yerbamate-ml/playbooks/gitea.yml

99 lines
4 KiB
YAML

---
- hosts: all
# Install python if required
# https://www.josharcher.uk/code/ansible-python-connection-failure-ubuntu-server-1604/
gather_facts: False
pre_tasks:
- name: install python for Ansible
raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal python-setuptools)
args:
executable: /bin/bash
register: output
changed_when: output.stdout != ""
- setup: # gather facts
tasks:
- name: create app folder
file: path={{item.path}} state=directory owner={{item.owner}} group={{item.owner}}
with_items:
- { path: '/gitea/', owner: 'root' }
- { path: '/gitea/volumes/', owner: 'root' }
- { path: '/gitea/volumes/gitea/', owner: 'root' }
- { path: '/gitea/volumes/redis/', owner: 'root' }
- { path: '/gitea/volumes/weblate/', owner: '1000' }
- { path: '/gitea/volumes/grafana/', owner: '472' }
- { path: '/gitea/volumes/postgres/', owner: '70' }
- { path: '/gitea/volumes/influxdb/', owner: 'root' }
- name: add all templates
template: src={{item.src}} dest={{item.dest}} mode={{item.mode}}
with_items:
- { src: '../templates/gitea.conf', dest: '/etc/nginx/sites-enabled/gitea.conf', mode: '0600' }
- { src: '../templates/weblate.conf', dest: '/etc/nginx/sites-enabled/weblate.conf', mode: '0600' }
- { src: '../templates/grafana.conf', dest: '/etc/nginx/sites-enabled/grafana.conf', mode: '0600' }
- { src: '../templates/env', dest: '/gitea/.env', mode: '0600' }
- name: copy all files
copy: src={{item.src}} dest={{item.dest}} mode={{item.mode}}
with_items:
- { src: '../files/docker-compose.yml', dest: '/gitea/docker-compose.yml', mode: '0755' }
- { src: '../files/influxdb.conf', dest: '/gitea/influxdb.conf', mode: '0755' }
- name: install dependencies
apt:
pkg: ['docker-compose', 'docker.io', 'certbot', 'nginx', 'python-certbot-nginx', 'python-passlib']
- name: enable and start docker service
systemd:
name: docker
enabled: yes
state: started
- name: start docker-compose
docker_compose:
project_src: /gitea/
state: present
pull: yes
- name: Create htpasswd file for influxdb reporting endpoint
community.general.htpasswd:
path: /gitea/influxdb_htpasswd
name: telegraf
password: '{{ influxdb_auth_password }}'
owner: root
group: www-data
mode: 0640
- name: request letsencrypt certificates
shell: |
certbot certonly --nginx --agree-tos -d '{{ domain }}' -m '{{ letsencrypt_contact_email }}' -n
certbot certonly --nginx --agree-tos -d 'weblate.{{ domain }}' -m '{{ letsencrypt_contact_email }}' -n
certbot certonly --nginx --agree-tos -d 'grafana.{{ domain }}' -m '{{ letsencrypt_contact_email }}' -n
# keep old domain working for a while
certbot certonly --nginx --agree-tos -d 'yerbamate.dev' -m '{{ letsencrypt_contact_email }}' -n
certbot certonly --nginx --agree-tos -d 'weblate.yerbamate.dev' -m '{{ letsencrypt_contact_email }}' -n
certbot certonly --nginx --agree-tos -d 'grafana.yerbamate.dev' -m '{{ letsencrypt_contact_email }}' -n
- name: reload nginx config and certs
shell: nginx -s reload
- name: renew gitea certificates
cron:
special_time=daily
name=certbot-renew-gitea
user=root
job="certbot certonly --nginx -d {{ domain }} -n --deploy-hook 'nginx -s reload'"
- name: renew weblate certificates
cron:
special_time=daily
name=certbot-renew-weblate
user=root
job="certbot certonly --nginx -d weblate.{{ domain }} -n --deploy-hook 'nginx -s reload'"
- name: renew grafana certificates
cron:
special_time=daily
name=certbot-renew-grafana
user=root
job="certbot certonly --nginx -d grafana.{{ domain }} -n --deploy-hook 'nginx -s reload'"