DevOps/ansible-role-eom
1
0
Fork 0
Code Issues 19 Pull Requests Actions Packages Projects Releases Wiki Activity

Many changes

Browse Source
This commit is contained in:
Eric Meehan 2025-06-26 12:56:15 -04:00
parent 44bc9e4f25
commit 3ae97ac4e1
13 changed files with 4371 additions and 289 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

191
tasks/cloud.yaml
View File

@ -1,191 +0,0 @@
---
# tasks file for nextcloud
- name: Create NextCloud namespace
k8s:
state: present
definition:
apiVersion: v1
kind: Namespace
metadata:
name: cloud
- name: Create PVC for MySQL
k8s:
state: present
definition:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mysql
namespace: cloud
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 64Gi
- name: Create Deployment for MySQL
k8s:
state: present
definition:
apiVersion: v1
kind: Deployment
metadata:
name: mysql
namespace: cloud
labels:
app: mysql
spec:
replicas: 1
selector:
matchLabels:
app: mysql
template:
metadata:
labels:
app: mysql
spec:
containers:
- name: mysql
image: mysql
volumeMounts:
- name: data
mountPath: /var/lib/mysql
ports:
- containerPort: 3306
env:
- name: MYSQL_ROOT_PASSWORD
value: "{{ mysql_root_password }}"
- name: MYSQL_DATABASE
value: nextcloud
- name: MYSQL_USER
value: nextcloud
- name: MYSQL_PASSWORD
value: "{{ nextcloud_mysql_password }}"
volumes:
- name: data
persistentVolumeClaim:
claimName: mysql
- name: Create Service for MySQL
k8s:
state: present
definition:
apiVersion: v1
kind: Service
metadata:
name: mysql
namespace: cloud
spec:
selector:
app: mysql
ports:
- port: 3306
name: mysql
type: ClusterIP
- name: Create PVC for NextCloud
k8s:
state: present
definition:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nextcloud
namespace: cloud
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 128Gi
- name: Create Deployment for NextCloud
k8s:
state: present
definition:
apiVersion: v1
kind: Deployment
metadata:
name: nextcloud
namespace: cloud
labels:
app: nextcloud
spec:
replicas: 1
selector:
matchLabels:
app: nextcloud
template:
metadata:
labels:
app: nextcloud
spec:
containers:
- name: nextcloud
image: nextcloud
volumeMounts:
- name: data
mountPath: /var/www/html
ports:
- containerPort: 3000
env:
- name: MYSQL_HOST
value: mysql
- name: MYSQL_DATABASE
value: nextcloud
- name: MYSQL_USER
value: nextcloud
- name: MYSQL_PASSWORD
value: "{{ nextcloud_mysql_password }}"
volumes:
- name: data
persistentVolumeClaim:
claimName: nextcloud
- name: Create Service for NextCloud
k8s:
state: present
definition:
apiVersion: v1
kind: Service
metadata:
name: nextcloud
namespace: cloud
spec:
selector:
app: nextcloud
ports:
- port: 80
name: http
type: ClusterIP
- name: Create Ingress
k8s:
state: present
definition:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
cert-manager.io/cluster-issuer: ca-issuer
name: nextcloud
namespace: cloud
spec:
ingressClassName: nginx
rules:
- host: cloud.eom.dev
http:
paths:
- pathType: Prefix
path: /
backend:
service:
name: nextcloud
port:
number: 80
tls:
- hosts:
- cloud.eom.dev
secretName: nextcloud

93
tasks/dex.yaml Normal file
View File

@ -0,0 +1,93 @@
---
# tasks file for dex
- name: Add Dex repo
kubernetes.core.helm_repository:
name: dex
repo_url: https://charts.dexidp.io
register: repo
- name: Update Helm repos
command: helm repo update
when: repo.changed
- name: Deploy PostgreSQL
kubernetes.core.helm:
name: postgresql
chart_ref: bitnami/postgresql
release_namespace: dex
create_namespace: true
values:
auth:
enablePostgresUser: true
postgresPassword: "{{ postgresql_admin_password }}"
username: "dex"
password: "{{ dex_admin_password }}"
database: "dex"
primary:
name: primary
initdb:
scripts: {}
persistence:
enabled: true
volumeName: "data"
size: 256Gi
- name: Deploy Dex
kubernetes.core.helm:
name: dex
chart_ref: dex/dex
release_namespace: dex
create_namespace: true
values:
config:
issuer: https://dex.eom.dev/
storage:
type: postgres
config:
host: postgresql
port: 5432
databbase: dex
user: dex
password: "{{ dex_admin_password }}"
ssl:
mode: disable
connectors:
- type: ldap
id: ldap
name: LDAP
config:
host: openldap.openldap.svc.cluster.local
insecureNoSSL: true
bindDN: cn=readonly,dc=example,dc=com
bindPW: "{{ openldap_readonly_password }}"
userSearch:
baseDN: dc=example,dc=com
filter: "(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))"
username: uid
idAttr: uid
emailAttr: mail
nameAttr: givenName
preferredUsernameAttr: uid
groupSearch:
baseDN: dc=eom,dc=dev
filter: "(objectClass=groupOfUniqueNames)"
userMatchers:
- userAttr: cn
groupAttr: uniqueMember
nameAttr: cn
ingress:
enabled: true
annotations:
cert-manager.io/cluster-issuer: ca-issuer
hosts:
- host: dex.eom.dev
paths:
- path: /
tls:
- hosts:
- dex.eom.dev
secretName: dex

2
tasks/grafana-matrix-forwarder.yaml
View File

@ -29,7 +29,7 @@
- name: GMF_MATRIX_PASSWORD
value: "{{ grafana_admin_password }}"
- name: GMF_MATRIX_HOMESERVER
value: synapse.eom.dev
value: eom.dev
- name: GMF_RESOLVE_MODE
value: reply

131
tasks/lemmy.yaml Normal file
View File

@ -0,0 +1,131 @@
---
# tasks file for lemmy
- name: Create lemmy namespace
k8s:
state: present
definition:
apiVersion: v1
kind: Namespace
metadata:
name: lemmy
- name: Create a persistent volume claim for lemmy
k8s:
state: present
definition:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: config
namespace: lemmy
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Ti
- name: Create a persistent volume claim for lemmy
k8s:
state: present
definition:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: lemmy
namespace: lemmy
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Ti
- name: Create a deployment for lemmy
k8s:
definition:
apiVersion: v1
kind: Deployment
metadata:
name: lemmy
namespace: lemmy
spec:
replicas: 1
selector:
matchLabels:
app: lemmy
template:
metadata:
labels:
app: lemmy
spec:
containers:
- name: lemmy
image: dessalines/lemmy:0.19.11
volumeMounts:
- name: config
mountPath: /tmp/docker-lemmyserver
- name: ssl
mountPath: /etc/letsencrypt
- name: lemmy
mountPath: /var/lemmy
ports:
- containerPort: 25
env:
- name: OVERRIDE_HOSTNAME
value: "postfix.eom.dev"
volumes:
- name: lemmy
persistentVolumeClaim:
claimName: lemmy
- name: Create a deployment for lemmy-ui
k8s:
definition:
apiVersion: v1
kind: Deployment
metadata:
name: lemmy-ui
namespace: lemmy
spec:
replicas: 1
selector:
matchLabels:
app: lemmy-ui
template:
metadata:
labels:
app: lemmy-ui
spec:
containers:
- name: lemmy-ui
image: dessalines/lemmy-ui:0.19.11
volumeMounts:
- name: lemmy
mountPath: /var/lemmy
ports:
- containerPort: 25
env:
- name: OVERRIDE_HOSTNAME
value: "postfix.eom.dev"
volumes:
- name: lemmy
persistentVolumeClaim:
claimName: lemmy
- name: Expose deployment as a service
k8s:
definition:
apiVersion: v1
kind: Service
metadata:
name: lemmy
namespace: lemmy
spec:
selector:
app: lemmy
ports:
- port: 25
name: smtp-a
type: LoadBalancer
externalTrafficPolicy: Local

2
tasks/main.yaml
View File

@ -3,4 +3,4 @@
- name: Deploy
include_tasks: "{{ item }}"
loop:
- mail.yaml
- lemmy.yaml

18
tasks/mastodon.yaml
View File

@ -40,6 +40,15 @@
LDAP_UID: uid
LDAP_SEARCH_FILTER: (&(objectClass=posixAccount)(|(%{uid}=%{email})(%{mail}=%{email}))(memberOf=cn=Mastodon Users,ou=Mastodon,ou=Services,dc=eom,dc=dev))
LDAP_MAIL: mail
OIDC_ENABLED: "true"
OIDC_DISPLAY_NAME: Google
OIDC_ISSUER: https://accounts.google.com
OIDC_DISCOVERY: "true"
OIDC_SCOPE: openid,profile,email
OIDC_UID_FIELD:
OIDC_CLIENT_ID: "{{ mastodon_google_oidc_client_id }}"
OIDC_CLIENT_SECRET: "{{ mastodon_google_oidc_client_secret }}"
OIDC_REDIRECT_URI: https://mastodon.eom.dev/auth/auth/openid_connect/callback
localDomain: mastodon.eom.dev
smtp:
server: postfix.eom.dev
@ -54,7 +63,7 @@
password: "{{ mastodon_admin_password }}"
persistence:
enabled: true
size: 64Gi
size: 2Ti
redis:
enabled: true
auth:
@ -70,7 +79,7 @@
enabled: true
size: 2Ti
elasticsearch:
enabled: true
enabled: false
master:
persistence:
size: 64Gi
@ -79,11 +88,6 @@
size: 512Gi
minio:
enabled: false
externalS3:
host: minio.eom.dev
accessKeyId: mastodon
accessKeySecret: "{{ mastodon_admin_password }}"
bucket: mastodon
apache:
service:
type: ClusterIP

141
tasks/matrix-auth-service.yaml Normal file
View File

@ -0,0 +1,141 @@
---
# tasks file for synapse
- name: Add Small Hack repo
kubernetes.core.helm_repository:
name: small-hack-matrix-auth-service
repo_url: https://small-hack.github.io/matrix-authentication-service-chart
register: repo
- name: Update Helm repos
command: helm repo update
when: repo.changed
- name: Deploy Matrix Auth Service
kubernetes.core.helm:
name: matrix-auth-service
chart_ref: small-hack-matrix-auth-service/matrix-authentication-service
release_namespace: matrix-auth-service
create_namespace: true
values:
fullnameOverride: mas
image:
pullPolicy: IfNotPresent
tag: latest
http:
public_base: https://matrix-auth-service.eom.dev/
ingress:
className: nginx
annotations:
cert-manager.io/cluster-issuer: ca-issuer
hosts:
- host: matrix-auth-service.eom.dev
paths:
- path: /
pathType: Prefix
tls:
- secretName: mas-tls
hosts:
- matrix-auth-service.eom.dev
postgresql:
enabled: true
global:
auth:
password: "{{ matrix_auth_service_admin_password }}"
mas:
http:
public_base: https://matrix-auth-service.eom.dev/
policy:
client_registration:
allow_host_mismatch: false
allow_insecure_uris: false
clients:
- client_id: 0000000000000000000SYNAPSE
client_auth_method: client_secret_basic
client_secret: 5ZrwKXmKdiQfus2J
matrix:
homeserver: synapse.eom.dev
endpoint: https://synapse.eom.dev
secret: SacP5rWpci6GMqb2
email:
from: Matrix Auth Service <matrix-auth-service@eom.dev>
reply_to: Matrix Auth Service <matrix-auth-service@eom.dev>
transport: smtp
mode: tls
hostname: postfix.eom.dev
port: 587
username: matrix-auth-service
password: "{{ matrix_auth_service_admin_password }}"
upstream_oauth2:
providers:
- id: 01JG22H4F0G8PYCZ5HVTQVHBC4
issuer: https://google.com/
human_name: Google
brand_name: google
pkce_method: auto
client_id: "{{ matrix_google_oidc_client_id }}"
client_secret: "{{ matrix_google_oidc_client_secret }}"
token_endpoint_auth_method: client_secret_basic
scope: "openid email profile"
discovery_mode: oidc
claims_imports:
subject:
template: "{{ '{{ user.sub }}' | quote }}"
# -- The localpart is the local part of the user's Matrix ID.
# For example, on the `example.com` server, if the localpart is `alice`,
# the user's Matrix ID will be `@alice:example.com`.
localpart:
action: require
template: "{{ '{{ user.preferred_username }}' | quote }}"
# -- The display name is the user's display name.
displayname:
action: suggest
template: "{{ '{{ user.name }}' | quote }}"
# -- An email address to import.
email:
action: suggest
template: "{{ '{{ user.email }}' | quote }}"
# -- Whether the email address must be marked as verified.
# Possible values are:
# - `import`: mark the email address as verified if the upstream provider
# has marked it as verified, using the `email_verified` claim.
# This is the default.
# - `always`: mark the email address as verified
# - `never`: mark the email address as not verified
set_email_verification: import
# - id: 01JG2B7DBS6RQRH1TFVZ4BP7H8
# issuer: https://github.com/
# client_id: "{{ matrix_github_oidc_client_id }}"
# client_secret: "{{ matrix_github_oidc_client_secret }}"
# token_endpoint_auth_method: client_secret_basic
# discovery_mode: oidc
# claims_imports:
# subject:
# template: "{{ '{{ user.sub }}' | quote }}"
#
# # -- The localpart is the local part of the user's Matrix ID.
# # For example, on the `example.com` server, if the localpart is `alice`,
# # the user's Matrix ID will be `@alice:example.com`.
# localpart:
# action: require
# template: "{{ '{{ user.preferred_username }}' | quote }}"
#
# # -- The display name is the user's display name.
# displayname:
# action: suggest
# template: "{{ '{{ user.name }}' | quote }}"
#
# # -- An email address to import.
# email:
# action: suggest
# template: "{{ '{{ user.email }}' | quote }}"
# # -- Whether the email address must be marked as verified.
# # Possible values are:
# # - `import`: mark the email address as verified if the upstream provider
# # has marked it as verified, using the `email_verified` claim.
# # This is the default.
# # - `always`: mark the email address as verified
# # - `never`: mark the email address as not verified
# set_email_verification: import

3748
tasks/matrix-new.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

11
tasks/matrix.yaml
View File

@ -103,12 +103,12 @@
# msc3861:
# enabled: true
# # Synapse will call `{issuer}/.well-known/openid-configuration` to get the OIDC configuration
# issuer: http://localhost:8080/
# issuer: https://matrix-auth-service.eom.dev/
# client_id: 0000000000000000000SYNAPSE
# client_auth_method: client_secret_basic
# client_secret: 5ZrwKXmKdiQfus2J
# admin_token: SacP5rWpci6GMqb2
# account_management_url: "https://matrix-auth-service.eom.dev/"
# account_management_url: "https://matrix-auth-service.eom.dev/account"
volumes:
media:
capacity: 2Ti
@ -271,23 +271,22 @@
- host: matrix-auth-service.eom.dev
paths:
- path: /
pathType: ImplementationSpecific
pathType: Prefix
tls:
- secretName: mas-tls
hosts:
- matrix-auth-service.eom.dev
postgresql:
enabled: false
enabled: true
global:
auth:
password: "{{ matrix_auth_service_admin_password }}"
mas:
enabled: false
http:
public_base: https://matrix-auth-service.eom.dev/
policy:
client_registration:
allow_host_mismatch: true
allow_host_mismatch: false
allow_insecure_uris: false
clients:
- client_id: 0000000000000000000SYNAPSE

16
tasks/misskey.yaml Normal file
View File

@ -0,0 +1,16 @@
---
# tasks file for misskey
- name: Deploy Misskey
kubernetes.core.helm:
name: misskey
chart_ref: oci://tccr.io/truecharts/misskey
release_namespace: misskey
create_namespace: true
values:
service:
main:
ports:
main:
port: 3003
misskey:
url: "https://misskey.eom.dev/"

223
tasks/pleroma.yaml Normal file
View File

@ -0,0 +1,223 @@
---
# tasks file for pleroma
- name: Create NextCloud namespace
k8s:
state: present
definition:
apiVersion: v1
kind: Namespace
metadata:
name: pleroma
- name: Create PVC for PostgreSQL
k8s:
state: present
definition:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: postgresql
namespace: pleroma
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Ti
- name: Create Deployment for PostgreSQL
k8s:
state: present
definition:
apiVersion: v1
kind: Deployment
metadata:
name: postgresql
namespace: pleroma
labels:
app: postgresql
spec:
replicas: 1
selector:
matchLabels:
app: postgresql
template:
metadata:
labels:
app: postgresql
spec:
containers:
- name: postgresql
image: postgresql
volumeMounts:
- name: data
mountPath: /var/lib/postgresql/data
ports:
- containerPort: 5432
env:
- name: MYSQL_ROOT_PASSWORD
value: "{{ mysql_root_password }}"
- name: MYSQL_DATABASE
value: nextcloud
- name: MYSQL_USER
value: nextcloud
- name: MYSQL_PASSWORD
value: "{{ nextcloud_mysql_password }}"
volumes:
- name: data
persistentVolumeClaim:
claimName: postgresql
- name: Create Service for PostgreSQL
k8s:
state: present
definition:
apiVersion: v1
kind: Service
metadata:
name: postgresql
namespace: cloud
spec:
selector:
app: postgresql
ports:
- port: 3306
name: mysql
type: ClusterIP
- name: Create PVC for Pleroma
k8s:
state: present
definition:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pleroma
namespace: pleroma
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 128Gi
- name: Create Deployment for Pleroma
k8s:
state: present
definition:
apiVersion: v1
kind: Deployment
metadata:
name: pleroma
namespace: pleroma
labels:
app: pleroma
spec:
replicas: 1
selector:
matchLabels:
app: pleroma
template:
metadata:
labels:
app: pleroma
spec:
containers:
- name: pleroma
image: pleroma
volumeMounts:
- name: data
mountPath: /data/uploads
ports:
- containerPort: 4000
env:
- name: POSTGRES_PASSWORD
value: "{{ pleroma_admin_password }}"
- name: POSTGRES_USER
value: pleroma
- name: POSTGRES_DB
value: pleroma
- name: ADMIN_EMAIL
value: pleroma@eom.dev
- name: ADMIN_PASSWORD
value: "{{ pleroma_admin_password }}"
- name: DB_HOST
value: postgresql
- name: DB_PORT
value: 5432
- name: DB_USER
value: pleroma
- name: DB_PASS
value: "{{ pleroma_admin_password }}"
- name: DB_NAME
value: pleroma
- name: INSTANCE_NAME
value: Pleroma
- name: DOMAIN
value: pleroma.eom.dev
- name: LDAP_ENABLED
value: true
- name: LDAP_HOST
value: openldap.openldap.svc.cluster.local
- name: LDAP_PORT
value: 389
- name: LDAP_SSL
value: false
- name: LDAP_TLS
value: false
- name: LDAP_BASE
value: dc=eom,dc=dev
- name: LDAP_UID
value: uid
- name: LDAP_MAIL
value: mail
volumes:
- name: data
persistentVolumeClaim:
claimName: pleroma
- name: Create Service for Pleroma
k8s:
state: present
definition:
apiVersion: v1
kind: Service
metadata:
name: pleroma
namespace: pleroma
spec:
selector:
app: pleroma
ports:
- port: 80
name: http
type: ClusterIP
- name: Create Ingress
k8s:
state: present
definition:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
cert-manager.io/cluster-issuer: ca-issuer
name: pleroma
namespace: pleroma
spec:
ingressClassName: nginx
rules:
- host: pleroma.eom.dev
http:
paths:
- pathType: Prefix
path: /
backend:
service:
name: pleroma
port:
number: 4000
tls:
- hosts:
- pleroma.eom.dev
secretName: pleroma

2
tasks/prometheus.yaml
View File

@ -13,11 +13,11 @@
extraScrapeConfigs:
- job_name: apps
static_configs:
- targets:
- targets:
- discourse.eom.dev
labels:
instance: discourse
- targets:
- gitea.eom.dev
labels:
instance: gitea

82
tasks/sogo.yaml
View File

@ -1,82 +0,0 @@
---
# tasks file for SOGo
- name: Create SOGo namespace
k8s:
state: present
definition:
apiVersion: v1
kind: Namespace
metadata:
name: sogo
- name: Create a deployment
k8s:
definition:
apiVersion: v1
kind: Deployment
metadata:
name: sogo
namespace: sogo
spec:
replicas: 1
selector:
matchLabels:
app: sogo
template:
metadata:
labels:
app: sogo
spec:
containers:
- name: sogo
image: mailcow/sogo
volumeMounts:
- name: mail
mountPath: /var/mail
ports:
- containerPort: 80
env:
- name: OVERRIDE_HOSTNAME
value: "postfix.eom.dev"
- name: POSTMASTER_ADDRESS
value: "postfix@eom.dev"
- name: ACCOUNT_PROVISIONER
value: "LDAP"
- name: LDAP_SERVER_HOST
value: "ldap://openldap.openldap.svc.cluster.local/"
- name: LDAP_SEARCH_BASE
value: "dc=eom,dc=dev"
- name: LDAP_BIND_DN
value: "cn=readonly,dc=eom,dc=dev"
- name: LDAP_BIND_PW
value: "{{ openldap_readonly_password }}"
- name: LDAP_QUERY_FILTER_DOMAIN
value: "(mail=*@%s)"
- name: LDAP_QUERY_FILTER_USER
value: "(&(mail=%s)(memberOf=cn=Postfix Users,ou=Postfix,ou=Services,dc=eom,dc=dev))"
- name: LDAP_QUERY_FILTER_ALIAS
value: "(&(objectClass=posixAccount)(mailAlias=%s))"
- name: LDAP_QUERY_FILTER_GROUP
value: "(&(objectClass=posixAccount)(mailGroupMember=%s))"
- name: LDAP_QUERY_FILTER_SENDERS
value: "(&(objectClass=posixAccount)(|(mail=%s)(mailAlias=%s)(mailGroupMember=%s)))"
volumes:
- name: mail
persistentVolumeClaim:
claimName: mail
- name: Expose deployment as a service
k8s:
definition:
apiVersion: v1
kind: Service
metadata:
name: sogo
namespace: sogo
spec:
selector:
app: sogo
ports:
- port: 80
name: http
type: LoadBalancer