diff --git a/README.md b/README.md index 37086c15..c45c55f4 100644 --- a/README.md +++ b/README.md @@ -190,4 +190,13 @@ ROLENAME_admin_password: "{{ vault_ROLENAME_admin_password }}" ROLENAME_postgres_hostname: ROLENAME_postgres_user: ROLENAME_postgres_password: "{{ vault_ROLENAME_postgres_password }}" +# SMTP +ROLENAME_smtp_hostname: +ROLENAME_smtp_auth: +ROLENAME_smtp_secure: +ROLENAME_smtp_port: +ROLENAME_smtp_domain: +ROLENAME_smtp_from: +ROLENAME_smtp_username: +ROLENAME_smtp_password: ``` diff --git a/TODO.md b/TODO.md index 038b2e64..35cad1bd 100644 --- a/TODO.md +++ b/TODO.md @@ -6,6 +6,10 @@ - [ ] Install bbb exporter https://github.com/greenstatic/bigbluebutton-exporter - [ ] Configure nginx role -> map the *.nginx files and include them in the config +## Wordpress + +- [ ] Configure sendmail + ## Odoo - [ ] Install etherpad https://github.com/ether/etherpad-lite/blob/develop/doc/docker.md or use pad.odoo.com @@ -23,8 +27,10 @@ - [x] apollo - [x] eris - [x] hera +- [ ] Package upgrader -> if versions do not match, unpin package - [ ] Update Odoo and apps -> show db names 1.0.1 - [ ] Update Bookstack to 0.29 +- [ ] upgrade nginx images -> basic group -> nginx 1.19 ## Identity @@ -95,6 +101,7 @@ # DONE +- [x] Docker packages use package role to install its packages -> include role and override packages - [x] Test PATH update for crontab -> did not work! -> fixed -> all paths were required - [x] Configure meta/main.yml dependencies for all projects! See cadvisor and update playbooks - [x] node-exporter diff --git a/clean.yml b/clean.yml index 1d31f3a1..c7e1901d 100644 --- a/clean.yml +++ b/clean.yml @@ -3,25 +3,4 @@ roles: - role: clean tags: - - nginx - - modsecurity - - keycloak - - kibana - - moodle - - odoo - - odoo-scripts - - nextcloud - - collabora-code - - bookstack - - logstash - - elasticsearch - - metricbeat - - cadvisor - - node-exporter - - prometheus - - grafana - - openldap - - mysql - - postgres - - docker-network - - fathom \ No newline at end of file + - always \ No newline at end of file diff --git a/inventories b/inventories index 219a8d37..b3096fb2 160000 --- a/inventories +++ b/inventories @@ -1 +1 @@ -Subproject commit 219a8d3766c7aa6de75ae608348469f861043462 +Subproject commit b3096fb2901bcc9db8680f0ff2451aa90de0f92f diff --git a/roles/bigbluebutton/tasks/main.yml b/roles/bigbluebutton/tasks/main.yml index 166f797d..eb94283a 100644 --- a/roles/bigbluebutton/tasks/main.yml +++ b/roles/bigbluebutton/tasks/main.yml @@ -7,19 +7,21 @@ - name: Include letsencrypt install tasks include: install-letsencrypt.yml + when: ansible_distribution == "Ubuntu" and ansible_distribution_version == "16.04" and bigbluebutton_apt_repo_url tags: - bigbluebutton - bigbluebutton-letsencrypt - name: Include enable https tasks include: enable-https.yml + when: ansible_distribution == "Ubuntu" and ansible_distribution_version == "16.04" and bigbluebutton_apt_repo_url tags: - bigbluebutton - bigbluebutton-https - name: Include greenligh install tasks include: install-greenlight.yml - when: greenlight_image is defined + when: ansible_distribution == "Ubuntu" and ansible_distribution_version == "16.04" and bigbluebutton_apt_repo_url tags: - bigbluebutton - bigbluebutton-greenlight \ No newline at end of file diff --git a/roles/clean/tasks/main.yml b/roles/clean/tasks/main.yml index 28bd52d3..8d5a0f6e 100644 --- a/roles/clean/tasks/main.yml +++ b/roles/clean/tasks/main.yml @@ -25,4 +25,5 @@ - mysql - postgres - docker-network - - odoo-scripts \ No newline at end of file + - odoo-scripts + - wordpress \ No newline at end of file diff --git a/roles/clean/tasks/mysql.yml b/roles/clean/tasks/mysql.yml index 54ce88fe..2bac2567 100644 --- a/roles/clean/tasks/mysql.yml +++ b/roles/clean/tasks/mysql.yml @@ -2,4 +2,10 @@ docker_container: name: "{{ mysql_hostname }}" state: absent - when: mysql_hostname is defined \ No newline at end of file + when: mysql_hostname is defined + +- name: "Remove mysql volume {{ mysql_volume_name }}" + docker_volume: + name: "{{ mysql_volume_name }}" + state: absent + when: mysql_volume_name is defined and 'mysql-volume' in ansible_run_tags diff --git a/roles/clean/tasks/wordpress.yml b/roles/clean/tasks/wordpress.yml new file mode 100644 index 00000000..e50d0657 --- /dev/null +++ b/roles/clean/tasks/wordpress.yml @@ -0,0 +1,11 @@ +- name: "Remove wordpress container {{ wordpress_hostname }}" + docker_container: + name: "{{ wordpress_hostname }}" + state: absent + when: wordpress_hostname is defined + +- name: "Remove wordpress volume {{ wordpress_volume_name }}" + docker_volume: + name: "{{ wordpress_volume_name }}" + state: absent + when: wordpress_volume_name is defined and 'wordpress-volume' in ansible_run_tags diff --git a/roles/docker/tasks/install-ubuntu.yml b/roles/docker/tasks/install-ubuntu.yml index 34ef15ac..73c83b12 100644 --- a/roles/docker/tasks/install-ubuntu.yml +++ b/roles/docker/tasks/install-ubuntu.yml @@ -1,27 +1,8 @@ -- name: Install aptitude using apt - apt: - name: "{{ docker_aptitude_package }}" - update_cache: yes - force_apt_get: yes - -- name: Unpin docker packages - dpkg_selections: - name: "{{ item }}" - selection: install - loop: "{{ docker_packages }}" - when: "'=' not in item" - - name: Install required docker packages - apt: - name: "{{ item }}" - loop: "{{ docker_packages }}" - -- name: Pin docker packages - dpkg_selections: - name: "{{ item.split('=')[0] }}" - selection: hold - loop: "{{ docker_packages }}" - when: "'=' in item" + include_role: + name: package + vars: + packages: "{{ docker_packages }}" - name: Add Docker GPG apt Key apt_key: @@ -33,22 +14,12 @@ repo: "{{ docker_apt_repo }}" state: present -- name: Unpin docker-ce version - dpkg_selections: - name: "{{ docker_package }}" - selection: hold - when: "'=' not in docker_package" - -- name: Update apt and install docker-ce - apt: - update_cache: yes - name: "{{ docker_package }}" - -- name: Pin docker-ce version - dpkg_selections: - name: "{{ docker_package.split('=')[0] }}" - selection: hold - when: "'=' in docker_package" +- name: Install required docker packages + include_role: + name: package + vars: + packages: + - "{{ docker_package }}" - name: Install Docker Module for Python pip: diff --git a/roles/nginx/tasks/install-certbot.yml b/roles/nginx/tasks/install-certbot.yml index 1c6107ab..5cf210ad 100644 --- a/roles/nginx/tasks/install-certbot.yml +++ b/roles/nginx/tasks/install-certbot.yml @@ -56,10 +56,6 @@ seconds: "10" when: certbot_certs | json_query(certbot_stat_filter) | list -- name: debug - debug: - var: certbot_issue_certificate - - name: "Remove certbot container {{ certbot_hostname }}" docker_container: name: "{{ certbot_hostname }}" diff --git a/roles/nginx/tasks/install.yml b/roles/nginx/tasks/install.yml index 399925ac..a80bd619 100644 --- a/roles/nginx/tasks/install.yml +++ b/roles/nginx/tasks/install.yml @@ -15,6 +15,12 @@ when: item.msg == 'alias.zeit.co.' loop: "{{ dig.results }}" +- name: Fail if DNS record points to cname.vercel-dns.com. + fail: + msg: DNS record points to default alias. + when: item.msg == 'cname.vercel-dns.com.' + loop: "{{ dig.results }}" + - name: Include install certbot tasks include_tasks: install-certbot.yml when: certbot_image is defined @@ -65,7 +71,7 @@ name: "{{ nginx_hostname }}" image: "{{ nginx_image }}" restart_policy: unless-stopped - recreate: yes + recreate: no ports: - "{{ nginx_http_port }}:{{ nginx_http_port }}" - "{{ nginx_https_port }}:{{ nginx_https_port }}" diff --git a/roles/nginx/templates/nginx-proxy.conf b/roles/nginx/templates/nginx-proxy.conf index 6ee0b558..dc989400 100644 --- a/roles/nginx/templates/nginx-proxy.conf +++ b/roles/nginx/templates/nginx-proxy.conf @@ -8,7 +8,7 @@ server { location / { {% if redirect_hostname %} - return 301 $scheme://{{ redirect_hostname }}$request_uri; + return 301 https://{{ redirect_hostname }}$request_uri; {% else %} return 301 https://$host$request_uri; {% endif %} @@ -53,7 +53,7 @@ server { {% if redirect_hostname %} location / { - return 301 $scheme://{{ redirect_hostname }}$request_uri; + return 301 https://{{ redirect_hostname }}$request_uri; } {% endif %} diff --git a/roles/package/README.md b/roles/package/README.md index d19b38cf..112d2a02 100644 --- a/roles/package/README.md +++ b/roles/package/README.md @@ -15,11 +15,22 @@ packages: state: absent ``` -And include it in your playbook. +Include it in your playbook. ```yml - hosts: package roles: - - role: packages + - role: package tags: package ``` + +Or include it in another role. + +```yml +- name: Install required docker packages + include_role: + name: package + vars: + packages: + - "{{ docker_package }}" +``` \ No newline at end of file diff --git a/roles/package/tasks/install.yml b/roles/package/tasks/install.yml index ef37e4a9..d2a553f9 100644 --- a/roles/package/tasks/install.yml +++ b/roles/package/tasks/install.yml @@ -1,3 +1,9 @@ +- name: Update apt-get repo and cache + apt: + update_cache: yes + force_apt_get: yes + cache_valid_time: 3600 + - name: Unpin packages dpkg_selections: name: "{{ item.name }}" diff --git a/roles/wordpress/README.md b/roles/wordpress/README.md index 7514bed6..92e3fbef 100644 --- a/roles/wordpress/README.md +++ b/roles/wordpress/README.md @@ -9,7 +9,19 @@ Configure the role. **vars.yml** ```yml - +wordpress_image: wordpress:php7.4-apache +wordpress_hostname: word01 +wordpress_volume_name: word_data01 +wordpress_db_hostname: mysql01 +wordpress_db_user: wordpress +wordpress_db_password: "{{ vault_wordpress_db_password }}" +wordpress_db_name: wordpress +wordpress_smtp_secure: tls +wordpress_smtp_hostname: mail.example.com +wordpress_smtp_port: "587" +wordpress_smtp_from: noreply@example.com +wordpress_smtp_username: bot@example.com +wordpress_smtp_password: "{{ vault_wordpress_smtp_password }}" ``` And include it in your playbook. diff --git a/roles/wordpress/tasks/install.yml b/roles/wordpress/tasks/install.yml index e112b80f..a78a903a 100644 --- a/roles/wordpress/tasks/install.yml +++ b/roles/wordpress/tasks/install.yml @@ -3,12 +3,6 @@ name: "{{ wordpress_volume_name }}" when: wordpress_volume_name is defined -- name: Ensure wordpress data dir exists - file: - path: "{{ wordpress_data_dir }}" - state: directory - when: wordpress_data_dir is defined - - name: "Start wordpress container {{ wordpress_hostname }}" docker_container: name: "{{ wordpress_hostname }}" @@ -16,15 +10,44 @@ restart_policy: unless-stopped recreate: no env: - GF_SECURITY_ADMIN_USER: "{{ wordpress_admin_user }}" - GF_SECURITY_ADMIN_PASSWORD: "{{ wordpress_admin_password }}" - GF_USERS_ALLOW_SIGN_UP: "false" + WORDPRESS_DB_HOST: "{{ wordpress_db_hostname }}" + WORDPRESS_DB_USER: "{{ wordpress_db_user}}" + WORDPRESS_DB_PASSWORD: "{{ wordpress_db_password }}" + WORDPRESS_DB_NAME: "{{ wordpress_db_name }}" + WORDPRESS_SMTP_HOST: "{{ wordpress_smtp_hostname }}" + WORDPRESS_SMTP_PORT: "{{ wordpress_smtp_port }}" + WORDPRESS_SMTP_SECURE: "{{ wordpress_smtp_secure }}" + WORDPRESS_SMTP_USERNAME: "{{ wordpress_smtp_username }}" + WORDPRESS_SMTP_PASSWORD: "{{ wordpress_smtp_password }}" + WORDPRESS_SMTP_FROM: "{{ wordpress_smtp_from }}" + WORDPRESS_SMTP_FROM_NAME: "{{ wordpress_smtp_from }}" + WORDPRESS_SMTP_AUTH: "true" volumes: - - "{{ wordpress_volume_name }}:/wordpress" - - "{{ wordpress_data_dir }}/datasource.yml:/etc/wordpress/provisioning/datasource/datasource.yml" + - "{{ wordpress_volume_name }}:/var/www/html" networks: - name: "{{ docker_network_name }}" log_driver: "{{ docker_log_driver }}" log_options: max-size: "{{ docker_log_max_size }}" max-file: "{{ docker_log_max_file }}" + +# - name: Upate wordpress config +# blockinfile: +# path: "/var/lib/docker/volumes/{{ wordpress_volume_name }}/_data/wp-mail.php" +# insertafter: "$pop3->quit();" +# marker: "// {mark} ANSIBLE MANAGED BLOCK" +# block: | +# /* SMTP Settings */ +# add_action( 'phpmailer_init', 'send_smtp_email' ); +# function send_smtp_email( $phpmailer ) { +# $phpmailer->isSMTP(); +# $phpmailer->Host = getenv('WORDPRESS_SMTP_HOST'); +# $phpmailer->SMTPAuth = getenv('WORDPRESS_SMTP_AUTH'); +# $phpmailer->Port = getenv('WORDPRESS_SMTP_PORT'); +# $phpmailer->SMTPSecure = getenv('WORDPRESS_SMTP_SECURE'); +# $phpmailer->Username = getenv('WORDPRESS_SMTP_USERNAME'); +# $phpmailer->Password = getenv('WORDPRESS_SMTP_PASSWORD'); +# $phpmailer->From = getenv('WORDPRESS_SMTP_FROM'); +# $phpmailer->FromName = getenv('WORDPRESS_SMTP_FROM_NAME'); +# } +# notify: Restart wordpress container \ No newline at end of file diff --git a/various.yml b/various.yml index cf38053a..fbba0719 100644 --- a/various.yml +++ b/various.yml @@ -19,4 +19,6 @@ - biglbuebutton-core - biglbuebutton-letsencrypt - biglbuebutton-https - - biglbuebutton-greenlight \ No newline at end of file + - biglbuebutton-greenlight + - role: wordpress + tags: wordpress \ No newline at end of file