diff --git a/README.md b/README.md index 7d18fbb..7f4b332 100644 --- a/README.md +++ b/README.md @@ -16,3 +16,8 @@ ansible-playbook deploy_matrix.yml -i inventory/hosts.yml ``` +## Clean up everything ## +you will lose all persistence as well +``` +ansible-playbook prune.yml -i inventory/hosts.yml +``` diff --git a/deploy_matrix.yml b/deploy_matrix.yml index 8f7fa5c..838023e 100644 --- a/deploy_matrix.yml +++ b/deploy_matrix.yml @@ -31,20 +31,17 @@ driver: local state: present loop: - - "{{ vol_traefik }}" - "{{ vol_synapse }}" - "{{ vol_media }}" - "{{ vol_turn }}" - "{{ vol_nginx }}" - - "{{ vol_teamspeak }}" + - "{{ vol_teamspeak }}" + - "{{ npm_data }}" + - "{{ npm_letsencrypt }}" # ----------------------------------------------------------------- # Pull required images (including Teamspeak) # ----------------------------------------------------------------- - - name: Pull Traefik image - containers.podman.podman_image: - name: "{{ traefik_image }}" - state: present - name: Pull coturn image containers.podman.podman_image: @@ -65,22 +62,16 @@ containers.podman.podman_image: name: "{{ teamspeak_image }}" state: present + + - name: Pull Nginx Proxy Manager image + containers.podman.podman_image: + name: "{{ npm_image }}" + state: present # ----------------------------------------------------------------- # Render all configuration files from the templates # ----------------------------------------------------------------- - - name: Render static Traefik config - ansible.builtin.template: - src: traefik_static.toml.j2 - dest: "{{ static_traefik_path }}" - mode: "0644" - - - name: Render dynamic Traefik config - ansible.builtin.template: - src: traefik_dynamic.yml.j2 - dest: "{{ dynamic_traefik_path }}" - mode: "0644" - name: Render coturn config ansible.builtin.template: @@ -112,90 +103,94 @@ dest: "{{ synapse_log_config }}" + # ----------------------------------------------------------------- - # Start the NGINX container (unchanged – just mounts the file we created) + # Start the NGINX Proxy Manager Container # ----------------------------------------------------------------- - - name: Start NGINX landing-page container + + - name: Start Nginx Proxy manager containers.podman.podman_container: - name: landing - image: "{{ nginx_image }}" + name: npm + image: "{{ npm_image }}" state: started ports: - - "8080:80" + - "80:80" + - "443:443" + - "81:81" volumes: - - "{{ vol_nginx }}:/usr/share/nginx/html:ro" - - "{{ nginx_html_path }}:/usr/share/nginx/html/index.html:ro" + - "{{ npm_data }}:/data" + - "{{ npm_letsencrypt }}:/etc/letsencrypt" network: "{{ podman_network }}" - restart_policy: always + + # ----------------------------------------------------------------- + # Start the NGINX container + # ----------------------------------------------------------------- + # - name: Start NGINX landing-page container + # containers.podman.podman_container: + # name: landing + # image: "{{ nginx_image }}" + # state: started + # ports: + # - "8080:80" + # volumes: + # - "{{ vol_nginx }}:/usr/share/nginx/html:ro" + # - "{{ nginx_html_path }}:/usr/share/nginx/html/index.html:ro" + # network: "{{ podman_network }}" + # restart_policy: always # ----------------------------------------------------------------- # Start containers (Traefik, TURN, Synapse, NGINX – unchanged) # ----------------------------------------------------------------- - - name: Start Traefik container - containers.podman.podman_container: - name: traefik - image: "{{ traefik_image }}" - state: started - ports: - - "{{ traefik_http_port }}:{{ traefik_http_port }}" - - "{{ traefik_https_port }}:{{ traefik_https_port }}" -# - "{{ teamspeak_tcp_port }}:{{ teamspeak_tcp_port }}" # expose TCP entrypoint on host - volumes: - - "{{ vol_traefik }}:/etc/traefik" - - "{{ static_traefik_path }}:{{ static_traefik_path }}:ro" - - "{{ dynamic_traefik_path }}:{{ dynamic_traefik_path }}:ro" - network: "{{ podman_network }}" - restart_policy: always - - name: Start coturn container - containers.podman.podman_container: - name: turn - image: "{{ turn_image }}" - state: started - ports: - - "{{ turn_listen_port }}:{{ turn_listen_port }}/udp" - - "{{ turn_listen_port }}:{{ turn_listen_port }}/tcp" - - "{{ turn_tls_port }}:{{ turn_tls_port }}/udp" - - "{{ turn_tls_port }}:{{ turn_tls_port }}/tcp" - volumes: - - "{{ vol_turn }}:/var/lib/turn" - - "{{ turn_conf_path }}:/etc/turnserver.conf:ro" - command: "-c /etc/turnserver.conf" - network: "{{ podman_network }}" - restart_policy: always + # - name: Start coturn container + # containers.podman.podman_container: + # name: turn + # image: "{{ turn_image }}" + # state: started + # ports: + # - "{{ turn_listen_port }}:{{ turn_listen_port }}/udp" + # - "{{ turn_listen_port }}:{{ turn_listen_port }}/tcp" + # - "{{ turn_tls_port }}:{{ turn_tls_port }}/udp" + # - "{{ turn_tls_port }}:{{ turn_tls_port }}/tcp" + # volumes: + # - "{{ vol_turn }}:/var/lib/turn" + # - "{{ turn_conf_path }}:/etc/turnserver.conf:ro" + # command: "-c /etc/turnserver.conf" + # network: "{{ podman_network }}" + # restart_policy: always - - name: Start Synapse container - containers.podman.podman_container: - name: synapse - image: "{{ synapse_image }}" - state: started - env: - SYNAPSE_SERVER_NAME: "{{ matrix_domain }}" - SYNAPSE_REPORT_STATS: "yes" - ports: - - "{{ synapse_http_port }}:{{ synapse_http_port }}" - volumes: - - "{{ vol_synapse }}:/data" - - "{{ vol_media }}:/data/media_store" - - "{{ synapse_cfg_path }}:/data/homeserver.yaml:Z" - - "{{ synapse_secret_key_path }}:/data/my.matrix.host.signing.key:Z" - - "{{ synapse_log_config }}:/data/matrix.fpov.space.log.config:Z" - network: "{{ podman_network }}" - restart_policy: always + # - name: Start Synapse container + # containers.podman.podman_container: + # name: synapse + # image: "{{ synapse_image }}" + # state: started + # env: + # SYNAPSE_SERVER_NAME: "{{ matrix_domain }}" + # SYNAPSE_REPORT_STATS: "yes" + # ports: + # - "{{ synapse_http_port }}:{{ synapse_http_port }}" + # volumes: + # - "{{ vol_synapse }}:/data" + # - "{{ vol_media }}:/data/media_store" + # - "{{ synapse_cfg_path }}:/data/homeserver.yaml:Z" + # - "{{ synapse_secret_key_path }}:/data/my.matrix.host.signing.key:Z" + # - "{{ synapse_log_config }}:/data/matrix.fpov.space.log.config:Z" + # network: "{{ podman_network }}" + # restart_policy: always - - name: Start NGINX landing-page container - containers.podman.podman_container: - name: landing - image: "{{ nginx_image }}" - state: started - ports: - - "8080:80" - volumes: - - "{{ vol_nginx }}:/usr/share/nginx/html:ro" - - "{{ nginx_html_path }}:/usr/share/nginx/html/index.html:ro" - network: "{{ podman_network }}" - restart_policy: always + # - name: Start NGINX landing-page container + # containers.podman.podman_container: + # name: landing + # image: "{{ nginx_image }}" + # state: started + # ports: + # - "8080:80" + # volumes: + # - "{{ vol_nginx }}:/usr/share/nginx/html:ro" + # - "{{ nginx_html_path }}:/usr/share/nginx/html/index.html:ro" + # network: "{{ podman_network }}" + # restart_policy: always # ----------------------------------------------------------------- # Start Teamspeak container @@ -205,7 +200,7 @@ name: "{{ teamspeak_container_name }}" image: "{{ teamspeak_image }}" env: - TSSERVER_LICENSE_ACCEPTED: 1 + TS3SERVER_LICENSE: accept state: started ports: # UDP voice port – exposed directly on the host (no Traefik) diff --git a/prune.yml b/prune.yml new file mode 100644 index 0000000..d59597e --- /dev/null +++ b/prune.yml @@ -0,0 +1,14 @@ +--- +- name: prune all Podman resources + hosts: all + become: true + collections: + - containers.podman + + tasks: + - name: Prune all Podman resources + containers.podman.podman_prune: + system: true + system_all: true + system_volumes: true + \ No newline at end of file diff --git a/templates/traefik_dynamic.yml.j2 b/templates/traefik_dynamic.yml.j2 deleted file mode 100644 index bb1681e..0000000 --- a/templates/traefik_dynamic.yml.j2 +++ /dev/null @@ -1,40 +0,0 @@ -http: - routers: - synapse: - entryPoints: - - websecure - rule: "Host(`{{ matrix_domain }}`)" - service: synapse - tls: - certResolver: myresolver - landing: - entryPoints: - - websecure - rule: "Host(`{{ landing_domain }}`)" - service: landing - tls: - certResolver: myresolver - - services: - synapse: - loadBalancer: - servers: - - url: "http://{{ podman_network }}:{{ synapse_http_port }}/" - landing: - loadBalancer: - servers: - - url: "http://{{ podman_network }}:8080/" - -# ---------- TCP router for Teamspeak query ---------- -tcp: - routers: - teamspeak: - entryPoints: - - teamspeak - rule: "HostSNI(`{{ teamspeak_domain }}`)" # optional – works like Host for TCP - service: teamspeak - services: - teamspeak: - loadBalancer: - servers: - - address: "{{ podman_network }}:{{ teamspeak_tcp_port }}" \ No newline at end of file diff --git a/templates/traefik_static.toml.j2 b/templates/traefik_static.toml.j2 deleted file mode 100644 index 35ab112..0000000 --- a/templates/traefik_static.toml.j2 +++ /dev/null @@ -1,23 +0,0 @@ -[log] - level = "INFO" - -[accessLog] - -[entryPoints] - [entryPoints.web] - address = ":{{ traefik_http_port }}" - [entryPoints.websecure] - address = ":{{ traefik_https_port }}" - - # ---------- TCP entrypoint for Teamspeak query ---------- - [entryPoints.teamspeak] - address = ":{{ teamspeak_tcp_port }}" - -[providers] - [providers.file] - filename = "{{ dynamic_traefik_path }}" - watch = true - -[certificatesResolvers.myresolver.acme] - email = "{{ matrix_email }}" - storage = "/etc/traefik/acme.json" \ No newline at end of file diff --git a/vars/vars.yml b/vars/vars.yml index 8315ad1..dc384f2 100644 --- a/vars/vars.yml +++ b/vars/vars.yml @@ -46,6 +46,7 @@ traefik_image: "docker.io/traefik:v3.6.11" turn_image: "docker.io/coturn/coturn:4.9.0" synapse_image: "docker.io/matrixdotorg/synapse:latest" nginx_image: "docker.io/nginx:alpine" +npm_image: "docker.io/jc21/nginx-proxy-manager:latest" # -------------------------------------------------------------- # Podman names & volumes @@ -56,7 +57,9 @@ vol_synapse: synapse_config vol_media: synapse_media vol_turn: turn_data vol_nginx: nginx_html -vol_teamspeak: teamspeak_data +vol_teamspeak: teamspeak_data +npm_data: npm_data +npm_letsencrypt: letsencrypt # -------------------------------------------------------------- # Paths on the target host (temporary files)