ansible rework
This commit is contained in:
parent
67414814c0
commit
eecff4345a
47 changed files with 1995 additions and 538 deletions
272
ansible/playbooks/02-full-deployment.yaml
Normal file
272
ansible/playbooks/02-full-deployment.yaml
Normal file
|
|
@ -0,0 +1,272 @@
|
|||
---
|
||||
# Stage 2: Full Infrastructure Deployment
|
||||
#
|
||||
# PREREQUISITES:
|
||||
# 1. Stage 1 (01-wireguard-setup.yaml) must be completed
|
||||
# 2. inventory/hosts.yaml must be updated to use WireGuard IPs (10.20.0.x)
|
||||
# 3. You must be connected via WireGuard VPN
|
||||
#
|
||||
# This playbook deploys the complete infrastructure in one go:
|
||||
# - SSH hardening (with connection recovery)
|
||||
# - Traefik reverse proxy
|
||||
# - Forgejo Git server
|
||||
# - Forgejo CI/CD runner
|
||||
#
|
||||
# Usage:
|
||||
# ansible-playbook playbooks/02-full-deployment.yaml
|
||||
#
|
||||
|
||||
- name: Verify prerequisites
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Test WireGuard connectivity
|
||||
ansible.builtin.wait_for:
|
||||
host: "{{ asxpio_ops_wireguard_ip }}"
|
||||
port: 22
|
||||
timeout: 10
|
||||
state: started
|
||||
register: wg_test
|
||||
failed_when: false
|
||||
|
||||
- name: Verify WireGuard is reachable
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- not wg_test.failed
|
||||
fail_msg: |
|
||||
❌ ERROR: Cannot reach servers via WireGuard!
|
||||
|
||||
Tested: {{ asxpio_ops_wireguard_ip }}:22
|
||||
Result: Connection failed
|
||||
|
||||
Stage 2 automatically uses WireGuard IPs and REQUIRES an active VPN connection.
|
||||
|
||||
To fix:
|
||||
1. Ensure Stage 1 is complete:
|
||||
ansible-playbook playbooks/01-wireguard-setup.yaml
|
||||
|
||||
2. Import WireGuard config:
|
||||
playbooks/wireguard-configs/<hostname>/<client>.conf
|
||||
|
||||
3. Start WireGuard:
|
||||
- Linux/Mac: sudo wg-quick up <config>.conf
|
||||
- Windows: Import in WireGuard GUI and activate
|
||||
|
||||
4. Test connectivity:
|
||||
ping {{ asxpio_ops_wireguard_ip }}
|
||||
ping {{ asxpio_services_wireguard_ip }}
|
||||
|
||||
5. Re-run this playbook
|
||||
|
||||
Aborting deployment for safety...
|
||||
success_msg: "✅ WireGuard connectivity verified"
|
||||
|
||||
- name: Display pre-deployment checklist
|
||||
ansible.builtin.debug:
|
||||
msg: |
|
||||
========================================
|
||||
Pre-Deployment Checklist
|
||||
========================================
|
||||
|
||||
✅ WireGuard connectivity verified
|
||||
✅ Ready for deployment
|
||||
|
||||
This playbook will:
|
||||
1. Verify common setup
|
||||
2. Harden SSH (will restrict access to WireGuard/VPC only)
|
||||
3. Deploy Traefik reverse proxy
|
||||
4. Deploy Forgejo Git server
|
||||
5. Deploy Forgejo CI/CD runner (requires manual token setup)
|
||||
|
||||
⚠️ IMPORTANT: This playbook uses WireGuard IPs automatically.
|
||||
After SSH hardening, you will ONLY be able to
|
||||
access servers via WireGuard VPN!
|
||||
|
||||
========================================
|
||||
|
||||
- name: Pause for confirmation
|
||||
ansible.builtin.pause:
|
||||
prompt: "Press ENTER to continue or Ctrl+C to abort"
|
||||
|
||||
- name: Common setup verification
|
||||
hosts: asxpio:!old_servers
|
||||
become: true
|
||||
gather_facts: true
|
||||
vars:
|
||||
# Force WireGuard IPs for Stage 2 (SSH hardening requires it)
|
||||
ansible_host: "{{ wireguard_ip }}"
|
||||
|
||||
roles:
|
||||
- role: common
|
||||
|
||||
post_tasks:
|
||||
- name: Display setup status
|
||||
ansible.builtin.debug:
|
||||
msg: "Common setup verified on {{ inventory_hostname }}"
|
||||
|
||||
- name: Harden SSH configuration
|
||||
hosts: asxpio:!old_servers
|
||||
become: true
|
||||
gather_facts: true
|
||||
vars:
|
||||
# Force WireGuard IPs for Stage 2 (SSH hardening requires it)
|
||||
ansible_host: "{{ wireguard_ip }}"
|
||||
|
||||
pre_tasks:
|
||||
- name: Display SSH hardening notice
|
||||
ansible.builtin.debug:
|
||||
msg: |
|
||||
========================================
|
||||
SSH Hardening - {{ inventory_hostname }}
|
||||
========================================
|
||||
|
||||
SSH will be restarted asynchronously.
|
||||
Connection may drop briefly but will automatically recover.
|
||||
|
||||
Trusted networks:
|
||||
- WireGuard: {{ wireguard_network }}
|
||||
- VPC: {{ vpc_network }}
|
||||
========================================
|
||||
|
||||
roles:
|
||||
- role: ssh_hardening
|
||||
|
||||
post_tasks:
|
||||
- name: Verify SSH connection after hardening
|
||||
ansible.builtin.debug:
|
||||
msg: "SSH hardening complete and connection verified on {{ inventory_hostname }}"
|
||||
|
||||
- name: Deploy Traefik reverse proxy
|
||||
hosts: asxpio-ops
|
||||
become: true
|
||||
gather_facts: true
|
||||
vars:
|
||||
# Force WireGuard IPs for Stage 2
|
||||
ansible_host: "{{ wireguard_ip }}"
|
||||
|
||||
roles:
|
||||
- role: traefik
|
||||
|
||||
post_tasks:
|
||||
- name: Display Traefik status
|
||||
ansible.builtin.debug:
|
||||
msg: |
|
||||
Traefik deployed successfully on {{ inventory_hostname }}
|
||||
Dashboard: http://{{ asxpio_ops_wireguard_ip }}:{{ traefik_dashboard_port }}
|
||||
|
||||
- name: Deploy Forgejo Git server
|
||||
hosts: asxpio-ops
|
||||
become: true
|
||||
gather_facts: true
|
||||
vars:
|
||||
# Force WireGuard IPs for Stage 2
|
||||
ansible_host: "{{ wireguard_ip }}"
|
||||
|
||||
roles:
|
||||
- role: forgejo
|
||||
|
||||
post_tasks:
|
||||
- name: Display Forgejo status
|
||||
ansible.builtin.debug:
|
||||
msg: |
|
||||
Forgejo deployed successfully on {{ inventory_hostname }}
|
||||
Web UI: http://{{ asxpio_ops_wireguard_ip }}:{{ forgejo_http_port }}
|
||||
SSH: ssh://git@{{ asxpio_ops_wireguard_ip }}:{{ forgejo_ssh_port }}
|
||||
|
||||
⚠️ IMPORTANT: Before deploying the runner, you must:
|
||||
1. Access Forgejo web UI
|
||||
2. Complete initial setup (create admin user)
|
||||
3. Go to: Site Administration → Actions → Runners
|
||||
4. Generate a runner registration token
|
||||
5. Update forgejo_runner_token in inventory/group_vars/all.yaml (or vault)
|
||||
|
||||
- name: Pause for Forgejo runner token generation
|
||||
ansible.builtin.pause:
|
||||
prompt: |
|
||||
|
||||
========================================
|
||||
Forgejo Runner Registration Token Required
|
||||
========================================
|
||||
|
||||
The runner cannot be deployed without a registration token from Forgejo.
|
||||
|
||||
Steps to generate the token:
|
||||
1. Open Forgejo: http://{{ asxpio_ops_wireguard_ip }}:{{ forgejo_http_port }}
|
||||
2. Complete initial setup if not done (create admin account)
|
||||
3. Login as admin
|
||||
4. Navigate to: Site Administration → Actions → Runners
|
||||
5. Click "Create new Runner" or "Generate Token"
|
||||
6. Copy the registration token
|
||||
7. Update forgejo_runner_token in inventory/group_vars/all.yaml
|
||||
OR better: ansible-vault edit inventory/group_vars/vault.yaml
|
||||
|
||||
Press ENTER when ready to continue with runner deployment, or Ctrl+C to abort
|
||||
========================================
|
||||
|
||||
- name: Deploy Forgejo CI/CD Runner
|
||||
hosts: asxpio-services
|
||||
become: true
|
||||
gather_facts: true
|
||||
vars:
|
||||
# Force WireGuard IPs for Stage 2
|
||||
ansible_host: "{{ wireguard_ip }}"
|
||||
|
||||
pre_tasks:
|
||||
- name: Verify runner token is configured
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- forgejo_runner_token is defined
|
||||
- forgejo_runner_token | length > 0
|
||||
- forgejo_runner_token != "REPLACE_WITH_ACTUAL_TOKEN"
|
||||
fail_msg: |
|
||||
ERROR: forgejo_runner_token is not properly configured!
|
||||
|
||||
You must set a valid runner registration token from Forgejo:
|
||||
1. Get token from: Site Administration → Actions → Runners
|
||||
2. Set in inventory/group_vars/all.yaml or vault.yaml
|
||||
3. Re-run this playbook
|
||||
success_msg: "Runner token validated"
|
||||
|
||||
roles:
|
||||
- role: forgejo_runner
|
||||
|
||||
post_tasks:
|
||||
- name: Display runner status
|
||||
ansible.builtin.debug:
|
||||
msg: |
|
||||
Forgejo Runner deployed successfully on {{ inventory_hostname }}
|
||||
Check status: docker logs forgejo-runner
|
||||
|
||||
- name: Display deployment summary
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Show final status
|
||||
ansible.builtin.debug:
|
||||
msg: |
|
||||
========================================
|
||||
Full Infrastructure Deployment Complete!
|
||||
========================================
|
||||
|
||||
Services deployed:
|
||||
|
||||
Traefik (asxpio-services):
|
||||
- Dashboard: http://{{ asxpio_services_wireguard_ip }}:8080
|
||||
|
||||
Forgejo (asxpio-ops):
|
||||
- Web UI: http://{{ asxpio_ops_wireguard_ip }}:3000
|
||||
- Git SSH: ssh://git@{{ asxpio_ops_wireguard_ip }}:2222
|
||||
|
||||
Forgejo Runner (asxpio-services):
|
||||
- Status: docker logs forgejo-runner
|
||||
|
||||
SSH Access:
|
||||
- Restricted to WireGuard (10.20.0.0/24) and VPC (10.10.0.0/20)
|
||||
- Connect via WireGuard VPN to access servers
|
||||
|
||||
Next steps:
|
||||
- Configure Forgejo admin account
|
||||
- Set up repositories
|
||||
- Test CI/CD pipeline
|
||||
|
||||
========================================
|
||||
Loading…
Add table
Add a link
Reference in a new issue