files/httpd-dav.conf

@@ -0,0 +1,36 @@
+#
+# Distributed authoring and versioning (WebDAV)
+#
+# Required modules: mod_alias, mod_auth_digest, mod_authn_core, mod_authn_file,
+#                   mod_authz_core, mod_authz_user, mod_dav, mod_dav_fs,
+#                   mod_setenvif
+LoadModule dav_module modules/mod_dav.so
+LoadModule dav_fs_module modules/mod_dav_fs.so
+
+# The following example gives DAV write access to a directory called
+# "uploads" under the ServerRoot directory.
+#
+# The User/Group specified in httpd.conf needs to have write permissions
+# on the directory where the DavLockDB is placed and on any directory where
+# "Dav On" is specified.
+
+DavLockDB "/usr/local/apache2/DavLock"
+
+<Directory "/usr/local/apache2/htdocs">
+    Dav On
+</Directory>
+
+#
+# The following directives disable redirects on non-GET requests for
+# a directory that does not include the trailing slash.  This fixes a 
+# problem with several clients that do not appropriately handle 
+# redirects for folders with DAV methods.
+#
+BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
+BrowserMatch "MS FrontPage" redirect-carefully
+BrowserMatch "^WebDrive" redirect-carefully
+BrowserMatch "^WebDAVFS/1.[01234]" redirect-carefully
+BrowserMatch "^gnome-vfs/1.0" redirect-carefully
+BrowserMatch "^XML Spy" redirect-carefully
+BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully
+BrowserMatch " Konqueror/4" redirect-carefully

files/httpd-gitweb.conf

@@ -0,0 +1,30 @@
+LoadModule rewrite_module modules/mod_rewrite.so
+LoadModule cgi_module modules/mod_cgi.so
+
+SetEnv GIT_PROJECT_ROOT /usr/local/apache2/htdocs
+SetEnv GIT_HTTP_EXPORT_ALL
+
+ScriptAliasMatch \
+	"(?x)^/(.*/(HEAD | \
+			info/refs | \
+			objects/(info/[^/]+ | \
+				 [0-9a-f]{2}/[0-9a-f]{38} | \
+				 pack/pack-[0-9a-f]{40}\.(pack|idx)) | \
+			git-(upload|receive)-pack))$" \
+	/usr/lib/git-core/git-http-backend/$1
+
+ScriptAlias / /usr/lib/cgi-bin/gitweb.cgi/
+
+<Directory "/usr/lib/git-core">
+    Options +ExecCGI +Indexes
+    Order allow,deny
+    Allow from all
+    Require all granted
+</Directory>
+
+<Directory "/usr/lib/cgi-bin">
+    Options +ExecCGI +Indexes
+    Order allow,deny
+    Allow from all
+    Require all granted
+</Directory>

files/httpd-proxy.conf

@@ -0,0 +1,139 @@
+LoadModule proxy_module modules/mod_proxy.so
+LoadModule proxy_http_module modules/mod_proxy_http.so
+LoadModule rewrite_module modules/mod_rewrite.so
+
+<VirtualHost *:80>
+	ServerName api.eom.dev
+	ServerAlias *.api.eom.dev
+
+	ProxyRequests Off
+	ProxyPreserveHost On
+
+	<Proxy *>
+		Order deny,allow
+		Allow from all
+	</Proxy>
+
+	ProxyPass / http://api/
+	ProxyPassReverse / http://api/
+</VirtualHost>
+<VirtualHost *:443>
+	ServerName api.eom.dev
+	ServerAlias *.api.eom.dev
+
+	SSLProxyEngine On
+	SSLCertificateFile "/usr/local/apache2/conf/server.crt"
+	SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"
+	ProxyRequests Off
+	ProxyPreserveHost On
+
+	<Proxy *>
+		Order deny,allow
+		Allow from all
+	</Proxy>
+
+	ProxyPass / http://api/
+	ProxyPassReverse / http://api/
+</VirtualHost>
+
+<VirtualHost *:80>
+	ServerName git.eom.dev
+	ServerAlias *.git.eom.dev
+
+	ProxyRequests Off
+	ProxyPreserveHost On
+
+	<Proxy *>
+		Order deny,allow
+		Allow from all
+	</Proxy>
+
+	ProxyPass / http://git/
+	ProxyPassReverse / http://git/
+</VirtualHost>
+<VirtualHost *:443>
+	ServerName git.eom.dev
+	ServerAlias *.git.eom.dev
+
+	SSLProxyEngine On
+	SSLCertificateFile "/usr/local/apache2/conf/server.crt"
+	SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"
+	ProxyRequests Off
+	ProxyPreserveHost On
+
+	<Proxy *>
+		Order deny,allow
+		Allow from all
+	</Proxy>
+
+	ProxyPass / http://git/
+	ProxyPassReverse / http://git/
+</VirtualHost>
+
+<VirtualHost *:80>
+	ServerName media.eom.dev
+	ServerAlias *.media.eom.dev
+
+	ProxyRequests Off
+	ProxyPreserveHost On
+
+	<Proxy *>
+		Order deny,allow
+		Allow from all
+	</Proxy>
+
+	ProxyPass / http://media/
+	ProxyPassReverse / http://media/
+</VirtualHost>
+<VirtualHost *:443>
+	ServerName media.eom.dev
+	ServerAlias *.media.eom.dev
+
+	SSLProxyEngine On
+	SSLCertificateFile "/usr/local/apache2/conf/server.crt"
+	SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"
+	ProxyRequests Off
+	ProxyPreserveHost On
+
+	<Proxy *>
+		Order deny,allow
+		Allow from all
+	</Proxy>
+
+	ProxyPass / http://media/
+	ProxyPassReverse / http://media/
+</VirtualHost>
+
+<VirtualHost *:80>
+	ServerName www.eom.dev
+	ServerAlias *.www.eom.dev
+
+	ProxyRequests Off
+	ProxyPreserveHost On
+
+	<Proxy *>
+		Order deny,allow
+		Allow from all
+	</Proxy>
+
+	ProxyPass / http://www/
+	ProxyPassReverse / http://www/
+</VirtualHost>
+<VirtualHost *:443>
+	ServerName www.eom.dev
+	ServerAlias *.www.eom.dev
+
+	SSLProxyEngine On
+	SSLCertificateFile "/usr/local/apache2/conf/server.crt"
+	SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"
+	ProxyRequests Off
+	ProxyPreserveHost On
+
+	<Proxy *>
+		Order deny,allow
+		Allow from all
+	</Proxy>
+
+	ProxyPass / http://www/
+	ProxyPassReverse / http://www/
+</VirtualHost>

files/httpd-ssi.conf

@@ -0,0 +1,11 @@
+LoadModule include_module modules/mod_include.so
+
+AddOutputFilter INCLUDES .shtml
+
+<Directory "/usr/local/apache2/htdocs">
+    Options +Includes
+</Directory>
+
+<IfModule dir_module>
+    DirectoryIndex index.shtml
+</IfModule>

files/httpd-ssl.conf

@@ -0,0 +1,292 @@
+#
+# This is the Apache server configuration file providing SSL support.
+# It contains the configuration directives to instruct the server how to
+# serve pages over an https connection. For detailed information about these 
+# directives see <URL:http://httpd.apache.org/docs/2.4/mod/mod_ssl.html>
+# 
+# Do NOT simply read the instructions in here without understanding
+# what they do.  They're here only as hints or reminders.  If you are unsure
+# consult the online docs. You have been warned.  
+#
+# Required modules: mod_log_config, mod_setenvif, mod_ssl,
+#          socache_shmcb_module (for default value of SSLSessionCache)
+LoadModule ssl_module modules/mod_ssl.so
+LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
+
+#
+# Pseudo Random Number Generator (PRNG):
+# Configure one or more sources to seed the PRNG of the SSL library.
+# The seed data should be of good random quality.
+# WARNING! On some platforms /dev/random blocks if not enough entropy
+# is available. This means you then cannot use the /dev/random device
+# because it would lead to very long connection times (as long as
+# it requires to make more entropy available). But usually those
+# platforms additionally provide a /dev/urandom device which doesn't
+# block. So, if available, use this one instead. Read the mod_ssl User
+# Manual for more details.
+#
+#SSLRandomSeed startup file:/dev/random  512
+#SSLRandomSeed startup file:/dev/urandom 512
+#SSLRandomSeed connect file:/dev/random  512
+#SSLRandomSeed connect file:/dev/urandom 512
+
+
+#
+# When we also provide SSL we have to listen to the 
+# standard HTTP port (see above) and to the HTTPS port
+#
+Listen 443
+
+##
+##  SSL Global Context
+##
+##  All SSL configuration in this context applies both to
+##  the main server and all SSL-enabled virtual hosts.
+##
+
+#   SSL Cipher Suite:
+#   List the ciphers that the client is permitted to negotiate,
+#   and that httpd will negotiate as the client of a proxied server.
+#   See the OpenSSL documentation for a complete list of ciphers, and
+#   ensure these follow appropriate best practices for this deployment.
+#   httpd 2.2.30, 2.4.13 and later force-disable aNULL, eNULL and EXP ciphers,
+#   while OpenSSL disabled these by default in 0.9.8zf/1.0.0r/1.0.1m/1.0.2a.
+SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
+SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
+
+#  By the end of 2016, only TLSv1.2 ciphers should remain in use.
+#  Older ciphers should be disallowed as soon as possible, while the
+#  kRSA ciphers do not offer forward secrecy.  These changes inhibit
+#  older clients (such as IE6 SP2 or IE8 on Windows XP, or other legacy
+#  non-browser tooling) from successfully connecting.  
+#
+#  To restrict mod_ssl to use only TLSv1.2 ciphers, and disable
+#  those protocols which do not support forward secrecy, replace
+#  the SSLCipherSuite and SSLProxyCipherSuite directives above with
+#  the following two directives, as soon as practical.
+# SSLCipherSuite HIGH:MEDIUM:!SSLv3:!kRSA
+# SSLProxyCipherSuite HIGH:MEDIUM:!SSLv3:!kRSA
+
+#   User agents such as web browsers are not configured for the user's
+#   own preference of either security or performance, therefore this
+#   must be the prerogative of the web server administrator who manages
+#   cpu load versus confidentiality, so enforce the server's cipher order.
+SSLHonorCipherOrder on 
+
+#   SSL Protocol support:
+#   List the protocol versions which clients are allowed to connect with.
+#   Disable SSLv3 by default (cf. RFC 7525 3.1.1).  TLSv1 (1.0) should be
+#   disabled as quickly as practical.  By the end of 2016, only the TLSv1.2
+#   protocol or later should remain in use.
+SSLProtocol all -SSLv3
+SSLProxyProtocol all -SSLv3
+
+#   Pass Phrase Dialog:
+#   Configure the pass phrase gathering process.
+#   The filtering dialog program (`builtin' is an internal
+#   terminal dialog) has to provide the pass phrase on stdout.
+SSLPassPhraseDialog  builtin
+
+#   Inter-Process Session Cache:
+#   Configure the SSL Session Cache: First the mechanism 
+#   to use and second the expiring timeout (in seconds).
+#SSLSessionCache         "dbm:/usr/local/apache2/logs/ssl_scache"
+SSLSessionCache        "shmcb:/usr/local/apache2/logs/ssl_scache(512000)"
+SSLSessionCacheTimeout  300
+
+#   OCSP Stapling (requires OpenSSL 0.9.8h or later)
+#
+#   This feature is disabled by default and requires at least
+#   the two directives SSLUseStapling and SSLStaplingCache.
+#   Refer to the documentation on OCSP Stapling in the SSL/TLS
+#   How-To for more information.
+#
+#   Enable stapling for all SSL-enabled servers:
+#SSLUseStapling On
+
+#   Define a relatively small cache for OCSP Stapling using
+#   the same mechanism that is used for the SSL session cache
+#   above.  If stapling is used with more than a few certificates,
+#   the size may need to be increased.  (AH01929 will be logged.)
+#SSLStaplingCache "shmcb:/usr/local/apache2/logs/ssl_stapling(32768)"
+
+#   Seconds before valid OCSP responses are expired from the cache
+#SSLStaplingStandardCacheTimeout 3600
+
+#   Seconds before invalid OCSP responses are expired from the cache
+#SSLStaplingErrorCacheTimeout 600
+
+##
+## SSL Virtual Host Context
+##
+
+<VirtualHost _default_:443>
+
+#   General setup for the virtual host
+DocumentRoot "/usr/local/apache2/htdocs"
+ServerName proxy.eom.dev:443
+ServerAdmin admin@mail.eom.dev
+ErrorLog /proc/self/fd/2
+TransferLog /proc/self/fd/1
+
+#   SSL Engine Switch:
+#   Enable/Disable SSL for this virtual host.
+SSLEngine on
+
+#   Server Certificate:
+#   Point SSLCertificateFile at a PEM encoded certificate.  If
+#   the certificate is encrypted, then you will be prompted for a
+#   pass phrase.  Note that a kill -HUP will prompt again.  Keep
+#   in mind that if you have both an RSA and a DSA certificate you
+#   can configure both in parallel (to also allow the use of DSA
+#   ciphers, etc.)
+#   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
+#   require an ECC certificate which can also be configured in
+#   parallel.
+SSLCertificateFile "/usr/local/apache2/conf/server.crt"
+#SSLCertificateFile "/usr/local/apache2/conf/server-dsa.crt"
+#SSLCertificateFile "/usr/local/apache2/conf/server-ecc.crt"
+
+#   Server Private Key:
+#   If the key is not combined with the certificate, use this
+#   directive to point at the key file.  Keep in mind that if
+#   you've both a RSA and a DSA private key you can configure
+#   both in parallel (to also allow the use of DSA ciphers, etc.)
+#   ECC keys, when in use, can also be configured in parallel
+SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"
+#SSLCertificateKeyFile "/usr/local/apache2/conf/server-dsa.key"
+#SSLCertificateKeyFile "/usr/local/apache2/conf/server-ecc.key"
+
+#   Server Certificate Chain:
+#   Point SSLCertificateChainFile at a file containing the
+#   concatenation of PEM encoded CA certificates which form the
+#   certificate chain for the server certificate. Alternatively
+#   the referenced file can be the same as SSLCertificateFile
+#   when the CA certificates are directly appended to the server
+#   certificate for convenience.
+#SSLCertificateChainFile "/usr/local/apache2/conf/server-ca.crt"
+
+#   Certificate Authority (CA):
+#   Set the CA certificate verification path where to find CA
+#   certificates for client authentication or alternatively one
+#   huge file containing all of them (file must be PEM encoded)
+#   Note: Inside SSLCACertificatePath you need hash symlinks
+#         to point to the certificate files. Use the provided
+#         Makefile to update the hash symlinks after changes.
+#SSLCACertificatePath "/usr/local/apache2/conf/ssl.crt"
+#SSLCACertificateFile "/usr/local/apache2/conf/ssl.crt/ca-bundle.crt"
+
+#   Certificate Revocation Lists (CRL):
+#   Set the CA revocation path where to find CA CRLs for client
+#   authentication or alternatively one huge file containing all
+#   of them (file must be PEM encoded).
+#   The CRL checking mode needs to be configured explicitly
+#   through SSLCARevocationCheck (defaults to "none" otherwise).
+#   Note: Inside SSLCARevocationPath you need hash symlinks
+#         to point to the certificate files. Use the provided
+#         Makefile to update the hash symlinks after changes.
+#SSLCARevocationPath "/usr/local/apache2/conf/ssl.crl"
+#SSLCARevocationFile "/usr/local/apache2/conf/ssl.crl/ca-bundle.crl"
+#SSLCARevocationCheck chain
+
+#   Client Authentication (Type):
+#   Client certificate verification type and depth.  Types are
+#   none, optional, require and optional_no_ca.  Depth is a
+#   number which specifies how deeply to verify the certificate
+#   issuer chain before deciding the certificate is not valid.
+#SSLVerifyClient require
+#SSLVerifyDepth  10
+
+#   TLS-SRP mutual authentication:
+#   Enable TLS-SRP and set the path to the OpenSSL SRP verifier
+#   file (containing login information for SRP user accounts). 
+#   Requires OpenSSL 1.0.1 or newer. See the mod_ssl FAQ for
+#   detailed instructions on creating this file. Example:
+#   "openssl srp -srpvfile /usr/local/apache2/conf/passwd.srpv -add username"
+#SSLSRPVerifierFile "/usr/local/apache2/conf/passwd.srpv"
+
+#   Access Control:
+#   With SSLRequire you can do per-directory access control based
+#   on arbitrary complex boolean expressions containing server
+#   variable checks and other lookup directives.  The syntax is a
+#   mixture between C and Perl.  See the mod_ssl documentation
+#   for more details.
+#<Location />
+#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
+#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
+#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
+#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
+#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
+#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
+#</Location>
+
+#   SSL Engine Options:
+#   Set various options for the SSL engine.
+#   o FakeBasicAuth:
+#     Translate the client X.509 into a Basic Authorisation.  This means that
+#     the standard Auth/DBMAuth methods can be used for access control.  The
+#     user name is the `one line' version of the client's X.509 certificate.
+#     Note that no password is obtained from the user. Every entry in the user
+#     file needs this password: `xxj31ZMTZzkVA'.
+#   o ExportCertData:
+#     This exports two additional environment variables: SSL_CLIENT_CERT and
+#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
+#     server (always existing) and the client (only existing when client
+#     authentication is used). This can be used to import the certificates
+#     into CGI scripts.
+#   o StdEnvVars:
+#     This exports the standard SSL/TLS related `SSL_*' environment variables.
+#     Per default this exportation is switched off for performance reasons,
+#     because the extraction step is an expensive operation and is usually
+#     useless for serving static content. So one usually enables the
+#     exportation for CGI and SSI requests only.
+#   o StrictRequire:
+#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
+#     under a "Satisfy any" situation, i.e. when it applies access is denied
+#     and no other module can change it.
+#   o OptRenegotiate:
+#     This enables optimized SSL connection renegotiation handling when SSL
+#     directives are used in per-directory context. 
+#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
+<FilesMatch "\.(cgi|shtml|phtml|php)$">
+    SSLOptions +StdEnvVars
+</FilesMatch>
+<Directory "/usr/local/apache2/cgi-bin">
+    SSLOptions +StdEnvVars
+</Directory>
+
+#   SSL Protocol Adjustments:
+#   The safe and default but still SSL/TLS standard compliant shutdown
+#   approach is that mod_ssl sends the close notify alert but doesn't wait for
+#   the close notify alert from client. When you need a different shutdown
+#   approach you can use one of the following variables:
+#   o ssl-unclean-shutdown:
+#     This forces an unclean shutdown when the connection is closed, i.e. no
+#     SSL close notify alert is sent or allowed to be received.  This violates
+#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
+#     this when you receive I/O errors because of the standard approach where
+#     mod_ssl sends the close notify alert.
+#   o ssl-accurate-shutdown:
+#     This forces an accurate shutdown when the connection is closed, i.e. a
+#     SSL close notify alert is send and mod_ssl waits for the close notify
+#     alert of the client. This is 100% SSL/TLS standard compliant, but in
+#     practice often causes hanging connections with brain-dead browsers. Use
+#     this only for browsers where you know that their SSL implementation
+#     works correctly. 
+#   Notice: Most problems of broken clients are also related to the HTTP
+#   keep-alive facility, so you usually additionally want to disable
+#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
+#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
+#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
+#   "force-response-1.0" for this.
+BrowserMatch "MSIE [2-5]" \
+         nokeepalive ssl-unclean-shutdown \
+         downgrade-1.0 force-response-1.0
+
+#   Per-Server Logging:
+#   The home of a custom SSL log file. Use this when you want a
+#   compact non-error SSL logfile on a virtual host basis.
+CustomLog /proc/self/fd/1 \
+          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
+
+</VirtualHost>                                  

files/httpd-wsgi.conf

@@ -0,0 +1,3 @@
+LoadModule wsgi_module modules/mod_wsgi.so
+
+WSGIScriptAlias / /usr/local/apache2/htdocs/wsgi_app.py

files/httpd.conf

@@ -0,0 +1,551 @@
+#
+# This is the main Apache HTTP server configuration file.  It contains the
+# configuration directives that give the server its instructions.
+# See <URL:http://httpd.apache.org/docs/2.4/> for detailed information.
+# In particular, see 
+# <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
+# for a discussion of each configuration directive.
+#
+# Do NOT simply read the instructions in here without understanding
+# what they do.  They're here only as hints or reminders.  If you are unsure
+# consult the online docs. You have been warned.  
+#
+# Configuration and logfile names: If the filenames you specify for many
+# of the server's control files begin with "/" (or "drive:/" for Win32), the
+# server will use that explicit path.  If the filenames do *not* begin
+# with "/", the value of ServerRoot is prepended -- so "logs/access_log"
+# with ServerRoot set to "/usr/local/apache2" will be interpreted by the
+# server as "/usr/local/apache2/logs/access_log", whereas "/logs/access_log" 
+# will be interpreted as '/logs/access_log'.
+
+#
+# ServerRoot: The top of the directory tree under which the server's
+# configuration, error, and log files are kept.
+#
+# Do not add a slash at the end of the directory path.  If you point
+# ServerRoot at a non-local disk, be sure to specify a local disk on the
+# Mutex directive, if file-based mutexes are used.  If you wish to share the
+# same ServerRoot for multiple httpd daemons, you will need to change at
+# least PidFile.
+#
+ServerRoot "/usr/local/apache2"
+
+#
+# Mutex: Allows you to set the mutex mechanism and mutex file directory
+# for individual mutexes, or change the global defaults
+#
+# Uncomment and change the directory if mutexes are file-based and the default
+# mutex file directory is not on a local disk or is not appropriate for some
+# other reason.
+#
+# Mutex default:logs
+
+#
+# Listen: Allows you to bind Apache to specific IP addresses and/or
+# ports, instead of the default. See also the <VirtualHost>
+# directive.
+#
+# Change this to Listen on specific IP addresses as shown below to 
+# prevent Apache from glomming onto all bound IP addresses.
+#
+#Listen 12.34.56.78:80
+Listen 80
+
+#
+# Dynamic Shared Object (DSO) Support
+#
+# To be able to use the functionality of a module which was built as a DSO you
+# have to place corresponding `LoadModule' lines at this location so the
+# directives contained in it are actually available _before_ they are used.
+# Statically compiled modules (those listed by `httpd -l') do not need
+# to be loaded here.
+#
+# Example:
+# LoadModule foo_module modules/mod_foo.so
+#
+LoadModule mpm_event_module modules/mod_mpm_event.so
+#LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
+#LoadModule mpm_worker_module modules/mod_mpm_worker.so
+LoadModule authn_file_module modules/mod_authn_file.so
+#LoadModule authn_dbm_module modules/mod_authn_dbm.so
+#LoadModule authn_anon_module modules/mod_authn_anon.so
+#LoadModule authn_dbd_module modules/mod_authn_dbd.so
+#LoadModule authn_socache_module modules/mod_authn_socache.so
+LoadModule authn_core_module modules/mod_authn_core.so
+LoadModule authz_host_module modules/mod_authz_host.so
+LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
+LoadModule authz_user_module modules/mod_authz_user.so
+#LoadModule authz_dbm_module modules/mod_authz_dbm.so
+#LoadModule authz_owner_module modules/mod_authz_owner.so
+#LoadModule authz_dbd_module modules/mod_authz_dbd.so
+LoadModule authz_core_module modules/mod_authz_core.so
+#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
+#LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so
+LoadModule access_compat_module modules/mod_access_compat.so
+LoadModule auth_basic_module modules/mod_auth_basic.so
+#LoadModule auth_form_module modules/mod_auth_form.so
+#LoadModule auth_digest_module modules/mod_auth_digest.so
+#LoadModule allowmethods_module modules/mod_allowmethods.so
+#LoadModule isapi_module modules/mod_isapi.so
+#LoadModule file_cache_module modules/mod_file_cache.so
+#LoadModule cache_module modules/mod_cache.so
+#LoadModule cache_disk_module modules/mod_cache_disk.so
+#LoadModule cache_socache_module modules/mod_cache_socache.so
+#LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
+#LoadModule socache_dbm_module modules/mod_socache_dbm.so
+#LoadModule socache_memcache_module modules/mod_socache_memcache.so
+#LoadModule socache_redis_module modules/mod_socache_redis.so
+#LoadModule watchdog_module modules/mod_watchdog.so
+#LoadModule macro_module modules/mod_macro.so
+#LoadModule dbd_module modules/mod_dbd.so
+#LoadModule bucketeer_module modules/mod_bucketeer.so
+#LoadModule dumpio_module modules/mod_dumpio.so
+#LoadModule echo_module modules/mod_echo.so
+#LoadModule example_hooks_module modules/mod_example_hooks.so
+#LoadModule case_filter_module modules/mod_case_filter.so
+#LoadModule case_filter_in_module modules/mod_case_filter_in.so
+#LoadModule example_ipc_module modules/mod_example_ipc.so
+#LoadModule buffer_module modules/mod_buffer.so
+#LoadModule data_module modules/mod_data.so
+#LoadModule ratelimit_module modules/mod_ratelimit.so
+LoadModule reqtimeout_module modules/mod_reqtimeout.so
+#LoadModule ext_filter_module modules/mod_ext_filter.so
+#LoadModule request_module modules/mod_request.so
+#LoadModule include_module modules/mod_include.so
+LoadModule filter_module modules/mod_filter.so
+#LoadModule reflector_module modules/mod_reflector.so
+#LoadModule substitute_module modules/mod_substitute.so
+#LoadModule sed_module modules/mod_sed.so
+#LoadModule charset_lite_module modules/mod_charset_lite.so
+#LoadModule deflate_module modules/mod_deflate.so
+#LoadModule xml2enc_module modules/mod_xml2enc.so
+#LoadModule proxy_html_module modules/mod_proxy_html.so
+#LoadModule brotli_module modules/mod_brotli.so
+LoadModule mime_module modules/mod_mime.so
+#LoadModule ldap_module modules/mod_ldap.so
+LoadModule log_config_module modules/mod_log_config.so
+#LoadModule log_debug_module modules/mod_log_debug.so
+#LoadModule log_forensic_module modules/mod_log_forensic.so
+#LoadModule logio_module modules/mod_logio.so
+#LoadModule lua_module modules/mod_lua.so
+LoadModule env_module modules/mod_env.so
+#LoadModule mime_magic_module modules/mod_mime_magic.so
+#LoadModule cern_meta_module modules/mod_cern_meta.so
+#LoadModule expires_module modules/mod_expires.so
+LoadModule headers_module modules/mod_headers.so
+#LoadModule ident_module modules/mod_ident.so
+#LoadModule usertrack_module modules/mod_usertrack.so
+#LoadModule unique_id_module modules/mod_unique_id.so
+LoadModule setenvif_module modules/mod_setenvif.so
+LoadModule version_module modules/mod_version.so
+#LoadModule remoteip_module modules/mod_remoteip.so
+#LoadModule proxy_module modules/mod_proxy.so
+#LoadModule proxy_connect_module modules/mod_proxy_connect.so
+#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
+#LoadModule proxy_http_module modules/mod_proxy_http.so
+#LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
+#LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
+#LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
+#LoadModule proxy_fdpass_module modules/mod_proxy_fdpass.so
+#LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
+#LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
+#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
+#LoadModule proxy_express_module modules/mod_proxy_express.so
+#LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so
+#LoadModule session_module modules/mod_session.so
+#LoadModule session_cookie_module modules/mod_session_cookie.so
+#LoadModule session_crypto_module modules/mod_session_crypto.so
+#LoadModule session_dbd_module modules/mod_session_dbd.so
+#LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
+#LoadModule slotmem_plain_module modules/mod_slotmem_plain.so
+#LoadModule ssl_module modules/mod_ssl.so
+#LoadModule optional_hook_export_module modules/mod_optional_hook_export.so
+#LoadModule optional_hook_import_module modules/mod_optional_hook_import.so
+#LoadModule optional_fn_import_module modules/mod_optional_fn_import.so
+#LoadModule optional_fn_export_module modules/mod_optional_fn_export.so
+#LoadModule dialup_module modules/mod_dialup.so
+#LoadModule http2_module modules/mod_http2.so
+#LoadModule proxy_http2_module modules/mod_proxy_http2.so
+#LoadModule md_module modules/mod_md.so
+#LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
+#LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
+#LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
+#LoadModule lbmethod_heartbeat_module modules/mod_lbmethod_heartbeat.so
+LoadModule unixd_module modules/mod_unixd.so
+#LoadModule heartbeat_module modules/mod_heartbeat.so
+#LoadModule heartmonitor_module modules/mod_heartmonitor.so
+#LoadModule dav_module modules/mod_dav.so
+LoadModule status_module modules/mod_status.so
+LoadModule autoindex_module modules/mod_autoindex.so
+#LoadModule asis_module modules/mod_asis.so
+#LoadModule info_module modules/mod_info.so
+#LoadModule suexec_module modules/mod_suexec.so
+<IfModule !mpm_prefork_module>
+	#LoadModule cgid_module modules/mod_cgid.so
+</IfModule>
+<IfModule mpm_prefork_module>
+	#LoadModule cgi_module modules/mod_cgi.so
+</IfModule>
+#LoadModule dav_fs_module modules/mod_dav_fs.so
+#LoadModule dav_lock_module modules/mod_dav_lock.so
+#LoadModule vhost_alias_module modules/mod_vhost_alias.so
+#LoadModule negotiation_module modules/mod_negotiation.so
+LoadModule dir_module modules/mod_dir.so
+#LoadModule imagemap_module modules/mod_imagemap.so
+#LoadModule actions_module modules/mod_actions.so
+#LoadModule speling_module modules/mod_speling.so
+#LoadModule userdir_module modules/mod_userdir.so
+LoadModule alias_module modules/mod_alias.so
+#LoadModule rewrite_module modules/mod_rewrite.so
+
+<IfModule unixd_module>
+#
+# If you wish httpd to run as a different user or group, you must run
+# httpd as root initially and it will switch.  
+#
+# User/Group: The name (or #number) of the user/group to run httpd as.
+# It is usually good practice to create a dedicated user and group for
+# running httpd, as with most system services.
+#
+User www-data
+Group www-data
+
+</IfModule>
+
+# 'Main' server configuration
+#
+# The directives in this section set up the values used by the 'main'
+# server, which responds to any requests that aren't handled by a
+# <VirtualHost> definition.  These values also provide defaults for
+# any <VirtualHost> containers you may define later in the file.
+#
+# All of these directives may appear inside <VirtualHost> containers,
+# in which case these default settings will be overridden for the
+# virtual host being defined.
+#
+
+#
+# ServerAdmin: Your address, where problems with the server should be
+# e-mailed.  This address appears on some server-generated pages, such
+# as error documents.  e.g. admin@your-domain.com
+#
+ServerAdmin you@example.com
+
+#
+# ServerName gives the name and port that the server uses to identify itself.
+# This can often be determined automatically, but we recommend you specify
+# it explicitly to prevent problems during startup.
+#
+# If your host doesn't have a registered DNS name, enter its IP address here.
+#
+#ServerName www.example.com:80
+
+#
+# Deny access to the entirety of your server's filesystem. You must
+# explicitly permit access to web content directories in other 
+# <Directory> blocks below.
+#
+<Directory />
+    AllowOverride none
+    Require all denied
+</Directory>
+
+#
+# Note that from this point forward you must specifically allow
+# particular features to be enabled - so if something's not working as
+# you might expect, make sure that you have specifically enabled it
+# below.
+#
+
+#
+# DocumentRoot: The directory out of which you will serve your
+# documents. By default, all requests are taken from this directory, but
+# symbolic links and aliases may be used to point to other locations.
+#
+DocumentRoot "/usr/local/apache2/htdocs"
+<Directory "/usr/local/apache2/htdocs">
+    #
+    # Possible values for the Options directive are "None", "All",
+    # or any combination of:
+    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
+    #
+    # Note that "MultiViews" must be named *explicitly* --- "Options All"
+    # doesn't give it to you.
+    #
+    # The Options directive is both complicated and important.  Please see
+    # http://httpd.apache.org/docs/2.4/mod/core.html#options
+    # for more information.
+    #
+    Options Indexes FollowSymLinks
+
+    #
+    # AllowOverride controls what directives may be placed in .htaccess files.
+    # It can be "All", "None", or any combination of the keywords:
+    #   AllowOverride FileInfo AuthConfig Limit
+    #
+    AllowOverride None
+
+    #
+    # Controls who can get stuff from this server.
+    #
+    Require all granted
+</Directory>
+
+#
+# DirectoryIndex: sets the file that Apache will serve if a directory
+# is requested.
+#
+<IfModule dir_module>
+    DirectoryIndex index.html
+</IfModule>
+
+#
+# The following lines prevent .htaccess and .htpasswd files from being 
+# viewed by Web clients. 
+#
+<Files ".ht*">
+    Require all denied
+</Files>
+
+#
+# ErrorLog: The location of the error log file.
+# If you do not specify an ErrorLog directive within a <VirtualHost>
+# container, error messages relating to that virtual host will be
+# logged here.  If you *do* define an error logfile for a <VirtualHost>
+# container, that host's errors will be logged there and not here.
+#
+ErrorLog /proc/self/fd/2
+
+#
+# LogLevel: Control the number of messages logged to the error_log.
+# Possible values include: debug, info, notice, warn, error, crit,
+# alert, emerg.
+#
+LogLevel warn
+
+<IfModule log_config_module>
+    #
+    # The following directives define some format nicknames for use with
+    # a CustomLog directive (see below).
+    #
+    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+    LogFormat "%h %l %u %t \"%r\" %>s %b" common
+
+    <IfModule logio_module>
+      # You need to enable mod_logio.c to use %I and %O
+      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
+    </IfModule>
+
+    #
+    # The location and format of the access logfile (Common Logfile Format).
+    # If you do not define any access logfiles within a <VirtualHost>
+    # container, they will be logged here.  Contrariwise, if you *do*
+    # define per-<VirtualHost> access logfiles, transactions will be
+    # logged therein and *not* in this file.
+    #
+    CustomLog /proc/self/fd/1 common
+
+    #
+    # If you prefer a logfile with access, agent, and referer information
+    # (Combined Logfile Format) you can use the following directive.
+    #
+    #CustomLog "logs/access_log" combined
+</IfModule>
+
+<IfModule alias_module>
+    #
+    # Redirect: Allows you to tell clients about documents that used to 
+    # exist in your server's namespace, but do not anymore. The client 
+    # will make a new request for the document at its new location.
+    # Example:
+    # Redirect permanent /foo http://www.example.com/bar
+
+    #
+    # Alias: Maps web paths into filesystem paths and is used to
+    # access content that does not live under the DocumentRoot.
+    # Example:
+    # Alias /webpath /full/filesystem/path
+    #
+    # If you include a trailing / on /webpath then the server will
+    # require it to be present in the URL.  You will also likely
+    # need to provide a <Directory> section to allow access to
+    # the filesystem path.
+
+    #
+    # ScriptAlias: This controls which directories contain server scripts. 
+    # ScriptAliases are essentially the same as Aliases, except that
+    # documents in the target directory are treated as applications and
+    # run by the server when requested rather than as documents sent to the
+    # client.  The same rules about trailing "/" apply to ScriptAlias
+    # directives as to Alias.
+    #
+    ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
+
+</IfModule>
+
+<IfModule cgid_module>
+    #
+    # ScriptSock: On threaded servers, designate the path to the UNIX
+    # socket used to communicate with the CGI daemon of mod_cgid.
+    #
+    #Scriptsock cgisock
+</IfModule>
+
+#
+# "/usr/local/apache2/cgi-bin" should be changed to whatever your ScriptAliased
+# CGI directory exists, if you have that configured.
+#
+<Directory "/usr/local/apache2/cgi-bin">
+    AllowOverride None
+    Options None
+    Require all granted
+</Directory>
+
+<IfModule headers_module>
+    #
+    # Avoid passing HTTP_PROXY environment to CGI's on this or any proxied
+    # backend servers which have lingering "httpoxy" defects.
+    # 'Proxy' request header is undefined by the IETF, not listed by IANA
+    #
+    RequestHeader unset Proxy early
+</IfModule>
+
+<IfModule mime_module>
+    #
+    # TypesConfig points to the file containing the list of mappings from
+    # filename extension to MIME-type.
+    #
+    TypesConfig conf/mime.types
+
+    #
+    # AddType allows you to add to or override the MIME configuration
+    # file specified in TypesConfig for specific file types.
+    #
+    #AddType application/x-gzip .tgz
+    #
+    # AddEncoding allows you to have certain browsers uncompress
+    # information on the fly. Note: Not all browsers support this.
+    #
+    #AddEncoding x-compress .Z
+    #AddEncoding x-gzip .gz .tgz
+    #
+    # If the AddEncoding directives above are commented-out, then you
+    # probably should define those extensions to indicate media types:
+    #
+    AddType application/x-compress .Z
+    AddType application/x-gzip .gz .tgz
+
+    #
+    # AddHandler allows you to map certain file extensions to "handlers":
+    # actions unrelated to filetype. These can be either built into the server
+    # or added with the Action directive (see below)
+    #
+    # To use CGI scripts outside of ScriptAliased directories:
+    # (You will also need to add "ExecCGI" to the "Options" directive.)
+    #
+    #AddHandler cgi-script .cgi
+
+    # For type maps (negotiated resources):
+    #AddHandler type-map var
+
+    #
+    # Filters allow you to process content before it is sent to the client.
+    #
+    # To parse .shtml files for server-side includes (SSI):
+    # (You will also need to add "Includes" to the "Options" directive.)
+    #
+    #AddType text/html .shtml
+    #AddOutputFilter INCLUDES .shtml
+</IfModule>
+
+#
+# The mod_mime_magic module allows the server to use various hints from the
+# contents of the file itself to determine its type.  The MIMEMagicFile
+# directive tells the module where the hint definitions are located.
+#
+#MIMEMagicFile conf/magic
+
+#
+# Customizable error responses come in three flavors:
+# 1) plain text 2) local redirects 3) external redirects
+#
+# Some examples:
+#ErrorDocument 500 "The server made a boo boo."
+#ErrorDocument 404 /missing.html
+#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
+#ErrorDocument 402 http://www.example.com/subscription_info.html
+#
+
+#
+# MaxRanges: Maximum number of Ranges in a request before
+# returning the entire resource, or one of the special
+# values 'default', 'none' or 'unlimited'.
+# Default setting is to accept 200 Ranges.
+#MaxRanges unlimited
+
+#
+# EnableMMAP and EnableSendfile: On systems that support it, 
+# memory-mapping or the sendfile syscall may be used to deliver
+# files.  This usually improves server performance, but must
+# be turned off when serving from networked-mounted 
+# filesystems or if support for these functions is otherwise
+# broken on your system.
+# Defaults: EnableMMAP On, EnableSendfile Off
+#
+#EnableMMAP off
+#EnableSendfile on
+
+# Supplemental configuration
+#
+# The configuration files in the conf/extra/ directory can be 
+# included to add extra features or to modify the default configuration of 
+# the server, or you may simply copy their contents here and change as 
+# necessary.
+
+# Server-pool management (MPM specific)
+#Include conf/extra/httpd-mpm.conf
+
+# Multi-language error messages
+#Include conf/extra/httpd-multilang-errordoc.conf
+
+# Fancy directory listings
+#Include conf/extra/httpd-autoindex.conf
+
+# Language settings
+#Include conf/extra/httpd-languages.conf
+
+# User home directories
+#Include conf/extra/httpd-userdir.conf
+
+# Real-time info on requests and configuration
+#Include conf/extra/httpd-info.conf
+
+# Virtual hosts
+#Include conf/extra/httpd-vhosts.conf
+
+# Local access to the Apache HTTP Server Manual
+#Include conf/extra/httpd-manual.conf
+
+# Distributed authoring and versioning (WebDAV)
+#Include conf/extra/httpd-dav.conf
+
+# Various default settings
+#Include conf/extra/httpd-default.conf
+
+# Configure mod_proxy_html to understand HTML4/XHTML1
+<IfModule proxy_html_module>
+Include conf/extra/proxy-html.conf
+</IfModule>
+
+# Secure (SSL/TLS) connections
+#Include conf/extra/httpd-ssl.conf
+#
+# Note: The following must must be present to support
+#       starting without SSL on platforms with no /dev/random equivalent
+#       but a statically compiled-in mod_ssl.
+#
+<IfModule ssl_module>
+SSLRandomSeed startup builtin
+SSLRandomSeed connect builtin
+</IfModule>
+

tasks/api.yaml

@@ -0,0 +1,67 @@
+---
+# tasks file for api
+- name: Create a config map for api
+  vars:
+    httpd_server_name: "api.eom.dev"
+    httpd_conf_extra:
+      - httpd-auth.conf
+      - httpd-wsgi.conf
+  k8s:
+    state: present
+    api_version: v1
+    kind: ConfigMap
+    name: api
+    namespace: "eom-{{ target_namespace }}"
+    definition:
+      data:
+        httpd.conf: "{{ lookup('template', 'httpd.conf.j2') }}"
+        httpd-auth.conf: "{{ lookup('template', 'httpd-auth.conf.j2') }}"
+        httpd-wsgi.conf: "{{ lookup('file', 'httpd-wsgi.conf') }}"
+        mime.types: "{{ lookup('file', 'mime.types') }}"
+
+- name: Create a deployment
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: api
+        namespace: "eom-{{ target_namespace }}"
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: api
+        template:
+          metadata:
+            labels:
+              app: api
+          spec:
+            containers:
+              - name: api
+                image: ericomeehan/api
+                volumeMounts:
+                  - name: config
+                    mountPath: /usr/local/apache2/conf
+                ports:
+                  - containerPort: 80
+            volumes:
+              - name: config
+                configMap:
+                  name: api
+
+- name: Expose deployment as a service
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: api
+        namespace: "eom-{{ target_namespace }}"
+      spec:
+        selector:
+          app: api
+        ports:
+          - port: 80
+            name: api-80
+        type: ClusterIP

tasks/auth.yaml

@@ -1,13 +1,13 @@
 ---
-# Tasks file for OpenLDAP
+# tasks file for openldap
-- name: Create OpenLDAP namespace
+- name: Create auth namespace
   k8s:
     state: present
     definition:
       apiVersion: v1
       kind: Namespace
       metadata:
-        name: openldap
+        name: auth
 
 - name: Create PVC for OpenLDAP data
   k8s:
@@ -17,13 +17,13 @@
       kind: PersistentVolumeClaim
       metadata:
         name: data
-        namespace: openldap
+        namespace: auth
       spec:
         accessModes:
           - ReadWriteOnce
         resources:
           requests:
-            storage: 16Gi
+            storage: 2Gi
 
 - name: Create PVC for OpenLDAP configuration
   k8s:
@@ -33,13 +33,13 @@
       kind: PersistentVolumeClaim
       metadata:
         name: config
-        namespace: openldap
+        namespace: auth
       spec:
         accessModes:
           - ReadWriteOnce
         resources:
           requests:
-            storage: 16Gi
+            storage: 2Gi
 
 - name: Create Deployment for OpenLDAP
   k8s:
@@ -48,7 +48,7 @@
       kind: Deployment
       metadata:
         name: openldap
-        namespace: openldap
+        namespace: auth
       spec:
         replicas: 1
         selector:
@@ -68,11 +68,11 @@
                   - name: LDAP_DOMAIN
                     value: "eom.dev"
                   - name: LDAP_ADMIN_PASSWORD
-                    value: "{{ openldap_admin_password }}"
+                    value: "{{ ldap_admin_password }}"
                   - name: LDAP_READONLY_USER
                     value: "true"
                   - name: LDAP_READONLY_USER_PASSWORD
-                    value: "{{ openldap_readonly_password }}"
+                    value: "{{ ldap_readonly_password }}"
                 volumeMounts:
                   - name: config
                     mountPath: /etc/ldap/slapd.d
@@ -96,7 +96,7 @@
       kind: Service
       metadata:
         name: openldap
-        namespace: openldap
+        namespace: auth
       spec:
         selector:
           app: openldap

tasks/elasticsearch.yaml

@@ -1,21 +0,0 @@
----
-# tasks file for elasticsearch
-- name: Deploy Elasticsearch
-  kubernetes.core.helm:
-    name: elasticsearch
-    chart_ref: bitnami/elasticsearch
-    release_namespace: elasticsearch
-    create_namespace: true
-    values:
-      master:
-        replicaCount: 1
-        persistence:
-          size: 64Gi
-      coordinating:
-        replicaCount: 1
-      data:
-        replicaCount: 1
-        persistence:
-          size: 256Gi
-      ingest:
-        replicaCount: 1

tasks/full.yaml

@@ -1,35 +0,0 @@
----
-# Tasks file for full deployment
-- name: Deploy authentication sources
-  include_tasks: "{{ item }}"
-  loop:
-    - openldap.yaml
-    - phpldapadmin.yaml
-
-- name: Populate OpenLDAP database
-  pause:
-    prompt: "Press Enter to continue..." 
-
-- name: Deploy databases
-  include_tasks: "{{ item }}"
-  loop:
-    - postgresql.yaml
-    - redis.yaml
-    - elsaticsearch.yaml
-
-- name: Deploy user services
-  include_tasks: "{{ item }}"
-  loop:
-    - postfix.yaml
-    - nextcloud.yaml
-    - mastodon.yaml
-    - jupyterhub.yaml
-    - gitea.yaml
-    - owncast.yaml
-    - mediawiki.yaml
-
-- name: Deploy monitoring
-  include_tasks: "{{ item }}"
-  loop:
-    - prometheus.yaml
-    - grafana.yaml

tasks/git.yaml

@@ -0,0 +1,197 @@
+---
+# tasks file for gitea
+- name: Create git namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: git
+
+- name: Create PVC for MySQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: mysql
+        namespace: git
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 64Gi
+
+- name: Create Deployment for MySQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: mysql
+        namespace: git
+        labels:
+          app: mysql
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: mysql
+        template:
+          metadata:
+            labels:
+              app: mysql
+          spec:
+            containers:
+              - name: mysql
+                image: mysql
+                volumeMounts:
+                  - name: data
+                    mountPath: /var/lib/mysql
+                ports:
+                  - containerPort: 3306
+                env:
+                  - name: MYSQL_DATABASE
+                    value: gitea
+                  - name: MYSQL_ROOT_PASSWORD
+                    value: "{{ mysql_root_password }}"
+                  - name: MYSQL_USER
+                    value: gitea
+                  - name: MYSQL_PASSWORD
+                    value: "{{ gitea_mysql_password }}"
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: mysql
+
+- name: Create Service for MySQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: mysql
+        namespace: git
+      spec:
+        selector:
+          app: mysql
+        ports:
+          - port: 3306
+            name: mysql
+        type: ClusterIP
+
+- name: Create PVC for Gitea
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: gitea
+        namespace: git
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 128Gi
+
+- name: Create Deployment for Gitea
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: gitea
+        namespace: git
+        labels:
+          app: gitea
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: gitea
+        template:
+          metadata:
+            labels:
+              app: gitea
+          spec:
+            containers:
+              - name: gitea
+                image: gitea/gitea
+                volumeMounts:
+                  - name: data
+                    mountPath: /data
+                ports:
+                  - containerPort: 3000
+                  - containerPort: 22
+                env:
+                  - name: GITEA__database__DB_TYPE
+                    value: mysql
+                  - name: GITEA__database__HOST
+                    value: mysql
+                  - name: GITEA__database__NAME
+                    value: gitea
+                  - name: GITEA__database__USER
+                    value: gitea
+                  - name: GITEA__database__DB_PASSWD
+                    value: "{{ gitea_mysql_password }}"
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: gitea
+
+- name: Create Service for Gitea
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: gitea
+        namespace: git
+      spec:
+        selector:
+          app: gitea
+        ports:
+          - port: 22
+            name: ssh
+          - port: 80
+            targetPort: 3000
+            name: http
+        type: ClusterIP
+
+- name: Create Ingress
+  k8s:
+    state: present
+    definition:
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        name: gitea
+        namespace: git
+      spec:
+        ingressClassName: nginx
+        rules:
+          - host: git.eom.dev
+            http:
+              paths:
+                - pathType: Prefix
+                  path: /
+                  backend:
+                    service:
+                      name: gitea
+                      port:
+                        number: 80
+        tls:
+          - hosts:
+            - git.eom.dev
+            secretName: gitea

tasks/gitea.yaml

@@ -1,94 +0,0 @@
----
-# tasks file for gitea
-- name: Add gitea repo
-  kubernetes.core.helm_repository:
-    name: gitea
-    repo_url: https://dl.gitea.com/charts/
-  register: repo_update
-
-- name: Update Helm repos
-  command: helm repo update
-  when: repo_update.changed
-
-- name: Deploy Gitea
-  kubernetes.core.helm:
-    name: gitea
-    chart_ref: gitea/gitea
-    release_namespace: gitea
-    create_namespace: true
-    values:
-      service:
-        ssh:
-          type: LoadBalancer
-      ingress:
-        enabled: true
-        className: nginx
-        annotations:
-          cert-manager.io/cluster-issuer: ca-issuer
-        hosts:
-          - host: gitea.eom.dev
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-            - gitea.eom.dev
-            secretName: gitea-tls
-      persistence:
-        size: 2Ti
-      actions:
-        enabled: true
-        provisioning:
-          enabled: true
-      gitea:
-        metrics:
-          enabled: true
-        admin:
-          username: gitea
-          password: "{{ gitea_admin_password }}"
-          email: gitea@postfix.eom.dev
-        ldap:
-          - name: OpenLDAP
-            securityProtocol: unencrypted
-            host: openldap.openldap.svc.cluster.local
-            port: 389
-            userSearchBase: dc=eom,dc=dev
-            userFilter: (&(objectClass=posixAccount)(uid=%s)(memberOf=cn=Gitea Users,ou=Gitea,ou=Services,dc=eom,dc=dev))
-            adminFilter: (memberOf=cn=Gitea Administrators,ou=Gitea,ou=Services,dc=eom,dc=dev)
-            emailAttribute: mail
-            bindDn: cn=readonly,dc=eom,dc=dev
-            bindPassword: "{{ openldap_readonly_password }}"
-            usernameAttribute: uid
-            publicSSHKeyAttribute: sshPublicKey
-        config:
-          APP_NAME: "Gitea"
-          service:
-            DISABLE_REGISTRATION: true
-            DEFAULT_ALLOW_CREATE_ORGANIZATION: false
-      redis:
-        enabled: true
-        global:
-          redis:
-            password: "{{ gitea_admin_password }}"
-        master:
-          persistence:
-            size: 32Gi
-        replica:
-          persistence:
-            size: 32Gi
-      redis-cluster:
-        enabled: false
-      postgresql:
-        enabled: true
-        global:
-          postgresql:
-            auth:
-              password: "{{ gitea_admin_password }}"
-        primary:
-          persistence:
-            size: 256Gi
-          readReplicas:
-            persistence:
-              size: 256Gi
-      postgresql-ha:
-        enabled: false

tasks/grafana.yaml

@@ -1,61 +0,0 @@
----
-# tasks file for grafana
-- name: Deploy Grafana
-  kubernetes.core.helm:
-    name: grafana
-    chart_ref: bitnami/grafana
-    release_namespace: grafana
-    create_namespace: true
-    values:
-      metrics:
-        enabled: true
-      admin:
-        user: grafana
-        password: "{{ grafana_admin_password }}"
-      persistence:
-        size: 64Gi
-      grafana:
-        extraEnvVars:
-          - name: GF_SERVER_DOMAIN
-            value: grafana.eom.dev
-          - name: GF_SERVER_ROOT_URL
-            value: https://grafana.eom.dev/
-      smtp:
-        enabled: true
-        user: grafana
-        password: "{{ grafana_admin_password }}"
-        host: postfix.eom.dev
-        fromAddress: grafana@postfix.eom.dev
-        fromName: Grafana
-      ldap:
-        enabled: true
-        allowSignUp: true
-        configuration: "{{ lookup('template', 'ldap.toml.j2') }}"
-      ingress:
-        enabled: true
-        pathType: Prefix
-        hostname: grafana.eom.dev
-        annotations:
-          cert-manager.io/cluster-issuer: ca-issuer
-        ingressClassName: nginx
-        tls: true
-      datasources:
-        secretDefinition:
-          apiVersion: 1
-          datasources:
-            - name: Prometheus
-              type: prometheus
-              access: proxy
-              orgId: 1
-              url: http://prometheus-server.prometheus.svc.cluster.local
-              version: 1
-              editable: true
-              isDefault: true
-            - name: Alertmanager
-              uid: alertmanager
-              type: alertmanager
-              access: proxy
-              orgId: 1
-              url: http://prometheus-alertmanager.prometheus.svc.cluster.local:9093
-              version: 1
-              editable: true

tasks/influxdb.yaml

@@ -1,15 +1,32 @@
 ---
-# tasks file for grafana
+# tasks file for influxdb
-- name: Create InfluxDB namespace
+- name: Create persistent volume for influxdb
   k8s:
     state: present
     definition:
       apiVersion: v1
-      kind: Namespace
+      kind: PersistentVolume
       metadata:
-        name: influxdb
+        name: "eom-{{ target_namespace }}-influxdb"
+      spec:
+        capacity:
+          storage: 32Gi
+        accessModes:
+          - ReadWriteMany
+        persistentVolumeReclaimPolicy: Retain
+        storageClassName: standard
+        hostPath:
+          path: "/data/store-0/eom-{{ target_namespace }}/influxdb"
+        nodeAffinity:
+          required:
+            nodeSelectorTerms:
+              - matchExpressions:
+                - key: kubernetes.io/hostname
+                  operator: In
+                  values:
+                    - alpha-worker-0
 
-- name: Create PVC for InfluxDB
+- name: Create a persistent volume claim for influxdb
   k8s:
     state: present
     definition:
@@ -17,25 +34,24 @@
       kind: PersistentVolumeClaim
       metadata:
         name: influxdb
-        namespace: influxdb
+        namespace: "eom-{{ target_namespace }}"
       spec:
         accessModes:
-          - ReadWriteOnce
+          - ReadWriteMany
         resources:
           requests:
-            storage: 128Gi
+            storage: 32Gi
+        storageClassName: standard
+        volumeName: "eom-{{ target_namespace }}-influxdb"
 
-- name: Create Deployment for InfluxDB
+- name: Create a deployment
   k8s:
-    state: present
     definition:
       apiVersion: v1
       kind: Deployment
       metadata:
         name: influxdb
-        namespace: influxdb
+        namespace: "eom-{{ target_namespace }}"
-        labels:
-          app: influxdb
       spec:
         replicas: 1
         selector:
@@ -48,75 +64,32 @@
           spec:
             containers:
               - name: influxdb
-                image: influxdb
+                image: bitnami/influxdb
-                env:
-                  - name: DOCKER_INFLUXDB_INIT_MODE
-                    value: setup
-                  - name: DOCKER_INFLUXDB_INIT_USERNAME
-                    value: influxdb
-                  - name: DOCKER_INFLUXDB_INIT_PASSWORD
-                    value: "{{ influxdb_admin_password }}"
-                  - name: DOCKER_INFLUXDB_INIT_ORG
-                    value: DevOps
-                  - name: DOCKER_INFLUXDB_INIT_BUCKET
-                    value: default
-                  - name: DOCKER_INFLUXDB_INIT_RETENTION
-                    value: 1w
-                  - name: DOCKER_INFLUXDB_INIT_ADMIN_TOKEN
-                    value: "{{ influxdb_admin_token }}"
                 volumeMounts:
                   - name: data
-                    mountPath: /var/lib/influxdb
+                    mountPath: /var/lib/mysql
                 ports:
-                  - containerPort: 8086
+                  - containerPort: 3306
+                env:
+                  key: INFLUXDB_ADMIN_USER_PASSWORD
+                  value: "{{ influxdb_root_password }}"
             volumes:
               - name: data
                 persistentVolumeClaim:
                   claimName: influxdb
 
-- name: Create Service for InfluxDB
+- name: Expose deployment as a service
   k8s:
-    state: present
     definition:
       apiVersion: v1
       kind: Service
       metadata:
         name: influxdb
-        namespace: influxdb
+        namespace: "eom-{{ target_namespace }}"
       spec:
         selector:
           app: influxdb
         ports:
-          - port: 80
+          - port: 3306
-            targetPort: 8086
+            name: influxdb-3306
-            name: influxdb
         type: ClusterIP
-
-- name: Create Ingress for InfluxDB
-  k8s:
-    state: present
-    definition:
-      apiVersion: networking.k8s.io/v1
-      kind: Ingress
-      metadata:
-        annotations:
-          cert-manager.io/cluster-issuer: ca-issuer
-        name: influxdb
-        namespace: influxdb
-      spec:
-        ingressClassName: nginx
-        rules:
-          - host: influxdb.eom.dev
-            http:
-              paths:
-                - pathType: Prefix
-                  path: /
-                  backend:
-                    service:
-                      name: influxdb
-                      port:
-                        number: 80
-        tls:
-          - hosts:
-            - influxdb.eom.dev
-            secretName: influxdb

tasks/jupyterhub.yaml

@@ -1,99 +0,0 @@
----
-# tasks file for jupyter hub
-- name: Add jupyter repository
-  kubernetes.core.helm_repository:
-    name: jupyterhub
-    repo_url: https://hub.jupyter.org/helm-chart/
-  register: repo
-
-- name: Update Helm repos
-  command: helm repo update
-  when: repo.changed
-
-- name: Deploy Jupyter Hub
-  kubernetes.core.helm:
-    name: jupyterhub
-    chart_ref: jupyterhub/jupyterhub
-    release_namespace: jupyterhub
-    create_namespace: true
-    values:
-      prePuller:
-        hook:
-          enabled: false
-        continuous:
-          enabled: false
-      hub:
-        config:
-          Authenticator:
-            admin_users:
-              - jupyterhub
-              - eric
-            allow_all: true
-          JupyterHub:
-            admin_access: true
-            authenticator_class: ldapauthenticator.LDAPAuthenticator
-          LDAPAuthenticator:
-            server_address: openldap.openldap.svc.cluster.local
-            server_port: 389
-            use_ssl: false
-            tls_strategy: insecure
-            lookup_dn: true
-            lookup_dn_search_user: cn=readonly,dc=eom,dc=dev
-            lookup_dn_search_password: "{{ openldap_readonly_password }}"
-            lookup_dn_search_filter: (&(objectClass=posixAccount)({login_attr}={login})(memberOf=cn=JupyterHub Users,ou=JupyterHub,ou=Services,dc=eom,dc=dev))
-            lookup_dn_user_dn_attribute: cn
-            user_search_base: dc=eom,dc=dev
-            user_attribute: uid
-      singleuser:
-        extraFiles:
-          jupyter_notebook_config.json:
-            mountPath: /etc/jupyter/jupyter_notebook_config.json
-            # data is a YAML structure here but will be rendered to JSON file as our
-            # file extension is ".json".
-            data:
-              MappingKernelManager:
-                cull_idle_timeout: 1200
-                cull_interval: 120
-                cull_connected: true
-                cull_busy: false
-        storage:
-          capacity: 64Gi
-        image:
-          name: jupyter/minimal-notebook
-          tag: latest
-          pullPolicy: IfNotPresent
-        memory:
-          guarantee: 1G
-        profileList:
-          - display_name: Minimal notebook
-            description: Command-line tools useful when working in Jupyter applications
-            kubespawner_override:
-              image: jupyter/minimal-notebook
-              tag: latest
-              pullPolicy: IfNotPresent
-            default: true
-          - display_name: Tensorflow notebook
-            description: Python deep learning libraries
-            kubespawner_override:
-              image: jupyter/tensorflow-notebook
-              tag: latest
-              pullPolicy: IfNotPresent
-          - display_name: Data science notebook
-            description: Libraries for data analysis from the Python, R, and Julia communities
-            kubespawner_override:
-              image: jupyter/datascience-notebook
-              tag: latest
-              pullPolicy: IfNotPresent
-      ingress:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: ca-issuer
-        ingressClassName: nginx
-        hosts:
-          - jupyterhub.eom.dev
-        pathSuffix:
-        pathType: Prefix
-        tls:
-          - hosts:
-            - jupyterhub.eom.dev
-            secretName: jupyterhub

tasks/main.yaml

@@ -1,6 +1,16 @@
 ---
 # tasks file for eom
-- name: Deploy
+- name: Deploy Auth
-  include_tasks: "{{ item }}"
+  include_tasks: auth.yaml
-  loop:
+
-    - owncast.yaml
+- name: Deploy Cloud
+  include_tasks: cloud.yaml
+
+- name: Deploy Git
+  include_tasks: git.yaml
+
+- name: Deploy Wiki
+  include_tasks: wiki.yaml
+
+- name: Deploy Redmine
+  include_tasks: org.yaml

tasks/mastodon.yaml

@@ -1,98 +0,0 @@
----
-# tasks file for mastodon
-- name: Deploy Mastodon
-  kubernetes.core.helm:
-    name: mastodon
-    chart_ref: bitnami/mastodon
-    release_namespace: mastodon
-    create_namespace: true
-    timeout: 600s
-    values:
-      metrics:
-        enabled: true
-      initJob:
-        precompileAssets:
-          resources:
-            requests:
-              cpu: 0m
-              memory: 0Mi
-            limits:
-              cpu: 1.5
-              memory: 3072Mi
-      adminUser: mastodon
-      adminEmail: mastodon@postfix.eom.dev
-      adminPassword: "{{ mastodon_admin_password }}"
-      extraConfig:
-        LDAP_ENABLED: "true"
-        LDAP_HOST: openldap.openldap.svc.cluster.local
-        LDAP_PORT: "389"
-        LDAP_METHOD: plain
-        LDAP_BASE: dc=eom,dc=dev
-        LDAP_BIND_DN: cn=readonly,dc=eom,dc=dev
-        LDAP_PASSWORD: "{{ openldap_readonly_password }}"
-        LDAP_UID: uid
-        LDAP_SEARCH_FILTER: (&(objectClass=posixAccount)(|(%{uid}=%{email})(%{mail}=%{email}))(memberOf=cn=Mastodon Users,ou=Mastodon,ou=Services,dc=eom,dc=dev))
-        LDAP_MAIL: mail
-      enableS3: false
-      localDomain: mastodon.eom.dev
-      smtp:
-        server: postfix.eom.dev
-        port: 587
-        from_address: mastodon@postfix.eom.dev
-        domain: postfix.eom.dev
-        reply_to: mastodon@postfix.eom.dev
-        delivery_method: smtp
-        tls: true
-        auth_method: starttls
-        login: mastodon
-        password: "{{ mastodon_admin_password }}"
-      persistence:
-        enabled: true
-        size: 8Ti
-      redis:
-        enabled: true
-        auth:
-          password: "{{ mastodon_admin_password }}"
-        master:
-          persistence:
-            size: 32Gi
-        replica:
-          persistence:
-            size: 32Gi
-      postgresql:
-        enabled: true
-        global:
-          postgresql:
-            auth:
-              password: "{{ mastodon_admin_password }}"
-        primary:
-          persistence:
-            size: 256Gi
-        readReplicas:
-          persistence:
-            size: 256Gi
-      elasticsearch:
-        enabled: true
-        master:
-          persistence:
-            size: 32Gi
-        data:
-          persistence:
-            size: 32Gi
-      minio:
-        enabled: false
-      apache:
-        service:
-          type: ClusterIP 
-          ports:
-            http: 80
-        ingress:
-          enabled: true
-          hostname: mastodon.eom.dev
-          annotations:
-            kubernetes.io/ingress.class: nginx
-            cert-manager.io/cluster-issuer: ca-issuer
-          tls:
-            - hosts:
-              - mastodon.eom.dev
-              secretName: mastodon-tls

tasks/mediawiki.yaml

@@ -1,42 +0,0 @@
----
-# tasks file for mediawiki
-- name: Deploy MediaWiki
-  kubernetes.core.helm:
-    name: mediawiki
-    chart_ref: bitnami/mediawiki
-    release_namespace: mediawiki
-    create_namespace: true
-    values:
-      mediawikiUser: mediawiki
-      mediawikiPassword: "{{ mediawiki_admin_password }}"
-      mediawikiEmail: mediawiki@postfix.eom.dev
-      mediawikiName: MediaWiki
-      mediawikiHost: https://mediawiki.eom.dev/
-      smtpHost: postfix.eom.dev
-      smtpPort: 587
-      smtpUser: mediawiki
-      smtpPassword: "{{ mediawiki_admin_password }}"
-      persistence:
-        size: 32Gi
-      service:
-        type: ClusterIP
-      ingress:
-        enabled: true
-        annotations:
-          cert-manager.io/clusteer-issuer: ca-issuer
-        ingressClassName: nginx
-        pathType: Prefix
-        hostname: mediawiki.eom.dev
-        path: /
-        tls: true
-      mariadb:
-        db:
-          name: mediawiki
-          user: mediawiki
-          password: "{{ mediawiki_admin_password }}"
-        master:
-          persistence:
-            size: 256Gi
-        slave:
-          persistence:
-            size: 256Gi

tasks/monitor.yaml

@@ -0,0 +1,237 @@
+---
+# tasks file for grafana
+- name: Create monitoring namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: monitor
+
+- name: Create PVC for MySQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: mysql
+        namespace: monitor
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 64Gi
+
+- name: Create Deployment for MySQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: mysql
+        namespace: monitor
+        labels:
+          app: mysql
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: mysql
+        template:
+          metadata:
+            labels:
+              app: mysql
+          spec:
+            containers:
+              - name: mysql
+                image: mysql
+                volumeMounts:
+                  - name: data
+                    mountPath: /var/lib/mysql
+                ports:
+                  - containerPort: 3306
+                env:
+                  - name: MYSQL_DATABASE
+                    value: grafana
+                  - name: MYSQL_USER
+                    value: grafana
+                  - name: MYSQL_PASSWORD
+                    value: "{{ grafana_mysql_password }}"
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: mysql
+
+- name: Create Service for MySQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: mysql
+        namespace: monitor
+      spec:
+        selector:
+          app: mysql
+        ports:
+          - port: 3306
+            name: mysql
+        type: ClusterIP
+
+- name: Create PVC for InfluxDB
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: influxdb
+        namespace: monitor
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 128Gi
+
+- name: Create Deployment for InfluxDB
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: influxdb
+        namespace: monitor
+        labels:
+          app: influxdb
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: influxdb
+        template:
+          metadata:
+            labels:
+              app: influxdb
+          spec:
+            containers:
+              - name: influxdb
+                image: influxdb
+                volumeMounts:
+                  - name: data
+                    mountPath: /var/lib/influxdb
+                ports:
+                  - containerPort: 8086
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: influxdb
+
+- name: Create Service for InfluxDB
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: influxdb
+        namespace: monitor
+      spec:
+        selector:
+          app: influxdb
+        ports:
+          - port: 80
+            targetPort: 8086
+            name: influxdb
+        type: ClusterIP
+
+- name: Create Deployment for Grafana
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: grafana
+        namespace: monitor
+        labels:
+          app: grafana
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: grafana
+        template:
+          metadata:
+            labels:
+              app: grafana
+          spec:
+            containers:
+              - name: grafana
+                image: grafana
+                ports:
+                  - containerPort: 3000
+                env:
+                  - name: GF_DATABASE_TYPE
+                    value: mysql
+                  - name: GF_DATABASE_HOST
+                    value: mysql
+                  - name: GF_DATABASE_USER
+                    value: grafana
+                  - name: GF_DATABASE_PASSWORD
+                    value: "{{ grafana_mysql_password }}"
+
+- name: Create Service for Grafana
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: grafana
+        namespace: monitor
+      spec:
+        selector:
+          app: grafana
+        ports:
+          - port: 22
+            name: ssh
+          - port: 80
+            targetPort: 3000
+            name: http
+        type: ClusterIP
+
+- name: Create Ingress
+  k8s:
+    state: present
+    definition:
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        name: grafana
+        namespace: monitor
+      spec:
+        ingressClassName: nginx
+        rules:
+          - host: git.eom.dev
+            http:
+              paths:
+                - pathType: Prefix
+                  path: /
+                  backend:
+                    service:
+                      name: grafana
+                      port:
+                        number: 80
+        tls:
+          - hosts:
+            - git.eom.dev
+            secretName: grafana

tasks/nextcloud.yaml

@@ -1,85 +0,0 @@
----
-# tasks file for nextcloud
-- name: Add NextCloud repo
-  kubernetes.core.helm_repository:
-    name: nextcloud
-    repo_url: https://nextcloud.github.io/helm/
-  register: repo
-
-- name: Update Helm repos
-  command: helm repo update
-  when: repo.changed
-
-- name: Deploy NextCloud
-  kubernetes.core.helm:
-    name: nextcloud
-    chart_ref: nextcloud/nextcloud
-    release_namespace: nextcloud
-    create_namespace: true
-    values:
-      nextcloud:
-        host: nextcloud.eom.dev
-        username: nextcloud
-        password: "{{ nextcloud_admin_password }}"
-        configs:
-          proxy.config.php: |-
-            <?php
-            $CONFIG = array (
-              'trusted_proxies' => array(
-                0 => '127.0.0.1',
-                1 => '10.0.0.0/8',
-              ),
-              'forwarded_for_headers' => array('HTTP_X_FORWARDED_FOR'),
-            );
-      mail:
-        enabled: true
-        fromAddress: nextcloud
-        domain: postfix.eom.dev
-        smtp:
-          host: postfix.eom.dev
-          secure: ssl
-          port: 587
-          authtype: LOGIN
-          name: nextcloud
-          password: "{{ nextcloud_admin_password }}"
-      internalDatabase:
-        enabled: false
-      externalDatabase:
-        enabled: true
-        type: postgresql
-        host: nextcloud-postgresql
-        user: nextcloud
-        password: "{{ nextcloud_admin_password }}"
-        database: nextcloud
-      persistence:
-        enabled: true
-        size: 8Ti
-      metrics:
-        enabled: true
-      ingress:
-        enabled: true
-        className: nginx
-        annotations:
-          nginx.ingress.kubernetes.io/enable-cors: "true"
-          nginx.ingress.kubernetes.io/cors-allow-headers: "X-Forwarded-For"
-          cert-manager.io/cluster-issuer: ca-issuer
-        tls:
-          - hosts:
-            - nextcloud.eom.dev
-            secretName: nextcloud-tls
-      cronjob:
-        enabled: true
-      redis:
-        enabled: true
-        auth:
-          password: "{{ nextcloud_admin_password }}"
-      postgresql:
-        enabled: true
-        global:
-          postgresql:
-            auth:
-              password: "{{ nextcloud_admin_password }}"
-        primary:
-          persistence:
-            enabled: true
-            size: 256Gi

tasks/owncast.yaml

@@ -1,110 +0,0 @@
----
-# tasks file for gitlab
-- name: Create stream namespace
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: Namespace
-      metadata:
-        name: owncast
-
-- name: Create PVC for OwnCast
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: PersistentVolumeClaim
-      metadata:
-        name: owncast
-        namespace: owncast
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: 128Gi
-
-- name: Create Deployment for OwnCast
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: Deployment
-      metadata:
-        name: owncast
-        namespace: owncast
-        labels:
-          app: owncast
-      spec:
-        replicas: 1
-        selector:
-          matchLabels:
-            app: owncast
-        template:
-          metadata:
-            labels:
-              app: owncast
-          spec:
-            containers:
-              - name: owncast
-                image: owncast/owncast
-                volumeMounts:
-                  - name: data
-                    mountPath: /app/data
-                ports:
-                  - containerPort: 8080
-                  - containerPort: 1935
-                env:
-            volumes:
-              - name: data
-                persistentVolumeClaim:
-                  claimName: owncast
-
-- name: Create Service for OwnCast
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: Service
-      metadata:
-        name: owncast
-        namespace: owncast
-      spec:
-        selector:
-          app: owncast
-        ports:
-          - port: 1935
-            name: rtmp
-          - port: 8080
-            name: http
-        type: LoadBalancer
-
-- name: Create Ingress
-  k8s:
-    state: present
-    definition:
-      apiVersion: networking.k8s.io/v1
-      kind: Ingress
-      metadata:
-        annotations:
-          cert-manager.io/cluster-issuer: ca-issuer
-        name: owncast
-        namespace: owncast
-      spec:
-        ingressClassName: nginx
-        rules:
-          - host: owncast.eom.dev
-            http:
-              paths:
-                - pathType: Prefix
-                  path: /
-                  backend:
-                    service:
-                      name: owncast
-                      port:
-                        number: 8080
-        tls:
-          - hosts:
-            - owncast.eom.dev
-            secretName: owncast

tasks/phpldapadmin.yaml

@@ -1,88 +0,0 @@
----
-# tasks file for phpLDAPadmin
-- name: Create phpLDAPadmin namespace
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: Namespace
-      metadata:
-        name: phpldapadmin
-
-- name: Create Deployment for phpLDAPadmin
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Deployment
-      metadata:
-        name: phpldapadmin
-        namespace: phpldapadmin
-      spec:
-        replicas: 1
-        selector:
-          matchLabels:
-            app: phpldapadmin
-        template:
-          metadata:
-            labels:
-              app: phpldapadmin
-          spec:
-            containers:
-              - name: phpldapadmin
-                image: osixia/phpldapadmin
-                env:
-                  - name: PHPLDAPADMIN_LDAP_HOSTS
-                    value: "openldap.openldap.svc.cluster.local"
-                  - name: PHPLDAPADMIN_SERVER_ADMIN
-                    value: "phpldapadmin@postfix.eom.dev"
-                  - name: PHPLDAPADMIN_SERVER_PATH
-                    value: "/"
-                  - name: PHPLDAPADMIN_HTTPS
-                    value: "false"
-                ports:
-                  - containerPort: 80
-
-- name: Create Service for phpLDAPadmin
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Service
-      metadata:
-        name: phpldapadmin
-        namespace: phpldapadmin
-      spec:
-        selector:
-          app: phpldapadmin
-        ports:
-          - port: 80
-            name: http
-        type: ClusterIP
-
-- name: Create Ingress
-  k8s:
-    state: present
-    definition:
-      apiVersion: networking.k8s.io/v1
-      kind: Ingress
-      metadata:
-        annotations:
-          cert-manager.io/cluster-issuer: ca-issuer
-        name: phpldapadmin
-        namespace: phpldapadmin
-      spec:
-        ingressClassName: nginx
-        rules:
-          - host: phpldapadmin.eom.dev
-            http:
-              paths:
-                - pathType: Prefix
-                  path: /
-                  backend:
-                    service:
-                      name: phpldapadmin
-                      port:
-                        number: 80
-        tls:
-          - hosts:
-            - phpldapadmin.eom.dev
-            secretName: phpldapadmin

tasks/postfix.yaml

@@ -1,168 +0,0 @@
----
-# tasks file for postfix
-- name: Create Postfix namespace
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: Namespace
-      metadata:
-        name: postfix
-
-- name: Request a certificate for postfix
-  k8s:
-    state: present
-    definition:
-      apiVersion: cert-manager.io/v1
-      kind: Certificate
-      metadata:
-        name: postfix
-        namespace: postfix
-      spec:
-        secretName: postfix
-        privateKey:
-          algorithm: RSA
-          encoding: PKCS1
-          size: 2048
-        duration: 2160h # 90d
-        renewBefore: 360h # 15d
-        isCA: false
-        usages:
-          - server auth
-          - client auth
-        subject:
-          organizations:
-            - EOM
-        commonName: postfix.eom.dev
-        dnsNames:
-          - postfix.eom.dev
-          - dovecot.eom.dev
-        issuerRef:
-          name: ca-issuer
-          kind: ClusterIssuer
-
-- name: Create a persistent volume claim for mail
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: PersistentVolumeClaim
-      metadata:
-        name: postfix
-        namespace: postfix
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Ti
-
-- name: Create a deployment
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Deployment
-      metadata:
-        name: postfix
-        namespace: postfix
-      spec:
-        replicas: 1
-        selector:
-          matchLabels:
-            app: postfix
-        template:
-          metadata:
-            labels:
-              app: postfix
-          spec:
-            containers:
-              - name: postfix
-                image: mailserver/docker-mailserver
-                volumeMounts:
-                  - name: ssl
-                    mountPath: /etc/letsencrypt
-                  - name: postfix
-                    mountPath: /var/mail
-                ports:
-                  - containerPort: 25
-                  - containerPort: 465
-                  - containerPort: 587
-                  - containerPort: 993
-                env:
-                  - name: OVERRIDE_HOSTNAME
-                    value: "postfix.eom.dev"
-                  - name: POSTMASTER_ADDRESS
-                    value: "postfix@postfix.eom.dev"
-                  - name: ACCOUNT_PROVISIONER
-                    value: "LDAP"
-                  - name: LDAP_SERVER_HOST
-                    value: "ldap://openldap.openldap.svc.cluster.local/"
-                  - name: LDAP_SEARCH_BASE
-                    value: "dc=eom,dc=dev"
-                  - name: LDAP_BIND_DN
-                    value: "cn=readonly,dc=eom,dc=dev"
-                  - name: LDAP_BIND_PW
-                    value: "{{ openldap_readonly_password }}"
-                  - name: LDAP_QUERY_FILTER_DOMAIN
-                    value: "(mail=*@%s)"
-                  - name: LDAP_QUERY_FILTER_USER
-                    value: "(&(mail=%s)(memberOf=cn=Postfix Users,ou=Postfix,ou=Services,dc=eom,dc=dev))"
-                  - name: LDAP_QUERY_FILTER_ALIAS
-                    value: "(&(objectClass=posixAccount)(mailAlias=%s))"
-                  - name: LDAP_QUERY_FILTER_GROUP
-                    value: "(&(objectClass=posixAccount)(mailGroupMember=%s))"
-                  - name: LDAP_QUERY_FILTER_SENDERS
-                    value: "(&(objectClass=posixAccount)(|(mail=%s)(mailAlias=%s)(mailGroupMember=%s)))"
-                  - name: SPOOF_PROTECTION
-                    value: "1"
-                  - name: DOVECOT_AUTH_BIND
-                    value: "yes"
-                  - name: DOVECOT_DEFAULT_PASS_SCHEME
-                    value: "MD5-CRYPT"
-                  - name: DOVECOT_USER_FILTER
-                    value: "(&(objectClass=posixAccount)(uid=%n)(memberOf=cn=Dovecot Users,ou=Dovecot,ou=Services,dc=eom,dc=dev))"
-                  - name: DOVECOT_PASS_ATTRS
-                    value: "uid=user,userPassword=password"
-                  - name: DOVECOT_USER_ATTRS
-                    value: "=home=/var/mail/%{ldap:uid},=uid=%{ldap:uidNumber},=gid=%{ldap:gidNumber},=mail=maildir:~/Maildir"
-                  - name: ENABLE_SASLAUTHD
-                    value: "1"
-                  - name: SASLAUTHD_MECHANISMS
-                    value: "ldap"
-                  - name: SASLAUTHD_LDAP_FILTER
-                    value: "(mail=%U@postfix.eom.dev)"
-                  - name: SSL_TYPE
-                    value: "manual"
-                  - name: SSL_CERT_PATH
-                    value: "/etc/letsencrypt/tls.crt"
-                  - name: SSL_KEY_PATH
-                    value: "/etc/letsencrypt/tls.key"
-            volumes:
-              - name: ssl
-                secret:
-                  secretName: postfix
-              - name: postfix
-                persistentVolumeClaim:
-                  claimName: postfix
-
-- name: Expose deployment as a service
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Service
-      metadata:
-        name: postfix
-        namespace: postfix
-      spec:
-        selector:
-          app: postfix
-        ports:
-          - port: 25
-            name: smtp-a
-          - port: 465
-            name: smtp-b
-          - port: 587
-            name: smtps
-          - port: 993
-            name: imap
-        type: LoadBalancer

tasks/postgresql.yaml

@@ -1,38 +0,0 @@
----
-# tasks file for postgresql
-- name: Deploy PostgreSQL
-  kubernetes.core.helm:
-    name: postgresql
-    chart_ref: bitnami/postgresql-ha
-    release_namespace: postgresql
-    create_namespace: true
-    values:
-      metrics:
-        enabled: true
-      volumePermissions:
-        enabled: true
-      pgpool:
-        adminPassword: "{{ postgresql_admin_password }}"
-        customUsers:
-          usernames: gitea,grafana,jupyterhub,mastodon,nextcloud
-          passwords: "{{ gitea_admin_password }},{{ grafana_admin_password }},{{ jupyterhub_admin_password }},{{ mastodon_admin_password }},{{ nextcloud_admin_password }}"
-      backup:
-        enabled: true
-      persistence:
-        size: 2Ti
-      postgresql:
-        username: postgres
-        password: "{{ postgresql_admin_password }}"
-        repmgrPassword: "{{ postgresql_repmgr_password }}"
-        initdbScripts:
-          setup.sql: |
-            CREATE USER gitea WITH PASSWORD '{{ gitea_admin_password }}';
-            CREATE DATABASE gitea WITH OWNER gitea;
-            CREATE USER grafana WITH PASSWORD '{{ grafana_admin_password }}';
-            CREATE DATABASE grafana WITH OWNER grafana;
-            CREATE USER jupyterhub WITH PASSWORD '{{ jupyterhub_admin_password }}';
-            CREATE DATABASE jupyterhub WITH OWNER jupyterhub;
-            CREATE USER mastodon WITH PASSWORD '{{ mastodon_admin_password }}';
-            CREATE DATABASE mastodon WITH OWNER mastodon;
-            CREATE USER nextcloud WITH PASSWORD '{{ nextcloud_admin_password }}';
-            CREATE DATABASE nextcloud WITH OWNER nextcloud;

tasks/prometheus.yaml

@@ -1,110 +0,0 @@
----
-# tasks file for prometheus
-- name: Deploy Prometheus
-  kubernetes.core.helm:
-    name: prometheus
-    chart_ref: bitnami/prometheus
-    release_namespace: prometheus
-    create_namespace: true
-    values:
-      server:
-        persistence:
-          size: 256Gi
-        extraScrapeConfigs:
-          - job_name: apps
-            static_configs:
-              - targets:
-                - gitea.eom.dev
-                labels:
-                  instance: gitea
-              - targets:
-                - grafana.eom.dev
-                labels:
-                  instance: grafana
-              - targets:
-                - jupyterhub.eom.dev
-                labels:
-                  instance: jupyterhub
-              - targets:
-                - mastodon.eom.dev
-                labels:
-                  instance: mastodon
-              - targets:
-                - nextcloud-metrics.nextcloud.svc.cluster.local
-                labels:
-                  instance: nextcloud
-            metrics_path: /metrics
-          - job_name: libvirt_exporter
-            static_configs:
-              - targets:
-                - 192.168.1.48:9177
-                labels:
-                  instance: poweredge-t640
-            metrics_path: /metrics
-          - job_name: node_exporter
-            static_configs:
-              - targets:
-                - 192.168.1.95:9100
-                labels:
-                  instance: poweredge-r350
-              - targets:
-                - 192.168.1.48:9100
-                labels:
-                  instance: poweredge-t640
-              - targets:
-                - 192.168.1.59:9100
-                labels:
-                  instance: alpha-control-plane
-              - targets:
-                - 192.168.1.91:9100
-                labels:
-                  instance: alpha-worker-0
-              - targets:
-                - 192.168.1.71:9100
-                labels:
-                  instance: alpha-worker-1
-              - targets:
-                - 192.168.1.74:9100
-                labels:
-                  instance: alpha-worker-2
-              - targets:
-                - 192.168.1.75:9100
-                labels:
-                  instance: alpha-worker-3
-              - targets:
-                - 192.168.1.60:9100
-                labels:
-                  instance: alpha-worker-4
-              - targets:
-                - 192.168.1.66:9100
-                labels:
-                  instance: alpha-worker-5
-              - targets:
-                - 192.168.1.38:9100
-                labels:
-                  instance: alpha-worker-6
-              - targets:
-                - 192.168.1.92:9100
-                labels:
-                  instance: alpha-worker-7
-              - targets:
-                - 192.168.1.67:9100
-                labels:
-                  instance: alpha-worker-8
-              - targets:
-                - 192.168.1.63:9100
-                labels:
-                  instance: alpha-worker-9
-              - targets:
-                - 192.168.1.86:9100
-                labels:
-                  instance: alpha-worker-10
-              - targets:
-                - 192.168.1.68:9100
-                labels:
-                  instance: alpha-worker-11
-              - targets:
-                - 192.168.1.72:9100
-                labels:
-                  instance: alpha-worker-12
-            metrics_path: /metrics

tasks/redis.yaml

@@ -1,14 +0,0 @@
----
-# tasks file for redis
-- name: Deploy Redis
-  kubernetes.core.helm:
-    name: redis
-    chart_ref: bitnami/redis-cluster
-    release_namespace: redis
-    create_namespace: true
-    values:
-      metrics:
-        enabled: true
-      password: "{{ redis_auth_password }}"
-      persistence:
-        size: 64Gi

tasks/www.yaml

@@ -7,7 +7,7 @@
       apiVersion: v1
       kind: Namespace
       metadata:
-        name: wordpress
+        name: www
 
 - name: Create PVC for MySQL
   k8s:
@@ -17,7 +17,7 @@
       kind: PersistentVolumeClaim
       metadata:
         name: mysql
-        namespace: wordpress
+        namespace: www
       spec:
         accessModes:
           - ReadWriteOnce
@@ -33,7 +33,7 @@
       kind: Deployment
       metadata:
         name: mysql
-        namespace: wordpress
+        namespace: www
         labels:
           app: mysql
       spec:
@@ -55,8 +55,6 @@
                 ports:
                   - containerPort: 3306
                 env:
-                  - name: MYSQL_ROOT_PASSWORD
-                    value: "{{ mysql_root_password }}"
                   - name: MYSQL_DATABASE
                     value: wordpress
                   - name: MYSQL_USER
@@ -76,7 +74,7 @@
       kind: Service
       metadata:
         name: mysql
-        namespace: wordpress
+        namespace: www
       spec:
         selector:
           app: mysql
@@ -93,7 +91,7 @@
       kind: PersistentVolumeClaim
       metadata:
         name: wordpress
-        namespace: wordpress
+        namespace: www
       spec:
         accessModes:
           - ReadWriteOnce
@@ -109,7 +107,7 @@
       kind: Deployment
       metadata:
         name: wordpress
-        namespace: wordpress
+        namespace: www
         labels:
           app: wordpress
       spec:
@@ -127,7 +125,7 @@
                 image: wordpress
                 volumeMounts:
                   - name: data
-                    mountPath: /var/wordpress/html
+                    mountPath: /var/www/html
                 ports:
                   - containerPort: 3000
                 env:
@@ -152,7 +150,7 @@
       kind: Service
       metadata:
         name: wordpress
-        namespace: wordpress
+        namespace: www
       spec:
         selector:
           app: wordpress
@@ -171,7 +169,7 @@
         annotations:
           cert-manager.io/cluster-issuer: ca-issuer
         name: wordpress
-        namespace: wordpress
+        namespace: www
       spec:
         ingressClassName: nginx
         rules:
@@ -185,18 +183,7 @@
                       name: wordpress
                       port:
                         number: 80
-          - host: wordpress.eom.dev
-            http:
-              paths:
-                - pathType: Prefix
-                  path: /
-                  backend:
-                    service:
-                      name: wordpress
-                      port:
-                        number: 80
         tls:
           - hosts:
             - www.eom.dev
-            - wordpress.eom.dev
             secretName: wordpress

templates/eric.ldif.j2

@@ -0,0 +1,14 @@
+dn: uid=eric,dc=eom,dc=dev
+changetype: add
+uid: eric
+cn: Eric O'Neill Meehan
+sn: 3
+objectClass: top
+objectClass: posixAccount
+objectClass: inetOrgPerson
+loginShell: /bin/zsh
+homeDirectory: /home/eric
+uidNumber: 10000
+gidNumber: 10000
+userPassword: {{ eric_user_password }}
+mail: eric@mail.eom.dev

templates/httpd-auth.conf.j2

@@ -0,0 +1,38 @@
+LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
+LoadModule ldap_module modules/mod_ldap.so
+
+# Base
+<LocationMatch "^/">
+	AuthType basic
+	AuthName OpenLDAP
+	AuthBasicProvider ldap
+	AuthLDAPBindDN "cn=admin,dc=eom,dc=dev"
+	AuthLDAPBindPassword "{{ ldap_admin_password }}"
+	AuthLDAPURL "ldap://openldap/dc=eom,dc=dev?uid"
+	<RequireAny>
+		Require method GET OPTIONS
+		Require valid-user
+	</RequireAny>
+</LocationMatch>
+
+# Users
+<LocationMatch "^/eric">
+	AuthType basic
+	AuthName OpenLDAP
+	AuthBasicProvider ldap
+	AuthLDAPBindDN "cn=admin,dc=eom,dc=dev"
+	AuthLDAPBindPassword "{{ ldap_admin_password }}"
+	AuthLDAPURL "ldap://openldap/dc=eom,dc=dev?uid??(uid=eric)"
+	Require valid-user
+</LocationMatch>
+
+# Git
+<LocationMatch "^/.*/git-receive-pack$">
+	AuthType basic
+	AuthName OpenLDAP
+	AuthBasicProvider ldap
+	AuthLDAPBindDN "cn=admin,dc=eom,dc=dev"
+	AuthLDAPBindPassword "{{ ldap_admin_password }}"
+	AuthLDAPURL "ldap://openldap/dc=eom,dc=dev?uid"
+	Require valid-user
+</LocationMatch>

templates/httpd.conf.j2

@@ -0,0 +1,555 @@
+#
+# This is the main Apache HTTP server configuration file.  It contains the
+# configuration directives that give the server its instructions.
+# See <URL:http://httpd.apache.org/docs/2.4/> for detailed information.
+# In particular, see 
+# <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
+# for a discussion of each configuration directive.
+#
+# Do NOT simply read the instructions in here without understanding
+# what they do.  They're here only as hints or reminders.  If you are unsure
+# consult the online docs. You have been warned.  
+#
+# Configuration and logfile names: If the filenames you specify for many
+# of the server's control files begin with "/" (or "drive:/" for Win32), the
+# server will use that explicit path.  If the filenames do *not* begin
+# with "/", the value of ServerRoot is prepended -- so "logs/access_log"
+# with ServerRoot set to "/usr/local/apache2" will be interpreted by the
+# server as "/usr/local/apache2/logs/access_log", whereas "/logs/access_log" 
+# will be interpreted as '/logs/access_log'.
+
+#
+# ServerRoot: The top of the directory tree under which the server's
+# configuration, error, and log files are kept.
+#
+# Do not add a slash at the end of the directory path.  If you point
+# ServerRoot at a non-local disk, be sure to specify a local disk on the
+# Mutex directive, if file-based mutexes are used.  If you wish to share the
+# same ServerRoot for multiple httpd daemons, you will need to change at
+# least PidFile.
+#
+ServerRoot "/usr/local/apache2"
+
+#
+# Mutex: Allows you to set the mutex mechanism and mutex file directory
+# for individual mutexes, or change the global defaults
+#
+# Uncomment and change the directory if mutexes are file-based and the default
+# mutex file directory is not on a local disk or is not appropriate for some
+# other reason.
+#
+# Mutex default:logs
+
+#
+# Listen: Allows you to bind Apache to specific IP addresses and/or
+# ports, instead of the default. See also the <VirtualHost>
+# directive.
+#
+# Change this to Listen on specific IP addresses as shown below to 
+# prevent Apache from glomming onto all bound IP addresses.
+#
+#Listen 12.34.56.78:80
+Listen 80
+
+#
+# Dynamic Shared Object (DSO) Support
+#
+# To be able to use the functionality of a module which was built as a DSO you
+# have to place corresponding `LoadModule' lines at this location so the
+# directives contained in it are actually available _before_ they are used.
+# Statically compiled modules (those listed by `httpd -l') do not need
+# to be loaded here.
+#
+# Example:
+# LoadModule foo_module modules/mod_foo.so
+#
+LoadModule mpm_event_module modules/mod_mpm_event.so
+#LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
+#LoadModule mpm_worker_module modules/mod_mpm_worker.so
+LoadModule authn_file_module modules/mod_authn_file.so
+#LoadModule authn_dbm_module modules/mod_authn_dbm.so
+#LoadModule authn_anon_module modules/mod_authn_anon.so
+#LoadModule authn_dbd_module modules/mod_authn_dbd.so
+#LoadModule authn_socache_module modules/mod_authn_socache.so
+LoadModule authn_core_module modules/mod_authn_core.so
+LoadModule authz_host_module modules/mod_authz_host.so
+LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
+LoadModule authz_user_module modules/mod_authz_user.so
+#LoadModule authz_dbm_module modules/mod_authz_dbm.so
+#LoadModule authz_owner_module modules/mod_authz_owner.so
+#LoadModule authz_dbd_module modules/mod_authz_dbd.so
+LoadModule authz_core_module modules/mod_authz_core.so
+#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
+#LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so
+LoadModule access_compat_module modules/mod_access_compat.so
+LoadModule auth_basic_module modules/mod_auth_basic.so
+#LoadModule auth_form_module modules/mod_auth_form.so
+#LoadModule auth_digest_module modules/mod_auth_digest.so
+#LoadModule allowmethods_module modules/mod_allowmethods.so
+#LoadModule isapi_module modules/mod_isapi.so
+#LoadModule file_cache_module modules/mod_file_cache.so
+#LoadModule cache_module modules/mod_cache.so
+#LoadModule cache_disk_module modules/mod_cache_disk.so
+#LoadModule cache_socache_module modules/mod_cache_socache.so
+#LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
+#LoadModule socache_dbm_module modules/mod_socache_dbm.so
+#LoadModule socache_memcache_module modules/mod_socache_memcache.so
+#LoadModule socache_redis_module modules/mod_socache_redis.so
+#LoadModule watchdog_module modules/mod_watchdog.so
+#LoadModule macro_module modules/mod_macro.so
+#LoadModule dbd_module modules/mod_dbd.so
+#LoadModule bucketeer_module modules/mod_bucketeer.so
+#LoadModule dumpio_module modules/mod_dumpio.so
+#LoadModule echo_module modules/mod_echo.so
+#LoadModule example_hooks_module modules/mod_example_hooks.so
+#LoadModule case_filter_module modules/mod_case_filter.so
+#LoadModule case_filter_in_module modules/mod_case_filter_in.so
+#LoadModule example_ipc_module modules/mod_example_ipc.so
+#LoadModule buffer_module modules/mod_buffer.so
+#LoadModule data_module modules/mod_data.so
+#LoadModule ratelimit_module modules/mod_ratelimit.so
+LoadModule reqtimeout_module modules/mod_reqtimeout.so
+#LoadModule ext_filter_module modules/mod_ext_filter.so
+#LoadModule request_module modules/mod_request.so
+#LoadModule include_module modules/mod_include.so
+LoadModule filter_module modules/mod_filter.so
+#LoadModule reflector_module modules/mod_reflector.so
+#LoadModule substitute_module modules/mod_substitute.so
+#LoadModule sed_module modules/mod_sed.so
+#LoadModule charset_lite_module modules/mod_charset_lite.so
+#LoadModule deflate_module modules/mod_deflate.so
+#LoadModule xml2enc_module modules/mod_xml2enc.so
+#LoadModule proxy_html_module modules/mod_proxy_html.so
+#LoadModule brotli_module modules/mod_brotli.so
+LoadModule mime_module modules/mod_mime.so
+#LoadModule ldap_module modules/mod_ldap.so
+LoadModule log_config_module modules/mod_log_config.so
+#LoadModule log_debug_module modules/mod_log_debug.so
+#LoadModule log_forensic_module modules/mod_log_forensic.so
+#LoadModule logio_module modules/mod_logio.so
+#LoadModule lua_module modules/mod_lua.so
+LoadModule env_module modules/mod_env.so
+#LoadModule mime_magic_module modules/mod_mime_magic.so
+#LoadModule cern_meta_module modules/mod_cern_meta.so
+#LoadModule expires_module modules/mod_expires.so
+LoadModule headers_module modules/mod_headers.so
+#LoadModule ident_module modules/mod_ident.so
+#LoadModule usertrack_module modules/mod_usertrack.so
+#LoadModule unique_id_module modules/mod_unique_id.so
+LoadModule setenvif_module modules/mod_setenvif.so
+LoadModule version_module modules/mod_version.so
+#LoadModule remoteip_module modules/mod_remoteip.so
+#LoadModule proxy_module modules/mod_proxy.so
+#LoadModule proxy_connect_module modules/mod_proxy_connect.so
+#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
+#LoadModule proxy_http_module modules/mod_proxy_http.so
+#LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
+#LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
+#LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
+#LoadModule proxy_fdpass_module modules/mod_proxy_fdpass.so
+#LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
+#LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
+#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
+#LoadModule proxy_express_module modules/mod_proxy_express.so
+#LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so
+#LoadModule session_module modules/mod_session.so
+#LoadModule session_cookie_module modules/mod_session_cookie.so
+#LoadModule session_crypto_module modules/mod_session_crypto.so
+#LoadModule session_dbd_module modules/mod_session_dbd.so
+#LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
+#LoadModule slotmem_plain_module modules/mod_slotmem_plain.so
+#LoadModule ssl_module modules/mod_ssl.so
+#LoadModule optional_hook_export_module modules/mod_optional_hook_export.so
+#LoadModule optional_hook_import_module modules/mod_optional_hook_import.so
+#LoadModule optional_fn_import_module modules/mod_optional_fn_import.so
+#LoadModule optional_fn_export_module modules/mod_optional_fn_export.so
+#LoadModule dialup_module modules/mod_dialup.so
+#LoadModule http2_module modules/mod_http2.so
+#LoadModule proxy_http2_module modules/mod_proxy_http2.so
+#LoadModule md_module modules/mod_md.so
+#LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
+#LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
+#LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
+#LoadModule lbmethod_heartbeat_module modules/mod_lbmethod_heartbeat.so
+LoadModule unixd_module modules/mod_unixd.so
+#LoadModule heartbeat_module modules/mod_heartbeat.so
+#LoadModule heartmonitor_module modules/mod_heartmonitor.so
+#LoadModule dav_module modules/mod_dav.so
+LoadModule status_module modules/mod_status.so
+LoadModule autoindex_module modules/mod_autoindex.so
+#LoadModule asis_module modules/mod_asis.so
+#LoadModule info_module modules/mod_info.so
+#LoadModule suexec_module modules/mod_suexec.so
+<IfModule !mpm_prefork_module>
+	#LoadModule cgid_module modules/mod_cgid.so
+</IfModule>
+<IfModule mpm_prefork_module>
+	#LoadModule cgi_module modules/mod_cgi.so
+</IfModule>
+#LoadModule dav_fs_module modules/mod_dav_fs.so
+#LoadModule dav_lock_module modules/mod_dav_lock.so
+#LoadModule vhost_alias_module modules/mod_vhost_alias.so
+#LoadModule negotiation_module modules/mod_negotiation.so
+LoadModule dir_module modules/mod_dir.so
+#LoadModule imagemap_module modules/mod_imagemap.so
+#LoadModule actions_module modules/mod_actions.so
+#LoadModule speling_module modules/mod_speling.so
+#LoadModule userdir_module modules/mod_userdir.so
+LoadModule alias_module modules/mod_alias.so
+#LoadModule rewrite_module modules/mod_rewrite.so
+
+<IfModule unixd_module>
+#
+# If you wish httpd to run as a different user or group, you must run
+# httpd as root initially and it will switch.  
+#
+# User/Group: The name (or #number) of the user/group to run httpd as.
+# It is usually good practice to create a dedicated user and group for
+# running httpd, as with most system services.
+#
+User www-data
+Group www-data
+
+</IfModule>
+
+# 'Main' server configuration
+#
+# The directives in this section set up the values used by the 'main'
+# server, which responds to any requests that aren't handled by a
+# <VirtualHost> definition.  These values also provide defaults for
+# any <VirtualHost> containers you may define later in the file.
+#
+# All of these directives may appear inside <VirtualHost> containers,
+# in which case these default settings will be overridden for the
+# virtual host being defined.
+#
+
+#
+# ServerAdmin: Your address, where problems with the server should be
+# e-mailed.  This address appears on some server-generated pages, such
+# as error documents.  e.g. admin@your-domain.com
+#
+ServerAdmin admin@mail.eom.dev
+
+#
+# ServerName gives the name and port that the server uses to identify itself.
+# This can often be determined automatically, but we recommend you specify
+# it explicitly to prevent problems during startup.
+#
+# If your host doesn't have a registered DNS name, enter its IP address here.
+#
+ServerName {{ httpd_server_name }}:80
+
+#
+# Deny access to the entirety of your server's filesystem. You must
+# explicitly permit access to web content directories in other 
+# <Directory> blocks below.
+#
+<Directory />
+    AllowOverride none
+    Require all denied
+</Directory>
+
+#
+# Note that from this point forward you must specifically allow
+# particular features to be enabled - so if something's not working as
+# you might expect, make sure that you have specifically enabled it
+# below.
+#
+
+#
+# DocumentRoot: The directory out of which you will serve your
+# documents. By default, all requests are taken from this directory, but
+# symbolic links and aliases may be used to point to other locations.
+#
+DocumentRoot "/usr/local/apache2/htdocs"
+<Directory "/usr/local/apache2/htdocs">
+    #
+    # Possible values for the Options directive are "None", "All",
+    # or any combination of:
+    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
+    #
+    # Note that "MultiViews" must be named *explicitly* --- "Options All"
+    # doesn't give it to you.
+    #
+    # The Options directive is both complicated and important.  Please see
+    # http://httpd.apache.org/docs/2.4/mod/core.html#options
+    # for more information.
+    #
+    Options Indexes FollowSymLinks
+
+    #
+    # AllowOverride controls what directives may be placed in .htaccess files.
+    # It can be "All", "None", or any combination of the keywords:
+    #   AllowOverride FileInfo AuthConfig Limit
+    #
+    AllowOverride None
+
+    #
+    # Controls who can get stuff from this server.
+    #
+    Require all granted
+</Directory>
+
+#
+# DirectoryIndex: sets the file that Apache will serve if a directory
+# is requested.
+#
+<IfModule dir_module>
+    DirectoryIndex index.html
+</IfModule>
+
+#
+# The following lines prevent .htaccess and .htpasswd files from being 
+# viewed by Web clients. 
+#
+<Files ".ht*">
+    Require all denied
+</Files>
+
+#
+# ErrorLog: The location of the error log file.
+# If you do not specify an ErrorLog directive within a <VirtualHost>
+# container, error messages relating to that virtual host will be
+# logged here.  If you *do* define an error logfile for a <VirtualHost>
+# container, that host's errors will be logged there and not here.
+#
+ErrorLog /proc/self/fd/2
+
+#
+# LogLevel: Control the number of messages logged to the error_log.
+# Possible values include: debug, info, notice, warn, error, crit,
+# alert, emerg.
+#
+LogLevel warn
+
+<IfModule log_config_module>
+    #
+    # The following directives define some format nicknames for use with
+    # a CustomLog directive (see below).
+    #
+    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+    LogFormat "%h %l %u %t \"%r\" %>s %b" common
+
+    <IfModule logio_module>
+      # You need to enable mod_logio.c to use %I and %O
+      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
+    </IfModule>
+
+    #
+    # The location and format of the access logfile (Common Logfile Format).
+    # If you do not define any access logfiles within a <VirtualHost>
+    # container, they will be logged here.  Contrariwise, if you *do*
+    # define per-<VirtualHost> access logfiles, transactions will be
+    # logged therein and *not* in this file.
+    #
+    CustomLog /proc/self/fd/1 common
+
+    #
+    # If you prefer a logfile with access, agent, and referer information
+    # (Combined Logfile Format) you can use the following directive.
+    #
+    #CustomLog "logs/access_log" combined
+</IfModule>
+
+<IfModule alias_module>
+    #
+    # Redirect: Allows you to tell clients about documents that used to 
+    # exist in your server's namespace, but do not anymore. The client 
+    # will make a new request for the document at its new location.
+    # Example:
+    # Redirect permanent /foo http://www.example.com/bar
+
+    #
+    # Alias: Maps web paths into filesystem paths and is used to
+    # access content that does not live under the DocumentRoot.
+    # Example:
+    # Alias /webpath /full/filesystem/path
+    #
+    # If you include a trailing / on /webpath then the server will
+    # require it to be present in the URL.  You will also likely
+    # need to provide a <Directory> section to allow access to
+    # the filesystem path.
+
+    #
+    # ScriptAlias: This controls which directories contain server scripts. 
+    # ScriptAliases are essentially the same as Aliases, except that
+    # documents in the target directory are treated as applications and
+    # run by the server when requested rather than as documents sent to the
+    # client.  The same rules about trailing "/" apply to ScriptAlias
+    # directives as to Alias.
+    #
+    ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
+
+</IfModule>
+
+<IfModule cgid_module>
+    #
+    # ScriptSock: On threaded servers, designate the path to the UNIX
+    # socket used to communicate with the CGI daemon of mod_cgid.
+    #
+    #Scriptsock cgisock
+</IfModule>
+
+#
+# "/usr/local/apache2/cgi-bin" should be changed to whatever your ScriptAliased
+# CGI directory exists, if you have that configured.
+#
+<Directory "/usr/local/apache2/cgi-bin">
+    AllowOverride None
+    Options None
+    Require all granted
+</Directory>
+
+<IfModule headers_module>
+    #
+    # Avoid passing HTTP_PROXY environment to CGI's on this or any proxied
+    # backend servers which have lingering "httpoxy" defects.
+    # 'Proxy' request header is undefined by the IETF, not listed by IANA
+    #
+    RequestHeader unset Proxy early
+</IfModule>
+
+<IfModule mime_module>
+    #
+    # TypesConfig points to the file containing the list of mappings from
+    # filename extension to MIME-type.
+    #
+    TypesConfig conf/mime.types
+
+    #
+    # AddType allows you to add to or override the MIME configuration
+    # file specified in TypesConfig for specific file types.
+    #
+    #AddType application/x-gzip .tgz
+    #
+    # AddEncoding allows you to have certain browsers uncompress
+    # information on the fly. Note: Not all browsers support this.
+    #
+    #AddEncoding x-compress .Z
+    #AddEncoding x-gzip .gz .tgz
+    #
+    # If the AddEncoding directives above are commented-out, then you
+    # probably should define those extensions to indicate media types:
+    #
+    AddType application/x-compress .Z
+    AddType application/x-gzip .gz .tgz
+
+    #
+    # AddHandler allows you to map certain file extensions to "handlers":
+    # actions unrelated to filetype. These can be either built into the server
+    # or added with the Action directive (see below)
+    #
+    # To use CGI scripts outside of ScriptAliased directories:
+    # (You will also need to add "ExecCGI" to the "Options" directive.)
+    #
+    #AddHandler cgi-script .cgi
+
+    # For type maps (negotiated resources):
+    #AddHandler type-map var
+
+    #
+    # Filters allow you to process content before it is sent to the client.
+    #
+    # To parse .shtml files for server-side includes (SSI):
+    # (You will also need to add "Includes" to the "Options" directive.)
+    #
+    #AddType text/html .shtml
+    #AddOutputFilter INCLUDES .shtml
+</IfModule>
+
+#
+# The mod_mime_magic module allows the server to use various hints from the
+# contents of the file itself to determine its type.  The MIMEMagicFile
+# directive tells the module where the hint definitions are located.
+#
+#MIMEMagicFile conf/magic
+
+#
+# Customizable error responses come in three flavors:
+# 1) plain text 2) local redirects 3) external redirects
+#
+# Some examples:
+#ErrorDocument 500 "The server made a boo boo."
+#ErrorDocument 404 /missing.html
+#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
+#ErrorDocument 402 http://www.example.com/subscription_info.html
+#
+
+#
+# MaxRanges: Maximum number of Ranges in a request before
+# returning the entire resource, or one of the special
+# values 'default', 'none' or 'unlimited'.
+# Default setting is to accept 200 Ranges.
+#MaxRanges unlimited
+
+#
+# EnableMMAP and EnableSendfile: On systems that support it, 
+# memory-mapping or the sendfile syscall may be used to deliver
+# files.  This usually improves server performance, but must
+# be turned off when serving from networked-mounted 
+# filesystems or if support for these functions is otherwise
+# broken on your system.
+# Defaults: EnableMMAP On, EnableSendfile Off
+#
+#EnableMMAP off
+#EnableSendfile on
+
+# Supplemental configuration
+#
+# The configuration files in the conf/extra/ directory can be 
+# included to add extra features or to modify the default configuration of 
+# the server, or you may simply copy their contents here and change as 
+# necessary.
+
+# Server-pool management (MPM specific)
+#Include conf/extra/httpd-mpm.conf
+
+# Multi-language error messages
+#Include conf/extra/httpd-multilang-errordoc.conf
+
+# Fancy directory listings
+#Include conf/extra/httpd-autoindex.conf
+
+# Language settings
+#Include conf/extra/httpd-languages.conf
+
+# User home directories
+#Include conf/extra/httpd-userdir.conf
+
+# Real-time info on requests and configuration
+#Include conf/extra/httpd-info.conf
+
+# Virtual hosts
+#Include conf/extra/httpd-vhosts.conf
+
+# Local access to the Apache HTTP Server Manual
+#Include conf/extra/httpd-manual.conf
+
+# Distributed authoring and versioning (WebDAV)
+#Include conf/extra/httpd-dav.conf
+
+# Various default settings
+#Include conf/extra/httpd-default.conf
+
+{% for config in httpd_conf_extra %}
+Include conf/{{ config }}
+{% endfor %}
+
+# Configure mod_proxy_html to understand HTML4/XHTML1
+<IfModule proxy_html_module>
+Include conf/extra/proxy-html.conf
+</IfModule>
+
+# Secure (SSL/TLS) connections
+#Include conf/extra/httpd-ssl.conf
+#
+# Note: The following must must be present to support
+#       starting without SSL on platforms with no /dev/random equivalent
+#       but a statically compiled-in mod_ssl.
+#
+<IfModule ssl_module>
+SSLRandomSeed startup builtin
+SSLRandomSeed connect builtin
+</IfModule>
+

templates/ldap.toml.j2

@@ -1,64 +0,0 @@
-[[servers]]
-# Ldap server host (specify multiple hosts space separated)
-host = "openldap.openldap.svc.cluster.local"
-# Default port is 389 or 636 if use_ssl = true
-port = 389
-# Set to true if LDAP server should use an encrypted TLS connection (either with STARTTLS or LDAPS)
-use_ssl = false
-# If set to true, use LDAP with STARTTLS instead of LDAPS
-start_tls = false
-# The value of an accepted TLS cipher. By default, this value is empty. Example value: ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"])
-# For a complete list of supported ciphers and TLS versions, refer to: https://go.dev/src/crypto/tls/cipher_suites.go
-# Starting with Grafana v11.0 only ciphers with ECDHE support are accepted for TLS 1.2 connections.
-tls_ciphers = []
-# This is the minimum TLS version allowed. By default, this value is empty. Accepted values are: TLS1.1 (only for Grafana v10.4 or earlier), TLS1.2, TLS1.3.
-min_tls_version = ""
-# set to true if you want to skip SSL cert validation
-ssl_skip_verify = false
-# set to the path to your root CA certificate or leave unset to use system defaults
-# root_ca_cert = "/path/to/certificate.crt"
-# Authentication against LDAP servers requiring client certificates
-# client_cert = "/path/to/client.crt"
-# client_key = "/path/to/client.key"
-
-# Search user bind dn
-bind_dn = "cn=readonly,dc=eom,dc=dev"
-# Search user bind password
-# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
-bind_password = "{{ openldap_readonly_password }}"
-# We recommend using variable expansion for the bind_password, for more info https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#variable-expansion
-# bind_password = '$__env{LDAP_BIND_PASSWORD}'
-
-# Timeout in seconds. Applies to each host specified in the 'host' entry (space separated).
-timeout = 30
-
-# User search filter, for example "(cn=%s)" or "(sAMAccountName=%s)" or "(uid=%s)"
-# Allow login from email or username, example "(|(sAMAccountName=%s)(userPrincipalName=%s))"
-search_filter = "(&(objectClass=posixAccount)(uid=%s)(memberOf=cn=Grafana Users,ou=Grafana,ou=Services,dc=eom,dc=dev))"
-
-# An array of base dns to search through
-search_base_dns = ["dc=eom,dc=dev"]
-
-# Specify names of the LDAP attributes your LDAP uses
-[servers.attributes]
-username = "uid"
-email =  "mail"
-name = "givenName"
-surname = "sn"
-member_of = "memberOf"
-
-[[servers.group_mappings]]
-group_dn = "cn=Grafana Administrators,ou=Grafana,ou=Services,dc=eom,dc=dev"
-org_id = 1
-org_role = "Admin"
-grafana_admin = true
-
-[[servers.group_mappings]]
-group_dn = "cn=Grafana Users,ou=Grafana,ou=Services,dc=eom,dc=dev"
-org_id = 1
-org_role = "Viewer"
-
-[[servers.group_mappings]]
-group_dn = "cn=DevOps Owners,ou=DevOps,ou=Organizations,dc=eom,dc=dev"
-org_id = 2
-org_role = "Admin"

templates/psql.sh.j2

@@ -1,6 +0,0 @@
-#!/bin/bash
-psql -U postgres <<-EOSQL
-	CREATE DATABASE {{ db }};
-	CREATE USER {{ user }} WITH ENCRYPTED PASSWORD '{{ pwd }}';
-	GRANT ALL PRIVILEGES ON {{ db }} TO {{ user }};
-	EOSQL