infrastructure/ansible/main.yml

- hosts: all
  roles:
    - base
    - role: realorangeone.reflector
      when: ansible_os_family == 'Archlinux'
    - role: paccache
      when: ansible_os_family == 'Archlinux'

- hosts: casey
  roles:
    - gateway
    - nebula
    - fail2ban_ssh
    - wireguard_53

- hosts:
    - pve
    - casey
    - ingress
    - walker
    - grimes
    - tang
  roles:
    - role: geerlingguy.ntp
      become: true
      vars:
        ntp_timezone: "{{ timezone }}"
        ntp_manage_config: true

- hosts:
    - pve-docker
    - forrest
    - walker
    - grimes
    - renovate
    - gitea-runner
  roles:
    - role: geerlingguy.docker
      become: true
      vars:
        docker_install_compose_plugin: "{{ ansible_os_family == 'Debian' }}"
        docker_users:
          - "{{ user }}"
    - docker_cleanup

- hosts:
    - pve-docker
    - forrest
    - walker
    - grimes
  roles:
    - db_auto_backup

- hosts:
    - pve-docker
    - walker
  roles:
    - traefik

- hosts: pve-docker
  roles:
    - pve_docker
    - yourls
    - pve_nebula_route
    - privatebin
    - vaultwarden
    - tandoor
    - mastodon
    - gitea

- hosts: ingress
  roles:
    - role: chmduquesne.iptables_persistent
      become: true
    - role: nginxinc.nginx  # The nginx in debian's repos is very old
      become: true
    - ingress
    - nebula

- hosts: pve
  roles:
    - role: ironicbadger.proxmox_nag_removal
      become: true
    - zfs
    - pve_nebula_route
    - role: ironicbadger.snapraid
      become: true
    - role: prometheus.prometheus.node_exporter
      become: true

- hosts: forrest
  roles:
    - forrest
    - pve_nebula_route

- hosts: qbittorrent
  roles:
    - qbittorrent
    - http_proxy

- hosts: walker
  roles:
    - nebula
    - upload
    - plausible
    - restic
    - commento
    - website

- hosts: jellyfin
  roles:
    - jellyfin

- hosts: restic
  roles:
    - restic

- hosts: gitea-runner
  roles:
    - gitea_runner

- hosts: grimes
  roles:
    - nebula
    - role: dokku_bot.ansible_dokku
      become: true
    - restic

- hosts: renovate
  roles:
    - renovate

- hosts: tang
  roles:
    - pihole
    - role: prometheus.prometheus.node_exporter
      become: true
COnfigure SSH bastion 2019-12-08 15:55:19 +00:00			`- hosts: all`
Install NTP 2019-12-08 21:17:30 +00:00			`roles:`
Merge SSH into base role 2020-05-23 10:58:09 +01:00			`- base`
Conditionally run reflector role rather than manually defining which machines run arch 2020-08-19 18:58:58 +01:00			`- role: realorangeone.reflector`
			`when: ansible_os_family == 'Archlinux'`
Clear pacman cache 2022-11-14 09:04:53 +00:00			`- role: paccache`
			`when: ansible_os_family == 'Archlinux'`
COnfigure SSH bastion 2019-12-08 15:55:19 +00:00
			`- hosts: casey`
			`roles:`
Define haproxy config 2019-12-08 16:47:28 +00:00			`- gateway`
Init some skeleton nebula stuff 2021-01-25 21:53:04 +00:00			`- nebula`
Add fail2ban for traefik Remote action coming soon 2021-03-28 13:05:31 +01:00			`- fail2ban_ssh`
Create VPN for port 53 2022-03-18 19:44:06 +00:00			`- wireguard_53`
Internalise SSH config and make it generic to all hosts 2020-01-28 20:39:42 +00:00
Don't install NTP on LXC containers This can cause issues with containers trying to sync the system clock, and getting it wrong 2021-03-04 15:45:47 +00:00			`- hosts:`
			`- pve`
			`- casey`
			`- ingress`
Provision `walker` 2021-04-24 21:19:04 +01:00			`- walker`
Provision dokku server 2021-06-20 12:01:20 +01:00			`- grimes`
Setup NTP on tang 2023-01-16 09:11:15 +00:00			`- tang`
Don't install NTP on LXC containers This can cause issues with containers trying to sync the system clock, and getting it wrong 2021-03-04 15:45:47 +00:00			`roles:`
			`- role: geerlingguy.ntp`
			`become: true`
			`vars:`
Update yamllint to fix dependency issue I think this still validates everything we need it to 2022-01-11 20:51:12 +00:00			`ntp_timezone: "{{ timezone }}"`
Don't install NTP on LXC containers This can cause issues with containers trying to sync the system clock, and getting it wrong 2021-03-04 15:45:47 +00:00			`ntp_manage_config: true`

Make `grimes` a docker host 2020-04-26 13:44:06 +01:00			`- hosts:`
Provision docker VM 2020-12-28 15:57:44 +00:00			`- pve-docker`
Install docker on `forrest` I'll be migrating it to docker, so I can run more things simply under Docker 2021-02-08 21:56:06 +00:00			`- forrest`
Provision `walker` 2021-04-24 21:19:04 +01:00			`- walker`
Provision dokku server 2021-06-20 12:01:20 +01:00			`- grimes`
Create a dedicated machine for renovate This way it can do what it wants with docker. Because apparently it's very picky about how it's setup 2022-01-01 22:58:03 +00:00			`- renovate`
Deploy gitea's runner Unofficial container, because there isn't an official one 2023-03-26 00:01:55 +00:00			`- gitea-runner`
Internalise SSH config and make it generic to all hosts 2020-01-28 20:39:42 +00:00			`roles:`
Use ansible galaxy to install docker 2020-03-02 19:37:11 +00:00			`- role: geerlingguy.docker`
			`become: true`
			`vars:`
Update some ansible galaxy roles 2023-05-06 21:54:22 +01:00			`docker_install_compose_plugin: "{{ ansible_os_family == 'Debian' }}"`
Use ansible galaxy to install docker 2020-03-02 19:37:11 +00:00			`docker_users:`
			`- "{{ user }}"`
Update ansible-lint Required a lot of renaming :( 2020-09-26 17:53:47 +01:00			`- docker_cleanup`
Initially provision `deluge` machine Based on Docker, so deluge itself is easier to install and keep updated. Until such time it's in the repos 2021-02-01 15:40:06 +00:00
Add container to automatically backup DBs 2022-01-16 16:55:40 +00:00			`- hosts:`
			`- pve-docker`
			`- forrest`
			`- walker`
			`- grimes`
			`roles:`
			`- db_auto_backup`

Initially provision `deluge` machine Based on Docker, so deluge itself is easier to install and keep updated. Until such time it's in the repos 2021-02-01 15:40:06 +00:00			`- hosts:`
			`- pve-docker`
Provision `walker` 2021-04-24 21:19:04 +01:00			`- walker`
Initially provision `deluge` machine Based on Docker, so deluge itself is easier to install and keep updated. Until such time it's in the repos 2021-02-01 15:40:06 +00:00			`roles:`
Convert watchtower into its own role 2020-04-23 21:51:01 +01:00			`- traefik`
Install docker on new server 2020-07-12 19:21:27 +01:00
Move docker containers to new PVE container 2021-01-09 18:02:17 +00:00			`- hosts: pve-docker`
Make `grimes` a docker host 2020-04-26 13:44:06 +01:00			`roles:`
Move docker containers to new PVE container 2021-01-09 18:02:17 +00:00			`- pve_docker`
Deploy yourls 2021-01-22 21:29:27 +00:00			`- yourls`
Allow PVE VMs to access nebula hosts via ingress 2021-01-31 12:19:33 +00:00			`- pve_nebula_route`
Provision privatebin 2021-02-12 23:32:31 +00:00			`- privatebin`
Update bitwarden_rs to vaultwarden I'll do the full rename of everything another time 2021-05-01 23:00:37 +01:00			`- vaultwarden`
Deploy tandoor 2022-08-24 22:17:29 +01:00			`- tandoor`
Deploy me a mastodon 2022-11-18 09:12:28 +00:00			`- mastodon`
Add a gitea deployment Yep, it's that time of year _again_ 2023-01-27 17:28:45 +00:00			`- gitea`
Host website outside home 2020-04-26 14:26:48 +01:00
Install and provision wireguard client on ingress server 2020-12-21 18:24:35 +00:00			`- hosts: ingress`
			`roles:`
Enable unsafe routing to PVE network over nebula 2021-01-30 22:59:56 +00:00			`- role: chmduquesne.iptables_persistent`
			`become: true`
Replace ingress proxy with nginx This enables HTTPS redirecting at it too much more easily, and matches the gateway configuration. Requires using upstream versions of nginx to enable https://nginx.org/en/docs/stream/ngx_stream_realip_module.html 2021-08-24 14:21:51 +01:00			`- role: nginxinc.nginx # The nginx in debian's repos is very old`
			`become: true`
Install and provision wireguard client on ingress server 2020-12-21 18:24:35 +00:00			`- ingress`
Provision remaining nebula instances 2021-01-30 20:46:49 +00:00			`- nebula`
Add roles to handle PVE nag and repos 2021-01-09 23:21:35 +00:00
			`- hosts: pve`
			`roles:`
Pin versions of galaxy requirements 2022-05-07 12:08:52 +01:00			`- role: ironicbadger.proxmox_nag_removal`
Add roles to handle PVE nag and repos 2021-01-09 23:21:35 +00:00			`become: true`
Decommission `walker` Kimsufi is just too annoying of a host. Everything has either been moved off, killed, or has further plans. 2021-01-28 18:56:39 +00:00			`- zfs`
Allow PVE VMs to access nebula hosts via ingress 2021-01-31 12:19:33 +00:00			`- pve_nebula_route`
Pin versions of galaxy requirements 2022-05-07 12:08:52 +01:00			`- role: ironicbadger.snapraid`
Version snapraid config Using fork of role at https://github.com/IronicBadger/ansible-role-snapraid/pull/7 2021-06-25 22:43:26 +01:00			`become: true`
Replace telegraf with prometheus exporters Still missing SMART and ping, but those can come later. Swapped as the polling model for prometheus doesn't play especially well with telegraf, and leads to gaps in data 2023-01-31 09:11:09 +00:00			`- role: prometheus.prometheus.node_exporter`
			`become: true`
Move grafana to `forrest` 2021-01-31 16:52:24 +00:00
			`- hosts: forrest`
			`roles:`
			`- forrest`
Connect `forrest` to nebula hosts 2021-03-04 16:08:53 +00:00			`- pve_nebula_route`
Deploy deluge in docker Makes version managing so much easier! 2021-02-01 17:24:36 +00:00
Swap out deluge for qbittorrent Just run on arch instead of docker, too. Much simpler. 2021-04-16 21:49:00 +01:00			`- hosts: qbittorrent`
Deploy deluge in docker Makes version managing so much easier! 2021-02-01 17:24:36 +00:00			`roles:`
Swap out deluge for qbittorrent Just run on arch instead of docker, too. Much simpler. 2021-04-16 21:49:00 +01:00			`- qbittorrent`
Add squid as a forwarding proxy so containers are exposed through a VPN Implementation isn't perfect, but as `qbittorrent` already had an outbound VPN connection, it makes sense to just reuse it. 2022-11-06 18:26:09 +00:00			`- http_proxy`
Provision `walker` 2021-04-24 21:19:04 +01:00
			`- hosts: walker`
			`roles:`
			`- nebula`
Move `upload` 2021-04-24 22:14:29 +01:00			`- upload`
Move plausible to walker 2021-05-02 16:07:25 +01:00			`- plausible`
Add restic to `walker` 2021-05-09 14:26:21 +01:00			`- restic`
Deploy commento++ 2022-06-05 15:44:49 +01:00			`- commento`
Add hosting for new website Top sneaky 2022-10-29 18:09:30 +01:00			`- website`
Install jellyfin through Ansible 2021-05-02 12:04:48 +01:00
			`- hosts: jellyfin`
			`roles:`
			`- jellyfin`
Add some restic wrapper things 2021-05-08 14:23:21 +01:00
			`- hosts: restic`
			`roles:`
			`- restic`
Init a GitLab server Some day i'll make up my mind on which server to use, honest! 2021-05-28 22:49:48 +01:00
Deploy gitea's runner Unofficial container, because there isn't an official one 2023-03-26 00:01:55 +00:00			`- hosts: gitea-runner`
			`roles:`
			`- gitea_runner`

Provision dokku server 2021-06-20 12:01:20 +01:00			`- hosts: grimes`
			`roles:`
			`- nebula`
Use dokku role to install it I also switched the host to debian, as the arch install didn't quite work. 2021-06-22 22:08:01 +01:00			`- role: dokku_bot.ansible_dokku`
			`become: true`
Add backups for `grimes` 2021-08-30 21:50:55 +01:00			`- restic`
Provision new VM This will be used for monitoring 2021-09-25 16:59:23 +01:00
Create a dedicated machine for renovate This way it can do what it wants with docker. Because apparently it's very picky about how it's setup 2022-01-01 22:58:03 +00:00			`- hosts: renovate`
			`roles:`
			`- renovate`
Add internal alias to pihole 2023-01-08 18:36:03 +00:00
			`- hosts: tang`
			`roles:`
			`- pihole`
Install node-exporter on pi-hole 2023-01-31 23:08:07 +00:00			`- role: prometheus.prometheus.node_exporter`
			`become: true`