60 lines
2.1 KiB
Markdown
60 lines
2.1 KiB
Markdown
# ASXP.IO Ansible Infrastructure
|
|
|
|
Automated deployment for asxpio servers: WireGuard VPN, SSH hardening, Traefik, Forgejo, and S3 storage.
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
# 1. Setup vault
|
|
echo "your-password" > .vault_pass && chmod 600 .vault_pass
|
|
./scripts/setup-vault.sh encrypt
|
|
|
|
# 2. Stage 1: WireGuard VPN
|
|
ansible-playbook playbooks/01-wireguard-setup.yaml
|
|
# Connect to VPN, update inventory/hosts.yaml to use WireGuard IPs
|
|
|
|
# 3. Stage 2: Full deployment (SSH hardening, Traefik, Forgejo, Runner)
|
|
ansible-playbook playbooks/02-full-deployment.yaml
|
|
|
|
# 4. Stage 3: S3 storage mounts
|
|
ansible-playbook playbooks/03-setup-s3fs.yaml
|
|
```
|
|
|
|
## Infrastructure
|
|
|
|
**Servers:**
|
|
- **asxpio-ops** (CX22): Forgejo, Traefik, WireGuard VPN hub
|
|
- **asxpio-services** (CX43): Forgejo Runner, Immich, game servers
|
|
|
|
**Networks:**
|
|
- VPC: 10.10.0.0/20
|
|
- WireGuard: 10.20.0.0/24
|
|
|
|
**S3 Buckets (mounted via s3fs):**
|
|
- asxpio-terraform-main → /mnt/s3/terraform
|
|
- asxpio-backups-main → /mnt/s3/backups
|
|
- asxpio-immich-main → /mnt/s3/immich
|
|
|
|
## Playbook Workflow
|
|
|
|
1. **WireGuard Setup** - Deploy VPN, generate client configs
|
|
2. **Full Deployment** - SSH hardening (no lockout), Traefik, Forgejo, Runner
|
|
3. **S3 Storage** - Mount S3 buckets with automatic cache management
|
|
|
|
All playbooks are idempotent - safe to rerun without breaking existing setup.
|
|
|
|
## Configuration Files
|
|
|
|
```
|
|
inventory/
|
|
├── hosts.yaml # Server inventory, IPs, groups
|
|
├── group_vars/all/ # Variables applied to all hosts
|
|
│ ├── main.yaml # Forgejo version, ports, runner config
|
|
│ ├── network.yaml # VPC (10.10.0.0/20), WireGuard (10.20.0.0/24) IPs
|
|
│ ├── services.yaml # Service paths (/opt/*), ports, Docker networks
|
|
│ ├── s3.yaml # S3 buckets, mount points, credentials reference
|
|
│ └── vault.yaml # ENCRYPTED: S3 keys, Forgejo secrets, runner token
|
|
└── host_vars/ # Host-specific overrides
|
|
├── asxpio-ops.yaml # WireGuard server, clients list, S3 cache: 10GB
|
|
└── asxpio-services.yaml # S3 cache: 80GB
|
|
```
|