asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
iac/ansible
History
Sergei Poljanski 66ab6d8db3 s3fs: allow turning the mounts off, off on asxpio-ops 
On the 38 GB ops disk the s3fs cache reserve (ensure_diskfree) never
fit, so all three mounts failed at every boot since 2026-09-22. Backups
now go to Hetzner S3 with rclone instead.

Add s3fs_enabled (default true); when false the role unmounts the
buckets and drops their fstab entries, keeping the credentials file
that the rclone wrapper reads.

Assisted-by: Claude:opus-5
2026-10-12 05:03:11 +04:00
..
inventory s3fs: allow turning the mounts off, off on asxpio-ops 2026-10-12 05:03:11 +04:00
playbooks ssh: add user zerrtika 2026-08-13 07:04:04 +04:00
roles s3fs: allow turning the mounts off, off on asxpio-ops 2026-10-12 05:03:11 +04:00
.gitignore ansible cleanup 2025-11-04 14:23:16 +02:00
ansible.cfg ansible rework 2025-11-04 11:06:35 +02:00
README.md ansible rework 2025-11-04 11:06:35 +02:00

README.md

ASXP.IO Ansible Infrastructure

Automated deployment for asxpio servers: WireGuard VPN, SSH hardening, Traefik, Forgejo, and S3 storage.

Quick Start

# 1. Setup vault
echo "your-password" > .vault_pass && chmod 600 .vault_pass
./scripts/setup-vault.sh encrypt

# 2. Stage 1: WireGuard VPN
ansible-playbook playbooks/01-wireguard-setup.yaml
# Connect to VPN, update inventory/hosts.yaml to use WireGuard IPs

# 3. Stage 2: Full deployment (SSH hardening, Traefik, Forgejo, Runner)
ansible-playbook playbooks/02-full-deployment.yaml

# 4. Stage 3: S3 storage mounts
ansible-playbook playbooks/03-setup-s3fs.yaml

Infrastructure

Servers:

  • asxpio-ops (CX22): Forgejo, Traefik, WireGuard VPN hub
  • asxpio-services (CX43): Forgejo Runner, Immich, game servers

Networks:

  • VPC: 10.10.0.0/20
  • WireGuard: 10.20.0.0/24

S3 Buckets (mounted via s3fs):

  • asxpio-terraform-main → /mnt/s3/terraform
  • asxpio-backups-main → /mnt/s3/backups
  • asxpio-immich-main → /mnt/s3/immich

Playbook Workflow

  1. WireGuard Setup - Deploy VPN, generate client configs
  2. Full Deployment - SSH hardening (no lockout), Traefik, Forgejo, Runner
  3. S3 Storage - Mount S3 buckets with automatic cache management

All playbooks are idempotent - safe to rerun without breaking existing setup.

Configuration Files

inventory/
├── hosts.yaml                      # Server inventory, IPs, groups
├── group_vars/all/                 # Variables applied to all hosts
│   ├── main.yaml                   # Forgejo version, ports, runner config
│   ├── network.yaml                # VPC (10.10.0.0/20), WireGuard (10.20.0.0/24) IPs
│   ├── services.yaml               # Service paths (/opt/*), ports, Docker networks
│   ├── s3.yaml                     # S3 buckets, mount points, credentials reference
│   └── vault.yaml                  # ENCRYPTED: S3 keys, Forgejo secrets, runner token
└── host_vars/                      # Host-specific overrides
    ├── asxpio-ops.yaml             # WireGuard server, clients list, S3 cache: 10GB
    └── asxpio-services.yaml        # S3 cache: 80GB