ml
e197ba7370
Traefik: - Upgrade v3.3 → v3.6 to fix Docker API version negotiation failure with Docker Engine 29 (which dropped support for API < 1.40) Directory permissions: - Change all service parent directories from 0750 to 0755 so container processes can traverse them after dropping from root to a lower UID - Create db directories owned by postgres UID 999 (mode 0700) so PostgreSQL can access its data files across Ansible runs - Create /opt/gitea/data owned by git UID 1000 (Gitea writes there after dropping privileges) Healthchecks: - Fix Redis healthcheck: use CMD form instead of CMD-SHELL pipe (pipe was unreliable in Alpine) - Fix Keycloak healthcheck: use bash /dev/tcp on management port 9000 (curl not available in UBI image; was incorrectly targeting port 8080) Image tags: - Fix Roundcube: 1.6 and 1.6-apache do not exist; correct tag is 1.6.x-apache Bootstrap scripts: - bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo (deploy user has no password so sudo group alone was not enough) - run-bootstrap.sh: read server IP from inventory.ini, chmod 600 keys automatically, show actual SSH error on failure Inventory / config: - Add ansible_host to inventory.ini — server IP now defined in one place - Restructure group_vars/ into all/ directory so vault.yml is auto-loaded (previously it did not match any group name) - Move ansible.cfg to repo root (Ansible looks in cwd, not playbook dir) Docs: - Split runbook.md into runbook-provisioning.md and runbook-configuration.md - Add step 1 (set server IP) to provisioning runbook - Expand prerequisites with SSH key generation and upload instructions - Expand bootstrap step with preflight check details
87 lines
3.1 KiB
YAML
87 lines
3.1 KiB
YAML
---
|
|
# Domains
|
|
domain_base: ladkau.de
|
|
domain_cloud: "cloud.{{ domain_base }}"
|
|
domain_gitea: "gitea.{{ domain_base }}"
|
|
domain_nextcloud: "nextcloud.{{ domain_base }}"
|
|
domain_sso: "sso.{{ domain_base }}"
|
|
domain_mail: "mail.{{ domain_base }}"
|
|
domain_registry: "cr.{{ domain_base }}"
|
|
domain_k8s: "k8s.{{ domain_base }}"
|
|
|
|
# Let's Encrypt
|
|
acme_email: matthias.ladkau@gmail.com
|
|
|
|
# Non-root deploy user created by the base role
|
|
deploy_user: deploy
|
|
|
|
# System timezone
|
|
timezone: Europe/Berlin
|
|
|
|
# Docker network shared by all services and Traefik
|
|
traefik_network: traefik_public
|
|
|
|
# Traefik
|
|
traefik_version: v3.6
|
|
traefik_data_dir: /opt/traefik
|
|
# htpasswd-formatted user list for the dashboard.
|
|
# Generate with: echo $(htpasswd -nB admin) | sed -e 's/\$/\$\$/g'
|
|
# Store the actual value in ansible/group_vars/all/vault.yml (Ansible Vault).
|
|
traefik_dashboard_users: ""
|
|
|
|
# Gitea
|
|
gitea_version: "1" # major-only tag — always pulls latest 1.x patch
|
|
gitea_db_version: "16" # PostgreSQL major version
|
|
gitea_data_dir: /opt/gitea
|
|
# Set to false for the very first deploy so the admin account can be created,
|
|
# then flip to true and redeploy to close public registration.
|
|
gitea_disable_registration: true
|
|
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
|
|
# gitea_db_password: ""
|
|
# gitea_secret_key: "" # generate: openssl rand -hex 32
|
|
# gitea_internal_token: "" # generate: openssl rand -hex 32
|
|
|
|
# SSO (Keycloak)
|
|
keycloak_version: "26.2"
|
|
keycloak_db_version: "16"
|
|
sso_data_dir: /opt/sso
|
|
keycloak_admin_user: admin
|
|
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
|
|
# keycloak_db_password: ""
|
|
# keycloak_admin_password: ""
|
|
|
|
# Nextcloud
|
|
nextcloud_version: "31-apache" # apache variant includes a working web server
|
|
nextcloud_db_version: "16"
|
|
nextcloud_data_dir: /opt/nextcloud
|
|
nextcloud_admin_user: admin
|
|
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
|
|
# nextcloud_db_password: ""
|
|
# nextcloud_admin_password: ""
|
|
|
|
# Mail (Roundcube webmail client)
|
|
roundcube_version: "1.6.x-apache"
|
|
roundcube_db_version: "16"
|
|
mail_data_dir: /opt/mail
|
|
# IMAP/SMTP — set to the mail server Roundcube should connect to.
|
|
# Leave imap_host empty to let users enter their own server at login.
|
|
# Use "ssl://hostname" for implicit TLS (port 993), or plain hostname for STARTTLS (port 143).
|
|
roundcube_imap_host: ""
|
|
roundcube_imap_port: "993"
|
|
roundcube_smtp_host: ""
|
|
roundcube_smtp_port: "587"
|
|
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
|
|
# roundcube_db_password: ""
|
|
# roundcube_des_key: "" # generate: openssl rand -hex 12 (must be exactly 24 chars)
|
|
|
|
# Container registry (Docker Registry v2)
|
|
registry_data_dir: /opt/registry
|
|
# registry_htpasswd — full htpasswd file content, store in vault.yml
|
|
# Generate with: docker run --entrypoint htpasswd httpd:2 -Bbn <user> <password>
|
|
# Multiple users: run the command once per user and concatenate the lines.
|
|
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
|
|
# registry_htpasswd: ""
|
|
|
|
# k8s (placeholder)
|
|
k8s_data_dir: /opt/k8s
|