48 changed files with 134 additions and 717 deletions
--- a/ansible/inventories/distributed.yaml
+++ b/ansible/inventories/distributed.yaml
@ -4,7 +4,7 @@ new_sudo:
    hserve1:
    hserve2:
    mini1:
-    backs.hassallab.it:
+


 distributed:
@ -20,7 +20,7 @@ distributed:
    nextcloud:
      hosts:
        hserve2:
-          ansible_host: 192.168.1.130
+          ansible_host: 192.168.1.0
    nginx:
      hosts:
        hserve1:
@ -28,7 +28,4 @@ distributed:
    forgejo:
      hosts:
        hserve1:
-    borg:
-      hosts:
-        backs.hassallab.it:

--- a/ansible/inventories/group_vars/all/borg.yaml
+++ b/ansible/inventories/group_vars/all/borg.yaml
@ -1,2 +0,0 @@
---
-borg_backup_server: backs.hassallab.it
--- a/ansible/inventories/group_vars/all/main.yaml
+++ b/ansible/inventories/group_vars/all/main.yaml
@ -1,2 +0,0 @@
---
-become_exe_value: "sudo"
--- a/ansible/inventories/group_vars/all/vault.yaml
+++ b/ansible/inventories/group_vars/all/vault.yaml
@ -1,45 +1,29 @@
 $ANSIBLE_VAULT;1.1;AES256
-32326233646532393231613436626235366262343565626264386561616466353736303435303030
-3666386236333538303034383762663663373661613638360a646138343865643464333539393333
-66616134326333356332303337376631313066366236633936343436656638663834616132303334
-3935626133353161340a393964346632346163376564316232653132363436353130396562653965
-31333963373361353432323339633961313030363036353464313534346330353966666634643364
-33643863346239303866313865363433343462393837396666636266323864343537666564303833
-63323763646333343732303662306234346233373836326438343937303932323763346538626230
-38633339643833616632636631316638396661633035396137373362326231303861313134383164
-34366664616465313938323061306232373139343466346537326264613664336561366365333535
-64393331383334653135333630346131633730333162663631376537323339373639323462653138
-65396565336665626635623961343236646336396565646137366435373436353835343162393865
-31666635636565616461353433376530613661343331663766626565346430653532653364353263
-32663966393237626362383263663138653631653538653361366266643638653365373130613661
-33333238323262363139623263663338633162616131303236376636313531623937303333633461
-66653130623433666662343038353532393032636662323536656466636238643931656130396132
-64636136653066393032343862663639636638323163343661636565623766303230626136663662
-32653361343963396238356138363666333536623965626665643837633437343661323538333666
-64353564326363313961363339346131356462326461656130376666616236316137386234316130
-37666438336464646236343336623261366337343731356631313131323364636337373933663862
-32646137636533653236326538663836303938393565343138393763323064363838663163643361
-37316334623862313739316338633932356136343435306564333139346235393833653864393232
-62316638363965336132303038363332613737613836653832373130356333636264383636383434
-36383436376137633934356338653966373531323938653663396337653135316662386232336633
-35373834393461623563663562646264356434323031343139373535623636623165386239383033
-64373432313466666532343266373932316461646433633062373439613063646136663532306134
-64613364616162323638646235353933313930626431373238633635386363633665646261303133
-32303464633434633864303334653566343538386466656337663334623336303461393339653338
-33396231646666376436343932656335613430626461643462363436396535353161373666333735
-37303263653566353362363330653738303831643830316630303764343738393162323136613165
-62323533313939336131303930363131373033626439326266633936353162643733373032643436
-64363035343366356332646362353838376266313833623031386565303735326362646436636364
-61336630363334383062616431383563363438613337623430386364626430633739633439333762
-66653334646535623336393763663238613134653562613062376130346133353361326365373536
-66383966316263326230313062613466663266666264653338303536333162653136396366313533
-61313131633737306335646233626435616563316430316634343663326364333332323564653837
-31336134633333303233326636363533383436616364323839396536616662303266366364623233
-31346563396464326566646435323165313934666530373435613861376164666435613335363535
-38356438393461383739313933353336326532336462303562653165303961383766333465363537
-66316161323932646430343565363638353038363033343363356463643331653138626165623361
-65346132373162643131626165333366623665326333303532643763343330653436376134393961
-31393634616564313564643030373637346136333133343432663438383965626536396239626135
-66366262346438616532373438396431383462373232396364303464633637366332663135326137
-32393535356234393232613239353565356630616636323465366537333362343239623338363932
-32383539346631323665
+38356639333633663161333637663539623835623666653738333235336563373030653036393837
+3235613032363938623938303463333562656561316636660a626532363638396138613637323265
+66663562366431333139616134333039323737356437393031643463363362363335636464333162
+3430353964646133660a666234613262396464363134313935383661393438616237633961643233
+31646435326336353130323139323961343561646137636332333139643033303664333035663538
+30346138613061616432656431613437306462666432646239373236323633346131663431366564
+66663031353366663766663330346633306233653033626134343738303937393934393936646533
+63613338323631366537353531356538643738393562346161666566393639363138663832306639
+32336433643134323433633433376137363834353763643834393530356536316565653831616165
+32306661353761643139343838313535333365646265613537626533346338333239626137363533
+39323930636336396134313561346463313662333734643536366433663030393130646366396564
+66656335353138376638353939316263306633613563663465636366353437333536353731326562
+66313862373830383736323330616236643066393032353961643166663935333966386562646335
+62616634363964333062306637656331396339643662663132623533636663313962376266353137
+30663131326365613635616234616138366236303938386536346633393839393732653964316636
+36626262663463306434386332353166313162356365643866393638663564343161643430373937
+37336233396632316537626465323866373463306565633835363263616362653266303364373835
+30386163626239356333353232343662643438353965346335613937346366386331343965343738
+32633732366161653834663766326536343065613463643263333065396532356635376362336335
+36386339343832623664323732363638616632363964373732336565636161396237333934353931
+66656339653731343534666635663331336238646561353664323438356339343164353531303362
+38333535333064386562346234656232653938316337343163616361633834656234333036393932
+37303539663032363134613335663937363165636135663338656434633031336631613236346663
+31376535353235636362346462333530633334313266613433396361333331363936643863323261
+61653564393238323935373935653662636363353063613432653531393337613664336433663337
+34383533376362303439303132363665313437363134333432643566636335393739616639613961
+32626163333961343331323364636238353137613835363363613538333231303031323033383634
+65643735636133313964
--- a/ansible/inventories/group_vars/borg/auth_users.yaml
+++ b/ansible/inventories/group_vars/borg/auth_users.yaml
@ -1,9 +0,0 @@
-configure_borg_server: true
-borg_auth_users:
-  - host: fabotest
-    key: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArNhKFcJ6T08sn7kTTLf+rO9HEvgOvqfhv5HQ2sRf2tFYfjfCb0zHKnMkgW+sy5gMU10Lyx1r7juXCvqRC955uIM97m1B1Xc6sVqASVKuGPhCKfhxEaMAyBcWFdE+HYbCOPYVN+JMrcwWfbblwiZTtK1OCqaEUvDDI7cFeU68noXwggEp46T48eqMUdi541D9Y+BVx9HYAo6OCQz0+6eXwxJL+tpRcAAXIMMWv362CYHoOgIU45R7xVSMLY1k/HLrcEAblwxEaSpduCH5cWUXZE/56IyxpvP44BxZkVhNdqJLmg4hxBQWhoMNYiTZxbLay3W2TwBCM111cAtUx4M/jQ== fabio@pc-fabio"
-  - host: rup_next
-    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILWSd+iKs/Qsr2JGTprUC6sHsxyCadO3YF8U81aNF+IA root@nextcloud-aio-borgbackup"
-  - host: hassallab_next
-    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJmmOdetpapMz1S2dGPgJB7qodPU7RVj3bExnKv/B2zK root@nextcloud-aio-borgbackup"
-    
--- a/ansible/inventories/group_vars/new_sudo/main.yaml
+++ b/ansible/inventories/group_vars/new_sudo/main.yaml
@ -1,2 +1,2 @@
 ---
-become_exe_value: "sudo.ws"
+become_exe: sudo.ws
--- a/ansible/inventories/group_vars/pangolin/mail.yaml
+++ b/ansible/inventories/group_vars/pangolin/mail.yaml
@ -1,7 +0,0 @@
---
-pangolin_mail_host: "smtp.ionos.it"
-pangolin_mail_port: 587
-pangolin_mail_user: "system@hassallab.it"
-pangolin_mail_password: "{{ pangolin_mail_crypted_password }}"
-pangolin_no_reply_address: "system@hassallab.it"
-pangolin_mail_secure_flag: false
--- a/ansible/inventories/group_vars/pangolin/node_setup.yaml
+++ b/ansible/inventories/group_vars/pangolin/node_setup.yaml
@ -1,3 +0,0 @@
---
-configure_swap: true
-ip_tables_config: true
--- a/ansible/inventories/host_vars/edge1.yaml
+++ b/ansible/inventories/host_vars/edge1.yaml
@ -6,9 +6,9 @@ pangolin_admin_email: "hassallah@mail.com"

 pangolin_gerbil_subnet_group: "10.42.0.0/16"

-configure_borg_client: true
-borg_repos:
-  - name: pangolin
-    borg_passphrase: "{{ edge1_backup_pangolin_crypted_password }}"
-    paths_to_backup:
-      - "/home/{{ ansible_user }}/compose_projects/pangolin"
+# Email (SMTP) settings
+pangolin_email_smtp_host: "mail.com"
+pangolin_email_smtp_port: 587
+pangolin_email_smtp_user: "pango.lin@mail.com"
+pangolin_email_smtp_pass: "{{ pangolin_mail_crypted_password }}"
+pangolin_email_no_reply: "no-reply@mail.com"
--- a/ansible/inventories/host_vars/hserve1.yaml
+++ b/ansible/inventories/host_vars/hserve1.yaml
@ -3,15 +3,4 @@ pangolin_site_id: 7drc3dz2bg5gbq5
 newt_secret: "{{ test_nginx_newt_secret }}"


-forgejo_db_password : "{{ forgejo_db_crypted_password }}"
-
-configure_borg_client: true
-borg_repos:
-  - name: web
-    borg_passphrase: "{{ hserve1_backup_web_crypted_password }}"
-    paths_to_backup:
-      - "/home/{{ ansible_user }}/web"
-  - name: forgejo
-    borg_passphrase: "{{ hserve1_backup_forgejo_crypted_password }}"
-    paths_to_backup:
-      - "/home/{{ ansible_user }}/compose_projects/forgejo"
+forgejo_db_password : "{{ forgejo_db_crypted_password }}"
--- a/ansible/inventories/host_vars/hserve2.yaml
+++ b/ansible/inventories/host_vars/hserve2.yaml
@ -1,4 +0,0 @@
---
-pangolin_site_id: 5hraslci7wl46nj
-newt_secret: "{{ hserve2_crypted_site_secret }}"
-nextcloud_docker_mastercontainer_volume_dir: "/home/{{ ansible_user }}/docker_data/nextcloud_aio_mastercontainer"
--- a/ansible/playbooks/README.md
+++ b/ansible/playbooks/README.md
@ -3,19 +3,7 @@
 Qui vengono riportati i playbook disponibili, descrizione e utilizzo. 
 **NB** Ci si aspetta che i playbook siano idempotenti. In caso contrario e' importante riportarlo nella documentazione corrente. 

-### Summary
- [Bootstrap](#bootstrap)
- [VPN Server](#vpn-server)
- [Pangolin](#pangolin)
- [Forgejo](#forgejo)
- [Authentik](#authentik)
- [Nextcloud](#nextcloud)
- [Static Nginx Page](#static-nginx-page)
- [Borg Backups](#borg-backups)
-
-
 ### Bootstrap
-
 Implementa la configurazione di base di un nodo per poter essere gestito dagli altri playbook, in particolare : 
 - crea l'utente ansible
 - registra le chiavi ssh degli utenti configurati
@ -79,73 +67,7 @@ Il playbook installa docker e docker compose. Attraverso docker compose vengono

 Il playbook utilizza : 
 - [geerlingguy.docker](https://github.com/geerlingguy/ansible-role-docker) attraverso ansible galaxy
- Il ruolo ***prepare_node***
- Il ruolo ***pangolin*** preso da [pangolin-ansible-terraform](https://github.com/patelanuj21/pangolin-ansible-terraform/tree/main)
+- I ruoli common e pangolin definiti in [pangolin-ansible-terraform](https://github.com/patelanuj21/pangolin-ansible-terraform/tree/main), riportati staticamente come ruolo *pangolin*

-I parametri attesi dal playbook sono quelli definiti nei ruoli da cui dipende. 

-### Forgejo
-Il playbook installa docker e docker compose. Attraverso docker compose vengono poi lanciati container per [forgejo](https://forgejo.org/) e [newt_client](https://docs.pangolin.net/manage/sites/install-site).
-
-Il playbook utilizza : 
- [geerlingguy.docker](https://github.com/geerlingguy/ansible-role-docker) attraverso ansible galaxy
- I ruoli ***forgejo*** e ***newt_client***
-
-### Authentik 
-Il playbook installa docker e docker compose. Attraverso docker compose vengono poi lanciati container per [authentik](https://docs.goauthentik.io/) e [newt_client](https://docs.pangolin.net/manage/sites/install-site).
-
-Il playbook utilizza : 
- [geerlingguy.docker](https://github.com/geerlingguy/ansible-role-docker) attraverso ansible galaxy
- [ax-bzh.authentik](https://galaxy.ansible.com/ui/standalone/roles/ax-bzh/authentik/documentation/) attraverso ***ansible galaxy***
- Il ruolo ***newt_client***
-
-### Nextcloud
-Il playbook installa docker e docker compose. Attraverso docker viene poi lanciato il container per [Nextcloud AIO](https://github.com/nextcloud/all-in-one) e [newt_client](https://docs.pangolin.net/manage/sites/install-site).
-
-Il playbook utilizza : 
- [geerlingguy.docker](https://github.com/geerlingguy/ansible-role-docker) attraverso ansible galaxy
- I ruoli ***newt_client*** e ***nextcloud_aio***
-
-### Static Nginx Page
-Il playbook installa docker e docker compose. Attraverso docker viene poi lanciato il container per [Nginx](https://nginx.org/) e [newt_client](https://docs.pangolin.net/manage/sites/install-site).
-
-Il playbook utilizza : 
- [geerlingguy.docker](https://github.com/geerlingguy/ansible-role-docker) attraverso ansible galaxy
- I ruoli ***newt_client*** e ***nginx***
-
-### Borg Backups
-Il playbook configura sia i client che il server per i backup effettuati con [borg](https://www.borgbackup.org/). I client vengono risolti dinamicamente verificando la presenza della seguente configurazione in esempio: 
-
-```
-configure_borg_client: True
-borg_repos:
-  - name: test
-    borg_passphrase: "dummy_secret"
-    paths_to_backup: 
-      - "/home/{{ ansible_user }}"
-      - "/proc/version"
-```
-
-Per ogni client vengono configurati : 
- l'utente e relative credenziali per connettersi al borg server
- Un servizio systemd **borg\_backup.service** e relativo timer **borg\_backup.timer** per eseguire il backup
- Uno script che esegue effettivamente il backup **"/home/{{borg_user}}/backup\_script.sh"** verso *"ssh://{{ borg\_user }}@{{ borg\_backup_server }}/./"*
-
-Sul server vengono configurati: 
- L'utente con cui eseguire borg service
- Le credenziali attese utilizzate dai vari client e i rispettivi path permessi per eseguire i report. 
-
-Sul server i permessi concessi ai vari client vengono limitati definendo su ***/home/{{borg\_user}}/.ssh/authorized\_keys*** le limitazioni di path (accesso solo al proprio repo) e di operation (solo ***"borg serve"***) con la seguente istruzione : 
-```
-command=\"cd {{ borg_pool }}/{{ item.host }};borg serve --restrict-to-path {{ borg_pool }}/{{ item.host }}\",restrict
-```
-
-E' possibile configurare il server per servire borg anche con altre credenziali e path, per casi non coperti dal playbook (e.g. borg backups usato direttamente da Nextcloud AIO) attraverso il seguente attributo: 
-
-```
-borg_auth_users:
-  - host: fabotest
-    key: "ssh-rsa ********"
-```
-
-Il playbook utilizza il role ***borg***
+I parametri attesi dal playbook sono quelli definiti nei ruoli da cui dipende. 
--- a/ansible/playbooks/authentik.yaml
+++ b/ansible/playbooks/authentik.yaml
@ -1,15 +1,10 @@
 ---
 - name: Install / remove authentik
  hosts: authentik
-  tasks:
-    - include_role:
-        name: geerlingguy.docker
-        apply:
-          become: true
-          become_exe: "{{ become_exe_value }}"
+  become: true
+  debugger: on_failed
+  roles:
+    - geerlingguy.docker
+    - newt_client
+    - ax-bzh.authentik

-    - include_role: 
-        name: "{{ item }}"
-      loop :
-        - newt_client
-        - ax-bzh.authentik
--- a/ansible/playbooks/bootstrap.yaml
+++ b/ansible/playbooks/bootstrap.yaml
@ -2,7 +2,6 @@
 - name: Bootstrap node
  hosts: all
  become: true
-  become_exe: "{{ become_exe_value }}"
  tasks:
    - name: Add the ansible group
      ansible.builtin.group:
--- a/ansible/playbooks/borg_backups.yaml
+++ b/ansible/playbooks/borg_backups.yaml
@ -1,32 +0,0 @@
---
- name: Evaluate borg client nodes
-  hosts: all
-  tags: clients
-  gather_facts: false
-  tasks:
-  - name: Gather configured clients
-    ansible.builtin.group_by:
-      key: "borg_clients_{{ configure_borg_client | default('False') }}"
-  # Creates: borg_clients_True and borg_clients_False
-
-
- name: Configure borg backups system
-  tags: server
-  hosts: borg_clients_True:borg
-  debugger: on_failed
-  tasks: 
-    - name: Configure clients
-      include_role:
-        name: borg
-        apply:
-          become: true
-          become_exe: "{{ become_exe_value }}"
-      when: configure_borg_client | default(false)
-
-    - name: Configure server
-      include_role:
-        name: borg
-        apply:
-          become: true
-          become_exe: "{{ become_exe_value }}"
-      when: configure_borg_server | default(false)
--- a/ansible/playbooks/forgejo.yaml
+++ b/ansible/playbooks/forgejo.yaml
@ -1,15 +1,5 @@
 ---
 - name : Install Forgejo
  hosts: forgejo
-  tasks:
-    - include_role:
-        name: geerlingguy.docker
-        apply:
-          become: true
-          become_exe: "{{ become_exe_value }}"
-
-    - include_role: 
-        name: "{{ item }}"
-      loop :
-        - newt_client
-        - forgejo
+  roles:
+    - forgejo
--- a/ansible/playbooks/nextcloud.yaml
+++ b/ansible/playbooks/nextcloud.yaml
@ -1,15 +0,0 @@
---
- name: Install Nextcloud
-  hosts: nextcloud
-  tasks:
-    - include_role:
-        name: geerlingguy.docker
-        apply:
-          become: true
-          become_exe: "{{ become_exe_value }}"
-          
-    - include_role:
-        name: "{{ item }}"
-      loop:
-        - newt_client
-        - nextcloud_aio
--- a/ansible/playbooks/pangolin.yaml
+++ b/ansible/playbooks/pangolin.yaml
@ -1,15 +1,7 @@
 ---
 - name: Install and configure Pangolin
  hosts: pangolin
-  tasks:
-    - include_role:
-        name: "{{ item }}"
-        apply:
-          become: true
-          become_exe: "{{ become_exe_value }}"
-      loop:
-        - geerlingguy.docker
-        - prepare_node
-          
-    - include_role: 
-        name: pangolin
+  become: true
+  roles:
+    - geerlingguy.docker
+    - pangolin
--- a/ansible/playbooks/roles/borg/defaults/main.yaml
+++ b/ansible/playbooks/roles/borg/defaults/main.yaml
@ -1,8 +0,0 @@
---
-borg_user: borg
-borg_group: borg
-borg_home: "/home/{{ borg_user }}"
-borg_pool: "{{ borg_home }}/repos"
-borg_pool_dest : /usr/backups/borg_repos
-borg_repo_base: "ssh://{{ borg_user }}@{{ borg_backup_server }}/./"
-borg_auth_users: []
--- a/ansible/playbooks/roles/borg/tasks/configure_borg_client.yaml
+++ b/ansible/playbooks/roles/borg/tasks/configure_borg_client.yaml
@ -1,44 +0,0 @@
---
- name: Define backup script
-  ansible.builtin.template:
-    dest: "/home/{{borg_user}}/backup_script.sh"
-    src: templates/backup_script.sh.j2
-    owner: root
-    mode: "0701"
-
- name: Define backup service
-  ansible.builtin.template:
-    dest: /etc/systemd/system/borg_backup.service
-    src: templates/borg_backup.service.j2
-    owner: root
-    mode: "0700"
-
-
- name: Define backup timer
-  ansible.builtin.copy:
-    content: |
-      [Unit]
-      Description=Daily Backup Timer
-
-      [Timer]
-      OnCalendar=*-*-* 02:00:00
-      Persistent=true
-      RandomizedDelaySec=300
-
-      [Install]
-      WantedBy=timers.target
-    dest: /etc/systemd/system/borg_backup.timer
-
- name: Reload systemd
-  ansible.builtin.systemd_service:
-    daemon_reload: true
-
-# Add entry in borg_auth_users for server configuration
-# borg_auth_users:
-#       - host: fabotest
-#         # Chiave di esempio per test
-#         key: "ssh-rsa ****"
-
- name: Register public key for server configuration
-  set_fact:
-    borg_auth_users: "{{ borg_auth_users + [{'host': inventory_hostname, 'key':borg_user_definition.ssh_public_key}] }}"
--- a/ansible/playbooks/roles/borg/tasks/configure_borg_server.yaml
+++ b/ansible/playbooks/roles/borg/tasks/configure_borg_server.yaml
@ -1,51 +0,0 @@
---
- name: Set ssh directory
-  file:
-    path: "{{ borg_home }}/.ssh"
-    owner: "{{ borg_user }}"
-    group: "{{ borg_group }}"
-    mode: "0700"
-    state: directory
-
- name: Create pool directory
-  file:
-    path: "{{ borg_pool_dest}}"
-    owner: "{{ borg_user }}"
-    group: "{{ borg_group }}"
-    mode: "0700"
-    state: directory
-
- name: Set pool directory link
-  file:
-    src: "{{ borg_pool_dest }}"
-    dest: "{{ borg_pool }}"
-    state: link
-
- name: Gathering clients configurations
-  set_fact:
-    borg_auth_users: "{{ borg_auth_users + hostvars[item]['borg_auth_users']}}"
-  loop: "{{ groups['borg_clients_True'] }}"
-
- name: Creating pool sub directories
-  file:
-    path: "{{ borg_pool }}/{{ item.host }}"
-    owner: "{{ borg_user }}"
-    group: "{{ borg_group }}"
-    mode: "0700"
-    state: directory
-  with_items: "{{ borg_auth_users }}"
-
- name: Defining authorized_key
-  authorized_key:
-    user: "{{ borg_user }}"
-    key: "{{ item.key }}"
-    key_options: "command=\"cd {{ borg_pool }}/{{ item.host }};borg serve --restrict-to-path {{ borg_pool }}/{{ item.host }}\",restrict"
-  with_items: "{{ borg_auth_users }}"
-
- name: Setting authorized keys file
-  file:
-    path: "{{ borg_home }}/.ssh/authorized_keys"
-    owner: "{{ borg_user }}"
-    group: "{{ borg_group }}"
-    mode: "0600"
-    state: file
--- a/ansible/playbooks/roles/borg/tasks/main.yaml
+++ b/ansible/playbooks/roles/borg/tasks/main.yaml
@ -1,9 +0,0 @@
---
- name: Prepare borg
-  include_tasks: prepare_borg.yaml
- name: Configure server
-  include_tasks: configure_borg_server.yaml
-  when: configure_borg_server | default(false)
- name: Configure client
-  include_tasks: configure_borg_client.yaml
-  when: configure_borg_client | default(false)
--- a/ansible/playbooks/roles/borg/tasks/prepare_borg.yaml
+++ b/ansible/playbooks/roles/borg/tasks/prepare_borg.yaml
@ -1,21 +0,0 @@
---
- name: Install borg and requirements
-  ansible.builtin.package:
-    name: borgbackup
-    state: present
-
- name: Set borg user group
-  group:
-    name: "{{ borg_group }}"
-    state: present
-
- name: Set borg user
-  user:
-    name: "{{ borg_user }}"
-    shell: /bin/bash
-    home: "{{ borg_home }}"
-    create_home: true
-    group: "{{ borg_group }}"
-    state: present
-    generate_ssh_key: "{{ configure_borg_client | default(false) }}"
-  register: borg_user_definition
--- a/ansible/playbooks/roles/borg/templates/backup_script.sh.j2
+++ b/ansible/playbooks/roles/borg/templates/backup_script.sh.j2
@ -1,86 +0,0 @@
-#!/bin/bash
-{% for repo_item in borg_repos %}
-
-# Setting this, so the repo does not need to be given on the commandline:
-export BORG_REPO="{{borg_repo_base}}{{repo_item.name}}"
-
-# See the section "Passphrase notes" for more infos.
-export BORG_PASSPHRASE="'{{ repo_item.borg_passphrase }}'"
-
-# some helpers and error handling:
-info() { logger "$*"; }
-trap 'echo $( date ) Backup interrupted >&2; exit 2' INT TERM
-
-info "Trying to initialize repo. NB returns error if already initialized"
-borg init --encryption=repokey
-
-info "Starting backup for repo {{repo_item.name}}"
-
-# Backup the most important directories into an archive named after
-# the machine this script is currently running on:
-
-borg create                         \
-    --verbose                       \
-    --filter AME                    \
-    --list                          \
-    --stats                         \
-    --show-rc                       \
-    --compression lz4               \
-    --exclude-caches                \
-    --exclude 'home/*/.cache/*'     \
-    --exclude 'var/tmp/*'           \
-                                    \
-    ::"'{{ inventory_hostname }}-{now}'"\
-    {% for item in repo_item.paths_to_backup %}
-    {{ item }}\
-    {% endfor %}
-
-backup_exit=$?
-
-info "Pruning repository {{ repo_item.name }}"
-
-# Use the `prune` subcommand to maintain 7 daily, 4 weekly and 6 monthly
-# archives of THIS machine. The '{hostname}-*' matching is very important to
-# limit prune's operation to this machine's archives and not apply to
-# other machines' archives also:
-
-borg prune                          \
-    --list                          \
-    --glob-archives "'{{ inventory_hostname }}-*'"  \
-    --show-rc                       \
-    --keep-daily    7               \
-    --keep-weekly   4               \
-    --keep-monthly  6
-
-prune_exit=$?
-
-# actually free repo disk space by compacting segments
-
-info "Compacting repository {{ repo_item.name }}"
-
-borg compact
-
-compact_exit=$?
-
-# use highest exit code as global exit code
-global_exit=$(( backup_exit > prune_exit ? backup_exit : prune_exit ))
-global_exit=$(( compact_exit > global_exit ? compact_exit : global_exit ))
-
-if [ ${global_exit} -eq 0 ]; then
-    info "Backup, Prune, and Compact finished successfully"
-elif [ ${global_exit} -eq 1 ]; then
-    info "Backup, Prune, and/or Compact finished with warnings"
-else
-    info "Backup, Prune, and/or Compact finished with errors"
-fi
-
-
-# end loop for repos
-
-{% endfor %}
-
-
-exit ${global_exit}
-
-
-
--- a/ansible/playbooks/roles/borg/templates/borg_backup.service.j2
+++ b/ansible/playbooks/roles/borg/templates/borg_backup.service.j2
@ -1,13 +0,0 @@
-[Unit]
-Description=Borg Backup
-
-[Service]
-Type=oneshot
-User={{ borg_user }}
-ExecStart=/home/{{borg_user}}/backup_script.sh
-
-AmbientCapabilities=CAP_DAC_READ_SEARCH
-
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=borg
--- a/ansible/playbooks/roles/forgejo/tasks/forgejo_docker.yaml
+++ b/ansible/playbooks/roles/forgejo/tasks/forgejo_docker.yaml
@ -8,7 +8,7 @@

 - name: Create data directory
  ansible.builtin.file:
-    path: "{{ compose_dir.path }}/data"
+    path: "/home/{{ ansible_user }}/forgejo/data"
    state: directory
    mode: '0755'
  register: forgejo_data_dir
@ -16,7 +16,7 @@

 - name: Create DB data directory
  ansible.builtin.file:
-    path: "{{ compose_dir.path }}/db"
+    path: "/home/{{ ansible_user }}/forgejo/db"
    state: directory
    mode: '0755'
  register: forgejo_db_dir
--- a/ansible/playbooks/roles/forgejo/tasks/main.yaml
+++ b/ansible/playbooks/roles/forgejo/tasks/main.yaml
@ -1,4 +1,6 @@
 ---
- include_tasks: forgejo_docker.yaml
-  tags:
-    - forgejo
+- include_role:
+    name: geerlingguy.docker
+    apply:
+      become: true
+- include_tasks: forgejo_docker.yaml
--- a/ansible/playbooks/roles/forgejo/templates/forgejo_compose.yaml.j2
+++ b/ansible/playbooks/roles/forgejo/templates/forgejo_compose.yaml.j2
@ -7,8 +7,7 @@ networks:

 services:
  server:
-    image: codeberg.org/forgejo/forgejo:16.0.1-rootless
-    user: "{{ ansible_user_uid }}:{{ ansible_group_uid }}"
+    image: codeberg.org/forgejo/forgejo:16.0.1
    container_name: forgejo
    restart: always
    environment:
@ -27,11 +26,11 @@ services:
      - newt
      
    volumes:
+      - {{ forgejo_data_dir.path }}:/data
      - /etc/localtime:/etc/localtime:ro
-      - {{ forgejo_data_dir.path }}/gitea:/var/lib/gitea
    ports:
      - '3000:3000'
-      - "222:2222"
+      - '222:22'

    depends_on:
      - db
@ -40,7 +39,6 @@ services:
  db:
    image: postgres:14
    restart: always
-    user: "{{ ansible_user_uid }}:{{ ansible_group_uid }}"
    environment:
      - POSTGRES_USER=forgejo
      - POSTGRES_PASSWORD={{ forgejo_db_password }}
--- a/ansible/playbooks/roles/newt_client/tasks/main.yaml
+++ b/ansible/playbooks/roles/newt_client/tasks/main.yaml
@ -1,4 +1,2 @@
 ---
 - include_tasks: docker_newt.yaml
-  tags:
-    - newt
--- a/ansible/playbooks/roles/nextcloud_aio/defaults/main.yaml
+++ b/ansible/playbooks/roles/nextcloud_aio/defaults/main.yaml
@ -1,4 +0,0 @@
-nextcloud_docker_image_name: "ghcr.io/nextcloud-releases/all-in-one"
-nextcloud_docker_image_tag: latest
-nextcloud_docker_skip_domain_validation: "true"
-nextcloud_docker_mastercontainer_volume_dir: /usr/data/nextcloud_aio_mastercontainer
--- a/ansible/playbooks/roles/nextcloud_aio/tasks/main.yaml
+++ b/ansible/playbooks/roles/nextcloud_aio/tasks/main.yaml
@ -1,4 +0,0 @@
---
- import_tasks: nextcloud_docker_aio.yaml
-  tags:
-    - nextcloud
--- a/ansible/playbooks/roles/nextcloud_aio/tasks/nextcloud_docker_aio.yaml
+++ b/ansible/playbooks/roles/nextcloud_aio/tasks/nextcloud_docker_aio.yaml
@ -1,33 +0,0 @@
---
- name: Pull docker image
-  docker_image:
-    name: "{{ nextcloud_docker_image_name }}"
-    tag: "{{ nextcloud_docker_image_tag }}"
-    source: pull
-
- name: Create Master Container volume dir
-  file:
-    path: "{{ nextcloud_docker_mastercontainer_volume_dir }}"
-    state: directory
-    mode: "0766"
-
- name: Create container
-  docker_container:
-    name: nextcloud-aio-mastercontainer
-    image: "{{ nextcloud_docker_image_name }}:{{ nextcloud_docker_image_tag }}"
-    ports:
-      - "8080:8080"
-      # - "80:80"
-      # - "8443:8443"
-    env:
-      APACHE_PORT: "11000"
-      APACHE_IP_BINDING: "0.0.0.0"
-      # APACHE_ADDITIONAL_NETWORK: ""
-      SKIP_DOMAIN_VALIDATION: "{{ nextcloud_docker_skip_domain_validation }}"
-    volumes:
-      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    networks:
-      - name: newt_compose_default
-    restart_policy : "always"
-    init : true
--- a/ansible/playbooks/roles/nginx/tasks/main.yaml
+++ b/ansible/playbooks/roles/nginx/tasks/main.yaml
@ -1,4 +1,2 @@
 ---
- include_tasks: docker_nginx.yaml
-  tags:
-    - nginx
+- include_tasks: docker_nginx.yaml
--- a/ansible/playbooks/roles/pangolin/tasks/docker_pangolin.yaml
+++ b/ansible/playbooks/roles/pangolin/tasks/docker_pangolin.yaml
@ -1,52 +1,38 @@
 ---
 - name: Ensure Pangolin directory exists
  ansible.builtin.file:
-    path: "/home/{{ ansible_user }}/compose_projects/pangolin"
+    path: /home/ubuntu/pangolin
    state: directory
-    mode: '0755'
-  register: compose_dir

 - name: Ensure Pangolin config directory exists
  ansible.builtin.file:
-    path: "{{ compose_dir.path }}/pangolin_config"
+    path: /home/ubuntu/pangolin/pangolin_config
    state: directory
-    mode: '0755'
-  register: pangolin_config

 - name: Template Pangolin config file
  ansible.builtin.template:
    src: pangolin_config.yml.j2
-    dest: "{{ pangolin_config.path }}/config.yaml"
+    dest: /home/ubuntu/pangolin/pangolin_config/config.yaml

 - name: Ensure Traefik config directory exists
  ansible.builtin.file:
-    path: "{{ pangolin_config.path }}/traefik"
-    mode: '0755'
+    path: /home/ubuntu/pangolin/config/traefik
    state: directory
-  register: traefik_config
-
- name: Ensure gerbil config directory exists
-  ansible.builtin.file:
-    path: "{{ pangolin_config.path }}/gerbil"
-    mode: '0755'
-    state: directory
-  register: gerbil_config
-

 - name: Template Traefik config file
  ansible.builtin.template:
    src: traefik_config.yml.j2
-    dest: "{{ traefik_config.path }}/traefik_config.yml"
+    dest: /home/ubuntu/pangolin/config/traefik/traefik_config.yml

 - name: Template Traefik dynamic config file
  ansible.builtin.template:
    src: dynamic_config.yml.j2
-    dest: "{{ traefik_config.path }}/dynamic_config.yml"
+    dest: /home/ubuntu/pangolin/config/traefik/dynamic_config.yml

 - name: Template docker-compose.yml for Pangolin
  ansible.builtin.template:
    src: docker-compose.yml.j2
-    dest: "{{ compose_dir.path }}/docker-compose.yml"
+    dest: /home/ubuntu/pangolin/docker-compose.yml
  register: pangolin_compose_template

 - name: Check if Pangolin container is running
@ -76,27 +62,23 @@
  when: pangolin_compose_needs_up
  ignore_errors: true

- name: (Re)Start Pangolin and Gerbil with Docker Compose
-  community.docker.docker_compose_v2:
-    project_src: "{{ compose_dir.path }}" 
-  register: docker_compose_status
-  state: restarted
-  # ansible.builtin.shell: |
-  #   cd /home/ubuntu/pangolin
-  #   docker compose up -d --force-recreate
-  # when: pangolin_compose_needs_up
-  # register: docker_compose_up
-  # failed_when: docker_compose_up.rc != 0
+- name: Start Pangolin and Gerbil with Docker Compose (force recreate if needed)
+  ansible.builtin.shell: |
+    cd /home/ubuntu/pangolin
+    docker compose up -d --force-recreate
+  when: pangolin_compose_needs_up
+  register: docker_compose_up
+  failed_when: docker_compose_up.rc != 0

-# - name: Check Docker Compose service status
-#   ansible.builtin.shell: |
-#     cd /home/ubuntu/pangolin
-#     docker compose ps
-#   register: docker_compose_status
+- name: Check Docker Compose service status
+  ansible.builtin.shell: |
+    cd /home/ubuntu/pangolin
+    docker compose ps
+  register: docker_compose_status

 - name: Display Docker Compose service status
  ansible.builtin.debug:
-    msg: "{{ docker_compose_status }}"
+    msg: "{{ docker_compose_status.stdout_lines }}"

 - name: "Assert that mandatory variables are defined and not default"
  ansible.builtin.assert:
--- a/ansible/playbooks/roles/pangolin/tasks/main.yaml
+++ b/ansible/playbooks/roles/pangolin/tasks/main.yaml
@ -1,5 +1,10 @@
 ---
- include_tasks: docker_pangolin.yaml
-  tags:
-    - pamgolin
-
+- ansible.builtin.include_tasks: prepare_node.yaml
+- include_role:
+    name: geerlingguy.docker
+    apply:
+      become: true
+- ansible.builtin.include_tasks: 
+    file: docker_pangolin.yaml
+    apply:
+      become: true
--- a/ansible/playbooks/roles/pangolin/tasks/prepare_node.yaml
+++ b/ansible/playbooks/roles/pangolin/tasks/prepare_node.yaml
@ -1,4 +1,34 @@
 ---
+- name: Update all packages
+  ansible.builtin.apt:
+    update_cache: true
+    upgrade: dist
+
+- name: Install essential packages
+  ansible.builtin.apt:
+    name:
+      - net-tools
+      - curl
+      - wget
+      - htop
+      - vim
+    state: present
+
+- name: Add 1GB swap file
+  ansible.builtin.shell: |
+    fallocate -l 1G /swapfile
+    chmod 600 /swapfile
+    mkswap /swapfile
+    swapon /swapfile
+  args:
+    creates: /swapfile
+
+- name: Make swap persistent
+  ansible.builtin.lineinfile:
+    dest: /etc/fstab
+    line: '/swapfile none swap sw 0 0'
+    state: present
+
 - name: Configure iptables firewall rules
  ansible.builtin.iptables:
    chain: INPUT
@ -12,10 +42,9 @@
    - { protocol: tcp, port: '443', description: 'HTTPS for secure web traffic' }
    - { protocol: udp, port: '51820', description: 'WireGuard VPN traffic' }
  become: true
-  become_exe: "{{ become_exe_value }}"
  register: iptables_result

 - name: Display iptables configuration status
  ansible.builtin.debug:
    msg: "Configured firewall rules for ports: 80 (HTTP), 443 (HTTPS), 51820 (WireGuard UDP)"
-  when: iptables_result is changed
+  when: iptables_result is changed
--- a/ansible/playbooks/roles/pangolin/templates/docker-compose.yml.j2
+++ b/ansible/playbooks/roles/pangolin/templates/docker-compose.yml.j2
@ -4,7 +4,7 @@ services:
    container_name: pangolin
    restart: unless-stopped
    volumes:
-      - {{ pangolin_config.path }}:/app/config
+      - ./pangolin_config:/app/config
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
      interval: "3s"
@ -24,7 +24,7 @@ services:
      - --remoteConfig=http://pangolin:3001/api/v1/gerbil/get-config
      - --reportBandwidthTo=http://pangolin:3001/api/v1/gerbil/receive-bandwidth
    volumes:
-      - {{ gerbil_config.path }}:/var/config
+      - ./gerbil_config/:/var/config
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
@ -44,9 +44,9 @@ services:
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    volumes:
-      - {{ traefik_config.path }}:/etc/traefik:ro # Volume to store the Traefik configuration
-      - {{ pangolin_config.path }}/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
-      - {{ traefik_config.path }}/logs:/var/log/traefik # Volume to store Traefik logs
+      - ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration
+      - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
+      - ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs
 networks:
  default:
    driver: bridge
--- a/ansible/playbooks/roles/pangolin/templates/pangolin_config.yml.j2
+++ b/ansible/playbooks/roles/pangolin/templates/pangolin_config.yml.j2
@ -20,12 +20,3 @@ server:
 gerbil:
  start_port: {{ pangolin_gerbil_start_port }}
  base_endpoint: "{{ pangolin_dashboard_url | regex_replace('^https://', '') }}" # Gerbil endpoint should be the FQDN, not the full URL
-
-
-email:
-  smtp_host: "{{ pangolin_mail_host}}"
-  smtp_port: {{ pangolin_mail_port }}
-  smtp_user: "{{ pangolin_mail_user }}"
-  smtp_pass: "{{ pangolin_mail_password }}"
-  smtp_secure: {{ pangolin_mail_secure_flag }}
-  no-reply: "{{ pangolin_no_reply_address }}"
--- a/ansible/playbooks/roles/prepare_node/tasks/main.yaml
+++ b/ansible/playbooks/roles/prepare_node/tasks/main.yaml
@ -1,6 +0,0 @@
---
- include_tasks: updates.yaml
- include_tasks: swap.yaml
-  when: configure_swap is defined
- include_tasks: iptables.yaml
-  when: ip_tables_coonfig is defined
--- a/ansible/playbooks/roles/prepare_node/tasks/swap.yaml
+++ b/ansible/playbooks/roles/prepare_node/tasks/swap.yaml
@ -1,15 +0,0 @@
---
- name: Add 1GB swap file
-  ansible.builtin.shell: |
-    fallocate -l 1G /swapfile
-    chmod 600 /swapfile
-    mkswap /swapfile
-    swapon /swapfile
-  args:
-    creates: /swapfile
-
- name: Make swap persistent
-  ansible.builtin.lineinfile:
-    dest: /etc/fstab
-    line: '/swapfile none swap sw 0 0'
-    state: present
--- a/ansible/playbooks/roles/prepare_node/tasks/updates.yaml
+++ b/ansible/playbooks/roles/prepare_node/tasks/updates.yaml
@ -1,15 +0,0 @@
---
- name: Update all packages
-  ansible.builtin.apt:
-    update_cache: true
-    upgrade: dist
-
- name: Install essential packages
-  ansible.builtin.apt:
-    name:
-      - net-tools
-      - curl
-      - wget
-      - htop
-      - vim
-    state: present
--- a/ansible/playbooks/roles/vaultwarden/defaults/main.yaml
+++ b/ansible/playbooks/roles/vaultwarden/defaults/main.yaml
@ -1,2 +0,0 @@
-vaultwarden_signup_allowed: true
-vaultwarden_image_tag: 1.37.2
--- a/ansible/playbooks/roles/vaultwarden/tasks/main.yaml
+++ b/ansible/playbooks/roles/vaultwarden/tasks/main.yaml
@ -1,4 +0,0 @@
---
- include_tasks: vaultwarden_docker.yaml
-  tags:
-    - vaultwarden
--- a/ansible/playbooks/roles/vaultwarden/tasks/vaultwarden_docker.yaml
+++ b/ansible/playbooks/roles/vaultwarden/tasks/vaultwarden_docker.yaml
@ -1,24 +0,0 @@
---
- name: Create docker compose directory
-  ansible.builtin.file:
-    path: "{{ docker_compose_projects_base_path }}/vaultwarden"
-    state: directory
-    mode: '0755'
-  register: compose_dir
-
- name: Create data directory
-  ansible.builtin.file:
-    path: "{{ compose_dir.path }}/data"
-    state: directory
-    mode: '0755'
-  register: vaultwarden_data_dir
-
- name: Copy compose file
-  ansible.builtin.template:
-    src: templates/vaultwarden_compose.yaml.j2
-    dest: "{{ compose_dir.path }}/compose.yaml"
-
-
- name: Starting Vaultwarden compose project
-  community.docker.docker_compose_v2:
-    project_src: "{{ compose_dir.path }}" 
--- a/ansible/playbooks/roles/vaultwarden/templates/vaultwarden_compose.yaml.j2
+++ b/ansible/playbooks/roles/vaultwarden/templates/vaultwarden_compose.yaml.j2
@ -1,19 +0,0 @@
-networks:
-  newt:
-    name: newt_compose_default
-    external: true
-
-services:
-  vaultwarden:
-    image: vaultwarden/server:{{ vaultwarden_image_tag }}
-    container_name: vaultwarden
-    restart: always
-    environment:
-      # DOMAIN: "https://vaultwarden.example.com"  # required when using a reverse proxy; your domain; vaultwarden needs to know it's https to work properly with attachments
-      SIGNUPS_ALLOWED: "{{ vaultwarden_signup_allowed }}" # Deactivate this with "false" after you have created your account so that no strangers can register
-    volumes:
-      - {{ vaultwarden_data_dir.path }}:/data # the path before the : can be changed
-    ports:
-      - 11001:80 # you can replace the 11001 with your preferred port
-    networks:
-      - newt
--- a/ansible/playbooks/static_nginx_page.yaml
+++ b/ansible/playbooks/static_nginx_page.yaml
@ -1,15 +1,9 @@
 ---
 - name : Nginx static with docker
  hosts: all
-  tasks:
-    - include_role:
-        name: geerlingguy.docker
-        apply:
-          become: true
-          become_exe: "{{ become_exe_value }}"
-
-    - include_role: 
-        name: "{{ item }}"
-      loop :
-        - newt_client
-        - nginx
+  become: true
+  roles:
+    - geerlingguy.docker
+    - newt_client
+    - nginx
+    
--- a/ansible/playbooks/vaultwarden.yaml
+++ b/ansible/playbooks/vaultwarden.yaml
@ -1,15 +0,0 @@
---
- name: Install Vaultwarden
-  hosts: vaultwarden
-  tasks:
-    - include_role:
-        name: geerlingguy.docker
-        apply:
-          become: true
-          become_exe: "{{ become_exe_value }}"
-          
-    - include_role:
-        name: "{{ item }}"
-      loop:
-        - newt_client
-        - vaultwarden
--- a/ansible/playbooks/vpn_server.yaml
+++ b/ansible/playbooks/vpn_server.yaml
@ -2,6 +2,5 @@
 - name: Configure VPN Server
  hosts: wireguard_server
  become: true
-  become_exe: "{{ become_exe_value }}"
  roles:
    - wireguard_server