256 lines
8 KiB
YAML
256 lines
8 KiB
YAML
---
|
|
# Stage 2: Full Infrastructure Deployment
|
|
#
|
|
# PREREQUISITES:
|
|
# 1. Stage 1 (01-wireguard-setup.yaml) must be completed
|
|
# 2. inventory/hosts.yaml must be updated to use WireGuard IPs (10.20.0.x)
|
|
# 3. You must be connected via WireGuard VPN
|
|
#
|
|
# This playbook deploys the complete infrastructure in one go:
|
|
# - SSH hardening (with connection recovery)
|
|
# - Traefik reverse proxy
|
|
# - Forgejo Git server
|
|
# - Forgejo CI/CD runner
|
|
#
|
|
# Usage:
|
|
# ansible-playbook playbooks/02-full-deployment.yaml
|
|
#
|
|
|
|
- name: Verify prerequisites
|
|
hosts: localhost
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Test WireGuard connectivity
|
|
ansible.builtin.wait_for:
|
|
host: "{{ asxpio_ops_wireguard_ip }}"
|
|
port: 22
|
|
timeout: 10
|
|
state: started
|
|
register: wg_test
|
|
failed_when: false
|
|
|
|
- name: Verify WireGuard is reachable
|
|
ansible.builtin.assert:
|
|
that:
|
|
- not wg_test.failed
|
|
fail_msg: |
|
|
❌ ERROR: Cannot reach servers via WireGuard!
|
|
|
|
Tested: {{ asxpio_ops_wireguard_ip }}:22
|
|
Result: Connection failed
|
|
|
|
Stage 2 automatically uses WireGuard IPs and REQUIRES an active VPN connection.
|
|
|
|
To fix:
|
|
1. Ensure Stage 1 is complete:
|
|
ansible-playbook playbooks/01-wireguard-setup.yaml
|
|
|
|
2. Import WireGuard config:
|
|
playbooks/wireguard-configs/<hostname>/<client>.conf
|
|
|
|
3. Start WireGuard:
|
|
- Linux/Mac: sudo wg-quick up <config>.conf
|
|
- Windows: Import in WireGuard GUI and activate
|
|
|
|
4. Test connectivity:
|
|
ping {{ asxpio_ops_wireguard_ip }}
|
|
ping {{ asxpio_services_wireguard_ip }}
|
|
|
|
5. Re-run this playbook
|
|
|
|
Aborting deployment for safety...
|
|
success_msg: "✅ WireGuard connectivity verified"
|
|
|
|
- name: Display pre-deployment checklist
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
========================================
|
|
Pre-Deployment Checklist
|
|
========================================
|
|
|
|
✅ WireGuard connectivity verified
|
|
✅ Ready for deployment
|
|
|
|
This playbook will:
|
|
1. Verify common setup
|
|
2. Harden SSH (will restrict access to WireGuard/VPC only)
|
|
3. Deploy Traefik reverse proxy
|
|
4. Deploy Forgejo Git server
|
|
5. Deploy Forgejo CI/CD runner (requires manual token setup)
|
|
|
|
⚠️ IMPORTANT: This playbook uses WireGuard IPs automatically.
|
|
After SSH hardening, you will ONLY be able to
|
|
access servers via WireGuard VPN!
|
|
|
|
========================================
|
|
|
|
- name: Pause for confirmation
|
|
ansible.builtin.pause:
|
|
prompt: "Press ENTER to continue or Ctrl+C to abort"
|
|
|
|
- name: Harden SSH configuration
|
|
hosts: asxpio
|
|
become: true
|
|
gather_facts: true
|
|
vars:
|
|
# Force WireGuard IPs for Stage 2 (SSH hardening requires it)
|
|
ansible_host: "{{ wireguard_ip }}"
|
|
|
|
pre_tasks:
|
|
- name: Display SSH hardening notice
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
========================================
|
|
SSH Hardening - {{ inventory_hostname }}
|
|
========================================
|
|
|
|
SSH will be restarted asynchronously.
|
|
Connection may drop briefly but will automatically recover.
|
|
|
|
Trusted networks:
|
|
- WireGuard: {{ wireguard_network }}
|
|
- VPC: {{ vpc_network }}
|
|
========================================
|
|
|
|
roles:
|
|
- role: ssh_hardening
|
|
|
|
post_tasks:
|
|
- name: Verify SSH connection after hardening
|
|
ansible.builtin.debug:
|
|
msg: "SSH hardening complete and connection verified on {{ inventory_hostname }}"
|
|
|
|
- name: Deploy Traefik reverse proxy
|
|
hosts: asxpio-ops
|
|
become: true
|
|
gather_facts: true
|
|
vars:
|
|
# Force WireGuard IPs for Stage 2
|
|
ansible_host: "{{ wireguard_ip }}"
|
|
|
|
roles:
|
|
- role: traefik
|
|
|
|
post_tasks:
|
|
- name: Display Traefik status
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
Traefik deployed successfully on {{ inventory_hostname }}
|
|
Dashboard: http://{{ asxpio_ops_wireguard_ip }}:{{ traefik_dashboard_port }}
|
|
|
|
- name: Deploy Forgejo Git server
|
|
hosts: asxpio-ops
|
|
become: true
|
|
gather_facts: true
|
|
vars:
|
|
# Force WireGuard IPs for Stage 2
|
|
ansible_host: "{{ wireguard_ip }}"
|
|
|
|
roles:
|
|
- role: forgejo
|
|
|
|
post_tasks:
|
|
- name: Display Forgejo status
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
Forgejo deployed successfully on {{ inventory_hostname }}
|
|
Web UI: http://{{ asxpio_ops_wireguard_ip }}:{{ forgejo_http_port }}
|
|
SSH: ssh://git@{{ asxpio_ops_wireguard_ip }}
|
|
|
|
⚠️ IMPORTANT: Before deploying the runner, you must:
|
|
1. Access Forgejo web UI
|
|
2. Complete initial setup (create admin user)
|
|
3. Go to: Site Administration → Actions → Runners
|
|
4. Generate a runner registration token
|
|
5. Update forgejo_runner_token in inventory/group_vars/all.yaml (or vault)
|
|
|
|
- name: Pause for Forgejo runner token generation
|
|
ansible.builtin.pause:
|
|
prompt: |
|
|
|
|
========================================
|
|
Forgejo Runner Registration Token Required
|
|
========================================
|
|
|
|
The runner cannot be deployed without a registration token from Forgejo.
|
|
|
|
Steps to generate the token:
|
|
1. Open Forgejo: http://{{ asxpio_ops_wireguard_ip }}:{{ forgejo_http_port }}
|
|
2. Complete initial setup if not done (create admin account)
|
|
3. Login as admin
|
|
4. Navigate to: Site Administration → Actions → Runners
|
|
5. Click "Create new Runner" or "Generate Token"
|
|
6. Copy the registration token
|
|
7. Update forgejo_runner_token in inventory/group_vars/all.yaml
|
|
OR better: ansible-vault edit inventory/group_vars/vault.yaml
|
|
|
|
Press ENTER when ready to continue with runner deployment, or Ctrl+C to abort
|
|
========================================
|
|
|
|
- name: Deploy Forgejo CI/CD Runner
|
|
hosts: asxpio-services
|
|
become: true
|
|
gather_facts: true
|
|
vars:
|
|
# Force WireGuard IPs for Stage 2
|
|
ansible_host: "{{ wireguard_ip }}"
|
|
|
|
pre_tasks:
|
|
- name: Verify runner token is configured
|
|
ansible.builtin.assert:
|
|
that:
|
|
- forgejo_runner_token is defined
|
|
- forgejo_runner_token | length > 0
|
|
- forgejo_runner_token != "REPLACE_WITH_ACTUAL_TOKEN"
|
|
fail_msg: |
|
|
ERROR: forgejo_runner_token is not properly configured!
|
|
|
|
You must set a valid runner registration token from Forgejo:
|
|
1. Get token from: Site Administration → Actions → Runners
|
|
2. Set in inventory/group_vars/all.yaml or vault.yaml
|
|
3. Re-run this playbook
|
|
success_msg: "Runner token validated"
|
|
|
|
roles:
|
|
- role: forgejo_runner
|
|
|
|
post_tasks:
|
|
- name: Display runner status
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
Forgejo Runner deployed successfully on {{ inventory_hostname }}
|
|
Check status: docker logs forgejo-runner
|
|
|
|
- name: Display deployment summary
|
|
hosts: localhost
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Show final status
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
========================================
|
|
Full Infrastructure Deployment Complete!
|
|
========================================
|
|
|
|
Services deployed:
|
|
|
|
Traefik (asxpio-services):
|
|
- Dashboard: http://{{ asxpio_services_wireguard_ip }}:8080
|
|
|
|
Forgejo (asxpio-ops):
|
|
- Web UI: http://{{ asxpio_ops_wireguard_ip }}:3000
|
|
- Git SSH: ssh://git@{{ asxpio_ops_wireguard_ip }}:2222
|
|
|
|
Forgejo Runner (asxpio-services):
|
|
- Status: docker logs forgejo-runner
|
|
|
|
SSH Access:
|
|
- Restricted to WireGuard (10.20.0.0/24) and VPC (10.10.0.0/20)
|
|
- Connect via WireGuard VPN to access servers
|
|
|
|
Next steps:
|
|
- Configure Forgejo admin account
|
|
- Set up repositories
|
|
- Test CI/CD pipeline
|
|
|
|
========================================
|