DevOps/ansible-role-eom
2
0
Fork 0
Code Issues 12 Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: DevOps/ansible-role-eom:main
Branches Tags
DevOps/ansible-role-eom:main
..
compare: DevOps/ansible-role-eom:bc7fb3eaf372827152e628e39d1aa13726a9319f
Branches Tags
DevOps/ansible-role-eom:main
1 Commits
main .. bc7fb3eaf3
Author SHA1 Message Date
eric bc7fb3eaf3 Pinned PostgreSQL to v16.6 2025-08-01 13:24:14 -04:00
31 changed files with 358 additions and 2825 deletions
Expand all files Collapse all files
files/discourse-sso.rb
-45
View File
@@ -1,45 +0,0 @@
# Idempotent: sign-in goes only through Dex (discourse-openid-connect),
# and the Sign Up button goes to the eom.dev membership site.
# Run with: RAILS_ENV=production bundle exec rails runner <this file>
SIGNUP_URL = "https://www.eom.dev/members"
# OIDC is the only login method left, so with auth_immediately the
# Log In button redirects straight to Dex. Accounts link by email.
SiteSetting.enable_local_logins = false
SiteSetting.auth_immediately = true
# New members sign up at www.eom.dev; Discourse must still create their
# account on first Dex login.
SiteSetting.allow_new_registrations = true
# Chat is bundled in core and on by default; this forum does not use it.
SiteSetting.chat_enabled = false
head_tag = <<~HTML
<script>
(function () {
var url = #{SIGNUP_URL.to_json};
if (location.pathname === "/signup") { location.replace(url); return; }
document.addEventListener("click", function (e) {
var b = e.target.closest(".sign-up-button, a[href='/signup']");
if (!b) return;
e.preventDefault();
e.stopImmediatePropagation();
location.href = url;
}, true);
})();
</script>
HTML
name = "eom.dev sign-up redirect"
component = Theme.find_by(name: name) ||
Theme.create!(name: name, user_id: Discourse.system_user.id, component: true)
component.set_field(target: :common, name: :head_tag, value: head_tag)
component.save!
Theme.where(component: false).find_each do |theme|
next if theme.child_themes.include?(component)
theme.add_relative_theme!(:child, component)
end
puts "enable_local_logins=#{SiteSetting.enable_local_logins} component=#{component.id} " \
"parents=#{component.parent_themes.pluck(:name).join(', ')}"
files/discourse/discourse-web.yaml
-107
View File
@@ -1,107 +0,0 @@
# Discourse v2026.10.0, built with the official launcher (see web_only.yml).
# Reuses the existing Bitnami-era uploads volume, Redis and Kubernetes secrets.
apiVersion: apps/v1
kind: Deployment
metadata:
name: discourse-web
namespace: discourse
labels:
app.kubernetes.io/name: discourse-web
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app.kubernetes.io/name: discourse-web
template:
metadata:
labels:
app.kubernetes.io/name: discourse-web
spec:
# The image is 3.77 GB and most nodes have only 3-8 GB free; pulling it
# elsewhere risks DiskPressure and evicting the MetalLB speakers.
nodeSelector:
kubernetes.io/hostname: alpha-worker-0
initContainers:
# The launcher image runs Discourse as uid 1000; Bitnami used 999.
- name: fix-ownership
image: gitea.eom.dev/devops/discourse-web:v2026.10.0
command: ["sh", "-c", "chown -R 1000:1000 /shared/uploads /shared/backups"]
volumeMounts:
- name: discourse-data
mountPath: /shared/uploads
subPath: discourse/public/uploads
- name: discourse-data
mountPath: /shared/backups
subPath: discourse/public/backups
containers:
- name: discourse
image: gitea.eom.dev/devops/discourse-web:v2026.10.0
command: ["/sbin/boot"]
ports:
- name: http
containerPort: 80
env:
- { name: RAILS_ENV, value: production }
- { name: LANG, value: en_US.UTF-8 }
- { name: LC_ALL, value: en_US.UTF-8 }
- { name: MIGRATE_ON_BOOT, value: "1" }
- { name: PRECOMPILE_ON_BOOT, value: "1" }
- { name: CREATE_DB_ON_BOOT, value: "0" }
- { name: UNICORN_WORKERS, value: "2" }
- { name: UNICORN_SIDEKIQS, value: "1" }
- { name: DISCOURSE_HOSTNAME, value: discourse.eom.dev }
- { name: DISCOURSE_DB_SOCKET, value: "" }
- { name: DISCOURSE_DB_HOST, value: discourse-postgres18 }
- { name: DISCOURSE_DB_NAME, value: bitnami_application }
- { name: DISCOURSE_DB_USERNAME, value: bn_discourse }
- name: DISCOURSE_DB_PASSWORD
valueFrom:
secretKeyRef: { name: discourse-postgresql, key: password }
- { name: DISCOURSE_REDIS_HOST, value: discourse-redis-master }
- name: DISCOURSE_REDIS_PASSWORD
valueFrom:
secretKeyRef: { name: discourse-redis, key: redis-password }
- { name: DISCOURSE_SMTP_ADDRESS, value: postfix.eom.dev }
- { name: DISCOURSE_SMTP_PORT, value: "587" }
- { name: DISCOURSE_SMTP_USER_NAME, value: discourse }
- name: DISCOURSE_SMTP_PASSWORD
valueFrom:
secretKeyRef: { name: discourse-discourse, key: smtp-password }
startupProbe:
httpGet: &status
path: /srv/status
port: http
httpHeaders:
- { name: Host, value: discourse.eom.dev }
- { name: X-Forwarded-Proto, value: https }
periodSeconds: 10
failureThreshold: 180
readinessProbe:
httpGet: *status
periodSeconds: 10
failureThreshold: 6
livenessProbe:
httpGet: *status
periodSeconds: 20
failureThreshold: 6
resources:
requests:
cpu: 250m
memory: 1Gi
volumeMounts:
- name: shared
mountPath: /shared
- name: discourse-data
mountPath: /shared/uploads
subPath: discourse/public/uploads
- name: discourse-data
mountPath: /shared/backups
subPath: discourse/public/backups
volumes:
- name: shared
emptyDir: {}
- name: discourse-data
persistentVolumeClaim:
claimName: discourse
files/discourse/postgres18.yaml
-73
View File
@@ -1,73 +0,0 @@
# PostgreSQL 18 with pgvector for Discourse. Runs alongside the old Bitnami
# PostgreSQL 17 StatefulSet, whose volume stays untouched for rollback.
apiVersion: v1
kind: Service
metadata:
name: discourse-postgres18
namespace: discourse
labels:
app.kubernetes.io/name: discourse-postgres18
spec:
clusterIP: None
selector:
app.kubernetes.io/name: discourse-postgres18
ports:
- name: postgresql
port: 5432
targetPort: postgresql
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: discourse-postgres18
namespace: discourse
labels:
app.kubernetes.io/name: discourse-postgres18
spec:
serviceName: discourse-postgres18
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: discourse-postgres18
template:
metadata:
labels:
app.kubernetes.io/name: discourse-postgres18
spec:
containers:
- name: postgresql
image: pgvector/pgvector:pg18
ports:
- name: postgresql
containerPort: 5432
env:
- name: POSTGRES_USER
value: postgres
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: discourse-postgresql
key: postgres-password
readinessProbe:
exec:
command: ["pg_isready", "-U", "postgres", "-h", "127.0.0.1"]
periodSeconds: 10
failureThreshold: 6
livenessProbe:
exec:
command: ["pg_isready", "-U", "postgres", "-h", "127.0.0.1"]
initialDelaySeconds: 60
periodSeconds: 10
failureThreshold: 6
volumeMounts:
- name: data
mountPath: /var/lib/postgresql
volumeClaimTemplates:
- metadata:
name: data
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: nfs-client
resources:
requests:
storage: 2Ti
files/discourse/web_only.yml
-36
View File
@@ -1,36 +0,0 @@
# Build-only config for the eom.dev Discourse image. No secrets belong here:
# database, Redis and SMTP credentials are supplied at runtime by Kubernetes.
templates:
- "templates/web.template.yml"
- "templates/web.ratelimited.template.yml"
params:
version: v2026.10.0
env:
LC_ALL: en_US.UTF-8
LANG: en_US.UTF-8
LANGUAGE: en_US.UTF-8
DISCOURSE_HOSTNAME: discourse.eom.dev
DISABLE_LETSENCRYPT: 1
# Everything else the forum uses (openid-connect, reactions, math, post-voting,
# adplugin, subscriptions, chat) is bundled in core at this version.
hooks:
after_code:
- exec:
cd: $home/plugins
cmd:
- git clone https://github.com/discourse/discourse-activity-pub.git
- git clone https://github.com/discourse/discourse-prometheus.git
run:
# ingress-nginx terminates TLS, so trust its X-Forwarded-For only from the pod
# network. Without this every visitor shares the ingress IP and hits rate limits.
- file:
path: /etc/nginx/conf.d/outlets/server/real-ip.conf
chmod: 644
contents: |
set_real_ip_from 10.244.0.0/16;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
tasks/anawiki.yaml
-140
View File
@@ -1,140 +0,0 @@
---
# tasks file for mediawiki
- name: Create MediaWiki namespace
k8s:
state: present
definition:
apiVersion: v1
kind: Namespace
metadata:
name: mediawiki
- name: Deploy MariaDB
kubernetes.core.helm:
name: mariadb
chart_ref: bitnami/mariadb
release_namespace: mediawiki
values:
auth:
rootPassword: "{{ mediawiki_admin_password }}"
username: mediawiki
password: "{{ mediawiki_admin_password }}"
database: mediawiki
primary:
persistence:
size: 4Ti
- name: Create a persistent volume claim for MediaWiki
k8s:
state: present
definition:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mediawiki
namespace: mediawiki
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 32Gi
- name: Create Deployment for MediaWiki
k8s:
definition:
apiVersion: v1
kind: Deployment
metadata:
name: mediawiki
namespace: mediawiki
spec:
replicas: 1
selector:
matchLabels:
app: mediawiki
template:
metadata:
labels:
app: mediawiki
spec:
containers:
- name: mediawiki
image: mediawiki
imagePullPolicy: IfNotPresent
resources:
requests:
memory: 2Gi
ports:
- containerPort: 80
volumemounts:
- name: mediawiki
mountpath: /var/www/html
volumes:
- name: mediawiki
persistentVolumeClaim:
claimName: mediawiki
- name: Create Service for MediaWiki
k8s:
definition:
apiVersion: v1
kind: Service
metadata:
name: mediawiki
namespace: mediawiki
spec:
selector:
app: mediawiki
ports:
- port: 80
name: http
type: ClusterIP
- name: Create OnionService
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
name: mediawiki
namespace: mediawiki
spec:
version: 3
rules:
- port:
number: 80
backend:
service:
name: mediawiki
port:
number: 80
#- name: Create Ingress
# k8s:
# state: present
# definition:
# apiVersion: networking.k8s.io/v1
# kind: Ingress
# metadata:
# annotations:
# cert-manager.io/cluster-issuer: ca-issuer
# name: mediawiki
# namespace: mediawiki
# spec:
# ingressClassName: nginx
# rules:
# - host: mediawiki.eom.dev
# http:
# paths:
# - pathType: Prefix
# path: /
# backend:
# service:
# name: mediawiki
# port:
# number: 80
# tls:
# - hosts:
# - mediawiki.eom.dev
# secretName: mediawiki
tasks/coturn.yaml
-12
View File
@@ -17,9 +17,6 @@
release_namespace: coturn
create_namespace: true
values:
global:
security:
allowInsecureImages: true
service:
type: LoadBalancer
externalTrafficPolicy: Local
@@ -33,14 +30,8 @@
pullPolicy: Always
externalDatabase:
enabled: true
username: coturn
password: "{{ coturn_admin_password }}"
database: coturn
postgresql:
enabled: true
image:
repository: bitnamilegacy/postgresql
tag: 17.6.0-debian-12-r0
global:
postgresql:
auth:
@@ -110,6 +101,3 @@
auth:
username: coturn
password: "{{ coturn_admin_password }}"
extraTurnserverConfiguration: |
use-auth-secret
static-auth-secret={{ coturn_shared_secret }}
tasks/demowiki.yaml
-147
View File
@@ -1,147 +0,0 @@
---
# tasks file for mediawiki
- name: Create MediaWiki namespace
k8s:
state: present
definition:
apiVersion: v1
kind: Namespace
metadata:
name: mediawiki
- name: Deploy MariaDB
kubernetes.core.helm:
name: mariadb
chart_ref: bitnami/mariadb
release_namespace: mediawiki
values:
auth:
rootPassword: "{{ mediawiki_admin_password }}"
username: mediawiki
password: "{{ mediawiki_admin_password }}"
database: mediawiki
primary:
persistence:
size: 4Ti
- name: Create Deployment for MediaWiki
k8s:
definition:
apiVersion: v1
kind: Deployment
metadata:
name: mediawiki
namespace: mediawiki
spec:
replicas: 1
selector:
matchLabels:
app: mediawiki
template:
metadata:
labels:
app: mediawiki
spec:
containers:
- name: mediawiki
image: ericomeehan/mediawiki-extended
imagePullPolicy: IfNotPresent
resources:
requests:
memory: 2Gi
env:
- name: WIKI_NAME
value: MediaWiki
- name: WIKI_ADMIN
value: mediawiki_admin
- name: WIKI_ADMIN_PASS
value: "{{ mediawiki_admin_password }}"
- name: WIKI_LANG
value: en
- name: WIKI_URL
value: https://mediawiki.eom.dev/
- name: DB_HOST
value: mariadb
- name: DB_PORT
value: "3306"
- name: DB_NAME
value: mediawiki
- name: DB_USER
value: mediawiki
- name: DB_PASS
value: "{{ mediawiki_admin_password }}"
- name: LDAP_BASE
value: dc=eom,dc=dev
- name: LDAP_SERVER_NAME
value: openldap.openldap.svc.cluster.local
- name: LDAP_SERVER_PORT
value: "389"
- name: LDAP_DOMAINNAME
value: openldap.openldap.svc.cluster.local
- name: LDAP_ENCTYPE
value: clear
- name: LDAP_USER_ATTR
value: uid
- name: LDAP_REAL_NAME_ATTR
value: cn
- name: LDAP_MAIL_ATTR
value: mail
- name: LDAP_BIND_USER
value: cn=readonly,dc=eom,dc=dev
- name: LDAP_BIND_PASS
value: "{{ openldap_readonly_password }}"
- name: LDAP_BUREAUCRAT_GROUP
value: cn=Mediawiki Bureaucrats,ou=MediaWiki,ou=Services,dc=eom,dc=dev
- name: LDAP_INTERFACE_ADMIN_GROUP
value: cn=Mediawiki Interface Administrators,ou=MediaWiki,ou=Services,dc=eom,dc=dev
- name: LDAP_SYSOP_GROUP
value: cn=Mediawiki Sysops,ou=MediaWiki,ou=Services,dc=eom,dc=dev
- name: LDAP_SEARCH_FILTER
value: (&(objectClass=posixAccount)(uid=%1$s)(memberOf=cn=Mediawiki Users,ou=MediaWiki,ou=Services,dc=eom,dc=dev))
ports:
- containerPort: 80
- name: Create Service for MediaWiki
k8s:
definition:
apiVersion: v1
kind: Service
metadata:
name: mediawiki
namespace: mediawiki
spec:
selector:
app: mediawiki
ports:
- port: 80
name: http
type: ClusterIP
- name: Create Ingress
k8s:
state: present
definition:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
cert-manager.io/cluster-issuer: ca-issuer
name: mediawiki
namespace: mediawiki
spec:
ingressClassName: nginx
rules:
- host: mediawiki.eom.dev
http:
paths:
- pathType: Prefix
path: /
backend:
service:
name: mediawiki
port:
number: 80
tls:
- hosts:
- mediawiki.eom.dev
secretName: mediawiki
tasks/dex.yaml
+6 -15
View File
@@ -32,6 +32,10 @@
volumeName: "data"
size: 256Gi
- name: Deploy Dex
kubernetes.core.helm:
name: dex
@@ -41,17 +45,6 @@
values:
config:
issuer: https://dex.eom.dev/
staticClients:
- id: "{{ www_dex_client_id }}"
name: WWW
secret: "{{ www_dex_client_secret }}"
redirectURIs:
- "https://www.eom.dev/members/oidc/callback/"
- id: "{{ matrix_dex_oidc_client_id }}"
name: Matrix Auth Service
secret: "{{ matrix_dex_oidc_client_secret }}"
redirectURIs:
- "https://mas.eom.dev/upstream/callback/01K96AQEZKKABW34PY3R6BVNJ4"
storage:
type: postgres
config:
@@ -69,10 +62,10 @@
config:
host: openldap.openldap.svc.cluster.local
insecureNoSSL: true
bindDN: cn=readonly,dc=eom,dc=dev
bindDN: cn=readonly,dc=example,dc=com
bindPW: "{{ openldap_readonly_password }}"
userSearch:
baseDN: dc=eom,dc=dev
baseDN: dc=example,dc=com
filter: "(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))"
username: uid
idAttr: uid
@@ -88,14 +81,12 @@
nameAttr: cn
ingress:
enabled: true
className: nginx
annotations:
cert-manager.io/cluster-issuer: ca-issuer
hosts:
- host: dex.eom.dev
paths:
- path: /
pathType: ImplementationSpecific
tls:
- hosts:
- dex.eom.dev
tasks/discourse-onion.yaml
-97
View File
@@ -1,97 +0,0 @@
---
# tasks file for discourse-onionservice
- name: onionservice for discourse
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
name: discourse
namespace: discourse
spec:
version: 3
rules:
- port:
number: 80
backend:
service:
name: discourse
port:
number: 80
- name: onionservice for gitea http
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
name: http
namespace: gitea
spec:
version: 3
rules:
- port:
number: 80
backend:
service:
name: gitea-http
port:
number: 3000
- name: onionservice for minio
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
name: minio
namespace: minio
spec:
version: 3
rules:
- port:
number: 80
backend:
service:
name: minio
port:
number: 9000
- name: onionservice for mastodon
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
name: mastodon
namespace: mastodon
spec:
version: 3
rules:
- port:
number: 80
backend:
service:
name: mastodon-apache
port:
number: 80
- name: onionservice for owncast
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
name: http
namespace: owncast
spec:
version: 3
rules:
- port:
number: 80
backend:
service:
name: owncast
port:
number: 8080
tasks/discourse.yaml
+67 -72
View File
@@ -1,76 +1,71 @@
---
# tasks file for discourse
#
# Discourse runs from an image built with the official launcher; the Bitnami
# chart stops at 3.5.0. To upgrade, change params.version in
# files/discourse/web_only.yml, then from a discourse_docker checkout:
# cp <role>/files/discourse/web_only.yml containers/web_only.yml
# launcher build --set base_image=<base_image from templates/web.template.yml>-web-only \
# --tag gitea.eom.dev/devops/discourse-web:<version> web_only --output=type=docker
# Push it, update the image tag in files/discourse/discourse-web.yaml, and re-run.
#
# Pushing through the gitea ingress needs proxy-body-size raised and
# proxy-request-buffering "off" for the push, then restored. With buffering on,
# ingress-nginx writes layers to its node's small disk; on 2026-11-08 that caused
# DiskPressure, evicted the MetalLB speaker, and took the public sites down.
#
# Redis, the secrets, the uploads PVC, the Service and the Ingress still come from
# the original Helm release, which must stay installed but is no longer upgraded.
- name: Deploy PostgreSQL 18 for Discourse
kubernetes.core.k8s:
state: present
src: "{{ role_path }}/files/discourse/postgres18.yaml"
- name: Deploy Discourse
kubernetes.core.k8s:
state: present
src: "{{ role_path }}/files/discourse/discourse-web.yaml"
wait: true
wait_condition:
type: Available
status: "True"
wait_timeout: 1800
- name: Point the Discourse Service at the launcher-built pods
kubernetes.core.k8s:
state: present
merge_type: merge
definition:
apiVersion: v1
kind: Service
metadata:
kubernetes.core.helm:
name: discourse
namespace: discourse
spec:
selector:
app.kubernetes.io/name: discourse-web
app.kubernetes.io/instance: null
- name: Find the Discourse pod
kubernetes.core.k8s_info:
kind: Pod
namespace: discourse
label_selectors:
- app.kubernetes.io/name=discourse-web
field_selectors:
- status.phase=Running
register: discourse_pods
- name: Copy the Dex sign-in / membership sign-up settings script
kubernetes.core.k8s_cp:
namespace: discourse
pod: "{{ discourse_pods.resources[0].metadata.name }}"
container: discourse
local_path: "{{ role_path }}/files/discourse-sso.rb"
remote_path: /tmp/discourse-sso.rb
- name: Apply Dex sign-in / membership sign-up settings
kubernetes.core.k8s_exec:
namespace: discourse
pod: "{{ discourse_pods.resources[0].metadata.name }}"
container: discourse
command: >-
bash -c 'cd /var/www/discourse && su discourse -c
"RAILS_ENV=production bundle exec rails runner /tmp/discourse-sso.rb"'
register: discourse_sso
changed_when: false
chart_ref: bitnami/discourse
release_namespace: discourse
create_namespace: true
values:
auth:
email: discourse@eom.dev
username: discourse_admin
password: "{{ discourse_admin_password }}"
host: "https://discourse.eom.dev"
siteName: 'Discourse'
smtp:
enabled: true
host: "postfix.eom.dev"
port: "587"
protocol: "tls"
user: "discourse"
password: "{{ discourse_admin_password }}"
image:
debug: false
service:
externalTrafficPolicy: Local
discourse:
skipInstall: false
plugins:
- https://github.com/discourse/discourse-adplugin
- https://github.com/discourse/discourse-subscriptions
- https://github.com/discourse/discourse-activity-pub
- https://github.com/discourse/discourse-openid-connect
- https://github.com/jonmbake/discourse-ldap-auth
- https://github.com/discourse/discourse-post-voting
- https://github.com/discourse/discourse-prometheus
- https://github.com/discourse/discourse-reactions
command:
- /bin/bash
args:
- -c
- |
rm -r /opt/bitnami/discourse/plugins/chat
chown -R discourse:root /opt/bitnami/discourse/plugins
/opt/bitnami/scripts/discourse/entrypoint.sh /opt/bitnami/scripts/discourse/run.sh
persistPlugins: false
compatiblePlugins: true
resourcesPreset: none
persistence:
size: 2Ti
ingress:
enabled: true
ingressClassName: "nginx"
hostname: discourse.eom.dev
annotations:
cert-manager.io/cluster-issuer: ca-issuer
nginx.ingress.kubernetes.io/proxy-set-header: "X-Forwarded-Proto $scheme"
tls: true
postgresql:
enabled: true
auth:
enablePostgresUser: true
postgresPassword: "{{ discourse_admin_password }}"
password: "{{ discourse_admin_password }}"
primary:
persistence:
size: 2Ti
redis:
enabled: true
auth:
password: "{{ discourse_admin_password }}"
tasks/fictwiki.yaml
-89
View File
@@ -1,89 +0,0 @@
---
# tasks file for mediawiki
- name: Create MediaWiki namespace
k8s:
state: present
definition:
apiVersion: v1
kind: Namespace
metadata:
name: fictwiki
- name: Deploy MariaDB
kubernetes.core.helm:
name: mariadb
chart_ref: bitnami/mariadb
release_namespace: fictwiki
values:
auth:
rootPassword: "{{ mediawiki_admin_password }}"
username: mediawiki
password: "{{ mediawiki_admin_password }}"
database: mediawiki
primary:
persistence:
size: 4Ti
- name: Create Deployment for MediaWiki
k8s:
definition:
apiVersion: v1
kind: Deployment
metadata:
name: mediawiki
namespace: fictwiki
spec:
replicas: 1
selector:
matchLabels:
app: mediawiki
template:
metadata:
labels:
app: mediawiki
spec:
containers:
- name: mediawiki
image: mediawiki
imagePullPolicy: IfNotPresent
resources:
requests:
memory: 2Gi
ports:
- containerPort: 80
- name: Create Service for MediaWiki
k8s:
definition:
apiVersion: v1
kind: Service
metadata:
name: mediawiki
namespace: fictwiki
spec:
selector:
app: mediawiki
ports:
- port: 80
name: http
type: ClusterIP
- name: Create OnionService
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
name: mediawiki
namespace: fictwiki
spec:
version: 3
rules:
- port:
number: 80
backend:
service:
name: mediawiki
port:
number: 80
tasks/full.yaml
+1
View File
@@ -32,3 +32,4 @@
include_tasks: "{{ item }}"
loop:
- prometheus.yaml
- grafana.yaml
tasks/gitea.yaml
+19 -5
View File
@@ -38,6 +38,23 @@
secretName: gitea-tls
persistence:
size: 2Ti
actions:
enabled: true
provisioning:
enabled: true
statefulset:
actRunner:
config: |
log:
level: debug
cache:
enabled: false
runner:
labels:
- "ubuntu-latest:docker://node:16-bullseye"
- "ubuntu-22.04:docker://node:16-bullseye"
- "ubuntu-20.04:docker://node:16-bullseye"
- "ubuntu-18.04:docker://node:16-buster"
gitea:
metrics:
enabled: true
@@ -62,10 +79,9 @@
APP_NAME: "Gitea"
service:
DISABLE_REGISTRATION: false
SHOW_REGISTRATION_BUTTON: true
SHOW_REGISTRATION_BUTTON: false
DEFAULT_ALLOW_CREATE_ORGANIZATION: false
ALLOW_ONLY_EXTERNAL_REGISTRATION: false
ENABLE_NOTIFY_MAIL: true
ALLOW_ONLY_EXTERNAL_REGISTRATION: true
oauth2_client:
ENABLE_AUTO_REGISTRATION: true
UPDATE_AVATAR: true
@@ -89,8 +105,6 @@
enabled: false
postgresql:
enabled: true
image:
tag: 16.4.0-debian-12-r9
global:
postgresql:
auth:
tasks/grafana-matrix-forwarder.yaml
+3 -12
View File
@@ -1,14 +1,5 @@
---
# tasks file for grafana-matrix-forwarder
- name: Create Grafana Matrix Forwarder namespace
k8s:
state: present
definition:
apiVersion: v1
kind: Namespace
metadata:
name: grafana-matrix-forwarder
- name: Create a Deployment for Grafana Matrix Forwarder
k8s:
definition:
@@ -16,7 +7,7 @@
kind: Deployment
metadata:
name: matrix-forwarder
namespace: grafana-matrix-forwarder
namespace: grafana
spec:
replicas: 1
selector:
@@ -38,7 +29,7 @@
- name: GMF_MATRIX_PASSWORD
value: "{{ grafana_admin_password }}"
- name: GMF_MATRIX_HOMESERVER
value: synapse.eom.dev
value: eom.dev
- name: GMF_RESOLVE_MODE
value: reply
@@ -49,7 +40,7 @@
kind: Service
metadata:
name: matrix-forwarder
namespace: grafana-matrix-forwarder
namespace: grafana
spec:
selector:
app: matrix-forwarder
tasks/grafana.yaml
+61
View File
@@ -0,0 +1,61 @@
---
# tasks file for grafana
- name: Deploy Grafana
kubernetes.core.helm:
name: grafana
chart_ref: bitnami/grafana
release_namespace: grafana
create_namespace: true
values:
metrics:
enabled: true
admin:
user: grafana_admin
password: "{{ grafana_admin_password }}"
persistence:
size: 64Gi
grafana:
extraEnvVars:
- name: GF_SERVER_DOMAIN
value: grafana.eom.dev
- name: GF_SERVER_ROOT_URL
value: https://grafana.eom.dev/
smtp:
enabled: true
user: grafana
password: "{{ grafana_admin_password }}"
host: mail.eom.dev:587
fromAddress: grafana@eom.dev
fromName: Grafana
ldap:
enabled: true
allowSignUp: true
configuration: "{{ lookup('template', 'ldap.toml.j2') }}"
ingress:
enabled: true
pathType: Prefix
hostname: grafana.eom.dev
annotations:
cert-manager.io/cluster-issuer: ca-issuer
ingressClassName: nginx
tls: true
datasources:
secretDefinition:
apiVersion: 1
datasources:
- name: Prometheus
type: prometheus
access: proxy
orgId: 1
url: http://prometheus-server.prometheus.svc.cluster.local
version: 1
editable: true
isDefault: true
- name: Alertmanager
uid: alertmanager
type: alertmanager
access: proxy
orgId: 1
url: http://prometheus-alertmanager.prometheus.svc.cluster.local
version: 1
editable: true
tasks/localai.yaml
+2 -25
View File
@@ -17,21 +17,12 @@
release_namespace: localai
create_namespace: true
values:
service:
type: LoadBalancer
deployment:
image:
tag: latest-gpu-nvidia-cuda-12
runtimeClassName: nvidia
secretEnv:
- name: LOCALAI_DISABLE_WEBUI
value: "true"
- name: LOCALAI_API_KEY
value: "{{ localai_api_keys | join(',') }}"
- name: LOCALAI_WATCHDOG_IDLE
value: "true"
- name: LOCALAI_WATCHDOG_IDLE_TIMEOUT
value: "5m"
- name: LOCALAI_WATCHDOG_BUSY
value: "true"
resources:
limits:
nvidia.com/gpu: 1
@@ -45,17 +36,3 @@
operator: Equal
value: GPU
effect: NoSchedule
ingress:
enabled: true
className: nginx
annotations:
cert-manager.io/cluster-issuer: ca-issuer
hosts:
- host: localai.eom.dev
paths:
- path: /
pathType: ImplementationSpecific
tls:
- secretName: localai-tls
hosts:
- localai.eom.dev
tasks/mail.yaml
+7 -85
View File
@@ -90,38 +90,6 @@
requests:
storage: 2Ti
- name: Create a ConfigMap for encryption
k8s:
state: present
definition:
apiVersion: v1
kind: ConfigMap
metadata:
name: certs
namespace: mail
data:
privkey.pem: "{{ mail_encryption_privkey }}"
pubkey.pem: "{{ mail_encryption_pubkey }}"
- name: Create a ConfigMap for Dovecot
k8s:
state: present
definition:
apiVersion: v1
kind: ConfigMap
metadata:
name: dovecot
namespace: mail
data:
10-encryption.conf: |
# Enables mail_crypt for all services (pop3, pop3, etc)
mail_plugins = $mail_plugins mail_crypt
plugin {
mail_crypt_global_private_key = </certs/privkey.pem
mail_crypt_global_public_key = </certs/pubkey.pem
mail_crypt_save_version = 2
}
- name: Create a deployment
k8s:
definition:
@@ -142,7 +110,7 @@
spec:
containers:
- name: mail
image: mailserver/docker-mailserver:15.1.0 # pinned: v17 renamed LDAP env vars and breaks this config
image: mailserver/docker-mailserver
securityContext:
# `allowPrivilegeEscalation: true` is required to support SGID via the `postdrop`
# executable in `/var/mail-state` for Postfix (maildrop + public dirs):
@@ -173,13 +141,8 @@
seccompProfile:
type: RuntimeDefault
volumeMounts:
- name: certs
mountPath: /certs
- name: config
mountPath: /tmp/docker-mailserver
- name: dovecot
mountPath: /etc/dovecot/conf.d/10-encryption.conf
subPath: 10-encryption.conf
- name: ssl
mountPath: /etc/letsencrypt
- name: mail
@@ -188,8 +151,6 @@
mountPath: /tmp/docker-mailserver/opendkim
ports:
- containerPort: 25
- containerPort: 110
- containerPort: 143
- containerPort: 465
- containerPort: 587
- containerPort: 993
@@ -212,8 +173,7 @@
- name: LDAP_BIND_PW
value: "{{ openldap_readonly_password }}"
- name: LDAP_QUERY_FILTER_DOMAIN
# Only mailbox users define local domains; member accounts carry external addresses (e.g. @gmail.com).
value: "(&(mail=*@%s)(memberOf=cn=Postfix Users,ou=Postfix,ou=Services,dc=eom,dc=dev))"
value: "(mail=*@%s)"
- name: LDAP_QUERY_FILTER_USER
value: "(&(mail=%s)(memberOf=cn=Postfix Users,ou=Postfix,ou=Services,dc=eom,dc=dev))"
- name: LDAP_QUERY_FILTER_ALIAS
@@ -222,14 +182,6 @@
value: "(&(objectClass=posixAccount)(mailGroupMember=%s))"
- name: LDAP_QUERY_FILTER_SENDERS
value: "(&(objectClass=posixAccount)(|(mail=%s)(mailAlias=%s)(mailGroupMember=%s)))"
# Outbound relay (Amazon SES): residential IPs are refused by Gmail et al.
# Leave mail_relay_host unset to deliver directly.
- name: DEFAULT_RELAY_HOST
value: "{{ mail_relay_host | default('') }}"
- name: RELAY_USER
value: "{{ mail_relay_user | default('') }}"
- name: RELAY_PASSWORD
value: "{{ mail_relay_password | default('') }}"
- name: SPOOF_PROTECTION
value: "1"
- name: DOVECOT_AUTH_BIND
@@ -255,9 +207,6 @@
- name: SSL_KEY_PATH
value: "/etc/letsencrypt/tls.key"
volumes:
- name: certs
configMap:
name: certs
- name: ssl
secret:
secretName: mail
@@ -270,9 +219,6 @@
- name: dkim
persistentVolumeClaim:
claimName: dkim
- name: dovecot
configMap:
name: dovecot
- name: Expose deployment as a service
k8s:
@@ -287,38 +233,14 @@
app: mail
ports:
- port: 25
name: smtp
- port: 110
name: pop3
- port: 143
name: imap
name: smtp-a
- port: 465
name: esmtps
name: smtp-b
- port: 587
name: esmtp
name: smtps
- port: 993
name: imaps
name: imap
- port: 995
name: pop3s
name: pop3
type: LoadBalancer
externalTrafficPolicy: Local
- name: onionservice for smtp
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
name: smtp
namespace: mail
spec:
version: 3
rules:
- port:
number: 25
backend:
service:
name: mail
port:
number: 25
tasks/main.yaml
+1 -1
View File
@@ -3,4 +3,4 @@
- name: Deploy
include_tasks: "{{ item }}"
loop:
- dex.yaml
- nextcloud.yaml
tasks/mediawiki.yaml
+66 -59
View File
@@ -24,22 +24,6 @@
persistence:
size: 4Ti
- name: Create a persistent volume claim for MediaWiki
k8s:
state: present
definition:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mediawiki
namespace: mediawiki
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 32Gi
- name: Create Deployment for MediaWiki
k8s:
definition:
@@ -60,20 +44,62 @@
spec:
containers:
- name: mediawiki
image: mediawiki
image: ericomeehan/mediawiki-extended
imagePullPolicy: IfNotPresent
resources:
requests:
memory: 2Gi
env:
- name: WIKI_NAME
value: MediaWiki
- name: WIKI_ADMIN
value: mediawiki_admin
- name: WIKI_ADMIN_PASS
value: "{{ mediawiki_admin_password }}"
- name: WIKI_LANG
value: en
- name: WIKI_URL
value: https://mediawiki.eom.dev/
- name: DB_HOST
value: mariadb
- name: DB_PORT
value: "3306"
- name: DB_NAME
value: mediawiki
- name: DB_USER
value: mediawiki
- name: DB_PASS
value: "{{ mediawiki_admin_password }}"
- name: LDAP_BASE
value: dc=eom,dc=dev
- name: LDAP_SERVER_NAME
value: openldap.openldap.svc.cluster.local
- name: LDAP_SERVER_PORT
value: "389"
- name: LDAP_DOMAINNAME
value: openldap.openldap.svc.cluster.local
- name: LDAP_ENCTYPE
value: clear
- name: LDAP_USER_ATTR
value: uid
- name: LDAP_REAL_NAME_ATTR
value: cn
- name: LDAP_MAIL_ATTR
value: mail
- name: LDAP_BIND_USER
value: cn=readonly,dc=eom,dc=dev
- name: LDAP_BIND_PASS
value: "{{ openldap_readonly_password }}"
- name: LDAP_BUREAUCRAT_GROUP
value: cn=Mediawiki Bureaucrats,ou=MediaWiki,ou=Services,dc=eom,dc=dev
- name: LDAP_INTERFACE_ADMIN_GROUP
value: cn=Mediawiki Interface Administrators,ou=MediaWiki,ou=Services,dc=eom,dc=dev
- name: LDAP_SYSOP_GROUP
value: cn=Mediawiki Sysops,ou=MediaWiki,ou=Services,dc=eom,dc=dev
- name: LDAP_SEARCH_FILTER
value: (&(objectClass=posixAccount)(uid=%1$s)(memberOf=cn=Mediawiki Users,ou=MediaWiki,ou=Services,dc=eom,dc=dev))
ports:
- containerPort: 80
volumemounts:
- name: mediawiki
mountpath: /var/www/html
volumes:
- name: mediawiki
persistentVolumeClaim:
claimName: mediawiki
- name: Create Service for MediaWiki
k8s:
@@ -91,50 +117,31 @@
name: http
type: ClusterIP
- name: Create OnionService
- name: Create Ingress
k8s:
state: present
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
cert-manager.io/cluster-issuer: ca-issuer
name: mediawiki
namespace: mediawiki
spec:
version: 3
ingressClassName: nginx
rules:
- port:
number: 80
- host: mediawiki.eom.dev
http:
paths:
- pathType: Prefix
path: /
backend:
service:
name: mediawiki
port:
number: 80
#- name: Create Ingress
# k8s:
# state: present
# definition:
# apiVersion: networking.k8s.io/v1
# kind: Ingress
# metadata:
# annotations:
# cert-manager.io/cluster-issuer: ca-issuer
# name: mediawiki
# namespace: mediawiki
# spec:
# ingressClassName: nginx
# rules:
# - host: mediawiki.eom.dev
# http:
# paths:
# - pathType: Prefix
# path: /
# backend:
# service:
# name: mediawiki
# port:
# number: 80
# tls:
# - hosts:
# - mediawiki.eom.dev
# secretName: mediawiki
tls:
- hosts:
- mediawiki.eom.dev
secretName: mediawiki
tasks/meidawiki-extended.yaml
-147
View File
@@ -1,147 +0,0 @@
---
# tasks file for mediawiki
- name: Create MediaWiki namespace
k8s:
state: present
definition:
apiVersion: v1
kind: Namespace
metadata:
name: mediawiki
- name: Deploy MariaDB
kubernetes.core.helm:
name: mariadb
chart_ref: bitnami/mariadb
release_namespace: mediawiki
values:
auth:
rootPassword: "{{ mediawiki_admin_password }}"
username: mediawiki
password: "{{ mediawiki_admin_password }}"
database: mediawiki
primary:
persistence:
size: 4Ti
- name: Create Deployment for MediaWiki
k8s:
definition:
apiVersion: v1
kind: Deployment
metadata:
name: mediawiki
namespace: mediawiki
spec:
replicas: 1
selector:
matchLabels:
app: mediawiki
template:
metadata:
labels:
app: mediawiki
spec:
containers:
- name: mediawiki
image: ericomeehan/mediawiki-extended
imagePullPolicy: IfNotPresent
resources:
requests:
memory: 2Gi
env:
- name: WIKI_NAME
value: MediaWiki
- name: WIKI_ADMIN
value: mediawiki_admin
- name: WIKI_ADMIN_PASS
value: "{{ mediawiki_admin_password }}"
- name: WIKI_LANG
value: en
- name: WIKI_URL
value: https://mediawiki.eom.dev/
- name: DB_HOST
value: mariadb
- name: DB_PORT
value: "3306"
- name: DB_NAME
value: mediawiki
- name: DB_USER
value: mediawiki
- name: DB_PASS
value: "{{ mediawiki_admin_password }}"
- name: LDAP_BASE
value: dc=eom,dc=dev
- name: LDAP_SERVER_NAME
value: openldap.openldap.svc.cluster.local
- name: LDAP_SERVER_PORT
value: "389"
- name: LDAP_DOMAINNAME
value: openldap.openldap.svc.cluster.local
- name: LDAP_ENCTYPE
value: clear
- name: LDAP_USER_ATTR
value: uid
- name: LDAP_REAL_NAME_ATTR
value: cn
- name: LDAP_MAIL_ATTR
value: mail
- name: LDAP_BIND_USER
value: cn=readonly,dc=eom,dc=dev
- name: LDAP_BIND_PASS
value: "{{ openldap_readonly_password }}"
- name: LDAP_BUREAUCRAT_GROUP
value: cn=Mediawiki Bureaucrats,ou=MediaWiki,ou=Services,dc=eom,dc=dev
- name: LDAP_INTERFACE_ADMIN_GROUP
value: cn=Mediawiki Interface Administrators,ou=MediaWiki,ou=Services,dc=eom,dc=dev
- name: LDAP_SYSOP_GROUP
value: cn=Mediawiki Sysops,ou=MediaWiki,ou=Services,dc=eom,dc=dev
- name: LDAP_SEARCH_FILTER
value: (&(objectClass=posixAccount)(uid=%1$s)(memberOf=cn=Mediawiki Users,ou=MediaWiki,ou=Services,dc=eom,dc=dev))
ports:
- containerPort: 80
- name: Create Service for MediaWiki
k8s:
definition:
apiVersion: v1
kind: Service
metadata:
name: mediawiki
namespace: mediawiki
spec:
selector:
app: mediawiki
ports:
- port: 80
name: http
type: ClusterIP
- name: Create Ingress
k8s:
state: present
definition:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
cert-manager.io/cluster-issuer: ca-issuer
name: mediawiki
namespace: mediawiki
spec:
ingressClassName: nginx
rules:
- host: mediawiki.eom.dev
http:
paths:
- pathType: Prefix
path: /
backend:
service:
name: mediawiki
port:
number: 80
tls:
- hosts:
- mediawiki.eom.dev
secretName: mediawiki
tasks/minio.yaml
+6 -7
View File
@@ -7,17 +7,13 @@
release_namespace: minio
create_namespace: true
values:
image:
repository: bitnamilegacy/minio
metrics:
enabled: true
console:
enabled: false
disableWebUI: true
auth:
rootUser: minio_admin
rootPassword: "{{ minio_admin_password }}"
defaultBuckets: default
defaultInitContainers:
volumePermissions:
enabled: true
mode: standalone
@@ -50,10 +46,13 @@
value: OpenLDAP
- name: MINIO_IDENTITY_LDAP_SERVER_INSECURE
value: "on"
ingress:
apiIngress:
enabled: true
hostname: minio.eom.dev
ingressClassName: nginx
annotations:
cert-manager.io/cluster-issuer: ca-issuer
tls: true
tls:
- hosts:
- minio.eom.dev
secretName: minio-tls
tasks/monero-hidden.yaml
-328
View File
@@ -1,328 +0,0 @@
---
# tasks file for monero
- name: Create Monero namespace
k8s:
state: present
definition:
apiVersion: v1
kind: Namespace
metadata:
name: monero
- name: Create PVC for Monero
k8s:
state: present
definition:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: data
namespace: monero
spec:
storageClassName: r720-nfs-client
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 512Gi
- name: Create PVC for P2Pool
k8s:
state: present
definition:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: p2pool
namespace: monero
spec:
storageClassName: r720-nfs-client
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 64Gi
- name: Create a Tor instance for Monerod
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: Tor
metadata:
name: tor
namespace: monero
- name: Create Deployment for Monerod
when: setup
k8s:
definition:
apiVersion: v1
kind: Deployment
metadata:
name: monerod
namespace: monero
spec:
replicas: 1
selector:
matchLabels:
app: monerod
template:
metadata:
labels:
app: monerod
spec:
containers:
- name: monerod
image: nginx
imagePullPolicy: IfNotPresent
resources:
requests:
memory: 2Gi
ports:
- containerPort: 18080
- containerPort: 18081
- containerPort: 18083
- containerPort: 18084
volumeMounts:
- name: data
mountPath: /data
- name: p2pool
image: nginx
imagePullPolicy: IfNotPresent
ports:
- containerPort: 3333
- containerPort: 37889
volumes:
- name: data
persistentVolumeClaim:
claimName: data
- name: Create Service for Monero
k8s:
definition:
apiVersion: v1
kind: Service
metadata:
name: monerod
namespace: monero
spec:
selector:
app: monerod
ports:
- port: 18080
name: p2p
- port: 18081
name: rpc
- port: 18083
name: zmq
- port: 18084
name: anonp2p
type: ClusterIP
- name: Create Service for P2Pool
k8s:
definition:
apiVersion: v1
kind: Service
metadata:
name: p2pool
namespace: monero
spec:
selector:
app: p2pool
ports:
- port: 3333
name: mine
- port: 37889
name: p2p
type: LoadBalancer
- name: Create OnionService
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
name: rpc
namespace: monero
spec:
version: 3
rules:
- port:
number: 18081
backend:
service:
name: monerod
port:
number: 18081
- name: Create OnionService
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
name: p2p
namespace: monero
spec:
version: 3
rules:
- port:
number: 18084
backend:
service:
name: monerod
port:
number: 18084
- name: Create OnionService
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
name: mining
namespace: monero
spec:
version: 3
rules:
- port:
number: 3333
backend:
service:
name: p2pool
port:
number: 3333
- name: Create OnionService
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
name: p2poolp2p
namespace: monero
spec:
version: 3
rules:
- port:
number: 37889
backend:
service:
name: p2pool
port:
number: 37889
- name: Get p2p OnionService info
kubernetes.core.k8s_info:
api_version: tor.k8s.torproject.org/v1alpha2
kind: OnionService
namespace: monero
field_selectors:
- metadata.name=p2p
register: p2p_onionservice
- name: Get p2pool OnionService info
kubernetes.core.k8s_info:
api_version: tor.k8s.torproject.org/v1alpha2
kind: OnionService
namespace: monero
field_selectors:
- metadata.name=p2poolp2p
register: p2pool_onionservice
- name: Get Tor Service info
kubernetes.core.k8s_info:
api_version: v1
kind: Service
namespace: monero
field_selectors:
- metadata.name=tor-tor-svc
register: tor_svc
- name: Edit Deployment for Monerod
k8s:
definition:
apiVersion: v1
kind: Deployment
metadata:
name: monerod
namespace: monero
spec:
replicas: 1
selector:
matchLabels:
app: monerod
template:
metadata:
labels:
app: monerod
spec:
containers:
- name: monerod
image: ericomeehan/monerod:latest
imagePullPolicy: Always
command:
- monerod
args:
- "--proxy={{ tor_svc.resources[0].spec.clusterIP }}:9050"
- "--p2p-bind-ip=0.0.0.0"
- "--p2p-bind-port=18080"
- "--rpc-bind-ip=0.0.0.0"
- "--rpc-bind-port=18081"
- "--tx-proxy=tor,{{ tor_svc.resources[0].spec.clusterIP }}:9050"
- "--anonymous-inbound={{ p2p_onionservice.resources[0].status.hostname }}:18084,0.0.0.0:18084"
- "--data-dir=/data"
- "--zmq-pub=tcp://127.0.0.1:18083"
- "--non-interactive"
- "--no-igd"
- "--confirm-external-bind"
resources:
requests:
memory: 2Gi
ports:
- containerPort: 18080
- containerPort: 18081
- containerPort: 18083
- containerPort: 18084
volumeMounts:
- name: monerod
mountPath: /data
- name: p2pool
image: ericomeehan/p2pool:latest
imagePullPolicy: IfNotPresent
command:
- p2pool
args:
- "--host"
- "127.0.0.1"
- "--rpc-port"
- "18081"
- "--wallet"
- "{{ monero_p2pool_wallet_address }}"
- "--stratum"
- "0.0.0.0:3333"
- "--p2p"
- "0.0.0.0:37889"
- "--addpeers"
- "65.21.227.114:37889"
- "--socks5"
- "{{ tor_svc.resources[0].spec.clusterIP }}:9050"
- "--no-dns"
- "--no-upnp"
- "--onion-address"
- "{{ p2pool_onionservice.resources[0].status.hostname }}"
ports:
- containerPort: 3333
- containerPort: 37889
volumeMounts:
- name: p2pool
mountPath: /home/p2pool
volumes:
- name: monerod
persistentVolumeClaim:
claimName: data
- name: p2pool
persistentVolumeClaim:
claimName: p2pool
tasks/monero.yaml
-264
View File
@@ -1,264 +0,0 @@
---
# tasks file for monero
- name: Create Monero namespace
k8s:
state: present
definition:
apiVersion: v1
kind: Namespace
metadata:
name: monero
- name: Create PVC for Monero
k8s:
state: present
definition:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: data
namespace: monero
spec:
storageClassName: r720-nfs-client
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 512Gi
- name: Create PVC for P2Pool
k8s:
state: present
definition:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: p2pool
namespace: monero
spec:
storageClassName: r720-nfs-client
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 64Gi
- name: Request a certificate for Monero
k8s:
state: present
definition:
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: monerotls
namespace: monero
spec:
secretName: monerotls
privateKey:
algorithm: RSA
encoding: PKCS1
size: 2048
duration: 2160h # 90d
renewBefore: 360h # 15d
isCA: false
usages:
- server auth
- client auth
subject:
organizations:
- EOM
commonName: monerod.eom.dev
dnsNames:
- monerod.eom.dev
issuerRef:
name: ca-issuer
kind: ClusterIssuer
- name: Request a certificate for p2pool
k8s:
state: present
definition:
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: tls
namespace: monero
spec:
secretName: tls
privateKey:
algorithm: RSA
encoding: PKCS1
size: 2048
duration: 2160h # 90d
renewBefore: 360h # 15d
isCA: false
usages:
- server auth
- client auth
subject:
organizations:
- EOM
commonName: p2pool.eom.dev
dnsNames:
- p2pool.eom.dev
issuerRef:
name: ca-issuer
kind: ClusterIssuer
- name: Edit Deployment for Monerod
k8s:
definition:
apiVersion: v1
kind: Deployment
metadata:
name: monerod
namespace: monero
spec:
replicas: 1
selector:
matchLabels:
app: monerod
template:
metadata:
labels:
app: monerod
spec:
containers:
- name: monerod
image: ericomeehan/monerod:latest
imagePullPolicy: Always
command:
- monerod
args:
- "--p2p-bind-ip=0.0.0.0"
- "--p2p-bind-port=18080"
- "--rpc-bind-ip=0.0.0.0"
- "--rpc-bind-port=18081"
- "--restricted-rpc"
- "--rpc-login={{ monerod_user }}:{{ monerod_password }}"
- "--data-dir=/data"
- "--zmq-pub=tcp://127.0.0.1:18083"
- "--rpc-ssl=enabled"
- "--rpc-ssl-private-key=/etc/letsencrypt/tls.key"
- "--rpc-ssl-certificate=/etc/letsencrypt/tls.crt"
- "--non-interactive"
- "--no-igd"
- "--confirm-external-bind"
- "--bootstrap-daemon-address=auto"
resources:
requests:
memory: 2Gi
ports:
- containerPort: 18080
- containerPort: 18081
- containerPort: 18083
volumeMounts:
- name: monerod
mountPath: /data
- name: monerotls
mountPath: /etc/letsencrypt
volumes:
- name: monerod
persistentVolumeClaim:
claimName: data
- name: monerotls
secret:
secretName: monerotls
- name: deploy p2pool
k8s:
definition:
apiVersion: v1
kind: Deployment
metadata:
name: p2pool
namespace: monero
spec:
replicas: 1
selector:
matchLabels:
app: p2pool
template:
metadata:
labels:
app: p2pool
spec:
containers:
- name: p2pool
image: ericomeehan/p2pool:latest
imagePullPolicy: IfNotPresent
command:
- p2pool
args:
- "--host"
- "monerod"
- "--rpc-port"
- "18081"
- "--wallet"
- "{{ monero_p2pool_wallet_address }}"
- "--stratum"
- "0.0.0.0:3333"
- "--p2p"
- "0.0.0.0:37889"
- "--addpeers"
- "65.21.227.114:37889"
- "--tls-cert"
- "/etc/letsencrypt/tls.crt"
- "--tls-cert-key"
- "/etc/letsencrypt/tls.key"
- "--rpc-ssl"
- "--rpc-login={{ monerod_user }}:{{ monerod_password }}"
ports:
- containerPort: 3333
- containerPort: 37889
volumeMounts:
- name: p2pool
mountPath: /home/p2pool
- name: tls
mountPath: /etc/letsencrypt
volumes:
- name: p2pool
persistentVolumeClaim:
claimName: p2pool
- name: tls
secret:
secretName: tls
- name: monero service
k8s:
definition:
apiVersion: v1
kind: Service
metadata:
name: monerod
namespace: monero
spec:
selector:
app: monerod
ports:
- port: 18080
name: p2p
- port: 18081
name: rpc
- port: 18083
name: zmq
type: LoadBalancer
- name: p2pool service
k8s:
definition:
apiVersion: v1
kind: Service
metadata:
name: p2pool
namespace: monero
spec:
selector:
app: p2pool
ports:
- port: 3333
name: mine
- port: 37889
name: p2poolp2p
type: LoadBalancer
tasks/openldap.yaml
-34
View File
@@ -41,36 +41,6 @@
requests:
storage: 32Gi
- name: Request a certificate for OpenLDAP
k8s:
state: present
definition:
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: openldap
namespace: openldap
spec:
secretName: openldap
privateKey:
algorithm: RSA
encoding: PKCS1
size: 2048
duration: 2160h # 90d
renewBefore: 360h # 15d
isCA: false
usages:
- server auth
- client auth
subject:
organizations:
- EOM
dnsNames:
- openldap.eom.dev
issuerRef:
name: ca-issuer
kind: ClusterIssuer
- name: Create Deployment for OpenLDAP
k8s:
definition:
@@ -105,10 +75,6 @@
value: "{{ openldap_readonly_password }}"
- name: LDAP_TLS_VERIFY_CLIENT
value: never
- name: LDAP_TLS_CRT_FILENAME
value: tls.crt
- name: LDAP_TLS_KEY_FILENAME
value: tls.key
volumeMounts:
- name: config
mountPath: /etc/ldap/slapd.d
tasks/owncast.yaml
+1 -5
View File
@@ -48,10 +48,7 @@
spec:
containers:
- name: owncast
image: owncast/owncast:0.3.0
resources:
requests:
cpu: 1.5
image: owncast/owncast:0.2.0
volumeMounts:
- name: data
mountPath: /app/data
@@ -81,7 +78,6 @@
name: rtmp
- port: 8080
name: http
externalTrafficPolicy: Local
type: LoadBalancer
- name: Create Ingress
tasks/p2pool.yaml
-191
View File
@@ -1,191 +0,0 @@
---
# tasks file for monero
- name: Create P2Pool namespace
k8s:
state: present
definition:
apiVersion: v1
kind: Namespace
metadata:
name: p2pool
- name: Create PVC for P2Pool
k8s:
state: present
definition:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: data
namespace: p2pool
spec:
storageClassName: r720-nfs-client
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 64Gi
- name: Create a Tor instance for P2Poold
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: Tor
metadata:
name: tor
namespace: p2pool
- name: Create Deployment for P2Poold
k8s:
definition:
apiVersion: v1
kind: Deployment
metadata:
name: p2pool
namespace: p2pool
spec:
replicas: 1
selector:
matchLabels:
app: p2pool
template:
metadata:
labels:
app: p2pool
spec:
containers:
- name: p2pool
image: nginx
imagePullPolicy: IfNotPresent
ports:
- containerPort: 3333
- containerPort: 37889
- name: Create Service for P2Pool
k8s:
definition:
apiVersion: v1
kind: Service
metadata:
name: p2pool
namespace: p2pool
spec:
selector:
app: p2pool
ports:
- port: 3333
name: mine
- port: 37889
name: p2p
type: ClusterIP
- name: Create OnionService for mining
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
name: mining
namespace: p2pool
spec:
version: 3
rules:
- port:
number: 3333
backend:
service:
name: p2pool
port:
number: 3333
- name: Create OnionService for P2P
k8s:
definition:
apiVersion: tor.k8s.torproject.org/v1alpha2
kind: OnionService
metadata:
name: p2p
namespace: p2pool
spec:
version: 3
rules:
- port:
number: 28722
backend:
service:
name: p2pool
port:
number: 37889
- name: Get Tor Service info
kubernetes.core.k8s_info:
api_version: v1
kind: Service
namespace: p2pool
field_selectors:
- metadata.name=tor-tor-svc
register: tor_svc
- name: Get p2pool OnionService info
kubernetes.core.k8s_info:
api_version: tor.k8s.torproject.org/v1alpha2
kind: OnionService
namespace: p2pool
field_selectors:
- metadata.name=p2p
register: p2pool_onionservice
- name: Edit Deployment for P2Poold
k8s:
definition:
apiVersion: v1
kind: Deployment
metadata:
name: p2pool
namespace: p2pool
spec:
replicas: 1
selector:
matchLabels:
app: p2pool
template:
metadata:
labels:
app: p2pool
spec:
containers:
- name: p2pool
image: ericomeehan/p2pool:latest
imagePullPolicy: IfNotPresent
command:
- p2pool
args:
- "--host"
- "{{ monero_p2pool_hostname }}"
- "--rpc-port"
- "18081"
- "--wallet"
- "{{ monero_p2pool_wallet_address }}"
- "--stratum"
- "0.0.0.0:3333"
- "--p2p"
- "0.0.0.0:37889"
- "--addpeers"
- "65.21.227.114:37889"
- "--socks5"
- "{{ tor_svc.resources[0].spec.clusterIP }}:9050"
- "--no-dns"
- "--no-upnp"
- "--onion-address"
- "{{ p2pool_onionservice.resources[0].status.hostname }}"
ports:
- containerPort: 3333
- containerPort: 37889
volumeMounts:
- name: data
mountPath: /home/p2pool
volumes:
- name: data
persistentVolumeClaim:
claimName: data
tasks/prometheus.yaml
+37 -69
View File
@@ -7,142 +7,110 @@
release_namespace: prometheus
create_namespace: true
values:
alertmanager:
image:
repository: bitnamilegacy/alertmanager
tag: 0.28.1-debian-12-r15
server:
image:
repository: bitnamilegacy/prometheus
tag: 3.5.0-debian-12-r3
resourcesPreset: none
resources:
requests:
cpu: 250m
memory: 1Gi
limits:
cpu: 1
memory: 2Gi
persistence:
size: 256Gi
extraScrapeConfigs:
- job_name: local
- job_name: apps
static_configs:
- targets:
- discourse.eom.dev
labels:
instance: discourse
- targets:
- gitea.eom.dev
labels:
instance: gitea
- targets:
- grafana.eom.dev
labels:
instance: grafana
metrics_path: /metrics
- job_name: nextcloud
static_configs:
- targets:
- nextcloud-metrics.nextcloud.svc.cluster.local:9205
labels:
instance: nextcloud
- targets:
- ingress-nginx-controller-metrics.ingress-nginx.svc.cluster.local:10254
- job_name: www
static_configs:
- targets:
- prometheus.www.svc.cluster.local:9117
- matrix-synapse.matrix.svc.cluster.local:9092
labels:
instance: www
metrics_path: /metrics
instance: matrix
metrics_path: /
- job_name: libvirt_exporter
static_configs:
- targets:
- poweredge-t640:9177
- 192.168.1.48:9177
labels:
instance: poweredge-t640
- targets:
- poweredge-r720:9177
labels:
instance: poweredge-r720
metrics_path: /metrics
- job_name: node_exporter
static_configs:
- targets:
- poweredge-r350:9100
- 192.168.1.95:9100
labels:
instance: poweredge-r350
- targets:
- poweredge-t640:9100
- 192.168.1.48:9100
labels:
instance: poweredge-t640
- targets:
- poweredge-r720:9100
labels:
instance: poweredge-r720
- targets:
- alpha-control-plane:9100
- 192.168.1.59:9100
labels:
instance: alpha-control-plane
- targets:
- alpha-worker-0:9100
- 192.168.1.91:9100
labels:
instance: alpha-worker-0
- targets:
- alpha-worker-1:9100
- 192.168.1.70:9100
labels:
instance: alpha-worker-1
- targets:
- alpha-worker-2:9100
- 192.168.1.74:9100
labels:
instance: alpha-worker-2
- targets:
- alpha-worker-3:9100
- 192.168.1.75:9100
labels:
instance: alpha-worker-3
- targets:
- alpha-worker-4:9100
- 192.168.1.61:9100
labels:
instance: alpha-worker-4
- targets:
- alpha-worker-5:9100
- 192.168.1.66:9100
labels:
instance: alpha-worker-5
- targets:
- alpha-worker-6:9100
- 192.168.1.38:9100
labels:
instance: alpha-worker-6
- targets:
- alpha-worker-7:9100
- 192.168.1.92:9100
labels:
instance: alpha-worker-7
- targets:
- alpha-worker-8:9100
- 192.168.1.67:9100
labels:
instance: alpha-worker-8
- targets:
- alpha-worker-9:9100
- 192.168.1.63:9100
labels:
instance: alpha-worker-9
- targets:
- alpha-worker-10:9100
- 192.168.1.86:9100
labels:
instance: alpha-worker-10
- targets:
- alpha-worker-11:9100
- 192.168.1.65:9100
labels:
instance: alpha-worker-11
- targets:
- alpha-worker-12:9100
- 192.168.1.72:9100
labels:
instance: alpha-worker-12
- targets:
- alpha-worker-13:9100
labels:
instance: alpha-worker-13
- targets:
- alpha-worker-14:9100
labels:
instance: alpha-worker-14
- targets:
- alpha-worker-15:9100
labels:
instance: alpha-worker-15
- targets:
- alpha-worker-16:9100
labels:
instance: alpha-worker-16
- targets:
- alpha-worker-17:9100
labels:
instance: alpha-worker-17
metrics_path: /metrics
tasks/tes3mp.yaml
+4 -27
View File
@@ -16,7 +16,7 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: data
name: config
namespace: tes3mp
spec:
accessModes:
@@ -25,18 +25,6 @@
requests:
storage: 16Gi
- name: Create a config map
k8s:
state: present
definition:
apiVersion: v1
kind: ConfigMap
metadata:
name: config
namespace: tes3mp
data:
tes3mp-server-default.cfg: "{{ lookup('template', 'tes3mp-server-default.cfg.j2') }}"
- name: Create a deployment
k8s:
definition:
@@ -57,32 +45,21 @@
spec:
containers:
- name: tes3mp
image: tes3mp/server:0.7.0
imagePullPolicy: Always
image: tes3mp/server
volumeMounts:
- name: data
mountPath: /server/data
- name: config
mountPath: /server/tes3mp-server-default.cfg
subPath: tes3mp-server-default.cfg
ports:
- containerPort: 25565
env:
- name: TES3MP_SERVER_GENERAL_HOSTNAME
value: tes3.eom.dev
- name: TES3MP_SERVER_GENERAL_PASSWORD
value: "{{ tes3mp_server_general_password }}"
command:
- "./tes3mp-server"
args:
- "$@"
value: "{{ tes3mp_password }}"
volumes:
- name: data
persistentVolumeClaim:
claimName: data
- name: config
configMap:
name: config
- name: Expose deployment as a service
k8s:
@@ -96,7 +73,7 @@
selector:
app: tes3mp
ports:
- port: 25565
- port: 25566
targetPort: 25565
name: tes3mp
protocol: UDP
templates/ldap.toml.j2
+69
View File
@@ -0,0 +1,69 @@
[[servers]]
# Ldap server host (specify multiple hosts space separated)
host = "openldap.openldap.svc.cluster.local"
# Default port is 389 or 636 if use_ssl = true
port = 389
# Set to true if LDAP server should use an encrypted TLS connection (either with STARTTLS or LDAPS)
use_ssl = false
# If set to true, use LDAP with STARTTLS instead of LDAPS
start_tls = false
# The value of an accepted TLS cipher. By default, this value is empty. Example value: ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"])
# For a complete list of supported ciphers and TLS versions, refer to: https://go.dev/src/crypto/tls/cipher_suites.go
# Starting with Grafana v11.0 only ciphers with ECDHE support are accepted for TLS 1.2 connections.
tls_ciphers = []
# This is the minimum TLS version allowed. By default, this value is empty. Accepted values are: TLS1.1 (only for Grafana v10.4 or earlier), TLS1.2, TLS1.3.
min_tls_version = ""
# set to true if you want to skip SSL cert validation
ssl_skip_verify = false
# set to the path to your root CA certificate or leave unset to use system defaults
# root_ca_cert = "/path/to/certificate.crt"
# Authentication against LDAP servers requiring client certificates
# client_cert = "/path/to/client.crt"
# client_key = "/path/to/client.key"
# Search user bind dn
bind_dn = "cn=readonly,dc=eom,dc=dev"
# Search user bind password
# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
bind_password = "{{ openldap_readonly_password }}"
# We recommend using variable expansion for the bind_password, for more info https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#variable-expansion
# bind_password = '$__env{LDAP_BIND_PASSWORD}'
# Timeout in seconds. Applies to each host specified in the 'host' entry (space separated).
timeout = 30
# User search filter, for example "(cn=%s)" or "(sAMAccountName=%s)" or "(uid=%s)"
# Allow login from email or username, example "(|(sAMAccountName=%s)(userPrincipalName=%s))"
search_filter = "(&(objectClass=posixAccount)(uid=%s)(memberOf=cn=Grafana Users,ou=Grafana,ou=Services,dc=eom,dc=dev))"
# An array of base dns to search through
search_base_dns = ["dc=eom,dc=dev"]
# Specify names of the LDAP attributes your LDAP uses
[servers.attributes]
username = "uid"
email = "mail"
name = "givenName"
surname = "sn"
member_of = "memberOf"
[[servers.group_mappings]]
group_dn = "cn=Grafana Administrators,ou=Grafana,ou=Services,dc=eom,dc=dev"
org_id = 1
org_role = "Admin"
grafana_admin = true
[[servers.group_mappings]]
group_dn = "cn=Grafana Users,ou=Grafana,ou=Services,dc=eom,dc=dev"
org_id = 1
org_role = "Viewer"
[[servers.group_mappings]]
group_dn = "cn=DevOps Owners,ou=Teams,dc=eom,dc=dev"
org_id = 2
org_role = "Admin"
[[servers.group_mappings]]
group_dn = "cn=Finance Owners,ou=Teams,dc=eom,dc=dev"
org_id = 3
org_role = "Admin"
templates/tes3mp-server-default.cfg.j2
-19
View File
@@ -1,19 +0,0 @@
[General]
# The default localAddress of 0.0.0.0 makes the server reachable at all of its local addresses
localAddress = 0.0.0.0
port = 25565
maximumPlayers = 64
hostname = {{ tes3mp_server_general_hostname }}
# 0 - Verbose (spam), 1 - Info, 2 - Warnings, 3 - Errors, 4 - Only fatal errors
logLevel = 1
password = {{ tes3mp_server_general_password }}
[Plugins]
home = /server/data
plugins = serverCore.lua
[MasterServer]
enabled = true
address = master.tes3mp.com
port = 25561
rate = 10000
templates/unrealircd.conf.j2
-706
View File
@@ -1,706 +0,0 @@
/* Configuration file for UnrealIRCd 6
*
* Simply copy this file to your conf/ directory and call it 'unrealircd.conf'
*
* If you are in a hurry then you can CTRL+F for: CHANGE THIS
* The items that must be changed are indicated with those two words.
* However, we actually recommend going through the file line by line
* and edit it where needed, so you can see all the basic items and
* what they are set to.
*
* BEFORE YOU PROCEED:
* Important: all lines, except { and } end with an ;
* This is very important, if you miss a ; somewhere then the
* configuration file parser will complain and the file will not
* be processed correctly!
* If this is your first experience with an UnrealIRCd configuration
* file then we really recommend you to read a little about the syntax,
* this only takes a few minutes and will help you a lot:
* https://www.unrealircd.org/docs/Configuration#Configuration_file_syntax
*
* UnrealIRCd 6 documentation (very extensive!):
* https://www.unrealircd.org/docs/UnrealIRCd_6_documentation
*
* Frequently Asked Questions:
* https://www.unrealircd.org/docs/FAQ
*/
/* This is a comment, all text here is ignored (comment type #1) */
// This is also a comment, this line is ignored (comment type #2)
# This is also a comment, again this line is ignored (comment type #3)
/* UnrealIRCd makes heavy use of modules. Modules allow you to completely
* customize the featureset you wish to enable in UnrealIRCd.
* See: https://www.unrealircd.org/docs/Modules
*
* By using the include below we instruct the IRCd to read the file
* 'modules.default.conf' which will load more than 150 modules
* shipped with UnrealIRCd. In other words: this will simply load
* all the available features in UnrealIRCd.
* If you are setting up UnrealIRCd for the first time we suggest you
* use this. Then, when everything is up and running you can come
* back later to customize the list (if you wish).
*/
include "modules.default.conf";
/* Now let's include some other files as well:
* - help/help.conf for our on-IRC /HELPOP system
* - badwords.conf for channel and user mode +G
* - spamfilter.conf as an example for spamfilter usage
* (commented out)
* - operclass.default.conf contains some good operclasses which
* you can use in your oper blocks.
*/
include "help/help.conf";
include "badwords.conf";
//include "spamfilter.conf";
include "operclass.default.conf";
include "snomasks.default.conf";
/* Load the default cloaking module (2021 onwards): */
loadmodule "cloak_sha256";
/* Or load the old module from UnrealIRCd 3.2/4/5 instead: */
//loadmodule "cloak_md5";
// CHANGE THIS (the 'name' and the 'info'):
/* This is the me { } block which basically says who we are.
* It defines our server name, some information line and an unique "sid".
* The server id (sid) must start with a digit followed by two digits or
* letters. The sid must be unique for your IRC network (each server should
* have it's own sid). It is common to use 001 for the first server.
*/
me {
name "{{ onionservice.resources[0].status.hostname }}";
info "{{ unrealircd.me.info }}";
sid "001";
}
// CHANGE THIS:
/* The admin { } block defines what users will see if they type /ADMIN.
* It normally contains information on how to contact the administrator.
*/
admin {
"{{ unrealircd.admin.name }}";
"{{ unrealircd.admin.username }}";
"{{ unrealircd.admin.email }}";
}
/* Clients and servers are put in class { } blocks, we define them here.
* Class blocks consist of the following items:
* - pingfreq: how often to ping a user / server (in seconds)
* - connfreq: how often we try to connect to this server (in seconds)
* - sendq: the maximum queue size for a connection
* - recvq: maximum receive queue from a connection (flood control)
*/
/* Client class with good defaults */
class clients
{
pingfreq 90;
maxclients 1000;
sendq 200k;
recvq 8000;
}
/* Special class for IRCOps with higher limits */
class opers
{
pingfreq 90;
maxclients 50;
sendq 1M;
recvq 8000;
}
/* Server class with good defaults */
class servers
{
pingfreq 60;
connfreq 15; /* try to connect every 15 seconds */
maxclients 10; /* max servers */
sendq 20M;
}
/* Allow blocks define which clients may connect to this server.
* This allows you to add a server password or restrict the server to
* specific IPs only. You also configure the maximum connections
* allowed per IP here.
* See also: https://www.unrealircd.org/docs/Allow_block
*/
/* Allow everyone in, but only 3 connections per IP */
allow {
mask *;
class clients;
maxperip 3;
}
/* Example of a special allow block on a specific IP:
* Requires users on that IP to connect with a password. If the password
* is correct then it permits 20 connections on that IP.
*/
// allow {
// mask 192.0.2.1;
// class clients;
// password "somesecretpasswd";
// maxperip 20;
// }
/* Oper blocks define your IRC Operators.
* IRC Operators are people who have "extra rights" compared to others,
* for example they may /KILL other people, initiate server linking,
* /JOIN channels even though they are banned, etc.
*
* For more information about becoming an IRCOp and how to do admin
* tasks, see: https://www.unrealircd.org/docs/IRCOp_guide
*
* For details regarding the oper { } block itself, see
* https://www.unrealircd.org/docs/Oper_block
*/
/* Here is an example oper block for 'bobsmith'
* YOU MUST CHANGE THIS!! (the oper name and the password)
*/
oper bobsmith {
class opers;
mask *@*;
/* Technically you can put oper passwords in plaintext in the conf but
* this is HIGHLY DISCOURAGED. Instead you should generate a password hash:
* On *NIX, run: ./unrealircd mkpasswd
* On Windows, run: "C:\Program Files\UnrealIRCd 6\bin\unrealircdctl" mkpasswd
* .. and then paste the result below:
*/
password "$argon2id..etc..";
/* See https://www.unrealircd.org/docs/Authentication_types for
* more information, including even better authentication types
* such as 'certfp', and how to generate hashes on Windows.
*/
/* Oper permissions are defined in an 'operclass' block.
* See https://www.unrealircd.org/docs/Operclass_block
* UnrealIRCd ships with a number of default blocks, see
* the article for a full list. We choose 'netadmin' here.
*/
operclass netadmin;
swhois "is a Network Administrator";
vhost netadmin.example.org;
}
/* Listen blocks define the ports where the server should listen on.
* In other words: the ports that clients and servers may use to
* connect to this server.
*
* Syntax:
* listen {
* ip <ip>;
* port <port>;
* options {
* <options....>;
* }
* }
*/
/* Standard IRC port 6667:
* Insecure plaintext (NOT for production servers)
* This listen block is here only for quick testing.
* Delete or comment out this listen block on production servers
* and use TLS on port 6697 instead.
*/
listen {
ip *;
port 6667;
}
/* Standard IRC SSL/TLS port 6697 */
listen {
ip *;
port 6697;
options { tls; }
}
/* Special SSL/TLS servers-only port for linking */
listen {
ip *;
port 6900;
options { tls; serversonly; }
}
/* NOTE: If you are on an IRCd shell with multiple IP's and you use
* the above listen { } blocks then you will likely get an
* 'Address already in use' error and the ircd won't start.
* This means you MUST bind to a specific IP instead of '*' like:
* listen { ip 1.2.3.4; port 6667; }
* Of course, replace the IP with the IP that was assigned to you.
*/
/*
* Link blocks allow you to link multiple servers together to form a network.
* See https://www.unrealircd.org/docs/Tutorial:_Linking_servers
*/
//link hub.example.org
//{
// incoming {
// mask *@something;
// }
//
// outgoing {
// bind-ip *; /* or explicitly an IP */
// hostname hub.example.org;
// port 6900;
// options { tls; }
// }
//
// /* We use the SPKI fingerprint of the other server for authentication.
// * Open a shell on the OTHER SERVER and run the command to get the fingerprint:
// * On *NIX, run: ./unrealircd spkifp
// * On Windows, run: "C:\Program Files\UnrealIRCd 6\bin\unrealircdctl" spkifp
// */
// password "AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUV=" { spkifp; }
//
// class servers;
//}
/* The link block for services is usually much simpler.
* For more information about what Services are,
* see https://www.unrealircd.org/docs/Services
*/
//link services.example.org
//{
// incoming {
// mask 127.0.0.1;
// }
//
// password "changemeplease";
//
// class servers;
//}
link {{ anope_os.resources[0].status.hostname }} {
incoming {
mask { ip 127.0.0.1; }
};
password "mypassword";
class servers;
};
ulines { services.example.net; };
/* U-lines give other servers (even) more power/commands.
* If you use services you MUST add them here. You must add the
* services server name in ulines { } in the config file on
* every UnrealIRCd server on your network.
* IMPORTANT: Never put the name of an UnrealIRCd server here,
* it's only for Services!
*/
//ulines {
// services.example.org;
//}
/* Here you can add a password for the IRCOp-only /DIE and /RESTART commands.
* This is mainly meant to provide a little protection against accidental
* restarts and server kills.
*/
drpass {
restart "restart";
die "die";
}
/* The log block defines what should be logged and to what file.
* See also https://www.unrealircd.org/docs/Log_block
*/
/* This is a good default, it logs everything except
* debug stuff and join/part/kick.
*/
log {
source {
all;
!debug;
!join.LOCAL_CLIENT_JOIN;
!join.REMOTE_CLIENT_JOIN;
!part.LOCAL_CLIENT_PART;
!part.REMOTE_CLIENT_PART;
!kick.LOCAL_CLIENT_KICK;
!kick.REMOTE_CLIENT_KICK;
}
destination {
file "ircd.log" { maxsize 100M; }
}
}
/* In addition to regular logging, also add a JSON log file.
* This includes lots of information about every event so is great
* for auditing purposes and is machine readable. It is, however
* less readable for humans.
*/
log {
source {
all;
!debug;
!join.LOCAL_CLIENT_JOIN;
!join.REMOTE_CLIENT_JOIN;
!part.LOCAL_CLIENT_PART;
!part.REMOTE_CLIENT_PART;
!kick.LOCAL_CLIENT_KICK;
!kick.REMOTE_CLIENT_KICK;
}
destination {
file "ircd.json.log" { maxsize 250M; type json; }
}
}
/* With "aliases" you can create an alias like /SOMETHING to send a message to
* some user or bot. They are usually used for services.
*
* We have a number of pre-set alias files, check out the alias/ directory.
* As an example, here we include all aliases used for anope services.
*/
include "aliases/anope.conf";
/* Ban nick names so they cannot be used by regular users */
// ban nick {
// mask "*C*h*a*n*S*e*r*v*";
// reason "Reserved for Services";
// }
/* Ban ip.
* Note that you normally use /KLINE, /GLINE and /ZLINE for this.
*/
// ban ip {
// mask 195.86.232.81;
// reason "Hate you";
// }
/* Ban server - if we see this server linked to someone then we delink */
// ban server {
// mask eris.berkeley.edu;
// reason "Get out of here.";
// }
/* Ban user - just as an example, you normally use /KLINE or /GLINE for this */
// ban user {
// mask *tirc@*.saturn.bbn.com;
// reason "Idiot";
// }
/* Ban realname allows you to ban clients based on their 'real name'
* or 'gecos' field.
*/
// ban realname {
// mask "Swat Team";
// reason "mIRKFORCE";
// }
// ban realname {
// mask "sub7server";
// reason "sub7";
// }
/* Ban and TKL exceptions. Allows you to exempt users / machines from
* KLINE, GLINE, etc.
* If you are an IRCOp with a static IP (and no untrusted persons on that IP)
* then we suggest you add yourself here. That way you can always get in
* even if you accidentally place a *LINE ban on yourself.
*/
/* except ban with type 'all' protects you from GLINE, GZLINE, QLINE, SHUN */
// except ban {
// mask *@192.0.2.1;
// type all;
// }
/* This allows IRCCloud connections in without maxperip restrictions
* and also exempt them from connect-flood throttling.
*/
except ban {
mask *.irccloud.com;
type { maxperip; connect-flood; }
}
/* With deny dcc blocks you can ban filenames for DCC */
// deny dcc {
// filename "*sub7*";
// reason "Possible Sub7 Virus";
// }
/* deny channel allows you to ban a channel (mask) entirely */
// deny channel {
// channel "*warez*";
// reason "Warez is illegal";
// class "clients";
// }
/* VHosts (Virtual Hosts) allow users to acquire a different host.
* See https://www.unrealircd.org/docs/Vhost_block
*/
/* Example vhost which you can use. On IRC type: /VHOST test test
*/
// vhost {
// vhost i.hate.microsefrs.com;
// mask *@*;
// login "test";
// password "test";
// }
/* Blacklist blocks will query an external DNS Blacklist service
* whenever a user connects, to see if the IP address is known
* to cause drone attacks, is a known hacked machine, etc.
* Documentation: https://www.unrealircd.org/docs/Blacklist_block
* Or just have a look at the blocks below.
*/
/* DroneBL, probably the most popular blacklist used by IRC Servers.
* See https://dronebl.org/ for their documentation and the
* meaning of the reply types. At time of writing we use types:
* 3: IRC Drone, 5: Bottler, 6: Unknown spambot or drone,
* 7: DDoS Drone, 8: SOCKS Proxy, 9: HTTP Proxy, 10: ProxyChain,
* 11: Web Page Proxy, 12: Open DNS Resolver, 13: Brute force attackers,
* 14: Open Wingate Proxy, 15: Compromised router / gateway,
* 16: Autorooting worms.
*/
blacklist dronebl {
dns {
name dnsbl.dronebl.org;
type record;
reply { 3; 5; 6; 7; 8; 9; 10; 11; 12; 13; 14; 15; 16; }
}
action gline;
ban-time 24h;
reason "Proxy/Drone detected. Check https://dronebl.org/lookup?ip=$ip for details.";
}
/* EFnetRBL, see https://rbl.efnetrbl.org/ for documentation
* and the meaning of the reply types.
* At time of writing: 1 is open proxy, 4 is TOR, 5 is drones/flooding.
*
* NOTE: If you want to permit TOR proxies on your server, then
* you need to remove the '4;' below in the reply section.
*/
blacklist efnetrbl {
dns {
name rbl.efnetrbl.org;
type record;
reply { 1; 4; 5; }
}
action gline;
ban-time 24h;
reason "Proxy/Drone/TOR detected. Check https://rbl.efnetrbl.org/?i=$ip for details.";
}
/* You can include other configuration files */
/* include "klines.conf"; */
/* Network configuration */
set {
// CHANGE THIS, ALL 4 ITEMS:
network-name "ExampleNET";
default-server "irc.example.org";
services-server "services.example.org";
stats-server "stats.example.org";
/* Normal defaults */
help-channel "#Help";
cloak-prefix "Clk";
prefix-quit "Quit";
/* Cloak keys should be the same at all servers on the network.
* They are used for generating masked hosts and should be kept secret.
* YOU MUST CHANGE THIS!
* The keys should be 3 random strings of 80 characters each (or more).
* and must consist of lowcase (a-z), upcase (A-Z) and digits (0-9).
* On *NIX, you can run './unrealircd gencloak' in your shell to let
* UnrealIRCd generate 3 random strings for you.
* On Windows, you can run "C:\Program Files\UnrealIRCd 6\bin\unrealircdctl" gencloak
*/
cloak-keys {
"Oozahho1raezoh0iMee4ohvegaifahv5xaepeitaich9tahdiquaid0geecipahdauVaij3zieph4ahi";
"and another one";
"and another one";
}
}
/* Server specific configuration */
set {
// FINALLY, YOU MUST CHANGE THIS NEXT ITEM:
kline-address 'set.this.to.email.address'; /* e-mail or URL shown when a user is banned */
modes-on-connect "+ixw"; /* when users connect, they will get these user modes */
modes-on-oper "+xws"; /* when someone becomes IRCOp they'll get these modes */
modes-on-join "+nt"; /* default channel modes when a new channel is created */
oper-auto-join "#opers"; /* IRCOps are auto-joined to this channel */
options {
hide-ulines; /* hide U-lines in /MAP and /LINKS */
show-connect-info; /* show "looking up your hostname" messages on connect */
}
maxchannelsperuser 10; /* maximum number of channels a user may /JOIN */
/* The minimum time a user must be connected before being allowed to
* use a QUIT message. This will hopefully help stop spam.
*/
anti-spam-quit-message-time 10s;
/* Or simply set a static quit, meaning any /QUIT reason is ignored */
/* static-quit "Client quit"; */
/* static-part does the same for /PART */
/* static-part yes; */
/* Flood protection */
anti-flood {
/* There are lots of settings for this and most have good defaults.
* See https://www.unrealircd.org/docs/Anti-flood_settings
*/
channel {
/* For channel-specific anti-flood settings, see
* https://www.unrealircd.org/docs/Channel_anti-flood_settings
* In UnrealIRCd 6.2.0+ the default is profile "normal".
* Chanops can override this via "MODE #channel +F relaxed"
* or "+F off". If you are afraid of too many false positives
* then you could set this to "relaxed" instead. Note that
* doing so would reduce protection for everyone. Another
* option is to set it here to "off" to disable this default
* channel protection entirely (not recommended).
*/
default-profile normal;
}
}
/* Settings for spam filter */
spamfilter {
ban-time 1d; /* default duration of a *LINE ban set by spamfilter */
ban-reason "Spam/Advertising"; /* default reason */
virus-help-channel "#help"; /* channel to use for 'viruschan' action */
/* except "#help"; channel to exempt from Spamfilter */
}
/* Restrict certain commands.
* See https://www.unrealircd.org/docs/Set_block#set::restrict-commands
*/
restrict-commands {
list {
except {
connect-time 60; /* after 60 seconds you can use LIST */
identified yes; /* or immediately, if you are identified to services */
reputation-score 24; /* or if you have a reputation score of 24 or more */
}
}
invite {
except {
connect-time 120;
identified yes;
reputation-score 24;
}
}
/* In addition to the ability to restrict any command,
* such as shown above. There are also 4 special types
* that you can restrict. These are "private-message",
* "private-notice", "channel-message" and "channel-notice".
* They are commented out (disabled) in this example:
*/
//private-message {
// except { connect-time 10; }
//}
//private-notice {
// except { connect-time 10; }
//}
}
}
/*
* The following will configure connection throttling of "unknown users".
*
* When UnrealIRCd detects a high number of users connecting from IP addresses
* that have not been seen before, then connections from new IP's are rejected
* above the set rate. For example at 10:60 only 10 users per minute can connect
* that have not been seen before. Known IP addresses can always get in,
* regardless of the set rate. Same for users who login using SASL.
*
* See also https://www.unrealircd.org/docs/Connthrottle for details.
* Or just keep reading the default configuration settings below:
*/
set {
connthrottle {
/* First we configure which users are exempt from the
* restrictions. These users are always allowed in!
* By default these are users on IP addresses that have
* a score of 24 or higher. A score of 24 means that the
* IP was connected to this network for at least 2 hours
* in the past month (or minimum 1 hour if registered).
* We also allow users who are identified to services via
* SASL to bypass the restrictions.
*/
except {
reputation-score 24;
identified yes;
/* for more options, see
* https://www.unrealircd.org/docs/Mask_item
*/
}
/* New users are all users that do not belong in the
* known-users group. They are considered "new" and in
* case of a high number of such new users connecting
* they are subject to connection rate limiting.
* By default the rate is 20 new local users per minute
* and 30 new global users per minute.
*/
new-users {
local-throttle 20:60;
global-throttle 30:60;
}
/* This configures when this module will NOT be active.
* The default settings will disable the module when:
* - The reputation module has been running for less than
* a week. If running less than 1 week then there is
* insufficient data to consider who is a "known user".
* - The server has just been booted up (first 3 minutes).
*/
disabled-when {
reputation-gathering 1w;
start-delay 3m;
}
}
}
/* CHANNEL HISTORY:
* UnrealIRCd has channel mode +H which can be used by users to read back
* channel history, such as from before they joined. For general information
* on this feature, see https://www.unrealircd.org/docs/Channel_history
*
* The history limits can be configured via set::history. The defaults are
* probably already good for you, but if you are on a low-memory system
* or have thousands of channels then you may want to double check. See
* https://www.unrealircd.org/docs/Set_block#set::history for the options.
*
* In addition to that, you can have "persistent channel history", which
* means channel history is stored encrypted on disk so it is preserved
* between IRC server restarts, see
* https://www.unrealircd.org/docs/Set_block#Persistent_channel_history
* The persistent history feature is NOT enabled by default because you
* need to configure a secret { } block for it. The following is a simple
* example with passwords stored directly in the configuration file.
* To get better security, read https://www.unrealircd.org/docs/Secret_block
* on alternative ways so you don't store passwords directly in the config.
*/
//secret historydb { password "somepassword"; }
//set { history { channel { persist yes; db-secret "historydb"; } } }
/* Finally, you may wish to have a MOTD (Message of the Day), this can be
* done by creating an 'ircd.motd' text file in your conf/ directory.
* This file will be shown to your users on connect.
* For more information see https://www.unrealircd.org/docs/MOTD_and_Rules
*/
/*
* Problems or need more help?
* 1) https://www.unrealircd.org/docs/
* 2) https://www.unrealircd.org/docs/FAQ <- answers 80% of your questions!
* 3) If you are still having problems then you can get support:
* - Forums: https://forums.unrealircd.org/
* - IRC: irc.unrealircd.org (SSL on port 6697) / #unreal-support
* Note that we require you to read the documentation and FAQ first!
*/