asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ansible rework

Browse source
This commit is contained in:
Sergei Poljanski 2025-11-04 11:06:35 +02:00
commit eecff4345a
47 changed files with 1995 additions and 538 deletions
Download patch file Download diff file Expand all files Collapse all files

50
ansible/inventory/host_vars/asxpio-ops.yaml
View file

@ -1,5 +1,10 @@
---
# WireGuard VPN Configuration for asxpio-ops
# Host-specific configuration for asxpio-ops
# Operations server: Forgejo, Traefik, WireGuard VPN hub
# ============================================================================
# WireGuard VPN Configuration
# ============================================================================
wireguard_port: 60101
wireguard_interface: wg0
wireguard_ipv4: 10.20.0.10
@ -22,34 +27,41 @@ wireguard_clients:
ipv6: fd69:69:69::2
preshared_key: true
persistent_keepalive: 25
- name: phone
ipv4: 10.20.0.3
ipv6: fd69:69:69::3
preshared_key: true
persistent_keepalive: 25
- name: pixel9
ipv4: 10.20.0.4
ipv6: fd69:69:69::4
preshared_key: true
persistent_keepalive: 25
# Optional: DNS servers for clients
wireguard_dns_servers:
- 1.1.1.1
- 1.0.0.1
- 1.1.1.1
- 1.0.0.1
# Optional: Additional routes for split tunneling
# wireguard_additional_routes:
# - 192.168.1.0/24
# ============================================================================
# SSH Hardening Configuration
# ============================================================================
# Allow public SSH access for Forgejo git operations
ssh_allow_public_git: true
ssh_git_user: git
# Forgejo secrets (from old server)
forgejo_secret_key: "***REDACTED***"
forgejo_internal_token: "***REDACTED***"
forgejo_jwt_secret: "***REDACTED***"
forgejo_lfs_jwt_secret: "***REDACTED***"
letsencrypt_email: "me@asxp.io"
# ============================================================================
# Forgejo Configuration
# ============================================================================
# Secrets are stored in encrypted vault (group_vars/all/vault.yaml)
forgejo_secret_key: "{{ vault_forgejo_secret_key }}"
forgejo_internal_token: "{{ vault_forgejo_internal_token }}"
forgejo_jwt_secret: "{{ vault_forgejo_jwt_secret }}"
forgejo_lfs_jwt_secret: "{{ vault_forgejo_lfs_jwt_secret }}"
# ============================================================================
# SSL/TLS Configuration
# ============================================================================
letsencrypt_email: "{{ vault_letsencrypt_email }}"
# ============================================================================
# S3FS Configuration
# ============================================================================
# ops server: CX22 with 40GB disk, limit cache to 10GB
# Formula: Total_Disk - Desired_Cache_Size = ensure_diskfree
# 40GB - 10GB = 30GB free
s3fs_ensure_diskfree: 30720 # 30GB free = max 10GB cache

13
ansible/inventory/host_vars/asxpio-services.yaml
View file

@ -1,4 +1,17 @@
---
# Host-specific configuration for asxpio-services
# Services server: Forgejo Runner, Immich, game servers, XMPP
# ============================================================================
# SSH Hardening Configuration
# ============================================================================
# Restrict SSH to VPC and WireGuard networks only
ssh_allow_public_git: false
# ============================================================================
# S3FS Configuration
# ============================================================================
# services server: CX43 with 160GB disk, limit cache to 80GB
# Formula: Total_Disk - Desired_Cache_Size = ensure_diskfree
# 160GB - 80GB = 80GB free
s3fs_ensure_diskfree: 81920 # 80GB free = max 80GB cache