infrastructure/ansible/main.yml

- hosts: all
  roles:
    - base
    - role: realorangeone.reflector
      when: ansible_os_family == 'Archlinux'
    - role: paccache
      when: ansible_os_family == 'Archlinux'

- hosts: casey
  roles:
    - nginx
    - role: geerlingguy.certbot
      become: true
    - gateway
    - nebula
    - headscale
    - fail2ban_ssh
    - restic
    - artis3n.tailscale
    - glinet_vpn

- hosts:
    - pve
    - casey
    - ingress
    - walker
    - tang
  roles:
    - role: geerlingguy.ntp
      become: true
      vars:
        ntp_timezone: "{{ timezone }}"
        ntp_manage_config: true

- hosts:
    - pve-docker
    - forrest
    - walker
    - renovate
    - gitea-runner
    - pve-dokku
  roles:
    - role: geerlingguy.docker
      become: true
      vars:
        docker_install_compose_plugin: "{{ ansible_os_family == 'Debian' }}"
        docker_install_compose: "{{ ansible_os_family == 'Debian' }}"
        docker_users:
          - "{{ me.user }}"
    - docker_cleanup

- hosts:
    - pve-docker
    - forrest
    - walker
    - pve-dokku
  roles:
    - db_auto_backup

- hosts:
    - pve-docker
  roles:
    - traefik

- hosts: pve-docker
  roles:
    - pve_docker
    - yourls
    - pve_nebula_route
    - privatebin
    - vaultwarden
    - tandoor
    - mastodon
    - gitea
    - vikunja
    - authentik
    - minio
    - ntfy

- hosts: ingress
  roles:
    - nginx
    - ingress
    - nebula
    - artis3n.tailscale

- hosts: pve
  roles:
    - role: ironicbadger.proxmox_nag_removal
      become: true
    - zfs
    - pve_nebula_route
    - role: ironicbadger.snapraid
      become: true
    - role: prometheus.prometheus.node_exporter
      become: true

- hosts: forrest
  roles:
    - prometheus
    - uptime_kuma
    - pve_nebula_route
    - pve_tailscale_route

- hosts: qbittorrent
  roles:
    - nginx
    - qbittorrent
    - http_proxy

- hosts: walker
  roles:
    - nginx
    - role: geerlingguy.certbot
      become: true
    - nebula
    - coredns_docker_proxy
    - plausible
    - restic
    - commento
    - website
    - artis3n.tailscale
    - slides
    - comentario

- hosts: jellyfin
  roles:
    - jellyfin

- hosts: restic
  roles:
    - restic
    - s3_sync

- hosts: gitea-runner
  roles:
    - gitea_runner

- hosts: renovate
  roles:
    - renovate

- hosts: tang
  roles:
    - adguardhome
    - role: prometheus.prometheus.node_exporter
      become: true
    - restic

- hosts: pve-dokku
  roles:
    - nginx
    - dokku
COnfigure SSH bastion 2019-12-08 15:55:19 +00:00			`- hosts: all`
Install NTP 2019-12-08 21:17:30 +00:00			`roles:`
Merge SSH into base role 2020-05-23 10:58:09 +01:00			`- base`
Conditionally run reflector role rather than manually defining which machines run arch 2020-08-19 18:58:58 +01:00			`- role: realorangeone.reflector`
			`when: ansible_os_family == 'Archlinux'`
Clear pacman cache 2022-11-14 09:04:53 +00:00			`- role: paccache`
			`when: ansible_os_family == 'Archlinux'`
COnfigure SSH bastion 2019-12-08 15:55:19 +00:00
			`- hosts: casey`
			`roles:`
Ensure nginx is in place before certbot tries to issue certs 2024-05-04 12:52:33 +01:00			`- nginx`
Deploy headscale 2024-01-27 14:18:37 +00:00			`- role: geerlingguy.certbot`
			`become: true`
Define haproxy config 2019-12-08 16:47:28 +00:00			`- gateway`
Init some skeleton nebula stuff 2021-01-25 21:53:04 +00:00			`- nebula`
Deploy headscale 2024-01-27 14:18:37 +00:00			`- headscale`
Add fail2ban for traefik Remote action coming soon 2021-03-28 13:05:31 +01:00			`- fail2ban_ssh`
Back up headscale config 2024-01-27 15:04:53 +00:00			`- restic`
Install tailscale Install, not configure 2024-02-01 19:41:47 +00:00			`- artis3n.tailscale`
Add wireguard config for glinet router 2024-04-23 22:19:57 +01:00			`- glinet_vpn`
Internalise SSH config and make it generic to all hosts 2020-01-28 20:39:42 +00:00
Don't install NTP on LXC containers This can cause issues with containers trying to sync the system clock, and getting it wrong 2021-03-04 15:45:47 +00:00			`- hosts:`
			`- pve`
			`- casey`
			`- ingress`
Provision `walker` 2021-04-24 21:19:04 +01:00			`- walker`
Setup NTP on tang 2023-01-16 09:11:15 +00:00			`- tang`
Don't install NTP on LXC containers This can cause issues with containers trying to sync the system clock, and getting it wrong 2021-03-04 15:45:47 +00:00			`roles:`
			`- role: geerlingguy.ntp`
			`become: true`
			`vars:`
Update yamllint to fix dependency issue I think this still validates everything we need it to 2022-01-11 20:51:12 +00:00			`ntp_timezone: "{{ timezone }}"`
Don't install NTP on LXC containers This can cause issues with containers trying to sync the system clock, and getting it wrong 2021-03-04 15:45:47 +00:00			`ntp_manage_config: true`

Make `grimes` a docker host 2020-04-26 13:44:06 +01:00			`- hosts:`
Provision docker VM 2020-12-28 15:57:44 +00:00			`- pve-docker`
Install docker on `forrest` I'll be migrating it to docker, so I can run more things simply under Docker 2021-02-08 21:56:06 +00:00			`- forrest`
Provision `walker` 2021-04-24 21:19:04 +01:00			`- walker`
Create a dedicated machine for renovate This way it can do what it wants with docker. Because apparently it's very picky about how it's setup 2022-01-01 22:58:03 +00:00			`- renovate`
Deploy gitea's runner Unofficial container, because there isn't an official one 2023-03-26 00:01:55 +00:00			`- gitea-runner`
Bootstrap a new dokku machine on PVE 2023-09-29 22:03:23 +01:00			`- pve-dokku`
Internalise SSH config and make it generic to all hosts 2020-01-28 20:39:42 +00:00			`roles:`
Use ansible galaxy to install docker 2020-03-02 19:37:11 +00:00			`- role: geerlingguy.docker`
			`become: true`
			`vars:`
Update some ansible galaxy roles 2023-05-06 21:54:22 +01:00			`docker_install_compose_plugin: "{{ ansible_os_family == 'Debian' }}"`
Only install compose on debian The rest will get it through the system package manager 2024-04-27 17:42:24 +01:00			`docker_install_compose: "{{ ansible_os_family == 'Debian' }}"`
Use ansible galaxy to install docker 2020-03-02 19:37:11 +00:00			`docker_users:`
Fix new ansible-lint errors Quite a few changes here, hopefully they work! 2023-06-15 15:16:19 +01:00			`- "{{ me.user }}"`
Update ansible-lint Required a lot of renaming :( 2020-09-26 17:53:47 +01:00			`- docker_cleanup`
Initially provision `deluge` machine Based on Docker, so deluge itself is easier to install and keep updated. Until such time it's in the repos 2021-02-01 15:40:06 +00:00
Add container to automatically backup DBs 2022-01-16 16:55:40 +00:00			`- hosts:`
			`- pve-docker`
			`- forrest`
			`- walker`
Deploy db-auto-backup to dokku It might have DBs somewhen 2023-10-01 16:47:06 +01:00			`- pve-dokku`
Add container to automatically backup DBs 2022-01-16 16:55:40 +00:00			`roles:`
			`- db_auto_backup`

Initially provision `deluge` machine Based on Docker, so deluge itself is easier to install and keep updated. Until such time it's in the repos 2021-02-01 15:40:06 +00:00			`- hosts:`
			`- pve-docker`
			`roles:`
Convert watchtower into its own role 2020-04-23 21:51:01 +01:00			`- traefik`
Install docker on new server 2020-07-12 19:21:27 +01:00
Move docker containers to new PVE container 2021-01-09 18:02:17 +00:00			`- hosts: pve-docker`
Make `grimes` a docker host 2020-04-26 13:44:06 +01:00			`roles:`
Move docker containers to new PVE container 2021-01-09 18:02:17 +00:00			`- pve_docker`
Deploy yourls 2021-01-22 21:29:27 +00:00			`- yourls`
Allow PVE VMs to access nebula hosts via ingress 2021-01-31 12:19:33 +00:00			`- pve_nebula_route`
Provision privatebin 2021-02-12 23:32:31 +00:00			`- privatebin`
Update bitwarden_rs to vaultwarden I'll do the full rename of everything another time 2021-05-01 23:00:37 +01:00			`- vaultwarden`
Deploy tandoor 2022-08-24 22:17:29 +01:00			`- tandoor`
Deploy me a mastodon 2022-11-18 09:12:28 +00:00			`- mastodon`
Add a gitea deployment Yep, it's that time of year _again_ 2023-01-27 17:28:45 +00:00			`- gitea`
Deploy vikunja 2023-09-07 20:18:32 +01:00			`- vikunja`
Deploy authentik _again_. 2023-11-07 20:47:19 +00:00			`- authentik`
Deploy minio My own S3, for various things 2023-11-12 21:23:54 +00:00			`- minio`
Deploy ntfy 2023-12-23 16:40:53 +00:00			`- ntfy`
Host website outside home 2020-04-26 14:26:48 +01:00
Install and provision wireguard client on ingress server 2020-12-21 18:24:35 +00:00			`- hosts: ingress`
			`roles:`
Unify nginx configuration This creates a simple base configuration skeleton, that other configuration can be easily loaded into. 2023-12-16 17:47:04 +00:00			`- nginx`
Install and provision wireguard client on ingress server 2020-12-21 18:24:35 +00:00			`- ingress`
Provision remaining nebula instances 2021-01-30 20:46:49 +00:00			`- nebula`
Install tailscale Install, not configure 2024-02-01 19:41:47 +00:00			`- artis3n.tailscale`
Add roles to handle PVE nag and repos 2021-01-09 23:21:35 +00:00
			`- hosts: pve`
			`roles:`
Pin versions of galaxy requirements 2022-05-07 12:08:52 +01:00			`- role: ironicbadger.proxmox_nag_removal`
Add roles to handle PVE nag and repos 2021-01-09 23:21:35 +00:00			`become: true`
Decommission `walker` Kimsufi is just too annoying of a host. Everything has either been moved off, killed, or has further plans. 2021-01-28 18:56:39 +00:00			`- zfs`
Allow PVE VMs to access nebula hosts via ingress 2021-01-31 12:19:33 +00:00			`- pve_nebula_route`
Pin versions of galaxy requirements 2022-05-07 12:08:52 +01:00			`- role: ironicbadger.snapraid`
Version snapraid config Using fork of role at https://github.com/IronicBadger/ansible-role-snapraid/pull/7 2021-06-25 22:43:26 +01:00			`become: true`
Replace telegraf with prometheus exporters Still missing SMART and ping, but those can come later. Swapped as the polling model for prometheus doesn't play especially well with telegraf, and leads to gaps in data 2023-01-31 09:11:09 +00:00			`- role: prometheus.prometheus.node_exporter`
			`become: true`
Move grafana to `forrest` 2021-01-31 16:52:24 +00:00
			`- hosts: forrest`
			`roles:`
Rename forrest role to prometheus Makes organising much simpler 2024-04-21 19:47:02 +01:00			`- prometheus`
Deploy uptime-kuma 2024-04-21 18:11:39 +01:00			`- uptime_kuma`
Connect `forrest` to nebula hosts 2021-03-04 16:08:53 +00:00			`- pve_nebula_route`
Add routes from forrest to tailscale network 2024-02-07 22:12:08 +00:00			`- pve_tailscale_route`
Deploy deluge in docker Makes version managing so much easier! 2021-02-01 17:24:36 +00:00
Swap out deluge for qbittorrent Just run on arch instead of docker, too. Much simpler. 2021-04-16 21:49:00 +01:00			`- hosts: qbittorrent`
Deploy deluge in docker Makes version managing so much easier! 2021-02-01 17:24:36 +00:00			`roles:`
Unify nginx configuration This creates a simple base configuration skeleton, that other configuration can be easily loaded into. 2023-12-16 17:47:04 +00:00			`- nginx`
Swap out deluge for qbittorrent Just run on arch instead of docker, too. Much simpler. 2021-04-16 21:49:00 +01:00			`- qbittorrent`
Add squid as a forwarding proxy so containers are exposed through a VPN Implementation isn't perfect, but as `qbittorrent` already had an outbound VPN connection, it makes sense to just reuse it. 2022-11-06 18:26:09 +00:00			`- http_proxy`
Provision `walker` 2021-04-24 21:19:04 +01:00
			`- hosts: walker`
			`roles:`
Ensure nginx is in place before certbot tries to issue certs 2024-05-04 12:52:33 +01:00			`- nginx`
Use certbot to issue certificates 2023-12-21 16:35:20 +00:00			`- role: geerlingguy.certbot`
			`become: true`
Provision `walker` 2021-04-24 21:19:04 +01:00			`- nebula`
Rename coredns role 2024-01-02 17:02:34 +00:00			`- coredns_docker_proxy`
Move plausible to walker 2021-05-02 16:07:25 +01:00			`- plausible`
Add restic to `walker` 2021-05-09 14:26:21 +01:00			`- restic`
Deploy commento++ 2022-06-05 15:44:49 +01:00			`- commento`
Add hosting for new website Top sneaky 2022-10-29 18:09:30 +01:00			`- website`
Install tailscale Install, not configure 2024-02-01 19:41:47 +00:00			`- artis3n.tailscale`
Deploy slides hosting 2024-03-03 21:39:22 +00:00			`- slides`
Deploy comentario 2024-06-22 21:20:54 +01:00			`- comentario`
Install jellyfin through Ansible 2021-05-02 12:04:48 +01:00
			`- hosts: jellyfin`
			`roles:`
			`- jellyfin`
Add some restic wrapper things 2021-05-08 14:23:21 +01:00
			`- hosts: restic`
			`roles:`
			`- restic`
Sync terraform state to `restic` This allows it to be backed up easily 2024-01-09 19:46:40 +00:00			`- s3_sync`
Init a GitLab server Some day i'll make up my mind on which server to use, honest! 2021-05-28 22:49:48 +01:00
Deploy gitea's runner Unofficial container, because there isn't an official one 2023-03-26 00:01:55 +00:00			`- hosts: gitea-runner`
			`roles:`
			`- gitea_runner`

Create a dedicated machine for renovate This way it can do what it wants with docker. Because apparently it's very picky about how it's setup 2022-01-01 22:58:03 +00:00			`- hosts: renovate`
			`roles:`
			`- renovate`
Add internal alias to pihole 2023-01-08 18:36:03 +00:00
			`- hosts: tang`
			`roles:`
Replace pihole with adguardhome AGH is much simpler to install and manage, and does DoH natively. 2024-01-01 15:48:14 +00:00			`- adguardhome`
Install node-exporter on pi-hole 2023-01-31 23:08:07 +00:00			`- role: prometheus.prometheus.node_exporter`
			`become: true`
Add backups to tang 2024-01-08 19:20:55 +00:00			`- restic`
Deploy a dokku 2023-10-01 16:25:20 +01:00
			`- hosts: pve-dokku`
			`roles:`
Unify nginx configuration This creates a simple base configuration skeleton, that other configuration can be easily loaded into. 2023-12-16 17:47:04 +00:00			`- nginx`
Deploy a dokku 2023-10-01 16:25:20 +01:00			`- dokku`