ml
e197ba7370
Traefik: - Upgrade v3.3 → v3.6 to fix Docker API version negotiation failure with Docker Engine 29 (which dropped support for API < 1.40) Directory permissions: - Change all service parent directories from 0750 to 0755 so container processes can traverse them after dropping from root to a lower UID - Create db directories owned by postgres UID 999 (mode 0700) so PostgreSQL can access its data files across Ansible runs - Create /opt/gitea/data owned by git UID 1000 (Gitea writes there after dropping privileges) Healthchecks: - Fix Redis healthcheck: use CMD form instead of CMD-SHELL pipe (pipe was unreliable in Alpine) - Fix Keycloak healthcheck: use bash /dev/tcp on management port 9000 (curl not available in UBI image; was incorrectly targeting port 8080) Image tags: - Fix Roundcube: 1.6 and 1.6-apache do not exist; correct tag is 1.6.x-apache Bootstrap scripts: - bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo (deploy user has no password so sudo group alone was not enough) - run-bootstrap.sh: read server IP from inventory.ini, chmod 600 keys automatically, show actual SSH error on failure Inventory / config: - Add ansible_host to inventory.ini — server IP now defined in one place - Restructure group_vars/ into all/ directory so vault.yml is auto-loaded (previously it did not match any group name) - Move ansible.cfg to repo root (Ansible looks in cwd, not playbook dir) Docs: - Split runbook.md into runbook-provisioning.md and runbook-configuration.md - Add step 1 (set server IP) to provisioning runbook - Expand prerequisites with SSH key generation and upload instructions - Expand bootstrap step with preflight check details
54 lines
1.2 KiB
YAML
54 lines
1.2 KiB
YAML
---
|
|
- name: Create Gitea data directory
|
|
ansible.builtin.file:
|
|
path: "{{ gitea_data_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
tags: gitea
|
|
|
|
# Gitea runs as git (UID 1000) and writes directly to this directory
|
|
- name: Create Gitea app data directory (git UID 1000)
|
|
ansible.builtin.file:
|
|
path: "{{ gitea_data_dir }}/data"
|
|
state: directory
|
|
owner: "1000"
|
|
group: "1000"
|
|
mode: "0755"
|
|
tags: gitea
|
|
|
|
- name: Create Gitea database directory (postgres UID 999)
|
|
ansible.builtin.file:
|
|
path: "{{ gitea_data_dir }}/db"
|
|
state: directory
|
|
owner: "999"
|
|
group: "999"
|
|
mode: "0700"
|
|
tags: gitea
|
|
|
|
# Git-over-SSH runs on 2222 to avoid conflict with the host SSH on 22
|
|
- name: Allow Gitea SSH (2222/tcp)
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "2222"
|
|
proto: tcp
|
|
tags: gitea
|
|
|
|
- name: Deploy Docker Compose file
|
|
ansible.builtin.template:
|
|
src: docker-compose.yml.j2
|
|
dest: "{{ gitea_data_dir }}/docker-compose.yml"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart gitea
|
|
tags: gitea
|
|
|
|
- name: Start Gitea
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ gitea_data_dir }}"
|
|
state: present
|
|
pull: missing
|
|
tags: gitea
|