Update DNS records

Ensure CNAME values are absolute
Use personal access token for traefik
2024-11-25 20:02:36 +00:00 · 2024-09-22 15:27:05 +01:00 · 2024-09-15 14:21:20 +01:00 · 2024-09-14 22:06:42 +01:00 · 2024-09-14 22:00:24 +01:00 · 2024-09-14 21:24:12 +01:00
128 changed files with 1055 additions and 1067 deletions
--- a/ansible/ansible.cfg
+++ b/ansible/ansible.cfg
@ -5,11 +5,8 @@ retry_files_enabled = False
 roles_path = $PWD/galaxy_roles:$PWD/roles
 collections_path = $PWD/galaxy_collections
 inventory = ./hosts
-interpreter_python = auto_silent
-
-[privilege_escalation]
-become = True
 become_ask_pass = True
+interpreter_python = auto_silent

 [ssh_connection]
 pipelining = True
--- a/ansible/dev-requirements.txt
+++ b/ansible/dev-requirements.txt
@ -1,4 +1,4 @@
-ansible-lint==24.9.2
+ansible-lint==24.5.0
 yamllint==1.33.0
 ansible
 passlib
--- a/ansible/files/nginx-docker.conf
+++ b/ansible/files/nginx-docker.conf
@ -7,8 +7,6 @@ server {
    server_name {{ server_name }};
    set $upstream {{ upstream }};

-    access_log /var/log/nginx/{{ server_name|split|first }}.log main;
-
    ssl_certificate {{ ssl_cert_path }}/fullchain.pem;
    ssl_certificate_key {{ ssl_cert_path }}/privkey.pem;
    ssl_trusted_certificate {{ ssl_cert_path }}/chain.pem;
--- a/ansible/galaxy-requirements.yml
+++ b/ansible/galaxy-requirements.yml
@ -8,7 +8,7 @@ collections:

 roles:
  - src: geerlingguy.docker
-    version: 7.4.3
+    version: 7.3.0
  - src: geerlingguy.ntp
    version: 2.5.0
  - src: realorangeone.reflector
@ -17,6 +17,6 @@ roles:
  - src: ironicbadger.snapraid
    version: 1.0.0
  - src: geerlingguy.certbot
-    version: 5.2.0
+    version: 5.1.0
  - src: artis3n.tailscale
    version: v4.5.0
--- a/ansible/group_vars/all/tailscale.yml
+++ b/ansible/group_vars/all/tailscale.yml
@ -8,4 +8,4 @@ tailscale_port: 41641

 tailscale_nodes:
  casey:
-    ip: 100.64.0.6
+    ip: 100.64.0.1
--- a/ansible/host_vars/casey/main.yml
+++ b/ansible/host_vars/casey/main.yml
@ -1,4 +1,3 @@
-private_ip: "{{ ansible_tailscale0.ipv4.address }}"
 nginx_https_redirect: true

 certbot_certs:
--- a/ansible/host_vars/casey/vault.yml
+++ b/ansible/host_vars/casey/vault.yml
@ -1,21 +1,9 @@
 $ANSIBLE_VAULT;1.1;AES256
-65613137336266343033333338323734396266363431356166316233646663383039336634343936
-3939353039396237396432336361653838323161356330360a393962313733363734323666666361
-34303239633739383432323337356535613636376466323931323237626264333534626566386630
-3839613338316530360a396364363163623633333362636238316463313732613562386161306661
-38396361393837613137633830636333653565323331643937323863383963383739623235656636
-30393033393031393733653335633462383062613039613332653466313439366161303533366264
-39626132643534366639623230383233353332363836356132363130306637653465633663333665
-34656636316439626230663037656130346635636232336561346361396166643465313565363963
-32303962386635653264306530653132353238356336656634363136323564313261336638376136
-63306333303763633362663238396434663066386235666163383135353232633236623832356439
-62613664663164363838303531326363623465343036656530663562323231613737383464303664
-35646137373233643966323363623961393361316463313464666261653636623937646464613133
-39363863643835316330626435343166363931613430303966383263663639646463616133363463
-33346665616263666635306162383333313063636364623838306462303438373832333965633236
-61346161376161353736633332386538643839333261646432323466653962653964643438323130
-64663133346564336334653430616363643662313732356634353764613466346638353833316332
-31323364356265313263383138626234343239383063373066613666663330653431346630393937
-34636464383766623662623136636363316530643534306366616333396465636264616531363863
-33616237386132373034346132333766343030313039336531613837366265346539366264303634
-65383731656130373464
+30643138356634323666316163396138663836316261363966636335366534336330616635383663
+6461393538346263363164613930396266323930626335370a306165306663336538316163666364
+65383835386635336433393162613031386334646632666638613162623434646531356533346132
+3162373933336365660a353163316338303630633761336238363966376336643838616135303231
+32646530376561326635633563393066656232363734653464326665396236656232613362333461
+39393134626466656561346138633362653732333639333765303961383365623737666164326532
+66356263326366323435623834306439633061386364633132613362386663633733386637363266
+31393438326531353265
--- a/ansible/host_vars/ingress.yml
+++ b/ansible/host_vars/ingress.yml
@ -1,2 +1 @@
-private_ip: "{{ ansible_tailscale0.ipv4.address }}"
 nginx_https_redirect: true
--- a/ansible/host_vars/restic/main.yml
+++ b/ansible/host_vars/restic/main.yml
@ -5,4 +5,4 @@ restic_backup_locations:
  - /mnt/home-assistant
  - /home/rclone/sync

-restic_dir: ""
+restic_forget: true
--- a/ansible/host_vars/restic/vault.yml
+++ b/ansible/host_vars/restic/vault.yml
@ -1,26 +1,17 @@
 $ANSIBLE_VAULT;1.1;AES256
-37616635326362383437633735343430663563653561636338646666323631333135313465623933
-6363373730633062343966663735376666623439633139650a323537313831386537383133336461
-63353034663931363663383766653465386335383238306636666531353062316263356362386230
-3330356164373731390a363439656564666364323530363464623736313165353465346163623037
-62383238386330623662343835306563353831396666643862653965323438373332363364383333
-35343230396564343161393963666438613865316137356139393361636661373335303735323664
-36383632643534623237353562386638336533626362636363396635393533656631326337383465
-32633239643464353465626165393261323033623062313930353764386465623332613534613636
-39613563623135306232356235613862353437393062646464633732383735343362316462326561
-34346262656461643237353366303138653764363337343439656330393833333233386436646661
-62343631323035613132656665636661643162323632323363396362306266323631343161316230
-34666363383861323231353734336165393335646537326162343430653337653739376232343033
-63663731653836393232323731323965643262653836353565383261393539616536346237323166
-36633339303038613635333537393933383732303332366366326666343066316337383535333566
-65396636666238616339633839323763383732326364386138306439353030396561336262306632
-32383934383463326532363235333062363631363131616466316638366631663930366461393564
-31646330386161626463633931363439366433646439363035396364366332346339623661333562
-37633136343838666338356533643230393331636136333931653937363731623434653364393464
-31623937656231363262343366343565616134313466313835636139306164393638626263623833
-62623564396232373565393131366366383335366631373031656235326365373137613031653665
-35616265663064363832623132356365643065343830306539646635383737666231343830323261
-66633032373737653966623930386661386634316339303762383431613332643134323731636563
-34313832623430623964626139306535323139346162626332366438623630356639616630376230
-34656138323234386238373036363335353430366139363964323437623833653361613333383537
-6466
+32353739643531336665636334646135323336353562316362333266316263653364656132643661
+3736386461316563376134326638376261323734663032630a306530636166666561343264393266
+62326437343637363038646632396461303365646466666666386432306134313562356538623133
+6561323739386337630a623835656239633866666333616664366339333232303031343561633239
+62636636623462316536333334306562626637643936623963376663326164333962646134376566
+62646336353937316238333036376232323834346530626136316233626166326231633330646266
+36653263636266626233313263346263633734386339386664323331363263306465626165336337
+38653766366530373230623334386234303461336133323663626439383530373966363830633364
+37336635356334633338633161356161353133656633386563393363303064613761306137323261
+34626164663936306665613861343039666330613263303932333766306663616134316566313963
+66653263643134343363353637343636633936343165363934376537343538643434376434336633
+31613339613035633335643034336265376630326662393865626336303261363130333637643162
+32383863313139663066363766613865653966613430616631346432623164366663313838363164
+37613863326433653531656139633533353539366563653532626534346165626535643434333861
+34306433373134376137633836666162663130623130353062316439303466393035633636386234
+38333132376361376363
--- a/ansible/host_vars/tang/main.yml
+++ b/ansible/host_vars/tang/main.yml
@ -2,4 +2,4 @@ ssh_extra_allowed_users: jake
 private_ip: "{{ ansible_default_ipv4.address }}"

 restic_backup_locations:
-  - /var/lib/private/adguardhome/
+  - /var/lib/adguardhome/
--- a/ansible/host_vars/tang/vault.yml
+++ b/ansible/host_vars/tang/vault.yml
@ -1,21 +1,9 @@
 $ANSIBLE_VAULT;1.1;AES256
-66303032306566656332616563633936393036326332646664366430383635363534363037303065
-3164383833353062633336313163336364616230653338390a636234663832636666623864623464
-65373739396235383536363631326333623533613064303961333637613664386161656432613638
-3466623664326632310a363338363433323132626537396665333766366161393832663537623837
-62626166353230626334633735323164316663353936303439656336653130613963666530356630
-31346465663437663630663839613530323064383066323633363435616431346231396130383032
-32623730376363353938663834346665333133666661303162323030623462633234363139626633
-36623039363838646336623464313662333962326335653561383633306263366130366362626466
-33633366653036363935316239396161323663393263323435313032363862326637663732663839
-34663432663333666666303538623566633330313037623662616565373733636432373430333436
-65386331623439313066613437396566643062333062666437363365363134626333353332393534
-38343764383036343836346439363162363733646335616136616463396635323239636264303735
-34393533643730343432316661633736653161396161343431623862353136313035353933666537
-34346330663866323864666366363030613663643363346433303266643434643239643062303632
-30306638303534633833626532653462663337376435626533316230323638653861393130343763
-35376331333135343130303062333436643639353733653862383732363030396432386461346632
-30653230616231666665383564346565656461613561666139393234626263656137343530353136
-36376561333833633435353861336538636633633064633739313831366633633861303437306234
-39353538323563396632353936316330643961636665356439376666346135323563663631653365
-35633533643731373861
+62623062666237373636616333623434363662316639633962363833303663376331346338363365
+6633336638623237396134613033346665313964613538320a656134323135613834316462366161
+36633062623031306562313233356536643132346466376435303031333331643936613036616236
+3231613336396135340a376339396663343837353139393062353530626566626566366439353762
+37376236376437393863633730643531323762336536633034353132356266373361613434326333
+39663562353337666435653435623563383630383537663633336437613262323733363766666539
+66373538386163303731663331666138656435343436613633323766366261316337373830653837
+64313133396532376436
--- a/ansible/host_vars/walker/vault.yml
+++ b/ansible/host_vars/walker/vault.yml
@ -1,25 +1,12 @@
 $ANSIBLE_VAULT;1.1;AES256
-61616639316338623739306163363831303664633965666134373335353038323065306538303465
-3462346437303139393738613031363637383731333438630a393862353436376264386264626531
-37326431643130373566633431313431653538636662623135386364373634373761303365646564
-3735633436323231390a386661336431656266616136626261373132393862386163396336643366
-31366463656363363363666438653762653332313336303561313961393236613065303966386535
-34396239366138613330366361323562663132343762333536646131643466643533303163636139
-34626135613731653033313236386162613037386464613531633063656564336566386461666639
-65653635326232643937313465343763326464613231383932393262323062316136353538626464
-31383361643164303330653531333439613665313136393833366334323931373963313033646163
-37363231616232353565636634646235383564356461393831323430363965333265656166363265
-62353130323939313931316430393636336634323930376337373130363362396561373835633731
-30383633333864623336353937623438616562346361626333306162626331326635363365353939
-32636637396461396662626633323034383034353630633565363439636261333063306638373063
-63363932623635393465336132343337633765646339376638326635373930353734666461636538
-39613538313462633836343664333034326436336139343865643135383736656132343866663263
-64323562383963396237383537306261643331646533616233326435386164336237316462623438
-30623662303835653039393739396535613264373031336637616165333837343939363564613339
-37633831653361373038643438623732323535653230626364653936383736363364313632656538
-63646361323733656362366433353136643038643039633231326638346636653861616437653562
-65343237623039386339326564316333636362376266316661333632313034366565383139323564
-30343531333038323438393461326335386439373365323031366562363966616437616265386234
-33646562626564386639376130623366303063313739343435656434356230636630333834666433
-35663035663137666537633335613737383563356266336433396531366166313435653934663433
-63646162663563643962
+65616232306563653238306536316238353432656365303665343830323833376436303231646230
+6633613632646639326266333639663734326135373165660a616534353763643737646363363635
+35316462343935666362313735376164343238313564366232346330313565613039643735626535
+3335366566303730640a656665323266386430383263326161376435663062353763396264316462
+62663166326262633437643065396132326366646331323330316565626637656632643162636563
+63623563386164333638633638633061616266316333336133313166373639643633643631386136
+39633565343862333134323737393761323365636534303863646233646639636437656335633836
+66356237386162316365376238343430373866623463633635383634383336393264363364663139
+32613761643030343764396339386538333663376633646332613330373838343137373833643235
+61303762336132326339363366623231366565316139383561656364376564336230346533323638
+626365336439666234343531666266646437
--- a/ansible/main.yml
+++ b/ansible/main.yml
@ -9,10 +9,12 @@
 - hosts: casey
  roles:
    - nginx
-    - geerlingguy.certbot
+    - role: geerlingguy.certbot
+      become: true
    - gateway
    - headscale
    - restic
+    - artis3n.tailscale
    - glinet_vpn

 - hosts:
@ -23,6 +25,7 @@
    - tang
  roles:
    - role: geerlingguy.ntp
+      become: true
      vars:
        ntp_timezone: "{{ timezone }}"
        ntp_manage_config: true
@ -34,7 +37,8 @@
    - renovate
    - gitea-runner
  roles:
-    - geerlingguy.docker
+    - role: geerlingguy.docker
+      become: true
    - docker_cleanup

 - hosts:
@ -49,14 +53,6 @@
  roles:
    - traefik

- hosts:
-    - ingress
-    - walker
-    - casey
-  become: false  # Forcefully run as current user
-  roles:
-    - artis3n.tailscale
-
 - hosts: pve-docker
  roles:
    - pve_docker
@ -70,20 +66,22 @@
    - authentik
    - minio
    - ntfy
-    - baby_buddy
-    - bsky

 - hosts: ingress
  roles:
    - nginx
    - ingress
+    - artis3n.tailscale

 - hosts: pve
  roles:
-    - ironicbadger.proxmox_nag_removal
+    - role: ironicbadger.proxmox_nag_removal
+      become: true
    - zfs
-    - ironicbadger.snapraid
-    - prometheus.prometheus.node_exporter
+    - role: ironicbadger.snapraid
+      become: true
+    - role: prometheus.prometheus.node_exporter
+      become: true

 - hosts: forrest
  roles:
@ -100,11 +98,13 @@
 - hosts: walker
  roles:
    - nginx
-    - geerlingguy.certbot
+    - role: geerlingguy.certbot
+      become: true
    - coredns_docker_proxy
    - plausible
    - restic
    - website
+    - artis3n.tailscale
    - slides
    - comentario

@ -128,5 +128,6 @@
 - hosts: tang
  roles:
    - adguardhome
-    - prometheus.prometheus.node_exporter
+    - role: prometheus.prometheus.node_exporter
+      become: true
    - restic
--- a/ansible/roles/adguardhome/handlers/main.yml
+++ b/ansible/roles/adguardhome/handlers/main.yml
@ -3,9 +3,11 @@
    name: coredns
    state: restarted
    enabled: true
+  become: true

 - name: restart systemd-resolved
  service:
    name: systemd-resolved
    state: restarted
    enabled: true
+  become: true
--- a/ansible/roles/adguardhome/tasks/main.yml
+++ b/ansible/roles/adguardhome/tasks/main.yml
@ -1,6 +1,7 @@
 - name: Install adguardhome
-  package:
-    name: adguardhome
+  kewlfft.aur.aur:
+    name: adguardhome-bin
+  become: true

 - name: Disable resolved stub
  template:
@ -9,6 +10,7 @@
    owner: root
    mode: "0644"
  notify: restart systemd-resolved
+  become: true

 - name: Use resolved resolv.conf
  file:
@ -16,10 +18,12 @@
    dest: /etc/resolv.conf
    state: link
  notify: restart systemd-resolved
+  become: true

 - name: Install coredns
  kewlfft.aur.aur:
    name: coredns
+  become: true

 - name: Install coredns config file
  template:
@ -28,3 +32,4 @@
    owner: coredns
    mode: "0644"
  notify: restart coredns
+  become: true
--- a/ansible/roles/authentik/files/docker-compose.yml
+++ b/ansible/roles/authentik/files/docker-compose.yml
@ -19,7 +19,7 @@ x-env: &env

 services:
  server:
-    image: ghcr.io/goauthentik/server:2024.8
+    image: ghcr.io/goauthentik/server:2024.6
    restart: unless-stopped
    command: server
    user: "{{ docker_user.id }}"
@ -42,7 +42,7 @@ services:
      - traefik

  worker:
-    image: ghcr.io/goauthentik/server:2024.8
+    image: ghcr.io/goauthentik/server:2024.6
    restart: unless-stopped
    command: worker
    user: "{{ docker_user.id }}"
--- a/ansible/roles/authentik/tasks/main.yml
+++ b/ansible/roles/authentik/tasks/main.yml
@ -7,6 +7,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install compose file
  template:
@ -16,3 +17,4 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  notify: restart authentik
+  become: true
--- a/ansible/roles/baby_buddy/files/docker-compose.yml
+++ b/ansible/roles/baby_buddy/files/docker-compose.yml
@ -1,38 +0,0 @@
-services:
-  baby-buddy:
-    image: lscr.io/linuxserver/babybuddy:latest
-    restart: unless-stopped
-    environment:
-      - PUID={{ docker_user.id }}
-      - PGID={{ docker_user.id }}
-      - TZ={{ timezone }}
-      - DATABASE_URL=postgres://baby-buddy:baby-buddy@db/baby-buddy
-      - ALLOWED_HOSTS=baby-buddy.jakehoward.tech
-      - CSRF_COOKIE_SECURE=True
-      - SECRET_KEY={{ vault_secret_key }}
-      - SECURE_PROXY_SSL_HEADER=True
-      - SESSION_COOKIE_SECURE=True
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.baby-buddy.rule=Host(`baby-buddy.jakehoward.tech`)
-      - traefik.http.routers.baby-buddy.middlewares=tailscale-only@file
-    volumes:
-      - "{{ app_data_dir }}/baby-buddy:/config"
-    depends_on:
-      - db
-    networks:
-      - default
-      - traefik
-
-  db:
-    image: postgres:14-alpine
-    restart: unless-stopped
-    volumes:
-      - /mnt/speed/dbs/postgres/baby-buddy:/var/lib/postgresql/data
-    environment:
-      - POSTGRES_PASSWORD=baby-buddy
-      - POSTGRES_USER=baby-buddy
-
-networks:
-  traefik:
-    external: true
--- a/ansible/roles/baby_buddy/handlers/main.yml
+++ b/ansible/roles/baby_buddy/handlers/main.yml
@ -1,4 +0,0 @@
- name: restart baby-buddy
-  shell:
-    chdir: /opt/baby-buddy
-    cmd: "{{ docker_update_command }}"
--- a/ansible/roles/baby_buddy/tasks/main.yml
+++ b/ansible/roles/baby_buddy/tasks/main.yml
@ -1,18 +0,0 @@
- name: Include vault
-  include_vars: vault.yml
-
- name: Create install directory
-  file:
-    path: /opt/baby-buddy
-    state: directory
-    owner: "{{ docker_user.name }}"
-    mode: "{{ docker_compose_directory_mask }}"
-
- name: Install compose file
-  template:
-    src: files/docker-compose.yml
-    dest: /opt/baby-buddy/docker-compose.yml
-    mode: "{{ docker_compose_file_mask }}"
-    owner: "{{ docker_user.name }}"
-    validate: docker-compose -f %s config
-  notify: restart baby-buddy
--- a/ansible/roles/baby_buddy/vars/vault.yml
+++ b/ansible/roles/baby_buddy/vars/vault.yml
@ -1,8 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-31663462633839636531393633633938376534316230626362353733653862623964626232333265
-3733313066313639363131353963373431363761383537300a613662393631623832613537363034
-30623931653839636361646231386465383333343535646436656565663137303166366533353866
-3634643437303034330a646236353831363638633835666239383430636532396466623461303535
-31383238633430393935653366646666303066316232643733366264353034626461613038323834
-35383961316663356136363562646636313133346438343965383931353336643434303938373766
-303432363965616134613933643635626565
--- a/ansible/roles/base/tasks/fail2ban.yml
+++ b/ansible/roles/base/tasks/fail2ban.yml
@ -1,21 +1,25 @@
 - name: Install fail2ban
  package:
    name: fail2ban
+  become: true

 - name: Enable fail2ban
  service:
    name: fail2ban
    enabled: true
+  become: true

 - name: fail2ban SSH jail
  template:
    src: files/ssh-jail.conf
    dest: /etc/fail2ban/jail.d/ssh.conf
    mode: "0600"
+  become: true
  register: fail2ban_jail

 - name: Restart fail2ban
  service:
    name: fail2ban
    state: restarted
+  become: true
  when: fail2ban_jail.changed
--- a/ansible/roles/base/tasks/logrotate.yml
+++ b/ansible/roles/base/tasks/logrotate.yml
@ -1,11 +1,13 @@
 - name: Install logrotate
  package:
    name: logrotate
+  become: true

 - name: Enable logrotate timer
  service:
    name: logrotate.timer
    enabled: true
+  become: true
  when: ansible_os_family == 'Archlinux'

 - name: logrotate fail2ban config
@ -13,3 +15,4 @@
    src: files/fail2ban-logrotate
    dest: /etc/logrotate.d/fail2ban
    mode: "0600"
+  become: true
--- a/ansible/roles/base/tasks/packages.yml
+++ b/ansible/roles/base/tasks/packages.yml
@ -1,6 +1,7 @@
 - name: Install Base Packages
  package:
    name: "{{ item }}"
+  become: true
  loop:
    - htop
    - neofetch
--- a/ansible/roles/base/tasks/ssh.yml
+++ b/ansible/roles/base/tasks/ssh.yml
@ -1,11 +1,13 @@
 - name: Install OpenSSH for Debian
  package:
    name: openssh-server
+  become: true
  when: ansible_os_family == 'Debian'

 - name: Install OpenSSH for Arch
  package:
    name: openssh
+  become: true
  when: ansible_os_family == 'Archlinux'

 - name: Define context
@ -20,6 +22,7 @@
    validate: /usr/sbin/sshd -t -f %s
    backup: true
    mode: "644"
+  become: true
  register: sshd_config

 - name: Set up authorized keys
@ -35,9 +38,11 @@
  service:
    name: sshd
    enabled: true
+  become: true

 - name: Restart SSH Daemon
  service:
    name: sshd
    state: reloaded
  when: sshd_config.changed
+  become: true
--- a/ansible/roles/base/tasks/user.yml
+++ b/ansible/roles/base/tasks/user.yml
@ -5,9 +5,11 @@
    comment: "{{ me.name }}"
    shell: /bin/bash
    system: true
+  become: true

 - name: Give user sudo access
  user:
    name: "{{ me.user }}"
    groups: "{{ 'sudo' if ansible_os_family == 'Debian' else 'wheel' }}"
    append: true
+  become: true
--- a/ansible/roles/bsky/files/docker-compose.yml
+++ b/ansible/roles/bsky/files/docker-compose.yml
@ -1,19 +0,0 @@
-services:
-  pds:
-    image: ghcr.io/bluesky-social/pds:latest
-    user: "{{ docker_user.id }}"
-    restart: unless-stopped
-    env_file:
-      - /opt/bsky/pds.env
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.bsky.rule=Host(`bsky.theorangeone.net`)
-    volumes:
-      - "{{ app_data_dir }}/bsky:/pds"
-    networks:
-      - default
-      - traefik
-
-networks:
-  traefik:
-    external: true
--- a/ansible/roles/bsky/files/pds.env
+++ b/ansible/roles/bsky/files/pds.env
@ -1,17 +0,0 @@
-TZ={{ timezone }}
-PDS_HOSTNAME=bsky.theorangeone.net
-PDS_JWT_SECRET={{ vault_jwt_secret }}
-PDS_ADMIN_PASSWORD={{ vault_admin_password }}
-PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX={{ vault_plc_rotation_private_key }}
-PDS_DATA_DIRECTORY=/pds
-PDS_BLOBSTORE_DISK_LOCATION=/pds/blocks
-PDS_BLOB_UPLOAD_LIMIT=52428800
-PDS_DID_PLC_URL=https://plc.directory
-PDS_BSKY_APP_VIEW_URL=https://api.bsky.app
-PDS_BSKY_APP_VIEW_DID=did:web:api.bsky.app
-PDS_REPORT_SERVICE_URL=https://mod.bsky.app
-PDS_REPORT_SERVICE_DID=did:plc:ar7c4by46qjdydhdevvrndac
-PDS_CRAWLERS=https://bsky.network
-LOG_ENABLED=false
-PDS_EMAIL_SMTP_URL={{ vault_smtp_url }}
-PDS_EMAIL_FROM_ADDRESS={{ vault_smtp_from_address }}
--- a/ansible/roles/bsky/handlers/main.yml
+++ b/ansible/roles/bsky/handlers/main.yml
@ -1,4 +0,0 @@
- name: restart bsky
-  shell:
-    chdir: /opt/bsky
-    cmd: "{{ docker_update_command }}"
--- a/ansible/roles/bsky/tasks/main.yml
+++ b/ansible/roles/bsky/tasks/main.yml
@ -1,26 +0,0 @@
- name: Include vault
-  include_vars: vault.yml
-
- name: Create install directory
-  file:
-    path: /opt/bsky
-    state: directory
-    owner: "{{ docker_user.name }}"
-    mode: "{{ docker_compose_directory_mask }}"
-
- name: Install environment variables
-  template:
-    src: files/pds.env
-    dest: /opt/bsky/pds.env
-    mode: "660"
-    owner: "{{ docker_user.name }}"
-  notify: restart bsky
-
- name: Install compose file
-  template:
-    src: files/docker-compose.yml
-    dest: /opt/bsky/docker-compose.yml
-    mode: "{{ docker_compose_file_mask }}"
-    owner: "{{ docker_user.name }}"
-    validate: docker-compose -f %s config
-  notify: restart bsky
--- a/ansible/roles/bsky/vars/vault.yml
+++ b/ansible/roles/bsky/vars/vault.yml
@ -1,24 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-35316238376465633461333439343331636238346532623336316231653664653963643331346362
-3763363363333066636166356465373233323138643961390a343232623866303961316431363534
-31653234383465356637363636363838393130396364623261353266396533326563303838643366
-6339666332326439610a666235636432616565643839663234336134343632316538353331396337
-33303836373037336533623864613966646463333161663965653663326266376234633530393530
-63303938376338613531623065316339653938666439643035663231646566643334356337343861
-65353264613465626532643935313262323766666538386239613163366536636335616562613635
-31643637333266373336323035366465636261346263666239323934616238616366383330336661
-38386536326137363531636635626232333465613031633031336330316337303237303736656639
-37313331346165363465326336663536646438363835393138646238353661303937346430303333
-39663236663530396562626133666434396132356638643563626362636563373464356636313337
-63303730656338313036313937323462326366366231363265363335636536396335323561663235
-65333666333033376334303463376666373738376361316463343836323839383735666530656135
-33316238356536663362646437633866323531353439393561626331326562663366663839393438
-35653262653262326532386431373336393737363665393030363538356262346435343333373636
-34343261623832306139623337353137646435613433346630643865333965303334393666336534
-61353035373034323864356636643930333638396564616134353536663164363932643364656162
-35366139363939663632353066373932363961656464393131373239356663303736653334336531
-35303236303065363764313432643664333532343134393965323963636664663536376632323538
-38356335383934636631643436356563636364646136333637666331363261656236346539373233
-37306330306531623464663031626337346339613630363635633161336366653638626339356662
-63383836613863646436346233376563353037373666313631393161333133633132666633663361
-326132663033396335306165333862666433
--- a/ansible/roles/comentario/files/docker-compose.yml
+++ b/ansible/roles/comentario/files/docker-compose.yml
@ -1,6 +1,6 @@
 services:
  comentario:
-    image: registry.gitlab.com/comentario/comentario:v3.11.0
+    image: registry.gitlab.com/comentario/comentario:v3.9.0
    restart: unless-stopped
    user: "{{ docker_user.id }}:{{ docker_user.id }}"
    depends_on:
--- a/ansible/roles/comentario/tasks/main.yml
+++ b/ansible/roles/comentario/tasks/main.yml
@ -7,6 +7,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install compose file
  template:
@ -16,6 +17,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  notify: restart comentario
+  become: true

 - name: Install secrets
  copy:
@ -24,6 +26,7 @@
    mode: "600"
    owner: "{{ docker_user.name }}"
  notify: restart comentario
+  become: true

 - name: Install nginx config
  template:
@ -31,6 +34,7 @@
    dest: /etc/nginx/http.d/comentario.conf
    mode: "0644"
  notify: reload nginx
+  become: true
  vars:
    server_name: comentario.theorangeone.net
    upstream: comentario-comentario-1.docker:80
--- a/ansible/roles/comentario/vars/main.yml
+++ b/ansible/roles/comentario/vars/main.yml
@ -11,9 +11,6 @@ comentario_secrets:
    gitlab:
      key: "{{ vault_comentario_gitlab_application_id }}"
      secret: "{{ vault_comentario_gitlab_application_secret }}"
-    twitter:
-      key: "{{ vault_comentario_twitter_api_key }}"
-      secret: "{{ vault_comentario_twitter_api_secret  }}"
  smtpServer:
    host: smtp.eu.mailgun.org
    port: 587
--- a/ansible/roles/comentario/vars/vault.yml
+++ b/ansible/roles/comentario/vars/vault.yml
@ -1,38 +1,30 @@
 $ANSIBLE_VAULT;1.1;AES256
-36376264363334643335646564636336613234393261326366386234663464633966666133383933
-3731363234333962306638323737336237343230653439650a343362336166626633666161313863
-33623130623239626532663063633436616665653135343266336330353538306265323739326262
-3066643432643465350a643436366637623765663265316665386564663933663730383264396336
-39396139396238653065366663333533343336363631616332616362386639313766656136666532
-63336131346563323733333139636233353465643766643562643632653062373737353364336536
-64653162656233383136363339623933643834363931663830656364396637333632613838323461
-38666362663831363363636363346164343032376366346530393864306332326339323836643062
-66346265643039663636616464383330366539343832373839663361393661353861643364633534
-38383461323031626161663938326339386634363165303238333365323235303535333765613734
-30363032386333353962306131373466356137666334303230343561616639363238633630386330
-32383537646430666331313530343033376238646334313335343661313665626631663331656638
-31303637343263343566386634623362373366323136663032663966313836353136616564646563
-66653938326539343130346439666264663962323661386131643432663237643334633837376163
-62393330336434393232646163353539303831336638663135393734393064353964623032616233
-32393037313965313933363236653537306634613265633764636436653332623339316132373964
-39313334653831366533663661653934633338393539326564396236373462623262333530346436
-66646266623666333034346634613365356333343934363963366137303030646638373466643564
-66356265363634623363646266633137363966666361366463383266663032316665373430383031
-33303530323561366531356133363035353732333135303762316337626330333530303563643935
-35303465633536373833386435336638386662353032383861633965393564303839666463616263
-39353934343965316134663634363135616338353734656361343433313837313639303931356233
-39643135353661306461393962646238613062356361386533316362633233353235666262653738
-33616465653435303736636165343239336139383162616463613232656639393338363766396434
-32353965363537666366623066313461316463373130653637343430366231366263616261393564
-36323038383238633239323365326334393132643832373033643432653032613665646666336338
-30316565346630396537363431366337656236363462646435393731323866313366373438386265
-61373366383865336334356638653065333839303663636266393933663833313931333133663966
-35306163373462613335616265316563313062623139343061306465656463336162396266636437
-36646439613433306464383133636466383430363363393762646534343133333732613530626162
-31633430313039643636666365613232373335336235633832666139643937373766336563303266
-34396137656436373438383035316133343132313130636536393536393862386531386531303761
-64613337353463383032636636643963636235346262646366366539646233313939633864306335
-38373465373863383964633038373334386632666236303436376438666132623964396434626439
-38356235353430323236623962396461346438633962333163393535373362373164313132356232
-63313639333862313565396165613265623135626635373134626137633638333561353732313036
-3837
+33656462373736356363313738643335333930343461366666663532653264363963653732656366
+3034323730613334326462326332323763323665636165390a303639633036303831373966303037
+37376233383138323265396531303739316330396230333464383963333035343735303866626334
+6562393435303264620a633139616164303337363863616138306531656365353964346638646165
+35346539326339623364343662643038336238613535623964666562383662613661616564646433
+30653432666538616565373832353434303565386333643735313866396436393732303466376237
+64383236373364383338613530353830353334326331636436323766353565656664356138386532
+62366266656461663330396562316439393038666534663564633037623237363532363637356336
+63336633393666343064383735363664643936333130636465623139393838373134636265366439
+64326538653236306437346165333934303134313032383135313335626136626162363831613430
+30636436343162376637616262393633306330663362396638393166643131343564646162616530
+62343735343832636661326265396262643136346366663337636335656137393231646438633338
+61613137366661333462363134343732666330373864393636643665396435653064623030626466
+65633536346531383565616130626461376566316535316339326363646336626266376330393939
+33653438656438316532393665333939613334666464656635323566326439363964316535623233
+38636236616637336230363032396635613563313966353334313365663434653138303764393938
+37643561346338323934663936356563363833383435373933396138663334616563666562653935
+33666631373964396265393233636631336632386537663663366439313137656661653265323162
+64656333336165326563323333653036386334386566386664306638656130323665366136373732
+34383532303363646334356534316630363133303031343665353465656239306338386238313262
+30363438383164343661343730386162633430373765313834313739393638333963393234613564
+30356134646431353132316565346331613137353431383863383866306632626336633764393036
+66626466623034666335356539653136633331636365623061613433393335303535333433616137
+65383231373230653838316630303736353237666431366134353534366564656338646265396162
+61663366663532636635663337363063306466626463396630636236363736303963353062376163
+63653530346335393934656531386139663136383132306564383937396364626365373839613766
+62633264336335313932396164373363623061363262616330343735633862623234643365353035
+36616231636461323832663837323232396636363561376563386530306339333431613935613263
+30366335393834643066343763636561346336383463333535323932326663633338
--- a/ansible/roles/coredns_docker_proxy/files/docker-compose.yml
+++ b/ansible/roles/coredns_docker_proxy/files/docker-compose.yml
@ -1,6 +1,6 @@
 services:
  coredns:
-    image: coredns/coredns:1.11.3
+    image: coredns/coredns:latest
    restart: unless-stopped
    volumes:
      - ./Corefile:/home/nonroot/Corefile:ro
--- a/ansible/roles/coredns_docker_proxy/tasks/main.yml
+++ b/ansible/roles/coredns_docker_proxy/tasks/main.yml
@ -1,6 +1,8 @@
 - name: Create network
  docker_network:
    name: coredns
+    internal: true
+  become: true

 - name: Create install directory
  file:
@ -8,6 +10,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install compose file
  template:
@ -17,11 +20,4 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  notify: restart coredns
-
- name: Install Corefile
-  template:
-    src: files/Corefile
-    dest: /opt/coredns/Corefile
-    mode: "{{ docker_compose_file_mask }}"
-    owner: "{{ docker_user.name }}"
-  notify: restart coredns
+  become: true
--- a/ansible/roles/db_auto_backup/files/docker-compose.yml
+++ b/ansible/roles/db_auto_backup/files/docker-compose.yml
@ -9,9 +9,6 @@ services:
      - HEALTHCHECKS_ID={{ vault_db_auto_backup_healthchecks_id }}
    depends_on:
      - docker_proxy
-    networks:
-      - default
-      - backup_private

  docker_proxy:
    image: lscr.io/linuxserver/socket-proxy:latest
@ -23,13 +20,5 @@ services:
      - EXEC=1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
-    networks:
-      - backup_private
-    tmpfs:
-      - /run
    logging:
      driver: none
-
-networks:
-  backup_private:
-    internal: true
--- a/ansible/roles/db_auto_backup/tasks/main.yml
+++ b/ansible/roles/db_auto_backup/tasks/main.yml
@ -4,6 +4,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install compose file
  template:
@ -13,3 +14,4 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  notify: restart db-auto-backup
+  become: true
--- a/ansible/roles/docker_cleanup/tasks/main.yml
+++ b/ansible/roles/docker_cleanup/tasks/main.yml
@ -1,6 +1,7 @@
 - name: Install docker-compose
  package:
    name: docker-compose
+  become: true
  when: ansible_os_family != 'Debian'

 - name: Install compose-switch
@ -8,6 +9,7 @@
    url: "{{ docker_compose_url }}"
    dest: "{{ docker_compose_path }}"
    mode: "0755"
+  become: true
  when: ansible_os_family == 'Debian'

 - name: Create docker group
@ -15,6 +17,7 @@
    name: "{{ docker_user.name }}"
    state: present
    gid: "{{ docker_user.id }}"
+  become: true

 - name: Create docker user
  user:
@ -22,18 +25,21 @@
    uid: "{{ docker_user.id }}"
    group: "{{ docker_user.name }}"
    create_home: false
+  become: true

 - name: Add user to docker user group
  user:
    name: "{{ me.user }}"
    groups: "{{ docker_user.name }}"
    append: true
+  become: true

 - name: Add user to docker group
  user:
    name: "{{ me.user }}"
    groups: docker
    append: true
+  become: true

 - name: Clean up docker containers
  cron:
@ -41,8 +47,6 @@
    hour: 1
    minute: 0
    job: docker system prune -af --volumes
-    cron_file: docker_cleanup
-    user: root

 - name: Install util scripts
  copy:
@ -50,7 +54,6 @@
    dest: "{{ me.home }}"
    mode: "755"
    directory_mode: "755"
-    owner: "{{ me.user }}"

 - name: override docker service for zfs dependencies
  include_tasks: zfs-override.yml
--- a/ansible/roles/docker_cleanup/tasks/zfs-override.yml
+++ b/ansible/roles/docker_cleanup/tasks/zfs-override.yml
@ -3,6 +3,7 @@
    path: /etc/systemd/system/docker.service.d
    state: directory
    mode: "0755"
+  become: true

 - name: Create override.conf
  copy:
@ -11,3 +12,4 @@
    owner: root
    group: root
    mode: "0644"
+  become: true
--- a/ansible/roles/forgejo/files/docker-compose.yml
+++ b/ansible/roles/forgejo/files/docker-compose.yml
@ -1,6 +1,6 @@
 services:
  forgejo:
-    image: code.forgejo.org/forgejo/forgejo:9-rootless
+    image: code.forgejo.org/forgejo/forgejo:8-rootless
    user: "{{ docker_user.id }}:{{ docker_user.id }}"
    environment:
      - TZ={{ timezone }}
--- a/ansible/roles/forgejo/tasks/main.yml
+++ b/ansible/roles/forgejo/tasks/main.yml
@ -7,6 +7,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install compose file
  template:
@ -16,6 +17,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  notify: restart gitea
+  become: true

 - name: Install config file
  template:
@ -24,6 +26,7 @@
    mode: "{{ docker_compose_file_mask }}"
    owner: "{{ docker_user.name }}"
  notify: restart gitea
+  become: true

 - name: Create custom templates directory
  file:
@ -32,6 +35,7 @@
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
    recurse: true
+  become: true

 - name: Install custom footer
  copy:
@ -40,3 +44,4 @@
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_file_mask }}"
  notify: restart gitea
+  become: true
--- a/ansible/roles/forgejo_runner/files/docker-compose.yml
+++ b/ansible/roles/forgejo_runner/files/docker-compose.yml
@ -1,44 +1,20 @@
 services:
  forgejo-runner:
-    image: code.forgejo.org/forgejo/runner:4.0.1
+    image: code.forgejo.org/forgejo/runner:3.5.1
    user: "{{ docker_user.id }}"
    volumes:
      - /mnt/data:/data
-      - ./config.yml:/data/config.yml
    environment:
      - TZ={{ timezone }}
-      - DOCKER_HOST=tcp://docker_proxy:2375
+      - DOCKER_HOST=tcp://dind:2375
    restart: unless-stopped
    command: forgejo-runner daemon
-    networks:
-      - default
-      - forgejo_private
    depends_on:
-      - docker_proxy
+      dind:
+        condition: service_started

-  docker_proxy:
-    image: lscr.io/linuxserver/socket-proxy:latest
+  dind:
+    image: docker:dind
+    privileged: true
+    command: [dockerd, -H, tcp://0.0.0.0:2375, --tls=false]
    restart: unless-stopped
-    environment:
-      - POST=1
-      - CONTAINERS=1
-      - INFO=1
-      - IMAGES=1
-      - VOLUMES=1
-      - NETWORKS=1
-      - ALLOW_START=1
-      - ALLOW_STOP=1
-      - ALLOW_RESTARTS=1
-      - EXEC=1
-    tmpfs:
-      - /run
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    networks:
-      - forgejo_private
-    logging:
-      driver: none
-
-networks:
-  forgejo_private:
-    internal: true
--- a/ansible/roles/forgejo_runner/tasks/main.yml
+++ b/ansible/roles/forgejo_runner/tasks/main.yml
@ -4,14 +4,24 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Create data directory
+  file:
+    path: /opt/forgejo-runner/data
+    state: directory
+    mode: "700"
+    owner: "{{ docker_user.name }}"
+  become: true

 - name: Install config file
  template:
    src: files/config.yml
-    dest: /opt/forgejo-runner/config.yml
+    dest: /opt/forgejo-runner/data/config.yml
    mode: "600"
    owner: "{{ docker_user.name }}"
  notify: restart forgejo-runner
+  become: true

 - name: Install compose file
  template:
@ -21,3 +31,4 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  notify: restart forgejo-runner
+  become: true
--- a/ansible/roles/gateway/tasks/fail2ban.yml
+++ b/ansible/roles/gateway/tasks/fail2ban.yml
@ -3,6 +3,7 @@
    src: files/nginx-fail2ban-filter.conf
    dest: /etc/fail2ban/filter.d/nginx-tcp.conf
    mode: "0600"
+  become: true
  register: fail2ban_filter

 - name: fail2ban jail
@ -10,10 +11,12 @@
    src: files/nginx-fail2ban-jail.conf
    dest: /etc/fail2ban/jail.d/nginx.conf
    mode: "0600"
+  become: true
  register: fail2ban_jail

 - name: Restart fail2ban
  service:
    name: fail2ban
    state: restarted
+  become: true
  when: fail2ban_filter.changed or fail2ban_jail.changed
--- a/ansible/roles/gateway/tasks/nginx.yml
+++ b/ansible/roles/gateway/tasks/nginx.yml
@ -3,6 +3,7 @@
    src: files/nginx.conf
    dest: /etc/nginx/stream.d/gateway.conf
    mode: "0644"
+  become: true
  register: nginx_config

 - name: Install CDN config
@ -10,10 +11,12 @@
    src: files/nginx-cdn.conf
    dest: /etc/nginx/http.d/cdn.conf
    mode: "0644"
+  become: true
  register: nginx_config

 - name: Reload Nginx
  service:
    name: nginx
    state: reloaded
+  become: true
  when: nginx_config.changed
--- a/ansible/roles/gateway/tasks/wireguard.yml
+++ b/ansible/roles/gateway/tasks/wireguard.yml
@ -1,6 +1,7 @@
 - name: Install wireguard tools
  package:
    name: "{{ item }}"
+  become: true
  loop:
    - wireguard-tools
    - qrencode
@ -11,18 +12,21 @@
    dest: /etc/wireguard/wg0.conf
    mode: "0600"
    backup: true
+  become: true
  register: wireguard_conf

 - name: Enable wireguard
  service:
    name: wg-quick@wg0
    enabled: true
+  become: true

 - name: Restart wireguard
  service:
    name: wg-quick@wg0
    state: restarted
  when: wireguard_conf.changed
+  become: true

 - name: Create wireguard client directory
  file:
--- a/ansible/roles/glinet_vpn/handlers/main.yml
+++ b/ansible/roles/glinet_vpn/handlers/main.yml
@ -2,3 +2,4 @@
  service:
    name: wg-quick@glinet
    state: restarted
+  become: true
--- a/ansible/roles/glinet_vpn/tasks/main.yml
+++ b/ansible/roles/glinet_vpn/tasks/main.yml
@ -4,6 +4,7 @@
 - name: Install wireguard tools
  package:
    name: "{{ item }}"
+  become: true
  loop:
    - wireguard-tools
    - qrencode
@ -14,6 +15,7 @@
    dest: /etc/wireguard/glinet.conf
    mode: "0600"
    backup: true
+  become: true
  notify: restart wireguard

 - name: Wireguard client config
@ -22,9 +24,11 @@
    dest: "{{ me.home }}/glinet-vpn.conf"
    mode: "0600"
    owner: "{{ me.user }}"
+  become: true
  notify: restart wireguard

 - name: Enable wireguard
  service:
    name: wg-quick@glinet
    enabled: true
+  become: true
--- a/ansible/roles/headscale/files/acls.json
+++ b/ansible/roles/headscale/files/acls.json
@ -1,7 +1,6 @@
 {
    "tagOwners": {
-        "tag:client": [],
-        "tag:private-svcs": []
+        "tag:client": []

    },
    "acls": [
@ -9,11 +8,6 @@
            "action": "accept",
            "src": ["tag:client"],
            "dst": ["*:*"]
-        },
-        {
-            "action": "accept",
-            "src": ["tag:private-svcs"],
-            "dst": ["{{ vps_hosts.private_ipv6_marker }}:80,443"]
        }
    ]
 }
--- a/ansible/roles/headscale/files/headscale.yml
+++ b/ansible/roles/headscale/files/headscale.yml
@ -63,11 +63,9 @@ noise:
 # IPv6: https://github.com/tailscale/tailscale/blob/22ebb25e833264f58d7c3f534a8b166894a89536/net/tsaddr/tsaddr.go#LL81C52-L81C71
 # IPv4: https://github.com/tailscale/tailscale/blob/22ebb25e833264f58d7c3f534a8b166894a89536/net/tsaddr/tsaddr.go#L33
 # Any other range is NOT supported, and it will cause unexpected issues.
-prefixes:
-  v6: fd7a:115c:a1e0::/48
-  v4: 100.64.0.0/10
-
-  allocation: sequential
+ip_prefixes:
+  - fd7a:115c:a1e0::/48
+  - 100.64.0.0/10

 # DERP is a relay system that Tailscale uses when a direct
 # connection cannot be established.
@ -96,13 +94,6 @@ derp:
    # For more details on how this works, check this great article: https://tailscale.com/blog/how-tailscale-works/
    stun_listen_addr: 0.0.0.0:3478

-    automatically_add_embedded_derp_region: true
-
-    private_key_path: /var/lib/headscale/derp_server_private.key
-
-    ipv4: "{{ ansible_default_ipv4.address }}"
-    ipv6: "{{ ansible_default_ipv6.address }}"
-
  # List of externally available DERP maps encoded in JSON
  urls: []

@ -137,25 +128,10 @@ ephemeral_node_inactivity_timeout: 30m
 node_update_check_interval: 20s

 # SQLite config
-database:
-  type: sqlite
+db_type: sqlite3

-  gorm:
-    # Enable prepared statements.
-    prepare_stmt: true
-
-    # Enable parameterized queries.
-    parameterized_queries: true
-
-    # Skip logging "record not found" errors.
-    skip_err_record_not_found: true
-
-    # Threshold for slow queries in milliseconds.
-    slow_threshold: 3000
-
-  sqlite:
-    path: /var/lib/headscale/db.sqlite
-    write_ahead_log: true
+# For production:
+db_path: /var/lib/headscale/db.sqlite

 # # Postgres config
 # If using a Unix socket to connect to Postgres, set the socket path in the 'host' field and leave 'port' blank.
@ -212,9 +188,7 @@ log:
 # Path to a file containg ACL policies.
 # ACLs can be defined as YAML or HUJSON.
 # https://tailscale.com/kb/1018/acls/
-policy:
-  mode: file
-  path: /etc/headscale/acls.json
+acl_policy_path: /etc/headscale/acls.json

 ## DNS
 #
@ -225,13 +199,13 @@ policy:
 # - https://tailscale.com/kb/1081/magicdns/
 # - https://tailscale.com/blog/2021-09-private-dns-with-magicdns/
 #
-dns:
+dns_config:
  # Whether to prefer using Headscale provided DNS or use local.
  override_local_dns: false

  # List of DNS servers to expose to clients.
  nameservers:
-    global: []
+    - 1.1.1.1

  # NextDNS (see https://tailscale.com/kb/1218/nextdns/).
  # "abc123" is example NextDNS ID, replace with yours.
@ -277,7 +251,7 @@ dns:
  # `base_domain` must be a FQDNs, without the trailing dot.
  # The FQDN of the hosts will be
  # `hostname.user.base_domain` (e.g., _myhost.myuser.example.com_).
-  base_domain: hs.sys.theorangeone.net
+  base_domain: headscale.jakehoward.tech

 # Unix socket used for the CLI to connect without authentication
 # Note: for production you will want to set this to something like:
--- a/ansible/roles/headscale/handlers/main.yml
+++ b/ansible/roles/headscale/handlers/main.yml
@ -3,3 +3,4 @@
    name: headscale
    state: restarted
    enabled: true
+  become: true
--- a/ansible/roles/headscale/tasks/main.yml
+++ b/ansible/roles/headscale/tasks/main.yml
@ -4,6 +4,7 @@
 - name: Install Headscale
  package:
    name: headscale
+  become: true

 - name: Install headscale config file
  template:
@ -12,6 +13,7 @@
    owner: headscale
    mode: "0600"
  notify: restart headscale
+  become: true

 - name: Install ACLs
  template:
@ -20,10 +22,12 @@
    owner: headscale
    mode: "0600"
  notify: restart headscale
+  become: true

 - name: Install nginx config
  template:
    src: files/nginx.conf
    dest: /etc/nginx/http.d/headscale.conf
    mode: "0644"
+  become: true
  notify: reload nginx
--- a/ansible/roles/http_proxy/handlers/main.yml
+++ b/ansible/roles/http_proxy/handlers/main.yml
@ -2,3 +2,4 @@
  service:
    name: squid
    state: restarted
+  become: true
--- a/ansible/roles/http_proxy/tasks/main.yml
+++ b/ansible/roles/http_proxy/tasks/main.yml
@ -1,15 +1,18 @@
 - name: Install squid
  package:
    name: squid
+  become: true

 - name: Squid config
  template:
    src: files/squid.conf
    dest: /etc/squid/squid.conf
    mode: "0600"
+  become: true
  notify: restart squid

 - name: Enable squid
  service:
    name: squid
    enabled: true
+  become: true
--- a/ansible/roles/ingress/handlers/main.yml
+++ b/ansible/roles/ingress/handlers/main.yml
@ -2,11 +2,13 @@
  service:
    name: wg-quick@wg0
    state: restarted
+  become: true

 - name: reload nginx
  service:
    name: nginx
    state: reloaded
+  become: true

 - name: reload nftables
  command:
@ -14,3 +16,4 @@
      - nft
      - -f
      - /etc/nftables.conf
+  become: true
--- a/ansible/roles/ingress/tasks/firewall.yml
+++ b/ansible/roles/ingress/tasks/firewall.yml
@ -1,6 +1,7 @@
 - name: Install nftables
  package:
    name: nftables
+  become: true

 - name: Copy firewall config
  template:
@ -8,6 +9,7 @@
    dest: /etc/nftables.conf
    validate: nft -c -f %s
    mode: "644"
+  become: true
  notify: reload nftables

 - name: Enable nftables
@ -15,3 +17,4 @@
    name: nftables
    enabled: true
    state: started
+  become: true
--- a/ansible/roles/ingress/tasks/nginx.yml
+++ b/ansible/roles/ingress/tasks/nginx.yml
@ -3,4 +3,5 @@
    src: files/nginx.conf
    dest: /etc/nginx/stream.d/ingress.conf
    mode: "0644"
+  become: true
  notify: reload nginx
--- a/ansible/roles/ingress/tasks/wireguard.yml
+++ b/ansible/roles/ingress/tasks/wireguard.yml
@ -1,6 +1,8 @@
 - name: Install Wireguard
  package:
-    name: wireguard
+    name:
+      - wireguard
+  become: true

 - name: Get wireguard credentials
  set_fact:
@ -12,12 +14,14 @@
    dest: /etc/wireguard/wg0.conf
    mode: "0600"
    backup: true
+  become: true
  notify: restart wireguard

 - name: Enable wireguard
  service:
    name: wg-quick@wg0
    enabled: true
+  become: true

 - name: Enable p2p communication
  sysctl:
@ -27,3 +31,4 @@
    state: present
    reload: true
    sysctl_file: /etc/sysctl.d/99-sysctl.conf
+  become: true
--- a/ansible/roles/jellyfin/tasks/main.yml
+++ b/ansible/roles/jellyfin/tasks/main.yml
@ -2,19 +2,23 @@
  ansible.builtin.apt_key:
    url: https://repo.jellyfin.org/jellyfin_team.gpg.key
    state: present
+  become: true

 - name: Add Jellyfin repository
  apt_repository:
    repo: deb [arch=amd64] https://repo.jellyfin.org/debian {{ ansible_distribution_release }} main
    filename: jellyfin
    state: present
+  become: true

 - name: Install jellyfin
  package:
    name: jellyfin
+  become: true

 - name: Set media dir permissions
  cron:
    name: Set media permissions
    special_time: daily
    job: chown -R jellyfin:jellyfin /mnt/media
+  become: true
--- a/ansible/roles/mastodon/files/docker-compose.yml
+++ b/ansible/roles/mastodon/files/docker-compose.yml
@ -1,22 +1,19 @@
 services:
  mastodon:
-    image: lscr.io/linuxserver/mastodon:4.3.1
+    image: lscr.io/linuxserver/mastodon:4.2.12
    environment:
      - TZ={{ timezone }}
      - PUID={{ docker_user.id }}
      - PGID={{ docker_user.id }}
      - LOCAL_DOMAIN=theorangeone.net
      - WEB_DOMAIN=mastodon.theorangeone.net
-      - DATABASE_URL=postgresql://mastodon:mastodon@db:5432/mastodon
+      - DATABASE_URL=postgresql://mastodon:mastodon@db/mastodon
      - REDIS_URL=redis://redis
      - SIDEKIQ_REDIS_URL=redis://redis/1
      - SECRET_KEY_BASE={{ vault_secret_key_base }}
      - OTP_SECRET={{ vault_otp_secret }}
      - VAPID_PRIVATE_KEY={{ vault_vapid_private_key }}
      - VAPID_PUBLIC_KEY={{ vault_vapid_public_key }}
-      - ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY={{ vault_active_record_encryption_deterministic_key }}
-      - ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT={{ vault_active_record_encryption_key_derivation_salt }}
-      - ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY={{ vault_active_record_encryption_primary_key }}
      - SINGLE_USER_MODE=true
      - DEFAULT_LOCALE=en
      - STREAMING_CLUSTER_NUM=1
--- a/ansible/roles/mastodon/tasks/main.yml
+++ b/ansible/roles/mastodon/tasks/main.yml
@ -7,6 +7,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install compose file
  template:
@ -16,6 +17,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  notify: restart mastodon
+  become: true

 - name: Install media cleanup script
  template:
@ -23,6 +25,7 @@
    dest: /opt/mastodon/purge-media.sh
    mode: "0755"
    owner: "{{ docker_user.name }}"
+  become: true

 - name: Schedule media cleanup
  cron:
@ -32,3 +35,4 @@
    weekday: 1
    job: /opt/mastodon/purge-media.sh
    user: "{{ me.user }}"
+  become: true
--- a/ansible/roles/mastodon/vars/vault.yml
+++ b/ansible/roles/mastodon/vars/vault.yml
@ -1,42 +1,30 @@
 $ANSIBLE_VAULT;1.1;AES256
-61313731363564306234653163633231356330313936636631393536356434396530643065333731
-3534663665643665613164343931646262643231356337350a333262356130636265643465323263
-34333463353131323930636566633462613561333733636230363066343834316664363036346635
-6666363330383337340a316635663663343034613039353835633035633036646131303365626466
-38636438323537303134356162633666376236346635366161356430376366626637343362363039
-33356332333362363834373137633130306161393430393830643363636463633234646634306265
-34366438333132633937303661356134383831373765306339363161643132393737356434653832
-31346166333539643161346130386565376630333435376661343666636239666138316337633463
-37633237393063313633393732616364653930353661366136346139663030393530383533646265
-34393236643439316364376236373431643536333561613135616338643538313238303530356136
-34393864323365633166643434363262346233393938313463643162343761643831373639313830
-31363837393934333064316463313562393939613034653762303764333730353165623765653430
-32383961353162306431393331643262353635383761663330323239383732346535636138636634
-64616631373765393033306562343433373733646331643930373663323837393438643331663062
-39323564376436353032303362653261363730383062346664663462656230613238303430303561
-63663461376139616237333864643461343130326637616264353132613930306238613634343636
-62393835393336646133616438336266653762366163623032323131656638393234383532333237
-34333030356638326139333636343865636335333665656534656466333135663562303637333136
-62386134633330663364323730646134383534623835636633653236653232393232653163613435
-64663437383233323435386163653933383634666630383862323831316166353837323461333961
-39626563323364653731316361333534616361366435643266626164666463613836336639373835
-64393038336333356431326532626463333332373465613364386461623533646266626264383332
-61393338663162343831616566346133646166353431396139393237356332616437353538313236
-35323263383036623761643430336462656430356164313561663437383530346434306438386533
-34366262663261636365323235326532393436333962383032353236323761373239613836646564
-33316433656636313261653364663966633431663762363133666631653835386131643061626161
-39633065326130643134343139363266363362393938623261646231333833643034633638386162
-37376263613839353365336563623830333338373339393830323834326234373833336237326365
-63366664323136303638643237366265653235363266333738343437313636663163663134363262
-32663533363539313238663237366330633738613733363932653031356263643935666166363536
-61383532373565383730363662613533333265636361333230333233396534353337653662363065
-38393937396337633430303831353831376666623061356239363534333537323662306530303639
-65303735343431623561356361373330343033643130393235336535623530303236356432353834
-62376163646362616465643730353866333464666365336336383466653462346334646231633736
-62336132343737303061396636313334333538396333626263396361386631313730363766653530
-66663461616530326261343931343330313836633966646661626361643064316261313234386635
-30306534396136656432653236343337656433396337393064313466653165396562393665363938
-63393232646164333263313136303236353465636139376232626563613835303561653935316332
-61373432613632663366383933343839363765396637306339363162616237366361306237336464
-37353336306536396466356432393766623061363938633736323431313237663464646364666131
-3737
+63646161653431383335313735643535313434613362343161373961633539373932313338343633
+6637323935616636353731336531663635656532383166640a633335666633363136333433343266
+37383237623837616464613561633931613230623633313533393464646464646566366330323365
+6563396262363238320a303433636266616635313536396132366239343230656432626639653230
+63336165323337393664373635616532643935343363303766376533366661663366623939653564
+35363335396266363532653038623038383836383236366466366339343433393338343566653834
+30393761626537313531346466373136666565653731663430376664353737663039643263303533
+35663836626462333262356330616131316432326139616165363831393036343235663736626661
+35666264346563306133306565636261633766616135616366376430643763333031353534373033
+35373739333562313639376264343562363130373531313563643834613533653034316536323339
+39646337376462656362666330643831653730393562316661326433633334353963306664396264
+30373238653832613861633263383663616538366361336163373861613538613132353963373666
+34376464333462633839396263396335613233356261666661313763333033376434626463663133
+32646130333635656665396335393232346661303861626566663931303637653065313031323936
+64333931393165343761376630666462343136353335343632323435306261633232633662353137
+32323863343365623566316537343062393638393434323134633535313531333135666535323439
+35613439373737396562613834373638356534326438646330663564366436333962626135363833
+63653731383163653932383632306239663365323237363562306639643662393530633430386164
+61613137663734636666633966663366393832353166343239656335396630323138366338616430
+37653036303735383664656530626630616437373762343263643661343464326466353234316363
+64643733363435656365343537626364643430316630663666373932663564623835646336633034
+65646264346439356161353838353064626230636664373035336433356530326632613035316434
+31613434366530323263383337316432316432373835343164313963643733626362393334623266
+65356131626135336337383139643838333134616137366530353730646634633364353333646563
+66333134616639363932613238346538623764663831353031383834613230393936386432623434
+37393935346238633338323432613638616466623264656434393761623363356330623632323261
+36393064316263666432663633323535363035323535653834323064383437343530306166306239
+37316236313533393062623066336561373138636339393631313866303433643832383230656532
+3137
--- a/ansible/roles/minio/tasks/main.yml
+++ b/ansible/roles/minio/tasks/main.yml
@ -7,6 +7,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install compose file
  template:
@ -16,3 +17,4 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  notify: restart minio
+  become: true
--- a/ansible/roles/nginx/handlers/main.yml
+++ b/ansible/roles/nginx/handlers/main.yml
@ -2,3 +2,4 @@
  service:
    name: nginx
    state: reloaded
+  become: true
--- a/ansible/roles/nginx/tasks/main.yml
+++ b/ansible/roles/nginx/tasks/main.yml
@ -1,6 +1,7 @@
 - name: Install nginx
  package:
    name: nginx
+  become: true

 - name: Install nginx modules
  package:
@ -10,6 +11,7 @@
    - libnginx-mod-http-brotli-filter
    - libnginx-mod-stream
  when: ansible_os_family != 'Archlinux'
+  become: true

 - name: Install nginx modules (on Arch)
  kewlfft.aur.aur:
@ -18,10 +20,12 @@
    - nginx-mod-headers-more
    - nginx-mod-brotli
  when: ansible_os_family == 'Archlinux'
+  become: true

 - name: Generate Diffie-Hellman parameters
  community.crypto.openssl_dhparam:
    path: /etc/nginx/dhparams.pem
+  become: true

 - name: Create config directories
  file:
@ -32,6 +36,7 @@
    - http.d
    - stream.d
    - includes
+  become: true

 - name: Copy config files
  template:
@ -39,6 +44,7 @@
    dest: /etc/nginx/includes/{{ item | basename }}
    mode: "0644"
  with_fileglob: files/includes/*.conf
+  become: true
  notify: reload nginx

 - name: Install config
@ -46,6 +52,7 @@
    src: files/nginx.conf
    dest: /etc/nginx/nginx.conf
    mode: "0644"
+  become: true
  notify: reload nginx

 - name: Install HTTPS redirect
@ -53,5 +60,6 @@
    src: files/nginx-https-redirect.conf
    dest: /etc/nginx/http.d/https-redirect.conf
    mode: "0644"
+  become: true
  notify: reload nginx
  when: nginx_https_redirect
--- a/ansible/roles/ntfy/tasks/main.yml
+++ b/ansible/roles/ntfy/tasks/main.yml
@ -7,6 +7,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install compose file
  template:
@ -16,3 +17,4 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  notify: restart ntfy
+  become: true
--- a/ansible/roles/paccache/tasks/main.yml
+++ b/ansible/roles/paccache/tasks/main.yml
@ -1,15 +1,18 @@
 - name: Install Pacman utils
  package:
    name: pacman-contrib
+  become: true

 - name: Create hooks directory
  file:
    path: /etc/pacman.d/hooks/
    state: directory
    mode: "0755"
+  become: true

 - name: Install pacman hook
  template:
    src: files/paccache.hook
    dest: /etc/pacman.d/hooks/clean_package_cache.hook
    mode: "0644"
+  become: true
--- a/ansible/roles/plausible/tasks/main.yml
+++ b/ansible/roles/plausible/tasks/main.yml
@ -7,6 +7,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install clickhouse config
  template:
@ -14,6 +15,7 @@
    dest: /opt/plausible/docker_related_config.xml
    mode: "0644"
  notify: restart plausible
+  become: true

 - name: Install clickhouse user config
  template:
@ -21,6 +23,7 @@
    dest: /opt/plausible/docker_related_user_config.xml
    mode: "0644"
  notify: restart plausible
+  become: true

 - name: Install compose file
  template:
@ -30,6 +33,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  notify: restart plausible
+  become: true

 - name: Install nginx config
  template:
@ -37,6 +41,7 @@
    dest: /etc/nginx/http.d/plausible.conf
    mode: "0644"
  notify: reload nginx
+  become: true
  vars:
    server_name: plausible.theorangeone.net elbisualp.theorangeone.net
    upstream: plausible-plausible-1.docker:8000
--- a/ansible/roles/privatebin/tasks/main.yml
+++ b/ansible/roles/privatebin/tasks/main.yml
@ -4,6 +4,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install compose file
  template:
@ -13,6 +14,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  notify: restart privatebin
+  become: true

 - name: Install config file
  template:
@ -21,3 +23,4 @@
    mode: "{{ docker_compose_file_mask }}"
    owner: "{{ docker_user.name }}"
  notify: restart privatebin
+  become: true
--- a/ansible/roles/prometheus/tasks/grafana.yml
+++ b/ansible/roles/prometheus/tasks/grafana.yml
@ -8,6 +8,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install grafana compose file
  template:
@ -17,3 +18,4 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  notify: restart grafana
+  become: true
--- a/ansible/roles/prometheus/tasks/main.yml
+++ b/ansible/roles/prometheus/tasks/main.yml
@ -17,6 +17,7 @@
      - "{{ vps_hosts.private_ipv6_range }}"
  register: routes
  changed_when: false
+  become: true

 - name: Add route to private services via ingress
  command:
@ -30,4 +31,5 @@
      - "{{ pve_hosts.ingress.ipv6 }}"
      - dev
      - eth0
+  become: true
  when: vps_hosts.private_ipv6_marker not in routes.stdout
--- a/ansible/roles/prometheus/tasks/prometheus.yml
+++ b/ansible/roles/prometheus/tasks/prometheus.yml
@ -4,6 +4,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install prometheus config
  template:
@ -12,6 +13,7 @@
    mode: "{{ docker_compose_file_mask }}"
    owner: "{{ docker_user.name }}"
  notify: reload prometheus
+  become: true

 - name: Install prometheus compose file
  template:
@ -21,6 +23,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  notify: restart prometheus
+  become: true

 - name: Install blackbox config
  template:
@ -29,6 +32,7 @@
    mode: "{{ docker_compose_file_mask }}"
    owner: "{{ docker_user.name }}"
  notify: restart prometheus
+  become: true

 - name: Install alertmanager config
  template:
@ -37,6 +41,7 @@
    mode: "{{ docker_compose_file_mask }}"
    owner: "{{ docker_user.name }}"
  notify: restart prometheus
+  become: true

 - name: Install prometheus alert rules
  copy:
@ -45,3 +50,4 @@
    mode: "{{ docker_compose_file_mask }}"
    owner: "{{ docker_user.name }}"
  notify: reload prometheus
+  become: true
--- a/ansible/roles/pve_docker/files/nextcloud/config.php
+++ b/ansible/roles/pve_docker/files/nextcloud/config.php
@ -19,7 +19,7 @@ $CONFIG = array (
    0 => 'intersect.jakehoward.tech',
  ),
  'dbtype' => 'mysql',
-  'version' => '30.0.1.2',
+  'version' => '29.0.4.1',
  'overwrite.cli.url' => 'https://intersect.jakehoward.tech',
  'dbname' => 'nextcloud',
  'dbhost' => 'mariadb',
--- a/ansible/roles/pve_docker/files/nextcloud/docker-compose.yml
+++ b/ansible/roles/pve_docker/files/nextcloud/docker-compose.yml
@ -1,6 +1,6 @@
 services:
  nextcloud:
-    image: lscr.io/linuxserver/nextcloud:30.0.1
+    image: lscr.io/linuxserver/nextcloud:29.0.4
    environment:
      - PUID={{ docker_user.id }}
      - PGID={{ docker_user.id }}
--- a/ansible/roles/pve_docker/files/wallabag/docker-compose.yml
+++ b/ansible/roles/pve_docker/files/wallabag/docker-compose.yml
@ -1,6 +1,6 @@
 services:
  wallabag:
-    image: wallabag/wallabag:2.6.10
+    image: wallabag/wallabag:2.6.9
    restart: unless-stopped
    environment:
      - SYMFONY__ENV__SECRET={{ wallabag_secret }}
--- a/ansible/roles/pve_docker/files/whoami/docker-compose.yml
+++ b/ansible/roles/pve_docker/files/whoami/docker-compose.yml
@ -4,7 +4,7 @@ services:
    restart: unless-stopped
    labels:
      - traefik.enable=true
-      - traefik.http.routers.whoami.rule=Host(`whoami.theorangeone.net`) || Host(`whoami-cdn.theorangeone.net`) || Host(`who.0rng.one`)
+      - traefik.http.routers.whoami.rule=Host(`whoami.theorangeone.net`) || Host(`whoami-cdn.theorangeone.net`)

      - traefik.http.routers.whoami-private.rule=Host(`whoami-private.theorangeone.net`)
      - traefik.http.routers.whoami-private.middlewares=tailscale-only@file
--- a/ansible/roles/pve_docker/tasks/calibre.yml
+++ b/ansible/roles/pve_docker/tasks/calibre.yml
@ -4,6 +4,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install calibre compose file
  template:
@ -13,6 +14,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  register: compose_file
+  become: true

 - name: restart calibre
  shell:
--- a/ansible/roles/pve_docker/tasks/librespeed.yml
+++ b/ansible/roles/pve_docker/tasks/librespeed.yml
@ -7,6 +7,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install librespeed compose file
  template:
@ -16,6 +17,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  register: compose_file
+  become: true

 - name: restart librespeed
  shell:
--- a/ansible/roles/pve_docker/tasks/nextcloud.yml
+++ b/ansible/roles/pve_docker/tasks/nextcloud.yml
@ -7,6 +7,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install nextcloud compose file
  template:
@ -16,6 +17,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  register: compose_file
+  become: true

 - name: Install nextcloud config
  template:
@ -24,6 +26,7 @@
    mode: "{{ docker_compose_file_mask }}"
    owner: "{{ docker_user.name }}"
  register: config_file
+  become: true

 - name: Install occ script
  template:
@ -31,6 +34,7 @@
    dest: /opt/nextcloud/occ
    mode: "0755"
    owner: "{{ docker_user.name }}"
+  become: true

 - name: restart nextcloud
  shell:
@ -43,3 +47,4 @@
    name: Set nextcloud data permissions
    special_time: daily
    job: chown -R {{ docker_user.name }}:{{ docker_user.name }} /mnt/tank/files/nextcloud
+  become: true
--- a/ansible/roles/pve_docker/tasks/quassel.yml
+++ b/ansible/roles/pve_docker/tasks/quassel.yml
@ -4,6 +4,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install quassel compose file
  template:
@ -13,6 +14,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  register: compose_file
+  become: true

 - name: restart quassel
  shell:
--- a/ansible/roles/pve_docker/tasks/synapse.yml
+++ b/ansible/roles/pve_docker/tasks/synapse.yml
@ -7,6 +7,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install synapse compose file
  template:
@ -16,6 +17,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  register: compose_file
+  become: true

 - name: Install synapse config
  template:
@ -24,6 +26,7 @@
    mode: "{{ docker_compose_file_mask }}"
    owner: "{{ docker_user.name }}"
  register: homeserver_config
+  become: true

 - name: restart synapse
  shell:
--- a/ansible/roles/pve_docker/tasks/tt-rss.yml
+++ b/ansible/roles/pve_docker/tasks/tt-rss.yml
@ -4,6 +4,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Create tt-rss plugins directory
  file:
@ -12,6 +13,7 @@
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
  register: plugins_dir
+  become: true

 - name: Install tt-rss compose file
  template:
@ -21,6 +23,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  register: compose_file
+  become: true

 - name: Install fever plugin
  git:
@ -38,6 +41,7 @@
    owner: "{{ docker_user.name }}"
    mode: u=rwX,g=rwX,o=rX
    recurse: true
+  become: true
  when: fever_plugin.changed

 - name: restart tt-rss
--- a/ansible/roles/pve_docker/tasks/wallabag.yml
+++ b/ansible/roles/pve_docker/tasks/wallabag.yml
@ -7,6 +7,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install wallabag compose file
  template:
@ -16,6 +17,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  register: compose_file
+  become: true

 - name: restart wallabag
  shell:
--- a/ansible/roles/pve_docker/tasks/whoami.yml
+++ b/ansible/roles/pve_docker/tasks/whoami.yml
@ -4,6 +4,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install whoami compose file
  template:
@ -13,6 +14,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  register: compose_file
+  become: true

 - name: restart whoami
  shell:
--- a/ansible/roles/pve_tailscale_route/tasks/main.yml
+++ b/ansible/roles/pve_tailscale_route/tasks/main.yml
@ -7,6 +7,7 @@
      - "{{ tailscale_cidr }}"
  register: routes
  changed_when: false
+  become: true

 - name: Add route to tailscale hosts via ingress
  command:
@ -17,4 +18,5 @@
      - "{{ tailscale_cidr }}"
      - via
      - "{{ pve_hosts.ingress.ip }}"
+  become: true
  when: tailscale_cidr not in routes.stdout
--- a/ansible/roles/qbittorrent/handlers/main.yml
+++ b/ansible/roles/qbittorrent/handlers/main.yml
@ -2,8 +2,10 @@
  service:
    name: nginx
    state: reloaded
+  become: true

 - name: restart qbittorrent
  service:
    name: qbittorrent-nox@{{ qbittorrent_user.name }}
    state: restarted
+  become: true
--- a/ansible/roles/qbittorrent/tasks/nginx.yml
+++ b/ansible/roles/qbittorrent/tasks/nginx.yml
@ -3,4 +3,5 @@
    src: files/nginx.conf
    dest: /etc/nginx/http.d/downloads.conf
    mode: "0644"
+  become: true
  notify: reload nginx
--- a/ansible/roles/qbittorrent/tasks/qbittorrent.yml
+++ b/ansible/roles/qbittorrent/tasks/qbittorrent.yml
@ -1,17 +1,20 @@
 - name: Install qbittorrent
  package:
    name: qbittorrent-nox
+  become: true

 - name: Create user
  user:
    name: qbittorrent
    system: true
+  become: true
  register: qbittorrent_user

 - name: Enable service
  service:
    name: qbittorrent-nox@{{ qbittorrent_user.name }}
    enabled: true
+  become: true

 - name: Set configuration
  ini_file:
@ -39,4 +42,5 @@
    - {section: Preferences, option: Bittorrent\MaxConnecsPerTorrent, value: -1"}
    - {section: Preferences, option: Bittorrent\MaxUploads, value: -1"}
    - {section: Preferences, option: Bittorrent\MaxUploadsPerTorrent, value: -1"}
+  become: true
  notify: restart qbittorrent
--- a/ansible/roles/renovate/files/docker-compose.yml
+++ b/ansible/roles/renovate/files/docker-compose.yml
@ -9,9 +9,6 @@ services:
      - DOCKER_HOST=tcp://docker_proxy:2375
      - LOG_LEVEL=debug  # Noisy, but required for debugging
    restart: unless-stopped
-    networks:
-      - default
-      - renovate_private
    depends_on:
      - redis
      - docker_proxy
@ -36,13 +33,5 @@ services:
      - IMAGES=1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
-    networks:
-      - renovate_private
-    tmpfs:
-      - /run
    logging:
      driver: none
-
-networks:
-  renovate_private:
-    internal: true
--- a/ansible/roles/renovate/tasks/main.yml
+++ b/ansible/roles/renovate/tasks/main.yml
@ -7,6 +7,7 @@
    state: directory
    owner: "{{ docker_user.name }}"
    mode: "{{ docker_compose_directory_mask }}"
+  become: true

 - name: Install compose file
  template:
@ -16,6 +17,7 @@
    owner: "{{ docker_user.name }}"
    validate: docker-compose -f %s config
  notify: restart renovate
+  become: true

 - name: Install config file
  template:
@ -24,6 +26,7 @@
    mode: "{{ docker_compose_file_mask }}"
    owner: "{{ docker_user.name }}"
  notify: restart renovate
+  become: true

 - name: Install custom entrypoint
  template:
@ -32,3 +35,4 @@
    mode: "0755"
    owner: "{{ docker_user.name }}"
  notify: restart renovate
+  become: true
--- a/ansible/roles/restic/defaults/main.yml
+++ b/ansible/roles/restic/defaults/main.yml
@ -1,3 +1,3 @@
 restic_backup_locations: []
 restic_backup_excludes: []
-restic_dir: "{{ hostname_slug }}"
+restic_forget: false
--- a/ansible/roles/restic/files/backrest.sh
+++ b/ansible/roles/restic/files/backrest.sh
@ -2,10 +2,10 @@

 set -e

-export AWS_ACCESS_KEY_ID="{{ vault_restic_b2_application_key_id }}"
-export AWS_SECRET_ACCESS_KEY="{{ vault_restic_b2_application_key }}"
-export RESTIC_PASSWORD="{{ vault_restic_key }}"
-export RESTIC_REPOSITORY="s3:{{ restic_b2_endpoint }}/{{ restic_b2_bucket }}/{{ restic_dir }}"
+export B2_ACCOUNT_ID="{{ restic_b2_account_id }}"
+export B2_ACCOUNT_KEY="{{ restic_b2_account_key }}"
+export RESTIC_PASSWORD="{{ restic_key }}"
+export RESTIC_REPOSITORY="b2:{{ restic_b2_bucket }}"
 export GOGC=20  # HACK: Work around for restic's high memory usage https://github.com/restic/restic/issues/1988

 set -x
--- a/ansible/roles/restic/files/restic-backup.sh
+++ b/ansible/roles/restic/files/restic-backup.sh
@ -3,5 +3,3 @@
 set -e

 exec $HOME/backrest.sh --verbose backup --files-from=$HOME/restic-include.txt --exclude-file=$HOME/restic-excludes.txt
-
-exec $HOME/backrest.sh forget --prune --keep-daily 30 --keep-monthly 3 --group-by host
--- a/ansible/roles/restic/files/restic-forget.sh
+++ b/ansible/roles/restic/files/restic-forget.sh
@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+set -e
+
+exec $HOME/backrest.sh forget --prune --keep-daily 30 --keep-monthly 3 --group-by host
--- a/ansible/roles/restic/tasks/homeassistant.yml
+++ b/ansible/roles/restic/tasks/homeassistant.yml
@ -1,18 +1,21 @@
 - name: Install CIFS utils
  package:
    name: cifs-utils
+  become: true

 - name: Create dir for CIFS mount
  file:
    path: /mnt/home-assistant
    state: directory
    mode: "0755"
+  become: true

 - name: Create dir for each CIFS mount
  file:
    path: /mnt/home-assistant/{{ item }}
    state: directory
    mode: "0600"
+  become: true
  loop: "{{ restic_homeassistant_mounts }}"

 - name: Create mounts
@ -22,4 +25,5 @@
    opts: username=homeassistant,password={{ vault_homeassistant_smb_password }}
    src: //{{ pve_hosts.homeassistant.ip }}/{{ item }}
    state: mounted
+  become: true
  loop: "{{ restic_homeassistant_mounts }}"
--- a/ansible/roles/restic/tasks/main.yml
+++ b/ansible/roles/restic/tasks/main.yml
@ -1,16 +1,19 @@
 - name: Install restic
  package:
    name: restic
+  become: true

 - name: Install runitor
  kewlfft.aur.aur:
    name: runitor-bin
+  become: true

 - name: Make user
  user:
    name: restic
    shell: /bin/nologin
    system: false
+  become: true

 - name: Install scripts
  template:
@ -21,6 +24,8 @@
  loop:
    - backrest.sh
    - restic-backup.sh
+    - restic-forget.sh
+  become: true

 - name: Install includes files
  copy:
@ -28,6 +33,7 @@
    dest: /home/restic/restic-include.txt
    mode: "0644"
    owner: restic
+  become: true

 - name: Install excludes files
  copy:
@ -35,6 +41,7 @@
    dest: /home/restic/restic-excludes.txt
    mode: "0644"
    owner: restic
+  become: true

 - name: Set restic binary permissions
  file:
@ -42,11 +49,13 @@
    mode: "0750"
    owner: root
    group: restic
+  become: true

 - name: Set cap_sys_chroot=+ep on restic
  community.general.capabilities:
    path: /usr/bin/restic
    capability: cap_dac_read_search=+ep
+  become: true

 - name: Schedule backup
  cron:
@ -55,12 +64,25 @@
    minute: 0
    job: CHECK_UUID={{ vault_restic_healthchecks_id }} /usr/bin/runitor -- /home/restic/restic-backup.sh
    user: restic
+  become: true
+
+- name: Schedule forget
+  cron:
+    name: restic forget
+    hour: 2
+    minute: 0
+    weekday: 0
+    job: CHECK_UUID={{ vault_restic_forget_healthchecks_id }} /usr/bin/runitor -- /home/restic/restic-forget.sh
+    user: restic
+  become: true
+  when: restic_forget

 - name: Install pacman post script
  template:
    src: files/restic-post.sh
    dest: /usr/share/libalpm/scripts/restic-post.sh
    mode: "0700"
+  become: true
  when: ansible_os_family == 'Archlinux'

 - name: Install pacman post hook
@ -68,6 +90,7 @@
    src: files/restic-post.hook
    dest: /usr/share/libalpm/hooks/restic-post.hook
    mode: "0600"
+  become: true
  when: ansible_os_family == 'Archlinux'

 - name: Install HomeAssistant mounts
--- a/ansible/roles/restic/vars/main.yml
+++ b/ansible/roles/restic/vars/main.yml
@ -1,5 +1,29 @@
+restic_b2_account_id: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  37653465353462333831333031373566343362316461643463303737356332363364666264666562
+  6436353430313239643831626537383664376264393430310a353434306465653934356164393265
+  65336534356636386634366533313039643438656439636434666464636338373130636661303536
+  6638356530373062640a376430663231396538386161353165363538346266663135363337303166
+  35613838363336393032643965373437663937626532356239336535663064363438
+restic_b2_account_key: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  31343939356266366364313631633836653364633331306134663163653939373663316632626161
+  3262376666323366313563313836643133393437663462320a653637633663636663353234323265
+  63633632383461616437636230643430613635626431383966326666383030393735623963333263
+  3433633830356530390a623436376364343630313066663965303238646564323266303865623965
+  66353963376434333030333332646464653637633737633832663762303339666336
+restic_key: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  65326130653631643138373231336439303962356666353737373832633666373965666466613034
+  3730333664373334316436396435356137313337633836330a653366343732656539663439313838
+  34326361353232663533663366393464643761343864623965386633313438303738343238623430
+  6661313730646166330a393336333635623832653232653863626135343164363831366134316465
+  30306238613865393664383865323233626636333063393936613864303365386431613838366363
+  39633865393761366134633933333237313362636234323330313135336637613235303764383938
+  34383938396366363937643864393838363638383066646663393363393562653431653764356537
+  61303164333662353732656265386430383566343462633435626334373331316663363563616662
+  66643135336539333738623231346331623464636637373639666435663961383936
 restic_b2_bucket: 0rng-restic
-restic_b2_endpoint: s3.eu-central-003.backblazeb2.com
 healthchecks_host: https://hc-ping.com

 restic_homeassistant_mounts:
--- a/Show more
+++ b/Show more
Author	SHA1	Message	Date
Jake Howard	3bf44d1d5b	Update DNS records All checks were successful / terraform (push) Successful in 38s Details / ansible (push) Successful in 1m36s Details	2024-11-25 20:02:36 +00:00
Jake Howard	43ad69e118	Ensure CNAME values are absolute All checks were successful / terraform (push) Successful in 38s Details / ansible (push) Successful in 1m30s Details	2024-09-22 15:27:05 +01:00
Jake Howard	d554dabdc5	Use personal access token for traefik All checks were successful / terraform (push) Successful in 57s Details / ansible (push) Successful in 1m30s Details	2024-09-15 14:21:20 +01:00
Jake Howard	acfd2af7eb	Use Gandi as cert provider for traefik All checks were successful / terraform (push) Successful in 37s Details / ansible (push) Successful in 1m28s Details	2024-09-14 22:06:42 +01:00
Jake Howard	f1ba63818b	Migrate jakehoward.tech to Gandi All checks were successful / terraform (push) Successful in 40s Details / ansible (push) Successful in 1m28s Details	2024-09-14 22:00:24 +01:00
Jake Howard	07c53709c9	Migrate theorangeone.net to Gandi All checks were successful / terraform (push) Successful in 38s Details / ansible (push) Successful in 1m29s Details	2024-09-14 21:24:12 +01:00
Jake Howard	b125d8422b	Add Fastmail records for jakehoward.tech All checks were successful / terraform (push) Successful in 36s Details / ansible (push) Successful in 1m29s Details	2024-09-05 21:23:53 +01:00
Jake Howard	5d06ed1e5e	Add livedns resources All checks were successful / terraform (push) Successful in 36s Details / ansible (push) Successful in 1m22s Details	2024-09-01 22:27:24 +01:00