ml
f53ccbab4a
- New dl role — nginx serves files publicly over HTTPS with directory listing; atmoz/sftp on port 2223 for key-only uploads; both containers share /opt/dl/files volume - check-vault.sh gains a third tier: optional secrets are validated when present — vaultwarden_sso_client_secret must be non-empty, dl_sftp_authorized_keys must begin with a recognised SSH public key prefix - dl.ladkau.de added to DNS table, check-services.sh, and status dashboard - Configuration runbook section 7: deploy key generation, Gitea Actions scp workflow example, and SFTP client connection settings - Provisioning runbook documents the three-tier vault validation behaviour
119 lines
4.1 KiB
YAML
119 lines
4.1 KiB
YAML
---
|
|
# Domains
|
|
domain_base: ladkau.de
|
|
domain_cloud: "cloud.{{ domain_base }}"
|
|
domain_gitea: "gitea.{{ domain_base }}"
|
|
domain_nextcloud: "nextcloud.{{ domain_base }}"
|
|
domain_sso: "sso.{{ domain_base }}"
|
|
domain_mail: "mail.{{ domain_base }}"
|
|
domain_registry: "cr.{{ domain_base }}"
|
|
domain_k8s: "k8s.{{ domain_base }}"
|
|
domain_vault: "vault.{{ domain_base }}"
|
|
domain_dl: "dl.{{ domain_base }}"
|
|
|
|
# Let's Encrypt
|
|
acme_email: matthias.ladkau@gmail.com
|
|
|
|
# Non-root deploy user created by the base role
|
|
deploy_user: deploy
|
|
|
|
# System timezone
|
|
timezone: Europe/Berlin
|
|
|
|
# Docker network shared by all services and Traefik
|
|
traefik_network: traefik_public
|
|
|
|
# Traefik
|
|
traefik_version: v3.6
|
|
traefik_data_dir: /opt/traefik
|
|
# Dashboard basic-auth users — plaintext passwords, Ansible generates bcrypt hashes at deploy time
|
|
# traefik_dashboard_users:
|
|
# - username: admin
|
|
# password: "your-password"
|
|
traefik_dashboard_users: []
|
|
|
|
# Gitea
|
|
gitea_version: "1" # major-only tag — always pulls latest 1.x patch
|
|
gitea_db_version: "16" # PostgreSQL major version
|
|
gitea_data_dir: /opt/gitea
|
|
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
|
|
# gitea_db_password: ""
|
|
# gitea_secret_key: "" # generate: openssl rand -hex 32
|
|
# gitea_internal_token: "" # generate: openssl rand -hex 32
|
|
|
|
# SSO (Keycloak)
|
|
keycloak_version: "26.2"
|
|
keycloak_db_version: "16"
|
|
sso_data_dir: /opt/sso
|
|
keycloak_admin_user: admin
|
|
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
|
|
# keycloak_db_password: ""
|
|
# keycloak_admin_password: ""
|
|
|
|
# Nextcloud
|
|
nextcloud_version: "31-apache" # apache variant includes a working web server
|
|
nextcloud_db_version: "16"
|
|
nextcloud_data_dir: /opt/nextcloud
|
|
nextcloud_admin_user: admin
|
|
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
|
|
# nextcloud_db_password: ""
|
|
# nextcloud_admin_password: ""
|
|
|
|
# Mail (Roundcube + Dovecot IMAP + Fetchmail)
|
|
roundcube_version: "1.6.x-apache"
|
|
roundcube_db_version: "16"
|
|
mail_data_dir: /opt/mail
|
|
# Dovecot IMAP server — Roundcube always connects to the local Dovecot container
|
|
dovecot_version: "2.3"
|
|
# SMTP — outgoing mail server for Roundcube (leave empty if not configured)
|
|
roundcube_smtp_host: ""
|
|
roundcube_smtp_port: "587"
|
|
# Fetchmail — polls external POP3 accounts and delivers to local Dovecot via LMTP
|
|
# poll_minutes is per-account (default: 10 minutes)
|
|
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
|
|
# roundcube_db_password: ""
|
|
# roundcube_des_key: "" # generate: openssl rand -hex 12 (must be exactly 24 chars)
|
|
#
|
|
# Dovecot users — list of {username, password} pairs (plaintext, vault is encrypted)
|
|
# dovecot_users:
|
|
# - username: alice
|
|
# password: "plaintext-password"
|
|
#
|
|
# Fetchmail accounts — list of external POP3 sources to poll
|
|
# fetchmail_accounts:
|
|
# - server: pop.gmail.com
|
|
# username: user@gmail.com
|
|
# password: app-password
|
|
# local_user: alice
|
|
# protocol: pop3 # default: pop3
|
|
# ssl: true # default: true
|
|
# keep: true # default: true — set false to delete from source after fetch
|
|
|
|
# Container registry (Docker Registry v2)
|
|
registry_data_dir: /opt/registry
|
|
# Registry users — plaintext passwords, Ansible generates bcrypt hashes at deploy time
|
|
# registry_users:
|
|
# - username: alice
|
|
# password: "your-password"
|
|
|
|
# k8s (placeholder)
|
|
k8s_data_dir: /opt/k8s
|
|
|
|
# Vaultwarden (self-hosted Bitwarden-compatible password vault)
|
|
vaultwarden_version: "latest"
|
|
vaultwarden_data_dir: /opt/vaultwarden
|
|
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
|
|
# vaultwarden_admin_token: "" # generate: openssl rand -hex 32
|
|
# vaultwarden_sso_client_secret: "" # added after Keycloak is configured — see runbook-configuration.md step 2.6
|
|
|
|
# Download server (nginx HTTPS + SFTP)
|
|
dl_data_dir: /opt/dl
|
|
dl_upload_user: uploader
|
|
dl_sftp_port: 2223
|
|
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
|
|
# dl_sftp_authorized_keys: |
|
|
# ssh-ed25519 AAAA... gitea-actions
|
|
|
|
# Status dashboard (public — cloud.ladkau.de root)
|
|
dashboard_data_dir: /opt/dashboard
|