735313065383736316635613437393439393437613363386234356535353534
+32613436346439643835636665656537336534643665323961666632613462633839616637393033
+62383966616666613565653732616164623136323861313365333532393931353338666565336430
+30626638363234623662333638633962313633306536323964343731653362313935363932626331
+38613935643861353830373839393465356334356361656335303732336363306263356463396665
+62633432613838363431653338356639383138343431303632666361313863663938643134626361
+66363666633431343831396637353463366366306135646163633563376437663663353033333865
+38323638333664623037386531323063376533623962366530636137363065616361646464663431
+32326363343163303535643865356539396664393233633639633639346137663635366133636437
+34373839623932626130336265623565313233646562653063343739333539306631353863393337
+61353531303339343963306463613339386530366432646336333039336639326165386562333835
+38373665396138616264646434316333363838333765353436393433656330373738333662373033
+37633234343265373133336331393538303965326366663134353936613439656561356438306231
+62313338383439653835316566663039303330306564626634346165386366393135646137393835
+63316431396439653738656239643565366632616133653039313736333034353032313533363662
+36383661663331633961353839386464656134623337353561613135303865363463346638346263
+32333634343162393266353235326635336332623566353838353566323030663732643531663234
+65616234643931346533333365643263323135366236316363636566613032643636623130306230
+33666266373432303132303438656533653331333636396235623164353730343961376361383838
+35386330616439363662396165643631616638656466313933396339303632323232363638326263
+62326337373534616463633062613261636631656464336663313239636432373230383434363937
+39353764623636343534613639353032643632373334623536373665383538623135316238393937
+33633666636531306666306432666462306137653036643866653365373265646437663362313835
+65613431643030313833333839666663366435613065323033666234653530663837363462383138
+37363739386231646234386265343531303163613563303833623534353832396131336235633362
+32666631653933376130616632333031306331323931336566663764373262376637313465383535
+35356332663931313862376365346361613632306166643433386436666435333233623361323934
+35373031663863343239636435646165323763313137626161623238383365323662623934383162
+34356236386339316533373139663562393531333831666136626162616366633461333863613063
+34376534663135343939373439303966633133353632616530626433303463656634306539653139
+63376561363331306266343033336162663334663638323231323532373239393562383238383831
+32323635356534636637303534393832326566306562633762313363363563643764663063656131
+38323061363438366330613239643937616430313865356366343435343736346633393736333131
+66656635336234663938373433646465383061366139313230663539303365616261336338363565
+36316130303836363366303437373762353061363733343861613530666663363738363032323631
+37613634656532626436343639383431353532316435376232663962636238383862353830313634
+39376262353332663438313062316430383366393265323064613038363763333465373561663430
+62306638623165386636316531396535313134396232343332336663333834636532393530376334
+34333037323830646330303562353439383031356165376564303338323630383337616131636133
+64663665306466633538323330333731386233306130366634646637663839323130633065313462
+66633337346264313561663135323034633636646131303234363132633335313966646534646461
+62353131346666323862323461623437363930333064373439333166656430646237393832373462
+63393430646531323835386462326635313861646335323564643630376131626137616231303335
+39623533383939353966356636656337343336336130643333323236303739393263633562633534
+38666632316432663332626437626337376533393139353731383835376131643035313866386265
+33323333613766333932333637353563366462303763613562333963373537343837653535653631
+33383331396363396439646534323832613165393062623332393537393731373234396634363237
+36343839363163356232333936663230336266376432373433393964313436616637633865636435
+33633835353337613233616438396537393166346464313563643536623835613636373436633562
+33366633326130646138373539656336363034346438326361333539626563613734636138376533
+62313863613237316237346330326330623462346539356330333265383163353733613464326238
+36363131613461643235373937326130383063353534393133636339373439656238333232653263
+6137343166303139343338663639306434656262343139653437

ansible/inventory/group_vars/all/vault.yaml.template

@@ -0,0 +1,56 @@
+---
+# Ansible Vault Template
+# Copy this file to vault.yaml and encrypt it with:
+#   ansible-vault encrypt vault.yaml
+#
+# Or create encrypted vault directly:
+#   ansible-vault create vault.yaml
+#
+# This file contains all sensitive secrets used across the infrastructure
+
+# ============================================================================
+# S3 Object Storage Credentials
+# ============================================================================
+vault_s3_access_key: "YOUR_S3_ACCESS_KEY_HERE"
+vault_s3_secret_key: "YOUR_S3_SECRET_KEY_HERE"
+
+# Optional: Alternative S3 endpoint if not using default
+# vault_s3_endpoint: "https://hel1.your-objectstorage.com"
+
+# ============================================================================
+# Forgejo Secrets
+# ============================================================================
+# Generate with: openssl rand -hex 32
+vault_forgejo_secret_key: "GENERATE_64_CHAR_HEX_STRING_HERE"
+
+# Generate with Forgejo or use existing JWT token
+vault_forgejo_internal_token: "eyJhbGc..."
+
+# Generate with: openssl rand -base64 32
+vault_forgejo_jwt_secret: "GENERATE_BASE64_STRING_HERE"
+vault_forgejo_lfs_jwt_secret: "GENERATE_BASE64_STRING_HERE"
+
+# ============================================================================
+# Forgejo Runner
+# ============================================================================
+# Generate from Forgejo UI: Site Admin → Actions → Runners → Create Runner
+vault_forgejo_runner_token: "GENERATE_FROM_FORGEJO_UI"
+
+# ============================================================================
+# SSL/TLS Certificates
+# ============================================================================
+# Email for Let's Encrypt certificate notifications
+vault_letsencrypt_email: "admin@example.com"
+
+# ============================================================================
+# Database Credentials (if needed for future services)
+# ============================================================================
+# vault_postgres_password: "GENERATE_SECURE_PASSWORD"
+# vault_mysql_root_password: "GENERATE_SECURE_PASSWORD"
+# vault_redis_password: "GENERATE_SECURE_PASSWORD"
+
+# ============================================================================
+# API Keys and Tokens (if needed for future services)
+# ============================================================================
+# vault_grafana_admin_password: "GENERATE_SECURE_PASSWORD"
+# vault_immich_db_password: "GENERATE_SECURE_PASSWORD"