Fix all issues found during first live provisioning run
Traefik: - Upgrade v3.3 → v3.6 to fix Docker API version negotiation failure with Docker Engine 29 (which dropped support for API < 1.40) Directory permissions: - Change all service parent directories from 0750 to 0755 so container processes can traverse them after dropping from root to a lower UID - Create db directories owned by postgres UID 999 (mode 0700) so PostgreSQL can access its data files across Ansible runs - Create /opt/gitea/data owned by git UID 1000 (Gitea writes there after dropping privileges) Healthchecks: - Fix Redis healthcheck: use CMD form instead of CMD-SHELL pipe (pipe was unreliable in Alpine) - Fix Keycloak healthcheck: use bash /dev/tcp on management port 9000 (curl not available in UBI image; was incorrectly targeting port 8080) Image tags: - Fix Roundcube: 1.6 and 1.6-apache do not exist; correct tag is 1.6.x-apache Bootstrap scripts: - bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo (deploy user has no password so sudo group alone was not enough) - run-bootstrap.sh: read server IP from inventory.ini, chmod 600 keys automatically, show actual SSH error on failure Inventory / config: - Add ansible_host to inventory.ini — server IP now defined in one place - Restructure group_vars/ into all/ directory so vault.yml is auto-loaded (previously it did not match any group name) - Move ansible.cfg to repo root (Ansible looks in cwd, not playbook dir) Docs: - Split runbook.md into runbook-provisioning.md and runbook-configuration.md - Add step 1 (set server IP) to provisioning runbook - Expand prerequisites with SSH key generation and upload instructions - Expand bootstrap step with preflight check details
This commit is contained in:
ml
@@ -0,0 +1,68 @@
|
||||
# Configuration Runbook
|
||||
|
||||
First-run configuration steps to perform after the Ansible playbook has
|
||||
provisioned the server. See `runbook-provisioning.md` for the provisioning steps.
|
||||
|
||||
## Gitea
|
||||
|
||||
`gitea_disable_registration` defaults to `true`. For the first deploy, override
|
||||
it to `false` so the setup wizard can create the admin account:
|
||||
|
||||
```bash
|
||||
ansible-vault edit ansible/group_vars/all/vault.yml
|
||||
# add: gitea_disable_registration: false
|
||||
ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags gitea --ask-vault-pass
|
||||
```
|
||||
|
||||
After the admin account is created at `https://gitea.ladkau.de`, remove the
|
||||
override and redeploy to close public registration.
|
||||
|
||||
## Keycloak
|
||||
|
||||
`KEYCLOAK_ADMIN` / `KEYCLOAK_ADMIN_PASSWORD` bootstrap the initial admin account
|
||||
on first start only — Keycloak ignores them once the account exists. After
|
||||
logging in at `https://sso.ladkau.de`, change the admin password via the UI.
|
||||
|
||||
Keycloak takes ~90 seconds to start. If the login page is not immediately
|
||||
available, wait and retry.
|
||||
|
||||
## Nextcloud
|
||||
|
||||
Nextcloud runs its first-time installation on the initial HTTP request, which
|
||||
takes a minute or two. The admin credentials are set via `nextcloud_admin_user`
|
||||
and `nextcloud_admin_password` in the vault.
|
||||
|
||||
## Roundcube
|
||||
|
||||
Roundcube is a webmail client — it does not host mail itself. Configure the IMAP
|
||||
and SMTP servers it connects to via `ansible/group_vars/all/vars.yml`:
|
||||
|
||||
```yaml
|
||||
roundcube_imap_host: "ssl://mail.example.com" # implicit TLS (port 993)
|
||||
roundcube_smtp_host: "mail.example.com" # STARTTLS (port 587)
|
||||
```
|
||||
|
||||
Leave both empty to let users enter their own server at login.
|
||||
|
||||
## Container registry
|
||||
|
||||
```bash
|
||||
# Login
|
||||
docker login cr.ladkau.de
|
||||
|
||||
# Push
|
||||
docker tag myimage:latest cr.ladkau.de/myimage:latest
|
||||
docker push cr.ladkau.de/myimage:latest
|
||||
|
||||
# Pull
|
||||
docker pull cr.ladkau.de/myimage:latest
|
||||
```
|
||||
|
||||
Registry credentials are managed via `registry_htpasswd` in the vault. To add
|
||||
or rotate a user, regenerate the htpasswd entry and redeploy:
|
||||
|
||||
```bash
|
||||
docker run --entrypoint htpasswd httpd:2 -Bbn <user> <password>
|
||||
# update registry_htpasswd in vault, then:
|
||||
ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags registry --ask-vault-pass
|
||||
```
|
||||
@@ -3,6 +3,9 @@
|
||||
Follow these steps to provision the server from scratch — whether setting it up
|
||||
for the first time or reinstalling after a wipe.
|
||||
|
||||
After provisioning completes, follow `runbook-configuration.md` for first-run
|
||||
setup of individual services.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
### Local tools
|
||||
@@ -179,42 +182,6 @@ To apply a single role:
|
||||
ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags <role> --ask-vault-pass
|
||||
```
|
||||
|
||||
## First-run notes
|
||||
|
||||
### Gitea
|
||||
|
||||
`gitea_disable_registration` defaults to `true`. For the first deploy, override
|
||||
it to `false` in `vault.yml` so the setup wizard can create the admin account:
|
||||
|
||||
```bash
|
||||
ansible-vault edit ansible/group_vars/all/vault.yml
|
||||
# add: gitea_disable_registration: false
|
||||
ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags gitea --ask-vault-pass
|
||||
```
|
||||
|
||||
After the admin account is created at `https://gitea.ladkau.de`, remove the
|
||||
override and redeploy to close public registration.
|
||||
|
||||
### Keycloak
|
||||
|
||||
`KEYCLOAK_ADMIN` / `KEYCLOAK_ADMIN_PASSWORD` bootstrap the initial admin account
|
||||
on first start only — Keycloak ignores them once the account exists. After
|
||||
logging in at `https://sso.ladkau.de`, change the admin password via the UI.
|
||||
|
||||
### Container registry
|
||||
|
||||
```bash
|
||||
# Login
|
||||
docker login cr.ladkau.de
|
||||
|
||||
# Push
|
||||
docker tag myimage:latest cr.ladkau.de/myimage:latest
|
||||
docker push cr.ladkau.de/myimage:latest
|
||||
|
||||
# Pull
|
||||
docker pull cr.ladkau.de/myimage:latest
|
||||
```
|
||||
|
||||
## Scripts reference
|
||||
|
||||
| Script | Purpose |
|
||||
Reference in New Issue
Block a user