test inv cleanup

Vagrantfile

@@ -18,31 +18,17 @@ Vagrant.configure("2") do |config|
     debian.vm.network "private_network", ip: "192.168.121.100"  # Static IP needed for nas
     debian.vm.network "forwarded_port", guest: 22, host: 3023
   end
-  config.vm.define "vaermina" do |debian|
+  config.vm.define "akatosh" do |debian|
     debian.vm.box = "debian/bookworm64"
-    debian.vm.hostname = "test-vaermina"
+    debian.vm.hostname = "test-akatosh"
     debian.vm.network "private_network", type: "dhcp"
-    debian.vm.network "forwarded_port", guest: 22, host: 3024
+    debian.vm.network "forwarded_port", guest: 22, host: 3029
+    debian.vm.provider "libvirt" do |lv|
+      lv.memory = "6144"
+      lv.cpus = 2
+      lv.machine_virtual_size = 40
+    end
   end
-
-  # config.vm.define "meridia" do |arch|
-  #   arch.vm.box = "generic/arch"
-  #   arch.vm.hostname = "test-meridia"
-  #   arch.vm.network "private_network", type: "dhcp"
-  #   arch.vm.network "forwarded_port", guest: 22, host: 3025
-  #   arch.vm.provision "shell", inline: <<-SHELL
-  #     pacman -Sy --noconfirm python
-  #   SHELL
-  # end
-  # config.vm.define "dibella" do |arch|
-  #   arch.vm.box = "generic/arch"
-  #   arch.vm.hostname = "test-dibella"
-  #   arch.vm.network "private_network", type: "dhcp"
-  #   arch.vm.network "forwarded_port", guest: 22, host: 3026
-  #   arch.vm.provision "shell", inline: <<-SHELL
-  #     pacman -Sy --noconfirm python
-  #   SHELL
-  # end
   # config.vm.define "azura" do |arch|
   #   arch.vm.box = "generic/arch"
   #   arch.vm.hostname = "test-azura"

group_vars/backup.yml

@@ -0,0 +1,4 @@
+backup_root: /srv/backups/aurbis
+backup_key_path: /root/.ssh/aurbis_backup_ed25519
+backup_retain_recent: 14
+backup_retain_monthly: 6

group_vars/cloud.yml

@@ -1,6 +0,0 @@
-users:
-  - mark
-  - martijn
-  - jp
-  - lourens
-  - guus

group_vars/home.yml

@@ -1,3 +1,2 @@
 users:
   - mark
-  - martijn

handlers/main.yml

@@ -22,3 +22,8 @@
     iptables-save > /etc/iptables/rules.v4
   args:
     executable: /bin/bash
+
+- name: reload nginx
+  service:
+    name: nginx
+    state: reloaded

host_vars/akatosh.yml

@@ -0,0 +1,54 @@
+users:
+  - mark
+  - martijn
+  - jp
+  - lourens
+  - guus
+cloud_nginx_tls: true
+cloud_nginx_sites:
+  - name: nextcloud
+    server_name: cloud.hoekveen.net
+    port: 8081
+    max_body: 10g
+  - name: hdwiki
+    server_name: wiki.hoekveen.net
+    port: 8082
+  - name: gitea
+    server_name: git.hoekveen.net
+    port: 8083
+  - name: authentik
+    server_name: sso.hoekveen.net
+    port: 9000
+  - name: drone
+    server_name: drone.hoekveen.net
+    port: 3496
+  - name: www
+    server_name: www.hoekveen.net
+    root: /opt/hoekveen.net
+  - name: nightingale
+    server_name: karaoke.hoekveen.net
+    port: 8087
+    max_body: 2g # song uploads
+
+stroopwafel_dir: /opt/stroopwafel
+stroopwafel_repo: gitea@git.hoekveen.net:mark/stroopwafel.git
+stroopwafel_version: master
+
+backup_dump_dir: /var/backups/aurbis
+backup_paths:
+  - /etc # nginx, certs, systemd units
+  - /opt # all stacks
+  - /var/nextcloud # nextcloud files
+  - /var/lib/docker/volumes # nextcloud_html (apps/config) etc.
+  - /var/backups/aurbis # the database dumps
+backup_excludes:
+  - /var/nextcloud/appdata_*/preview # regenerable thumbnails
+  - /var/nextcloud/nextcloud.log # rotates
+  - /opt/containerd # docker runtime state
+  - /var/lib/docker/volumes/nextcloud_db # raw databases are dumped instead
+  - /var/lib/docker/volumes/gitea_db
+  - /var/lib/docker/volumes/hdwiki_db
+  - /var/lib/docker/volumes/authentik_database
+  - /var/lib/docker/volumes/authentik_redis
+  - /var/lib/docker/volumes/nightingale_data
+  - /var/lib/docker/volumes/backingFsBlockDev

host_vars/todd-test.yml

@@ -1,2 +0,0 @@
-users:
-  - mark

inventory.test.yml

@@ -1,20 +1,5 @@
 rpi:
   hosts:
-    vaermina:
-      ansible_host: 127.0.0.1
-      ansible_port: 3024
-      ansible_user: vagrant
-      ansible_ssh_private_key_file: .vagrant/machines/vaermina/libvirt/private_key
-    # azura:
-    #   ansible_host: 127.0.0.1
-    #   ansible_port: 3027
-    #   ansible_user: vagrant
-    #   ansible_ssh_private_key_file: .vagrant/machines/azura/libvirt/private_key
-    # kynareth:
-    #   ansible_host: 127.0.0.1
-    #   ansible_port: 3028
-    #   ansible_user: vagrant
-    #   ansible_ssh_private_key_file: .vagrant/machines/kynareth/libvirt/private_key
     nocturnal:
       ansible_host: 127.0.0.1
       ansible_port: 3023
@@ -28,36 +13,26 @@ x86:
       ansible_port: 3022
       ansible_user: vagrant
       ansible_ssh_private_key_file: .vagrant/machines/talos/libvirt/private_key
-    # meridia:
-    #   ansible_host: 127.0.0.1
-    #   ansible_port: 3025
-    #   ansible_user: vagrant
-    #   ansible_ssh_private_key_file: .vagrant/machines/meridia/libvirt/private_key
-    # dibella:
-    #   ansible_host: 127.0.0.1
-    #   ansible_port: 3026
-    #   ansible_user: vagrant
-    #   ansible_ssh_private_key_file: .vagrant/machines/dibella/libvirt/private_key
+    akatosh:
+      ansible_host: 127.0.0.1
+      ansible_port: 3029
+      ansible_user: nerevar
 
 debian:
   hosts:
-    vaermina:
     talos:
     nocturnal:
-# arch:
-#   hosts:
-#     azura:
-#     kynareth:
-#     meridia:
-#     dibella:
+    akatosh:
 home:
   hosts:
-    # azura:
-    vaermina:
-    # kynareth:
     nocturnal:
     talos:
-# cloud:
-#   hosts:
-#     meridia:
-#     dibella:
+cloud:
+  hosts:
+    akatosh:
+backup_sources:
+  hosts:
+    akatosh:
+backup:
+  hosts:
+    talos:

inventory.yml

@@ -1,7 +1,5 @@
 rpi:
   hosts:
-    vaermina:
-      ansible_host: 192.168.178.95
     azura:
       ansible_host: 192.168.178.94
     kynareth:
@@ -12,29 +10,30 @@ x86:
   hosts:
     talos:
       ansible_host: 192.168.178.64
-    meridia:
-      ansible_host: 62.171.176.43
-    dibella:
-      ansible_host: 45.88.188.77
+    akatosh:
+      ansible_host: 169.58.40.23
 debian:
   hosts:
-    vaermina:
     talos:
     nocturnal:
+    akatosh:
 arch:
   hosts:
     azura:
     kynareth:
-    meridia:
-    dibella:
 home:
   hosts:
     azura:
-    vaermina:
     kynareth:
     nocturnal:
     talos:
 cloud:
   hosts:
-    meridia:
-    dibella:
+    akatosh:
+# Hosts whose application data talos pulls into hardlinked snapshots.
+backup_sources:
+  hosts:
+    akatosh:
+backup:
+  hosts:
+    talos:

playbook.yml

@@ -39,6 +39,7 @@
           (inventory_hostname not in groups['home'] and item in groups['cloud'])
       with_items: "{{ groups.all }}"
     - import_tasks: tasks/motd.yml
+      tags: motd
 - name: Update Debian hosts
   hosts: debian
   become: true
@@ -46,8 +47,9 @@
   tasks:
     - name: Update
       include_tasks: tasks/update_debian.yml
+# azura werkt niet echt mee met updates op het moment
 - name: Update Arch hosts
-  hosts: arch
+  hosts: arch:!azura
   become: true
   remote_user: nerevar
   tasks:
@@ -65,13 +67,6 @@
   remote_user: nerevar
   tasks:
     - import_tasks: tasks/scripts.yml
-# - name: Add Nocturnal SMB share
-#   hosts: home
-#   vars_files:
-#     - vault/nocturnal.yml
-#   become: true
-#   tasks:
-#     - import_tasks: tasks/nocturnal_smb.yml
 - name: Setup zsh
   hosts: debian
   become: true
@@ -90,20 +85,52 @@
   remote_user: nerevar
   tasks:
     - import_tasks: tasks/vcmp_timer.yml
-    - import_tasks: tasks/audiobookshelf.yml
     - import_tasks: tasks/stash.yml
     - import_tasks: tasks/jellyfin.yml
     - import_tasks: tasks/wireguard.yml
   handlers:
     - import_tasks: handlers/main.yml
   tags: leaf
-- name: Vaermina install
-  hosts: vaermina
+- name: Backup host (pull snapshots from cloud)
+  hosts: backup
   become: true
   remote_user: nerevar
   tasks:
-    - import_tasks: tasks/pihole.yml
-    - import_tasks: tasks/mediawiki.yml
+    - import_tasks: tasks/backup_pull.yml
+  tags:
+    - leaf
+    - backup
+- name: Akatosh install
+  hosts: akatosh
+  become: true
+  remote_user: nerevar
+  tasks:
+    - name: Install base tools (minimal cloud image lacks them)
+      package:
+        name: [rsync, curl, sqlite3]
+        state: present
+    - name: Normalise /opt app ownership to root:aurbis (top dir only, not recursive)
+      file:
+        path: "/opt/{{ item }}"
+        state: directory
+        owner: root
+        group: aurbis
+        mode: "0775"
+      loop: [nextcloud, hdwiki, gitea, authentik, drone, "hoekveen.net"]
+    - import_tasks: tasks/nextcloud.yml
+    - import_tasks: tasks/hdwiki.yml
+    - import_tasks: tasks/gitea.yml
+    - import_tasks: tasks/nightingale.yml
+    - import_tasks: tasks/stroopwafel.yml
+    - import_tasks: tasks/cloud_nginx.yml
+    - name: Ensure the backup user can run the forced-command pull
+      user:
+        name: backup
+        shell: /bin/bash
+        create_home: false
+    - import_tasks: tasks/backup_source.yml
+  handlers:
+    - import_tasks: handlers/main.yml
   tags: leaf
 - name: Kynareth install
   hosts: kynareth

tasks/audiobookshelf.yml

@@ -1,4 +0,0 @@
-- name: Deploy Audio Bookshelf
-  include_tasks: tasks/docker_service.yml
-  vars:
-    service_name: audiobookshelf

tasks/audiobookshelf/docker-compose.yml.j2

@@ -1,13 +0,0 @@
-services:
-  audiobookshelf:
-    image: ghcr.io/advplyr/audiobookshelf:latest
-    ports:
-      - 13378:80
-    volumes:
-      #- </path/to/audiobooks>:/audiobooks
-      #- </path/to/podcasts>:/podcasts
-      - /mnt/azura/Books:/audiobooks
-      - .config/:/config
-      - .metadata:/metadata
-    environment:
-      - TZ=Europe/Amsterdam

tasks/audiobookshelf/vault.yml

@@ -1,6 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-38333333623830373232656136653330383737663565326538363462663966623364623237343836
-3635353564346238313865363361306563303734366336300a383030323538386438373563303238
-30346265396136616238376539633532613363323034343339636130393739376563323036393463
-6266363262363263330a366330633638336331666335373233323537666166366564333736353764
-3039

tasks/backup/aurbis-backup-pull.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Pull application-data backup from the cloud hosts
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/aurbis-backup-pull
+Nice=10
+IOSchedulingClass=idle

tasks/backup/aurbis-backup-pull.sh.j2

@@ -0,0 +1,80 @@
+#!/bin/bash
+# {{ ansible_managed }}
+# Pull application data from the cloud hosts into hardlinked snapshots
+# rsnapshot-style: rsync --link-dest
+set -uo pipefail
+
+ROOT={{ backup_root }}
+KEY={{ backup_key_path }}
+RETAIN={{ backup_retain_recent | default(14) }}
+RETAIN_MONTHLY={{ backup_retain_monthly | default(6) }}
+SSH="ssh -i $KEY -o StrictHostKeyChecking=accept-new -o BatchMode=yes"
+STAMP=$(date +%Y-%m-%d_%H%M)
+
+exec 9> "$ROOT/.lock" || exit 1
+flock -n 9 || { echo "another backup run is active, aborting"; exit 1; }
+
+overall_rc=0
+
+{% raw %}
+prune() {
+    local host_root=$1
+    local -a snaps
+    mapfile -t snaps < <(find "$host_root" -mindepth 1 -maxdepth 1 -type d -name '20*' | sort)
+    ((${#snaps[@]})) || return 0
+    declare -A keep_set month_first
+    # newest RETAIN snapshots
+    local n=${#snaps[@]} start=0
+    ((n > RETAIN)) && start=$((n - RETAIN))
+    for s in "${snaps[@]:$start}"; do keep_set[$s]=1; done
+    # oldest snapshot of each month, for the RETAIN_MONTHLY most recent months
+    for s in "${snaps[@]}"; do
+        local m; m=$(basename "$s" | cut -c1-7)
+        [[ -z ${month_first[$m]:-} ]] && month_first[$m]=$s
+    done
+    mapfile -t months < <(printf '%s\n' "${!month_first[@]}" | sort | tail -n "$RETAIN_MONTHLY")
+    for m in "${months[@]}"; do keep_set[${month_first[$m]}]=1; done
+    for s in "${snaps[@]}"; do
+        if [[ -z ${keep_set[$s]:-} ]]; then
+            echo "pruning $s"
+            rm -rf "$s"
+        fi
+    done
+}
+{% endraw %}
+
+{% for host in groups['backup_sources'] %}
+##### {{ host }} #####
+host={{ host }}
+addr={{ hostvars[host].ansible_host }}
+host_root=$ROOT/$host
+new=$host_root/incomplete
+mkdir -p "$host_root"
+rm -rf "$new"
+mkdir "$new"
+link_dest=()
+[[ -d $host_root/latest/. ]] && link_dest=(--link-dest="$host_root/latest/")
+host_rc=0
+{% for path in hostvars[host].backup_paths %}
+rsync -aR --numeric-ids --delete --delete-excluded \
+    {% for ex in hostvars[host].backup_excludes | default([]) %}--exclude='{{ ex }}' {% endfor %}\
+    -e "$SSH" "${link_dest[@]}" \
+    "backup@$addr:{{ path }}" "$new/"
+rc=$?
+if ((rc != 0 && rc != 24)); then
+    echo "ERROR: $host:{{ path }} failed with rsync exit $rc" >&2
+    host_rc=1
+fi
+{% endfor %}
+if ((host_rc == 0)); then
+    mv "$new" "$host_root/$STAMP"
+    ln -sfn "$STAMP" "$host_root/latest"
+    prune "$host_root"
+    echo "$host: snapshot $STAMP complete"
+else
+    echo "$host: snapshot FAILED, keeping previous 'latest'" >&2
+    overall_rc=1
+fi
+
+{% endfor %}
+exit $overall_rc

tasks/backup/aurbis-backup-pull.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Daily pull of the aurbis application-data backup
+
+[Timer]
+OnCalendar=*-*-* 04:30
+RandomizedDelaySec=15m
+Persistent=true
+
+[Install]
+WantedBy=timers.target

tasks/backup/aurbis-dump-akatosh.sh.j2

@@ -0,0 +1,31 @@
+#!/bin/bash
+# {{ ansible_managed }}
+# Dump application databases to {{ backup_dump_dir }}
+# for pickup by the backup host
+set -euo pipefail
+umask 077
+DEST={{ backup_dump_dir }}
+mkdir -p "$DEST"
+
+# MariaDB stacks: dump via the stack's `db` service using its own env creds.
+dump_mariadb() { # <stack dir under /opt> <output file>
+    docker compose -f "/opt/$1/docker-compose.yml" exec -T db sh -c \
+        'exec mariadb-dump --single-transaction --quick --routines --events \
+            -u"$MARIADB_USER" -p"$MARIADB_PASSWORD" "$MARIADB_DATABASE"' \
+        | gzip > "$DEST/$2.tmp"
+    mv "$DEST/$2.tmp" "$DEST/$2"
+}
+dump_mariadb nextcloud nextcloud.sql.gz
+dump_mariadb gitea     gitea.sql.gz
+dump_mariadb hdwiki    mediawikidb.sql.gz
+
+# Authentik PostgreSQL (docker compose)
+docker compose -f /opt/authentik/docker-compose.yml exec -T postgresql \
+    pg_dump -U authentik -d authentik | gzip > "$DEST/authentik.sql.gz.tmp"
+mv "$DEST/authentik.sql.gz.tmp" "$DEST/authentik.sql.gz"
+
+# Drone CI sqlite (online-safe consistent copy)
+sqlite3 /opt/drone/drone/database.sqlite ".backup '$DEST/drone.sqlite.tmp'"
+mv "$DEST/drone.sqlite.tmp" "$DEST/drone.sqlite"
+
+date --iso-8601=seconds > "$DEST/LAST_DUMP"

tasks/backup/aurbis-dump.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Dump application databases for the aurbis backup
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/aurbis-dump
+Nice=10
+IOSchedulingClass=idle

tasks/backup/aurbis-dump.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Daily application database dump for the aurbis backup
+
+[Timer]
+OnCalendar=*-*-* 03:00
+RandomizedDelaySec=15m
+Persistent=true
+
+[Install]
+WantedBy=timers.target

tasks/backup/backup-rsync-shell

@@ -0,0 +1,11 @@
+#!/bin/bash
+# only allow read-only rsync, BUT elevated so all application data is readable.
+case "$SSH_ORIGINAL_COMMAND" in
+    "rsync --server --sender "*)
+        exec sudo /usr/bin/rsync ${SSH_ORIGINAL_COMMAND#rsync }
+        ;;
+    *)
+        echo "backup key only permits read-only rsync" >&2
+        exit 1
+        ;;
+esac

tasks/backup_pull.yml

@@ -0,0 +1,48 @@
+- name: Ensure rsync is installed
+  package:
+    name: rsync
+    state: present
+
+- name: Create backup root
+  file:
+    path: "{{ backup_root }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: Generate pull ssh key
+  command:
+    cmd: ssh-keygen -t ed25519 -N "" -C aurbis-backup-pull -f {{ backup_key_path }}
+    creates: "{{ backup_key_path }}"
+
+- name: Read pull public key
+  slurp:
+    src: "{{ backup_key_path }}.pub"
+  register: backup_pubkey_slurp
+
+- name: Export public key as fact for the source hosts
+  set_fact:
+    aurbis_backup_pubkey: "{{ backup_pubkey_slurp.content | b64decode | trim }}"
+
+- name: Install pull script
+  template:
+    src: backup/aurbis-backup-pull.sh.j2
+    dest: /usr/local/bin/aurbis-backup-pull
+    mode: "0750"
+
+- name: Install pull service and timer
+  copy:
+    src: "backup/{{ item }}"
+    dest: /etc/systemd/system/
+    mode: "0644"
+  with_items:
+    - aurbis-backup-pull.service
+    - aurbis-backup-pull.timer
+
+- name: Enable pull timer
+  systemd:
+    name: aurbis-backup-pull.timer
+    enabled: yes
+    state: started
+    daemon_reload: yes

tasks/backup_source.yml

@@ -0,0 +1,55 @@
+# daily DB dumps into {{ backup_dump_dir }}
+# read-only rsync access for the backup host's pull key (user `backup`)
+- name: Resolve the backup pull public key from the backup host
+  when: aurbis_backup_pubkey is not defined
+  block:
+    - name: Read the pull public key
+      slurp:
+        src: "{{ hostvars[groups['backup'][0]].backup_key_path }}.pub"
+      delegate_to: "{{ groups['backup'][0] }}"
+      register: _pull_pubkey
+    - name: Set the pull pubkey fact
+      set_fact:
+        aurbis_backup_pubkey: "{{ _pull_pubkey.content | b64decode | trim }}"
+
+- name: Install database dump script
+  template:
+    src: "backup/aurbis-dump-{{ inventory_hostname }}.sh.j2"
+    dest: /usr/local/bin/aurbis-dump
+    mode: "0750"
+
+- name: Install dump service and timer
+  copy:
+    src: "backup/{{ item }}"
+    dest: /etc/systemd/system/
+    mode: "0644"
+  with_items:
+    - aurbis-dump.service
+    - aurbis-dump.timer
+
+- name: Enable dump timer
+  systemd:
+    name: aurbis-dump.timer
+    enabled: yes
+    state: started
+    daemon_reload: yes
+
+- name: Install read-only rsync wrapper for the backup user
+  copy:
+    src: backup/backup-rsync-shell
+    dest: /usr/local/bin/backup-rsync-shell
+    mode: "0755"
+
+- name: Allow backup user to run read-only rsync as root
+  community.general.sudoers:
+    name: backup-rsync
+    state: present
+    user: backup
+    commands: /usr/bin/rsync --server --sender *
+
+- name: Authorize the backup host's pull key (forced read-only rsync)
+  ansible.posix.authorized_key:
+    user: backup
+    state: present
+    key: "{{ aurbis_backup_pubkey }}"
+    key_options: 'command="/usr/local/bin/backup-rsync-shell",restrict'

tasks/cloud_nginx.yml

@@ -0,0 +1,41 @@
+# Reverse proxy for all cloud services.
+# the vhosts serve https using certs in /etc/letsencrypt
+- name: Install nginx (+certbot when TLS is on)
+  package:
+    name: "{{ ['nginx', 'certbot'] if cloud_nginx_tls | default(false) else ['nginx'] }}"
+    state: present
+
+- name: Create ACME webroot
+  file:
+    path: /var/www/letsencrypt
+    state: directory
+    mode: "0755"
+  when: cloud_nginx_tls | default(false)
+
+- name: Template vhosts
+  template:
+    src: cloud_nginx/vhost.conf.j2
+    dest: "/etc/nginx/sites-available/{{ item.name }}"
+    mode: "0644"
+  loop: "{{ cloud_nginx_sites }}"
+  notify: reload nginx
+
+- name: Enable vhosts
+  file:
+    src: "/etc/nginx/sites-available/{{ item.name }}"
+    dest: "/etc/nginx/sites-enabled/{{ item.name }}"
+    state: link
+  loop: "{{ cloud_nginx_sites }}"
+  notify: reload nginx
+
+- name: Disable default site
+  file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+  notify: reload nginx
+
+- name: Enable nginx
+  systemd:
+    name: nginx
+    enabled: yes
+    state: started

tasks/cloud_nginx/vhost.conf.j2

@@ -0,0 +1,51 @@
+# {{ ansible_managed }}
+{% if cloud_nginx_tls | default(false) %}
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ item.server_name }};
+    # ACME http-01 renewals keep working over plain http
+    location /.well-known/acme-challenge/ { root /var/www/letsencrypt; }
+    location / { return 301 https://$host$request_uri; }
+}
+{% endif %}
+
+server {
+{% if cloud_nginx_tls | default(false) %}
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    ssl_certificate /etc/letsencrypt/live/{{ item.server_name }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ item.server_name }}/privkey.pem;
+{% else %}
+    listen 80;
+    listen [::]:80;
+{% endif %}
+    server_name {{ item.server_name }};
+
+    client_max_body_size {{ item.max_body | default('512m') }};
+
+{% if item.root is defined %}
+    root {{ item.root }};
+    index index.html index.htm;
+{% else %}
+    location / {
+        proxy_pass http://127.0.0.1:{{ item.port }};
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_read_timeout 300s;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+{% endif %}
+{% if item.name == 'nextcloud' %}
+
+    # Nextcloud service discovery
+    location = /.well-known/carddav { return 301 /remote.php/dav/; }
+    location = /.well-known/caldav  { return 301 /remote.php/dav/; }
+{% endif %}
+}

tasks/create_users.yml

@@ -6,7 +6,6 @@
       - sudo
       - wheel
     append: true
-    shell: /bin/bash
     state: present
   when: users is defined
   loop: "{{ users }}"

tasks/docker_service.yml

@@ -16,7 +16,7 @@
         src: "{{ service_name }}/docker-compose.yml.j2"
         dest: "/opt/{{ service_name }}/docker-compose.yml"
         group: "{{ service_group | default('aurbis') }}"
-        mode: "0775"
+        mode: "0664"
     - name: Start docker service
       community.docker.docker_compose_v2:
         project_src: "/opt/{{ service_name }}"

tasks/gitea.yml

@@ -0,0 +1,32 @@
+# Git-over-ssh stays on the host sshd port 22
+# ("SSH container passthrough" in gitea docs)
+- name: Create gitea group (gid must match compose USER_GID)
+  group:
+    name: gitea
+    gid: 2222
+- name: Create gitea passthrough user (uid must match compose USER_UID)
+  user:
+    name: gitea
+    uid: 2222
+    group: gitea
+    groups: docker # for the docker exec
+    append: true
+    home: /opt/gitea/data/git # holds .ssh/authorized_keys
+    create_home: false
+    shell: /bin/bash # standard sh doesn't work
+    password_lock: true
+- name: Install gitea ssh passthrough shim
+  copy:
+    dest: /usr/local/bin/gitea
+    mode: "0755"
+    content: |
+      #!/bin/sh
+      # Managed by ansible, see tasks/gitea.yml.
+      exec /usr/bin/docker exec -i -u gitea \
+        -e SSH_ORIGINAL_COMMAND="$SSH_ORIGINAL_COMMAND" \
+        -e GITEA_CUSTOM=/data/gitea \
+        gitea-gitea-1 /usr/local/bin/gitea "$@"
+- name: Deploy Gitea
+  include_tasks: tasks/docker_service.yml
+  vars:
+    service_name: gitea

tasks/gitea/docker-compose.yml.j2

@@ -0,0 +1,39 @@
+# Git-over-ssh stays on the host sshd port 22 via passthrough
+services:
+  db:
+    image: mariadb:11.8
+    restart: unless-stopped
+    environment:
+      MARIADB_DATABASE: gitea
+      MARIADB_USER: gitea
+      MARIADB_PASSWORD: "{{ gitea_db_password }}"
+      MARIADB_RANDOM_ROOT_PASSWORD: 1
+    volumes:
+      - db:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 10s
+      retries: 12
+  gitea:
+    image: docker.gitea.com/gitea:1.26.4
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      # Match the host "gitea" passthrough user (tasks/gitea.yml)
+      # for access to authorized_keys
+      USER_UID: 2222
+      USER_GID: 2222
+      # Must match RUN_USER in data/gitea/conf/app.ini.
+      USER: gitea
+    ports:
+      - "127.0.0.1:8083:3000"
+      - "127.0.0.1:2222:22"
+    volumes:
+      - ./data:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+
+volumes:
+  db:

tasks/gitea/vault.yml

@@ -0,0 +1,8 @@
+$ANSIBLE_VAULT;1.1;AES256
+38636231623835373231353663356664626532653632623064323361316330653838373637646261
+6164313264623363626236346138303639613666363466310a633563353032646531333339666563
+36353563313934623637646131383231396436393138333537396138393834376532336630326366
+3633396139613661380a393431356635663136633131633836616630306131333231316436663432
+39326232383262363936333134313862393265383266303137616537623032616437623735643734
+36646231343438383566366230616365623638643132383533643731633535326535623765336664
+303661616561333336306165633932353765

tasks/hdwiki.yml

@@ -0,0 +1,4 @@
+- name: Deploy HD MediaWiki
+  include_tasks: tasks/docker_service.yml
+  vars:
+    service_name: hdwiki

tasks/hdwiki/docker-compose.yml.j2

@@ -0,0 +1,42 @@
+services:
+  db:
+    image: mariadb:11.8
+    restart: unless-stopped
+    environment:
+      MARIADB_DATABASE: mediawikidb
+      MARIADB_USER: mediawiki
+      MARIADB_PASSWORD: "{{ hdwiki_db_password }}"
+      MARIADB_RANDOM_ROOT_PASSWORD: 1
+    volumes:
+      - db:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 10s
+      retries: 12
+  mediawiki:
+    # ffmpeg added for TimedMediaHandler
+    build:
+      context: .
+      dockerfile_inline: |
+        FROM mediawiki:1.45.4
+        RUN apt-get update \
+          && apt-get install -y --no-install-recommends ffmpeg \
+          && rm -rf /var/lib/apt/lists/*
+        # mediawiki image ships no php.ini, leaving display_errors=On
+        RUN cp /usr/local/etc/php/php.ini-production /usr/local/etc/php/php.ini
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    ports:
+      - "127.0.0.1:8082:80"
+    volumes:
+      - ./images:/var/www/html/images
+      - ./LocalSettings.php:/var/www/html/LocalSettings.php:ro
+      # Extension volumes:
+      - ./extensions-1.45/TimedMediaHandler:/var/www/html/extensions/TimedMediaHandler
+      - ./extensions-1.45/PluggableAuth:/var/www/html/extensions/PluggableAuth
+      - ./extensions-1.45/OpenIDConnect:/var/www/html/extensions/OpenIDConnect
+
+volumes:
+  db:

tasks/hdwiki/vault.yml

@@ -0,0 +1,8 @@
+$ANSIBLE_VAULT;1.1;AES256
+61376366643562623839396662336136653036353930323864646330633535633935393936366133
+3935633032356364376335363865353662303561626362300a656362323464636331666164333037
+34313065633861653036613265336464333935613164356462336533373534386234653765393932
+6536303464313235340a336138613863666662316231306365366131326339646466626631613430
+36643564333135353834346534313533373566623838363538306437643766626630633461313136
+32346132306165353134356439306232643436623333613533633765633039333764383331383530
+663431346261346363323132356165656462

tasks/install_docker_debian.yml

@@ -3,6 +3,7 @@
     name:
       - ca-certificates
       - curl
+      - gnupg # not present on minimal Debian 13
     state: latest
     update_cache: true
 - name: Create /etc/apt/keyrings directory

tasks/jellyfin/docker-compose.yml.j2

@@ -14,6 +14,10 @@ services:
         source: /mnt/azura
         target: /media
         read_only: true
+      - type: bind
+        source: ./local
+        target: /media2
+        read_only: true
     devices:
       - /dev/dri:/dev/dri
     restart: 'unless-stopped'

tasks/mediawiki.yml

@@ -1,4 +0,0 @@
-- name: Deploy MediaWiki
-  include_tasks: tasks/docker_service.yml
-  vars:
-    service_name: mediawiki

tasks/mediawiki/docker-compose.yml.j2

@@ -1,43 +0,0 @@
-services:
-  db:
-    image: mariadb:11
-    environment:
-      MARIADB_USER: wiki
-      MARIADB_PASSWORD: {{ mediawiki_db_password }}
-      MARIADB_DATABASE: wiki
-      MARIADB_RANDOM_ROOT_PASSWORD: 1
-    restart: unless-stopped
-    volumes:
-      - ./mysql/conf.d:/etc/mysql/conf.d
-  mediawiki:
-    image: mediawiki
-    restart: always
-    depends_on:
-      - db
-    volumes:
-      - images:/var/www/html/images
-      - ./LocalSettings.php:/var/www/html/LocalSettings.php
-    networks:
-      - proxy
-networks:
-  proxy:
-    external: true
-      # After initial setup, download LocalSettings.php to the same directory as
-      # this yaml and uncomment the following line and use compose to restart
-      # the mediawiki service
-  # This key also defines the name of the database host used during setup instead of the default "localhost"
-  # database:
-  #   image: mariadb
-  #   restart: always
-  #   environment:
-  #     # @see https://phabricator.wikimedia.org/source/mediawiki/browse/master/includes/DefaultSettings.php
-  #     MYSQL_DATABASE: my_wiki
-  #     MYSQL_USER: wikiuser
-  #     MYSQL_PASSWORD: example
-  #     MYSQL_RANDOM_ROOT_PASSWORD: 'yes'
-  #   volumes:
-  #     - db:/var/lib/mysql
-
-volumes:
-  images:
-#   db:

tasks/mediawiki/vault.yml

@@ -1,8 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-34373261306661343338643437303430616236646361383332333564323861633830353338643762
-6438396639613866666336353838313632336262336261310a343335303464616266303863636232
-30373831623835346337646137356634313832663239326531386432633063373636623962343139
-3865363861646634660a393236623237656239616366313931663464336139326333643865356264
-39386138636332636161643535386164313266303764373362366431613733646633343865363930
-39623362613434316430343664343565653537343436393633393332343032623662353962366362
-316433386639326262353539303833356134

tasks/nextcloud.yml

@@ -0,0 +1,4 @@
+- name: Deploy Nextcloud
+  include_tasks: tasks/docker_service.yml
+  vars:
+    service_name: nextcloud

tasks/nextcloud/docker-compose.yml.j2

@@ -0,0 +1,53 @@
+services:
+  db:
+    image: mariadb:11.8
+    restart: unless-stopped
+    command: --transaction-isolation=READ-COMMITTED
+    environment:
+      MARIADB_DATABASE: nextcloud
+      MARIADB_USER: nextcloud
+      MARIADB_PASSWORD: "{{ nextcloud_db_password }}"
+      MARIADB_RANDOM_ROOT_PASSWORD: 1
+    volumes:
+      - db:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 10s
+      retries: 12
+  redis:
+    image: redis:alpine
+    restart: unless-stopped
+  nextcloud:
+    image: nextcloud:34.0.1-apache
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    ports:
+      - "127.0.0.1:8081:80"
+    volumes:
+      - html:/var/www/html
+      - /var/nextcloud:/var/nextcloud
+      - /opt/nightingale/songs:/karaoke
+    environment:
+      TRUSTED_PROXIES: "172.16.0.0/12"
+      APACHE_DISABLE_REWRITE_IP: 1
+  cron:
+    image: nextcloud:34.0.1-apache
+    restart: unless-stopped
+    entrypoint: /cron.sh
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    volumes:
+      - html:/var/www/html
+      - /var/nextcloud:/var/nextcloud
+      - /opt/nightingale/songs:/karaoke
+
+volumes:
+  db:
+  html:

tasks/nextcloud/vault.yml

@@ -0,0 +1,8 @@
+$ANSIBLE_VAULT;1.1;AES256
+32386635343938666234396638643362313132333261366139326466633332386336656232353434
+3631396261346166373435616436303738323563616265610a353064643636363161306565393566
+63336231376663303437303565383463323463376563356533303333663734653730373731393932
+3139346639613732630a376463343931363330316430313833316137383066343831323564333638
+30636130353266306438333538623161306432613631313035376537623961316433363333623335
+31663238326666326630313562343062313166643535303736343335623031303635623636613366
+646463656333366161626336386466613465

tasks/nightingale.yml

@@ -0,0 +1,29 @@
+- name: Create nightingale directory
+  file:
+    path: /opt/nightingale
+    state: directory
+    owner: root
+    group: aurbis
+    mode: "0775"
+
+# Song library. Read-only for nightingale.
+# Keep this in sync with the /karaoke mount in nextcloud
+# TODO: Maybe make this a configurable non-dependency
+- name: Create nightingale songs dir (writable by nextcloud's www-data)
+  file:
+    path: /opt/nightingale/songs
+    state: directory
+    owner: root
+    group: www-data
+    mode: "02775"
+
+- name: Template nightingale compose
+  template:
+    src: nightingale/docker-compose.yml.j2
+    dest: /opt/nightingale/docker-compose.yml
+    group: aurbis
+    mode: "0664"
+
+- name: Start nightingale
+  community.docker.docker_compose_v2:
+    project_src: /opt/nightingale

tasks/nightingale/docker-compose.yml.j2

@@ -0,0 +1,16 @@
+# {{ ansible_managed }}
+# CPU-only prebuilt image
+services:
+  nightingale:
+    image: razzaru/nightingale:latest
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:8087:8080"
+    volumes:
+      - data:/data
+      - ./songs:/songs:ro
+    environment:
+      NIGHTINGALE_LIBRARY_PATH: /songs
+
+volumes:
+  data:

tasks/nocturnal_smb.yml

@@ -1,22 +0,0 @@
-- name: Get aurbis group gid
-  getent:
-    database: group
-    key: aurbis
-- name: Mount (1)
-  ansible.posix.mount:
-    #src: //{{ hostvars['nocturnal']['ansible_host']}}/nocturnal
-    src: //{{ hostvars['nocturnal']['internal_ip'] | default(hostvars['nocturnal']['ansible_host']) }}/nocturnal
-    path: /mnt/nocturnal/share
-    state: mounted
-    opts: "_netdev,username={{ nocturnal_smb_username }},password={{ nocturnal_smb_password }},file_mode=0775,dir_mode=0775,uid=0,gid={{ getent_group['aurbis'][1] }}"
-    fstype: cifs
-  when: inventory_hostname != 'nocturnal'
-- name: Mount (2)
-  ansible.posix.mount:
-    #src: //{{ hostvars['nocturnal']['ansible_host']}}/nocturnalocal
-    src: //{{ hostvars['nocturnal']['internal_ip'] | default(hostvars['nocturnal']['ansible_host']) }}/nocturnalocal
-    path: /mnt/nocturnal/local
-    state: mounted
-    opts: "_netdev,username={{ nocturnal_smb_username }},password={{ nocturnal_smb_password }},file_mode=0775,dir_mode=0775,uid=0,gid={{ getent_group['aurbis'][1] }}"
-    fstype: cifs
-  when: inventory_hostname != 'nocturnal'

tasks/pihole.yml

@@ -1,18 +0,0 @@
-- name: Pi-hole
-  include_vars:
-    file: pihole/vault.yml
-- name: Create /opt/pihole directory
-  file:
-    path: "/opt/pihole"
-    state: directory
-    owner: root
-    group: aurbis
-    mode: "0755"
-- name: Copy docker-compose file
-  template:
-    src: pihole/docker-compose.yml.j2
-    dest: /opt/pihole/docker-compose.yml
-    group: aurbis
-- name: Go go gadget pihole
-  community.docker.docker_compose_v2:
-    project_src: /opt/pihole

tasks/pihole/docker-compose.yml.j2

@@ -1,17 +0,0 @@
-# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
-services:
-  pihole:
-    container_name: pihole
-    image: pihole/pihole:latest
-    ports:
-      - "53:53/tcp"
-      - "53:53/udp"
-      - "80:80/tcp"
-    environment:
-      TZ: "Europe/Amsterdam"
-      WEBPASSWORD: "{{ pihole_password }}"
-      WEBTHEME: "default-dark"
-    volumes:
-      - "./etc-pihole:/etc/pihole"
-      - "./etc-dnsmasq.d:/etc/dnsmasq.d"
-    restart: unless-stopped

tasks/pihole/vault.yml

@@ -1,6 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-39636161643531383438646638376437613630663932623366366132346662303266313834643835
-3537373030666638313833623765336335386135363036610a316231333431666639316139663738
-31336539366161323162373736626534323432333663363534336565353763653363353365396266
-3935663537303165640a393334306565383730663934653536393839313437313330623438636564
-63363234336365616639613236336233333739383264383762343462316564316434

tasks/stroopwafel.yml

@@ -0,0 +1,41 @@
+# Pulling needs to have git access; root does not.
+- name: Include stroopwafel vault
+  include_vars:
+    dir: stroopwafel
+    files_matching: vault.yml
+- name: Create stroopwafel directory
+  file:
+    path: "{{ stroopwafel_dir }}"
+    state: directory
+    owner: root
+    group: "{{ service_group | default('aurbis') }}"
+    mode: "0775"
+- name: Check out stroopwafel source
+  ansible.builtin.git:
+    repo: "{{ stroopwafel_repo }}"
+    dest: "{{ stroopwafel_dir }}"
+    version: "{{ stroopwafel_version }}"
+    update: "{{ stroopwafel_update | default(false) }}"
+    accept_hostkey: true
+    force: false
+  become_user: "{{ stroopwafel_git_user | default(omit) }}"
+- name: Deploy stroopwafel .env
+  copy:
+    content: "{{ stroopwafel_env_b64 | b64decode }}"
+    dest: "{{ stroopwafel_dir }}/.env"
+    owner: root
+    group: "{{ service_group | default('aurbis') }}"
+    mode: "0640"
+  when: stroopwafel_env_b64 is defined
+  no_log: true
+- name: Copy docker-compose file
+  template:
+    src: stroopwafel/docker-compose.yml.j2
+    dest: "{{ stroopwafel_dir }}/docker-compose.yml"
+    owner: root
+    group: "{{ service_group | default('aurbis') }}"
+    mode: "0664"
+- name: Start stroopwafel
+  community.docker.docker_compose_v2:
+    project_src: "{{ stroopwafel_dir }}"
+    build: policy

tasks/stroopwafel/docker-compose.yml.j2

@@ -0,0 +1,7 @@
+services:
+  stroopwafel:
+    build: .
+    command: python Stroopwafel.py
+    restart: unless-stopped
+    volumes:
+      - .:/opt/stroopwafel

tasks/wikijs.yml

@@ -1,18 +0,0 @@
-- name: Wiki.js
-  include_vars:
-    file: wikijs/vault.yml
-- name: Create /opt/wikijs directory
-  file:
-    path: "/opt/wikijs"
-    state: directory
-    owner: root
-    group: aurbis
-    mode: "0755"
-- name: Copy docker-compose file
-  template:
-    src: wikijs/docker-compose.yml.j2
-    dest: /opt/wikijs/docker-compose.yml
-    group: aurbis
-- name: Go go gadget wiki.js
-  community.docker.docker_compose_v2:
-    project_src: /opt/wikijs

tasks/wikijs/docker-compose.yml.j2

@@ -1,35 +0,0 @@
-services:
-  db:
-    image: mariadb:11
-    environment:
-      MARIADB_USER: wiki
-      MARIADB_PASSWORD: {{ wikijs_db_password }}
-      MARIADB_DATABASE: wiki
-      MARIADB_RANDOM_ROOT_PASSWORD: 1
-    restart: unless-stopped
-    volumes:
-      - ./mysql/conf.d:/etc/mysql/conf.d
-  phpmyadmin:
-    image: phpmyadmin:latest
-    restart: always
-    ports:
-      - 8080:80
-    environment:
-      - PMA_HOST=db
-  wiki:
-    image: requarks/wiki:2
-    depends_on:
-      - db
-    environment:
-      DB_TYPE: mariadb
-      DB_HOST: db
-      DB_PORT: 3306
-      DB_USER: wiki
-      DB_PASS: {{ wikijs_db_password }}
-      DB_NAME: wiki
-    restart: unless-stopped
-    ports:
-      - 3004:3000
-
-# volumes:
-#   db-data:

tasks/wikijs/vault.yml

@@ -1,7 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-63353939373666343366396161306662333730323765353536383961626234356332343439643065
-6138626461343764376161323135346666326230313965300a366163656564353437626434306163
-31393832323134653630663334303733616534303632376138383630336366313733323064313334
-6333313539346564610a666639643133393238653237636165353565333233356630303464333236
-36663437393835346134393735316666663031396333663636663339643733613762646165626662
-3264343864396233633631613534313563633466626331373162

tasks/zsh.yml

@@ -5,17 +5,21 @@
       - zsh-syntax-highlighting
       - fzf
     state: present
-- name: Create .config/zsh directory
+- name: Create .config and .config/zsh directories
   file:
-    path: "/home/{{ item }}/.config/zsh"
+    path: "/home/{{ item.0 }}/{{ item.1 }}"
     state: directory
+    owner: "{{ item.0 }}"
+    group: "{{ item.0 }}"
     mode: "0755"
-  loop: "{{ users }}"
+  loop: "{{ users | product(['.config', '.config/zsh']) | list }}"
   when: users is defined
 - name: Copy .zshenv
   copy:
     src: zsh/.zshenv
     dest: "/home/{{ item }}/.zshenv"
+    owner: "{{ item }}"
+    group: "{{ item }}"
     mode: "0644"
   loop: "{{ users }}"
   when: users is defined
@@ -23,6 +27,8 @@
   copy:
     src: zsh/.zshrc
     dest: "/home/{{ item }}/.config/zsh/.zshrc"
+    owner: "{{ item }}"
+    group: "{{ item }}"
     mode: "0644"
   loop: "{{ users }}"
   when: users is defined
@@ -30,6 +36,8 @@
   copy:
     src: zsh/.aliasrc
     dest: "/home/{{ item }}/.config/zsh/.aliasrc"
+    owner: "{{ item }}"
+    group: "{{ item }}"
     mode: "0644"
   loop: "{{ users }}"
   when: users is defined

vault/nocturnal.yml

@@ -1,9 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-62343164653332363039613065656238616461626663383262373132623432333263323138633834
-3231626235323039316539326138643339643565303934610a393864623132336134393734326263
-65623338663837353032373732393935316661333965376266323835316630393734666234323835
-6232666333613630660a666464626661646339306230303631653431303765353764623663646636
-30616462613831363364306334616262323865613333383631346334393937383332396232336563
-30313361346438666365366633613062343964616233303130396436313862363264366637366630
-35613161383232626336343133626239346264626135366265343838643164613761656262356261
-61353761333833343965