247 lines
6.9 KiB
YAML
Executable File
247 lines
6.9 KiB
YAML
Executable File
---
|
|
- hosts: internal-apps
|
|
become: true
|
|
vars_files:
|
|
- ./vars.yml
|
|
tasks:
|
|
- name: Update Packages
|
|
ansible.builtin.dnf:
|
|
update_cache: yes
|
|
|
|
- name: Install Packages
|
|
ansible.builtin.dnf:
|
|
name:
|
|
- vim
|
|
- podman
|
|
- fail2ban
|
|
- python3-libdnf5
|
|
state: present
|
|
|
|
- name: Create directories
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: '0755'
|
|
loop: "{{ directories }}"
|
|
|
|
- name: Create Jellyfin directories
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: '0777'
|
|
loop: "{{ directories_jellyfin }}"
|
|
|
|
- name: Create internal podman network
|
|
containers.podman.podman_network:
|
|
name: npm_internal
|
|
ip_range: 10.10.0.128/25
|
|
subnet: 10.10.0.0/24
|
|
gateway: 10.10.0.1
|
|
state: present
|
|
|
|
- name: Ensure WireGuard kernel module is loaded
|
|
ansible.builtin.modprobe:
|
|
name: wireguard
|
|
state: present
|
|
|
|
- name: Persist WireGuard kernel module across reboots
|
|
ansible.builtin.copy:
|
|
dest: /etc/modules-load.d/wg-easy.conf
|
|
content: |
|
|
wireguard
|
|
mode: '0644'
|
|
|
|
- name: Enable IP forwarding on host
|
|
ansible.posix.sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: '1'
|
|
sysctl_set: true
|
|
state: present
|
|
reload: true
|
|
|
|
- name: Enable source valid mark on host
|
|
ansible.posix.sysctl:
|
|
name: net.ipv4.conf.all.src_valid_mark
|
|
value: '1'
|
|
sysctl_set: true
|
|
state: present
|
|
reload: true
|
|
|
|
- name: pull images
|
|
containers.podman.podman_image:
|
|
name: "{{ item }}"
|
|
loop: "{{ images }}"
|
|
|
|
- name: Deploy Nginx Proxy Manager
|
|
containers.podman.podman_container:
|
|
image: "docker.io/jc21/nginx-proxy-manager:latest"
|
|
name: npm
|
|
restart_policy: always
|
|
recreate: true
|
|
state: started
|
|
ports:
|
|
- "80:80"
|
|
- "81:81"
|
|
- "443:443"
|
|
volumes:
|
|
- "/opt/apps/npm:/data:z"
|
|
- "/opt/apps/letsencrypt:/etc/letsencrypt:z"
|
|
network:
|
|
- npm_internal
|
|
ip: '10.10.0.19'
|
|
|
|
|
|
- name: Deploy Gitea
|
|
containers.podman.podman_container:
|
|
image: docker.gitea.com/gitea:nightly
|
|
name: gitea
|
|
env:
|
|
USER_UID: 1000
|
|
USER_GID: 1000
|
|
restart_policy: always
|
|
recreate: true
|
|
state: started
|
|
volumes:
|
|
- /opt/apps/gitea:/data:z
|
|
- /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
network:
|
|
- npm_internal
|
|
ip: '10.10.0.25'
|
|
ports:
|
|
# - "3000:3000"
|
|
- "222:22"
|
|
|
|
- name: Deploy Jellyfin
|
|
containers.podman.podman_container:
|
|
image: lscr.io/linuxserver/jellyfin:latest
|
|
name: jellyfin
|
|
env:
|
|
USER_UID: 1000
|
|
USER_GID: 1000
|
|
JELLYFIN_PublishedServerUrl: http://jellyfin.boxswapper.io
|
|
restart_policy: always
|
|
recreate: true
|
|
state: started
|
|
volumes:
|
|
- /opt/apps/jellyfin/config:/config:z
|
|
- /opt/apps/jellyfin/tvseries:/data/tvshows:z
|
|
- /opt/apps/jellyfin/movies:/data/movies:z
|
|
- /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
network:
|
|
- npm_internal
|
|
ip: '10.10.0.30'
|
|
# ports:
|
|
# - 8096:8096
|
|
# - 8920:8920 #optional
|
|
# - 7359:7359/udp #optional
|
|
# - 1900:1900/udp #optional
|
|
|
|
# WireGuard Easy VPN — deployed on npm_internal behind NPM
|
|
# After first deploy, you MUST add NAT hooks in the wg-easy UI:
|
|
# 1. Open http://10.10.0.36:51821 in a browser
|
|
# 2. Log in with the username/password from vars.yml
|
|
# 3. Go to the "Hooks" tab
|
|
# 4. PostUp — paste this EXACTLY:
|
|
# nft add table inet wg_table; nft add chain inet wg_table prerouting { type nat hook prerouting priority 100 \; }; nft add chain inet wg_table postrouting { type nat hook postrouting priority 100 \; }; nft add rule inet wg_table postrouting ip saddr {{ipv4Cidr}} oifname {{device}} masquerade; nft add rule inet wg_table postrouting ip6 saddr {{ipv6Cidr}} oifname {{device}} masquerade; nft add chain inet wg_table input { type filter hook input priority 0 \; policy accept \; }; nft add rule inet wg_table input udp dport {{port}} accept; nft add rule inet wg_table input tcp dport {{uiPort}} accept; nft add chain inet wg_table forward { type filter hook forward priority 0 \; policy accept \; }; nft add rule inet wg_table forward iifname "wg0" accept; nft add rule inet wg_table forward oifname "wg0" accept;
|
|
# 5. PostDown — paste this EXACTLY:
|
|
# nft delete table inet wg_table
|
|
# 6. Click Save and restart the container
|
|
# These hooks enable VPN clients to reach your app containers (10.10.0.0/24)
|
|
- name: Deploy WireGuard Easy (wg-easy)
|
|
containers.podman.podman_container:
|
|
name: wg-easy
|
|
image: "{{ wireguard_image }}"
|
|
restart_policy: always
|
|
recreate: true
|
|
state: started
|
|
env:
|
|
INIT_ENABLED: "true"
|
|
INIT_USERNAME: "{{ wireguard_ui_username }}"
|
|
INIT_PASSWORD: "{{ wireguard_ui_password }}"
|
|
INIT_HOST: "{{ wireguard_host }}"
|
|
INIT_PORT: "{{ wireguard_port }}"
|
|
INIT_DNS: "{{ wireguard_default_dns }}"
|
|
INIT_IPV4_CIDR: "{{ wireguard_cidr }}"
|
|
INIT_IPV6_CIDR: "{{ wireguard_ipv6_cidr }}"
|
|
INIT_ALLOWED_IPS: "{{ wireguard_allowed_ips }}"
|
|
PORT: "{{ wireguard_ui_port }}"
|
|
INSECURE: "true"
|
|
DISABLE_VERSION_CHECK: "true"
|
|
ports:
|
|
- "{{ wireguard_port }}:{{ wireguard_port }}/udp"
|
|
- "{{ wireguard_ui_port }}:{{ wireguard_ui_port }}/tcp"
|
|
volumes:
|
|
- "/opt/apps/wireguard:/etc/wireguard:z"
|
|
- "/lib/modules:/lib/modules:ro"
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- SYS_MODULE
|
|
- NET_RAW
|
|
sysctl:
|
|
net.ipv4.ip_forward: "1"
|
|
net.ipv4.conf.all.src_valid_mark: "1"
|
|
network:
|
|
- npm_internal
|
|
ip: '{{ wireguard_ip }}'
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#----N8N deployment, no GPU avail for deployment ------#
|
|
|
|
# - name: Deploy n8n
|
|
# containers.podman.podman_container:
|
|
# image: docker.n8n.io/n8nio/n8n
|
|
# name: n8n
|
|
# env:
|
|
# N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: true
|
|
# N8N_RUNNERS_ENABLED: true
|
|
# restart_policy: always
|
|
# recreate: true
|
|
# state: started
|
|
# volumes:
|
|
# - /opt/apps/n8n/data:/home/node/.n8n:z
|
|
# - /opt/apps/n8n/files:/files:z
|
|
# - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
|
|
# - /etc/localtime:/etc/localtime:ro
|
|
|
|
# network:
|
|
# - npm_internal
|
|
# ip: '10.10.0.35'
|
|
# # ports:
|
|
# # - 5678:5678
|
|
|
|
|