asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
iac/ansible
History
Sergei Poljanski 63bd67a86d ci: deploy site.yaml from Forgejo Actions 
Service changes were made by hand on the servers, which is how the
repository drifted. Apply site.yaml from a workflow instead: every
push dry-runs it against production, and a push to main applies it.

Jobs run in containers on asxpio-services. asxpio-ops is reached over
the private network; the services host is reached through asxpio-ops,
because a container connecting to its own host arrives from a Docker
bridge address that sshd and the firewall refuse. Host keys are pinned
in known_hosts.

Ansible comes from a pinned nixpkgs revision so every run uses the
same version.

Assisted-by: Claude:fable-5-2
2026-11-12 06:47:09 +04:00
..
inventory ci: deploy site.yaml from Forgejo Actions 2026-11-12 06:47:09 +04:00
playbooks ansible: describe what runs on the servers 2026-11-12 06:47:08 +04:00
roles ansible: describe what runs on the servers 2026-11-12 06:47:08 +04:00
.gitignore ansible cleanup 2025-11-04 14:23:16 +02:00
ansible.cfg ansible rework 2025-11-04 11:06:35 +02:00
known_hosts ci: deploy site.yaml from Forgejo Actions 2026-11-12 06:47:09 +04:00
README.md ansible rework 2025-11-04 11:06:35 +02:00
site.yaml ansible: describe what runs on the servers 2026-11-12 06:47:08 +04:00

README.md

ASXP.IO Ansible Infrastructure

Automated deployment for asxpio servers: WireGuard VPN, SSH hardening, Traefik, Forgejo, and S3 storage.

Quick Start

# 1. Setup vault
echo "your-password" > .vault_pass && chmod 600 .vault_pass
./scripts/setup-vault.sh encrypt

# 2. Stage 1: WireGuard VPN
ansible-playbook playbooks/01-wireguard-setup.yaml
# Connect to VPN, update inventory/hosts.yaml to use WireGuard IPs

# 3. Stage 2: Full deployment (SSH hardening, Traefik, Forgejo, Runner)
ansible-playbook playbooks/02-full-deployment.yaml

# 4. Stage 3: S3 storage mounts
ansible-playbook playbooks/03-setup-s3fs.yaml

Infrastructure

Servers:

  • asxpio-ops (CX22): Forgejo, Traefik, WireGuard VPN hub
  • asxpio-services (CX43): Forgejo Runner, Immich, game servers

Networks:

  • VPC: 10.10.0.0/20
  • WireGuard: 10.20.0.0/24

S3 Buckets (mounted via s3fs):

  • asxpio-terraform-main → /mnt/s3/terraform
  • asxpio-backups-main → /mnt/s3/backups
  • asxpio-immich-main → /mnt/s3/immich

Playbook Workflow

  1. WireGuard Setup - Deploy VPN, generate client configs
  2. Full Deployment - SSH hardening (no lockout), Traefik, Forgejo, Runner
  3. S3 Storage - Mount S3 buckets with automatic cache management

All playbooks are idempotent - safe to rerun without breaking existing setup.

Configuration Files

inventory/
├── hosts.yaml                      # Server inventory, IPs, groups
├── group_vars/all/                 # Variables applied to all hosts
│   ├── main.yaml                   # Forgejo version, ports, runner config
│   ├── network.yaml                # VPC (10.10.0.0/20), WireGuard (10.20.0.0/24) IPs
│   ├── services.yaml               # Service paths (/opt/*), ports, Docker networks
│   ├── s3.yaml                     # S3 buckets, mount points, credentials reference
│   └── vault.yaml                  # ENCRYPTED: S3 keys, Forgejo secrets, runner token
└── host_vars/                      # Host-specific overrides
    ├── asxpio-ops.yaml             # WireGuard server, clients list, S3 cache: 10GB
    └── asxpio-services.yaml        # S3 cache: 80GB