infrastructure/ansible/main.yml

- hosts: all
  roles:
    - base
    - role: realorangeone.reflector
      when: ansible_os_family == 'Archlinux'
    - role: paccache
      when: ansible_os_family == 'Archlinux'

- hosts: casey
  roles:
    - gateway
    - nebula
    - fail2ban_ssh
    - wireguard_53

- hosts:
    - pve
    - casey
    - ingress
    - walker
    - grimes
  roles:
    - role: geerlingguy.ntp
      become: true
      vars:
        ntp_timezone: "{{ timezone }}"
        ntp_manage_config: true

- hosts:
    - pve-docker
    - forrest
    - walker
    - pve-gitlab-runner
    - grimes
    - renovate
  roles:
    - role: geerlingguy.docker
      become: true
      vars:
        docker_install_compose: "{{ ansible_os_family == 'Debian' }}"
        docker_package: "{{ 'docker-ce' if ansible_os_family == 'Debian' else 'docker' }}"
        docker_users:
          - "{{ user }}"
    - docker_cleanup

- hosts:
    - pve-docker
    - forrest
    - walker
    - grimes
  roles:
    - db_auto_backup

- hosts:
    - pve-docker
    - walker
  roles:
    - traefik

- hosts: pve-docker
  roles:
    - pve_docker
    - yourls
    - pve_nebula_route
    - privatebin
    - vaultwarden
    - tandoor
    - authentik
    - mastodon

- hosts: ingress
  roles:
    - role: chmduquesne.iptables_persistent
      become: true
    - role: nginxinc.nginx  # The nginx in debian's repos is very old
      become: true
    - ingress
    - nebula

- hosts: pve
  roles:
    - role: ironicbadger.proxmox_nag_removal
      become: true
    - zfs
    - pve_nebula_route
    - telegraf
    - role: ironicbadger.snapraid
      become: true

- hosts: forrest
  roles:
    - forrest
    - pve_nebula_route

- hosts: qbittorrent
  roles:
    - qbittorrent
    - http_proxy

- hosts: walker
  roles:
    - nebula
    - upload
    - plausible
    - restic
    - commento
    - website

- hosts: jellyfin
  roles:
    - jellyfin

- hosts: restic
  roles:
    - restic

- hosts: pve-gitlab
  roles:
    - gitlab

- hosts: pve-gitlab-runner
  roles:
    - gitlab_runner

- hosts: grimes
  roles:
    - nebula
    - role: dokku_bot.ansible_dokku
      become: true
    - restic

- hosts: renovate
  roles:
    - renovate
COnfigure SSH bastion 2019-12-08 15:55:19 +00:00			`- hosts: all`
Install NTP 2019-12-08 21:17:30 +00:00			`roles:`
Merge SSH into base role 2020-05-23 10:58:09 +01:00			`- base`
Conditionally run reflector role rather than manually defining which machines run arch 2020-08-19 18:58:58 +01:00			`- role: realorangeone.reflector`
			`when: ansible_os_family == 'Archlinux'`
Clear pacman cache 2022-11-14 09:04:53 +00:00			`- role: paccache`
			`when: ansible_os_family == 'Archlinux'`
COnfigure SSH bastion 2019-12-08 15:55:19 +00:00
			`- hosts: casey`
			`roles:`
Define haproxy config 2019-12-08 16:47:28 +00:00			`- gateway`
Init some skeleton nebula stuff 2021-01-25 21:53:04 +00:00			`- nebula`
Add fail2ban for traefik Remote action coming soon 2021-03-28 13:05:31 +01:00			`- fail2ban_ssh`
Create VPN for port 53 2022-03-18 19:44:06 +00:00			`- wireguard_53`
Internalise SSH config and make it generic to all hosts 2020-01-28 20:39:42 +00:00
Don't install NTP on LXC containers This can cause issues with containers trying to sync the system clock, and getting it wrong 2021-03-04 15:45:47 +00:00			`- hosts:`
			`- pve`
			`- casey`
			`- ingress`
Provision `walker` 2021-04-24 21:19:04 +01:00			`- walker`
Provision dokku server 2021-06-20 12:01:20 +01:00			`- grimes`
Don't install NTP on LXC containers This can cause issues with containers trying to sync the system clock, and getting it wrong 2021-03-04 15:45:47 +00:00			`roles:`
			`- role: geerlingguy.ntp`
			`become: true`
			`vars:`
Update yamllint to fix dependency issue I think this still validates everything we need it to 2022-01-11 20:51:12 +00:00			`ntp_timezone: "{{ timezone }}"`
Don't install NTP on LXC containers This can cause issues with containers trying to sync the system clock, and getting it wrong 2021-03-04 15:45:47 +00:00			`ntp_manage_config: true`

Make `grimes` a docker host 2020-04-26 13:44:06 +01:00			`- hosts:`
Provision docker VM 2020-12-28 15:57:44 +00:00			`- pve-docker`
Install docker on `forrest` I'll be migrating it to docker, so I can run more things simply under Docker 2021-02-08 21:56:06 +00:00			`- forrest`
Provision `walker` 2021-04-24 21:19:04 +01:00			`- walker`
Add a GitLab runner Woo CI! 2021-06-01 19:29:21 +01:00			`- pve-gitlab-runner`
Provision dokku server 2021-06-20 12:01:20 +01:00			`- grimes`
Create a dedicated machine for renovate This way it can do what it wants with docker. Because apparently it's very picky about how it's setup 2022-01-01 22:58:03 +00:00			`- renovate`
Internalise SSH config and make it generic to all hosts 2020-01-28 20:39:42 +00:00			`roles:`
Use ansible galaxy to install docker 2020-03-02 19:37:11 +00:00			`- role: geerlingguy.docker`
			`become: true`
			`vars:`
Install docker from binary on debian distros This is because the repos are usually super out of date, or at least can stray quite a bit 2021-02-07 15:56:25 +00:00			`docker_install_compose: "{{ ansible_os_family == 'Debian' }}"`
Make `grimes` a docker host 2020-04-26 13:44:06 +01:00			`docker_package: "{{ 'docker-ce' if ansible_os_family == 'Debian' else 'docker' }}"`
Use ansible galaxy to install docker 2020-03-02 19:37:11 +00:00			`docker_users:`
			`- "{{ user }}"`
Update ansible-lint Required a lot of renaming :( 2020-09-26 17:53:47 +01:00			`- docker_cleanup`
Initially provision `deluge` machine Based on Docker, so deluge itself is easier to install and keep updated. Until such time it's in the repos 2021-02-01 15:40:06 +00:00
Add container to automatically backup DBs 2022-01-16 16:55:40 +00:00			`- hosts:`
			`- pve-docker`
			`- forrest`
			`- walker`
			`- grimes`
			`roles:`
			`- db_auto_backup`

Initially provision `deluge` machine Based on Docker, so deluge itself is easier to install and keep updated. Until such time it's in the repos 2021-02-01 15:40:06 +00:00			`- hosts:`
			`- pve-docker`
Provision `walker` 2021-04-24 21:19:04 +01:00			`- walker`
Initially provision `deluge` machine Based on Docker, so deluge itself is easier to install and keep updated. Until such time it's in the repos 2021-02-01 15:40:06 +00:00			`roles:`
Convert watchtower into its own role 2020-04-23 21:51:01 +01:00			`- traefik`
Install docker on new server 2020-07-12 19:21:27 +01:00
Move docker containers to new PVE container 2021-01-09 18:02:17 +00:00			`- hosts: pve-docker`
Make `grimes` a docker host 2020-04-26 13:44:06 +01:00			`roles:`
Move docker containers to new PVE container 2021-01-09 18:02:17 +00:00			`- pve_docker`
Deploy yourls 2021-01-22 21:29:27 +00:00			`- yourls`
Allow PVE VMs to access nebula hosts via ingress 2021-01-31 12:19:33 +00:00			`- pve_nebula_route`
Provision privatebin 2021-02-12 23:32:31 +00:00			`- privatebin`
Update bitwarden_rs to vaultwarden I'll do the full rename of everything another time 2021-05-01 23:00:37 +01:00			`- vaultwarden`
Deploy tandoor 2022-08-24 22:17:29 +01:00			`- tandoor`
Deploy authentik Not integrated into other services quite yet. But it's there 2022-09-18 18:49:17 +01:00			`- authentik`
Deploy me a mastodon 2022-11-18 09:12:28 +00:00			`- mastodon`
Host website outside home 2020-04-26 14:26:48 +01:00
Install and provision wireguard client on ingress server 2020-12-21 18:24:35 +00:00			`- hosts: ingress`
			`roles:`
Enable unsafe routing to PVE network over nebula 2021-01-30 22:59:56 +00:00			`- role: chmduquesne.iptables_persistent`
			`become: true`
Replace ingress proxy with nginx This enables HTTPS redirecting at it too much more easily, and matches the gateway configuration. Requires using upstream versions of nginx to enable https://nginx.org/en/docs/stream/ngx_stream_realip_module.html 2021-08-24 14:21:51 +01:00			`- role: nginxinc.nginx # The nginx in debian's repos is very old`
			`become: true`
Install and provision wireguard client on ingress server 2020-12-21 18:24:35 +00:00			`- ingress`
Provision remaining nebula instances 2021-01-30 20:46:49 +00:00			`- nebula`
Add roles to handle PVE nag and repos 2021-01-09 23:21:35 +00:00
			`- hosts: pve`
			`roles:`
Pin versions of galaxy requirements 2022-05-07 12:08:52 +01:00			`- role: ironicbadger.proxmox_nag_removal`
Add roles to handle PVE nag and repos 2021-01-09 23:21:35 +00:00			`become: true`
Decommission `walker` Kimsufi is just too annoying of a host. Everything has either been moved off, killed, or has further plans. 2021-01-28 18:56:39 +00:00			`- zfs`
Allow PVE VMs to access nebula hosts via ingress 2021-01-31 12:19:33 +00:00			`- pve_nebula_route`
Move telegraf to host This makes metric collection for SMART much simpler. I'll still be using the prometheus node exporter for actual system metrics, though. 2021-03-05 20:39:11 +00:00			`- telegraf`
Pin versions of galaxy requirements 2022-05-07 12:08:52 +01:00			`- role: ironicbadger.snapraid`
Version snapraid config Using fork of role at https://github.com/IronicBadger/ansible-role-snapraid/pull/7 2021-06-25 22:43:26 +01:00			`become: true`
Move grafana to `forrest` 2021-01-31 16:52:24 +00:00
			`- hosts: forrest`
			`roles:`
			`- forrest`
Connect `forrest` to nebula hosts 2021-03-04 16:08:53 +00:00			`- pve_nebula_route`
Deploy deluge in docker Makes version managing so much easier! 2021-02-01 17:24:36 +00:00
Swap out deluge for qbittorrent Just run on arch instead of docker, too. Much simpler. 2021-04-16 21:49:00 +01:00			`- hosts: qbittorrent`
Deploy deluge in docker Makes version managing so much easier! 2021-02-01 17:24:36 +00:00			`roles:`
Swap out deluge for qbittorrent Just run on arch instead of docker, too. Much simpler. 2021-04-16 21:49:00 +01:00			`- qbittorrent`
Add squid as a forwarding proxy so containers are exposed through a VPN Implementation isn't perfect, but as `qbittorrent` already had an outbound VPN connection, it makes sense to just reuse it. 2022-11-06 18:26:09 +00:00			`- http_proxy`
Provision `walker` 2021-04-24 21:19:04 +01:00
			`- hosts: walker`
			`roles:`
			`- nebula`
Move `upload` 2021-04-24 22:14:29 +01:00			`- upload`
Move plausible to walker 2021-05-02 16:07:25 +01:00			`- plausible`
Add restic to `walker` 2021-05-09 14:26:21 +01:00			`- restic`
Deploy commento++ 2022-06-05 15:44:49 +01:00			`- commento`
Add hosting for new website Top sneaky 2022-10-29 18:09:30 +01:00			`- website`
Install jellyfin through Ansible 2021-05-02 12:04:48 +01:00
			`- hosts: jellyfin`
			`roles:`
			`- jellyfin`
Add some restic wrapper things 2021-05-08 14:23:21 +01:00
			`- hosts: restic`
			`roles:`
			`- restic`
Init a GitLab server Some day i'll make up my mind on which server to use, honest! 2021-05-28 22:49:48 +01:00
Rename host "gitlab" sounds more like the hosted service, not mine 2021-05-29 22:01:01 +01:00			`- hosts: pve-gitlab`
Init a GitLab server Some day i'll make up my mind on which server to use, honest! 2021-05-28 22:49:48 +01:00			`roles:`
			`- gitlab`
Add a GitLab runner Woo CI! 2021-06-01 19:29:21 +01:00
			`- hosts: pve-gitlab-runner`
			`roles:`
			`- gitlab_runner`
Provision dokku server 2021-06-20 12:01:20 +01:00
			`- hosts: grimes`
			`roles:`
			`- nebula`
Use dokku role to install it I also switched the host to debian, as the arch install didn't quite work. 2021-06-22 22:08:01 +01:00			`- role: dokku_bot.ansible_dokku`
			`become: true`
Add backups for `grimes` 2021-08-30 21:50:55 +01:00			`- restic`
Provision new VM This will be used for monitoring 2021-09-25 16:59:23 +01:00
Create a dedicated machine for renovate This way it can do what it wants with docker. Because apparently it's very picky about how it's setup 2022-01-01 22:58:03 +00:00			`- hosts: renovate`
			`roles:`
			`- renovate`