Implemented all service roles

- docker: install Docker Engine from official apt repo, configure log rotation, create shared traefik_public network - traefik: reverse proxy with automatic Let's Encrypt TLS, dashboard on cloud.ladkau.de behind basic auth - gitea: self-hosted Git with PostgreSQL, Git-over-SSH on port 2222 - sso: Keycloak with PostgreSQL for OIDC/OAuth2 single sign-on - nextcloud: file storage with PostgreSQL, Redis, cron sidecar, CalDAV/CardDAV well-known redirects - mail: Roundcube webmail client with PostgreSQL - registry: Docker Registry v2 with htpasswd auth, no upload size limit - k8s: placeholder nginx page All secrets documented in vault.yml; runbook updated with per-service first-run notes.
2026-06-27 15:35:15 +02:00
parent 6115d9d48f
commit 75a0f21f74
30 changed files with 979 additions and 10 deletions
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>k8s.ladkau.de</title>
+  <style>
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+      background: #0f1117;
+      color: #e2e8f0;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      min-height: 100vh;
+      margin: 0;
+    }
+    .box {
+      text-align: center;
+      padding: 3rem;
+    }
+    h1 {
+      font-size: 2rem;
+      font-weight: 600;
+      color: #f8fafc;
+    }
+  </style>
+</head>
+<body>
+  <div class="box">
+    <h1>k8s.ladkau.de</h1>
+  </div>
+</body>
+</html>
@@ -0,0 +1,7 @@
+---
+- name: Restart k8s
+  community.docker.docker_compose_v2:
+    project_src: "{{ k8s_data_dir }}"
+    state: present
+    pull: missing
+    recreate: always
@@ -1,2 +1,39 @@
 ---
-# TODO: implement k8s role
+# Placeholder — serves a static HTML page at k8s.ladkau.de
+- name: Create k8s placeholder directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop:
+    - "{{ k8s_data_dir }}"
+    - "{{ k8s_data_dir }}/html"
+  tags: k8s
+
+- name: Deploy placeholder HTML page
+  ansible.builtin.copy:
+    src: index.html
+    dest: "{{ k8s_data_dir }}/html/index.html"
+    owner: root
+    group: root
+    mode: "0644"
+  tags: k8s
+
+- name: Deploy Docker Compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ k8s_data_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart k8s
+  tags: k8s
+
+- name: Start k8s placeholder
+  community.docker.docker_compose_v2:
+    project_src: "{{ k8s_data_dir }}"
+    state: present
+    pull: missing
+  tags: k8s
@@ -0,0 +1,20 @@
+# Managed by Ansible — do not edit manually
+services:
+  k8s-placeholder:
+    image: nginx:alpine
+    container_name: k8s-placeholder
+    restart: unless-stopped
+    volumes:
+      - {{ k8s_data_dir }}/html:/usr/share/nginx/html:ro
+    networks:
+      - traefik_public
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.k8s.rule=Host(`{{ domain_k8s }}`)"
+      - "traefik.http.routers.k8s.entrypoints=websecure"
+      - "traefik.http.routers.k8s.tls.certresolver=letsencrypt"
+      - "traefik.http.services.k8s.loadbalancer.server.port=80"
+
+networks:
+  traefik_public:
+    external: true