287 lines
9.6 KiB
YAML
287 lines
9.6 KiB
YAML
---
|
||
- name: Deploy Element + Matrix + Matrix_admin + TURN + NGINX-PM + Teamspeak
|
||
hosts: all
|
||
become: true
|
||
collections:
|
||
- containers.podman
|
||
|
||
vars_files:
|
||
- ../vars/vars.yml # ← our variable file
|
||
|
||
tasks:
|
||
|
||
# -----------------------------------------------------------------
|
||
# Install podman, create network, create volumes …
|
||
# -----------------------------------------------------------------
|
||
- name: Install podman package
|
||
ansible.builtin.package:
|
||
name: podman
|
||
state: present
|
||
|
||
- name: Create podman network "{{ podman_network }}"
|
||
containers.podman.podman_network:
|
||
name: "{{ podman_network }}"
|
||
driver: bridge
|
||
subnet: "10.36.0.0/16"
|
||
state: present
|
||
|
||
- name: Ensure required podman volumes exist
|
||
containers.podman.podman_volume:
|
||
name: "{{ item }}"
|
||
driver: local
|
||
state: present
|
||
loop:
|
||
- "{{ vol_synapse }}"
|
||
- "{{ vol_media }}"
|
||
- "{{ vol_turn }}"
|
||
- "{{ vol_nginx }}"
|
||
- "{{ vol_teamspeak }}"
|
||
- "{{ vol_db }}"
|
||
- "{{ npm_data }}"
|
||
- "{{ npm_letsencrypt }}"
|
||
- "{{ keycloak_data }}"
|
||
- "{{ vol_kc_db }}"
|
||
|
||
# -----------------------------------------------------------------
|
||
# Pull required images
|
||
# -----------------------------------------------------------------
|
||
|
||
- name: Pull coturn image
|
||
containers.podman.podman_image:
|
||
name: "{{ turn_image }}"
|
||
state: present
|
||
|
||
- name: Pull Synapse image
|
||
containers.podman.podman_image:
|
||
name: "{{ synapse_image }}"
|
||
state: present
|
||
|
||
- name: Pull NGINX image
|
||
containers.podman.podman_image:
|
||
name: "{{ nginx_image }}"
|
||
state: present
|
||
|
||
- name: Pull Teamspeak image
|
||
containers.podman.podman_image:
|
||
name: "{{ teamspeak_image }}"
|
||
state: present
|
||
|
||
- name: Pull Nginx Proxy Manager image
|
||
containers.podman.podman_image:
|
||
name: "{{ npm_image }}"
|
||
state: present
|
||
|
||
- name: Pull Postgres DB image
|
||
containers.podman.podman_image:
|
||
name: "{{ db_image }}"
|
||
state: present
|
||
|
||
- name: Pull Keycloak Image
|
||
containers.podman.podman_image:
|
||
name: "{{ keycloak_image }}"
|
||
state: present
|
||
|
||
# -----------------------------------------------------------------
|
||
# Render all configuration files from the templates
|
||
# -----------------------------------------------------------------
|
||
|
||
- name: Render coturn config
|
||
ansible.builtin.template:
|
||
src: turnserver.conf.j2
|
||
dest: "{{ turn_conf_path }}"
|
||
mode: "0644"
|
||
|
||
- name: Render Synapse homeserver.yaml
|
||
ansible.builtin.template:
|
||
src: homeserver.yaml.j2
|
||
dest: "{{ synapse_cfg_path }}"
|
||
mode: "0644"
|
||
|
||
- name: Render landing page index.html
|
||
ansible.builtin.template:
|
||
src: landing.html.j2
|
||
dest: "{{ nginx_html_path }}"
|
||
mode: "0644"
|
||
|
||
- name: Render Synapse Secret key
|
||
ansible.builtin.template:
|
||
src: matrix.fpov.space.signing.key
|
||
dest: "{{ synapse_secret_key_path }}"
|
||
mode: "0644"
|
||
|
||
- name: Render Synapse log config file
|
||
ansible.builtin.template:
|
||
src: matrix.fpov.space.log.config.j2
|
||
dest: "{{ synapse_log_config }}"
|
||
mode: "0644"
|
||
|
||
- name: Render Element config file
|
||
ansible.builtin.template:
|
||
src: config.json.j2
|
||
dest: "{{ element_config_path }}"
|
||
mode: "0644"
|
||
|
||
# -----------------------------------------------------------------
|
||
# Start the NGINX Proxy Manager Container
|
||
# -----------------------------------------------------------------
|
||
|
||
- name: Start Nginx Proxy manager
|
||
containers.podman.podman_container:
|
||
name: npm
|
||
image: "{{ npm_image }}"
|
||
state: started
|
||
ports:
|
||
- "80:80"
|
||
- "443:443"
|
||
- "81:81"
|
||
volumes:
|
||
- "{{ npm_data }}:/data"
|
||
- "{{ npm_letsencrypt }}:/etc/letsencrypt"
|
||
network: "{{ podman_network }}"
|
||
|
||
# -----------------------------------------------------------------
|
||
# Start the Coturn container
|
||
# -----------------------------------------------------------------
|
||
|
||
- name: Start coturn container
|
||
containers.podman.podman_container:
|
||
name: turn
|
||
image: "{{ turn_image }}"
|
||
state: started
|
||
ports:
|
||
- "{{ turn_listen_port }}:{{ turn_listen_port }}/udp"
|
||
- "{{ turn_listen_port }}:{{ turn_listen_port }}/tcp"
|
||
- "{{ turn_tls_port }}:{{ turn_tls_port }}/udp"
|
||
- "{{ turn_tls_port }}:{{ turn_tls_port }}/tcp"
|
||
volumes:
|
||
- "{{ vol_turn }}:/var/lib/turn"
|
||
- "{{ turn_conf_path }}:/etc/turnserver.conf:ro"
|
||
command: "-c /etc/turnserver.conf"
|
||
network: "{{ podman_network }}"
|
||
restart_policy: always
|
||
|
||
|
||
# -----------------------------------------------------------------
|
||
# Start the Matrix-Synaps and supporting DB containers
|
||
# -----------------------------------------------------------------
|
||
|
||
- name: start Matrix Database container
|
||
containers.podman.podman_container:
|
||
name: synapse-db
|
||
image: "{{ db_image }}"
|
||
state: started
|
||
env:
|
||
POSTGRES_USER: "{{ postgres_user }}"
|
||
POSTGRES_PASSWORD: "{{ postgres_pw }}"
|
||
POSTGRES_DB: "{{ postgres_db }}"
|
||
volumes:
|
||
- "{{ vol_db }}:/var/lib/postgresql/data"
|
||
network: "{{ podman_network }}"
|
||
restart_policy: always
|
||
|
||
- name: Start Synapse container
|
||
containers.podman.podman_container:
|
||
name: "{{ matrix_container_name }}"
|
||
image: "{{ synapse_image }}"
|
||
state: started
|
||
ports:
|
||
- "{{ synapse_http_port }}:{{ synapse_http_port }}"
|
||
volumes:
|
||
- "{{ vol_synapse }}:/data"
|
||
- "{{ vol_media }}:/data/media_store:Z"
|
||
- "{{ synapse_cfg_path }}:/data/homeserver.yaml:Z"
|
||
- "{{ synapse_secret_key_path }}:/data/matrix.fpov.space.signing.key:Z"
|
||
- "{{ synapse_log_config }}:/data/matrix.fpov.space.log.config:Z"
|
||
network: "{{ podman_network }}"
|
||
restart_policy: always
|
||
|
||
# -----------------------------------------------------------------
|
||
# Start the Teamspeak Container
|
||
# -----------------------------------------------------------------
|
||
|
||
- name: Start Teamspeak container
|
||
containers.podman.podman_container:
|
||
name: "{{ teamspeak_container_name }}"
|
||
image: "{{ teamspeak_image }}"
|
||
env:
|
||
TS3SERVER_LICENSE: accept
|
||
state: started
|
||
ports:
|
||
# UDP voice port – exposed directly on the host (no Traefik)
|
||
- "{{ teamspeak_udp_port }}:{{ teamspeak_udp_port }}/udp"
|
||
# TCP query port – Traefik will forward it (see static config)
|
||
- "{{ teamspeak_tcp_port }}:{{ teamspeak_tcp_port }}/tcp"
|
||
# Optional file‑transfer port (exposed directly)
|
||
- "{{ teamspeak_file_port }}:{{ teamspeak_file_port }}/tcp"
|
||
volumes:
|
||
- "{{ vol_teamspeak }}:/var/ts3server"
|
||
network: "{{ podman_network }}"
|
||
restart_policy: always
|
||
|
||
# -----------------------------------------------------------------
|
||
# Matrix Admin Panel
|
||
# -----------------------------------------------------------------
|
||
|
||
- name: Start Matrix Admin panel
|
||
containers.podman.podman_container:
|
||
name: "{{ admin_container_name }}"
|
||
image: "{{ synapse_admin_image }}"
|
||
state: started
|
||
network: "{{ podman_network }}"
|
||
restart_policy: always
|
||
|
||
# -----------------------------------------------------------------
|
||
# Element Web app
|
||
#------------------------------------------------------------------
|
||
- name: start Element Web Application
|
||
containers.podman.podman_container:
|
||
name: "{{ element_container_name }}"
|
||
image: "{{ element_image }}"
|
||
env:
|
||
ELEMENT_WEB_PORT=8008
|
||
state: started
|
||
volumes:
|
||
- "{{ element_config_path }}:/app/config.json:Z"
|
||
network: "{{ podman_network }}"
|
||
restart_policy: always
|
||
|
||
# -----------------------------------------------------------------
|
||
# Start Keyclaok and supporting DB containers
|
||
# -----------------------------------------------------------------
|
||
|
||
- name: start Keyclaok Database container
|
||
containers.podman.podman_container:
|
||
name: keycloak-db
|
||
image: "{{ db_image }}"
|
||
state: started
|
||
env:
|
||
POSTGRES_USER: "{{ keycloak_postgres_user }}"
|
||
POSTGRES_PASSWORD: "{{ keycloak_postgres_pw }}"
|
||
POSTGRES_DB: "{{ keycloak_db }}"
|
||
volumes:
|
||
- "{{ vol_kc_db }}:/var/lib/postgresql/data"
|
||
network: "{{ podman_network }}"
|
||
restart_policy: always
|
||
|
||
- name: Start Keycloak authentication container
|
||
containers.podman.podman_container:
|
||
name: "{{ keycloak_container_name }}"
|
||
image: "{{ keycloak_image }}"
|
||
command: ["start-dev"]
|
||
env:
|
||
KC_DB: postgres
|
||
KC_DB_URL: jdbc:postgresql://keycloak-db/{{ keycloak_db }}
|
||
KC_DB_USERNAME: "{{ keycloak_postgres_user }}"
|
||
KC_DB_PASSWORD: "{{ keycloak_postgres_pw }}"
|
||
KC_HOSTNAME: "{{ keycloak_domain }}"
|
||
KC_HOSTNAME_PORT: "{{ kc_hn_port }}"
|
||
KEYCLOAK_ADMIN: "{{ keycloak_admin }}"
|
||
KC_BOOTSTRAP_ADMIN_PASSWORD: "{{ keycloak_pw }}"
|
||
KC_PROXY_HEADERS: xforwarded
|
||
KC_HTTP_ENABLED: "true"
|
||
KC_HOSTNAME_STRICT: "{{ 'false' }}"
|
||
volumes:
|
||
- "{{ keycloak_data }}:/opt/keycloak/data:Z"
|
||
network: "{{ podman_network }}"
|
||
restart_policy: always
|