matthias/server_cloud_ladkau_de
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adding gitea act_runner roles

Browse Source
This commit is contained in:
ml
2026-07-02 07:49:53 +02:00
parent 2ccf2c9826
commit c968995481
10 changed files with 185 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/runbook-provisioning.md
+26 -14
View File
@@ -121,6 +121,10 @@ registry_users:
- username: alice
password: "your-password"
# Gitea Actions runners — token obtained after Gitea is running
# See step 3.4 of runbook-configuration.md; replace after Gitea admin account is created
gitea_runner_registration_token: "placeholder"
# Vaultwarden password vault
vaultwarden_admin_token: "" # generate: openssl rand -hex 32
# vaultwarden_sso_client_secret is added after Keycloak is configured — see
@@ -203,20 +207,28 @@ ansible-playbook -i ansible/inventory.ini ansible/site.yml --ask-vault-pass
This runs all roles in order:
| # | Role | What it does |
|---|------------|--------------|
| 1 | `base` | OS hardening, deploy user, SSH config, ufw firewall, fail2ban |
| 2 | `docker` | Docker Engine + Compose plugin, shared Traefik network |
| 3 | `traefik` | Reverse proxy, automatic TLS via Let's Encrypt |
| 4 | `gitea` | Self-hosted Git with PostgreSQL |
| 5 | `nextcloud`| File storage with PostgreSQL, Redis, cron sidecar |
| 6 | `sso` | Keycloak single sign-on with PostgreSQL |
| 7 | `mail` | Roundcube webmail client with PostgreSQL |
| 8 | `registry` | Docker Registry v2 with htpasswd auth |
| 9 | `k8s` | Placeholder page at k8s.ladkau.de |
| 10 | `vaultwarden` | Vaultwarden password vault at vault.ladkau.de |
| 11 | `dl` | Public download server at dl.ladkau.de — nginx HTTPS + SFTP upload |
| 12 | `dashboard` | Public status dashboard at cloud.ladkau.de — service health and server stats |
| # | Role | What it does |
|----|---------------|--------------|
| 1 | `base` | OS hardening, deploy user, SSH config, ufw firewall, fail2ban |
| 2 | `docker` | Docker Engine + Compose plugin, shared Traefik network |
| 3 | `traefik` | Reverse proxy, automatic TLS via Let's Encrypt |
| 4 | `gitea` | Self-hosted Git with PostgreSQL |
| 5 | `act_runner` | Three Gitea Actions runners with Docker executor |
| 6 | `nextcloud` | File storage with PostgreSQL, Redis, cron sidecar |
| 7 | `sso` | Keycloak single sign-on with PostgreSQL |
| 8 | `mail` | Roundcube webmail client with PostgreSQL |
| 9 | `registry` | Docker Registry v2 with htpasswd auth |
| 10 | `k8s` | Placeholder page at k8s.ladkau.de |
| 11 | `vaultwarden` | Vaultwarden password vault at vault.ladkau.de |
| 12 | `dl` | Public download server at dl.ladkau.de — nginx HTTPS + SFTP upload |
| 13 | `dashboard` | Public status dashboard at cloud.ladkau.de — service health and server stats |
> **Note:** The `act_runner` role requires `gitea_runner_registration_token` in the
> vault, which can only be obtained after Gitea is running and an admin account has
> been created. On a fresh provisioning run the role will fail if the token is
> absent. Either add a placeholder and redeploy with `--tags act_runner` after
> Gitea is configured (see step 3.4 of `runbook-configuration.md`), or skip the
> role on first run: `--skip-tags act_runner`.
To apply a single role: