asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ansible rework

Browse source
This commit is contained in:
Sergei Poljanski 2025-11-04 11:06:35 +02:00
commit eecff4345a
47 changed files with 1995 additions and 538 deletions
Download patch file Download diff file Expand all files Collapse all files

191
ansible/playbooks/01-wireguard-setup.yaml Normal file
View file

@ -0,0 +1,191 @@
---
# Stage 1: WireGuard VPN Setup
#
# This playbook must be run FIRST to establish the WireGuard VPN network.
# After this playbook completes:
# 1. WireGuard will be running on all hosts
# 2. Client configs will be generated in playbooks/wireguard-configs/
# 3. You MUST manually update inventory/hosts.yaml to use WireGuard IPs (10.20.0.x)
# 4. Then you can run playbook 02-full-deployment.yaml
#
# Usage:
# ansible-playbook playbooks/01-wireguard-setup.yaml
#
- name: Deploy WireGuard VPN Server
hosts: ops_servers
become: true
gather_facts: true
pre_tasks:
- name: Validate required variables
ansible.builtin.assert:
that:
- wireguard_network is defined
- vpc_network is defined
- ansible_host is defined
fail_msg: "Required network variables are missing. Check group_vars/all/"
success_msg: "Network variables validated successfully"
- name: Display pre-deployment information
ansible.builtin.debug:
msg: |
========================================
WireGuard VPN Server Deployment
========================================
Target: {{ inventory_hostname }} (VPN Hub)
WireGuard network: {{ wireguard_network }}
VPC network: {{ vpc_network }}
This will deploy WireGuard VPN server and generate client configs.
========================================
roles:
- role: wireguard
- name: Deploy WireGuard VPN Client
hosts: services_servers
become: true
gather_facts: true
vars:
# Map each server to its client config name
wireguard_client_configs:
asxpio-services: asxpio-services
tasks:
- name: Display client deployment information
ansible.builtin.debug:
msg: |
========================================
WireGuard VPN Client Deployment
========================================
Target: {{ inventory_hostname }} (VPN Client)
Will connect to: {{ asxpio_ops_wireguard_ip }} (asxpio-ops)
========================================
- name: Get client config name for this host
ansible.builtin.set_fact:
client_config_name: "{{ wireguard_client_configs[inventory_hostname] }}"
when: inventory_hostname in wireguard_client_configs
- name: Install WireGuard
ansible.builtin.apt:
name:
- wireguard
- wireguard-tools
state: present
update_cache: true
- name: Create WireGuard config directory
ansible.builtin.file:
path: /etc/wireguard
state: directory
mode: '0700'
owner: root
group: root
- name: Copy WireGuard client configuration
ansible.builtin.copy:
src: "{{ playbook_dir }}/wireguard-configs/asxpio-ops/{{ client_config_name }}.conf"
dest: "/etc/wireguard/{{ client_config_name }}.conf"
mode: '0600'
owner: root
group: root
when: client_config_name is defined
- name: Enable and start WireGuard interface
ansible.builtin.systemd:
name: "wg-quick@{{ client_config_name }}"
enabled: true
state: started
when: client_config_name is defined
register: wg_client_start
- name: Display client status
ansible.builtin.debug:
msg: |
✅ WireGuard client configured on {{ inventory_hostname }}
Interface: wg-quick@{{ client_config_name }}
Status: {{ 'Started' if wg_client_start.changed else 'Already running' }}
when: client_config_name is defined
- name: Post-deployment verification
hosts: localhost
gather_facts: false
tasks:
- name: Display post-deployment instructions
ansible.builtin.debug:
msg: |
========================================
WireGuard VPN Deployment Complete!
========================================
Infrastructure deployed:
✅ asxpio-ops: WireGuard VPN Server (hub)
✅ asxpio-services: WireGuard VPN Client (connected to ops)
Server-to-server connectivity:
- asxpio-ops ↔ asxpio-services via WireGuard (10.20.0.0/24)
IMPORTANT NEXT STEPS FOR YOUR WORKSTATION:
1. Client configurations for your machine are in:
playbooks/wireguard-configs/asxpio-ops/
2. Import a client config to connect your workstation:
- Linux/Mac: sudo wg-quick up ./playbooks/wireguard-configs/asxpio-ops/<client>.conf
- Windows: Import the .conf file in WireGuard GUI
3. Test connectivity from your workstation:
ping {{ asxpio_ops_wireguard_ip }}
ping {{ asxpio_services_wireguard_ip }}
4. After connecting to WireGuard, run Stage 2:
ansible-playbook playbooks/02-full-deployment.yaml
NOTE: Stage 2 automatically uses WireGuard IPs.
No manual configuration changes needed!
========================================
- name: Test WireGuard connectivity from controller
ansible.builtin.wait_for:
host: "{{ asxpio_ops_wireguard_ip }}"
port: 22
timeout: 5
state: started
register: wg_connectivity_test
failed_when: false
- name: Display connectivity test results
ansible.builtin.debug:
msg: |
========================================
WireGuard Connectivity Test
========================================
{% if wg_connectivity_test.failed %}
❌ Cannot reach servers via WireGuard from your workstation yet
This is NORMAL if you haven't connected your workstation to WireGuard.
To connect:
1. Import client config: playbooks/wireguard-configs/asxpio-ops/<client>.conf
2. Start WireGuard connection on your workstation
3. Verify with: ping {{ asxpio_ops_wireguard_ip }}
4. Run Stage 2: ansible-playbook playbooks/02-full-deployment.yaml
{% else %}
✅ WireGuard is reachable from your workstation!
Server-to-server VPN: Connected
Workstation-to-server VPN: Connected
You can now run Stage 2:
ansible-playbook playbooks/02-full-deployment.yaml
Stage 2 automatically uses WireGuard IPs - no manual configuration needed!
{% endif %}
========================================

272
ansible/playbooks/02-full-deployment.yaml Normal file
View file

@ -0,0 +1,272 @@
---
# Stage 2: Full Infrastructure Deployment
#
# PREREQUISITES:
# 1. Stage 1 (01-wireguard-setup.yaml) must be completed
# 2. inventory/hosts.yaml must be updated to use WireGuard IPs (10.20.0.x)
# 3. You must be connected via WireGuard VPN
#
# This playbook deploys the complete infrastructure in one go:
# - SSH hardening (with connection recovery)
# - Traefik reverse proxy
# - Forgejo Git server
# - Forgejo CI/CD runner
#
# Usage:
# ansible-playbook playbooks/02-full-deployment.yaml
#
- name: Verify prerequisites
hosts: localhost
gather_facts: false
tasks:
- name: Test WireGuard connectivity
ansible.builtin.wait_for:
host: "{{ asxpio_ops_wireguard_ip }}"
port: 22
timeout: 10
state: started
register: wg_test
failed_when: false
- name: Verify WireGuard is reachable
ansible.builtin.assert:
that:
- not wg_test.failed
fail_msg: |
❌ ERROR: Cannot reach servers via WireGuard!
Tested: {{ asxpio_ops_wireguard_ip }}:22
Result: Connection failed
Stage 2 automatically uses WireGuard IPs and REQUIRES an active VPN connection.
To fix:
1. Ensure Stage 1 is complete:
ansible-playbook playbooks/01-wireguard-setup.yaml
2. Import WireGuard config:
playbooks/wireguard-configs/<hostname>/<client>.conf
3. Start WireGuard:
- Linux/Mac: sudo wg-quick up <config>.conf
- Windows: Import in WireGuard GUI and activate
4. Test connectivity:
ping {{ asxpio_ops_wireguard_ip }}
ping {{ asxpio_services_wireguard_ip }}
5. Re-run this playbook
Aborting deployment for safety...
success_msg: "✅ WireGuard connectivity verified"
- name: Display pre-deployment checklist
ansible.builtin.debug:
msg: |
========================================
Pre-Deployment Checklist
========================================
✅ WireGuard connectivity verified
✅ Ready for deployment
This playbook will:
1. Verify common setup
2. Harden SSH (will restrict access to WireGuard/VPC only)
3. Deploy Traefik reverse proxy
4. Deploy Forgejo Git server
5. Deploy Forgejo CI/CD runner (requires manual token setup)
⚠️ IMPORTANT: This playbook uses WireGuard IPs automatically.
After SSH hardening, you will ONLY be able to
access servers via WireGuard VPN!
========================================
- name: Pause for confirmation
ansible.builtin.pause:
prompt: "Press ENTER to continue or Ctrl+C to abort"
- name: Common setup verification
hosts: asxpio:!old_servers
become: true
gather_facts: true
vars:
# Force WireGuard IPs for Stage 2 (SSH hardening requires it)
ansible_host: "{{ wireguard_ip }}"
roles:
- role: common
post_tasks:
- name: Display setup status
ansible.builtin.debug:
msg: "Common setup verified on {{ inventory_hostname }}"
- name: Harden SSH configuration
hosts: asxpio:!old_servers
become: true
gather_facts: true
vars:
# Force WireGuard IPs for Stage 2 (SSH hardening requires it)
ansible_host: "{{ wireguard_ip }}"
pre_tasks:
- name: Display SSH hardening notice
ansible.builtin.debug:
msg: |
========================================
SSH Hardening - {{ inventory_hostname }}
========================================
SSH will be restarted asynchronously.
Connection may drop briefly but will automatically recover.
Trusted networks:
- WireGuard: {{ wireguard_network }}
- VPC: {{ vpc_network }}
========================================
roles:
- role: ssh_hardening
post_tasks:
- name: Verify SSH connection after hardening
ansible.builtin.debug:
msg: "SSH hardening complete and connection verified on {{ inventory_hostname }}"
- name: Deploy Traefik reverse proxy
hosts: asxpio-ops
become: true
gather_facts: true
vars:
# Force WireGuard IPs for Stage 2
ansible_host: "{{ wireguard_ip }}"
roles:
- role: traefik
post_tasks:
- name: Display Traefik status
ansible.builtin.debug:
msg: |
Traefik deployed successfully on {{ inventory_hostname }}
Dashboard: http://{{ asxpio_ops_wireguard_ip }}:{{ traefik_dashboard_port }}
- name: Deploy Forgejo Git server
hosts: asxpio-ops
become: true
gather_facts: true
vars:
# Force WireGuard IPs for Stage 2
ansible_host: "{{ wireguard_ip }}"
roles:
- role: forgejo
post_tasks:
- name: Display Forgejo status
ansible.builtin.debug:
msg: |
Forgejo deployed successfully on {{ inventory_hostname }}
Web UI: http://{{ asxpio_ops_wireguard_ip }}:{{ forgejo_http_port }}
SSH: ssh://git@{{ asxpio_ops_wireguard_ip }}:{{ forgejo_ssh_port }}
⚠️ IMPORTANT: Before deploying the runner, you must:
1. Access Forgejo web UI
2. Complete initial setup (create admin user)
3. Go to: Site Administration → Actions → Runners
4. Generate a runner registration token
5. Update forgejo_runner_token in inventory/group_vars/all.yaml (or vault)
- name: Pause for Forgejo runner token generation
ansible.builtin.pause:
prompt: |
========================================
Forgejo Runner Registration Token Required
========================================
The runner cannot be deployed without a registration token from Forgejo.
Steps to generate the token:
1. Open Forgejo: http://{{ asxpio_ops_wireguard_ip }}:{{ forgejo_http_port }}
2. Complete initial setup if not done (create admin account)
3. Login as admin
4. Navigate to: Site Administration → Actions → Runners
5. Click "Create new Runner" or "Generate Token"
6. Copy the registration token
7. Update forgejo_runner_token in inventory/group_vars/all.yaml
OR better: ansible-vault edit inventory/group_vars/vault.yaml
Press ENTER when ready to continue with runner deployment, or Ctrl+C to abort
========================================
- name: Deploy Forgejo CI/CD Runner
hosts: asxpio-services
become: true
gather_facts: true
vars:
# Force WireGuard IPs for Stage 2
ansible_host: "{{ wireguard_ip }}"
pre_tasks:
- name: Verify runner token is configured
ansible.builtin.assert:
that:
- forgejo_runner_token is defined
- forgejo_runner_token | length > 0
- forgejo_runner_token != "REPLACE_WITH_ACTUAL_TOKEN"
fail_msg: |
ERROR: forgejo_runner_token is not properly configured!
You must set a valid runner registration token from Forgejo:
1. Get token from: Site Administration → Actions → Runners
2. Set in inventory/group_vars/all.yaml or vault.yaml
3. Re-run this playbook
success_msg: "Runner token validated"
roles:
- role: forgejo_runner
post_tasks:
- name: Display runner status
ansible.builtin.debug:
msg: |
Forgejo Runner deployed successfully on {{ inventory_hostname }}
Check status: docker logs forgejo-runner
- name: Display deployment summary
hosts: localhost
gather_facts: false
tasks:
- name: Show final status
ansible.builtin.debug:
msg: |
========================================
Full Infrastructure Deployment Complete!
========================================
Services deployed:
Traefik (asxpio-services):
- Dashboard: http://{{ asxpio_services_wireguard_ip }}:8080
Forgejo (asxpio-ops):
- Web UI: http://{{ asxpio_ops_wireguard_ip }}:3000
- Git SSH: ssh://git@{{ asxpio_ops_wireguard_ip }}:2222
Forgejo Runner (asxpio-services):
- Status: docker logs forgejo-runner
SSH Access:
- Restricted to WireGuard (10.20.0.0/24) and VPC (10.10.0.0/20)
- Connect via WireGuard VPN to access servers
Next steps:
- Configure Forgejo admin account
- Set up repositories
- Test CI/CD pipeline
========================================

134
ansible/playbooks/03-setup-s3fs.yaml Normal file
View file

@ -0,0 +1,134 @@
---
# Stage 3: Setup S3FS on all servers
#
# This playbook sets up s3fs to mount S3 buckets as local filesystems.
# Must be run after Stage 2 (full deployment) to ensure Docker is installed.
#
# Mounts the following buckets:
# - asxpio-terraform-main -> /mnt/s3/terraform
# - asxpio-backups-main -> /mnt/s3/backups
# - asxpio-immich-main -> /mnt/s3/immich
#
# Cache sizes (per-host):
# - asxpio-ops (40GB disk): 10GB cache max
# - asxpio-services (160GB disk): 80GB cache max
#
# Usage:
# ansible-playbook playbooks/03-setup-s3fs.yaml
#
# IMPORTANT: Ensure S3 credentials are set in group_vars/all/vault.yaml:
# vault_s3_access_key: "your-access-key"
# vault_s3_secret_key: "your-secret-key"
#
- name: Setup S3FS on all servers
hosts: ops_servers,services_servers
become: true
gather_facts: true
pre_tasks:
- name: Validate S3 credentials are set
ansible.builtin.assert:
that:
- s3_access_key is defined
- s3_access_key != ""
- s3_secret_key is defined
- s3_secret_key != ""
fail_msg: |
S3 credentials not set!
Please set vault_s3_access_key and vault_s3_secret_key in:
- group_vars/all/vault.yaml (encrypted with ansible-vault)
OR
- Pass via command line: -e "s3_access_key=xxx s3_secret_key=yyy"
success_msg: "S3 credentials validated"
- name: Display S3 configuration
ansible.builtin.debug:
msg: |
========================================
S3FS Setup on {{ inventory_hostname }}
========================================
Target: {{ inventory_hostname }}
S3 Region: {{ s3_region }}
S3 Endpoint: {{ s3_endpoint }}
Buckets to mount:
{% for bucket in s3_buckets %}
- {{ bucket.name }} -> {{ bucket.mount_point }}
{% endfor %}
========================================
roles:
- role: s3fs
post_tasks:
- name: Display mounted filesystems
ansible.builtin.command:
cmd: df -h
register: df_output
changed_when: false
- name: Show S3 mounts
ansible.builtin.debug:
msg: "{{ df_output.stdout_lines | select('search', 's3fs') | list }}"
- name: Create immich library directory structure
ansible.builtin.file:
path: "{{ item }}"
state: directory
mode: '0775'
owner: root
group: docker
loop:
- /mnt/s3/immich/library
- /mnt/s3/immich/library/backups
- /mnt/s3/immich/library/encoded-video
- /mnt/s3/immich/library/library
- /mnt/s3/immich/library/profile
- /mnt/s3/immich/library/thumbs
- /mnt/s3/immich/library/upload
when: inventory_hostname in groups['services_servers']
- name: Display post-setup information
ansible.builtin.debug:
msg: |
========================================
S3FS Setup Complete on {{ inventory_hostname }}!
========================================
✅ All S3 buckets mounted successfully
Mount points:
{% for bucket in s3_buckets %}
- {{ bucket.mount_point }} ({{ bucket.name }})
{% endfor %}
Cache configuration:
- Location: /var/cache/s3fs
- Max size: ~{{ (40 - (s3fs_ensure_diskfree / 1024)) | int }}GB
- Free space reserved: {{ (s3fs_ensure_diskfree / 1024) | int }}GB
{% if inventory_hostname in groups['services_servers'] %}
Immich library structure created at:
/mnt/s3/immich/library/
├── backups/
├── encoded-video/
├── library/
├── profile/
├── thumbs/
└── upload/
Next steps for Immich migration:
1. Manually sync data from legacy server:
rsync -avz --info=progress2 \
asxpio-old:/srv/immich/library/ \
/mnt/s3/immich/library/
2. Backup Immich PostgreSQL database on legacy server:
docker exec immich_postgres pg_dumpall -U postgres | gzip > /tmp/immich-db.sql.gz
3. Deploy Immich service configured to use S3 storage:
IMMICH_MEDIA_LOCATION=/mnt/s3/immich/library
{% endif %}
========================================

226
ansible/playbooks/deploy-forgejo-runner-standalone.yaml Normal file
View file

@ -0,0 +1,226 @@
---
# Standalone Forgejo Runner Deployment
#
# PREREQUISITES:
# 1. Forgejo must be deployed and running
# 2. You must have created an admin account in Forgejo
# 3. You must generate a runner registration token from Forgejo UI
#
# To get the registration token:
# 1. Login to Forgejo as admin
# 2. Go to: Site Administration → Actions → Runners
# 3. Click "Create new Runner" or "Generate Token"
# 4. Copy the token and update forgejo_runner_token variable
#
# Usage:
# ansible-playbook playbooks/deploy-forgejo-runner-standalone.yaml
#
- name: Verify Forgejo is accessible
hosts: localhost
gather_facts: false
tasks:
- name: Check Forgejo is running
ansible.builtin.uri:
url: "http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}/"
status_code: 200
timeout: 10
register: forgejo_check
failed_when: false
delegate_to: localhost
- name: Display Forgejo status
ansible.builtin.debug:
msg: |
{% if forgejo_check.status == 200 %}
✅ Forgejo is accessible at http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
{% else %}
❌ ERROR: Cannot reach Forgejo!
Please ensure:
1. Forgejo is deployed and running
2. You can access: http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
3. You are connected to the VPC network or WireGuard VPN
Deploy Forgejo first:
ansible-playbook playbooks/02-full-deployment.yaml
Or deploy just Forgejo:
ansible-playbook playbooks/legacy/deploy-forgejo.yaml
{% endif %}
- name: Fail if Forgejo is not accessible
ansible.builtin.fail:
msg: "Forgejo is not accessible. Please deploy Forgejo first."
when: forgejo_check.status != 200
- name: Get runner registration token
hosts: localhost
gather_facts: false
tasks:
- name: Prompt for runner token configuration
ansible.builtin.pause:
prompt: |
========================================
Forgejo Runner Registration Token Required
========================================
Before deploying the runner, you MUST generate a registration token from Forgejo.
Steps to generate the token:
1. Open Forgejo: http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
2. Login as administrator
3. Navigate to: Site Administration → Actions → Runners
(Click your profile icon → Site Administration → Actions → Runners)
4. Click "Create new Runner" or "Generate registration token"
5. Copy the generated token (it looks like: "eyJhbGc...")
6. Update the token in one of these locations:
Option A - Plaintext (NOT RECOMMENDED):
Edit: inventory/group_vars/all.yaml
Set: forgejo_runner_token: "YOUR-TOKEN-HERE"
Option B - Ansible Vault (RECOMMENDED):
ansible-vault edit inventory/group_vars/vault.yaml
Set: vault_forgejo_runner_token: "YOUR-TOKEN-HERE"
Then in all.yaml: forgejo_runner_token: "{{ vault_forgejo_runner_token }}"
7. Save the file
8. Press ENTER to continue with runner deployment
Or press Ctrl+C to abort and configure the token first
========================================
- name: Deploy Forgejo CI/CD Runner
hosts: asxpio-services
become: true
gather_facts: true
pre_tasks:
- name: Verify runner token is configured
ansible.builtin.assert:
that:
- forgejo_runner_token is defined
- forgejo_runner_token | length > 0
- forgejo_runner_token != "REPLACE_WITH_ACTUAL_TOKEN"
- forgejo_runner_token != "***REDACTED***" # Old token from git
fail_msg: |
❌ ERROR: forgejo_runner_token is not properly configured!
Current value: {{ forgejo_runner_token | default('NOT SET') }}
You must set a valid runner registration token from Forgejo:
1. Get token from Forgejo UI:
Site Administration → Actions → Runners → Generate Token
2. Update in inventory/group_vars/all.yaml:
forgejo_runner_token: "YOUR-TOKEN-HERE"
OR better, use Ansible Vault (recommended):
ansible-vault edit inventory/group_vars/vault.yaml
vault_forgejo_runner_token: "YOUR-TOKEN-HERE"
3. Re-run this playbook
Aborting deployment...
success_msg: "✅ Runner token validated (length: {{ forgejo_runner_token | length }} chars)"
- name: Display deployment information
ansible.builtin.debug:
msg: |
========================================
Deploying Forgejo Runner
========================================
Target: {{ inventory_hostname }}
Forgejo instance: http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
Runner name: runner-{{ inventory_hostname }}
This will:
1. Deploy runner container
2. Register with Forgejo instance
3. Start accepting CI/CD jobs
========================================
roles:
- role: forgejo_runner
post_tasks:
- name: Wait for runner registration
ansible.builtin.pause:
seconds: 5
prompt: "Waiting for runner to register with Forgejo..."
- name: Display runner status
ansible.builtin.debug:
msg: |
========================================
Forgejo Runner Deployment Complete!
========================================
Runner deployed successfully on {{ inventory_hostname }}
Check status:
docker logs forgejo-runner
Verify in Forgejo UI:
1. Login to Forgejo
2. Go to: Site Administration → Actions → Runners
3. You should see: runner-{{ inventory_hostname }} (idle/active)
Test the runner:
1. Create a repository with .forgejo/workflows/test.yml
2. Push a commit
3. Check Actions tab for workflow run
Runner supports these labels:
- ubuntu-latest, ubuntu-22.04, ubuntu-24.04
- debian-latest, debian-12, debian-11
- node-20, node-22
- python-3.11, python-3.12
- alpine-latest, arch-latest
- nginx-latest, nginx-alpine
Example workflow:
.forgejo/workflows/test.yml:
---
name: Test
on: [push]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: echo "Hello from Forgejo Actions!"
========================================
- name: Verify runner in Forgejo
hosts: localhost
gather_facts: false
tasks:
- name: Reminder to check Forgejo UI
ansible.builtin.debug:
msg: |
⚠️ FINAL STEP: Verify runner in Forgejo UI
1. Open: http://{{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}
2. Login as admin
3. Go to: Site Administration → Actions → Runners
4. Verify runner-asxpio-services appears in the list
5. Status should be "idle" (green) or "active"
If the runner doesn't appear:
- Check logs: docker logs forgejo-runner
- Verify token is correct
- Ensure runner can reach Forgejo at {{ asxpio_ops_vpc_ip }}:{{ forgejo_http_port }}

6
ansible/playbooks/deploy-forgejo-runner.yaml
View file

@ -1,6 +0,0 @@
---
- name: Deploy Forgejo Runner
hosts: asxpio-services
become: true
roles:
- forgejo_runner

6
ansible/playbooks/deploy-forgejo.yaml
View file

@ -1,6 +0,0 @@
---
- name: Deploy Forgejo Git server
hosts: asxpio-ops
become: true
roles:
- forgejo

6
ansible/playbooks/deploy-traefik.yaml
View file

@ -1,6 +0,0 @@
---
- name: Deploy Traefik reverse proxy
hosts: asxpio-ops
become: true
roles:
- traefik

0
ansible/playbooks/backup-forgejo.yaml → ansible/playbooks/legacy/backup-forgejo.yaml
View file

0
ansible/playbooks/restore-forgejo.yaml → ansible/playbooks/legacy/restore-forgejo.yaml
View file

32
ansible/playbooks/setup-servers.yaml
View file

@ -1,32 +0,0 @@
---
# Main playbook for setting up asxpio servers
# Usage: ansible-playbook playbooks/setup-servers.yml
#
# NOTE: Cloud-init handles base system setup:
# - System packages (fail2ban, curl, htop, ncdu, tree, etc.)
# - User management (asxpi + deploy users with sudo and docker access)
# - SSH hardening (key-only auth, prohibit root password)
# - Docker installation (docker-ce, docker-ce-cli, containerd.io, docker-compose-plugin)
# - Bash prompt styling for asxpi user
# - Docker image pruning cron job
# - Directory structure creation
#
# This playbook handles post-cloud-init verification and additional configuration.
# Application deployment (Traefik, Forgejo, monitoring, etc.)
# will be handled via Forgejo Actions pipelines
- name: Setup asxpio infrastructure servers
hosts: asxpio
become: yes
gather_facts: yes
roles:
- common
post_tasks:
- name: Display server info
debug:
msg: |
Server {{ inventory_hostname }} post-cloud-init setup complete!
Role: {{ server_role }}
Next: Deploy services via Forgejo Actions pipelines

6
ansible/playbooks/ssh-harden.yaml
View file

@ -1,6 +0,0 @@
---
- name: Harden SSH configuration
hosts: asxpio:!old_servers
become: true
roles:
- ssh_hardening

59
ansible/playbooks/wireguard-client.yaml
View file

@ -1,59 +0,0 @@
---
- name: Deploy WireGuard client configuration
hosts: services_servers
become: true
vars:
# Map each server to its client config name
wireguard_client_configs:
asxpio-services: asxpio-services
tasks:
- name: Get client config name for this host
ansible.builtin.set_fact:
client_config_name: "{{ wireguard_client_configs[inventory_hostname] }}"
when: inventory_hostname in wireguard_client_configs
- name: Install WireGuard
ansible.builtin.apt:
name:
- wireguard
- wireguard-tools
state: present
update_cache: true
- name: Create WireGuard config directory
ansible.builtin.file:
path: /etc/wireguard
state: directory
mode: '0700'
owner: root
group: root
- name: Copy WireGuard client configuration
ansible.builtin.copy:
src: "../playbooks/wireguard-configs/asxpio-ops/{{ client_config_name }}.conf"
dest: "/etc/wireguard/{{ client_config_name }}.conf"
mode: '0600'
owner: root
group: root
when: client_config_name is defined
notify: restart wireguard client
- name: Enable WireGuard interface
ansible.builtin.systemd:
name: "wg-quick@{{ client_config_name }}"
enabled: true
when: client_config_name is defined
- name: Start WireGuard interface
ansible.builtin.systemd:
name: "wg-quick@{{ client_config_name }}"
state: started
when: client_config_name is defined
handlers:
- name: restart wireguard client
ansible.builtin.shell: |
wg-quick down {{ client_config_name }} || true
wg-quick up {{ client_config_name }}
args:
executable: /bin/bash

6
ansible/playbooks/wireguard.yaml
View file

@ -1,6 +0,0 @@
---
- name: Setup WireGuard VPN
hosts: ops_servers
become: true
roles:
- wireguard