diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg
index b6cbd19..bd60647 100644
--- a/ansible/ansible.cfg
+++ b/ansible/ansible.cfg
@@ -444,7 +444,7 @@ interpreter_python=auto_silent
;become_ask_pass=False
# (string) executable to use for privilege escalation, otherwise Ansible will depend on PATH.
-;become_exe=
+;become_exe=sudo.ws
# (string) Flags to pass to the privilege escalation executable.
;become_flags=
diff --git a/ansible/inventories/distributed.yaml b/ansible/inventories/distributed.yaml
index b246ad1..56ef2b6 100644
--- a/ansible/inventories/distributed.yaml
+++ b/ansible/inventories/distributed.yaml
@@ -1,7 +1,31 @@
---
+new_sudo:
+ hosts:
+ hserve1:
+ hserve2:
+ mini1:
+
+
+
distributed:
children:
pangolin:
hosts:
- mini1:
+ edge1:
ansible_host: 172.104.128.23
+ authentik:
+ hosts:
+ mini1:
+ ansible_host: 192.168.1.66
+ nextcloud:
+ hosts:
+ hserve2:
+ ansible_host: 192.168.1.0
+ nginx:
+ hosts:
+ hserve1:
+ ansible_host: 192.168.1.142
+ forgejo:
+ hosts:
+ hserve1:
+
diff --git a/ansible/inventories/group_vars/all/bootstrap_info.yaml b/ansible/inventories/group_vars/all/bootstrap_info.yaml
index 6b9cc34..79a7b55 100644
--- a/ansible/inventories/group_vars/all/bootstrap_info.yaml
+++ b/ansible/inventories/group_vars/all/bootstrap_info.yaml
@@ -1,5 +1,8 @@
---
ansible_user: ansible
+ansible_group: ansible
+ansible_user_uid: 1100
+ansible_group_uid: 1100
to_set_authorized_keys:
- label: hassallah
key: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArNhKFcJ6T08sn7kTTLf+rO9HEvgOvqfhv5HQ2sRf2tFYfjfCb0zHKnMkgW+sy5gMU10Lyx1r7juXCvqRC955uIM97m1B1Xc6sVqASVKuGPhCKfhxEaMAyBcWFdE+HYbCOPYVN+JMrcwWfbblwiZTtK1OCqaEUvDDI7cFeU68noXwggEp46T48eqMUdi541D9Y+BVx9HYAo6OCQz0+6eXwxJL+tpRcAAXIMMWv362CYHoOgIU45R7xVSMLY1k/HLrcEAblwxEaSpduCH5cWUXZE/56IyxpvP44BxZkVhNdqJLmg4hxBQWhoMNYiTZxbLay3W2TwBCM111cAtUx4M/jQ=="
diff --git a/ansible/inventories/group_vars/all/docker_vars.yaml b/ansible/inventories/group_vars/all/docker_vars.yaml
new file mode 100644
index 0000000..2dc0414
--- /dev/null
+++ b/ansible/inventories/group_vars/all/docker_vars.yaml
@@ -0,0 +1,3 @@
+---
+docker_users:
+ - "{{ ansible_user }}"
\ No newline at end of file
diff --git a/ansible/inventories/group_vars/all/pangolin_info.yaml b/ansible/inventories/group_vars/all/pangolin_info.yaml
new file mode 100644
index 0000000..62669f1
--- /dev/null
+++ b/ansible/inventories/group_vars/all/pangolin_info.yaml
@@ -0,0 +1,3 @@
+---
+pangolin_secret: "{{ pangolin_crypted_secret }}"
+base_domain: "hassallab.it"
\ No newline at end of file
diff --git a/ansible/inventories/group_vars/all/vault.yaml b/ansible/inventories/group_vars/all/vault.yaml
index 6178444..8dd5674 100644
--- a/ansible/inventories/group_vars/all/vault.yaml
+++ b/ansible/inventories/group_vars/all/vault.yaml
@@ -1,15 +1,29 @@
$ANSIBLE_VAULT;1.1;AES256
-35316234643930663465333664613362323061613838343333313331636366616163366162303165
-3565383837343936306536633765616638646437356562630a396536396664303736303965383863
-64383632386534316230366337633462613336666636633138626438336163373138616363323835
-3137666361653932390a393432313565323939356232376430393762336136613762363036343961
-36613462636630626430303636613130346533336534386165633232326238366134376233613466
-35613338333035623237303336653137333133666234643466643166633636343234616430346130
-31643238653833663761326262626536636537666162653863363934363165323134646564653736
-65663334363037636266383930356664356531356664303261333539636462356533396634616130
-63336431376532323630323531386437313639393639353332393061633764613030613261393862
-36373738613136663165623834376462356139353932626364366164643038323665346639346462
-30356166343639653632313833333565393436633733346136653538663235636333383333313533
-31306634366535306464313738356662646130363662653062366635333837666464633330393038
-31376561323264633063616530656661396331353165626135366462373663346333373131396535
-6430326664303432393137353864366339366639643332356134
+38356639333633663161333637663539623835623666653738333235336563373030653036393837
+3235613032363938623938303463333562656561316636660a626532363638396138613637323265
+66663562366431333139616134333039323737356437393031643463363362363335636464333162
+3430353964646133660a666234613262396464363134313935383661393438616237633961643233
+31646435326336353130323139323961343561646137636332333139643033303664333035663538
+30346138613061616432656431613437306462666432646239373236323633346131663431366564
+66663031353366663766663330346633306233653033626134343738303937393934393936646533
+63613338323631366537353531356538643738393562346161666566393639363138663832306639
+32336433643134323433633433376137363834353763643834393530356536316565653831616165
+32306661353761643139343838313535333365646265613537626533346338333239626137363533
+39323930636336396134313561346463313662333734643536366433663030393130646366396564
+66656335353138376638353939316263306633613563663465636366353437333536353731326562
+66313862373830383736323330616236643066393032353961643166663935333966386562646335
+62616634363964333062306637656331396339643662663132623533636663313962376266353137
+30663131326365613635616234616138366236303938386536346633393839393732653964316636
+36626262663463306434386332353166313162356365643866393638663564343161643430373937
+37336233396632316537626465323866373463306565633835363263616362653266303364373835
+30386163626239356333353232343662643438353965346335613937346366386331343965343738
+32633732366161653834663766326536343065613463643263333065396532356635376362336335
+36386339343832623664323732363638616632363964373732336565636161396237333934353931
+66656339653731343534666635663331336238646561353664323438356339343164353531303362
+38333535333064386562346234656232653938316337343163616361633834656234333036393932
+37303539663032363134613335663937363165636135663338656434633031336631613236346663
+31376535353235636362346462333530633334313266613433396361333331363936643863323261
+61653564393238323935373935653662636363353063613432653531393337613664336433663337
+34383533376362303439303132363665313437363134333432643566636335393739616639613961
+32626163333961343331323364636238353137613835363363613538333231303031323033383634
+65643735636133313964
diff --git a/ansible/inventories/group_vars/new_sudo/main.yaml b/ansible/inventories/group_vars/new_sudo/main.yaml
new file mode 100644
index 0000000..58490a0
--- /dev/null
+++ b/ansible/inventories/group_vars/new_sudo/main.yaml
@@ -0,0 +1,2 @@
+---
+become_exe: sudo.ws
\ No newline at end of file
diff --git a/ansible/inventories/group_vars/pangolin/mini1.yaml b/ansible/inventories/host_vars/edge1.yaml
similarity index 70%
rename from ansible/inventories/group_vars/pangolin/mini1.yaml
rename to ansible/inventories/host_vars/edge1.yaml
index 20664df..085163a 100644
--- a/ansible/inventories/group_vars/pangolin/mini1.yaml
+++ b/ansible/inventories/host_vars/edge1.yaml
@@ -1,6 +1,6 @@
---
-pangolin_dashboard_url: "https://pangolin.hassallab.it"
-pangolin_base_domain: "hassallab.it"
+pangolin_dashboard_url: "https://pangolin.{{ base_domain}}"
+pangolin_base_domain: "{{ base_domain }}"
pangolin_secret: "{{ pangolin_crypted_secret }}"
pangolin_admin_email: "hassallah@mail.com"
diff --git a/ansible/inventories/host_vars/hserve1.yaml b/ansible/inventories/host_vars/hserve1.yaml
new file mode 100644
index 0000000..96c9642
--- /dev/null
+++ b/ansible/inventories/host_vars/hserve1.yaml
@@ -0,0 +1,6 @@
+---
+pangolin_site_id: 7drc3dz2bg5gbq5
+newt_secret: "{{ test_nginx_newt_secret }}"
+
+
+forgejo_db_password : "{{ forgejo_db_crypted_password }}"
\ No newline at end of file
diff --git a/ansible/inventories/host_vars/mini1.yaml b/ansible/inventories/host_vars/mini1.yaml
new file mode 100644
index 0000000..dba9226
--- /dev/null
+++ b/ansible/inventories/host_vars/mini1.yaml
@@ -0,0 +1,17 @@
+---
+pangolin_site_id: "original-steppe-polecat"
+newt_compose_network: "proxy-network"
+
+authentik_subdomain: "idp"
+
+# The hostname at which authentik is served.
+authentik_base_domain: "{{ base_domain }}"
+
+authentik_secret_key: "{{ authentik_crypted_secret_key }}"
+authentik_postgres_user: "authentik_ps"
+authentik_postgres_password: "{{ authentik_crypted_postgres_password }}"
+#authentik_api_token : "{{ authentik_crypted_token }}"
+
+
+authentik_email_enabled: false
+authentik_bootstrap_enabled: false
\ No newline at end of file
diff --git a/ansible/playbooks/authentik.yaml b/ansible/playbooks/authentik.yaml
new file mode 100644
index 0000000..150e05b
--- /dev/null
+++ b/ansible/playbooks/authentik.yaml
@@ -0,0 +1,10 @@
+---
+- name: Install / remove authentik
+ hosts: authentik
+ become: true
+ debugger: on_failed
+ roles:
+ - geerlingguy.docker
+ - newt_client
+ - ax-bzh.authentik
+
diff --git a/ansible/playbooks/bootstrap.yaml b/ansible/playbooks/bootstrap.yaml
index 41471e8..008a181 100644
--- a/ansible/playbooks/bootstrap.yaml
+++ b/ansible/playbooks/bootstrap.yaml
@@ -26,7 +26,7 @@
- name: Set ansible user as sudoer
ansible.builtin.copy:
- content: "ansible ALL = (ALL) NOPASSWD:ALL"
+ content: "ansible ALL = (ALL) NOPASSWD:ALL\n"
dest: /etc/sudoers.d/ansible
owner: root
group: root
diff --git a/ansible/playbooks/forgejo.yaml b/ansible/playbooks/forgejo.yaml
new file mode 100644
index 0000000..da01c0d
--- /dev/null
+++ b/ansible/playbooks/forgejo.yaml
@@ -0,0 +1,5 @@
+---
+- name : Install Forgejo
+ hosts: forgejo
+ roles:
+ - forgejo
\ No newline at end of file
diff --git a/ansible/playbooks/roles/forgejo/tasks/forgejo_docker.yaml b/ansible/playbooks/roles/forgejo/tasks/forgejo_docker.yaml
new file mode 100644
index 0000000..40aad45
--- /dev/null
+++ b/ansible/playbooks/roles/forgejo/tasks/forgejo_docker.yaml
@@ -0,0 +1,34 @@
+---
+- name: Create docker compose directory
+ ansible.builtin.file:
+ path: "/home/{{ ansible_user }}/compose_projects/forgejo"
+ state: directory
+ mode: '0755'
+ register: compose_dir
+
+- name: Create data directory
+ ansible.builtin.file:
+ path: "/home/{{ ansible_user }}/forgejo/data"
+ state: directory
+ mode: '0755'
+ register: forgejo_data_dir
+
+
+- name: Create DB data directory
+ ansible.builtin.file:
+ path: "/home/{{ ansible_user }}/forgejo/db"
+ state: directory
+ mode: '0755'
+ register: forgejo_db_dir
+
+
+- name: Copy compose file
+ ansible.builtin.template:
+ src: templates/forgejo_compose.yaml.j2
+ dest: "{{ compose_dir.path }}/compose.yaml"
+
+
+- name: Starting forgejo compose project
+ community.docker.docker_compose_v2:
+ project_src: "{{ compose_dir.path }}"
+
diff --git a/ansible/playbooks/roles/forgejo/tasks/main.yaml b/ansible/playbooks/roles/forgejo/tasks/main.yaml
new file mode 100644
index 0000000..daaca37
--- /dev/null
+++ b/ansible/playbooks/roles/forgejo/tasks/main.yaml
@@ -0,0 +1,6 @@
+---
+- include_role:
+ name: geerlingguy.docker
+ apply:
+ become: true
+- include_tasks: forgejo_docker.yaml
\ No newline at end of file
diff --git a/ansible/playbooks/roles/forgejo/templates/forgejo_compose.yaml.j2 b/ansible/playbooks/roles/forgejo/templates/forgejo_compose.yaml.j2
new file mode 100644
index 0000000..cf43b54
--- /dev/null
+++ b/ansible/playbooks/roles/forgejo/templates/forgejo_compose.yaml.j2
@@ -0,0 +1,52 @@
+networks:
+ forgejo:
+ external: false
+ newt:
+ name: newt_compose_default
+ external: true
+
+services:
+ server:
+ image: codeberg.org/forgejo/forgejo:16.0.1
+ container_name: forgejo
+ restart: always
+ environment:
+ - USER_UID={{ ansible_user_uid }}
+ - USER_GID={{ ansible_group_uid }}
+
+ - FORGEJO__database__DB_TYPE=postgres
+ - FORGEJO__database__HOST=db:5432
+ - FORGEJO__database__NAME=forgejo
+ - FORGEJO__database__USER=forgejo
+ - FORGEJO__database__PASSWD={{ forgejo_db_password }}
+
+
+ networks:
+ - forgejo
+ - newt
+
+ volumes:
+ - {{ forgejo_data_dir.path }}:/data
+ - /etc/localtime:/etc/localtime:ro
+ ports:
+ - '3000:3000'
+ - '222:22'
+
+ depends_on:
+ - db
+
+
+ db:
+ image: postgres:14
+ restart: always
+ environment:
+ - POSTGRES_USER=forgejo
+ - POSTGRES_PASSWORD={{ forgejo_db_password }}
+ - POSTGRES_DB=forgejo
+ networks:
+ - forgejo
+ volumes:
+ - {{ forgejo_db_dir.path }}:/var/lib/postgresql/data
+
+
+
diff --git a/ansible/playbooks/roles/newt_client/defaults/main.yaml b/ansible/playbooks/roles/newt_client/defaults/main.yaml
new file mode 100644
index 0000000..ed97d53
--- /dev/null
+++ b/ansible/playbooks/roles/newt_client/defaults/main.yaml
@@ -0,0 +1 @@
+---
diff --git a/ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml b/ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml
new file mode 100644
index 0000000..a8b9cb2
--- /dev/null
+++ b/ansible/playbooks/roles/newt_client/tasks/docker_newt.yaml
@@ -0,0 +1,23 @@
+---
+- name: Create docker compose directory
+ ansible.builtin.file:
+ path: "/home/{{ ansible_user }}/compose_projects/newt_compose"
+ state: directory
+ mode: '0755'
+ register: compose_dir
+
+- name: Copy compose file
+ ansible.builtin.template:
+ src: templates/newt_compose.yaml.j2
+ dest: "{{ compose_dir.path }}/compose.yaml"
+
+
+- name: Copy secret file
+ ansible.builtin.template:
+ src: templates/newt-config.secret.j2
+ dest: "{{ compose_dir.path }}/newt-config.secret"
+
+- name: Starting newt project
+ community.docker.docker_compose_v2:
+ project_src: "{{ compose_dir.path }}"
+
diff --git a/ansible/playbooks/roles/newt_client/tasks/main.yaml b/ansible/playbooks/roles/newt_client/tasks/main.yaml
new file mode 100644
index 0000000..1e18ee5
--- /dev/null
+++ b/ansible/playbooks/roles/newt_client/tasks/main.yaml
@@ -0,0 +1,2 @@
+---
+- include_tasks: docker_newt.yaml
diff --git a/ansible/playbooks/roles/newt_client/templates/newt-config.secret.j2 b/ansible/playbooks/roles/newt_client/templates/newt-config.secret.j2
new file mode 100644
index 0000000..014c277
--- /dev/null
+++ b/ansible/playbooks/roles/newt_client/templates/newt-config.secret.j2
@@ -0,0 +1,10 @@
+{
+ "id": "{{ pangolin_site_id }}",
+ "secret": "{{ newt_secret }}",
+ "endpoint": "https://pangolin.{{ base_domain }}",
+
+ "dockerSocket": "unix:///var/run/docker.sock",
+ "dockerEnforceNetworkValidation": true,
+
+ "tlsClientCert": ""
+}
\ No newline at end of file
diff --git a/ansible/playbooks/roles/newt_client/templates/newt_compose.yaml.j2 b/ansible/playbooks/roles/newt_client/templates/newt_compose.yaml.j2
new file mode 100644
index 0000000..f1c0de1
--- /dev/null
+++ b/ansible/playbooks/roles/newt_client/templates/newt_compose.yaml.j2
@@ -0,0 +1,16 @@
+services:
+
+ newt:
+ image: fosrl/newt
+ container_name: newt
+ restart: unless-stopped
+ volumes:
+ - /var/run/docker.sock:/var/run/docker.sock:ro
+ environment:
+ - CONFIG_FILE=/run/secrets/newt-config
+ secrets:
+ - newt-config
+
+secrets:
+ newt-config:
+ file: ./newt-config.secret
\ No newline at end of file
diff --git a/ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml b/ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml
new file mode 100644
index 0000000..7d4d57f
--- /dev/null
+++ b/ansible/playbooks/roles/nginx/tasks/docker_nginx.yaml
@@ -0,0 +1,55 @@
+---
+- name: Pull docker image
+ docker_image:
+ name: "nginx"
+ source: pull
+
+
+- name: Create site dir
+ file:
+ path: "/home/{{ ansible_user }}/web/static_nginx_site"
+ state: directory
+ register: site_dir
+
+
+- name: Create index.html
+ template:
+ src: templates/index.html.j2
+ dest: "{{site_dir.path}}/index.html"
+
+
+- name: Create nginx conf dir
+ file:
+ path: "/home/{{ ansible_user }}/nginx/conf"
+ state: directory
+ register: nginx_conf_dir
+
+- name: Copy nginx config
+ template:
+ src: templates/nginx.conf.j2
+ dest: "{{ nginx_conf_dir.path }}/nginx.conf"
+
+
+- name: Create nginx logs dir
+ file:
+ path: "/home/{{ ansible_user }}/nginx/logs"
+ state: directory
+ register: nginx_logs_dir
+
+
+- name: Create container
+ docker_container:
+ name: nginx-static
+ image: nginx
+ ports:
+ - "80:80"
+ volumes:
+ - "{{ site_dir.path }}:/usr/share/nginx/html"
+ - "{{ nginx_conf_dir.path }}:/etc/nginx/conf.d"
+ - "{{ nginx_logs_dir.path }}:/var/log/nginx"
+ restart_policy : "unless-stopped"
+ networks:
+ - name: "newt_compose_default"
+ init : true
+ recreate: true
+ state: started
\ No newline at end of file
diff --git a/ansible/playbooks/roles/nginx/tasks/main.yaml b/ansible/playbooks/roles/nginx/tasks/main.yaml
new file mode 100644
index 0000000..5e42f23
--- /dev/null
+++ b/ansible/playbooks/roles/nginx/tasks/main.yaml
@@ -0,0 +1,2 @@
+---
+- include_tasks: docker_nginx.yaml
\ No newline at end of file
diff --git a/ansible/playbooks/roles/nginx/templates/index.html.j2 b/ansible/playbooks/roles/nginx/templates/index.html.j2
new file mode 100644
index 0000000..31c0ee2
--- /dev/null
+++ b/ansible/playbooks/roles/nginx/templates/index.html.j2
@@ -0,0 +1,13 @@
+
+
+
+
+
+Welcome to My NGINX App
+
+
+
+Static
+This is a static web page served by NGINX inside a Docker container.
+
+
\ No newline at end of file
diff --git a/ansible/playbooks/roles/nginx/templates/nginx.conf.j2 b/ansible/playbooks/roles/nginx/templates/nginx.conf.j2
new file mode 100644
index 0000000..f2b7ed9
--- /dev/null
+++ b/ansible/playbooks/roles/nginx/templates/nginx.conf.j2
@@ -0,0 +1,13 @@
+server {
+ listen 80;
+ root /usr/share/nginx/html;
+ index index.html index.htm;
+ server_name static1;
+ client_max_body_size 32m;
+ access_log /var/log/nginx/static1.access.log;
+ error_log /var/log/nginx/static1.error.log debug;
+ error_page 500 502 503 504 /50x.html;
+ location = /50x.html {
+ root /var/lib/nginx/html;
+ }
+}
\ No newline at end of file
diff --git a/ansible/playbooks/roles/pangolin/tasks/main.yaml b/ansible/playbooks/roles/pangolin/tasks/main.yaml
index 2c34c0a..f0de8a8 100644
--- a/ansible/playbooks/roles/pangolin/tasks/main.yaml
+++ b/ansible/playbooks/roles/pangolin/tasks/main.yaml
@@ -1,3 +1,10 @@
---
- ansible.builtin.include_tasks: prepare_node.yaml
-- ansible.builtin.include_tasks: docker_pangolin.yaml
+- include_role:
+ name: geerlingguy.docker
+ apply:
+ become: true
+- ansible.builtin.include_tasks:
+ file: docker_pangolin.yaml
+ apply:
+ become: true
diff --git a/ansible/playbooks/roles/pangolin/templates/docker-compose.yml.j2 b/ansible/playbooks/roles/pangolin/templates/docker-compose.yml.j2
index b0efb85..5aeded0 100644
--- a/ansible/playbooks/roles/pangolin/templates/docker-compose.yml.j2
+++ b/ansible/playbooks/roles/pangolin/templates/docker-compose.yml.j2
@@ -1,6 +1,6 @@
services:
pangolin:
- image: fosrl/pangolin:latest
+ image: fosrl/pangolin:ee-latest
container_name: pangolin
restart: unless-stopped
volumes:
diff --git a/ansible/playbooks/static_nginx_page.yaml b/ansible/playbooks/static_nginx_page.yaml
new file mode 100644
index 0000000..54d4fd8
--- /dev/null
+++ b/ansible/playbooks/static_nginx_page.yaml
@@ -0,0 +1,9 @@
+---
+- name : Nginx static with docker
+ hosts: all
+ become: true
+ roles:
+ - geerlingguy.docker
+ - newt_client
+ - nginx
+
\ No newline at end of file
diff --git a/ansible/playbooks/tests.yaml b/ansible/playbooks/tests.yaml
new file mode 100644
index 0000000..cfc6ec4
--- /dev/null
+++ b/ansible/playbooks/tests.yaml
@@ -0,0 +1,10 @@
+---
+- name: tests
+ hosts: all
+ tasks:
+ - name: testing
+ shell: echo $USER
+
+ - name: testing sudo
+ become: true
+ shell: echo $USER
\ No newline at end of file
diff --git a/ansible/requirements.yaml b/ansible/requirements.yaml
index 2e0f99c..968b832 100644
--- a/ansible/requirements.yaml
+++ b/ansible/requirements.yaml
@@ -1,7 +1,19 @@
# requirements.yml
---
-collections:
+roles:
+ # Used by pangolin playbook
+ - name: geerlingguy.docker
+ # Used by authentik playbook
+ - name: ax-bzh.authentik
+
+
+collections:
# Used by role wireguard_server
-- name: ansible.netcommon
\ No newline at end of file
+ - name: ansible.netcommon
+
+ # Used by ax-bzh.authentik
+ - name: community.docker
+ version: ">=3.0.0"
+ - name: community.general
\ No newline at end of file