yerbamate-ml/gitea.yml

---
- hosts: all
  become: yes

  # Install python if required
  # https://www.josharcher.uk/code/ansible-python-connection-failure-ubuntu-server-1604/
  gather_facts: False
  pre_tasks:
    - name: install python for Ansible
      raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal python-setuptools)
      args:
        executable: /bin/bash
      register: output
      changed_when: output.stdout != ""
    - setup: # gather facts

  tasks:
    - name: create app folder
      file: path={{item.path}} state=directory owner={{item.owner}} group={{item.owner}}
      with_items:
        - { path: '/gitea/', owner: 'root' }
        - { path: '/gitea/volumes/', owner: 'root' }
        - { path: '/gitea/volumes/gitea/', owner: 'root' }
        - { path: '/gitea/volumes/redis/', owner: 'root' }
        - { path: '/gitea/volumes/weblate/', owner: '1000' }
        - { path: '/gitea/volumes/grafana/', owner: '472' }
        - { path: '/gitea/volumes/postgres/', owner: '70' }
        - { path: '/gitea/volumes/influxdb/', owner: 'root' }

    - name: add all templates
      template: src={{item.src}} dest={{item.dest}} mode={{item.mode}}
      with_items:
        - { src: 'templates/gitea.conf', dest: '/etc/nginx/sites-enabled/gitea.conf', mode: '0600' }
        - { src: 'templates/weblate.conf', dest: '/etc/nginx/sites-enabled/weblate.conf', mode: '0600' }
        - { src: 'templates/grafana.conf', dest: '/etc/nginx/sites-enabled/grafana.conf', mode: '0600' }
        - { src: 'templates/env', dest: '/gitea/.env', mode: '0600' }
      vars:
        weblate_admin_password: "{{ lookup('password', 'passwords/{{ inventory_hostname }}/weblate_admin_password chars=ascii_letters,digits') }}"
        weblate_postgres_password: "{{ lookup('password', 'passwords/{{ inventory_hostname }}/weblate_postgres_password chars=ascii_letters,digits') }}"
        influxdb_password: "{{ lookup('password', 'passwords/{{ inventory_hostname }}/influxdb_password chars=ascii_letters,digits') }}"

    - name: copy all files
      copy: src={{item.src}} dest={{item.dest}} mode={{item.mode}}
      with_items:
        - { src: 'files/docker-compose.yml', dest: '/gitea/docker-compose.yml', mode: '0755' }
        - { src: 'files/influxdb.conf', dest: '/gitea/influxdb.conf', mode: '0755' }

    - name: install dependencies
      apt:
        pkg: ['docker-compose', 'docker.io', 'certbot', 'nginx', 'python-certbot-nginx']

    - name: enable and start docker service
      systemd:
        name: docker
        enabled: yes
        state: started

    - name: start docker-compose
      docker_compose:
        project_src: /gitea/
        state: present
        stopped: yes
        services: nginx

    - name: request letsencrypt certificates
      shell: |
        certbot certonly --nginx --agree-tos -d '{{ domain }}' -m '{{ letsencrypt_contact_email }}' -n
        certbot certonly --nginx --agree-tos -d 'weblate.{{ domain }}' -m '{{ letsencrypt_contact_email }}' -n
        certbot certonly --nginx --agree-tos -d 'grafana.{{ domain }}' -m '{{ letsencrypt_contact_email }}' -n

    - name: start docker-compose
      docker_compose:
        project_src: /gitea/
        state: present
        pull: yes

    - name: reload nginx config and certs
      shell: nginx -s reload

    - name: renew gitea certificates
      cron:
        special_time=daily
        name=certbot-renew-gitea
        user=root
        job="certbot certonly --nginx -d {{ domain }} -n --deploy-hook 'nginx -s reload'"

    - name: renew weblate certificates
      cron:
        special_time=daily
        name=certbot-renew-weblate
        user=root
        job="certbot certonly --nginx -d weblate.{{ domain }} -n --deploy-hook 'nginx -s reload'"