Misc. changes

This change was made to recover from an update made while attempting to address DevOps/ansible-role-eom#37, which was not solved here.

Reviewed-on: #38

README.md

@@ -1,7 +1,7 @@
 Role Name
 =========
 
-Ansible role to deploy eom services.
+Ansible role to deploy EOM services on Kubernetes.
 
 Requirements
 ------------

files/httpd-dav.conf

@@ -1,36 +0,0 @@
-#
-# Distributed authoring and versioning (WebDAV)
-#
-# Required modules: mod_alias, mod_auth_digest, mod_authn_core, mod_authn_file,
-#                   mod_authz_core, mod_authz_user, mod_dav, mod_dav_fs,
-#                   mod_setenvif
-LoadModule dav_module modules/mod_dav.so
-LoadModule dav_fs_module modules/mod_dav_fs.so
-
-# The following example gives DAV write access to a directory called
-# "uploads" under the ServerRoot directory.
-#
-# The User/Group specified in httpd.conf needs to have write permissions
-# on the directory where the DavLockDB is placed and on any directory where
-# "Dav On" is specified.
-
-DavLockDB "/usr/local/apache2/DavLock"
-
-<Directory "/usr/local/apache2/htdocs">
-    Dav On
-</Directory>
-
-#
-# The following directives disable redirects on non-GET requests for
-# a directory that does not include the trailing slash.  This fixes a 
-# problem with several clients that do not appropriately handle 
-# redirects for folders with DAV methods.
-#
-BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
-BrowserMatch "MS FrontPage" redirect-carefully
-BrowserMatch "^WebDrive" redirect-carefully
-BrowserMatch "^WebDAVFS/1.[01234]" redirect-carefully
-BrowserMatch "^gnome-vfs/1.0" redirect-carefully
-BrowserMatch "^XML Spy" redirect-carefully
-BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully
-BrowserMatch " Konqueror/4" redirect-carefully

files/httpd-gitweb.conf

@@ -1,30 +0,0 @@
-LoadModule rewrite_module modules/mod_rewrite.so
-LoadModule cgi_module modules/mod_cgi.so
-
-SetEnv GIT_PROJECT_ROOT /usr/local/apache2/htdocs
-SetEnv GIT_HTTP_EXPORT_ALL
-
-ScriptAliasMatch \
-	"(?x)^/(.*/(HEAD | \
-			info/refs | \
-			objects/(info/[^/]+ | \
-				 [0-9a-f]{2}/[0-9a-f]{38} | \
-				 pack/pack-[0-9a-f]{40}\.(pack|idx)) | \
-			git-(upload|receive)-pack))$" \
-	/usr/lib/git-core/git-http-backend/$1
-
-ScriptAlias / /usr/lib/cgi-bin/gitweb.cgi/
-
-<Directory "/usr/lib/git-core">
-    Options +ExecCGI +Indexes
-    Order allow,deny
-    Allow from all
-    Require all granted
-</Directory>
-
-<Directory "/usr/lib/cgi-bin">
-    Options +ExecCGI +Indexes
-    Order allow,deny
-    Allow from all
-    Require all granted
-</Directory>

files/httpd-proxy.conf

@@ -1,105 +0,0 @@
-LoadModule proxy_module modules/mod_proxy.so
-LoadModule proxy_http_module modules/mod_proxy_http.so
-LoadModule rewrite_module modules/mod_rewrite.so
-
-<VirtualHost *:80>
-	ServerName git.eom.dev
-	ServerAlias *.git.eom.dev
-
-	ProxyRequests Off
-	ProxyPreserveHost On
-
-	<Proxy *>
-		Order deny,allow
-		Allow from all
-	</Proxy>
-
-	ProxyPass / http://git/
-	ProxyPassReverse / http://git/
-</VirtualHost>
-<VirtualHost *:443>
-	ServerName git.eom.dev
-	ServerAlias *.git.eom.dev
-
-	SSLProxyEngine On
-	SSLCertificateFile "/usr/local/apache2/conf/server.crt"
-	SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"
-	ProxyRequests Off
-	ProxyPreserveHost On
-
-	<Proxy *>
-		Order deny,allow
-		Allow from all
-	</Proxy>
-
-	ProxyPass / http://git/
-	ProxyPassReverse / http://git/
-</VirtualHost>
-
-<VirtualHost *:80>
-	ServerName media.eom.dev
-	ServerAlias *.media.eom.dev
-
-	ProxyRequests Off
-	ProxyPreserveHost On
-
-	<Proxy *>
-		Order deny,allow
-		Allow from all
-	</Proxy>
-
-	ProxyPass / http://media/
-	ProxyPassReverse / http://media/
-</VirtualHost>
-<VirtualHost *:443>
-	ServerName media.eom.dev
-	ServerAlias *.media.eom.dev
-
-	SSLProxyEngine On
-	SSLCertificateFile "/usr/local/apache2/conf/server.crt"
-	SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"
-	ProxyRequests Off
-	ProxyPreserveHost On
-
-	<Proxy *>
-		Order deny,allow
-		Allow from all
-	</Proxy>
-
-	ProxyPass / http://media/
-	ProxyPassReverse / http://media/
-</VirtualHost>
-
-<VirtualHost *:80>
-	ServerName www.eom.dev
-	ServerAlias *.www.eom.dev
-
-	ProxyRequests Off
-	ProxyPreserveHost On
-
-	<Proxy *>
-		Order deny,allow
-		Allow from all
-	</Proxy>
-
-	ProxyPass / http://www/
-	ProxyPassReverse / http://www/
-</VirtualHost>
-<VirtualHost *:443>
-	ServerName www.eom.dev
-	ServerAlias *.www.eom.dev
-
-	SSLProxyEngine On
-	SSLCertificateFile "/usr/local/apache2/conf/server.crt"
-	SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"
-	ProxyRequests Off
-	ProxyPreserveHost On
-
-	<Proxy *>
-		Order deny,allow
-		Allow from all
-	</Proxy>
-
-	ProxyPass / http://www/
-	ProxyPassReverse / http://www/
-</VirtualHost>

files/httpd-ssi.conf

@@ -1,11 +0,0 @@
-LoadModule include_module modules/mod_include.so
-
-AddOutputFilter INCLUDES .shtml
-
-<Directory "/usr/local/apache2/htdocs">
-    Options +Includes
-</Directory>
-
-<IfModule dir_module>
-    DirectoryIndex index.shtml
-</IfModule>

files/httpd-ssl.conf

@@ -1,292 +0,0 @@
-#
-# This is the Apache server configuration file providing SSL support.
-# It contains the configuration directives to instruct the server how to
-# serve pages over an https connection. For detailed information about these 
-# directives see <URL:http://httpd.apache.org/docs/2.4/mod/mod_ssl.html>
-# 
-# Do NOT simply read the instructions in here without understanding
-# what they do.  They're here only as hints or reminders.  If you are unsure
-# consult the online docs. You have been warned.  
-#
-# Required modules: mod_log_config, mod_setenvif, mod_ssl,
-#          socache_shmcb_module (for default value of SSLSessionCache)
-LoadModule ssl_module modules/mod_ssl.so
-LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
-
-#
-# Pseudo Random Number Generator (PRNG):
-# Configure one or more sources to seed the PRNG of the SSL library.
-# The seed data should be of good random quality.
-# WARNING! On some platforms /dev/random blocks if not enough entropy
-# is available. This means you then cannot use the /dev/random device
-# because it would lead to very long connection times (as long as
-# it requires to make more entropy available). But usually those
-# platforms additionally provide a /dev/urandom device which doesn't
-# block. So, if available, use this one instead. Read the mod_ssl User
-# Manual for more details.
-#
-#SSLRandomSeed startup file:/dev/random  512
-#SSLRandomSeed startup file:/dev/urandom 512
-#SSLRandomSeed connect file:/dev/random  512
-#SSLRandomSeed connect file:/dev/urandom 512
-
-
-#
-# When we also provide SSL we have to listen to the 
-# standard HTTP port (see above) and to the HTTPS port
-#
-Listen 443
-
-##
-##  SSL Global Context
-##
-##  All SSL configuration in this context applies both to
-##  the main server and all SSL-enabled virtual hosts.
-##
-
-#   SSL Cipher Suite:
-#   List the ciphers that the client is permitted to negotiate,
-#   and that httpd will negotiate as the client of a proxied server.
-#   See the OpenSSL documentation for a complete list of ciphers, and
-#   ensure these follow appropriate best practices for this deployment.
-#   httpd 2.2.30, 2.4.13 and later force-disable aNULL, eNULL and EXP ciphers,
-#   while OpenSSL disabled these by default in 0.9.8zf/1.0.0r/1.0.1m/1.0.2a.
-SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
-SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
-
-#  By the end of 2016, only TLSv1.2 ciphers should remain in use.
-#  Older ciphers should be disallowed as soon as possible, while the
-#  kRSA ciphers do not offer forward secrecy.  These changes inhibit
-#  older clients (such as IE6 SP2 or IE8 on Windows XP, or other legacy
-#  non-browser tooling) from successfully connecting.  
-#
-#  To restrict mod_ssl to use only TLSv1.2 ciphers, and disable
-#  those protocols which do not support forward secrecy, replace
-#  the SSLCipherSuite and SSLProxyCipherSuite directives above with
-#  the following two directives, as soon as practical.
-# SSLCipherSuite HIGH:MEDIUM:!SSLv3:!kRSA
-# SSLProxyCipherSuite HIGH:MEDIUM:!SSLv3:!kRSA
-
-#   User agents such as web browsers are not configured for the user's
-#   own preference of either security or performance, therefore this
-#   must be the prerogative of the web server administrator who manages
-#   cpu load versus confidentiality, so enforce the server's cipher order.
-SSLHonorCipherOrder on 
-
-#   SSL Protocol support:
-#   List the protocol versions which clients are allowed to connect with.
-#   Disable SSLv3 by default (cf. RFC 7525 3.1.1).  TLSv1 (1.0) should be
-#   disabled as quickly as practical.  By the end of 2016, only the TLSv1.2
-#   protocol or later should remain in use.
-SSLProtocol all -SSLv3
-SSLProxyProtocol all -SSLv3
-
-#   Pass Phrase Dialog:
-#   Configure the pass phrase gathering process.
-#   The filtering dialog program (`builtin' is an internal
-#   terminal dialog) has to provide the pass phrase on stdout.
-SSLPassPhraseDialog  builtin
-
-#   Inter-Process Session Cache:
-#   Configure the SSL Session Cache: First the mechanism 
-#   to use and second the expiring timeout (in seconds).
-#SSLSessionCache         "dbm:/usr/local/apache2/logs/ssl_scache"
-SSLSessionCache        "shmcb:/usr/local/apache2/logs/ssl_scache(512000)"
-SSLSessionCacheTimeout  300
-
-#   OCSP Stapling (requires OpenSSL 0.9.8h or later)
-#
-#   This feature is disabled by default and requires at least
-#   the two directives SSLUseStapling and SSLStaplingCache.
-#   Refer to the documentation on OCSP Stapling in the SSL/TLS
-#   How-To for more information.
-#
-#   Enable stapling for all SSL-enabled servers:
-#SSLUseStapling On
-
-#   Define a relatively small cache for OCSP Stapling using
-#   the same mechanism that is used for the SSL session cache
-#   above.  If stapling is used with more than a few certificates,
-#   the size may need to be increased.  (AH01929 will be logged.)
-#SSLStaplingCache "shmcb:/usr/local/apache2/logs/ssl_stapling(32768)"
-
-#   Seconds before valid OCSP responses are expired from the cache
-#SSLStaplingStandardCacheTimeout 3600
-
-#   Seconds before invalid OCSP responses are expired from the cache
-#SSLStaplingErrorCacheTimeout 600
-
-##
-## SSL Virtual Host Context
-##
-
-<VirtualHost _default_:443>
-
-#   General setup for the virtual host
-DocumentRoot "/usr/local/apache2/htdocs"
-ServerName proxy.eom.dev:443
-ServerAdmin admin@mail.eom.dev
-ErrorLog /proc/self/fd/2
-TransferLog /proc/self/fd/1
-
-#   SSL Engine Switch:
-#   Enable/Disable SSL for this virtual host.
-SSLEngine on
-
-#   Server Certificate:
-#   Point SSLCertificateFile at a PEM encoded certificate.  If
-#   the certificate is encrypted, then you will be prompted for a
-#   pass phrase.  Note that a kill -HUP will prompt again.  Keep
-#   in mind that if you have both an RSA and a DSA certificate you
-#   can configure both in parallel (to also allow the use of DSA
-#   ciphers, etc.)
-#   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
-#   require an ECC certificate which can also be configured in
-#   parallel.
-SSLCertificateFile "/usr/local/apache2/conf/server.crt"
-#SSLCertificateFile "/usr/local/apache2/conf/server-dsa.crt"
-#SSLCertificateFile "/usr/local/apache2/conf/server-ecc.crt"
-
-#   Server Private Key:
-#   If the key is not combined with the certificate, use this
-#   directive to point at the key file.  Keep in mind that if
-#   you've both a RSA and a DSA private key you can configure
-#   both in parallel (to also allow the use of DSA ciphers, etc.)
-#   ECC keys, when in use, can also be configured in parallel
-SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"
-#SSLCertificateKeyFile "/usr/local/apache2/conf/server-dsa.key"
-#SSLCertificateKeyFile "/usr/local/apache2/conf/server-ecc.key"
-
-#   Server Certificate Chain:
-#   Point SSLCertificateChainFile at a file containing the
-#   concatenation of PEM encoded CA certificates which form the
-#   certificate chain for the server certificate. Alternatively
-#   the referenced file can be the same as SSLCertificateFile
-#   when the CA certificates are directly appended to the server
-#   certificate for convenience.
-#SSLCertificateChainFile "/usr/local/apache2/conf/server-ca.crt"
-
-#   Certificate Authority (CA):
-#   Set the CA certificate verification path where to find CA
-#   certificates for client authentication or alternatively one
-#   huge file containing all of them (file must be PEM encoded)
-#   Note: Inside SSLCACertificatePath you need hash symlinks
-#         to point to the certificate files. Use the provided
-#         Makefile to update the hash symlinks after changes.
-#SSLCACertificatePath "/usr/local/apache2/conf/ssl.crt"
-#SSLCACertificateFile "/usr/local/apache2/conf/ssl.crt/ca-bundle.crt"
-
-#   Certificate Revocation Lists (CRL):
-#   Set the CA revocation path where to find CA CRLs for client
-#   authentication or alternatively one huge file containing all
-#   of them (file must be PEM encoded).
-#   The CRL checking mode needs to be configured explicitly
-#   through SSLCARevocationCheck (defaults to "none" otherwise).
-#   Note: Inside SSLCARevocationPath you need hash symlinks
-#         to point to the certificate files. Use the provided
-#         Makefile to update the hash symlinks after changes.
-#SSLCARevocationPath "/usr/local/apache2/conf/ssl.crl"
-#SSLCARevocationFile "/usr/local/apache2/conf/ssl.crl/ca-bundle.crl"
-#SSLCARevocationCheck chain
-
-#   Client Authentication (Type):
-#   Client certificate verification type and depth.  Types are
-#   none, optional, require and optional_no_ca.  Depth is a
-#   number which specifies how deeply to verify the certificate
-#   issuer chain before deciding the certificate is not valid.
-#SSLVerifyClient require
-#SSLVerifyDepth  10
-
-#   TLS-SRP mutual authentication:
-#   Enable TLS-SRP and set the path to the OpenSSL SRP verifier
-#   file (containing login information for SRP user accounts). 
-#   Requires OpenSSL 1.0.1 or newer. See the mod_ssl FAQ for
-#   detailed instructions on creating this file. Example:
-#   "openssl srp -srpvfile /usr/local/apache2/conf/passwd.srpv -add username"
-#SSLSRPVerifierFile "/usr/local/apache2/conf/passwd.srpv"
-
-#   Access Control:
-#   With SSLRequire you can do per-directory access control based
-#   on arbitrary complex boolean expressions containing server
-#   variable checks and other lookup directives.  The syntax is a
-#   mixture between C and Perl.  See the mod_ssl documentation
-#   for more details.
-#<Location />
-#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
-#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
-#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
-#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
-#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
-#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
-#</Location>
-
-#   SSL Engine Options:
-#   Set various options for the SSL engine.
-#   o FakeBasicAuth:
-#     Translate the client X.509 into a Basic Authorisation.  This means that
-#     the standard Auth/DBMAuth methods can be used for access control.  The
-#     user name is the `one line' version of the client's X.509 certificate.
-#     Note that no password is obtained from the user. Every entry in the user
-#     file needs this password: `xxj31ZMTZzkVA'.
-#   o ExportCertData:
-#     This exports two additional environment variables: SSL_CLIENT_CERT and
-#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
-#     server (always existing) and the client (only existing when client
-#     authentication is used). This can be used to import the certificates
-#     into CGI scripts.
-#   o StdEnvVars:
-#     This exports the standard SSL/TLS related `SSL_*' environment variables.
-#     Per default this exportation is switched off for performance reasons,
-#     because the extraction step is an expensive operation and is usually
-#     useless for serving static content. So one usually enables the
-#     exportation for CGI and SSI requests only.
-#   o StrictRequire:
-#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
-#     under a "Satisfy any" situation, i.e. when it applies access is denied
-#     and no other module can change it.
-#   o OptRenegotiate:
-#     This enables optimized SSL connection renegotiation handling when SSL
-#     directives are used in per-directory context. 
-#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
-<FilesMatch "\.(cgi|shtml|phtml|php)$">
-    SSLOptions +StdEnvVars
-</FilesMatch>
-<Directory "/usr/local/apache2/cgi-bin">
-    SSLOptions +StdEnvVars
-</Directory>
-
-#   SSL Protocol Adjustments:
-#   The safe and default but still SSL/TLS standard compliant shutdown
-#   approach is that mod_ssl sends the close notify alert but doesn't wait for
-#   the close notify alert from client. When you need a different shutdown
-#   approach you can use one of the following variables:
-#   o ssl-unclean-shutdown:
-#     This forces an unclean shutdown when the connection is closed, i.e. no
-#     SSL close notify alert is sent or allowed to be received.  This violates
-#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
-#     this when you receive I/O errors because of the standard approach where
-#     mod_ssl sends the close notify alert.
-#   o ssl-accurate-shutdown:
-#     This forces an accurate shutdown when the connection is closed, i.e. a
-#     SSL close notify alert is send and mod_ssl waits for the close notify
-#     alert of the client. This is 100% SSL/TLS standard compliant, but in
-#     practice often causes hanging connections with brain-dead browsers. Use
-#     this only for browsers where you know that their SSL implementation
-#     works correctly. 
-#   Notice: Most problems of broken clients are also related to the HTTP
-#   keep-alive facility, so you usually additionally want to disable
-#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
-#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
-#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
-#   "force-response-1.0" for this.
-BrowserMatch "MSIE [2-5]" \
-         nokeepalive ssl-unclean-shutdown \
-         downgrade-1.0 force-response-1.0
-
-#   Per-Server Logging:
-#   The home of a custom SSL log file. Use this when you want a
-#   compact non-error SSL logfile on a virtual host basis.
-CustomLog /proc/self/fd/1 \
-          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
-
-</VirtualHost>                                  

files/httpd.conf

@@ -1,551 +0,0 @@
-#
-# This is the main Apache HTTP server configuration file.  It contains the
-# configuration directives that give the server its instructions.
-# See <URL:http://httpd.apache.org/docs/2.4/> for detailed information.
-# In particular, see 
-# <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
-# for a discussion of each configuration directive.
-#
-# Do NOT simply read the instructions in here without understanding
-# what they do.  They're here only as hints or reminders.  If you are unsure
-# consult the online docs. You have been warned.  
-#
-# Configuration and logfile names: If the filenames you specify for many
-# of the server's control files begin with "/" (or "drive:/" for Win32), the
-# server will use that explicit path.  If the filenames do *not* begin
-# with "/", the value of ServerRoot is prepended -- so "logs/access_log"
-# with ServerRoot set to "/usr/local/apache2" will be interpreted by the
-# server as "/usr/local/apache2/logs/access_log", whereas "/logs/access_log" 
-# will be interpreted as '/logs/access_log'.
-
-#
-# ServerRoot: The top of the directory tree under which the server's
-# configuration, error, and log files are kept.
-#
-# Do not add a slash at the end of the directory path.  If you point
-# ServerRoot at a non-local disk, be sure to specify a local disk on the
-# Mutex directive, if file-based mutexes are used.  If you wish to share the
-# same ServerRoot for multiple httpd daemons, you will need to change at
-# least PidFile.
-#
-ServerRoot "/usr/local/apache2"
-
-#
-# Mutex: Allows you to set the mutex mechanism and mutex file directory
-# for individual mutexes, or change the global defaults
-#
-# Uncomment and change the directory if mutexes are file-based and the default
-# mutex file directory is not on a local disk or is not appropriate for some
-# other reason.
-#
-# Mutex default:logs
-
-#
-# Listen: Allows you to bind Apache to specific IP addresses and/or
-# ports, instead of the default. See also the <VirtualHost>
-# directive.
-#
-# Change this to Listen on specific IP addresses as shown below to 
-# prevent Apache from glomming onto all bound IP addresses.
-#
-#Listen 12.34.56.78:80
-Listen 80
-
-#
-# Dynamic Shared Object (DSO) Support
-#
-# To be able to use the functionality of a module which was built as a DSO you
-# have to place corresponding `LoadModule' lines at this location so the
-# directives contained in it are actually available _before_ they are used.
-# Statically compiled modules (those listed by `httpd -l') do not need
-# to be loaded here.
-#
-# Example:
-# LoadModule foo_module modules/mod_foo.so
-#
-LoadModule mpm_event_module modules/mod_mpm_event.so
-#LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
-#LoadModule mpm_worker_module modules/mod_mpm_worker.so
-LoadModule authn_file_module modules/mod_authn_file.so
-#LoadModule authn_dbm_module modules/mod_authn_dbm.so
-#LoadModule authn_anon_module modules/mod_authn_anon.so
-#LoadModule authn_dbd_module modules/mod_authn_dbd.so
-#LoadModule authn_socache_module modules/mod_authn_socache.so
-LoadModule authn_core_module modules/mod_authn_core.so
-LoadModule authz_host_module modules/mod_authz_host.so
-LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
-LoadModule authz_user_module modules/mod_authz_user.so
-#LoadModule authz_dbm_module modules/mod_authz_dbm.so
-#LoadModule authz_owner_module modules/mod_authz_owner.so
-#LoadModule authz_dbd_module modules/mod_authz_dbd.so
-LoadModule authz_core_module modules/mod_authz_core.so
-#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
-#LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so
-LoadModule access_compat_module modules/mod_access_compat.so
-LoadModule auth_basic_module modules/mod_auth_basic.so
-#LoadModule auth_form_module modules/mod_auth_form.so
-#LoadModule auth_digest_module modules/mod_auth_digest.so
-#LoadModule allowmethods_module modules/mod_allowmethods.so
-#LoadModule isapi_module modules/mod_isapi.so
-#LoadModule file_cache_module modules/mod_file_cache.so
-#LoadModule cache_module modules/mod_cache.so
-#LoadModule cache_disk_module modules/mod_cache_disk.so
-#LoadModule cache_socache_module modules/mod_cache_socache.so
-#LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
-#LoadModule socache_dbm_module modules/mod_socache_dbm.so
-#LoadModule socache_memcache_module modules/mod_socache_memcache.so
-#LoadModule socache_redis_module modules/mod_socache_redis.so
-#LoadModule watchdog_module modules/mod_watchdog.so
-#LoadModule macro_module modules/mod_macro.so
-#LoadModule dbd_module modules/mod_dbd.so
-#LoadModule bucketeer_module modules/mod_bucketeer.so
-#LoadModule dumpio_module modules/mod_dumpio.so
-#LoadModule echo_module modules/mod_echo.so
-#LoadModule example_hooks_module modules/mod_example_hooks.so
-#LoadModule case_filter_module modules/mod_case_filter.so
-#LoadModule case_filter_in_module modules/mod_case_filter_in.so
-#LoadModule example_ipc_module modules/mod_example_ipc.so
-#LoadModule buffer_module modules/mod_buffer.so
-#LoadModule data_module modules/mod_data.so
-#LoadModule ratelimit_module modules/mod_ratelimit.so
-LoadModule reqtimeout_module modules/mod_reqtimeout.so
-#LoadModule ext_filter_module modules/mod_ext_filter.so
-#LoadModule request_module modules/mod_request.so
-#LoadModule include_module modules/mod_include.so
-LoadModule filter_module modules/mod_filter.so
-#LoadModule reflector_module modules/mod_reflector.so
-#LoadModule substitute_module modules/mod_substitute.so
-#LoadModule sed_module modules/mod_sed.so
-#LoadModule charset_lite_module modules/mod_charset_lite.so
-#LoadModule deflate_module modules/mod_deflate.so
-#LoadModule xml2enc_module modules/mod_xml2enc.so
-#LoadModule proxy_html_module modules/mod_proxy_html.so
-#LoadModule brotli_module modules/mod_brotli.so
-LoadModule mime_module modules/mod_mime.so
-#LoadModule ldap_module modules/mod_ldap.so
-LoadModule log_config_module modules/mod_log_config.so
-#LoadModule log_debug_module modules/mod_log_debug.so
-#LoadModule log_forensic_module modules/mod_log_forensic.so
-#LoadModule logio_module modules/mod_logio.so
-#LoadModule lua_module modules/mod_lua.so
-LoadModule env_module modules/mod_env.so
-#LoadModule mime_magic_module modules/mod_mime_magic.so
-#LoadModule cern_meta_module modules/mod_cern_meta.so
-#LoadModule expires_module modules/mod_expires.so
-LoadModule headers_module modules/mod_headers.so
-#LoadModule ident_module modules/mod_ident.so
-#LoadModule usertrack_module modules/mod_usertrack.so
-#LoadModule unique_id_module modules/mod_unique_id.so
-LoadModule setenvif_module modules/mod_setenvif.so
-LoadModule version_module modules/mod_version.so
-#LoadModule remoteip_module modules/mod_remoteip.so
-#LoadModule proxy_module modules/mod_proxy.so
-#LoadModule proxy_connect_module modules/mod_proxy_connect.so
-#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
-#LoadModule proxy_http_module modules/mod_proxy_http.so
-#LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
-#LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
-#LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
-#LoadModule proxy_fdpass_module modules/mod_proxy_fdpass.so
-#LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
-#LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
-#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
-#LoadModule proxy_express_module modules/mod_proxy_express.so
-#LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so
-#LoadModule session_module modules/mod_session.so
-#LoadModule session_cookie_module modules/mod_session_cookie.so
-#LoadModule session_crypto_module modules/mod_session_crypto.so
-#LoadModule session_dbd_module modules/mod_session_dbd.so
-#LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
-#LoadModule slotmem_plain_module modules/mod_slotmem_plain.so
-#LoadModule ssl_module modules/mod_ssl.so
-#LoadModule optional_hook_export_module modules/mod_optional_hook_export.so
-#LoadModule optional_hook_import_module modules/mod_optional_hook_import.so
-#LoadModule optional_fn_import_module modules/mod_optional_fn_import.so
-#LoadModule optional_fn_export_module modules/mod_optional_fn_export.so
-#LoadModule dialup_module modules/mod_dialup.so
-#LoadModule http2_module modules/mod_http2.so
-#LoadModule proxy_http2_module modules/mod_proxy_http2.so
-#LoadModule md_module modules/mod_md.so
-#LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
-#LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
-#LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
-#LoadModule lbmethod_heartbeat_module modules/mod_lbmethod_heartbeat.so
-LoadModule unixd_module modules/mod_unixd.so
-#LoadModule heartbeat_module modules/mod_heartbeat.so
-#LoadModule heartmonitor_module modules/mod_heartmonitor.so
-#LoadModule dav_module modules/mod_dav.so
-LoadModule status_module modules/mod_status.so
-LoadModule autoindex_module modules/mod_autoindex.so
-#LoadModule asis_module modules/mod_asis.so
-#LoadModule info_module modules/mod_info.so
-#LoadModule suexec_module modules/mod_suexec.so
-<IfModule !mpm_prefork_module>
-	#LoadModule cgid_module modules/mod_cgid.so
-</IfModule>
-<IfModule mpm_prefork_module>
-	#LoadModule cgi_module modules/mod_cgi.so
-</IfModule>
-#LoadModule dav_fs_module modules/mod_dav_fs.so
-#LoadModule dav_lock_module modules/mod_dav_lock.so
-#LoadModule vhost_alias_module modules/mod_vhost_alias.so
-#LoadModule negotiation_module modules/mod_negotiation.so
-LoadModule dir_module modules/mod_dir.so
-#LoadModule imagemap_module modules/mod_imagemap.so
-#LoadModule actions_module modules/mod_actions.so
-#LoadModule speling_module modules/mod_speling.so
-#LoadModule userdir_module modules/mod_userdir.so
-LoadModule alias_module modules/mod_alias.so
-#LoadModule rewrite_module modules/mod_rewrite.so
-
-<IfModule unixd_module>
-#
-# If you wish httpd to run as a different user or group, you must run
-# httpd as root initially and it will switch.  
-#
-# User/Group: The name (or #number) of the user/group to run httpd as.
-# It is usually good practice to create a dedicated user and group for
-# running httpd, as with most system services.
-#
-User www-data
-Group www-data
-
-</IfModule>
-
-# 'Main' server configuration
-#
-# The directives in this section set up the values used by the 'main'
-# server, which responds to any requests that aren't handled by a
-# <VirtualHost> definition.  These values also provide defaults for
-# any <VirtualHost> containers you may define later in the file.
-#
-# All of these directives may appear inside <VirtualHost> containers,
-# in which case these default settings will be overridden for the
-# virtual host being defined.
-#
-
-#
-# ServerAdmin: Your address, where problems with the server should be
-# e-mailed.  This address appears on some server-generated pages, such
-# as error documents.  e.g. admin@your-domain.com
-#
-ServerAdmin you@example.com
-
-#
-# ServerName gives the name and port that the server uses to identify itself.
-# This can often be determined automatically, but we recommend you specify
-# it explicitly to prevent problems during startup.
-#
-# If your host doesn't have a registered DNS name, enter its IP address here.
-#
-#ServerName www.example.com:80
-
-#
-# Deny access to the entirety of your server's filesystem. You must
-# explicitly permit access to web content directories in other 
-# <Directory> blocks below.
-#
-<Directory />
-    AllowOverride none
-    Require all denied
-</Directory>
-
-#
-# Note that from this point forward you must specifically allow
-# particular features to be enabled - so if something's not working as
-# you might expect, make sure that you have specifically enabled it
-# below.
-#
-
-#
-# DocumentRoot: The directory out of which you will serve your
-# documents. By default, all requests are taken from this directory, but
-# symbolic links and aliases may be used to point to other locations.
-#
-DocumentRoot "/usr/local/apache2/htdocs"
-<Directory "/usr/local/apache2/htdocs">
-    #
-    # Possible values for the Options directive are "None", "All",
-    # or any combination of:
-    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
-    #
-    # Note that "MultiViews" must be named *explicitly* --- "Options All"
-    # doesn't give it to you.
-    #
-    # The Options directive is both complicated and important.  Please see
-    # http://httpd.apache.org/docs/2.4/mod/core.html#options
-    # for more information.
-    #
-    Options Indexes FollowSymLinks
-
-    #
-    # AllowOverride controls what directives may be placed in .htaccess files.
-    # It can be "All", "None", or any combination of the keywords:
-    #   AllowOverride FileInfo AuthConfig Limit
-    #
-    AllowOverride None
-
-    #
-    # Controls who can get stuff from this server.
-    #
-    Require all granted
-</Directory>
-
-#
-# DirectoryIndex: sets the file that Apache will serve if a directory
-# is requested.
-#
-<IfModule dir_module>
-    DirectoryIndex index.html
-</IfModule>
-
-#
-# The following lines prevent .htaccess and .htpasswd files from being 
-# viewed by Web clients. 
-#
-<Files ".ht*">
-    Require all denied
-</Files>
-
-#
-# ErrorLog: The location of the error log file.
-# If you do not specify an ErrorLog directive within a <VirtualHost>
-# container, error messages relating to that virtual host will be
-# logged here.  If you *do* define an error logfile for a <VirtualHost>
-# container, that host's errors will be logged there and not here.
-#
-ErrorLog /proc/self/fd/2
-
-#
-# LogLevel: Control the number of messages logged to the error_log.
-# Possible values include: debug, info, notice, warn, error, crit,
-# alert, emerg.
-#
-LogLevel warn
-
-<IfModule log_config_module>
-    #
-    # The following directives define some format nicknames for use with
-    # a CustomLog directive (see below).
-    #
-    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
-    LogFormat "%h %l %u %t \"%r\" %>s %b" common
-
-    <IfModule logio_module>
-      # You need to enable mod_logio.c to use %I and %O
-      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
-    </IfModule>
-
-    #
-    # The location and format of the access logfile (Common Logfile Format).
-    # If you do not define any access logfiles within a <VirtualHost>
-    # container, they will be logged here.  Contrariwise, if you *do*
-    # define per-<VirtualHost> access logfiles, transactions will be
-    # logged therein and *not* in this file.
-    #
-    CustomLog /proc/self/fd/1 common
-
-    #
-    # If you prefer a logfile with access, agent, and referer information
-    # (Combined Logfile Format) you can use the following directive.
-    #
-    #CustomLog "logs/access_log" combined
-</IfModule>
-
-<IfModule alias_module>
-    #
-    # Redirect: Allows you to tell clients about documents that used to 
-    # exist in your server's namespace, but do not anymore. The client 
-    # will make a new request for the document at its new location.
-    # Example:
-    # Redirect permanent /foo http://www.example.com/bar
-
-    #
-    # Alias: Maps web paths into filesystem paths and is used to
-    # access content that does not live under the DocumentRoot.
-    # Example:
-    # Alias /webpath /full/filesystem/path
-    #
-    # If you include a trailing / on /webpath then the server will
-    # require it to be present in the URL.  You will also likely
-    # need to provide a <Directory> section to allow access to
-    # the filesystem path.
-
-    #
-    # ScriptAlias: This controls which directories contain server scripts. 
-    # ScriptAliases are essentially the same as Aliases, except that
-    # documents in the target directory are treated as applications and
-    # run by the server when requested rather than as documents sent to the
-    # client.  The same rules about trailing "/" apply to ScriptAlias
-    # directives as to Alias.
-    #
-    ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
-
-</IfModule>
-
-<IfModule cgid_module>
-    #
-    # ScriptSock: On threaded servers, designate the path to the UNIX
-    # socket used to communicate with the CGI daemon of mod_cgid.
-    #
-    #Scriptsock cgisock
-</IfModule>
-
-#
-# "/usr/local/apache2/cgi-bin" should be changed to whatever your ScriptAliased
-# CGI directory exists, if you have that configured.
-#
-<Directory "/usr/local/apache2/cgi-bin">
-    AllowOverride None
-    Options None
-    Require all granted
-</Directory>
-
-<IfModule headers_module>
-    #
-    # Avoid passing HTTP_PROXY environment to CGI's on this or any proxied
-    # backend servers which have lingering "httpoxy" defects.
-    # 'Proxy' request header is undefined by the IETF, not listed by IANA
-    #
-    RequestHeader unset Proxy early
-</IfModule>
-
-<IfModule mime_module>
-    #
-    # TypesConfig points to the file containing the list of mappings from
-    # filename extension to MIME-type.
-    #
-    TypesConfig conf/mime.types
-
-    #
-    # AddType allows you to add to or override the MIME configuration
-    # file specified in TypesConfig for specific file types.
-    #
-    #AddType application/x-gzip .tgz
-    #
-    # AddEncoding allows you to have certain browsers uncompress
-    # information on the fly. Note: Not all browsers support this.
-    #
-    #AddEncoding x-compress .Z
-    #AddEncoding x-gzip .gz .tgz
-    #
-    # If the AddEncoding directives above are commented-out, then you
-    # probably should define those extensions to indicate media types:
-    #
-    AddType application/x-compress .Z
-    AddType application/x-gzip .gz .tgz
-
-    #
-    # AddHandler allows you to map certain file extensions to "handlers":
-    # actions unrelated to filetype. These can be either built into the server
-    # or added with the Action directive (see below)
-    #
-    # To use CGI scripts outside of ScriptAliased directories:
-    # (You will also need to add "ExecCGI" to the "Options" directive.)
-    #
-    #AddHandler cgi-script .cgi
-
-    # For type maps (negotiated resources):
-    #AddHandler type-map var
-
-    #
-    # Filters allow you to process content before it is sent to the client.
-    #
-    # To parse .shtml files for server-side includes (SSI):
-    # (You will also need to add "Includes" to the "Options" directive.)
-    #
-    #AddType text/html .shtml
-    #AddOutputFilter INCLUDES .shtml
-</IfModule>
-
-#
-# The mod_mime_magic module allows the server to use various hints from the
-# contents of the file itself to determine its type.  The MIMEMagicFile
-# directive tells the module where the hint definitions are located.
-#
-#MIMEMagicFile conf/magic
-
-#
-# Customizable error responses come in three flavors:
-# 1) plain text 2) local redirects 3) external redirects
-#
-# Some examples:
-#ErrorDocument 500 "The server made a boo boo."
-#ErrorDocument 404 /missing.html
-#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
-#ErrorDocument 402 http://www.example.com/subscription_info.html
-#
-
-#
-# MaxRanges: Maximum number of Ranges in a request before
-# returning the entire resource, or one of the special
-# values 'default', 'none' or 'unlimited'.
-# Default setting is to accept 200 Ranges.
-#MaxRanges unlimited
-
-#
-# EnableMMAP and EnableSendfile: On systems that support it, 
-# memory-mapping or the sendfile syscall may be used to deliver
-# files.  This usually improves server performance, but must
-# be turned off when serving from networked-mounted 
-# filesystems or if support for these functions is otherwise
-# broken on your system.
-# Defaults: EnableMMAP On, EnableSendfile Off
-#
-#EnableMMAP off
-#EnableSendfile on
-
-# Supplemental configuration
-#
-# The configuration files in the conf/extra/ directory can be 
-# included to add extra features or to modify the default configuration of 
-# the server, or you may simply copy their contents here and change as 
-# necessary.
-
-# Server-pool management (MPM specific)
-#Include conf/extra/httpd-mpm.conf
-
-# Multi-language error messages
-#Include conf/extra/httpd-multilang-errordoc.conf
-
-# Fancy directory listings
-#Include conf/extra/httpd-autoindex.conf
-
-# Language settings
-#Include conf/extra/httpd-languages.conf
-
-# User home directories
-#Include conf/extra/httpd-userdir.conf
-
-# Real-time info on requests and configuration
-#Include conf/extra/httpd-info.conf
-
-# Virtual hosts
-#Include conf/extra/httpd-vhosts.conf
-
-# Local access to the Apache HTTP Server Manual
-#Include conf/extra/httpd-manual.conf
-
-# Distributed authoring and versioning (WebDAV)
-#Include conf/extra/httpd-dav.conf
-
-# Various default settings
-#Include conf/extra/httpd-default.conf
-
-# Configure mod_proxy_html to understand HTML4/XHTML1
-<IfModule proxy_html_module>
-Include conf/extra/proxy-html.conf
-</IfModule>
-
-# Secure (SSL/TLS) connections
-#Include conf/extra/httpd-ssl.conf
-#
-# Note: The following must must be present to support
-#       starting without SSL on platforms with no /dev/random equivalent
-#       but a statically compiled-in mod_ssl.
-#
-<IfModule ssl_module>
-SSLRandomSeed startup builtin
-SSLRandomSeed connect builtin
-</IfModule>
-

files/matterbridge.toml

@@ -0,0 +1,130 @@
+#This is configuration for matterbridge.
+#WARNING: as this file contains credentials, be sure to set correct file permissions
+###################################################################
+# NCTalk (Nextcloud Talk)
+###################################################################
+
+[nctalk.bridge]
+
+# Url of your Nextcloud server
+Server = "https://nextcloud.eom.dev"
+
+# Enable to not verify the certificate on your Nextcloud server.
+# e.g. when using selfsigned certificates
+# OPTIONAL (default false)
+SkipTLSVerify=false
+
+# Username of the bot
+Login = "minecraft"
+
+# Password of the bot
+Password = "{{ minecraft_admin_password }}"
+
+# Suffix for Guest Users
+GuestSuffix = " (Guest)"
+
+# Separate display name (Note: needs to be configured from Nextcloud Talk to work)
+SeparateDisplayName=false
+
+###################################################################
+#API
+###################################################################
+[api]
+#You can configure multiple API hooks
+#In this example we use [api.minecraft]
+#REQUIRED
+
+[api.minecraft]
+#Address to listen on for API
+#REQUIRED
+BindAddress="0.0.0.0:4242"
+
+#Amount of messages to keep in memory
+Buffer=1000
+
+#Bearer token used for authentication
+#curl -H "Authorization: Bearer token" http://localhost:4242/api/messages
+#OPTIONAL (no authorization if token is empty)
+Token=""
+
+#extra label that can be used in the RemoteNickFormat
+#optional (default empty)
+Label="minecraft"
+
+#RemoteNickFormat defines how remote users appear on this bridge
+#The string "{NICK}" (case sensitive) will be replaced by the actual nick / username.
+#The string "{BRIDGE}" (case sensitive) will be replaced by the sending bridge
+#The string "{PROTOCOL}" (case sensitive) will be replaced by the protocol used by the bridge
+#OPTIONAL (default empty)
+RemoteNickFormat="{NICK}"
+
+###################################################################
+#General configuration
+###################################################################
+# Settings here are defaults that each protocol can override
+[general]
+#RemoteNickFormat defines how remote users appear on this bridge
+#The string "{NICK}" (case sensitive) will be replaced by the actual nick / username.
+#The string "{BRIDGE}" (case sensitive) will be replaced by the sending bridge
+#The string "{PROTOCOL}" (case sensitive) will be replaced by the protocol used by the bridge
+#OPTIONAL (default empty)
+RemoteNickFormat="[{PROTOCOL}] <{NICK}> "
+
+#StripNick only allows alphanumerical nicks. See https://github.com/42wim/matterbridge/issues/285
+#It will strip other characters from the nick
+#OPTIONAL (default false)
+StripNick=false
+
+
+#MediaServerUpload and MediaServerDownload are used for uploading images/files/video to
+#a remote "mediaserver" (a webserver like caddy for example).
+#When configured images/files uploaded on bridges like mattermost,slack, telegram will be downloaded
+#and uploaded again to MediaServerUpload URL
+#The MediaServerDownload will be used so that bridges without native uploading support:
+#gitter, irc and xmpp will be shown links to the files on MediaServerDownload
+#
+#More information https://github.com/42wim/matterbridge/wiki/Mediaserver-setup-%5Badvanced%5D
+#OPTIONAL (default empty)
+#MediaServerUpload="https://user:pass@yourserver.com/upload"
+#OPTIONAL (default empty)
+#MediaServerDownload="https://youserver.com/download"
+
+#MediaDownloadSize is the maximum size of attachments, videos, images
+#matterbridge will download and upload this file to bridges that also support uploading files.
+#eg downloading from slack to upload it to mattermost
+#
+#It will only download from bridges that don't have public links available, which are for the moment
+#slack, telegram, matrix and mattermost
+#
+#Optional (default 1000000 (1 megabyte))
+MediaDownloadSize=1000000
+
+###################################################################
+#Gateway configuration
+###################################################################
+
+#You can specify multiple gateways using [[gateway]]
+#Each gateway has a [[gateway.in]] and a [[gateway.out]]
+#[[gateway.in]] specifies the account and channels we will receive messages from.
+#[[gateway.out]] specifies the account and channels we will send the messages
+#from [[gateway.in]] to.
+#
+#Most of the time [[gateway.in]] and [[gateway.out]] are the same if you
+#want bidirectional bridging. You can then use [[gateway.inout]]
+#
+
+[[gateway]]
+#REQUIRED and UNIQUE
+name="minecraft"
+#Enable enables this gateway
+##OPTIONAL (default false)
+enable=true
+
+    # API
+    [[gateway.inout]]
+    account="api.minecraft"
+    channel="api"
+
+    [[gateway.inout]]
+    account="nctalk.bridge"
+    token="wgo6vovu"

files/nextcloud-talk-gitea-webhook.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+message="$(echo $1| sed 's/.*"message":"\(.*\).."}/\1/')"
+
+curl -X POST \
+	-H "Content-Type: application/json" \
+	-H "OCS-APIRequest: true" \
+	https://nextcloud.eom.dev/ocs/v2.php/apps/spreed/api/v1/chat/x3wy62mb \
+	-u Gitea:$GITEA_ADMIN_PASSWORD \
+	-d "{\"token\": \"x3wy62mb\", \"message\": \"$message\"}"

files/nextcloud-talk-grafana-webhook.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+message="$(echo $1| sed 's/.*"message":"\(.*\).."}/\1/')"
+
+curl -X POST \
+	-H "Content-Type: application/json" \
+	-H "OCS-APIRequest: true" \
+	https://nextcloud.eom.dev/ocs/v2.php/apps/spreed/api/v1/chat/x3wy62mb \
+	-u Grafana:$GRAFANA_ADMIN_PASSWORD \
+	-d "{\"token\": \"x3wy62mb\", \"message\": \"$message\"}"

tasks/bridgegate_kitchen.yaml

@@ -0,0 +1,36 @@
+---
+# tasks file for wordpress
+- name: Deploy Wordpress
+  kubernetes.core.helm:
+    name: bridgegate-kitchen
+    chart_ref: bitnami/wordpress
+    release_namespace: bridgegate-kitchen
+    create_namespace: true
+    values:
+      resourcesPreset: small
+      wordpressUsername: wordpress_admin
+      wordpressPassword: "{{ wordpress_admin_password }}"
+      wordpressEmail: wordpress@eom.dev
+      wordpressFirstName: Administrator
+      wordpressLastName: Wordpress
+      wordpressBlogName: Bridgegate Kitchen
+      wordpressScheme: https
+      service:
+        type: ClusterIP
+      ingress:
+        enabled: true
+        ingressClassName: nginx
+        hostname: bridgegate-kitchen.eom.dev
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        tls: true
+      persistence:
+        enabled: true
+        size: 128Gi
+      mariadb:
+        enabled: true
+        auth:
+          password: "{{ wordpress_admin_password }}"
+        primary:
+          persistence:
+            size: 256Gi

tasks/collabora.yaml

@@ -0,0 +1,44 @@
+---
+# tasks file for collabora
+- name: Add Collabora repo
+  kubernetes.core.helm_repository:
+    name: collabora
+    repo_url: https://collaboraonline.github.io/online/
+  register: repo
+
+- name: Update Helm repos
+  command: helm repo update
+  when: repo.changed
+
+- name: Deploy Collabora
+  kubernetes.core.helm:
+    name: collabora
+    chart_ref: collabora/collabora-online
+    release_namespace: collabora
+    create_namespace: true
+    values:
+      collabora:
+        server_name: collabora.eom.dev
+        username: collabora_admin
+        password: "{{ collabora_admin_password }}"
+        aliasgroups:
+          - host: "https://nextcloud.eom.dev"
+        extra_params: --o:ssl.enable=false --o:ssl.termination=true --o:num_prespawn_children=4
+      ingress:
+        enabled: true
+        className: "nginx"
+        annotations:
+          nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_WOPISrc"
+          nginx.ingress.kubernetes.io/proxy-body-size: "0"
+          nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+          nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+          cert-manager.io/cluster-issuer: ca-issuer
+        hosts:
+          - host: collabora.eom.dev
+            paths:
+            - path: /
+              pathType: ImplementationSpecific
+        tls:
+          - hosts:
+            - collabora.eom.dev
+            secretName: collabora-tls

tasks/coturn.yaml

@@ -0,0 +1,115 @@
+---
+# tasks file for coturn
+- name: Add Small Hack repo
+  kubernetes.core.helm_repository:
+    name: small-hack-coturn
+    repo_url: https://small-hack.github.io/coturn-chart
+  register: repo
+
+- name: Update Helm repos
+  command: helm repo update
+  when: repo.changed
+
+- name: Deploy Coturn
+  kubernetes.core.helm:
+    name: coturn
+    chart_ref: small-hack-coturn/coturn
+    release_namespace: coturn
+    create_namespace: true
+    values:
+        global:
+          security:
+            allowInsecureImages: true
+        service:
+          type: LoadBalancer
+          externalTrafficPolicy: Local
+        certificate:
+          enabled: true
+          host: coturn.eom.dev
+          issuerName: ca-issuer
+        sharedSecret: "{{ coturn_shared_secret }}"
+        image:
+          tag: latest
+          pullPolicy: Always
+        externalDatabase:
+          enabled: true
+          username: coturn
+          password: "{{ coturn_admin_password }}"
+          database: coturn
+        postgresql:
+          enabled: true
+          image:
+            repository: bitnamilegacy/postgresql
+            tag: 17.6.0-debian-12-r0
+          global:
+            postgresql:
+              auth:
+                password: "{{ coturn_admin_password }}"
+          primary:
+            initdb:
+              scripts:
+                schema.sql: |
+                  CREATE TABLE turnusers_lt (
+                      realm varchar(127) default '',
+                      name varchar(512),
+                      hmackey char(128),
+                      PRIMARY KEY (realm,name)
+                  );
+
+                  CREATE TABLE turn_secret (
+                      realm varchar(127) default '',
+                      value varchar(256),
+                      primary key (realm,value)
+                  );
+
+                  CREATE TABLE allowed_peer_ip (
+                      realm varchar(127) default '',
+                      ip_range varchar(256),
+                      primary key (realm,ip_range)
+                  );
+
+                  CREATE TABLE denied_peer_ip (
+                      realm varchar(127) default '',
+                      ip_range varchar(256),
+                      primary key (realm,ip_range)
+                  );
+
+                  CREATE TABLE turn_origin_to_realm (
+                      origin varchar(127),
+                      realm varchar(127),
+                      primary key (origin)
+                  );
+
+                  CREATE TABLE turn_realm_option (
+                      realm varchar(127) default '',
+                      opt varchar(32),
+                      value varchar(128),
+                      primary key (realm,opt)
+                  );
+
+                  CREATE TABLE oauth_key (
+                      kid varchar(128),
+                      ikm_key varchar(256),
+                      timestamp bigint default 0,
+                      lifetime integer default 0,
+                      as_rs_alg varchar(64) default '',
+                      realm varchar(127),
+                      primary key (kid)
+                  );
+
+                  CREATE TABLE admin_user (
+                      name varchar(32),
+                      realm varchar(127),
+                      password varchar(127),
+                      primary key (name)
+                  );
+            persistence:
+              size: 256Gi
+        coturn:
+          realm: coturn.eom.dev
+          auth:
+            username: coturn
+            password: "{{ coturn_admin_password }}"
+          extraTurnserverConfiguration: |
+            use-auth-secret
+            static-auth-secret={{ coturn_shared_secret }}

tasks/dex.yaml

@@ -0,0 +1,97 @@
+---
+# tasks file for dex
+- name: Add Dex repo
+  kubernetes.core.helm_repository:
+    name: dex
+    repo_url: https://charts.dexidp.io
+  register: repo
+
+- name: Update Helm repos
+  command: helm repo update
+  when: repo.changed
+
+- name: Deploy PostgreSQL
+  kubernetes.core.helm:
+    name: postgresql
+    chart_ref: bitnami/postgresql
+    release_namespace: dex
+    create_namespace: true
+    values:
+      auth:
+        enablePostgresUser: true
+        postgresPassword: "{{ postgresql_admin_password }}"
+        username: "dex"
+        password: "{{ dex_admin_password }}"
+        database: "dex"
+      primary:
+        name: primary
+        initdb:
+          scripts: {}
+        persistence:
+          enabled: true
+          volumeName: "data"
+          size: 256Gi
+
+- name: Deploy Dex
+  kubernetes.core.helm:
+    name: dex
+    chart_ref: dex/dex
+    release_namespace: dex
+    create_namespace: true
+    values:
+      config:
+        issuer: https://dex.eom.dev/
+        staticClients:
+          - id: "{{ matrix_dex_oidc_client_id }}"
+            name: Matrix Auth Service
+            secret: "{{ matrix_dex_oidc_client_secret }}"
+            redirectURIs:
+              - "https://mas.eom.dev/upstream/callback/01K96AQEZKKABW34PY3R6BVNJ4"
+        storage:
+          type: postgres
+          config:
+            host: postgresql
+            port: 5432
+            databbase: dex
+            user: dex
+            password: "{{ dex_admin_password }}"
+            ssl:
+              mode: disable
+        connectors:
+          - type: ldap
+            id: ldap
+            name: LDAP
+            config:
+              host: openldap.openldap.svc.cluster.local
+              insecureNoSSL: true
+              bindDN: cn=readonly,dc=eom,dc=dev
+              bindPW: "{{ openldap_readonly_password }}"
+              userSearch:
+                baseDN: dc=eom,dc=dev
+                filter: "(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))"
+                username: uid
+                idAttr: uid
+                emailAttr: mail
+                nameAttr: givenName
+                preferredUsernameAttr: uid
+              groupSearch:
+                baseDN: dc=eom,dc=dev
+                filter: "(objectClass=groupOfUniqueNames)"
+                userMatchers:
+                - userAttr: cn
+                  groupAttr: uniqueMember
+                nameAttr: cn
+      ingress:
+        enabled: true
+        className: nginx
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        hosts:
+          - host: dex.eom.dev
+            paths:
+              - path: /
+                pathType: ImplementationSpecific
+        tls:
+          - hosts:
+              - dex.eom.dev
+            secretName: dex

tasks/discourse.yaml

@@ -0,0 +1,78 @@
+---
+# tasks file for discourse
+- name: Deploy Discourse
+  kubernetes.core.helm:
+    name: discourse
+    chart_ref: bitnami/discourse
+    release_namespace: discourse
+    create_namespace: true
+    values:
+      auth:
+        email: discourse@eom.dev
+        username: discourse_admin
+        password: "{{ discourse_admin_password }}"
+      host: "https://discourse.eom.dev"
+      siteName: 'Discourse'
+      smtp:
+        enabled: true
+        host: "postfix.eom.dev"
+        port: "587"
+        protocol: "tls"
+        user: "discourse"
+        password: "{{ discourse_admin_password }}"
+      image:
+        debug: false
+        repository: bitnamilegacy/discourse
+        tag: 3.4.7-debian-12-r0
+      service:
+        externalTrafficPolicy: Local
+      discourse:
+        skipInstall: false
+        plugins:
+          - https://github.com/discourse/discourse-adplugin
+          - https://github.com/discourse/discourse-subscriptions
+          - https://github.com/discourse/discourse-activity-pub
+          - https://github.com/discourse/discourse-openid-connect
+          - https://github.com/jonmbake/discourse-ldap-auth
+          - https://github.com/discourse/discourse-math
+          - https://github.com/discourse/discourse-post-voting
+          - https://github.com/discourse/discourse-prometheus
+          - https://github.com/discourse/discourse-reactions
+        command:
+          - /bin/bash
+        args:
+          - -c
+          - |
+            rm -r /opt/bitnami/discourse/plugins/chat
+            chown -R discourse:root /opt/bitnami/discourse/plugins
+            /opt/bitnami/scripts/discourse/entrypoint.sh /opt/bitnami/scripts/discourse/run.sh
+        persistPlugins: false
+        compatiblePlugins: true
+        resourcesPreset: none
+      persistence:
+        size: 2Ti
+      ingress:
+        enabled: true
+        ingressClassName: "nginx"
+        hostname: discourse.eom.dev
+        annotations: 
+          cert-manager.io/cluster-issuer: ca-issuer
+          nginx.ingress.kubernetes.io/proxy-set-header: "X-Forwarded-Proto $scheme"
+        tls: true
+      postgresql:
+        enabled: true
+        image:
+          repository: bitnamilegacy/postgresql
+        auth:
+          enablePostgresUser: true
+          postgresPassword: "{{ discourse_admin_password }}"
+          password: "{{ discourse_admin_password }}"
+        primary:
+          persistence:
+            size: 2Ti
+      redis:
+        enabled: true
+        image:
+          repository: bitnamilegacy/redis
+        auth:
+          password: "{{ discourse_admin_password }}"

tasks/elasticsearch.yaml

@@ -0,0 +1,21 @@
+---
+# tasks file for elasticsearch
+- name: Deploy Elasticsearch
+  kubernetes.core.helm:
+    name: elasticsearch
+    chart_ref: bitnami/elasticsearch
+    release_namespace: elasticsearch
+    create_namespace: true
+    values:
+      master:
+        replicaCount: 1
+        persistence:
+          size: 64Gi
+      coordinating:
+        replicaCount: 1
+      data:
+        replicaCount: 1
+        persistence:
+          size: 512Gi
+      ingest:
+        replicaCount: 1

tasks/full.yaml

@@ -0,0 +1,35 @@
+---
+# Tasks file for full deployment
+- name: Deploy authentication sources
+  include_tasks: "{{ item }}"
+  loop:
+    - openldap.yaml
+    - phpldapadmin.yaml
+
+- name: Populate OpenLDAP database
+  pause:
+    prompt: "Press Enter to continue..." 
+
+- name: Deploy databases
+  include_tasks: "{{ item }}"
+  loop:
+    - postgresql.yaml
+    - redis.yaml
+    - elsaticsearch.yaml
+
+- name: Deploy user services
+  include_tasks: "{{ item }}"
+  loop:
+    - postfix.yaml
+    - nextcloud.yaml
+    - mastodon.yaml
+    - jupyterhub.yaml
+    - gitea.yaml
+    - owncast.yaml
+    - mediawiki.yaml
+
+- name: Deploy monitoring
+  include_tasks: "{{ item }}"
+  loop:
+    - prometheus.yaml
+    - grafana.yaml

tasks/git.yaml

@@ -1,133 +0,0 @@
----
-# tasks file for git
-- name: Create a config map for git gitweb
-  k8s:
-    state: present
-    api_version: v1
-    kind: ConfigMap
-    name: git-gitweb
-    namespace: "eom-{{ target_namespace }}"
-    definition:
-      data: 
-        gitweb.conf: "{{ lookup('file', 'gitweb.conf') }}"
-
-- name: Create a config map for git httpd
-  vars:
-    httpd_server_name: "git.eom.dev"
-    httpd_conf_extra:
-      - httpd-auth.conf
-      - httpd-git.conf
-  k8s:
-    state: present
-    api_version: v1
-    kind: ConfigMap
-    name: git-httpd
-    namespace: "eom-{{ target_namespace }}"
-    definition:
-      data:
-        httpd.conf: "{{ lookup('template', 'httpd.conf.j2') }}"
-        httpd-auth.conf: "{{ lookup('template', 'httpd-auth.conf.j2') }}"
-        httpd-git.conf: "{{ lookup('file', 'httpd-gitweb.conf') }}"
-        mime.types: "{{ lookup('file', 'mime.types') }}"
-
-- name: Create persistent volume for git
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: PersistentVolume
-      metadata:
-        name: "eom-{{ target_namespace }}-git"
-      spec:
-        capacity:
-          storage: 32Gi
-        accessModes:
-          - ReadWriteMany
-        persistentVolumeReclaimPolicy: Retain
-        storageClassName: standard
-        hostPath:
-          path: "/data/store-0/eom-{{ target_namespace }}/git"
-        nodeAffinity:
-          required:
-            nodeSelectorTerms:
-              - matchExpressions:
-                - key: kubernetes.io/hostname
-                  operator: In
-                  values:
-                    - alpha-worker-0
-
-- name: Create a persistent volume claim for git
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: PersistentVolumeClaim
-      metadata:
-        name: git
-        namespace: "eom-{{ target_namespace }}"
-      spec:
-        accessModes:
-          - ReadWriteMany
-        resources:
-          requests:
-            storage: 32Gi
-        storageClassName: standard
-        volumeName: "eom-{{ target_namespace }}-git"
-
-- name: Create a deployment
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Deployment
-      metadata:
-        name: git
-        namespace: "eom-{{ target_namespace }}"
-      spec:
-        replicas: 1
-        selector:
-          matchLabels:
-            app: git
-        template:
-          metadata:
-            labels:
-              app: git
-          spec:
-            containers:
-              - name: gitweb
-                image: ericomeehan/gitweb
-                volumeMounts:
-                  - name: gitweb-config
-                    mountPath: /etc/gitweb.conf
-                    subPath: gitweb.conf
-                  - name: httpd-config
-                    mountPath: /usr/local/apache2/conf
-                  - name: data
-                    mountPath: /usr/local/apache2/htdocs
-                ports:
-                  - containerPort: 80
-            volumes:
-              - name: gitweb-config
-                configMap:
-                  name: git-gitweb
-              - name: httpd-config
-                configMap:
-                  name: git-httpd
-              - name: data
-                persistentVolumeClaim:
-                  claimName: git
-
-- name: Expose deployment as a service
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Service
-      metadata:
-        name: git
-        namespace: "eom-{{ target_namespace }}"
-      spec:
-        selector:
-          app: git
-        ports:
-          - port: 80
-            name: git-80
-        type: ClusterIP

tasks/gitea.yaml

@@ -0,0 +1,119 @@
+---
+# tasks file for gitea
+- name: Add gitea repo
+  kubernetes.core.helm_repository:
+    name: gitea
+    repo_url: https://dl.gitea.com/charts/
+  register: repo_update
+
+- name: Update Helm repos
+  command: helm repo update
+  when: repo_update.changed
+
+- name: Deploy Gitea
+  kubernetes.core.helm:
+    name: gitea
+    chart_ref: gitea/gitea
+    release_namespace: gitea
+    create_namespace: true
+    values:
+      image:
+        pullPolicy: IfNotPresent
+      service:
+        ssh:
+          type: LoadBalancer
+      ingress:
+        enabled: true
+        className: nginx
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        hosts:
+          - host: gitea.eom.dev
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+            - gitea.eom.dev
+            secretName: gitea-tls
+      persistence:
+        size: 2Ti
+      actions:
+        enabled: true
+        provisioning:
+          enabled: true
+        statefulset:
+          actRunner:
+            config: |
+              log:                                                                                                                            
+                level: debug                                                                                                                  
+              cache:                                                                                                                          
+                enabled: false                                                                                                                
+              runner:
+                labels:
+                  - "ubuntu-latest:docker://node:16-bullseye"
+                  - "ubuntu-22.04:docker://node:16-bullseye"
+                  - "ubuntu-20.04:docker://node:16-bullseye"
+                  - "ubuntu-18.04:docker://node:16-buster"
+      gitea:
+        metrics:
+          enabled: true
+        admin:
+          username: gitea_admin
+          password: "{{ gitea_admin_password }}"
+          email: gitea@postfix.eom.dev
+        ldap:
+          - name: OpenLDAP
+            securityProtocol: unencrypted
+            host: openldap.openldap.svc.cluster.local
+            port: 389
+            userSearchBase: dc=eom,dc=dev
+            userFilter: (&(objectClass=posixAccount)(uid=%s)(memberOf=cn=Gitea Users,ou=Gitea,ou=Services,dc=eom,dc=dev))
+            adminFilter: (memberOf=cn=Gitea Administrators,ou=Gitea,ou=Services,dc=eom,dc=dev)
+            emailAttribute: mail
+            bindDn: cn=readonly,dc=eom,dc=dev
+            bindPassword: "{{ openldap_readonly_password }}"
+            usernameAttribute: uid
+            publicSSHKeyAttribute: sshPublicKey
+        config:
+          APP_NAME: "Gitea"
+          service:
+            DISABLE_REGISTRATION: false
+            SHOW_REGISTRATION_BUTTON: false
+            DEFAULT_ALLOW_CREATE_ORGANIZATION: false
+            ALLOW_ONLY_EXTERNAL_REGISTRATION: true
+          oauth2_client:
+            ENABLE_AUTO_REGISTRATION: true
+            UPDATE_AVATAR: true
+            ACCOUNT_LINKING: auto
+          mailer:
+            ENABLED: true
+            SMTP_ADDR: postfix.eom.dev
+            SMTP_PORT: 587
+            USER: gitea
+            PASSWD: "{{ gitea_admin_password }}"
+            FROM: Gitea <gitea@eom.dev>
+            ENVELOPE_FROM: gitea@eom.dev
+      redis:
+        enabled: true
+        global:
+          redis:
+            password: "{{ gitea_admin_password }}"
+        persistence:
+          enabled: true
+      redis-cluster:
+        enabled: false
+      postgresql:
+        enabled: true
+        global:
+          postgresql:
+            auth:
+              username: gitea
+              password: "{{ gitea_admin_password }}"
+              database: gitea
+        primary:
+          persistence:
+            enabled: true
+            size: 2Ti
+      postgresql-ha:
+        enabled: false

tasks/grafana-matrix-forwarder.yaml

@@ -0,0 +1,60 @@
+---
+# tasks file for grafana-matrix-forwarder
+- name: Create Grafana Matrix Forwarder namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: grafana-matrix-forwarder
+
+- name: Create a Deployment for Grafana Matrix Forwarder
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: matrix-forwarder
+        namespace: grafana-matrix-forwarder
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: matrix-forwarder
+        template:
+          metadata:
+            labels:
+              app: matrix-forwarder
+          spec:
+            containers:
+              - name: matrix-forwarder
+                image: registry.gitlab.com/hctrdev/grafana-matrix-forwarder
+                ports:
+                  - containerPort: 6000
+                env:
+                  - name: GMF_MATRIX_USER
+                    value: grafana
+                  - name: GMF_MATRIX_PASSWORD
+                    value: "{{ grafana_admin_password }}"
+                  - name: GMF_MATRIX_HOMESERVER
+                    value: synapse.eom.dev
+                  - name: GMF_RESOLVE_MODE
+                    value: reply
+
+- name: Expose GMF Deployment as a Service
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: matrix-forwarder
+        namespace: grafana-matrix-forwarder
+      spec:
+        selector:
+          app: matrix-forwarder
+        ports:
+          - port: 80
+            targetPort: 6000
+            name: http
+        type: ClusterIP

tasks/grafana.yaml

@@ -0,0 +1,61 @@
+---
+# tasks file for grafana
+- name: Deploy Grafana
+  kubernetes.core.helm:
+    name: grafana
+    chart_ref: bitnami/grafana
+    release_namespace: grafana
+    create_namespace: true
+    values:
+      metrics:
+        enabled: true
+      admin:
+        user: grafana_admin
+        password: "{{ grafana_admin_password }}"
+      persistence:
+        size: 64Gi
+      grafana:
+        extraEnvVars:
+          - name: GF_SERVER_DOMAIN
+            value: grafana.eom.dev
+          - name: GF_SERVER_ROOT_URL
+            value: https://grafana.eom.dev/
+      smtp:
+        enabled: true
+        user: grafana
+        password: "{{ grafana_admin_password }}"
+        host: mail.eom.dev:587
+        fromAddress: grafana@eom.dev
+        fromName: Grafana
+      ldap:
+        enabled: true
+        allowSignUp: true
+        configuration: "{{ lookup('template', 'ldap.toml.j2') }}"
+      ingress:
+        enabled: true
+        pathType: Prefix
+        hostname: grafana.eom.dev
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        ingressClassName: nginx
+        tls: true
+      datasources:
+        secretDefinition:
+          apiVersion: 1
+          datasources:
+            - name: Prometheus
+              type: prometheus
+              access: proxy
+              orgId: 1
+              url: http://prometheus-server.prometheus.svc.cluster.local
+              version: 1
+              editable: true
+              isDefault: true
+            - name: Alertmanager
+              uid: alertmanager
+              type: alertmanager
+              access: proxy
+              orgId: 1
+              url: http://prometheus-alertmanager.prometheus.svc.cluster.local
+              version: 1
+              editable: true

tasks/influxdb.yaml

@@ -0,0 +1,122 @@
+---
+# tasks file for grafana
+- name: Create InfluxDB namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: influxdb
+
+- name: Create PVC for InfluxDB
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: influxdb
+        namespace: influxdb
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 128Gi
+
+- name: Create Deployment for InfluxDB
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: influxdb
+        namespace: influxdb
+        labels:
+          app: influxdb
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: influxdb
+        template:
+          metadata:
+            labels:
+              app: influxdb
+          spec:
+            containers:
+              - name: influxdb
+                image: influxdb
+                env:
+                  - name: DOCKER_INFLUXDB_INIT_MODE
+                    value: setup
+                  - name: DOCKER_INFLUXDB_INIT_USERNAME
+                    value: influxdb
+                  - name: DOCKER_INFLUXDB_INIT_PASSWORD
+                    value: "{{ influxdb_admin_password }}"
+                  - name: DOCKER_INFLUXDB_INIT_ORG
+                    value: DevOps
+                  - name: DOCKER_INFLUXDB_INIT_BUCKET
+                    value: default
+                  - name: DOCKER_INFLUXDB_INIT_RETENTION
+                    value: 1w
+                  - name: DOCKER_INFLUXDB_INIT_ADMIN_TOKEN
+                    value: "{{ influxdb_admin_token }}"
+                volumeMounts:
+                  - name: data
+                    mountPath: /var/lib/influxdb
+                ports:
+                  - containerPort: 8086
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: influxdb
+
+- name: Create Service for InfluxDB
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: influxdb
+        namespace: influxdb
+      spec:
+        selector:
+          app: influxdb
+        ports:
+          - port: 80
+            targetPort: 8086
+            name: influxdb
+        type: ClusterIP
+
+- name: Create Ingress for InfluxDB
+  k8s:
+    state: present
+    definition:
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        name: influxdb
+        namespace: influxdb
+      spec:
+        ingressClassName: nginx
+        rules:
+          - host: influxdb.eom.dev
+            http:
+              paths:
+                - pathType: Prefix
+                  path: /
+                  backend:
+                    service:
+                      name: influxdb
+                      port:
+                        number: 80
+        tls:
+          - hosts:
+            - influxdb.eom.dev
+            secretName: influxdb

tasks/jupyterhub.yaml

@@ -0,0 +1,99 @@
+---
+# tasks file for jupyter hub
+- name: Add jupyter repository
+  kubernetes.core.helm_repository:
+    name: jupyterhub
+    repo_url: https://hub.jupyter.org/helm-chart/
+  register: repo
+
+- name: Update Helm repos
+  command: helm repo update
+  when: repo.changed
+
+- name: Deploy Jupyter Hub
+  kubernetes.core.helm:
+    name: jupyterhub
+    chart_ref: jupyterhub/jupyterhub
+    release_namespace: jupyterhub
+    create_namespace: true
+    values:
+      prePuller:
+        hook:
+          enabled: false
+        continuous:
+          enabled: false
+      hub:
+        config:
+          Authenticator:
+            admin_users:
+              - jupyterhub
+              - eric
+            allow_all: true
+          JupyterHub:
+            admin_access: true
+            authenticator_class: ldapauthenticator.LDAPAuthenticator
+          LDAPAuthenticator:
+            server_address: openldap.openldap.svc.cluster.local
+            server_port: 389
+            use_ssl: false
+            tls_strategy: insecure
+            lookup_dn: true
+            lookup_dn_search_user: cn=readonly,dc=eom,dc=dev
+            lookup_dn_search_password: "{{ openldap_readonly_password }}"
+            lookup_dn_search_filter: (&(objectClass=posixAccount)({login_attr}={login})(memberOf=cn=JupyterHub Users,ou=JupyterHub,ou=Services,dc=eom,dc=dev))
+            lookup_dn_user_dn_attribute: cn
+            user_search_base: dc=eom,dc=dev
+            user_attribute: uid
+      singleuser:
+        extraFiles:
+          jupyter_notebook_config.json:
+            mountPath: /etc/jupyter/jupyter_notebook_config.json
+            # data is a YAML structure here but will be rendered to JSON file as our
+            # file extension is ".json".
+            data:
+              MappingKernelManager:
+                cull_idle_timeout: 1200
+                cull_interval: 120
+                cull_connected: true
+                cull_busy: false
+        storage:
+          capacity: 64Gi
+        image:
+          name: jupyter/minimal-notebook
+          tag: latest
+          pullPolicy: IfNotPresent
+        memory:
+          guarantee: 1G
+        profileList:
+          - display_name: Minimal notebook
+            description: Command-line tools useful when working in Jupyter applications
+            kubespawner_override:
+              image: jupyter/minimal-notebook
+              tag: latest
+              pullPolicy: IfNotPresent
+            default: true
+          - display_name: Tensorflow notebook
+            description: Python deep learning libraries
+            kubespawner_override:
+              image: jupyter/tensorflow-notebook
+              tag: latest
+              pullPolicy: IfNotPresent
+          - display_name: Data science notebook
+            description: Libraries for data analysis from the Python, R, and Julia communities
+            kubespawner_override:
+              image: jupyter/datascience-notebook
+              tag: latest
+              pullPolicy: IfNotPresent
+      ingress:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        ingressClassName: nginx
+        hosts:
+          - jupyterhub.eom.dev
+        pathSuffix:
+        pathType: Prefix
+        tls:
+          - hosts:
+            - jupyterhub.eom.dev
+            secretName: jupyterhub-tls

tasks/lemmy.yaml

@@ -0,0 +1,131 @@
+---
+# tasks file for lemmy
+- name: Create lemmy namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: lemmy
+
+- name: Create a persistent volume claim for lemmy
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: config
+        namespace: lemmy
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 2Ti
+
+- name: Create a persistent volume claim for lemmy
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: lemmy
+        namespace: lemmy
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 2Ti
+
+- name: Create a deployment for lemmy
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: lemmy
+        namespace: lemmy
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: lemmy
+        template:
+          metadata:
+            labels:
+              app: lemmy
+          spec:
+            containers:
+              - name: lemmy
+                image: dessalines/lemmy:0.19.11
+                volumeMounts:
+                  - name: config
+                    mountPath: /tmp/docker-lemmyserver
+                  - name: ssl
+                    mountPath: /etc/letsencrypt
+                  - name: lemmy
+                    mountPath: /var/lemmy
+                ports:
+                  - containerPort: 25
+                env:
+                  - name: OVERRIDE_HOSTNAME
+                    value: "postfix.eom.dev"
+            volumes:
+              - name: lemmy
+                persistentVolumeClaim:
+                  claimName: lemmy
+
+- name: Create a deployment for lemmy-ui
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: lemmy-ui
+        namespace: lemmy
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: lemmy-ui
+        template:
+          metadata:
+            labels:
+              app: lemmy-ui
+          spec:
+            containers:
+              - name: lemmy-ui
+                image: dessalines/lemmy-ui:0.19.11
+                volumeMounts:
+                  - name: lemmy
+                    mountPath: /var/lemmy
+                ports:
+                  - containerPort: 25
+                env:
+                  - name: OVERRIDE_HOSTNAME
+                    value: "postfix.eom.dev"
+            volumes:
+              - name: lemmy
+                persistentVolumeClaim:
+                  claimName: lemmy
+
+- name: Expose deployment as a service
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: lemmy
+        namespace: lemmy
+      spec:
+        selector:
+          app: lemmy
+        ports:
+          - port: 25
+            name: smtp-a
+        type: LoadBalancer
+        externalTrafficPolicy: Local

tasks/localai.yaml

@@ -0,0 +1,61 @@
+---
+# tasks file for localai
+- name: Add skynet repo
+  kubernetes.core.helm_repository:
+    name: go-skynet
+    repo_url: https://go-skynet.github.io/helm-charts/
+  register: repo_update
+
+- name: Update Helm repos
+  command: helm repo update
+  when: repo_update.changed
+
+- name: Deploy LocalAI
+  kubernetes.core.helm:
+    name: localai
+    chart_ref: go-skynet/local-ai
+    release_namespace: localai
+    create_namespace: true
+    values:
+      deployment:
+        image:
+          tag: latest-gpu-nvidia-cuda-12
+        runtimeClassName: nvidia
+        secretEnv:
+          - name: LOCALAI_DISABLE_WEBUI
+            value: "true"
+          - name: LOCALAI_API_KEY
+            value: "{{ localai_api_keys | join(',') }}"
+          - name: LOCALAI_WATCHDOG_IDLE
+            value: "true"
+          - name: LOCALAI_WATCHDOG_IDLE_TIMEOUT
+            value: "5m"
+          - name: LOCALAI_WATCHDOG_BUSY
+            value: "true"
+      resources:
+        limits:
+          nvidia.com/gpu: 1
+      persistence:
+        models:
+          size: 256Gi
+        output:
+          size: 128Gi
+      tolerations:
+        - key: specialResources
+          operator: Equal
+          value: GPU
+          effect: NoSchedule
+      ingress:
+        enabled: true
+        className: nginx
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        hosts:
+          - host: localai.eom.dev
+            paths:
+              - path: /
+                pathType: ImplementationSpecific
+        tls:
+          - secretName: localai-tls
+            hosts:
+              - localai.eom.dev

tasks/luanti.yaml

@@ -0,0 +1,20 @@
+---
+# tasks file for luanti
+- name: Deploy Luanti
+  kubernetes.core.helm:
+    name: luanti
+    chart_ref: oci://tccr.io/truecharts/minetest
+    release_namespace: luanti
+    create_namespace: true
+    values:
+      service:
+        main:
+          type: LoadBalancer
+          externalTrafficPolicy: Local
+      workload:
+        main:
+          podSpec:
+            containers:
+              main:
+                env:
+                  CLI_ARGS: --gameid minetest_game

tasks/mail.yaml

@@ -1,42 +1,78 @@
 ---
 # tasks file for mail
-- name: Create ConfigMap for mail
+- name: Create DMS namespace
-  k8s:
-    state: present
-    api_version: v1
-    kind: ConfigMap
-    name: mail
-    namespace: "eom-{{ target_namespace }}"
-    definition:
-      data:
-        server.crt: "{{ proxy_server_crt }}"
-        server.key: "{{ proxy_server_key }}"
-
-- name: Create persistent volume for mail
   k8s:
     state: present
     definition:
       apiVersion: v1
-      kind: PersistentVolume
+      kind: Namespace
       metadata:
-        name: "eom-{{ target_namespace }}-mail"
+        name: mail
+
+- name: Request a certificate for DMS
+  k8s:
+    state: present
+    definition:
+      apiVersion: cert-manager.io/v1
+      kind: Certificate
+      metadata:
+        name: mail
+        namespace: mail
+      spec:
+        secretName: mail
+        privateKey:
+          algorithm: RSA
+          encoding: PKCS1
+          size: 2048
+        duration: 2160h # 90d
+        renewBefore: 360h # 15d
+        isCA: false
+        usages:
+          - server auth
+          - client auth
+        subject:
+          organizations:
+            - EOM
+        commonName: eom.dev
+        dnsNames:
+          - eom.dev
+          - postfix.eom.dev
+          - dovecot.eom.dev
+        issuerRef:
+          name: ca-issuer
+          kind: ClusterIssuer
+
+- name: Create a persistent volume claim for mail
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: dkim
+        namespace: mail
       spec:
-        capacity:
-          storage: 32Gi
         accessModes:
           - ReadWriteOnce
-        persistentVolumeReclaimPolicy: Retain
+        resources:
-        storageClassName: standard
+          requests:
-        hostPath:
+            storage: 512Mi
-          path: "/data/store-0/eom-{{ target_namespace }}/mail"
+
-        nodeAffinity:
+- name: Create a persistent volume claim for mail
-          required:
+  k8s:
-            nodeSelectorTerms:
+    state: present
-              - matchExpressions:
+    definition:
-                - key: kubernetes.io/hostname
+      apiVersion: v1
-                  operator: In
+      kind: PersistentVolumeClaim
-                  values:
+      metadata:
-                    - alpha-worker-0
+        name: config
+        namespace: mail
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 2Gi
 
 - name: Create a persistent volume claim for mail
   k8s:
@@ -46,15 +82,13 @@
       kind: PersistentVolumeClaim
       metadata:
         name: mail
-        namespace: "eom-{{ target_namespace }}"
+        namespace: mail
       spec:
         accessModes:
           - ReadWriteOnce
         resources:
           requests:
-            storage: 32Gi
+            storage: 2Ti
-        storageClassName: standard
-        volumeName: "eom-{{ target_namespace }}-mail"
 
 - name: Create a deployment
   k8s:
@@ -63,7 +97,7 @@
       kind: Deployment
       metadata:
         name: mail
-        namespace: "eom-{{ target_namespace }}"
+        namespace: mail
       spec:
         replicas: 1
         selector:
@@ -77,70 +111,114 @@
             containers:
               - name: mail
                 image: mailserver/docker-mailserver
+                securityContext:
+                  # `allowPrivilegeEscalation: true` is required to support SGID via the `postdrop`
+                  # executable in `/var/mail-state` for Postfix (maildrop + public dirs):
+                  # https://github.com/docker-mailserver/docker-mailserver/pull/3625
+                  allowPrivilegeEscalation: true
+                  readOnlyRootFilesystem: false
+                  runAsUser: 0
+                  runAsGroup: 0
+                  runAsNonRoot: false
+                  privileged: false
+                  capabilities:
+                    add:
+                      # file permission capabilities
+                      - CHOWN
+                      - FOWNER
+                      - MKNOD
+                      - SETGID
+                      - SETUID
+                      - DAC_OVERRIDE
+                      # network capabilities
+                      - NET_ADMIN  # needed for F2B
+                      - NET_RAW    # needed for F2B
+                      - NET_BIND_SERVICE
+                      # miscellaneous  capabilities
+                      - SYS_CHROOT
+                      - KILL
+                    drop: [ALL]
+                  seccompProfile:
+                    type: RuntimeDefault
                 volumeMounts:
+                  - name: config
+                    mountPath: /tmp/docker-mailserver
                   - name: ssl
                     mountPath: /etc/letsencrypt
                   - name: mail
                     mountPath: /var/mail
+                  - name: dkim
+                    mountPath: /tmp/docker-mailserver/opendkim
                 ports:
                   - containerPort: 25
                   - containerPort: 465
                   - containerPort: 587
                   - containerPort: 993
+                  - containerPort: 995
                 env:
                   - name: OVERRIDE_HOSTNAME
-                    value: "mail.eom.dev"
+                    value: "postfix.eom.dev"
+                  - name: POSTMASTER_ADDRESS
+                    value: "postfix@eom.dev"
+                  - name: ENABLE_POP3
+                    value: "1"
                   - name: ACCOUNT_PROVISIONER
                     value: "LDAP"
                   - name: LDAP_SERVER_HOST
-                    value: "ldap://openldap/"
+                    value: "ldap://openldap.openldap.svc.cluster.local/"
                   - name: LDAP_SEARCH_BASE
                     value: "dc=eom,dc=dev"
                   - name: LDAP_BIND_DN
-                    value: "cn=admin,dc=eom,dc=dev"
+                    value: "cn=readonly,dc=eom,dc=dev"
                   - name: LDAP_BIND_PW
-                    value: "{{ ldap_admin_password }}"
+                    value: "{{ openldap_readonly_password }}"
-                  - name: LDAP_QUERY_FILTER_USER
-                    value: "(&(mail=%s))"
-                  - name: LDAP_QUERY_FILTER_GROUP
-                    value: "(&(mailGroupMember=%s)(mailEnabled=TRUE))"
-                  - name: LDAP_QUERY_FILTER_ALIAS
-                    value: "(|(&(mailAlias=%s)(objectClass=PostfixBookMailForward))(&(mailAlias=%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE)))"
                   - name: LDAP_QUERY_FILTER_DOMAIN
-                    value: "(|(&(mail=*@%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE))(&(mailGroupMember=*@%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE))(&(mailalias=*@%s)(objectClass=PostfixBookMailForward)))"
+                    value: "(mail=*@%s)"
-                  - name: DOVECOT_PASS_FILTER
+                  - name: LDAP_QUERY_FILTER_USER
-                    value: "(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%n))"
+                    value: "(&(mail=%s)(memberOf=cn=Postfix Users,ou=Postfix,ou=Services,dc=eom,dc=dev))"
+                  - name: LDAP_QUERY_FILTER_ALIAS
+                    value: "(&(objectClass=posixAccount)(mailAlias=%s))"
+                  - name: LDAP_QUERY_FILTER_GROUP
+                    value: "(&(objectClass=posixAccount)(mailGroupMember=%s))"
+                  - name: LDAP_QUERY_FILTER_SENDERS
+                    value: "(&(objectClass=posixAccount)(|(mail=%s)(mailAlias=%s)(mailGroupMember=%s)))"
+                  - name: SPOOF_PROTECTION
+                    value: "1"
+                  - name: DOVECOT_AUTH_BIND
+                    value: "yes"
+                  - name: DOVECOT_DEFAULT_PASS_SCHEME
+                    value: "MD5-CRYPT"
                   - name: DOVECOT_USER_FILTER
-                    value: "(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%n))"
+                    value: "(&(objectClass=posixAccount)(uid=%n)(memberOf=cn=Dovecot Users,ou=Dovecot,ou=Services,dc=eom,dc=dev))"
+                  - name: DOVECOT_PASS_ATTRS
+                    value: "uid=user,userPassword=password"
+                  - name: DOVECOT_USER_ATTRS
+                    value: "=home=/var/mail/%{ldap:uid},=uid=%{ldap:uidNumber},=gid=%{ldap:gidNumber},=mail=maildir:~/Maildir"
                   - name: ENABLE_SASLAUTHD
                     value: "1"
                   - name: SASLAUTHD_MECHANISMS
                     value: "ldap"
-                  - name: SASLAUTHD_LDAP_SERVER
-                    value: "ldap://openldap/"
-                  - name: SASLAUTHD_LDAP_BIND_DN
-                    value: "cn=admin,dc=eom,dc=dev"
-                  - name: SASLAUTHD_LDAP_PASSWORD
-                    value: "{{ ldap_admin_password }}"
-                  - name: SASLAUTHD_LDAP_SEARCH_BASE
-                    value: "dc=eom,dc=dev"
                   - name: SASLAUTHD_LDAP_FILTER
-                    value: "(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%U))"
+                    value: "(mail=%U@eom.dev)"
-                  - name: POSTMASTER_ADDRESS
-                    value: "admin@mail.eom.dev"
                   - name: SSL_TYPE
                     value: "manual"
                   - name: SSL_CERT_PATH
-                    value: "/etc/letsencrypt/server.crt"
+                    value: "/etc/letsencrypt/tls.crt"
                   - name: SSL_KEY_PATH
-                    value: "/etc/letsencrypt/server.key"
+                    value: "/etc/letsencrypt/tls.key"
             volumes:
               - name: ssl
-                configMap:
+                secret:
-                  name: mail
+                  secretName: mail
+              - name: config
+                persistentVolumeClaim:
+                  claimName: config
               - name: mail
                 persistentVolumeClaim:
                   claimName: mail
+              - name: dkim
+                persistentVolumeClaim:
+                  claimName: dkim
 
 - name: Expose deployment as a service
   k8s:
@@ -149,21 +227,20 @@
       kind: Service
       metadata:
         name: mail
-        namespace: "eom-{{ target_namespace }}"
+        namespace: mail
       spec:
         selector:
           app: mail
         ports:
           - port: 25
-            name: mail-25
+            name: smtp-a
-            nodePort: 30025
           - port: 465
-            name: mail-465
+            name: smtp-b
-            nodePort: 30465
           - port: 587
-            name: mail-587
+            name: smtps
-            nodePort: 30587
           - port: 993
-            name: mail-993
+            name: imap
-            nodePort: 30993
+          - port: 995
-        type: NodePort
+            name: pop3
+        type: LoadBalancer
+        externalTrafficPolicy: Local

tasks/main.yaml

@@ -0,0 +1,6 @@
+---
+# tasks file for eom
+- name: Deploy
+  include_tasks: "{{ item }}"
+  loop:
+    - localai.yaml

tasks/main.yml

@@ -1,48 +0,0 @@
----
-# tasks file for eom
-- name: Create eom namespace
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: Namespace
-      metadata:
-        name: "eom-{{ target_namespace }}"
-
-- name: Deploy eom openldap
-  include_tasks: openldap.yaml
-
-- name: Deploy eom proxy
-  include_tasks: proxy.yaml
-
-- name: Deploy eom git
-  include_tasks: git.yaml
-
-- name: Deploy eom media
-  include_tasks: media.yaml
-
-- name: Deploy eom www
-  include_tasks: www.yaml
-
-- name: Create network policy
-  k8s:
-    state: present
-    definition:
-      apiVersion: networking.k8s.io/v1
-      kind: NetworkPolicy
-      metadata:
-        name: restrict-external-access
-        namespace: "eom-{{ target_namespace }}"
-      spec:
-        podSelector:
-          matchExpressions:
-            - key: app
-              operator: In
-              values:
-                - proxy
-        policyTypes:
-        - Ingress
-        ingress:
-        - from:
-          - ipBlock:
-              cidr: 192.168.1.0/24

tasks/mariadb.yaml

@@ -0,0 +1,95 @@
+---
+# tasks file for mariadb
+- name: Create persistent volume for mariadb
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolume
+      metadata:
+        name: "eom-{{ target_namespace }}-mariadb"
+      spec:
+        capacity:
+          storage: 32Gi
+        accessModes:
+          - ReadWriteMany
+        persistentVolumeReclaimPolicy: Retain
+        storageClassName: standard
+        hostPath:
+          path: "/data/store-0/eom-{{ target_namespace }}/mariadb"
+        nodeAffinity:
+          required:
+            nodeSelectorTerms:
+              - matchExpressions:
+                - key: kubernetes.io/hostname
+                  operator: In
+                  values:
+                    - alpha-worker-0
+
+- name: Create a persistent volume claim for mariadb
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: mariadb
+        namespace: "eom-{{ target_namespace }}"
+      spec:
+        accessModes:
+          - ReadWriteMany
+        resources:
+          requests:
+            storage: 32Gi
+        storageClassName: standard
+        volumeName: "eom-{{ target_namespace }}-mariadb"
+
+- name: Create a deployment
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: mariadb
+        namespace: "eom-{{ target_namespace }}"
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: mariadb
+        template:
+          metadata:
+            labels:
+              app: mariadb
+          spec:
+            containers:
+              - name: mariadb
+                image: mariadb
+                volumeMounts:
+                  - name: data
+                    mountPath: /var/lib/mysql
+                ports:
+                  - containerPort: 3306
+                env:
+                  key: MARIADB_ROOT_PASSWORD
+                  value: "{{ mariadb_root_password }}"
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: mariadb
+
+- name: Expose deployment as a service
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: mariadb
+        namespace: "eom-{{ target_namespace }}"
+      spec:
+        selector:
+          app: mariadb
+        ports:
+          - port: 3306
+            name: mariadb-3306
+        type: ClusterIP

tasks/mastodon.yaml

@@ -0,0 +1,105 @@
+---
+# tasks file for mastodon
+- name: Deploy Mastodon
+  kubernetes.core.helm:
+    name: mastodon
+    chart_ref: bitnami/mastodon
+    release_namespace: mastodon
+    create_namespace: true
+    timeout: 600s
+    values:
+      metrics:
+        enabled: true
+      initJob:
+        precompileAssets:
+          resources:
+            requests:
+              cpu: 0m
+              memory: 0Mi
+            limits:
+              cpu: 1.5
+              memory: 8192Mi
+      adminUser: mastodon_admin
+      adminEmail: mastodon_admin@postfix.eom.dev
+      adminPassword: "{{ mastodon_admin_password }}"
+      otpSecret: "{{ mastodon_otp_secret }}"
+      secretKeyBase: "{{ mastodon_secret_key_base }}"
+      vapidPrivateKey: "{{ mastodon_vapid_private_key }}"
+      vapidPublicKey: "{{ mastodon_vapid_public_key }}"
+      activeRecordEncryptionDeterministicKey: "{{ mastodon_active_record_encryption_deterministic_key }}"
+      activeRecordEncryptionKeyDerivationSalt: "{{ mastodon_active_record_encryption_key_derivation_salt }}"
+      activeRecordEncryptionPrimaryKey: "{{ mastodon_active_record_encryption_primary_key }}"
+      extraConfig:
+        LDAP_ENABLED: "true"
+        LDAP_HOST: openldap.openldap.svc.cluster.local
+        LDAP_PORT: "389"
+        LDAP_METHOD: plain
+        LDAP_BASE: dc=eom,dc=dev
+        LDAP_BIND_DN: cn=readonly,dc=eom,dc=dev
+        LDAP_PASSWORD: "{{ openldap_readonly_password }}"
+        LDAP_UID: uid
+        LDAP_SEARCH_FILTER: (&(objectClass=posixAccount)(|(%{uid}=%{email})(%{mail}=%{email}))(memberOf=cn=Mastodon Users,ou=Mastodon,ou=Services,dc=eom,dc=dev))
+        LDAP_MAIL: mail
+        OIDC_ENABLED: "true"
+        OIDC_DISPLAY_NAME: Google
+        OIDC_ISSUER: https://accounts.google.com
+        OIDC_DISCOVERY: "true"
+        OIDC_SCOPE: openid,profile,email
+        OIDC_UID_FIELD:
+        OIDC_CLIENT_ID: "{{ mastodon_google_oidc_client_id }}"
+        OIDC_CLIENT_SECRET: "{{ mastodon_google_oidc_client_secret }}"
+        OIDC_REDIRECT_URI: https://mastodon.eom.dev/auth/auth/openid_connect/callback
+      localDomain: mastodon.eom.dev
+      smtp:
+        server: postfix.eom.dev
+        port: 587
+        from_address: mastodon@postfix.eom.dev
+        domain: postfix.eom.dev
+        reply_to: mastodon@postfix.eom.dev
+        delivery_method: smtp
+        tls: true
+        auth_method: starttls
+        login: mastodon
+        password: "{{ mastodon_admin_password }}"
+      persistence:
+        enabled: true
+        size: 2Ti
+      redis:
+        enabled: true
+        auth:
+          password: "{{ mastodon_admin_password }}"
+      postgresql:
+        enabled: true
+        auth:
+          username: mastodon
+          password: "{{ mastodon_admin_password }}"
+          database: mastodon
+        primary:
+          persistence:
+            enabled: true
+            size: 2Ti
+      elasticsearch:
+        enabled: false
+        master:
+          persistence:
+            size: 64Gi
+        data:
+          persistence:
+            size: 512Gi
+      minio:
+        enabled: false
+      apache:
+        service:
+          type: ClusterIP 
+          ports:
+            http: 80
+        ingress:
+          enabled: true
+          hostname: mastodon.eom.dev
+          annotations:
+            kubernetes.io/ingress.class: nginx
+            cert-manager.io/cluster-issuer: ca-issuer
+          tls:
+            - hosts:
+              - mastodon.eom.dev
+              secretName: mastodon-tls

tasks/matrix-auth-service.yaml

@@ -0,0 +1,141 @@
+---
+# tasks file for synapse
+- name: Add Small Hack repo
+  kubernetes.core.helm_repository:
+    name: small-hack-matrix-auth-service
+    repo_url: https://small-hack.github.io/matrix-authentication-service-chart
+  register: repo
+
+- name: Update Helm repos
+  command: helm repo update
+  when: repo.changed
+
+- name: Deploy Matrix Auth Service
+  kubernetes.core.helm:
+    name: matrix-auth-service
+    chart_ref: small-hack-matrix-auth-service/matrix-authentication-service
+    release_namespace: matrix-auth-service
+    create_namespace: true
+    values:
+      fullnameOverride: mas
+      image:
+        pullPolicy: IfNotPresent
+        tag: latest
+      http:
+        public_base: https://matrix-auth-service.eom.dev/
+      ingress:
+        className: nginx
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        hosts:
+          - host: matrix-auth-service.eom.dev
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - secretName: mas-tls
+            hosts:
+              - matrix-auth-service.eom.dev
+      postgresql:
+        enabled: true
+        global:
+          auth:
+            password: "{{ matrix_auth_service_admin_password }}"
+      mas:
+        http:
+          public_base: https://matrix-auth-service.eom.dev/
+        policy:
+          client_registration:
+            allow_host_mismatch: false
+            allow_insecure_uris: false
+        clients:
+          - client_id: 0000000000000000000SYNAPSE
+            client_auth_method: client_secret_basic
+            client_secret: 5ZrwKXmKdiQfus2J
+        matrix:
+          homeserver: synapse.eom.dev
+          endpoint: https://synapse.eom.dev
+          secret: SacP5rWpci6GMqb2
+        email:
+          from: Matrix Auth Service <matrix-auth-service@eom.dev>
+          reply_to: Matrix Auth Service <matrix-auth-service@eom.dev>
+          transport: smtp
+          mode: tls
+          hostname: postfix.eom.dev
+          port: 587
+          username: matrix-auth-service
+          password: "{{ matrix_auth_service_admin_password }}"
+        upstream_oauth2:
+          providers:
+            - id: 01JG22H4F0G8PYCZ5HVTQVHBC4
+              issuer: https://google.com/
+              human_name: Google
+              brand_name: google
+              pkce_method: auto
+              client_id: "{{ matrix_google_oidc_client_id }}"
+              client_secret: "{{ matrix_google_oidc_client_secret }}"
+              token_endpoint_auth_method: client_secret_basic
+              scope: "openid email profile"
+              discovery_mode: oidc
+              claims_imports:
+                subject:
+                  template: "{{ '{{ user.sub }}' | quote }}"
+
+                # -- The localpart is the local part of the user's Matrix ID.
+                # For example, on the `example.com` server, if the localpart is `alice`,
+                #  the user's Matrix ID will be `@alice:example.com`.
+                localpart:
+                  action: require
+                  template: "{{ '{{ user.preferred_username }}' | quote }}"
+
+                # -- The display name is the user's display name.
+                displayname:
+                  action: suggest
+                  template: "{{ '{{ user.name }}' | quote }}"
+
+                # -- An email address to import.
+                email:
+                  action: suggest
+                  template: "{{ '{{ user.email }}' | quote }}"
+                  # -- Whether the email address must be marked as verified.
+                  # Possible values are:
+                  #  - `import`: mark the email address as verified if the upstream provider
+                  #     has marked it as verified, using the `email_verified` claim.
+                  #     This is the default.
+                  #   - `always`: mark the email address as verified
+                  #   - `never`: mark the email address as not verified
+                  set_email_verification: import
+#            - id: 01JG2B7DBS6RQRH1TFVZ4BP7H8
+#              issuer: https://github.com/
+#              client_id: "{{ matrix_github_oidc_client_id }}"
+#              client_secret: "{{ matrix_github_oidc_client_secret }}"
+#              token_endpoint_auth_method: client_secret_basic
+#              discovery_mode: oidc
+#              claims_imports:
+#                subject:
+#                  template: "{{ '{{ user.sub }}' | quote }}"
+#
+#                # -- The localpart is the local part of the user's Matrix ID.
+#                # For example, on the `example.com` server, if the localpart is `alice`,
+#                #  the user's Matrix ID will be `@alice:example.com`.
+#                localpart:
+#                  action: require
+#                  template: "{{ '{{ user.preferred_username }}' | quote }}"
+#
+#                # -- The display name is the user's display name.
+#                displayname:
+#                  action: suggest
+#                  template: "{{ '{{ user.name }}' | quote }}"
+#
+#                # -- An email address to import.
+#                email:
+#                  action: suggest
+#                  template: "{{ '{{ user.email }}' | quote }}"
+#                  # -- Whether the email address must be marked as verified.
+#                  # Possible values are:
+#                  #  - `import`: mark the email address as verified if the upstream provider
+#                  #     has marked it as verified, using the `email_verified` claim.
+#                  #     This is the default.
+#                  #   - `always`: mark the email address as verified
+#                  #   - `never`: mark the email address as not verified
+#                  set_email_verification: import

tasks/matrix.yaml

@@ -0,0 +1,377 @@
+---
+# tasks file for synapse
+- name: Add Small Hack repo
+  kubernetes.core.helm_repository:
+    name: small-hack-matrix
+    repo_url: https://small-hack.github.io/matrix-chart
+  register: repo
+
+- name: Update Helm repos
+  command: helm repo update
+  when: repo.changed
+
+- name: Deploy Matrix
+  kubernetes.core.helm:
+    name: matrix
+    chart_ref: small-hack-matrix/matrix
+    release_namespace: matrix
+    create_namespace: true
+    values:
+      matrix:
+        serverName: eom.dev
+        hostname: synapse.eom.dev
+        adminEmail: synapse@eom.dev
+        encryptByDefault: all
+        federation:
+          enabled: true
+          ingress:
+            enabled: true
+            host: eom.dev
+            className: nginx
+            annotations: 
+              nginx.ingress.kubernetes.io/configuration-snippet: |
+                proxy_intercept_errors off;
+              cert-manager.io/cluster-issuer: ca-issuer
+            tls:
+              enabled: true
+            host: eom.dev
+        oidc:
+          enabled: true
+          providers:
+            - idp_id: github
+              idp_name: Github
+              idp_brand: "github"  # optional: styling hint for clients
+              discover: false
+              issuer: "https://github.com/"
+              client_id: "{{ matrix_github_oidc_client_id }}" # TO BE FILLED
+              client_secret: "{{ matrix_github_oidc_client_secret }}" # TO BE FILLED
+              authorization_endpoint: "https://github.com/login/oauth/authorize"
+              token_endpoint: "https://github.com/login/oauth/access_token"
+              userinfo_endpoint: "https://api.github.com/user"
+              scopes: ["read:user"]
+              allow_existing_users: true
+              enable_registration: false
+              user_mapping_provider:
+                config:
+                  subject_claim: "id"
+                  localpart_template: "{{ '{{ user.login }}' | quote }}"
+                  display_name_template: "{{ '{{ user.name }}' | quote }}"
+            - idp_id: google
+              idp_name: Google
+              idp_brand: "google"
+              issuer: "https://accounts.google.com/"
+              client_id: "{{ matrix_google_oidc_client_id }}" # TO BE FILLED
+              client_secret: "{{ matrix_google_oidc_client_secret }}" # TO BE FILLED
+              scopes: ["openid", "profile", "email"] # email is optional, read below
+              allow_existing_users: true
+              enable_registration: false
+              user_mapping_provider:
+                config:
+                  localpart_template: "{{ '{{ user.given_name|lower }}' | quote }}"
+                  display_name_template: "{{ '{{ user.name }}' | quote }}"
+                  email_template: "{{ '{{ user.email }}' | quote }}" # needs "email" in scopes above
+        allow_public_rooms_over_federation: true
+        allow_public_rooms_without_auth: true
+        ip_range_blacklist:
+          - 127.0.0.0/8
+        registration:
+          enabled: false
+          allowGuests: false
+          autoJoinRooms:
+            - #main:eom.dev
+            - #announcements:eom.dev
+            - #general:eom.dev
+            - #help:eom.dev
+        serve_server_wellknown: true
+        homeserverExtra:
+          modules:
+           - module: "ldap_auth_provider.LdapAuthProviderModule"
+             config:
+               enabled: true
+               uri: "ldap://openldap.openldap.svc.cluster.local:389"
+               mode: search
+               start_tls: false
+               base: "dc=eom,dc=dev"
+               attributes:
+                  uid: "uid"
+                  mail: "mail"
+                  name: "givenName"
+               bind_dn: cn=readonly,dc=eom,dc=dev
+               bind_password: "{{ openldap_readonly_password }}"
+               filter: "(&(objectClass=posixAccount)(memberOf=cn=Synapse Users,ou=Synapse,ou=Services,dc=eom,dc=dev))"
+#        experimental_features:
+#          msc3861:
+#            enabled: true
+#            # Synapse will call `{issuer}/.well-known/openid-configuration` to get the OIDC configuration
+#            issuer: https://matrix-auth-service.eom.dev/
+#            client_id: 0000000000000000000SYNAPSE
+#            client_auth_method: client_secret_basic
+#            client_secret: 5ZrwKXmKdiQfus2J
+#            admin_token: SacP5rWpci6GMqb2
+#            account_management_url: "https://matrix-auth-service.eom.dev/account"
+      volumes:
+        media:
+          capacity: 2Ti
+      postgresql:
+        enabled: true
+        persistence:
+          enabled: true
+        global:
+          postgresql:
+            auth:
+              username: synapse
+              password: "{{ synapse_admin_password }}"
+        primary:
+          persistence:
+            size: 2Ti
+      synapse:
+        ingress:
+          className: nginx
+          annotations:
+            cert-manager.io/cluster-issuer: ca-issuer
+            nginx.ingress.kubernetes.io/configuration-snippet: proxy_intercept_errors off;
+          hosts:
+            - host: synapse.eom.dev
+              paths:
+#                - path: "/_matrix/client/(r0|v3)/(refresh|login|logout).*"
+#                  pathType: ImplementationSpecific
+#                  backend:
+#                    service:
+#                      name: mas
+#                      port:
+#                        name: http
+                - path: /
+                  pathType: Prefix
+          tls:
+            - secretName: synapse-tls
+              hosts:
+                - synapse.eom.dev
+      element:
+        enabled: true
+        permalinkPrefix: "https://element.eom.dev"
+        ingress:
+          host: element.eom.dev
+          annotations:
+            cert-manager.io/cluster-issuer: ca-issuer
+      coturn:
+        enabled: false
+        external: true
+        uris:
+          - turns:coturn.eom.dev?transport=udp
+          - turns:coturn.eom.dev?transport=tcp
+        allowGuests: false
+        sharedSecret: "{{ coturn_shared_secret }}"
+        service:
+          type: LoadBalancer
+          externalTrafficPolicy: Local
+        certificate:
+          enabled: true
+          host: coturn.eom.dev
+          issuerName: ca-issuer
+        image:
+          tag: latest
+          pullPolicy: Always
+        externalDatabase:
+          enabled: true
+        postgresql:
+          enabled: true
+          global:
+            postgresql:
+              auth:
+                password: "{{ coturn_admin_password }}"
+          primary:
+            initdb:
+              scripts:
+                schema.sql: |
+                  CREATE TABLE turnusers_lt (
+                      realm varchar(127) default '',
+                      name varchar(512),
+                      hmackey char(128),
+                      PRIMARY KEY (realm,name)
+                  );
+
+                  CREATE TABLE turn_secret (
+                      realm varchar(127) default '',
+                      value varchar(256),
+                      primary key (realm,value)
+                  );
+
+                  CREATE TABLE allowed_peer_ip (
+                      realm varchar(127) default '',
+                      ip_range varchar(256),
+                      primary key (realm,ip_range)
+                  );
+
+                  CREATE TABLE denied_peer_ip (
+                      realm varchar(127) default '',
+                      ip_range varchar(256),
+                      primary key (realm,ip_range)
+                  );
+
+                  CREATE TABLE turn_origin_to_realm (
+                      origin varchar(127),
+                      realm varchar(127),
+                      primary key (origin)
+                  );
+
+                  CREATE TABLE turn_realm_option (
+                      realm varchar(127) default '',
+                      opt varchar(32),
+                      value varchar(128),
+                      primary key (realm,opt)
+                  );
+
+                  CREATE TABLE oauth_key (
+                      kid varchar(128),
+                      ikm_key varchar(256),
+                      timestamp bigint default 0,
+                      lifetime integer default 0,
+                      as_rs_alg varchar(64) default '',
+                      realm varchar(127),
+                      primary key (kid)
+                  );
+
+                  CREATE TABLE admin_user (
+                      name varchar(32),
+                      realm varchar(127),
+                      password varchar(127),
+                      primary key (name)
+                  );
+            persistence:
+              size: 256Gi
+        coturn:
+          realm: coturn.eom.dev
+          auth:
+            username: coturn
+            password: "{{ coturn_admin_password }}"
+      mail:
+        enabled: true
+        from: Synapse <synapse@eom.dev>
+        elementUrl: https://element.eom.dev
+        relay:
+          enabled: false
+        external:
+          hostname: postfix.eom.dev
+          port: "587"
+          username: synapse
+          password: "{{ synapse_admin_password }}"
+      mas:
+        enabled: false
+        fullnameOverride: mas
+        image:
+          pullPolicy: IfNotPresent
+          tag: latest
+        http:
+          public_base: https://matrix-auth-service.eom.dev/
+        ingress:
+          className: nginx
+          annotations:
+            cert-manager.io/cluster-issuer: ca-issuer
+          hosts:
+            - host: matrix-auth-service.eom.dev
+              paths:
+                - path: /
+                  pathType: Prefix
+          tls:
+            - secretName: mas-tls
+              hosts:
+                - matrix-auth-service.eom.dev
+        postgresql:
+          enabled: true
+          global:
+            auth:
+              password: "{{ matrix_auth_service_admin_password }}"
+        mas:
+          http:
+            public_base: https://matrix-auth-service.eom.dev/
+          policy:
+            client_registration:
+              allow_host_mismatch: false
+              allow_insecure_uris: false
+          clients:
+            - client_id: 0000000000000000000SYNAPSE
+              client_auth_method: client_secret_basic
+              client_secret: 5ZrwKXmKdiQfus2J
+          matrix:
+            homeserver: synapse.eom.dev
+            endpoint: https://synapse.eom.dev
+            secret: SacP5rWpci6GMqb2
+          email:
+            from: Matrix Auth Service <matrix-auth-service@eom.dev>
+            reply_to: Matrix Auth Service <matrix-auth-service@eom.dev>
+            transport: smtp
+            mode: tls
+            hostname: postfix.eom.dev
+            port: 587
+            username: matrix-auth-service
+            password: "{{ matrix_auth_service_admin_password }}"
+          upstream_oauth2:
+            providers:
+              - id: 01JG22H4F0G8PYCZ5HVTQVHBC4
+                issuer: https://google.com/
+                client_id: "{{ matrix_google_oidc_client_id }}"
+                client_secret: "{{ matrix_google_oidc_client_secret }}"
+                token_endpoint_auth_method: client_secret_basic
+                discovery_mode: oidc
+                claims_imports:
+                  subject:
+                    template: "{{ '{{ user.sub }}' | quote }}"
+
+                  # -- The localpart is the local part of the user's Matrix ID.
+                  # For example, on the `example.com` server, if the localpart is `alice`,
+                  #  the user's Matrix ID will be `@alice:example.com`.
+                  localpart:
+                    action: require
+                    template: "{{ '{{ user.preferred_username }}' | quote }}"
+
+                  # -- The display name is the user's display name.
+                  displayname:
+                    action: suggest
+                    template: "{{ '{{ user.name }}' | quote }}"
+
+                  # -- An email address to import.
+                  email:
+                    action: suggest
+                    template: "{{ '{{ user.email }}' | quote }}"
+                    # -- Whether the email address must be marked as verified.
+                    # Possible values are:
+                    #  - `import`: mark the email address as verified if the upstream provider
+                    #     has marked it as verified, using the `email_verified` claim.
+                    #     This is the default.
+                    #   - `always`: mark the email address as verified
+                    #   - `never`: mark the email address as not verified
+                    set_email_verification: import
+              - id: 01JG2B7DBS6RQRH1TFVZ4BP7H8
+                issuer: https://github.com/
+                client_id: "{{ matrix_github_oidc_client_id }}"
+                client_secret: "{{ matrix_github_oidc_client_secret }}"
+                token_endpoint_auth_method: client_secret_basic
+                discovery_mode: oidc
+                claims_imports:
+                  subject:
+                    template: "{{ '{{ user.sub }}' | quote }}"
+
+                  # -- The localpart is the local part of the user's Matrix ID.
+                  # For example, on the `example.com` server, if the localpart is `alice`,
+                  #  the user's Matrix ID will be `@alice:example.com`.
+                  localpart:
+                    action: require
+                    template: "{{ '{{ user.preferred_username }}' | quote }}"
+
+                  # -- The display name is the user's display name.
+                  displayname:
+                    action: suggest
+                    template: "{{ '{{ user.name }}' | quote }}"
+
+                  # -- An email address to import.
+                  email:
+                    action: suggest
+                    template: "{{ '{{ user.email }}' | quote }}"
+                    # -- Whether the email address must be marked as verified.
+                    # Possible values are:
+                    #  - `import`: mark the email address as verified if the upstream provider
+                    #     has marked it as verified, using the `email_verified` claim.
+                    #     This is the default.
+                    #   - `always`: mark the email address as verified
+                    #   - `never`: mark the email address as not verified
+                    set_email_verification: import

tasks/matterbridge.yaml

@@ -0,0 +1,70 @@
+---
+# Tasks file for Matterbridge
+- name: Create Matterbridge namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: matterbridge
+
+- name: Create ConfigMap for Matterbridge
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: matterbridge
+        namespace: matterbridge
+      data:
+        matterbridge.toml: "{{ lookup('file', 'matterbridge.toml') }}"
+
+- name: Create Deployment for Matterbridge
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: matterbridge
+        namespace: matterbridge
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: matterbridge
+        template:
+          metadata:
+            labels:
+              app: matterbridge
+          spec:
+            containers:
+              - name: matterbridge
+                image: 42wim/matterbridge
+                volumeMounts:
+                  - name: config
+                    mountPath: /etc/matterbridge
+                ports:
+                  - containerPort: 4242
+            volumes:
+              - name: config
+                configMap:
+                  name: matterbridge
+                  subPath: matterbridge.toml
+
+- name: Create Service for Matterbridge
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: matterbridge
+        namespace: matterbridge
+      spec:
+        selector:
+          app: matterbridge
+        ports:
+          - port: 80
+            targetPort: 4242
+            name: http
+        type: ClusterIP

tasks/media.yaml

@@ -1,116 +0,0 @@
----
-# tasks file for media
-- name: Create a config map for httpd
-  vars:
-    httpd_server_name: "media.eom.dev"
-    httpd_conf_extra:
-      - httpd-auth.conf
-      - httpd-dav.conf
-  k8s:
-    state: present
-    api_version: v1
-    kind: ConfigMap
-    name: media
-    namespace: "eom-{{ target_namespace }}"
-    definition:
-      data:
-        httpd.conf: "{{ lookup('template', 'httpd.conf.j2') }}"
-        httpd-auth.conf: "{{ lookup('template', 'httpd-auth.conf.j2') }}"
-        httpd-dav.conf: "{{ lookup('file', 'httpd-dav.conf') }}"
-        mime.types: "{{ lookup('file', 'mime.types') }}"
-
-- name: Create persistent volume for media
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: PersistentVolume
-      metadata:
-        name: "eom-{{ target_namespace }}-media"
-      spec:
-        capacity:
-          storage: 1024Gi
-        accessModes:
-          - ReadWriteOnce
-        persistentVolumeReclaimPolicy: Retain
-        storageClassName: standard
-        hostPath:
-          path: "/data/store-0/eom-{{ target_namespace }}/media"
-        nodeAffinity:
-          required:
-            nodeSelectorTerms:
-              - matchExpressions:
-                - key: kubernetes.io/hostname
-                  operator: In
-                  values:
-                    - alpha-worker-0
-
-- name: Create a persistent volume claim for media
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: PersistentVolumeClaim
-      metadata:
-        name: media
-        namespace: "eom-{{ target_namespace }}"
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1024Gi
-        storageClassName: standard
-        volumeName: "eom-{{ target_namespace }}-media"
-
-- name: Create a deployment
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Deployment
-      metadata:
-        name: media
-        namespace: "eom-{{ target_namespace }}"
-      spec:
-        replicas: 1
-        selector:
-          matchLabels:
-            app: media
-        template:
-          metadata:
-            labels:
-              app: media
-          spec:
-            containers:
-              - name: httpd
-                image: httpd
-                volumeMounts:
-                  - name: config
-                    mountPath: /usr/local/apache2/conf
-                  - name: media
-                    mountPath: /usr/local/apache2/htdocs/
-                ports:
-                  - containerPort: 80
-            volumes:
-              - name: config
-                configMap:
-                  name: media
-              - name: media
-                persistentVolumeClaim:
-                  claimName: media
-
-- name: Expose deployment as a service
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Service
-      metadata:
-        name: media
-        namespace: "eom-{{ target_namespace }}"
-      spec:
-        selector:
-          app: media
-        ports:
-          - port: 80
-            name: media-80
-        type: ClusterIP

tasks/mediawiki.yaml

@@ -0,0 +1,147 @@
+---
+# tasks file for mediawiki
+- name: Create MediaWiki namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: mediawiki
+
+- name: Deploy MariaDB
+  kubernetes.core.helm:
+    name: mariadb
+    chart_ref: bitnami/mariadb
+    release_namespace: mediawiki
+    values:
+      auth:
+        rootPassword: "{{ mediawiki_admin_password }}"
+        username: mediawiki
+        password: "{{ mediawiki_admin_password }}"
+        database: mediawiki
+      primary:
+        persistence:
+          size: 4Ti
+
+- name: Create Deployment for MediaWiki
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: mediawiki
+        namespace: mediawiki
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: mediawiki
+        template:
+          metadata:
+            labels:
+              app: mediawiki
+          spec:
+            containers:
+              - name: mediawiki
+                image: ericomeehan/mediawiki-extended
+                imagePullPolicy: IfNotPresent
+                resources:
+                  requests:
+                    memory: 2Gi
+                env:
+                  - name: WIKI_NAME
+                    value: MediaWiki
+                  - name: WIKI_ADMIN
+                    value: mediawiki_admin
+                  - name: WIKI_ADMIN_PASS
+                    value: "{{ mediawiki_admin_password }}"
+                  - name: WIKI_LANG
+                    value: en
+                  - name: WIKI_URL
+                    value: https://mediawiki.eom.dev/
+                  - name: DB_HOST
+                    value: mariadb
+                  - name: DB_PORT
+                    value: "3306"
+                  - name: DB_NAME
+                    value: mediawiki
+                  - name: DB_USER
+                    value: mediawiki
+                  - name: DB_PASS
+                    value: "{{ mediawiki_admin_password }}"
+                  - name: LDAP_BASE
+                    value: dc=eom,dc=dev
+                  - name: LDAP_SERVER_NAME
+                    value: openldap.openldap.svc.cluster.local
+                  - name: LDAP_SERVER_PORT
+                    value: "389"
+                  - name: LDAP_DOMAINNAME
+                    value: openldap.openldap.svc.cluster.local
+                  - name: LDAP_ENCTYPE
+                    value: clear
+                  - name: LDAP_USER_ATTR
+                    value: uid
+                  - name: LDAP_REAL_NAME_ATTR
+                    value: cn
+                  - name: LDAP_MAIL_ATTR
+                    value: mail
+                  - name: LDAP_BIND_USER
+                    value: cn=readonly,dc=eom,dc=dev
+                  - name: LDAP_BIND_PASS
+                    value: "{{ openldap_readonly_password }}"
+                  - name: LDAP_BUREAUCRAT_GROUP
+                    value: cn=Mediawiki Bureaucrats,ou=MediaWiki,ou=Services,dc=eom,dc=dev
+                  - name: LDAP_INTERFACE_ADMIN_GROUP
+                    value: cn=Mediawiki Interface Administrators,ou=MediaWiki,ou=Services,dc=eom,dc=dev
+                  - name: LDAP_SYSOP_GROUP
+                    value: cn=Mediawiki Sysops,ou=MediaWiki,ou=Services,dc=eom,dc=dev
+                  - name: LDAP_SEARCH_FILTER
+                    value: (&(objectClass=posixAccount)(uid=%1$s)(memberOf=cn=Mediawiki Users,ou=MediaWiki,ou=Services,dc=eom,dc=dev))
+                ports:
+                  - containerPort: 80
+
+- name: Create Service for MediaWiki
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: mediawiki
+        namespace: mediawiki
+      spec:
+        selector:
+          app: mediawiki
+        ports:
+          - port: 80
+            name: http
+        type: ClusterIP
+
+- name: Create Ingress
+  k8s:
+    state: present
+    definition:
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        name: mediawiki
+        namespace: mediawiki
+      spec:
+        ingressClassName: nginx
+        rules:
+          - host: mediawiki.eom.dev
+            http:
+              paths:
+                - pathType: Prefix
+                  path: /
+                  backend:
+                    service:
+                      name: mediawiki
+                      port:
+                        number: 80
+        tls:
+          - hosts:
+            - mediawiki.eom.dev
+            secretName: mediawiki

tasks/minio.yaml

@@ -0,0 +1,58 @@
+---
+# tasks file for minio
+- name: Deploy MinIO
+  kubernetes.core.helm:
+    name: minio
+    chart_ref: bitnami/minio
+    release_namespace: minio
+    create_namespace: true
+    values:
+      metrics:
+        enabled: true
+      disableWebUI: true
+      auth:
+        rootUser: minio_admin
+        rootPassword: "{{ minio_admin_password }}"
+      defaultBuckets: default
+      volumePermissions:
+        enabled: true
+      mode: standalone
+      persistence:
+        size: 8Ti
+      extraEnvVars:
+        - name: MINIO_ROOT_USER
+          value: minio_admin
+        - name: MINIO_ROOT_PASSWORD
+          value: "{{ minio_admin_password }}"
+        - name: MINIO_SERVER_URL
+          value: https://minio.eom.dev/
+        - name: MINIO_IDENTITY_LDAP_SERVER_ADDR
+          value: openldap.openldap.svc.cluster.local:389
+        - name: MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN
+          value: cn=readonly,dc=eom,dc=dev
+        - name: MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD
+          value: "{{ openldap_readonly_password }}"
+        - name: MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN
+          value: dc=eom,dc=dev
+        - name: MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER
+          value: (&(objectClass=posixAccount)(uid=%s)(memberOf=cn=Minio Users,ou=Minio,ou=Services,dc=eom,dc=dev))
+        - name: MINIO_IDENTITY_LDAP_USER_DN_ATTRIBUTES
+          value: uid,cn,mail,sshPublicKey
+        - name: MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER
+          value: (&(objectclass=groupOfUniqueNames)(uniqueMember=%d))
+        - name: MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN
+          value: dc=eom,dc=dev
+        - name: MINIO_IDENTITY_LDAP_COMMENT
+          value: OpenLDAP
+        - name: MINIO_IDENTITY_LDAP_SERVER_INSECURE
+          value: "on"
+      apiIngress:
+        enabled: true
+        hostname: minio.eom.dev
+        ingressClassName: nginx
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        tls:
+          - hosts:
+            - minio.eom.dev
+            secretName: minio-tls

tasks/misskey.yaml

@@ -0,0 +1,16 @@
+---
+# tasks file for misskey
+- name: Deploy Misskey
+  kubernetes.core.helm:
+    name: misskey
+    chart_ref: oci://tccr.io/truecharts/misskey
+    release_namespace: misskey
+    create_namespace: true
+    values:
+      service:
+        main:
+          ports:
+            main:
+              port: 3003
+      misskey:
+        url: "https://misskey.eom.dev/"

tasks/mongodb.yaml

@@ -0,0 +1,96 @@
+---
+# tasks file for mongodb
+- name: Create persistent volume for mongodb
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolume
+      metadata:
+        name: "eom-{{ target_namespace }}-mongodb"
+      spec:
+        capacity:
+          storage: 32Gi
+        accessModes:
+          - ReadWriteMany
+        persistentVolumeReclaimPolicy: Retain
+        storageClassName: standard
+        hostPath:
+          path: "/data/store-0/eom-{{ target_namespace }}/mongodb"
+        nodeAffinity:
+          required:
+            nodeSelectorTerms:
+              - matchExpressions:
+                - key: kubernetes.io/hostname
+                  operator: In
+                  values:
+                    - alpha-worker-0
+
+- name: Create a persistent volume claim for mongodb
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: mongodb
+        namespace: "eom-{{ target_namespace }}"
+      spec:
+        accessModes:
+          - ReadWriteMany
+        resources:
+          requests:
+            storage: 32Gi
+        storageClassName: standard
+        volumeName: "eom-{{ target_namespace }}-mongodb"
+
+- name: Create a deployment
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: mongodb
+        namespace: "eom-{{ target_namespace }}"
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: mongodb
+        template:
+          metadata:
+            labels:
+              app: mongodb
+          spec:
+            containers:
+              - name: mongodb
+                image: mongo
+                volumeMounts:
+                  - name: data
+                    mountPath: /var/lib/mysql
+                ports:
+                  - containerPort: 3306
+                env:
+                  # TODO: check docs for extra vars
+                  key: ME_CONFIG_MONGODB_ADMINPASSWORD
+                  value: "{{ mongodb_root_password }}"
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: mongodb
+
+- name: Expose deployment as a service
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: mongodb
+        namespace: "eom-{{ target_namespace }}"
+      spec:
+        selector:
+          app: mongodb
+        ports:
+          - port: 8081
+            name: mongodb-8081
+        type: ClusterIP

tasks/nextcloud.yaml

@@ -0,0 +1,125 @@
+---
+# tasks file for nextcloud
+- name: Add NextCloud repo
+  kubernetes.core.helm_repository:
+    name: nextcloud
+    repo_url: https://nextcloud.github.io/helm/
+  register: repo
+
+- name: Update Helm repos
+  command: helm repo update
+  when: repo.changed
+
+- name: Deploy NextCloud
+  kubernetes.core.helm:
+    name: nextcloud
+    chart_ref: nextcloud/nextcloud
+    release_namespace: nextcloud
+    create_namespace: true
+    values:
+      image:
+        pullPolicy: IfNotPresent
+      livenessProbe:
+        initialDelaySeconds: 300
+      readinessProbe:
+        initialDelaySeconds: 300
+      nextcloud:
+        host: nextcloud.eom.dev
+        username: nextcloud_admin
+        password: "{{ nextcloud_admin_password }}"
+        configs:
+          proxy.config.php: |-
+            <?php
+            $CONFIG = array (
+              'overwriteprotocol' => 'https',
+              'trusted_proxies' => array(
+                0 => '127.0.0.1',
+                1 => '10.0.0.0/8',
+              ),
+              'forwarded_for_headers' => array('HTTP_X_FORWARDED_FOR'),
+            );
+      mail:
+        enabled: true
+        fromAddress: nextcloud
+        domain: postfix.eom.dev
+        smtp:
+          host: postfix.eom.dev
+          secure: ssl
+          port: 587
+          authtype: LOGIN
+          name: nextcloud
+          password: "{{ nextcloud_admin_password }}"
+      persistence:
+        enabled: true
+        size: 8Ti
+      metrics:
+        enabled: true
+      cronjob:
+        enabled: true
+      redis:
+        #global:
+            #defaultStorageClass: r720-nfs-client
+        enabled: true
+        auth:
+          password: "{{ redis_auth_password }}"
+      ingress:
+        enabled: true
+        className: nginx
+        annotations:
+          #nginx.ingress.kubernetes.io/enable-cors: "true"
+          #nginx.ingress.kubernetes.io/cors-allow-headers: "X-Forwarded-For"
+          nginx.ingress.kubernetes.io/proxy-body-size: 4G
+          kubernetes.io/tls-acme: "true"
+          cert-manager.io/cluster-issuer: ca-issuer
+          # Keep this in sync with the README.md:
+          nginx.ingress.kubernetes.io/server-snippet: |-
+            server_tokens off;
+            proxy_hide_header X-Powered-By;
+            rewrite ^/.well-known/webfinger /index.php/.well-known/webfinger last;
+            rewrite ^/.well-known/nodeinfo /index.php/.well-known/nodeinfo last;
+            rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
+            rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
+            location = /.well-known/carddav {
+              return 301 $scheme://$host/remote.php/dav;
+            }
+            location = /.well-known/caldav {
+              return 301 $scheme://$host/remote.php/dav;
+            }
+            location = /robots.txt {
+              allow all;
+              log_not_found off;
+              access_log off;
+            }
+            location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+              deny all;
+            }
+            location ~ ^/(?:autotest|occ|issue|indie|db_|console) {
+              deny all;
+            }
+        tls:
+          - hosts:
+            - nextcloud.eom.dev
+            secretName: nextcloud-tls
+      internalDatabase:
+        enabled: false
+      externalDatabase:
+        enabled: true
+        type: postgresql
+        host: postgresql
+        user: nextcloud
+        password: "{{ nextcloud_admin_password }}"
+        database: nextcloud
+      postgresql:
+        enabled: true
+        image:
+          tag: 16.6.0-debian-12-r2
+        global:
+          postgresql:
+            auth:
+              username: nextcloud
+              password: "{{ nextcloud_admin_password }}"
+              database: nextcloud
+        primary:
+          persistence:
+            enabled: true
+            size: 2Ti

tasks/obs-web.yaml

@@ -0,0 +1,51 @@
+---
+# tasks file for obs-web
+- name: Create namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: obs-web
+
+- name: Create a Deployment
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: obs-web
+        namespace: obs-web
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: obs-web
+        template:
+          metadata:
+            labels:
+              app: obs-web
+          spec:
+            containers:
+              - name: obs-web
+                image: ghcr.io/niek/obs-web
+                ports:
+                  - containerPort: 5000
+
+- name: Expose OBS-Web Deployment as a Service
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: obs-web
+        namespace: obs-web
+      spec:
+        selector:
+          app: obs-web
+        ports:
+          - port: 80
+            targetPort: 5000
+            name: http
+        type: LoadBalancer

tasks/openldap.yaml

@@ -1,101 +1,84 @@
 ---
-# tasks file for openldap
+# Tasks file for OpenLDAP
-- name: Create persistent volume for openldap-config
+- name: Create OpenLDAP namespace
   k8s:
     state: present
     definition:
       apiVersion: v1
-      kind: PersistentVolume
+      kind: Namespace
       metadata:
-        name: "eom-{{ target_namespace }}-openldap-config"
+        name: openldap
-      spec:
-        capacity:
-          storage: 1024Gi
-        accessModes:
-          - ReadWriteOnce
-        persistentVolumeReclaimPolicy: Retain
-        storageClassName: standard
-        hostPath:
-          path: "/data/store-0/eom-{{ target_namespace }}/openldap-config"
-        nodeAffinity:
-          required:
-            nodeSelectorTerms:
-              - matchExpressions:
-                - key: kubernetes.io/hostname
-                  operator: In
-                  values:
-                    - alpha-worker-0
 
-- name: Create a persistent volume claim for openldap-config
+- name: Create PVC for OpenLDAP data
   k8s:
     state: present
     definition:
       apiVersion: v1
       kind: PersistentVolumeClaim
       metadata:
-        name: openldap-config
+        name: data
-        namespace: "eom-{{ target_namespace }}"
+        namespace: openldap
       spec:
         accessModes:
           - ReadWriteOnce
         resources:
           requests:
-            storage: 1024Gi
+            storage: 128Gi
-        storageClassName: standard
-        volumeName: "eom-{{ target_namespace }}-openldap-config"
 
-- name: Create persistent volume for openldap-data
+- name: Create PVC for OpenLDAP configuration
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: PersistentVolume
-      metadata:
-        name: "eom-{{ target_namespace }}-openldap-data"
-      spec:
-        capacity:
-          storage: 1024Gi
-        accessModes:
-          - ReadWriteOnce
-        persistentVolumeReclaimPolicy: Retain
-        storageClassName: standard
-        hostPath:
-          path: "/data/store-0/eom-{{ target_namespace }}/openldap-data"
-        nodeAffinity:
-          required:
-            nodeSelectorTerms:
-              - matchExpressions:
-                - key: kubernetes.io/hostname
-                  operator: In
-                  values:
-                    - alpha-worker-0
-
-- name: Create a persistent volume claim for openldap-data
   k8s:
     state: present
     definition:
       apiVersion: v1
       kind: PersistentVolumeClaim
       metadata:
-        name: openldap-data
+        name: config
-        namespace: "eom-{{ target_namespace }}"
+        namespace: openldap
       spec:
         accessModes:
           - ReadWriteOnce
         resources:
           requests:
-            storage: 1024Gi
+            storage: 32Gi
-        storageClassName: standard
-        volumeName: "eom-{{ target_namespace }}-openldap-data"
 
-- name: Create a deployment
+- name: Request a certificate for OpenLDAP
+  k8s:
+    state: present
+    definition:
+      apiVersion: cert-manager.io/v1
+      kind: Certificate
+      metadata:
+        name: openldap
+        namespace: openldap
+      spec:
+        secretName: openldap
+        privateKey:
+          algorithm: RSA
+          encoding: PKCS1
+          size: 2048
+        duration: 2160h # 90d
+        renewBefore: 360h # 15d
+        isCA: false
+        usages:
+          - server auth
+          - client auth
+        subject:
+          organizations:
+            - EOM
+        dnsNames:
+          - openldap.eom.dev
+        issuerRef:
+          name: ca-issuer
+          kind: ClusterIssuer
+
+- name: Create Deployment for OpenLDAP
   k8s:
     definition:
       apiVersion: v1
       kind: Deployment
       metadata:
         name: openldap
-        namespace: "eom-{{ target_namespace }}"
+        namespace: openldap
       spec:
         replicas: 1
         selector:
@@ -115,11 +98,17 @@
                   - name: LDAP_DOMAIN
                     value: "eom.dev"
                   - name: LDAP_ADMIN_PASSWORD
-                    value: "{{ ldap_admin_password }}"
+                    value: "{{ openldap_admin_password }}"
                   - name: LDAP_READONLY_USER
                     value: "true"
                   - name: LDAP_READONLY_USER_PASSWORD
-                    value: "{{ ldap_readonly_password }}"
+                    value: "{{ openldap_readonly_password }}"
+                  - name: LDAP_TLS_VERIFY_CLIENT
+                    value: never
+                  - name: LDAP_TLS_CRT_FILENAME
+                    value: tls.crt
+                  - name: LDAP_TLS_KEY_FILENAME
+                    value: tls.key
                 volumeMounts:
                   - name: config
                     mountPath: /etc/ldap/slapd.d
@@ -129,25 +118,27 @@
                   - containerPort: 389
                   - containerPort: 636
             volumes:
-              - name: config
-                persistentVolumeClaim:
-                  claimName: openldap-config
               - name: data
                 persistentVolumeClaim:
-                  claimName: openldap-data
+                  claimName: data
+              - name: config
+                persistentVolumeClaim:
+                  claimName: config
 
-- name: Expose deployment as a service
+- name: Create Service for OpenLDAP
   k8s:
     definition:
       apiVersion: v1
       kind: Service
       metadata:
         name: openldap
-        namespace: "eom-{{ target_namespace }}"
+        namespace: openldap
       spec:
         selector:
           app: openldap
         ports:
           - port: 389
-            name: openldap-389
+            name: ldap
+          - port: 636
+            name: ldaps
         type: ClusterIP

tasks/org.yaml

@@ -0,0 +1,192 @@
+---
+# tasks file for redmine
+- name: Create org namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: org
+
+- name: Create PVC for MySQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: mysql
+        namespace: org
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 128Gi
+
+- name: Create Deployment for MySQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: mysql
+        namespace: org
+        labels:
+          app: mysql
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: mysql
+        template:
+          metadata:
+            labels:
+              app: mysql
+          spec:
+            containers:
+              - name: mysql
+                image: mysql
+                volumeMounts:
+                  - name: data
+                    mountPath: /var/lib/mysql
+                ports:
+                  - containerPort: 3306
+                env:
+                  - name: MYSQL_DATABASE
+                    value: redmine
+                  - name: MYSQL_ROOT_PASSWORD
+                    value: "{{ mysql_root_password }}"
+                  - name: MYSQL_USER
+                    value: redmine
+                  - name: MYSQL_PASSWORD
+                    value: "{{ redmine_mysql_password }}"
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: mysql
+
+- name: Create Service for MySQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: mysql
+        namespace: org
+      spec:
+        selector:
+          app: mysql
+        ports:
+          - port: 3306
+            name: mysql
+        type: ClusterIP
+
+- name: Create PVC for Redmine
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: redmine
+        namespace: org
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 64Gi
+
+- name: Create Deployment for Redmine
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: redmine
+        namespace: org
+        labels:
+          app: redmine
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: redmine
+        template:
+          metadata:
+            labels:
+              app: redmine
+          spec:
+            containers:
+              - name: redmine
+                image: redmine
+                volumeMounts:
+                  - name: data
+                    mountPath: /usr/src/redmine/files
+                ports:
+                  - containerPort: 3000
+                env:
+                  - name: REDMINE_DB_MYSQL
+                    value: mysql
+                  - name: REDMINE_DB_DATABASE
+                    value: redmine
+                  - name: REDMINE_DB_USERNAME
+                    value: redmine
+                  - name: REDMINE_DB_PASSWORD
+                    value: "{{ redmine_mysql_password }}"
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: redmine
+
+- name: Create Service for Redmine
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: redmine
+        namespace: org
+      spec:
+        selector:
+          app: redmine
+        ports:
+          - port: 80
+            targetPort: 3000
+            name: http
+        type: ClusterIP
+
+- name: Create Ingress
+  k8s:
+    state: present
+    definition:
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        name: redmine
+        namespace: org
+      spec:
+        ingressClassName: nginx
+        rules:
+          - host: org.eom.dev
+            http:
+              paths:
+                - pathType: Prefix
+                  path: /
+                  backend:
+                    service:
+                      name: redmine
+                      port:
+                        number: 80
+        tls:
+          - hosts:
+            - org.eom.dev
+            secretName: redmine

tasks/owncast.yaml

@@ -0,0 +1,114 @@
+---
+# tasks file for gitlab
+- name: Create stream namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: owncast
+
+- name: Create PVC for OwnCast
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: owncast
+        namespace: owncast
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 128Gi
+
+- name: Create Deployment for OwnCast
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: owncast
+        namespace: owncast
+        labels:
+          app: owncast
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: owncast
+        template:
+          metadata:
+            labels:
+              app: owncast
+          spec:
+            containers:
+              - name: owncast
+                image: owncast/owncast:0.2.0
+                resources:
+                  requests:
+                    cpu: 1.5
+                volumeMounts:
+                  - name: data
+                    mountPath: /app/data
+                ports:
+                  - containerPort: 8080
+                  - containerPort: 1935
+                env:
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: owncast
+
+- name: Create Service for OwnCast
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: owncast
+        namespace: owncast
+      spec:
+        selector:
+          app: owncast
+        ports:
+          - port: 1935
+            name: rtmp
+          - port: 8080
+            name: http
+        externalTrafficPolicy: Local
+        type: LoadBalancer
+
+- name: Create Ingress
+  k8s:
+    state: present
+    definition:
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        name: owncast
+        namespace: owncast
+      spec:
+        ingressClassName: nginx
+        rules:
+          - host: owncast.eom.dev
+            http:
+              paths:
+                - pathType: Prefix
+                  path: /
+                  backend:
+                    service:
+                      name: owncast
+                      port:
+                        number: 8080
+        tls:
+          - hosts:
+            - owncast.eom.dev
+            secretName: owncast

tasks/phpldapadmin.yaml

@@ -0,0 +1,88 @@
+---
+# tasks file for phpLDAPadmin
+- name: Create phpLDAPadmin namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: phpldapadmin
+
+- name: Create Deployment for phpLDAPadmin
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: phpldapadmin
+        namespace: phpldapadmin
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: phpldapadmin
+        template:
+          metadata:
+            labels:
+              app: phpldapadmin
+          spec:
+            containers:
+              - name: phpldapadmin
+                image: osixia/phpldapadmin
+                env:
+                  - name: PHPLDAPADMIN_LDAP_HOSTS
+                    value: "openldap.openldap.svc.cluster.local"
+                  - name: PHPLDAPADMIN_SERVER_ADMIN
+                    value: "phpldapadmin@postfix.eom.dev"
+                  - name: PHPLDAPADMIN_SERVER_PATH
+                    value: "/"
+                  - name: PHPLDAPADMIN_HTTPS
+                    value: "false"
+                ports:
+                  - containerPort: 80
+
+- name: Create Service for phpLDAPadmin
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: phpldapadmin
+        namespace: phpldapadmin
+      spec:
+        selector:
+          app: phpldapadmin
+        ports:
+          - port: 80
+            name: http
+        type: ClusterIP
+
+- name: Create Ingress
+  k8s:
+    state: present
+    definition:
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        name: phpldapadmin
+        namespace: phpldapadmin
+      spec:
+        ingressClassName: nginx
+        rules:
+          - host: phpldapadmin.eom.dev
+            http:
+              paths:
+                - pathType: Prefix
+                  path: /
+                  backend:
+                    service:
+                      name: phpldapadmin
+                      port:
+                        number: 80
+        tls:
+          - hosts:
+            - phpldapadmin.eom.dev
+            secretName: phpldapadmin

tasks/pleroma.yaml

@@ -0,0 +1,223 @@
+---
+# tasks file for pleroma
+- name: Create NextCloud namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: pleroma
+
+- name: Create PVC for PostgreSQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: postgresql
+        namespace: pleroma
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 2Ti
+
+- name: Create Deployment for PostgreSQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: postgresql
+        namespace: pleroma
+        labels:
+          app: postgresql
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: postgresql
+        template:
+          metadata:
+            labels:
+              app: postgresql
+          spec:
+            containers:
+              - name: postgresql
+                image: postgresql
+                volumeMounts:
+                  - name: data
+                    mountPath: /var/lib/postgresql/data
+                ports:
+                  - containerPort: 5432
+                env:
+                  - name: MYSQL_ROOT_PASSWORD
+                    value: "{{ mysql_root_password }}"
+                  - name: MYSQL_DATABASE
+                    value: nextcloud
+                  - name: MYSQL_USER
+                    value: nextcloud
+                  - name: MYSQL_PASSWORD
+                    value: "{{ nextcloud_mysql_password }}"
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: postgresql
+
+- name: Create Service for PostgreSQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: postgresql
+        namespace: cloud
+      spec:
+        selector:
+          app: postgresql
+        ports:
+          - port: 3306
+            name: mysql
+        type: ClusterIP
+
+- name: Create PVC for Pleroma
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: pleroma
+        namespace: pleroma
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 128Gi
+
+- name: Create Deployment for Pleroma
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: pleroma
+        namespace: pleroma
+        labels:
+          app: pleroma
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: pleroma
+        template:
+          metadata:
+            labels:
+              app: pleroma
+          spec:
+            containers:
+              - name: pleroma
+                image: pleroma
+                volumeMounts:
+                  - name: data
+                    mountPath: /data/uploads
+                ports:
+                  - containerPort: 4000
+                env:
+                  - name: POSTGRES_PASSWORD
+                    value: "{{ pleroma_admin_password }}"
+                  - name: POSTGRES_USER
+                    value: pleroma
+                  - name: POSTGRES_DB
+                    value: pleroma
+                  - name: ADMIN_EMAIL
+                    value: pleroma@eom.dev
+                  - name: ADMIN_PASSWORD
+                    value: "{{ pleroma_admin_password }}"
+                  - name: DB_HOST
+                    value: postgresql
+                  - name: DB_PORT
+                    value: 5432
+                  - name: DB_USER
+                    value: pleroma
+                  - name: DB_PASS
+                    value: "{{ pleroma_admin_password }}"
+                  - name: DB_NAME
+                    value: pleroma
+                  - name: INSTANCE_NAME
+                    value: Pleroma
+                  - name: DOMAIN
+                    value: pleroma.eom.dev
+                  - name: LDAP_ENABLED
+                    value: true
+                  - name: LDAP_HOST
+                    value: openldap.openldap.svc.cluster.local
+                  - name: LDAP_PORT
+                    value: 389
+                  - name: LDAP_SSL
+                    value: false
+                  - name: LDAP_TLS
+                    value: false
+                  - name: LDAP_BASE
+                    value: dc=eom,dc=dev
+                  - name: LDAP_UID
+                    value: uid
+                  - name: LDAP_MAIL
+                    value: mail
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: pleroma
+
+- name: Create Service for Pleroma
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: pleroma
+        namespace: pleroma
+      spec:
+        selector:
+          app: pleroma
+        ports:
+          - port: 80
+            name: http
+        type: ClusterIP
+
+- name: Create Ingress
+  k8s:
+    state: present
+    definition:
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        name: pleroma
+        namespace: pleroma
+      spec:
+        ingressClassName: nginx
+        rules:
+          - host: pleroma.eom.dev
+            http:
+              paths:
+                - pathType: Prefix
+                  path: /
+                  backend:
+                    service:
+                      name: pleroma
+                      port:
+                        number: 4000
+        tls:
+          - hosts:
+            - pleroma.eom.dev
+            secretName: pleroma

tasks/postgresql.yaml

@@ -0,0 +1,40 @@
+---
+# tasks file for postgresql
+- name: Deploy PostgreSQL
+  kubernetes.core.helm:
+    name: postgresql
+    chart_ref: bitnami/postgresql-ha
+    release_namespace: postgresql
+    create_namespace: true
+    values:
+      metrics:
+        enabled: true
+      volumePermissions:
+        enabled: true
+      pgpool:
+        adminPassword: "{{ postgresql_admin_password }}"
+        customUsers:
+          usernames: gitea,grafana,jupyterhub,mastodon,mediawiki,nextcloud
+          passwords: "{{ gitea_admin_password }},{{ grafana_admin_password }},{{ jupyterhub_admin_password }},{{ mastodon_admin_password }},{{ mediawiki_admin_password }},{{ nextcloud_admin_password }}"
+      backup:
+        enabled: true
+      persistence:
+        size: 4Ti
+      postgresql:
+        username: postgres
+        password: "{{ postgresql_admin_password }}"
+        repmgrPassword: "{{ postgresql_repmgr_password }}"
+        initdbScripts:
+          setup.sql: |
+            CREATE USER gitea WITH PASSWORD '{{ gitea_admin_password }}';
+            CREATE DATABASE gitea WITH OWNER gitea;
+            CREATE USER grafana WITH PASSWORD '{{ grafana_admin_password }}';
+            CREATE DATABASE grafana WITH OWNER grafana;
+            CREATE USER jupyterhub WITH PASSWORD '{{ jupyterhub_admin_password }}';
+            CREATE DATABASE jupyterhub WITH OWNER jupyterhub;
+            CREATE USER mastodon WITH PASSWORD '{{ mastodon_admin_password }}';
+            CREATE DATABASE mastodon WITH OWNER mastodon;
+            CREATE USER mediawiki WITH PASSWORD '{{ mediawiki_admin_password }}';
+            CREATE DATABASE mediawiki WITH OWNER mediawiki;
+            CREATE USER nextcloud WITH PASSWORD '{{ nextcloud_admin_password }}';
+            CREATE DATABASE nextcloud WITH OWNER nextcloud;

tasks/prometheus.yaml

@@ -0,0 +1,116 @@
+---
+# tasks file for prometheus
+- name: Deploy Prometheus
+  kubernetes.core.helm:
+    name: prometheus
+    chart_ref: bitnami/prometheus
+    release_namespace: prometheus
+    create_namespace: true
+    values:
+      server:
+        persistence:
+          size: 256Gi
+        extraScrapeConfigs:
+          - job_name: apps
+            static_configs:
+              - targets:
+                - discourse.eom.dev
+                labels:
+                  instance: discourse
+              - targets:
+                - gitea.eom.dev
+                labels:
+                  instance: gitea
+              - targets:
+                - grafana.eom.dev
+                labels:
+                  instance: grafana
+            metrics_path: /metrics
+
+          - job_name: nextcloud
+            static_configs:
+              - targets:
+                - nextcloud-metrics.nextcloud.svc.cluster.local:9205
+                labels:
+                  instance: nextcloud
+              - targets:
+                - matrix-synapse.matrix.svc.cluster.local:9092
+                labels:
+                  instance: matrix
+            metrics_path: /
+
+          - job_name: libvirt_exporter
+            static_configs:
+              - targets:
+                - 192.168.1.48:9177
+                labels:
+                  instance: poweredge-t640
+            metrics_path: /metrics
+
+          - job_name: node_exporter
+            static_configs:
+              - targets:
+                - 192.168.1.95:9100
+                labels:
+                  instance: poweredge-r350
+              - targets:
+                - 192.168.1.48:9100
+                labels:
+                  instance: poweredge-t640
+              - targets:
+                - 192.168.1.59:9100
+                labels:
+                  instance: alpha-control-plane
+              - targets:
+                - 192.168.1.91:9100
+                labels:
+                  instance: alpha-worker-0
+              - targets:
+                - 192.168.1.70:9100
+                labels:
+                  instance: alpha-worker-1
+              - targets:
+                - 192.168.1.74:9100
+                labels:
+                  instance: alpha-worker-2
+              - targets:
+                - 192.168.1.75:9100
+                labels:
+                  instance: alpha-worker-3
+              - targets:
+                - 192.168.1.61:9100
+                labels:
+                  instance: alpha-worker-4
+              - targets:
+                - 192.168.1.66:9100
+                labels:
+                  instance: alpha-worker-5
+              - targets:
+                - 192.168.1.38:9100
+                labels:
+                  instance: alpha-worker-6
+              - targets:
+                - 192.168.1.92:9100
+                labels:
+                  instance: alpha-worker-7
+              - targets:
+                - 192.168.1.67:9100
+                labels:
+                  instance: alpha-worker-8
+              - targets:
+                - 192.168.1.63:9100
+                labels:
+                  instance: alpha-worker-9
+              - targets:
+                - 192.168.1.86:9100
+                labels:
+                  instance: alpha-worker-10
+              - targets:
+                - 192.168.1.65:9100
+                labels:
+                  instance: alpha-worker-11
+              - targets:
+                - 192.168.1.72:9100
+                labels:
+                  instance: alpha-worker-12
+            metrics_path: /metrics

tasks/proxy.yaml

@@ -1,78 +0,0 @@
----
-# tasks file for deploy-reverse-proxy.yml
-- name: Create ConfigMap for httpd
-  vars:
-    httpd_server_name: "proxy.eom.dev"
-    httpd_conf_extra:
-      - httpd-auth.conf
-      - httpd-proxy.conf
-      - httpd-ssl.conf
-  k8s:
-    state: present
-    api_version: v1
-    kind: ConfigMap
-    name: proxy
-    namespace: "eom-{{ target_namespace }}"
-    definition:
-      data:
-        httpd.conf: "{{ lookup('template', 'httpd.conf.j2') }}"
-        httpd-auth.conf: "{{ lookup('template', 'httpd-auth.conf.j2') }}"
-        httpd-proxy.conf: "{{ lookup('file', 'httpd-proxy.conf') }}"
-        httpd-ssl.conf: "{{ lookup('file', 'httpd-ssl.conf') }}"
-        mime.types: "{{ lookup('file', 'mime.types') }}"
-        server.crt: "{{ proxy_server_crt }}"
-        server.key: "{{ proxy_server_key }}"
-
-- name: Create a deployment
-  k8s:
-    definition:
-      apiVersion: apps/v1
-      kind: Deployment
-      metadata:
-        name: proxy
-        namespace: "eom-{{ target_namespace }}"
-      spec:
-        replicas: 1
-        selector:
-          matchLabels:
-            app: proxy
-        template:
-          metadata:
-            labels:
-              app: proxy
-          spec:
-            containers:
-              - name: proxy
-                image: httpd
-                volumeMounts:
-                  - name: config
-                    mountPath: /usr/local/apache2/conf
-                ports:
-                  - containerPort: 80
-                  - containerPort: 443 
-            volumes:
-              - name: config
-                configMap:
-                  name: proxy
-
-- name: Expose deployment as a service
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Service
-      metadata:
-        name: proxy
-        namespace: "eom-{{ target_namespace }}"
-      spec:
-        selector:
-          app: proxy
-        ports:
-          - port: 80
-            protocol: TCP
-            nodePort: 30080
-            name: proxy-80
-          - port: 443
-            protocol: TCP
-            nodePort: 30443
-            name: proxy-443
-        type: NodePort

tasks/redis.yaml

@@ -0,0 +1,14 @@
+---
+# tasks file for redis
+- name: Deploy Redis
+  kubernetes.core.helm:
+    name: redis
+    chart_ref: bitnami/redis-cluster
+    release_namespace: redis
+    create_namespace: true
+    values:
+      metrics:
+        enabled: true
+      password: "{{ redis_auth_password }}"
+      persistence:
+        size: 64Gi

tasks/tes3mp.yaml

@@ -0,0 +1,81 @@
+---
+# tasks file for mail
+- name: Create tes3mp namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: tes3mp
+
+- name: Create a persistent volume claim
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: config
+        namespace: tes3mp
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 16Gi
+
+- name: Create a deployment
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: tes3mp
+        namespace: tes3mp
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: tes3mp
+        template:
+          metadata:
+            labels:
+              app: tes3mp
+          spec:
+            containers:
+              - name: tes3mp
+                image: tes3mp/server
+                volumeMounts:
+                  - name: data
+                    mountPath: /server/data
+                ports:
+                  - containerPort: 25565
+                env:
+                  - name: TES3MP_SERVER_GENERAL_HOSTNAME
+                    value: tes3.eom.dev
+                  - name: TES3MP_SERVER_GENERAL_PASSWORD
+                    value: "{{ tes3mp_password }}"
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: data
+
+- name: Expose deployment as a service
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: tes3mp
+        namespace: tes3mp
+      spec:
+        selector:
+          app: tes3mp
+        ports:
+          - port: 25566
+            targetPort: 25565
+            name: tes3mp
+            protocol: UDP
+        type: LoadBalancer
+        externalTrafficPolicy: Local

tasks/webhookd.yaml

@@ -0,0 +1,68 @@
+---
+# tasks file for webhookd
+- name: Create ConfigMap for Webhookd scripts
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: scripts
+        namespace: webhookd
+      data:
+        nextcloud-talk-gitea-webhook.sh: "{{ lookup('file', 'nextcloud-talk-gitea-webhook.sh') }}"
+        nextcloud-talk-grafana-webhook.sh: "{{ lookup('file', 'nextcloud-talk-grafana-webhook.sh') }}"
+        nextcloud-talk-minecraft-webhook.sh: "{{ lookup('file', 'nextcloud-talk-minecraft-webhook.sh') }}"
+
+- name: Create a Deployment for Webhookd
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: webhookd
+        namespace: webhookd
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: webhookd
+        template:
+          metadata:
+            labels:
+              app: webhookd
+          spec:
+            containers:
+              - name: webhookd
+                image: ncarlier/webhookd
+                volumeMounts:
+                  - name: scripts
+                    mountPath: /scripts
+                ports:
+                  - containerPort: 8080
+                env:
+                  - name: GITEA_ADMIN_PASSWORD
+                    value: "{{ gitea_admin_password }}"
+                  - name: GRAFANA_ADMIN_PASSWORD
+                    value: "{{ grafana_admin_password }}"
+            volumes:
+              - name: scripts
+                configMap:
+                  name: scripts
+                  defaultMode: 0777
+
+- name: Expose Webhookd Deployment as a Service
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: webhookd
+        namespace: webhookd
+      spec:
+        selector:
+          app: webhookd
+        ports:
+          - port: 80
+            targetPort: 8080
+            name: http
+        type: ClusterIP

tasks/wiki.yaml

@@ -0,0 +1,182 @@
+---
+# tasks file for mediawiki
+- name: Create wiki namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: wiki
+
+- name: Create PVC for MySQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: mysql
+        namespace: wiki
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 128Gi
+
+- name: Create Deployment for MySQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: mysql
+        namespace: wiki
+        labels:
+          app: mysql
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: mysql
+        template:
+          metadata:
+            labels:
+              app: mysql
+          spec:
+            containers:
+              - name: mysql
+                image: mysql
+                volumeMounts:
+                  - name: data
+                    mountPath: /var/lib/mysql
+                ports:
+                  - containerPort: 3306
+                env:
+                  - name: MYSQL_DATABASE
+                    value: mediawiki
+                  - name: MYSQL_ROOT_PASSWORD
+                    value: "{{ mysql_root_password }}"
+                  - name: MYSQL_USER
+                    value: mediawiki
+                  - name: MYSQL_PASSWORD
+                    value: "{{ mediawiki_mysql_password }}"
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: mysql
+
+- name: Create Service for MySQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: mysql
+        namespace: wiki
+      spec:
+        selector:
+          app: mysql
+        ports:
+          - port: 3306
+            name: mysql
+        type: ClusterIP
+
+- name: Create PVC for MediaWiki
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: mediawiki
+        namespace: wiki
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 64Gi
+
+- name: Create Deployment for MediaWiki
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: mediawiki
+        namespace: wiki
+        labels:
+          app: mediawiki
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: mediawiki
+        template:
+          metadata:
+            labels:
+              app: mediawiki
+          spec:
+            containers:
+              - name: mediawiki
+                image: mediawiki
+                volumeMounts:
+                  - name: data
+                    mountPath: /var/www/html/images
+                ports:
+                  - containerPort: 80
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: mediawiki
+
+- name: Create Service for MediaWiki
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: mediawiki
+        namespace: wiki
+      spec:
+        selector:
+          app: mediawiki
+        ports:
+          - port: 80
+            name: http
+        type: ClusterIP
+
+- name: Create Ingress
+  k8s:
+    state: present
+    definition:
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        name: mediawiki
+        namespace: wiki
+      spec:
+        ingressClassName: nginx
+        rules:
+          - host: wiki.eom.dev
+            http:
+              paths:
+                - pathType: Prefix
+                  path: /
+                  backend:
+                    service:
+                      name: mediawiki
+                      port:
+                        number: 80
+        tls:
+          - hosts:
+            - wiki.eom.dev
+            secretName: mediawiki

tasks/wordpress.yaml

@@ -0,0 +1,40 @@
+---
+# tasks file for wordpress
+- name: Deploy Wordpress
+  kubernetes.core.helm:
+    name: wordpress
+    chart_ref: bitnami/wordpress
+    release_namespace: wordpress
+    create_namespace: true
+    values:
+      wordpressUsername: wordpress_admin
+      wordpressPassword: "{{ wordpress_admin_password }}"
+      wordpressEmail: wordpress@eom.dev
+      wordpressFirstName: Administrator
+      wordpressLastName: Wordpress
+      wordpressBlogName: Wordpress
+      wordpressScheme: https
+      smtpHost: postfix.eom.dev
+      smtpPort: 587
+      smtpUser: wordpress
+      smtpPassword: "{{ wordpress_admin_password }}"
+      smtpFromName: Wordpress
+      service:
+        type: ClusterIP
+      ingress:
+        enabled: true
+        ingressClassName: nginx
+        hostname: wordpress.eom.dev
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        tls: true
+      persistence:
+        enabled: true
+        size: 2Ti
+      mariadb:
+        enabled: true
+        auth:
+          password: "{{ wordpress_admin_password }}"
+        primary:
+          persistence:
+            size: 2Ti

tasks/www.yaml

@@ -1,67 +0,0 @@
----
-# tasks file for www
-- name: Create a config map for www
-  vars:
-    httpd_server_name: "www.eom.dev"
-    httpd_conf_extra:
-      - httpd-auth.conf
-      - httpd-ssi.conf
-  k8s:
-    state: present
-    api_version: v1
-    kind: ConfigMap
-    name: www
-    namespace: "eom-{{ target_namespace }}"
-    definition:
-      data:
-        httpd.conf: "{{ lookup('template', 'httpd.conf.j2') }}"
-        httpd-auth.conf: "{{ lookup('template', 'httpd-auth.conf.j2') }}"
-        httpd-ssi.conf: "{{ lookup('file', 'httpd-ssi.conf') }}"
-        mime.types: "{{ lookup('file', 'mime.types') }}"
-
-- name: Create a deployment
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Deployment
-      metadata:
-        name: www
-        namespace: "eom-{{ target_namespace }}"
-      spec:
-        replicas: 1
-        selector:
-          matchLabels:
-            app: www
-        template:
-          metadata:
-            labels:
-              app: www
-          spec:
-            containers:
-              - name: www
-                image: ericomeehan/www
-                volumeMounts:
-                  - name: config
-                    mountPath: /usr/local/apache2/conf
-                ports:
-                  - containerPort: 80
-            volumes:
-              - name: config
-                configMap:
-                  name: www
-
-- name: Expose deployment as a service
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Service
-      metadata:
-        name: www
-        namespace: "eom-{{ target_namespace }}"
-      spec:
-        selector:
-          app: www
-        ports:
-          - port: 80
-            name: www-80
-        type: ClusterIP

templates/eric.ldif.j2

@@ -1,14 +0,0 @@
-dn: uid=eric,dc=eom,dc=dev
-changetype: add
-uid: eric
-cn: Eric O'Neill Meehan
-sn: 3
-objectClass: top
-objectClass: posixAccount
-objectClass: inetOrgPerson
-loginShell: /bin/zsh
-homeDirectory: /home/eric
-uidNumber: 10000
-gidNumber: 10000
-userPassword: {{ eric_user_password }}
-mail: eric@mail.eom.dev

templates/httpd-auth.conf.j2

@@ -1,38 +0,0 @@
-LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
-LoadModule ldap_module modules/mod_ldap.so
-
-# Base
-<LocationMatch "^/">
-	AuthType basic
-	AuthName OpenLDAP
-	AuthBasicProvider ldap
-	AuthLDAPBindDN "cn=admin,dc=eom,dc=dev"
-	AuthLDAPBindPassword "{{ ldap_admin_password }}"
-	AuthLDAPURL "ldap://openldap/dc=eom,dc=dev?uid"
-	<RequireAny>
-		Require method GET OPTIONS
-		Require valid-user
-	</RequireAny>
-</LocationMatch>
-
-# Users
-<LocationMatch "^/eric">
-	AuthType basic
-	AuthName OpenLDAP
-	AuthBasicProvider ldap
-	AuthLDAPBindDN "cn=admin,dc=eom,dc=dev"
-	AuthLDAPBindPassword "{{ ldap_admin_password }}"
-	AuthLDAPURL "ldap://openldap/dc=eom,dc=dev?uid??(uid=eric)"
-	Require valid-user
-</LocationMatch>
-
-# Git
-<LocationMatch "^/.*/git-receive-pack$">
-	AuthType basic
-	AuthName OpenLDAP
-	AuthBasicProvider ldap
-	AuthLDAPBindDN "cn=admin,dc=eom,dc=dev"
-	AuthLDAPBindPassword "{{ ldap_admin_password }}"
-	AuthLDAPURL "ldap://openldap/dc=eom,dc=dev?uid"
-	Require valid-user
-</LocationMatch>

templates/httpd.conf.j2

@@ -1,555 +0,0 @@
-#
-# This is the main Apache HTTP server configuration file.  It contains the
-# configuration directives that give the server its instructions.
-# See <URL:http://httpd.apache.org/docs/2.4/> for detailed information.
-# In particular, see 
-# <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
-# for a discussion of each configuration directive.
-#
-# Do NOT simply read the instructions in here without understanding
-# what they do.  They're here only as hints or reminders.  If you are unsure
-# consult the online docs. You have been warned.  
-#
-# Configuration and logfile names: If the filenames you specify for many
-# of the server's control files begin with "/" (or "drive:/" for Win32), the
-# server will use that explicit path.  If the filenames do *not* begin
-# with "/", the value of ServerRoot is prepended -- so "logs/access_log"
-# with ServerRoot set to "/usr/local/apache2" will be interpreted by the
-# server as "/usr/local/apache2/logs/access_log", whereas "/logs/access_log" 
-# will be interpreted as '/logs/access_log'.
-
-#
-# ServerRoot: The top of the directory tree under which the server's
-# configuration, error, and log files are kept.
-#
-# Do not add a slash at the end of the directory path.  If you point
-# ServerRoot at a non-local disk, be sure to specify a local disk on the
-# Mutex directive, if file-based mutexes are used.  If you wish to share the
-# same ServerRoot for multiple httpd daemons, you will need to change at
-# least PidFile.
-#
-ServerRoot "/usr/local/apache2"
-
-#
-# Mutex: Allows you to set the mutex mechanism and mutex file directory
-# for individual mutexes, or change the global defaults
-#
-# Uncomment and change the directory if mutexes are file-based and the default
-# mutex file directory is not on a local disk or is not appropriate for some
-# other reason.
-#
-# Mutex default:logs
-
-#
-# Listen: Allows you to bind Apache to specific IP addresses and/or
-# ports, instead of the default. See also the <VirtualHost>
-# directive.
-#
-# Change this to Listen on specific IP addresses as shown below to 
-# prevent Apache from glomming onto all bound IP addresses.
-#
-#Listen 12.34.56.78:80
-Listen 80
-
-#
-# Dynamic Shared Object (DSO) Support
-#
-# To be able to use the functionality of a module which was built as a DSO you
-# have to place corresponding `LoadModule' lines at this location so the
-# directives contained in it are actually available _before_ they are used.
-# Statically compiled modules (those listed by `httpd -l') do not need
-# to be loaded here.
-#
-# Example:
-# LoadModule foo_module modules/mod_foo.so
-#
-LoadModule mpm_event_module modules/mod_mpm_event.so
-#LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
-#LoadModule mpm_worker_module modules/mod_mpm_worker.so
-LoadModule authn_file_module modules/mod_authn_file.so
-#LoadModule authn_dbm_module modules/mod_authn_dbm.so
-#LoadModule authn_anon_module modules/mod_authn_anon.so
-#LoadModule authn_dbd_module modules/mod_authn_dbd.so
-#LoadModule authn_socache_module modules/mod_authn_socache.so
-LoadModule authn_core_module modules/mod_authn_core.so
-LoadModule authz_host_module modules/mod_authz_host.so
-LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
-LoadModule authz_user_module modules/mod_authz_user.so
-#LoadModule authz_dbm_module modules/mod_authz_dbm.so
-#LoadModule authz_owner_module modules/mod_authz_owner.so
-#LoadModule authz_dbd_module modules/mod_authz_dbd.so
-LoadModule authz_core_module modules/mod_authz_core.so
-#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
-#LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so
-LoadModule access_compat_module modules/mod_access_compat.so
-LoadModule auth_basic_module modules/mod_auth_basic.so
-#LoadModule auth_form_module modules/mod_auth_form.so
-#LoadModule auth_digest_module modules/mod_auth_digest.so
-#LoadModule allowmethods_module modules/mod_allowmethods.so
-#LoadModule isapi_module modules/mod_isapi.so
-#LoadModule file_cache_module modules/mod_file_cache.so
-#LoadModule cache_module modules/mod_cache.so
-#LoadModule cache_disk_module modules/mod_cache_disk.so
-#LoadModule cache_socache_module modules/mod_cache_socache.so
-#LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
-#LoadModule socache_dbm_module modules/mod_socache_dbm.so
-#LoadModule socache_memcache_module modules/mod_socache_memcache.so
-#LoadModule socache_redis_module modules/mod_socache_redis.so
-#LoadModule watchdog_module modules/mod_watchdog.so
-#LoadModule macro_module modules/mod_macro.so
-#LoadModule dbd_module modules/mod_dbd.so
-#LoadModule bucketeer_module modules/mod_bucketeer.so
-#LoadModule dumpio_module modules/mod_dumpio.so
-#LoadModule echo_module modules/mod_echo.so
-#LoadModule example_hooks_module modules/mod_example_hooks.so
-#LoadModule case_filter_module modules/mod_case_filter.so
-#LoadModule case_filter_in_module modules/mod_case_filter_in.so
-#LoadModule example_ipc_module modules/mod_example_ipc.so
-#LoadModule buffer_module modules/mod_buffer.so
-#LoadModule data_module modules/mod_data.so
-#LoadModule ratelimit_module modules/mod_ratelimit.so
-LoadModule reqtimeout_module modules/mod_reqtimeout.so
-#LoadModule ext_filter_module modules/mod_ext_filter.so
-#LoadModule request_module modules/mod_request.so
-#LoadModule include_module modules/mod_include.so
-LoadModule filter_module modules/mod_filter.so
-#LoadModule reflector_module modules/mod_reflector.so
-#LoadModule substitute_module modules/mod_substitute.so
-#LoadModule sed_module modules/mod_sed.so
-#LoadModule charset_lite_module modules/mod_charset_lite.so
-#LoadModule deflate_module modules/mod_deflate.so
-#LoadModule xml2enc_module modules/mod_xml2enc.so
-#LoadModule proxy_html_module modules/mod_proxy_html.so
-#LoadModule brotli_module modules/mod_brotli.so
-LoadModule mime_module modules/mod_mime.so
-#LoadModule ldap_module modules/mod_ldap.so
-LoadModule log_config_module modules/mod_log_config.so
-#LoadModule log_debug_module modules/mod_log_debug.so
-#LoadModule log_forensic_module modules/mod_log_forensic.so
-#LoadModule logio_module modules/mod_logio.so
-#LoadModule lua_module modules/mod_lua.so
-LoadModule env_module modules/mod_env.so
-#LoadModule mime_magic_module modules/mod_mime_magic.so
-#LoadModule cern_meta_module modules/mod_cern_meta.so
-#LoadModule expires_module modules/mod_expires.so
-LoadModule headers_module modules/mod_headers.so
-#LoadModule ident_module modules/mod_ident.so
-#LoadModule usertrack_module modules/mod_usertrack.so
-#LoadModule unique_id_module modules/mod_unique_id.so
-LoadModule setenvif_module modules/mod_setenvif.so
-LoadModule version_module modules/mod_version.so
-#LoadModule remoteip_module modules/mod_remoteip.so
-#LoadModule proxy_module modules/mod_proxy.so
-#LoadModule proxy_connect_module modules/mod_proxy_connect.so
-#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
-#LoadModule proxy_http_module modules/mod_proxy_http.so
-#LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
-#LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
-#LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
-#LoadModule proxy_fdpass_module modules/mod_proxy_fdpass.so
-#LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
-#LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
-#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
-#LoadModule proxy_express_module modules/mod_proxy_express.so
-#LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so
-#LoadModule session_module modules/mod_session.so
-#LoadModule session_cookie_module modules/mod_session_cookie.so
-#LoadModule session_crypto_module modules/mod_session_crypto.so
-#LoadModule session_dbd_module modules/mod_session_dbd.so
-#LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
-#LoadModule slotmem_plain_module modules/mod_slotmem_plain.so
-#LoadModule ssl_module modules/mod_ssl.so
-#LoadModule optional_hook_export_module modules/mod_optional_hook_export.so
-#LoadModule optional_hook_import_module modules/mod_optional_hook_import.so
-#LoadModule optional_fn_import_module modules/mod_optional_fn_import.so
-#LoadModule optional_fn_export_module modules/mod_optional_fn_export.so
-#LoadModule dialup_module modules/mod_dialup.so
-#LoadModule http2_module modules/mod_http2.so
-#LoadModule proxy_http2_module modules/mod_proxy_http2.so
-#LoadModule md_module modules/mod_md.so
-#LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
-#LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
-#LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
-#LoadModule lbmethod_heartbeat_module modules/mod_lbmethod_heartbeat.so
-LoadModule unixd_module modules/mod_unixd.so
-#LoadModule heartbeat_module modules/mod_heartbeat.so
-#LoadModule heartmonitor_module modules/mod_heartmonitor.so
-#LoadModule dav_module modules/mod_dav.so
-LoadModule status_module modules/mod_status.so
-LoadModule autoindex_module modules/mod_autoindex.so
-#LoadModule asis_module modules/mod_asis.so
-#LoadModule info_module modules/mod_info.so
-#LoadModule suexec_module modules/mod_suexec.so
-<IfModule !mpm_prefork_module>
-	#LoadModule cgid_module modules/mod_cgid.so
-</IfModule>
-<IfModule mpm_prefork_module>
-	#LoadModule cgi_module modules/mod_cgi.so
-</IfModule>
-#LoadModule dav_fs_module modules/mod_dav_fs.so
-#LoadModule dav_lock_module modules/mod_dav_lock.so
-#LoadModule vhost_alias_module modules/mod_vhost_alias.so
-#LoadModule negotiation_module modules/mod_negotiation.so
-LoadModule dir_module modules/mod_dir.so
-#LoadModule imagemap_module modules/mod_imagemap.so
-#LoadModule actions_module modules/mod_actions.so
-#LoadModule speling_module modules/mod_speling.so
-#LoadModule userdir_module modules/mod_userdir.so
-LoadModule alias_module modules/mod_alias.so
-#LoadModule rewrite_module modules/mod_rewrite.so
-
-<IfModule unixd_module>
-#
-# If you wish httpd to run as a different user or group, you must run
-# httpd as root initially and it will switch.  
-#
-# User/Group: The name (or #number) of the user/group to run httpd as.
-# It is usually good practice to create a dedicated user and group for
-# running httpd, as with most system services.
-#
-User www-data
-Group www-data
-
-</IfModule>
-
-# 'Main' server configuration
-#
-# The directives in this section set up the values used by the 'main'
-# server, which responds to any requests that aren't handled by a
-# <VirtualHost> definition.  These values also provide defaults for
-# any <VirtualHost> containers you may define later in the file.
-#
-# All of these directives may appear inside <VirtualHost> containers,
-# in which case these default settings will be overridden for the
-# virtual host being defined.
-#
-
-#
-# ServerAdmin: Your address, where problems with the server should be
-# e-mailed.  This address appears on some server-generated pages, such
-# as error documents.  e.g. admin@your-domain.com
-#
-ServerAdmin admin@mail.eom.dev
-
-#
-# ServerName gives the name and port that the server uses to identify itself.
-# This can often be determined automatically, but we recommend you specify
-# it explicitly to prevent problems during startup.
-#
-# If your host doesn't have a registered DNS name, enter its IP address here.
-#
-ServerName {{ httpd_server_name }}:80
-
-#
-# Deny access to the entirety of your server's filesystem. You must
-# explicitly permit access to web content directories in other 
-# <Directory> blocks below.
-#
-<Directory />
-    AllowOverride none
-    Require all denied
-</Directory>
-
-#
-# Note that from this point forward you must specifically allow
-# particular features to be enabled - so if something's not working as
-# you might expect, make sure that you have specifically enabled it
-# below.
-#
-
-#
-# DocumentRoot: The directory out of which you will serve your
-# documents. By default, all requests are taken from this directory, but
-# symbolic links and aliases may be used to point to other locations.
-#
-DocumentRoot "/usr/local/apache2/htdocs"
-<Directory "/usr/local/apache2/htdocs">
-    #
-    # Possible values for the Options directive are "None", "All",
-    # or any combination of:
-    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
-    #
-    # Note that "MultiViews" must be named *explicitly* --- "Options All"
-    # doesn't give it to you.
-    #
-    # The Options directive is both complicated and important.  Please see
-    # http://httpd.apache.org/docs/2.4/mod/core.html#options
-    # for more information.
-    #
-    Options Indexes FollowSymLinks
-
-    #
-    # AllowOverride controls what directives may be placed in .htaccess files.
-    # It can be "All", "None", or any combination of the keywords:
-    #   AllowOverride FileInfo AuthConfig Limit
-    #
-    AllowOverride None
-
-    #
-    # Controls who can get stuff from this server.
-    #
-    Require all granted
-</Directory>
-
-#
-# DirectoryIndex: sets the file that Apache will serve if a directory
-# is requested.
-#
-<IfModule dir_module>
-    DirectoryIndex index.html
-</IfModule>
-
-#
-# The following lines prevent .htaccess and .htpasswd files from being 
-# viewed by Web clients. 
-#
-<Files ".ht*">
-    Require all denied
-</Files>
-
-#
-# ErrorLog: The location of the error log file.
-# If you do not specify an ErrorLog directive within a <VirtualHost>
-# container, error messages relating to that virtual host will be
-# logged here.  If you *do* define an error logfile for a <VirtualHost>
-# container, that host's errors will be logged there and not here.
-#
-ErrorLog /proc/self/fd/2
-
-#
-# LogLevel: Control the number of messages logged to the error_log.
-# Possible values include: debug, info, notice, warn, error, crit,
-# alert, emerg.
-#
-LogLevel warn
-
-<IfModule log_config_module>
-    #
-    # The following directives define some format nicknames for use with
-    # a CustomLog directive (see below).
-    #
-    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
-    LogFormat "%h %l %u %t \"%r\" %>s %b" common
-
-    <IfModule logio_module>
-      # You need to enable mod_logio.c to use %I and %O
-      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
-    </IfModule>
-
-    #
-    # The location and format of the access logfile (Common Logfile Format).
-    # If you do not define any access logfiles within a <VirtualHost>
-    # container, they will be logged here.  Contrariwise, if you *do*
-    # define per-<VirtualHost> access logfiles, transactions will be
-    # logged therein and *not* in this file.
-    #
-    CustomLog /proc/self/fd/1 common
-
-    #
-    # If you prefer a logfile with access, agent, and referer information
-    # (Combined Logfile Format) you can use the following directive.
-    #
-    #CustomLog "logs/access_log" combined
-</IfModule>
-
-<IfModule alias_module>
-    #
-    # Redirect: Allows you to tell clients about documents that used to 
-    # exist in your server's namespace, but do not anymore. The client 
-    # will make a new request for the document at its new location.
-    # Example:
-    # Redirect permanent /foo http://www.example.com/bar
-
-    #
-    # Alias: Maps web paths into filesystem paths and is used to
-    # access content that does not live under the DocumentRoot.
-    # Example:
-    # Alias /webpath /full/filesystem/path
-    #
-    # If you include a trailing / on /webpath then the server will
-    # require it to be present in the URL.  You will also likely
-    # need to provide a <Directory> section to allow access to
-    # the filesystem path.
-
-    #
-    # ScriptAlias: This controls which directories contain server scripts. 
-    # ScriptAliases are essentially the same as Aliases, except that
-    # documents in the target directory are treated as applications and
-    # run by the server when requested rather than as documents sent to the
-    # client.  The same rules about trailing "/" apply to ScriptAlias
-    # directives as to Alias.
-    #
-    ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
-
-</IfModule>
-
-<IfModule cgid_module>
-    #
-    # ScriptSock: On threaded servers, designate the path to the UNIX
-    # socket used to communicate with the CGI daemon of mod_cgid.
-    #
-    #Scriptsock cgisock
-</IfModule>
-
-#
-# "/usr/local/apache2/cgi-bin" should be changed to whatever your ScriptAliased
-# CGI directory exists, if you have that configured.
-#
-<Directory "/usr/local/apache2/cgi-bin">
-    AllowOverride None
-    Options None
-    Require all granted
-</Directory>
-
-<IfModule headers_module>
-    #
-    # Avoid passing HTTP_PROXY environment to CGI's on this or any proxied
-    # backend servers which have lingering "httpoxy" defects.
-    # 'Proxy' request header is undefined by the IETF, not listed by IANA
-    #
-    RequestHeader unset Proxy early
-</IfModule>
-
-<IfModule mime_module>
-    #
-    # TypesConfig points to the file containing the list of mappings from
-    # filename extension to MIME-type.
-    #
-    TypesConfig conf/mime.types
-
-    #
-    # AddType allows you to add to or override the MIME configuration
-    # file specified in TypesConfig for specific file types.
-    #
-    #AddType application/x-gzip .tgz
-    #
-    # AddEncoding allows you to have certain browsers uncompress
-    # information on the fly. Note: Not all browsers support this.
-    #
-    #AddEncoding x-compress .Z
-    #AddEncoding x-gzip .gz .tgz
-    #
-    # If the AddEncoding directives above are commented-out, then you
-    # probably should define those extensions to indicate media types:
-    #
-    AddType application/x-compress .Z
-    AddType application/x-gzip .gz .tgz
-
-    #
-    # AddHandler allows you to map certain file extensions to "handlers":
-    # actions unrelated to filetype. These can be either built into the server
-    # or added with the Action directive (see below)
-    #
-    # To use CGI scripts outside of ScriptAliased directories:
-    # (You will also need to add "ExecCGI" to the "Options" directive.)
-    #
-    #AddHandler cgi-script .cgi
-
-    # For type maps (negotiated resources):
-    #AddHandler type-map var
-
-    #
-    # Filters allow you to process content before it is sent to the client.
-    #
-    # To parse .shtml files for server-side includes (SSI):
-    # (You will also need to add "Includes" to the "Options" directive.)
-    #
-    #AddType text/html .shtml
-    #AddOutputFilter INCLUDES .shtml
-</IfModule>
-
-#
-# The mod_mime_magic module allows the server to use various hints from the
-# contents of the file itself to determine its type.  The MIMEMagicFile
-# directive tells the module where the hint definitions are located.
-#
-#MIMEMagicFile conf/magic
-
-#
-# Customizable error responses come in three flavors:
-# 1) plain text 2) local redirects 3) external redirects
-#
-# Some examples:
-#ErrorDocument 500 "The server made a boo boo."
-#ErrorDocument 404 /missing.html
-#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
-#ErrorDocument 402 http://www.example.com/subscription_info.html
-#
-
-#
-# MaxRanges: Maximum number of Ranges in a request before
-# returning the entire resource, or one of the special
-# values 'default', 'none' or 'unlimited'.
-# Default setting is to accept 200 Ranges.
-#MaxRanges unlimited
-
-#
-# EnableMMAP and EnableSendfile: On systems that support it, 
-# memory-mapping or the sendfile syscall may be used to deliver
-# files.  This usually improves server performance, but must
-# be turned off when serving from networked-mounted 
-# filesystems or if support for these functions is otherwise
-# broken on your system.
-# Defaults: EnableMMAP On, EnableSendfile Off
-#
-#EnableMMAP off
-#EnableSendfile on
-
-# Supplemental configuration
-#
-# The configuration files in the conf/extra/ directory can be 
-# included to add extra features or to modify the default configuration of 
-# the server, or you may simply copy their contents here and change as 
-# necessary.
-
-# Server-pool management (MPM specific)
-#Include conf/extra/httpd-mpm.conf
-
-# Multi-language error messages
-#Include conf/extra/httpd-multilang-errordoc.conf
-
-# Fancy directory listings
-#Include conf/extra/httpd-autoindex.conf
-
-# Language settings
-#Include conf/extra/httpd-languages.conf
-
-# User home directories
-#Include conf/extra/httpd-userdir.conf
-
-# Real-time info on requests and configuration
-#Include conf/extra/httpd-info.conf
-
-# Virtual hosts
-#Include conf/extra/httpd-vhosts.conf
-
-# Local access to the Apache HTTP Server Manual
-#Include conf/extra/httpd-manual.conf
-
-# Distributed authoring and versioning (WebDAV)
-#Include conf/extra/httpd-dav.conf
-
-# Various default settings
-#Include conf/extra/httpd-default.conf
-
-{% for config in httpd_conf_extra %}
-Include conf/{{ config }}
-{% endfor %}
-
-# Configure mod_proxy_html to understand HTML4/XHTML1
-<IfModule proxy_html_module>
-Include conf/extra/proxy-html.conf
-</IfModule>
-
-# Secure (SSL/TLS) connections
-#Include conf/extra/httpd-ssl.conf
-#
-# Note: The following must must be present to support
-#       starting without SSL on platforms with no /dev/random equivalent
-#       but a statically compiled-in mod_ssl.
-#
-<IfModule ssl_module>
-SSLRandomSeed startup builtin
-SSLRandomSeed connect builtin
-</IfModule>
-

templates/ldap.toml.j2

@@ -0,0 +1,69 @@
+[[servers]]
+# Ldap server host (specify multiple hosts space separated)
+host = "openldap.openldap.svc.cluster.local"
+# Default port is 389 or 636 if use_ssl = true
+port = 389
+# Set to true if LDAP server should use an encrypted TLS connection (either with STARTTLS or LDAPS)
+use_ssl = false
+# If set to true, use LDAP with STARTTLS instead of LDAPS
+start_tls = false
+# The value of an accepted TLS cipher. By default, this value is empty. Example value: ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"])
+# For a complete list of supported ciphers and TLS versions, refer to: https://go.dev/src/crypto/tls/cipher_suites.go
+# Starting with Grafana v11.0 only ciphers with ECDHE support are accepted for TLS 1.2 connections.
+tls_ciphers = []
+# This is the minimum TLS version allowed. By default, this value is empty. Accepted values are: TLS1.1 (only for Grafana v10.4 or earlier), TLS1.2, TLS1.3.
+min_tls_version = ""
+# set to true if you want to skip SSL cert validation
+ssl_skip_verify = false
+# set to the path to your root CA certificate or leave unset to use system defaults
+# root_ca_cert = "/path/to/certificate.crt"
+# Authentication against LDAP servers requiring client certificates
+# client_cert = "/path/to/client.crt"
+# client_key = "/path/to/client.key"
+
+# Search user bind dn
+bind_dn = "cn=readonly,dc=eom,dc=dev"
+# Search user bind password
+# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
+bind_password = "{{ openldap_readonly_password }}"
+# We recommend using variable expansion for the bind_password, for more info https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#variable-expansion
+# bind_password = '$__env{LDAP_BIND_PASSWORD}'
+
+# Timeout in seconds. Applies to each host specified in the 'host' entry (space separated).
+timeout = 30
+
+# User search filter, for example "(cn=%s)" or "(sAMAccountName=%s)" or "(uid=%s)"
+# Allow login from email or username, example "(|(sAMAccountName=%s)(userPrincipalName=%s))"
+search_filter = "(&(objectClass=posixAccount)(uid=%s)(memberOf=cn=Grafana Users,ou=Grafana,ou=Services,dc=eom,dc=dev))"
+
+# An array of base dns to search through
+search_base_dns = ["dc=eom,dc=dev"]
+
+# Specify names of the LDAP attributes your LDAP uses
+[servers.attributes]
+username = "uid"
+email =  "mail"
+name = "givenName"
+surname = "sn"
+member_of = "memberOf"
+
+[[servers.group_mappings]]
+group_dn = "cn=Grafana Administrators,ou=Grafana,ou=Services,dc=eom,dc=dev"
+org_id = 1
+org_role = "Admin"
+grafana_admin = true
+
+[[servers.group_mappings]]
+group_dn = "cn=Grafana Users,ou=Grafana,ou=Services,dc=eom,dc=dev"
+org_id = 1
+org_role = "Viewer"
+
+[[servers.group_mappings]]
+group_dn = "cn=DevOps Owners,ou=Teams,dc=eom,dc=dev"
+org_id = 2
+org_role = "Admin"
+
+[[servers.group_mappings]]
+group_dn = "cn=Finance Owners,ou=Teams,dc=eom,dc=dev"
+org_id = 3
+org_role = "Admin"

templates/psql.sh.j2

@@ -0,0 +1,6 @@
+#!/bin/bash
+psql -U postgres <<-EOSQL
+	CREATE DATABASE {{ db }};
+	CREATE USER {{ user }} WITH ENCRYPTED PASSWORD '{{ pwd }}';
+	GRANT ALL PRIVILEGES ON {{ db }} TO {{ user }};
+	EOSQL