260 lines
8.8 KiB
YAML
260 lines
8.8 KiB
YAML
---
|
||
- name: Deploy Matrix + TURN + Traefik + NGINX + Teamspeak
|
||
hosts: all
|
||
become: true
|
||
collections:
|
||
- containers.podman
|
||
|
||
vars_files:
|
||
- ../vars/vars.yml # ← our variable file
|
||
|
||
tasks:
|
||
|
||
# -----------------------------------------------------------------
|
||
# Install podman, create network, create volumes …
|
||
# -----------------------------------------------------------------
|
||
- name: Install podman package
|
||
ansible.builtin.package:
|
||
name: podman
|
||
state: present
|
||
|
||
- name: Create podman network "{{ podman_network }}"
|
||
containers.podman.podman_network:
|
||
name: "{{ podman_network }}"
|
||
driver: bridge
|
||
subnet: "10.36.0.0/16"
|
||
state: present
|
||
|
||
- name: Ensure required podman volumes exist
|
||
containers.podman.podman_volume:
|
||
name: "{{ item }}"
|
||
driver: local
|
||
state: present
|
||
loop:
|
||
- "{{ vol_traefik }}"
|
||
- "{{ vol_synapse }}"
|
||
- "{{ vol_media }}"
|
||
- "{{ vol_turn }}"
|
||
- "{{ vol_nginx }}"
|
||
- "{{ vol_teamspeak }}"
|
||
|
||
# -----------------------------------------------------------------
|
||
# Pull required images (including Teamspeak)
|
||
# -----------------------------------------------------------------
|
||
- name: Pull Traefik image
|
||
containers.podman.podman_image:
|
||
name: "{{ traefik_image }}"
|
||
state: present
|
||
|
||
- name: Pull coturn image
|
||
containers.podman.podman_image:
|
||
name: "{{ turn_image }}"
|
||
state: present
|
||
|
||
- name: Pull Synapse image
|
||
containers.podman.podman_image:
|
||
name: "{{ synapse_image }}"
|
||
state: present
|
||
|
||
- name: Pull NGINX image
|
||
containers.podman.podman_image:
|
||
name: "{{ nginx_image }}"
|
||
state: present
|
||
|
||
- name: Pull Teamspeak image
|
||
containers.podman.podman_image:
|
||
name: "{{ teamspeak_image }}"
|
||
state: present
|
||
|
||
|
||
# -----------------------------------------------------------------
|
||
# Render all configuration files from the templates
|
||
# -----------------------------------------------------------------
|
||
- name: Render static Traefik config
|
||
ansible.builtin.template:
|
||
src: traefik_static.toml.j2
|
||
dest: "{{ static_traefik_path }}"
|
||
mode: "0644"
|
||
|
||
- name: Render dynamic Traefik config
|
||
ansible.builtin.template:
|
||
src: traefik_dynamic.yml.j2
|
||
dest: "{{ dynamic_traefik_path }}"
|
||
mode: "0644"
|
||
|
||
- name: Render coturn config
|
||
ansible.builtin.template:
|
||
src: turnserver.conf.j2
|
||
dest: "{{ turn_conf_path }}"
|
||
mode: "0644"
|
||
|
||
- name: Render Synapse homeserver.yaml
|
||
ansible.builtin.template:
|
||
src: homeserver.yaml.j2
|
||
dest: "{{ synapse_cfg_path }}"
|
||
mode: "0644"
|
||
|
||
- name: Render landing page index.html
|
||
ansible.builtin.template:
|
||
src: landing.html.j2
|
||
dest: "{{ nginx_html_path }}"
|
||
mode: "0644"
|
||
|
||
- name: Render Synapse Secret key
|
||
ansible.builtin.template:
|
||
src: matrix.fpov.space.signing.key
|
||
dest: "{{ synapse_secret_key_path }}"
|
||
mode: "0600"
|
||
|
||
- name: Render Synapse log config file
|
||
ansible.builtin.template:
|
||
src: matrix.fpov.space.log.config.j2
|
||
dest: "{{ synapse_log_config }}"
|
||
|
||
|
||
# -----------------------------------------------------------------
|
||
# Start the NGINX container (unchanged – just mounts the file we created)
|
||
# -----------------------------------------------------------------
|
||
- name: Start NGINX landing-page container
|
||
containers.podman.podman_container:
|
||
name: landing
|
||
image: "{{ nginx_image }}"
|
||
state: started
|
||
ports:
|
||
- "8080:80"
|
||
volumes:
|
||
- "{{ vol_nginx }}:/usr/share/nginx/html:ro"
|
||
- "{{ nginx_html_path }}:/usr/share/nginx/html/index.html:ro"
|
||
network: "{{ podman_network }}"
|
||
restart_policy: always
|
||
|
||
|
||
# -----------------------------------------------------------------
|
||
# Start containers (Traefik, TURN, Synapse, NGINX – unchanged)
|
||
# -----------------------------------------------------------------
|
||
- name: Start Traefik container
|
||
containers.podman.podman_container:
|
||
name: traefik
|
||
image: "{{ traefik_image }}"
|
||
state: started
|
||
ports:
|
||
- "{{ traefik_http_port }}:{{ traefik_http_port }}"
|
||
- "{{ traefik_https_port }}:{{ traefik_https_port }}"
|
||
# - "{{ teamspeak_tcp_port }}:{{ teamspeak_tcp_port }}" # expose TCP entrypoint on host
|
||
volumes:
|
||
- "{{ vol_traefik }}:/etc/traefik"
|
||
- "{{ static_traefik_path }}:{{ static_traefik_path }}:ro"
|
||
- "{{ dynamic_traefik_path }}:{{ dynamic_traefik_path }}:ro"
|
||
network: "{{ podman_network }}"
|
||
restart_policy: always
|
||
|
||
- name: Start coturn container
|
||
containers.podman.podman_container:
|
||
name: turn
|
||
image: "{{ turn_image }}"
|
||
state: started
|
||
ports:
|
||
- "{{ turn_listen_port }}:{{ turn_listen_port }}/udp"
|
||
- "{{ turn_listen_port }}:{{ turn_listen_port }}/tcp"
|
||
- "{{ turn_tls_port }}:{{ turn_tls_port }}/udp"
|
||
- "{{ turn_tls_port }}:{{ turn_tls_port }}/tcp"
|
||
volumes:
|
||
- "{{ vol_turn }}:/var/lib/turn"
|
||
- "{{ turn_conf_path }}:/etc/turnserver.conf:ro"
|
||
command: "-c /etc/turnserver.conf"
|
||
network: "{{ podman_network }}"
|
||
restart_policy: always
|
||
|
||
- name: Start Synapse container
|
||
containers.podman.podman_container:
|
||
name: synapse
|
||
image: "{{ synapse_image }}"
|
||
state: started
|
||
env:
|
||
SYNAPSE_SERVER_NAME: "{{ matrix_domain }}"
|
||
SYNAPSE_REPORT_STATS: "yes"
|
||
ports:
|
||
- "{{ synapse_http_port }}:{{ synapse_http_port }}"
|
||
volumes:
|
||
- "{{ vol_synapse }}:/data"
|
||
- "{{ vol_media }}:/data/media_store"
|
||
- "{{ synapse_cfg_path }}:/data/homeserver.yaml:Z"
|
||
- "{{ synapse_secret_key_path }}:/data/my.matrix.host.signing.key:Z"
|
||
- "{{ synapse_log_config }}:/data/matrix.fpov.space.log.config:Z"
|
||
network: "{{ podman_network }}"
|
||
restart_policy: always
|
||
|
||
- name: Start NGINX landing-page container
|
||
containers.podman.podman_container:
|
||
name: landing
|
||
image: "{{ nginx_image }}"
|
||
state: started
|
||
ports:
|
||
- "8080:80"
|
||
volumes:
|
||
- "{{ vol_nginx }}:/usr/share/nginx/html:ro"
|
||
- "{{ nginx_html_path }}:/usr/share/nginx/html/index.html:ro"
|
||
network: "{{ podman_network }}"
|
||
restart_policy: always
|
||
|
||
# -----------------------------------------------------------------
|
||
# Start Teamspeak container
|
||
# -----------------------------------------------------------------
|
||
- name: Start Teamspeak container
|
||
containers.podman.podman_container:
|
||
name: "{{ teamspeak_container_name }}"
|
||
image: "{{ teamspeak_image }}"
|
||
env:
|
||
TSSERVER_LICENSE_ACCEPTED: 1
|
||
state: started
|
||
ports:
|
||
# UDP voice port – exposed directly on the host (no Traefik)
|
||
- "{{ teamspeak_udp_port }}:{{ teamspeak_udp_port }}/udp"
|
||
# TCP query port – Traefik will forward it (see static config)
|
||
- "{{ teamspeak_tcp_port }}:{{ teamspeak_tcp_port }}/tcp"
|
||
# Optional file‑transfer port (exposed directly)
|
||
- "{{ teamspeak_file_port }}:{{ teamspeak_file_port }}/tcp"
|
||
volumes:
|
||
- "{{ vol_teamspeak }}:/var/ts3server"
|
||
network: "{{ podman_network }}"
|
||
restart_policy: always
|
||
|
||
# # -----------------------------------------------------------------
|
||
# # generate systemd units for containers
|
||
# # -----------------------------------------------------------------
|
||
# - name: Generate systemd unit for Teamspeak
|
||
# containers.podman.podman_generate_systemd:
|
||
# name: "{{ teamspeak_container_name }}"
|
||
# state: present
|
||
# dest: "/etc/systemd/system/{{ teamspeak_container_name }}.service"
|
||
|
||
# - name: Generate systemd unit for Traefik
|
||
# containers.podman.podman_generate_systemd:
|
||
# name: traefik
|
||
# state: present
|
||
# dest: "/etc/systemd/system/traefik.service"
|
||
|
||
# - name: Generate systemd unit for TURN
|
||
# containers.podman.podman_generate_systemd:
|
||
# name: turn
|
||
# state: present
|
||
# dest: "/etc/systemd/system/turn.service"
|
||
|
||
# - name: Generate systemd unit for Synapse
|
||
# containers.podman.podman_generate_systemd:
|
||
# name: synapse
|
||
# state: present
|
||
# dest: "/etc/systemd/system/synapse.service"
|
||
|
||
# - name: Generate systemd unit for landing page
|
||
# containers.podman.podman_generate_systemd:
|
||
# name: landing
|
||
# state: present
|
||
# dest: "/etc/systemd/system/landing.service"
|
||
|
||
# - name: Reload systemd daemon (if units were created)
|
||
# ansible.builtin.systemd:
|
||
# daemon_reload: yes
|
||
|
||
|