ml
187c6bdea4
- Add local Dovecot IMAP server exposed via Traefik IMAPS on port 993; Roundcube now connects to it internally instead of requiring manual server entry - Add Fetchmail integration for pulling from external POP3 accounts with configurable per-account poll interval - Fix Gitea SSO registration: DISABLE_REGISTRATION=false + ALLOW_ONLY_EXTERNAL_REGISTRATION allows Keycloak-authenticated users to get accounts while blocking public sign-up; disable legacy OpenID 2.0 sign-in - Fix Keycloak post-logout redirect for Nextcloud (valid post logout redirect URI) - Replace all pre-hashed credentials (Traefik dashboard, registry, Dovecot) with plaintext passwords in vault; Ansible generates deterministic bcrypt/SHA-512 hashes at deploy time — no more manual htpasswd commands - Rewrite check-vault.sh with Python/PyYAML to properly validate both scalar and list-type secrets - Update provisioning and configuration runbooks throughout
41 lines
917 B
YAML
41 lines
917 B
YAML
---
|
|
- name: Create registry data directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
loop:
|
|
- "{{ registry_data_dir }}"
|
|
- "{{ registry_data_dir }}/data"
|
|
- "{{ registry_data_dir }}/auth"
|
|
tags: registry
|
|
|
|
- name: Deploy htpasswd file
|
|
ansible.builtin.template:
|
|
src: htpasswd.j2
|
|
dest: "{{ registry_data_dir }}/auth/htpasswd"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
notify: Restart registry
|
|
tags: registry
|
|
|
|
- name: Deploy Docker Compose file
|
|
ansible.builtin.template:
|
|
src: docker-compose.yml.j2
|
|
dest: "{{ registry_data_dir }}/docker-compose.yml"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart registry
|
|
tags: registry
|
|
|
|
- name: Start registry
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ registry_data_dir }}"
|
|
state: present
|
|
pull: missing
|
|
tags: registry
|