asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
iac/ansible/README.md
Sergei Poljanski eecff4345a ansible rework
2025-11-04 11:06:35 +02:00

2.1 KiB
Raw Blame History

ASXP.IO Ansible Infrastructure

Automated deployment for asxpio servers: WireGuard VPN, SSH hardening, Traefik, Forgejo, and S3 storage.

Quick Start

# 1. Setup vault
echo "your-password" > .vault_pass && chmod 600 .vault_pass
./scripts/setup-vault.sh encrypt

# 2. Stage 1: WireGuard VPN
ansible-playbook playbooks/01-wireguard-setup.yaml
# Connect to VPN, update inventory/hosts.yaml to use WireGuard IPs

# 3. Stage 2: Full deployment (SSH hardening, Traefik, Forgejo, Runner)
ansible-playbook playbooks/02-full-deployment.yaml

# 4. Stage 3: S3 storage mounts
ansible-playbook playbooks/03-setup-s3fs.yaml

Infrastructure

Servers:

  • asxpio-ops (CX22): Forgejo, Traefik, WireGuard VPN hub
  • asxpio-services (CX43): Forgejo Runner, Immich, game servers

Networks:

  • VPC: 10.10.0.0/20
  • WireGuard: 10.20.0.0/24

S3 Buckets (mounted via s3fs):

  • asxpio-terraform-main → /mnt/s3/terraform
  • asxpio-backups-main → /mnt/s3/backups
  • asxpio-immich-main → /mnt/s3/immich

Playbook Workflow

  1. WireGuard Setup - Deploy VPN, generate client configs
  2. Full Deployment - SSH hardening (no lockout), Traefik, Forgejo, Runner
  3. S3 Storage - Mount S3 buckets with automatic cache management

All playbooks are idempotent - safe to rerun without breaking existing setup.

Configuration Files

inventory/
├── hosts.yaml                      # Server inventory, IPs, groups
├── group_vars/all/                 # Variables applied to all hosts
│   ├── main.yaml                   # Forgejo version, ports, runner config
│   ├── network.yaml                # VPC (10.10.0.0/20), WireGuard (10.20.0.0/24) IPs
│   ├── services.yaml               # Service paths (/opt/*), ports, Docker networks
│   ├── s3.yaml                     # S3 buckets, mount points, credentials reference
│   └── vault.yaml                  # ENCRYPTED: S3 keys, Forgejo secrets, runner token
└── host_vars/                      # Host-specific overrides
    ├── asxpio-ops.yaml             # WireGuard server, clients list, S3 cache: 10GB
    └── asxpio-services.yaml        # S3 cache: 80GB