Deploy a dokku

ansible/ansible.cfg

@@ -7,6 +7,8 @@ collections_path = $PWD/galaxy_collections
 inventory = ./hosts
 become_ask_pass = True
 interpreter_python = auto_silent
+# HACK: Force Ansible to find dokku plugins
+library = $PWD/galaxy_roles/dokku_bot.ansible_dokku/library
 
 [ssh_connection]
 pipelining = True

ansible/galaxy-requirements.yml

@@ -16,3 +16,5 @@ roles:
   - src: chmduquesne.iptables_persistent
   - src: ironicbadger.snapraid
     version: 1.0.0
+  - src: dokku_bot.ansible_dokku
+    version: v2022.10.17

ansible/host_vars/pve-docker/main.yml

@@ -3,6 +3,7 @@ private_ip: "{{ pve_hosts.docker.ip }}"
 traefik_provider_jellyfin: true
 traefik_provider_homeassistant: true
 traefik_provider_grafana: true
+traefik_provider_dokku: true
 
 with_fail2ban: true
 

ansible/host_vars/pve-dokku.yml

@@ -0,0 +1 @@
+ssh_extra_allowed_users: dokku

ansible/main.yml

@@ -127,3 +127,7 @@
     - pihole
     - role: prometheus.prometheus.node_exporter
       become: true
+
+- hosts: pve-dokku
+  roles:
+    - dokku

ansible/roles/dokku/files/nginx.conf

@@ -0,0 +1,29 @@
+worker_processes  auto;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    sendfile        on;
+
+    keepalive_timeout  65;
+
+    gzip  on;
+
+    # Block requests which don't have an explicit handler
+    server {
+        listen 80 default_server;
+        listen [::]:80 default_server;
+
+        server_name _;
+        access_log off;
+        return 418;
+    }
+
+    # Load configuration files for the default server block.
+    include /etc/nginx/conf.d/*.conf;
+}

ansible/roles/dokku/handlers/main.yml

@@ -0,0 +1,5 @@
+- name: restart nginx
+  service:
+    name: nginx
+    state: restarted
+  become: true

ansible/roles/dokku/tasks/main.yml

@@ -0,0 +1,53 @@
+# HACK: Fake include some tasks from `ansible_dokku`, so its library plugins can be used below
+- name: Run role without running any tasks
+  include_role:
+    name: dokku_bot.ansible_dokku
+    tasks_from: init.yml
+    apply:
+      when: false
+
+- name: Install Dokku
+  package:
+    name: dokku
+  become: true
+
+- name: List dokku plugins
+  command: dokku plugin:list
+  changed_when: false
+  register: installed_dokku_plugins
+
+- name: Install Dokku plugins
+  command: dokku plugin:install {{ item.url }} --name {{ item.name }}
+  when: installed_dokku_plugins.stdout.find(item.name) == -1
+  loop: "{{ dokku_plugins }}"
+  loop_control:
+    label: "{{ item.name }}"
+  become: true
+
+- name: Automatically update Dokku plugins
+  cron:
+    name: "dokku plugin:update {{ item.name }}"
+    minute: "0"
+    hour: "12"
+    user: "root"
+    job: "/usr/bin/chronic /usr/bin/dokku plugin:update {{ item.name }}"
+    cron_file: "dokku-plugin-update-{{ item.name }}"
+  loop: "{{ dokku_plugins }}"
+  loop_control:
+    label: "{{ item.name }}"
+  become: true
+
+- name: Set up global domain
+  dokku_domains:
+    global: true
+    domains: d.theorangeone.net
+  become: true
+
+- name: Install custom nginx config
+  template:
+    src: files/nginx.conf
+    dest: /etc/nginx/nginx.conf
+    validate: nginx -t -c %s
+    mode: "644"
+  notify: restart nginx
+  become: true

ansible/roles/dokku/vars/main.yml

@@ -0,0 +1,9 @@
+dokku_plugins:
+  - name: postgres
+    url: https://github.com/dokku/dokku-postgres.git
+  - name: redis
+    url: https://github.com/dokku/dokku-redis.git
+  - name: redirect
+    url: https://github.com/dokku/dokku-redirect.git
+  - name: http-auth
+    url: https://github.com/dokku/dokku-http-auth.git

ansible/roles/traefik/defaults/main.yml

@@ -1,5 +1,6 @@
 traefik_provider_jellyfin: false
 traefik_provider_homeassistant: false
 traefik_provider_grafana: false
+traefik_provider_dokku: false
 
 with_fail2ban: false

ansible/roles/traefik/files/file-provider-dokku.yml

@@ -0,0 +1,10 @@
+http:
+  routers:
+    router-dokku:
+      rule: HostRegexp(`{subdomain:[a-z]+}.d.theorangeone.net`)
+      service: service-dokku
+  services:
+    service-dokku:
+      loadBalancer:
+        servers:
+          - url: http://{{ pve_hosts.dokku.ip }}

ansible/roles/traefik/files/traefik.yml

@@ -26,6 +26,10 @@ entryPoints:
             sans: "*.jakehoward.tech"
           - main: 0rng.one
             sans: "*.0rng.one"
+          {% if traefik_provider_dokku %}
+          - main: d.theorangeone.net
+            sans: "*.d.theorangeone.net"
+          {% endif %}
     proxyProtocol:
       trustedIPs:
         - "{{ wireguard.cidr }}"

ansible/roles/traefik/tasks/main.yml

@@ -47,6 +47,8 @@
     dest: /opt/traefik/traefik/traefik.yml
     mode: "{{ docker_compose_file_mask }}"
     owner: "{{ docker_user.name }}"
+    lstrip_blocks: true
+    trim_blocks: true
   notify: restart traefik
   become: true
 
@@ -89,6 +91,16 @@
   when: traefik_provider_grafana
   become: true
 
+- name: Install dokku provider
+  template:
+    src: files/file-provider-dokku.yml
+    dest: /opt/traefik/traefik/conf/dokku.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+  notify: restart traefik
+  when: traefik_provider_dokku
+  become: true
+
 - name: logrotate config
   template:
     src: files/logrotate.conf

terraform/theorangeone.net.tf

@@ -181,6 +181,22 @@ resource "cloudflare_record" "theorangeonenet_privatebin" {
   ttl     = 1
 }
 
+resource "cloudflare_record" "theorangeonenet_dokku" {
+  zone_id = cloudflare_zone.theorangeonenet.id
+  name    = "d"
+  value   = linode_instance.casey.ip_address
+  type    = "A"
+  ttl     = 1
+}
+
+resource "cloudflare_record" "theorangeonenet_dokku_wildcard" {
+  zone_id = cloudflare_zone.theorangeonenet.id
+  name    = "*.d"
+  value   = cloudflare_record.theorangeonenet_dokku.hostname
+  type    = "CNAME"
+  ttl     = 1
+}
+
 resource "cloudflare_record" "theorangeonenet_google_site_verification" {
   zone_id = cloudflare_zone.theorangeonenet.id
   name    = "@"