infrastructure/ansible/main.yml

- hosts: all
  roles:
    - base
    - role: realorangeone.reflector
      when: ansible_os_family == 'Archlinux'

- hosts: casey
  roles:
    - gateway
    - nebula
    - fail2ban_ssh

- hosts:
    - pve
    - casey
    - ingress
    - qbittorrent
    - walker
  roles:
    - role: geerlingguy.ntp
      become: true
      vars:
        ntp_timezone: "{{ TZ }}"
        ntp_manage_config: true
      when: ansible_os_family != 'Alpine'  # https://github.com/ansible-collections/community.general/issues/781

- hosts:
    - pve-docker
    - forrest
    - walker
  roles:
    - role: geerlingguy.docker
      become: true
      vars:
        docker_install_compose: "{{ ansible_os_family == 'Debian' }}"
        docker_package: "{{ 'docker-ce' if ansible_os_family == 'Debian' else 'docker' }}"
        docker_users:
          - "{{ user }}"
    - docker_cleanup

- hosts:
    - pve-docker
    - walker
  roles:
    - traefik

- hosts: pve-docker
  roles:
    - pve_docker
    - gitea
    - duplicati
    - yourls
    - pve_nebula_route
    - privatebin
    - vaultwarden

- hosts: ingress
  roles:
    - role: chmduquesne.iptables_persistent
      become: true
    - ingress
    - nebula

- hosts: pve
  roles:
    - role: proxmox-nag-removal
      become: true
    - pve
    - zfs
    - pve_nebula_route
    - telegraf

- hosts: forrest
  roles:
    - forrest
    - pve_nebula_route

- hosts: qbittorrent
  roles:
    - qbittorrent

- hosts: walker
  roles:
    - nebula
    - upload
    - duplicati
    - plausible
    - pages

- hosts: jellyfin
  roles:
    - jellyfin

- hosts: restic
  roles:
    - restic
COnfigure SSH bastion 2019-12-08 15:55:19 +00:00			`- hosts: all`
Install NTP 2019-12-08 21:17:30 +00:00			`roles:`
Merge SSH into base role 2020-05-23 10:58:09 +01:00			`- base`
Conditionally run reflector role rather than manually defining which machines run arch 2020-08-19 18:58:58 +01:00			`- role: realorangeone.reflector`
			`when: ansible_os_family == 'Archlinux'`
COnfigure SSH bastion 2019-12-08 15:55:19 +00:00
			`- hosts: casey`
			`roles:`
Define haproxy config 2019-12-08 16:47:28 +00:00			`- gateway`
Init some skeleton nebula stuff 2021-01-25 21:53:04 +00:00			`- nebula`
Add fail2ban for traefik Remote action coming soon 2021-03-28 13:05:31 +01:00			`- fail2ban_ssh`
Internalise SSH config and make it generic to all hosts 2020-01-28 20:39:42 +00:00
Don't install NTP on LXC containers This can cause issues with containers trying to sync the system clock, and getting it wrong 2021-03-04 15:45:47 +00:00			`- hosts:`
			`- pve`
			`- casey`
			`- ingress`
Swap out deluge for qbittorrent Just run on arch instead of docker, too. Much simpler. 2021-04-16 21:49:00 +01:00			`- qbittorrent`
Provision `walker` 2021-04-24 21:19:04 +01:00			`- walker`
Don't install NTP on LXC containers This can cause issues with containers trying to sync the system clock, and getting it wrong 2021-03-04 15:45:47 +00:00			`roles:`
			`- role: geerlingguy.ntp`
			`become: true`
			`vars:`
			`ntp_timezone: "{{ TZ }}"`
			`ntp_manage_config: true`
			`when: ansible_os_family != 'Alpine' # https://github.com/ansible-collections/community.general/issues/781`

Make `grimes` a docker host 2020-04-26 13:44:06 +01:00			`- hosts:`
Provision docker VM 2020-12-28 15:57:44 +00:00			`- pve-docker`
Install docker on `forrest` I'll be migrating it to docker, so I can run more things simply under Docker 2021-02-08 21:56:06 +00:00			`- forrest`
Provision `walker` 2021-04-24 21:19:04 +01:00			`- walker`
Internalise SSH config and make it generic to all hosts 2020-01-28 20:39:42 +00:00			`roles:`
Use ansible galaxy to install docker 2020-03-02 19:37:11 +00:00			`- role: geerlingguy.docker`
			`become: true`
			`vars:`
Install docker from binary on debian distros This is because the repos are usually super out of date, or at least can stray quite a bit 2021-02-07 15:56:25 +00:00			`docker_install_compose: "{{ ansible_os_family == 'Debian' }}"`
Make `grimes` a docker host 2020-04-26 13:44:06 +01:00			`docker_package: "{{ 'docker-ce' if ansible_os_family == 'Debian' else 'docker' }}"`
Use ansible galaxy to install docker 2020-03-02 19:37:11 +00:00			`docker_users:`
			`- "{{ user }}"`
Update ansible-lint Required a lot of renaming :( 2020-09-26 17:53:47 +01:00			`- docker_cleanup`
Initially provision `deluge` machine Based on Docker, so deluge itself is easier to install and keep updated. Until such time it's in the repos 2021-02-01 15:40:06 +00:00
			`- hosts:`
			`- pve-docker`
Provision `walker` 2021-04-24 21:19:04 +01:00			`- walker`
Initially provision `deluge` machine Based on Docker, so deluge itself is easier to install and keep updated. Until such time it's in the repos 2021-02-01 15:40:06 +00:00			`roles:`
Convert watchtower into its own role 2020-04-23 21:51:01 +01:00			`- traefik`
Install docker on new server 2020-07-12 19:21:27 +01:00
Move docker containers to new PVE container 2021-01-09 18:02:17 +00:00			`- hosts: pve-docker`
Make `grimes` a docker host 2020-04-26 13:44:06 +01:00			`roles:`
Move docker containers to new PVE container 2021-01-09 18:02:17 +00:00			`- pve_docker`
Replace gitlab with gitea Leave gitlab in place for a bit in case I need to get at data 2021-01-18 20:14:38 +00:00			`- gitea`
Install duplicati on PVE docker machine Requires some changes to how private IPs are specified, which I really need to clean up at some point! 2021-01-20 21:38:01 +00:00			`- duplicati`
Deploy yourls 2021-01-22 21:29:27 +00:00			`- yourls`
Allow PVE VMs to access nebula hosts via ingress 2021-01-31 12:19:33 +00:00			`- pve_nebula_route`
Provision privatebin 2021-02-12 23:32:31 +00:00			`- privatebin`
Update bitwarden_rs to vaultwarden I'll do the full rename of everything another time 2021-05-01 23:00:37 +01:00			`- vaultwarden`
Host website outside home 2020-04-26 14:26:48 +01:00
Install and provision wireguard client on ingress server 2020-12-21 18:24:35 +00:00			`- hosts: ingress`
			`roles:`
Enable unsafe routing to PVE network over nebula 2021-01-30 22:59:56 +00:00			`- role: chmduquesne.iptables_persistent`
			`become: true`
Install and provision wireguard client on ingress server 2020-12-21 18:24:35 +00:00			`- ingress`
Provision remaining nebula instances 2021-01-30 20:46:49 +00:00			`- nebula`
Add roles to handle PVE nag and repos 2021-01-09 23:21:35 +00:00
			`- hosts: pve`
			`roles:`
			`- role: proxmox-nag-removal`
			`become: true`
			`- pve`
Decommission `walker` Kimsufi is just too annoying of a host. Everything has either been moved off, killed, or has further plans. 2021-01-28 18:56:39 +00:00			`- zfs`
Allow PVE VMs to access nebula hosts via ingress 2021-01-31 12:19:33 +00:00			`- pve_nebula_route`
Move telegraf to host This makes metric collection for SMART much simpler. I'll still be using the prometheus node exporter for actual system metrics, though. 2021-03-05 20:39:11 +00:00			`- telegraf`
Move grafana to `forrest` 2021-01-31 16:52:24 +00:00
			`- hosts: forrest`
			`roles:`
			`- forrest`
Connect `forrest` to nebula hosts 2021-03-04 16:08:53 +00:00			`- pve_nebula_route`
Deploy deluge in docker Makes version managing so much easier! 2021-02-01 17:24:36 +00:00
Swap out deluge for qbittorrent Just run on arch instead of docker, too. Much simpler. 2021-04-16 21:49:00 +01:00			`- hosts: qbittorrent`
Deploy deluge in docker Makes version managing so much easier! 2021-02-01 17:24:36 +00:00			`roles:`
Swap out deluge for qbittorrent Just run on arch instead of docker, too. Much simpler. 2021-04-16 21:49:00 +01:00			`- qbittorrent`
Provision `walker` 2021-04-24 21:19:04 +01:00
			`- hosts: walker`
			`roles:`
			`- nebula`
Move `upload` 2021-04-24 22:14:29 +01:00			`- upload`
Add duplicati to `walker` 2021-04-24 22:25:40 +01:00			`- duplicati`
Move plausible to walker 2021-05-02 16:07:25 +01:00			`- plausible`
Move website to walker 2021-05-02 17:24:10 +01:00			`- pages`
Install jellyfin through Ansible 2021-05-02 12:04:48 +01:00
			`- hosts: jellyfin`
			`roles:`
			`- jellyfin`
Add some restic wrapper things 2021-05-08 14:23:21 +01:00
			`- hosts: restic`
			`roles:`
			`- restic`