phil/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: implement comprehensive variable management system

Browse Source 
- Create standardized group_vars directory structure
- Add domains.yml with centralized subdomain mappings
- Add infrastructure.yml with network, SMTP, and path config
- Reorganize vault.yml secrets by service with consistent naming
- Update 15+ Docker compose templates to use new variable structure
- Simplify playbook commands by removing --extra-vars requirement
- Replace hardcoded domains/IPs with template variables
- Standardize secret references across all services

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Phil
2025-06-06 15:14:47 -06:00
parent 8d686c2aa5
commit 0268e49b4d
21 changed files with 365 additions and 104 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
CLAUDE.md
View File

@@ -28,17 +28,17 @@ ansible-playbook dns.yml -i hosts.yml
### Service Management ### Service Management
```bash ```bash
# Deploy specific services using tags # Deploy specific services using tags
ansible-playbook site.yml -i hosts.yml --tags caddy --vault-password-file vault_pass --extra-vars "@secrets.enc" ansible-playbook site.yml -i hosts.yml --tags caddy --vault-password-file vault_pass
ansible-playbook site.yml -i hosts.yml --tags authentik,gitea --vault-password-file vault_pass --extra-vars "@secrets.enc" ansible-playbook site.yml -i hosts.yml --tags authentik,gitea --vault-password-file vault_pass
ansible-playbook site.yml -i hosts.yml --tags docker --vault-password-file vault_pass --extra-vars "@secrets.enc" # all docker services ansible-playbook site.yml -i hosts.yml --tags docker --vault-password-file vault_pass # all docker services
# Deploy services by category (new organized structure) # Deploy services by category (new organized structure)
ansible-playbook site.yml -i hosts.yml --tags infrastructure --vault-password-file vault_pass --extra-vars "@secrets.enc" ansible-playbook site.yml -i hosts.yml --tags infrastructure --vault-password-file vault_pass
ansible-playbook site.yml -i hosts.yml --tags media,productivity --vault-password-file vault_pass --extra-vars "@secrets.enc" ansible-playbook site.yml -i hosts.yml --tags media,productivity --vault-password-file vault_pass
ansible-playbook site.yml -i hosts.yml --tags development,monitoring --vault-password-file vault_pass --extra-vars "@secrets.enc" ansible-playbook site.yml -i hosts.yml --tags development,monitoring --vault-password-file vault_pass
# Deploy only infrastructure components # Deploy only infrastructure components
ansible-playbook site.yml -i hosts.yml --tags common,cron --vault-password-file vault_pass --extra-vars "@secrets.enc" ansible-playbook site.yml -i hosts.yml --tags common,cron --vault-password-file vault_pass
``` ```
## Architecture ## Architecture

5
bootstrap.yml
View File

@@ -3,11 +3,8 @@
become: true become: true
vars: vars:
created_username: phil created_username: phil
vars_prompt:
- name: tailscale_key
prompt: Enter the tailscale key
roles: roles:
- bootstrap - bootstrap
- role: artis3n.tailscale - role: artis3n.tailscale
vars: vars:
tailscale_authkey: "{{ tailscale_key }}" tailscale_authkey: "{{ vault_infrastructure.tailscale_key }}"

39
group_vars/all/domains.yml Normal file
View File

@@ -0,0 +1,39 @@
# Domain Configuration
primary_domain: "thesatelliteoflove.com"
secondary_domain: "nerder.land"
# Subdomain mappings
subdomains:
auth: "auth.{{ primary_domain }}"
git: "git.{{ primary_domain }}"
cal: "cal.{{ primary_domain }}"
docs: "docs.{{ primary_domain }}"
phlog: "phlog.{{ primary_domain }}" # Ghost blog
bookmarks: "bookmarks.{{ primary_domain }}" # Hoarder/Karakeep
heyform: "forms.{{ secondary_domain }}" # Heyform on nerder.land
media: "media.{{ primary_domain }}"
audio: "audio.{{ primary_domain }}" # Audiobookshelf
books: "books.{{ primary_domain }}" # Calibre
models: "models.{{ primary_domain }}" # Manyfold
pinchflat: "pinchflat.{{ primary_domain }}"
pin: "pin.{{ primary_domain }}" # Pinry
papers: "papers.{{ primary_domain }}" # Paperless-NGX
tasks: "tasks.{{ primary_domain }}" # MMDL
syncthing: "syncthing.{{ primary_domain }}"
loclog: "loclog.{{ primary_domain }}" # Dawarich
pingvin: "pingvin.{{ primary_domain }}"
social: "social.{{ primary_domain }}" # GoToSocial
post: "post.{{ primary_domain }}" # Postiz
home: "home.{{ primary_domain }}" # Glance
watcher: "watcher.{{ primary_domain }}" # Changedetection
appriseapi: "appriseapi.{{ primary_domain }}"
dockge: "dockge.{{ primary_domain }}"
code: "code.{{ primary_domain }}" # Code Server
chat: "chat.{{ primary_domain }}" # Conduit Matrix
# Email domains for notifications
email_domains:
updates: "updates.{{ primary_domain }}"
auth_email: "auth@updates.{{ primary_domain }}"
git_email: "git@updates.{{ primary_domain }}"
cal_email: "cal@updates.{{ primary_domain }}"

22
group_vars/all/infrastructure.yml Normal file
View File

@@ -0,0 +1,22 @@
# Infrastructure Configuration
# Docker configuration
docker:
network_name: "lava"
stacks_path: "/opt/stacks"
hairpin_ip: "172.20.0.5"
# SMTP configuration
smtp:
host: "smtp.resend.com"
username: "resend"
from_domain: "{{ email_domains.updates }}"
# Network configuration
network:
netcup_ip: "152.53.36.98"
docker_host_ip: "100.70.169.99"
# Paths
paths:
stacks: "{{ docker.stacks_path }}"

178
group_vars/all/vault.yml Normal file
View File

@@ -0,0 +1,178 @@
$ANSIBLE_VAULT;1.1;AES256
36656631633631613335386230623438383533396639633766663966636134336662376337646537
3735623737386630386463666563633961303235653962380a623065373135363239633931363365
64303031653865663366363536316265376362623463383133326165353436363062643232356364
3239373332393264630a623736313132306434333936306638393831636636316439396162643636
34356631653265373835636563643631396162396533376430323538613462616535353134383732
31656533633365616566373837633535396636656638313964346164363435303263333766323236
35373965376630323235666562663539326162306436353934326664353264636436663063343932
33383334336637626436383761393232383337303663653264363333323231653166633865326566
63383763336335663932383530303338393937613334666564626136666366656561386231653030
62323734393162373432363834613365616431326162306338303862663865396533643637343236
39343337636239616430396533366362623236616166346364343166393731666364633664633639
39666262323963393562353939396631326237323061396364663834356634353762323735343130
38393462303561373065353034613339613130383534666265626539646465666339336432376334
36346364626363666332303064396161303737383864633933653064623064303837373037346138
32303937346432343038626562386232373633343164643065373833613031616162343432313666
32613935373165643636653064653630366462313462376634323664343938616635666365326431
62343966613361656161616530356564396231616166336363373864653166303534396431313732
33363463613834393266363562346533626435313939373165633430356134343436613662636331
35653866333034633436336130323835303362626238343831316339636135316266336662643136
37633231393334666661303230656336343834643539373238333931316339623338323362343935
33313731383965373930306135623864396162346334393466363435623334643464363163633731
65313964613732336661626465666562643966336363336338633538336535623362376164643938
62313665343434363436363338316433643835666536663734316534663238316264616239333531
62306336393565623233386162333933613430343835616237303837343666623033363132353361
64316135306563313833396437396633633139333963663564643965313232643364386465363438
66393663356663666437663164373664633039653733393361333233663430356233316238666361
66633835623436646362373233326433366533616335396166623833626431376663376138373839
36396162366565343861626233326637313530663666623338653236656232343037343435323439
62383563346230393266336138373763653235343839336536636634303765346463333832323831
36633434663035376465376433343839343534343463353436623664333435333662326661346431
36396463623731363761373264373761383931636338386135366236393434623261613131643165
36613366663830666234393462386530626162623862363430306361373838363336313862313034
34323562636631373766353635666462646533313863323831333136383937353163356436313930
65633832303431386266356566333665303838393363306534623231393035316637346130653064
61373361333366373031646538333661383133376138393431663732353735643061303139653765
30613733636161366465376438636237663361646138323337666463396535346339306230313135
63633731343735663166616533623962343033396266623061373065306638613230653933626537
32396235313134663731616564393837626666613539363531623665353432366564306661373538
30616337323232663462616563366362616264383037356233626232353137386261626235333238
61633935343766326637373632363236383637643064396366353137376137346334346432313439
31326364633739363164386334376432633532643635343734306433636436386239346138376365
61333864373961313565383533343738363537356466396464666363316166653662626430626139
32353063636136643830343161616563663365393439323765323235373966393232623166366335
61303331353232366237613061333863373232373763613130636462633863646137623461383339
64356262393061616562636331636439623365663762313139376163656137393463303065383235
63613331626538613737666234623330623462646639326139346164333365313233326539383963
39346636653962623538643666623261396564613734626533343932643464343762366436383666
36333230386438633435643434386566313835626432663331313231666432306363373530633562
30346563626639353061393764346437666264333635613131356464333530633266643838623933
33613733653264323438333363613737326439393764613238316665313764643835303565663462
36633361653339306335383865663330616265623462613162336132633630353261313462616363
33623261656432636232653961306535343633386466376130343264366662396162666365653231
35343132373865656531646234333763393934333433376563356632313664656331616264313861
61303263373364633663666133616332653665613362356238633865636361653830316462333063
38303634373566313966633865303763666538613966323037656339373837383833326130313037
35653666353864343734646161363061663331306262313764653864356261306465616664393339
31353039636131643961323132643834343030326430343433393034663162303633356666386462
66623166623135653938336532636434613431633366626637306563386434613738383937643937
39636531646139633037386462383261663164653466383739373564633563646164643166336539
30313162356331333538336235306163303366396262313366376531323833373430386162313962
64313265393836343031656339393162313162303835386230313834383030653361363430663532
37613631633232333964333636646636356532653065363639336234303761346435613831343835
62376633643166643437626537346164326133396532393232333365316335393239333230343062
61656534616536373164343064313061366538363961646533623265666663626439333266363466
37336331333333366530636634323938653363643237343465653733656563346532623633636138
38353761383562353434666438646436653033613761383466383962626134366237346530666539
66353837613361313861353631613934376435343765396332353532326439663836333365386234
32396339373765643731303738336330613066386362316538396136346236393630333939343939
34663231363561333836636562666639346463666565613730613837663138333730303330653166
61363763663631653061623333666437346463376264656338363462666130323031306636646532
39343764303432346530666630316330666136346432396439343334333532363165666362356234
64373936316438323230396263393739313665386663656263396335383461643030363463646434
65353633636336623661616466303061376438663636656238343464366664393438633837393538
61636461663930623661336432306237353239306334626430633662623034316635323936303534
33663732613438353832316531353933303236306531393639633566643631356330646365333035
38343933633139643965303864653263663965323465343331323666323239353666346336356134
36623038393533646566303066383566323235396434663939393661356638623663653530366663
65393934373537663265336139303033386631633038656564646438306362633230373930636335
35353833643731373963313563613164383063666335636639656338316437393336323234393239
63326361616161373966303663373537393462633264613639643262393163343363646163373961
33306532636431633436633661333232303231653065653264323961303031316164653366353865
33643437663532313638333661633464373732383838363439623235636261373839663533656362
39373035393664336261643866623531343437666366313938376461646435333731326464613739
39353335643766383162313161393339363465333464663335393830313638656633376466333236
39376534613530336632373662366365343365343438666465343063653632333236343066353562
39613864346634656233326261306231663436666339393762356531656164383531623032626537
62363732343237656230383535343133343437643464663337623735326635353762313133313438
61663339666537386365353335656237316336373732333330616435353461646637363362316637
30343062643863663738373732393236666166336235333637393364376366663136356166333831
35373534656430643030323638663933383766623533393832616461363536343361313336303030
37636432373137346363626264616432373861663739303263393837643565623766313932303337
62353230353065383930366532336336326437376339613933653137326166643532376238383330
64356435386330613262363461623338656565666639386634613538373063323532316638623736
63643461613833306161383237653161353537303036303238323234353934633032656631646139
32633766623434666661366365346638313033613530336164653130646466373362646139333761
65316337373766326262383932373965303532353133303331653965313136323364323230663566
62323866366537343862343533373734383839326261383938313066643934626562663334643135
36666435373138656562613335666230333534323432303932613364316666326239313230326230
65653236353761306232346537653431306264353464633765346366336236396263363332383062
30323035336165636236656262323231383539323166346534373532613439386466633039333338
31626432366363306264626233306261613634343333366563623738336637643836343434306462
30626535386230623838633430393466386561663062366439303337643536316237343738643331
38616533653030363132356134356461366365633337646632663266333865313733376335333364
66303135643932656265626164373264303263363534303161306366393835313663636164346133
33383362653764303637343531626362336632613532313662303864626235626638653136366665
65306530306462613937353631363931626261333634626665663739333562313536353938313134
37343833653764663035313433633931303639656166636232353937346530373365376536616432
39353933346532383730663637633964656535333034643832306365306432396463316538313731
38323837653936323231306438383136373232663437646135326134633266613237393639613339
31633633666361356366376635643631353938343861666531383664343236366661313530316166
66313637626665626136613732323237396231316633666264613130613032666362313566653565
30363333313933393835636431653931383031636138376662326437333435323035666661646666
61636665613839346530623464326135643834313533323032643335636663623265326162323766
37333233313962396138336665393438313937383731343739626134643230393766303662386131
32623336303736653736353438623561613061306130383535303836643138613931373336626565
34643533393936336262633239376135356632613061633962633762356637303032643435346263
64356132666636636262363864303236623263343833643134656433646134356439646665323365
65333733636330323766616539626635303364376431396531633131366333636636626339303363
31613836363531653034346530333236313531363737356538313931316130323631376164396438
66306563333561636133613462336331376363303431343761633265346338663836643337633137
36383064383862636363303562353861643065613564646661633130623763303637343066373763
35376136383438316233303936613637393230613339343932393533653661326164643430356535
37373834646437613539343437316639663665656565633836653532346532636466616530383036
38373035356665643863323666376337653930626663636631396662356165663734353539373464
36393138613063326130623266356431663839636266623830306136653530623035623562613763
31643038323332666632323433646139643766363737656262336334336538343066663438393261
37626438386130323566356231656434326336333631643334303764343535306265633438353366
62633363363762643331623165316265376363366639303532373236313961333462343362653565
64313061376261356438316638653633376231363830303137316663666661663539323932396531
30373738356330343336623731353030303434393739613531303034313136353164363962663538
65646432346265393938656162313835326337653431326133343632633265376663303032636539
62623932383462356134316637373832303863653733383133616138303264633165313461353139
63326138366530363930333337333939663763633764646437616438383239313433323463393734
63363339636536323561363062653238373133306661626235396234383138346137653161316238
36333235663063356636363737663862323061326335383738383133386161393835393462656136
38633635343561303634393430393738613330303535363561333739373963313930396263373535
65396333386662663065656331643330386633643835323365363133396364646130666131666339
63626166366662383531623830626664656239333562323166366431663661646331326432656537
32643137666662313738373863303239336638363266623561636561333261613131383134343533
64386362666235643734393738343036313664333539376166396132333131636538653030643136
38646331363633383332313937323535396564303336303531316339383130653734623633626534
62346136346533373037663632353836343332346233386634663534303133393964346139336130
64643662613332306363643139653135323633613635303065336636636333376562366665373163
65376338313264316464636162313337363439366165336137613235313466633638393836366265
62333134393038653133383366626637313066393863303663303539643462633264653837393232
30376331306662393431613135613366616537393162663266653034656661633236323566623963
32313465333539333562363639663162393835373739366134363536393035616231376138373261
39316366393562303566366533336563313937373864643732613266653239353335363031376362
62623236346232333466613264303434653430636137386637303765303031666230303630323430
37363331396163643963346637616665343366313736646437313234323132356565623730323334
64613330656637326633306266373537613437366133393031656239316465636531623464323034
32373237623864303437616363613063663233663864393462613433616333396431653563373338
32663832396231313633316262343832653439653230316565663635376565393265356563356561
37316432303839336533643761626635353935313632333065373063386635363934326431646535
65353965363562653637646137383366636463336632376230373330333233393234656636363139
63613633313834356236666638623764396164633466336164346139643631316234666434316663
30626262353738313264636565626664363039356136306361626466356461656331336430643335
61613363363837383430623765343863386331323437383235393933653237373465383066393439
62613562356537616133613034663963626662333638353639396432656539633466303437393436
33396330663133623961376462316630363431306436386137313238303431393734636262323335
39386234323734313530363564303331623864616537346335633736376665636132376230386234
35623733663362343165653330626635306330396237323861313530636465336437306262343238
63373237303337316562633065633533383163373034373734346562363531393334336239306139
65636362653238356439643038376362356338326235373337313930633337316565376131326231
34313866336265666133643965383765343366643034373334343331373363663736643638313033
35396239396537343230376466386133313365323732333063663066393331336133313035383064
33633734633836613431636166666232663037626131313834336264636438303435633434646638
64366463616365643864396533663061346262303631386134653465653933353437343134363361
34626431643438633638333566306563396337336533653532633961336635623231393431306232
32613831653762616264303939636264633931316432613138653039366331323739393431656263
33623138383161646134633666623366366361373836666138633837393961623566356266663661
33353437363334373135323835333163363939393765636264333039623663633632363533356537
63303638656235653739326432363164343236343430636436626232313864396565363066656135
38386535636231386166633635333837643630383765346333626136623362366232643065313938
31613537386262336661633637666639626332343532653839313134656338343531383466616230
63313036646533376639336439366539346132373939386634656235323836633630333265386165
39623637306562626534353930633361323532636361393562353931336661373531

25
group_vars/docker/services.yml Normal file
View File

@@ -0,0 +1,25 @@
# Docker Services Configuration
# Service categories for organization
service_categories:
infrastructure: ["caddy", "authentik", "dockge"]
development: ["gitea", "codeserver", "conduit"]
media: ["audiobookshelf", "calibre", "ghost", "pinchflat", "pinry", "hoarder", "manyfold"]
productivity: ["paperlessngx", "baikal", "syncthing", "mmdl", "heyform", "dawarich", "pingvin"]
communication: ["gotosocial", "postiz"]
monitoring: ["glance", "changedetection", "appriseapi"]
# Common service configuration
services:
common:
restart_policy: "unless-stopped"
network: "{{ docker.network_name }}"
# Service-specific configurations
dawarich:
db_name: "dawarich"
db_user: "dawarich"
mmdl:
db_name: "mmdl"
db_user: "mmdl"

6
roles/docker/templates/audiobookshelf-compose.yml.j2
View File

@@ -10,11 +10,11 @@ services:
- TZ=America/Denver - TZ=America/Denver
- DISABLE_SSRF_REQUEST_FILTER=1 - DISABLE_SSRF_REQUEST_FILTER=1
extra_hosts: extra_hosts:
- 'auth.thesatelliteoflove.com:172.20.0.5' - '{{ subdomains.auth }}:172.20.0.5'
labels: labels:
glance.name: Audiobookshelf glance.name: Audiobookshelf
glance.icon: si:audiobookshelf glance.icon: si:audiobookshelf
glance.url: https://audio.thesatelliteoflove.com/ glance.url: https://{{ subdomains.audio }}/
glance.description: Audio book server glance.description: Audio book server
volumes: volumes:
audiobooks: audiobooks:
@@ -28,4 +28,4 @@ volumes:
networks: networks:
default: default:
external: true external: true
name: lava name: {{ docker.network_name }}

12
roles/docker/templates/authentik-env.j2
View File

@@ -1,15 +1,15 @@
PG_PASS={{ authentik_pg_pass }} PG_PASS={{ vault_authentik.postgres_password }}
AUTHENTIK_SECRET_KEY={{ authentik_secret_key }} AUTHENTIK_SECRET_KEY={{ vault_authentik.secret_key }}
# SMTP Host Emails are sent to # SMTP Host Emails are sent to
AUTHENTIK_EMAIL__HOST=smtp.resend.com AUTHENTIK_EMAIL__HOST={{ smtp.host }}
AUTHENTIK_EMAIL__PORT=25 AUTHENTIK_EMAIL__PORT=25
# Optionally authenticate (don't add quotation marks to your password) # Optionally authenticate (don't add quotation marks to your password)
AUTHENTIK_EMAIL__USERNAME=resend AUTHENTIK_EMAIL__USERNAME={{ smtp.username }}
AUTHENTIK_EMAIL__PASSWORD={{ resend_key }} AUTHENTIK_EMAIL__PASSWORD={{ vault_smtp.password }}
# Use StartTLS # Use StartTLS
AUTHENTIK_EMAIL__USE_TLS=true AUTHENTIK_EMAIL__USE_TLS=true
# Use SSL # Use SSL
AUTHENTIK_EMAIL__USE_SSL=false AUTHENTIK_EMAIL__USE_SSL=false
AUTHENTIK_EMAIL__TIMEOUT=10 AUTHENTIK_EMAIL__TIMEOUT=10
# Email address authentik will send from, should have a correct @domain # Email address authentik will send from, should have a correct @domain
AUTHENTIK_EMAIL__FROM=auth@updates.thesatelliteoflove.com AUTHENTIK_EMAIL__FROM=auth@{{ email_domains.updates }}

4
roles/docker/templates/calibre-compose.yml.j2
View File

@@ -16,7 +16,7 @@ services:
labels: labels:
glance.name: Calibre glance.name: Calibre
glance.icon: si:calibreweb glance.icon: si:calibreweb
glance.url: https://books.thesatelliteoflove.com/ glance.url: https://{{ subdomains.books }}/
glance.description: Book server glance.description: Book server
volumes: volumes:
config: config:
@@ -26,4 +26,4 @@ volumes:
networks: networks:
default: default:
external: true external: true
name: lava name: {{ docker.network_name }}

8
roles/docker/templates/changedetection-compose.yml.j2
View File

@@ -5,11 +5,11 @@ services:
container_name: changedetection container_name: changedetection
hostname: changedetection hostname: changedetection
extra_hosts: extra_hosts:
- 'chat.thesatelliteoflove.com:172.20.0.5' - '{{ subdomains.chat }}:172.20.0.5'
labels: labels:
glance.name: Changedetection glance.name: Changedetection
glance.icon: si:watchtower glance.icon: si:watchtower
glance.url: https://watcher.thesatelliteoflove.com/ glance.url: https://{{ subdomains.watcher }}/
glance.description: Changedetection glance.description: Changedetection
glance.id: changedetection glance.id: changedetection
volumes: volumes:
@@ -50,7 +50,7 @@ services:
# - NO_PROXY="localhost,192.168.0.0/24" # - NO_PROXY="localhost,192.168.0.0/24"
# #
# Base URL of your changedetection.io install (Added to the notification alert) # Base URL of your changedetection.io install (Added to the notification alert)
- BASE_URL=https://watcher.thesatelliteoflove.com - BASE_URL=https://{{ subdomains.watcher }}
# Respect proxy_pass type settings, `proxy_set_header Host "localhost";` and `proxy_set_header X-Forwarded-Prefix /app;` # Respect proxy_pass type settings, `proxy_set_header Host "localhost";` and `proxy_set_header X-Forwarded-Prefix /app;`
# More here https://github.com/dgtlmoon/changedetection.io/wiki/Running-changedetection.io-behind-a-reverse-proxy-sub-directory # More here https://github.com/dgtlmoon/changedetection.io/wiki/Running-changedetection.io-behind-a-reverse-proxy-sub-directory
# - USE_X_SETTINGS=1 # - USE_X_SETTINGS=1
@@ -130,4 +130,4 @@ volumes:
networks: networks:
default: default:
external: true external: true
name: lava name: {{ docker.network_name }}

10
roles/docker/templates/dawarich-compose.yml.j2
View File

@@ -10,7 +10,7 @@ services:
- dawarich_db_data:/var/lib/postgresql/data - dawarich_db_data:/var/lib/postgresql/data
environment: environment:
POSTGRES_USER: postgres POSTGRES_USER: postgres
POSTGRES_PASSWORD: {{ dawarich_db_password }} POSTGRES_PASSWORD: {{ vault_dawarich.postgres_password }}
POSTGRES_DB: dawarich_production POSTGRES_DB: dawarich_production
restart: always restart: always
healthcheck: healthcheck:
@@ -25,7 +25,7 @@ services:
labels: labels:
glance.name: Dawarich glance.name: Dawarich
glance.icon: si:openstreetmap glance.icon: si:openstreetmap
glance.url: https://loclog.thesatelliteoflove.com/ glance.url: https://{{ subdomains.loclog }}/
glance.description: Dawarich glance.description: Dawarich
glance.id: dawarich glance.id: dawarich
volumes: volumes:
@@ -45,10 +45,10 @@ services:
DATABASE_HOST: dawarich_db DATABASE_HOST: dawarich_db
DATABASE_PORT: 5432 DATABASE_PORT: 5432
DATABASE_USERNAME: postgres DATABASE_USERNAME: postgres
DATABASE_PASSWORD: {{ dawarich_db_password }} DATABASE_PASSWORD: {{ vault_dawarich.postgres_password }}
DATABASE_NAME: dawarich_production DATABASE_NAME: dawarich_production
MIN_MINUTES_SPENT_IN_CITY: 60 MIN_MINUTES_SPENT_IN_CITY: 60
APPLICATION_HOSTS: loclog.thesatelliteoflove.com,localhost,::1,127.0.0.1 APPLICATION_HOSTS: {{ subdomains.loclog }},localhost,::1,127.0.0.1
TIME_ZONE: America/Denver TIME_ZONE: America/Denver
APPLICATION_PROTOCOL: http APPLICATION_PROTOCOL: http
DISTANCE_UNIT: mi DISTANCE_UNIT: mi
@@ -85,4 +85,4 @@ volumes:
networks: networks:
default: default:
external: true external: true
name: lava name: {{ docker.network_name }}

8
roles/docker/templates/ghost-1-compose.yml.j2
View File

@@ -7,15 +7,15 @@ services:
- database__client=sqlite3 - database__client=sqlite3
- database__connection__filename=/var/lib/ghost/content/data/ghost.db - database__connection__filename=/var/lib/ghost/content/data/ghost.db
- database__useNullAsDefault=true - database__useNullAsDefault=true
- url=https://phlog.thesatelliteoflove.com - url=https://{{ subdomains.phlog }}
volumes: volumes:
- ghost:/var/lib/ghost/content - ghost:/var/lib/ghost/content
extra_hosts: extra_hosts:
- 'phlog.thesatelliteoflove.com:172.20.0.5' - '{{ subdomains.phlog }}:172.20.0.5'
labels: labels:
glance.name: Ghost glance.name: Ghost
glance.icon: si:ghost glance.icon: si:ghost
glance.url: https://phlog.thesatelliteoflove.com/ glance.url: https://{{ subdomains.phlog }}/
glance.description: Photo Blog glance.description: Photo Blog
volumes: volumes:
@@ -24,4 +24,4 @@ volumes:
networks: networks:
default: default:
external: true external: true
name: lava name: {{ docker.network_name }}

24
roles/docker/templates/gitea-compose.yml.j2
View File

@@ -7,17 +7,17 @@ services:
- USER_UID=1000 - USER_UID=1000
- USER_GID=1000 - USER_GID=1000
- GITEA__mailer__ENABLED=true - GITEA__mailer__ENABLED=true
- GITEA__mailer__FROM=git@updates.thesatelliteoflove.com - GITEA__mailer__FROM=git@{{ email_domains.updates }}
- GITEA__mailer__PROTOCOL=smtps - GITEA__mailer__PROTOCOL=smtps
- GITEA__mailer__SMTP_ADDR=smtp.resend.com - GITEA__mailer__SMTP_ADDR={{ smtp.host }}
- GITEA__mailer__SMTP_PORT=465 - GITEA__mailer__SMTP_PORT=465
- GITEA__mailer__USER=resend - GITEA__mailer__USER={{ smtp.username }}
- GITEA__mailer__PASSWD={{ resend_key }} - GITEA__mailer__PASSWD={{ vault_smtp.password }}
restart: unless-stopped restart: unless-stopped
labels: labels:
glance.name: Gitea glance.name: Gitea
glance.icon: si:gitea glance.icon: si:gitea
glance.url: https://git.thesatelliteoflove.com/ glance.url: https://{{ subdomains.git }}/
glance.description: Code repo glance.description: Code repo
glance.id: gitea glance.id: gitea
volumes: volumes:
@@ -27,8 +27,8 @@ services:
ports: ports:
- 222:22 - 222:22
extra_hosts: extra_hosts:
- 'auth.thesatelliteoflove.com:172.20.0.5' - '{{ subdomains.auth }}:{{ docker.hairpin_ip }}'
- 'git.thesatelliteoflove.com:172.20.0.5' - '{{ subdomains.git }}:{{ docker.hairpin_ip }}'
runner: runner:
image: gitea/act_runner:nightly image: gitea/act_runner:nightly
restart: unless-stopped restart: unless-stopped
@@ -37,12 +37,12 @@ services:
environment: environment:
- CONFIG_FILE=/config.yaml - CONFIG_FILE=/config.yaml
- GITEA_INSTANCE_URL=http://gitea:3000 - GITEA_INSTANCE_URL=http://gitea:3000
- GITEA_RUNNER_REGISTRATION_TOKEN={{ gitea_runner_key }} - GITEA_RUNNER_REGISTRATION_TOKEN={{ vault_infrastructure.gitea_runner_key }}
- GITEA_RUNNER_NAME=runner_1 - GITEA_RUNNER_NAME=runner_1
- GITEA_RUNNER_LABELS=docker - GITEA_RUNNER_LABELS=docker
extra_hosts: extra_hosts:
- 'auth.thesatelliteoflove.com:172.20.0.5' - '{{ subdomains.auth }}:{{ docker.hairpin_ip }}'
- 'git.thesatelliteoflove.com:172.20.0.5' - '{{ subdomains.git }}:{{ docker.hairpin_ip }}'
labels: labels:
glance.parent: gitea glance.parent: gitea
glance.name: Worker glance.name: Worker
@@ -50,11 +50,11 @@ services:
- ./runner-config.yaml:/config.yaml - ./runner-config.yaml:/config.yaml
- ./data:/data - ./data:/data
- /var/run/docker.sock:/var/run/docker.sock - /var/run/docker.sock:/var/run/docker.sock
- /opt/stacks/caddy/site:/sites - {{ paths.stacks }}/caddy/site:/sites
volumes: volumes:
gitea: gitea:
driver: local driver: local
networks: networks:
default: default:
external: true external: true
name: lava name: {{ docker.network_name }}

8
roles/docker/templates/glance-compose.yml.j2
View File

@@ -8,16 +8,16 @@ services:
- /var/run/docker.sock:/var/run/docker.sock - /var/run/docker.sock:/var/run/docker.sock
restart: unless-stopped restart: unless-stopped
extra_hosts: extra_hosts:
- 'thesatelliteoflove.com:172.20.0.5' - '{{ primary_domain }}:172.20.0.5'
- 'watcher.thesatelliteoflove.com:172.20.0.5' - '{{ subdomains.watcher }}:172.20.0.5'
labels: labels:
glance.name: Glance glance.name: Glance
glance.icon: si:homepage glance.icon: si:homepage
glance.url: https://home.thesatelliteoflove.com/ glance.url: https://{{ subdomains.home }}/
glance.description: Homepage app glance.description: Homepage app
glance.id: glance glance.id: glance
networks: networks:
default: default:
external: true external: true
name: lava name: {{ docker.network_name }}

30
roles/docker/templates/gotosocial-compose.yml.j2
View File

@@ -4,28 +4,28 @@ services:
container_name: gotosocial container_name: gotosocial
user: 1000:1000 user: 1000:1000
extra_hosts: extra_hosts:
- 'auth.thesatelliteoflove.com:172.20.0.5' - '{{ subdomains.auth }}:{{ docker.hairpin_ip }}'
environment: environment:
GTS_HOST: social.thesatelliteoflove.com GTS_HOST: {{ subdomains.social }}
GTS_DB_TYPE: sqlite GTS_DB_TYPE: sqlite
GTS_DB_ADDRESS: /gotosocial/storage/sqlite.db GTS_DB_ADDRESS: /gotosocial/storage/sqlite.db
GTS_WAZERO_COMPILATION_CACHE: /gotosocial/.cache GTS_WAZERO_COMPILATION_CACHE: /gotosocial/.cache
GTS_LETSENCRYPT_ENABLED: "false" GTS_LETSENCRYPT_ENABLED: "false"
GTS_LETSENCRYPT_EMAIL_ADDRESS: "" GTS_LETSENCRYPT_EMAIL_ADDRESS: ""
GTS_TRUSTED_PROXIES: "172.20.0.5" GTS_TRUSTED_PROXIES: "{{ docker.hairpin_ip }}"
GTS_ACCOUNT_DOMAIN: thesatelliteoflove.com GTS_ACCOUNT_DOMAIN: {{ primary_domain }}
GTS_OIDC_ENABLED: "true" GTS_OIDC_ENABLED: "true"
GTS_OIDC_IDP_NAME: "Authentik" GTS_OIDC_IDP_NAME: "Authentik"
GTS_OIDC_ISSUER: https://auth.thesatelliteoflove.com/application/o/gotosocial/ GTS_OIDC_ISSUER: https://{{ subdomains.auth }}/application/o/gotosocial/
GTS_OIDC_CLIENT_ID: {{ gts_oidc_client_id }} GTS_OIDC_CLIENT_ID: {{ vault_gotosocial.oidc.client_id }}
GTS_OIDC_CLIENT_SECRET: {{ gts_oidc_client_secret }} GTS_OIDC_CLIENT_SECRET: {{ vault_gotosocial.oidc.client_secret }}
GTS_OIDC_LINK_EXISTING: "true" GTS_OIDC_LINK_EXISTING: "true"
GTS_HTTP_CLIENT: "20s" GTS_HTTP_CLIENT: "20s"
GTS_SMTP_HOST: "smtp.resend.com" GTS_SMTP_HOST: "{{ smtp.host }}"
GTS_SMTP_PORT: "587" GTS_SMTP_PORT: "587"
GTS_SMTP_USERNAME: "resend" GTS_SMTP_USERNAME: "{{ smtp.username }}"
GTS_SMTP_PASSWORD: {{ resend_key }} GTS_SMTP_PASSWORD: {{ vault_smtp.password }}
GTS_SMTP_FROM: "social@updates.thesatelliteoflove.com" GTS_SMTP_FROM: "social@{{ email_domains.updates }}"
TZ: UTC TZ: UTC
volumes: volumes:
- gotosocial:/gotosocial/storage - gotosocial:/gotosocial/storage
@@ -34,7 +34,7 @@ services:
docker-volume-backup.stop-during-backup: true docker-volume-backup.stop-during-backup: true
glance.name: GoToSocial glance.name: GoToSocial
glance.icon: si:mastodon glance.icon: si:mastodon
glance.url: https://social.thesatelliteoflove.com/ glance.url: https://{{ subdomains.social }}/
glance.description: Fediverse server glance.description: Fediverse server
glance.id: gotosocial glance.id: gotosocial
@@ -52,8 +52,8 @@ services:
BACKUP_RETENTION_DAYS: 1 BACKUP_RETENTION_DAYS: 1
AWS_S3_BUCKET_NAME: tsolbackups AWS_S3_BUCKET_NAME: tsolbackups
AWS_ENDPOINT: s3.us-west-004.backblazeb2.com AWS_ENDPOINT: s3.us-west-004.backblazeb2.com
AWS_ACCESS_KEY_ID: {{ backup_key_id }} AWS_ACCESS_KEY_ID: {{ vault_backup.access_key_id }}
AWS_SECRET_ACCESS_KEY: {{ backup_key }} AWS_SECRET_ACCESS_KEY: {{ vault_backup.secret_access_key }}
BACKUP_SKIP_BACKENDS_FROM_PRUNE: s3 BACKUP_SKIP_BACKENDS_FROM_PRUNE: s3
@@ -69,4 +69,4 @@ volumes:
networks: networks:
default: default:
external: true external: true
name: lava name: {{ docker.network_name }}

18
roles/docker/templates/heyform-compose.yml.j2
View File

@@ -11,21 +11,21 @@ services:
labels: labels:
glance.name: Heyform glance.name: Heyform
glance.icon: si:googleforms glance.icon: si:googleforms
glance.url: https://forms.nerder.land/ glance.url: https://{{ subdomains.heyform }}/
glance.description: Forms server glance.description: Forms server
glance.id: heyform glance.id: heyform
environment: environment:
- APP_HOMEPAGE_URL=http://forms.nerder.land - APP_HOMEPAGE_URL=http://{{ subdomains.heyform }}
- SESSION_KEY={{ heyform_session_key }} - SESSION_KEY={{ vault_heyform.session_key }}
- FORM_ENCRYPTION_KEY={{ heyform_encryption_key }} - FORM_ENCRYPTION_KEY={{ vault_heyform.encryption_key }}
- MONGO_URI='mongodb://mongo:27017/heyform' - MONGO_URI='mongodb://mongo:27017/heyform'
- REDIS_HOST=keydb - REDIS_HOST=keydb
- REDIS_PORT=6379 - REDIS_PORT=6379
- SMTP_FROM=nerderland@updates.thesatelliteoflove.com - SMTP_FROM=nerderland@{{ email_domains.updates }}
- SMTP_HOST=smtp.resend.com - SMTP_HOST={{ smtp.host }}
- SMTP_PORT=465 - SMTP_PORT=465
- SMTP_USER=resend - SMTP_USER={{ smtp.username }}
- SMTP_PASSWORD={{ resend_key }} - SMTP_PASSWORD={{ vault_smtp.password }}
- SMTP_SECURE=true - SMTP_SECURE=true
mongo: mongo:
@@ -60,4 +60,4 @@ volumes:
networks: networks:
default: default:
external: true external: true
name: lava name: {{ docker.network_name }}

12
roles/docker/templates/hoarder-env.j2
View File

@@ -1,10 +1,10 @@
KARAKEEP_VERSION=release KARAKEEP_VERSION=release
NEXTAUTH_SECRET={{ hoarder_nextauth_secret }} NEXTAUTH_SECRET={{ vault_hoarder.nextauth_secret }}
MEILI_MASTER_KEY={{ hoarder_meili_master_key }} MEILI_MASTER_KEY={{ vault_hoarder.meili_master_key }}
NEXTAUTH_URL=https://bookmarks.thesatelliteoflove.com NEXTAUTH_URL=https://{{ subdomains.bookmarks }}
OPENAI_API_KEY={{ openai_api_key }} OPENAI_API_KEY={{ vault_infrastructure.openai_api_key }}
OAUTH_CLIENT_SECRET={{ hoarder_oidc_client_secret }} OAUTH_CLIENT_SECRET={{ vault_hoarder.oidc.client_secret }}
OAUTH_CLIENT_ID=GTi0QBRH5TiTqZfxfAkYSQVVFouGdlOFMc2sjivN OAUTH_CLIENT_ID=GTi0QBRH5TiTqZfxfAkYSQVVFouGdlOFMc2sjivN
OAUTH_PROVIDER_NAME=Authentik OAUTH_PROVIDER_NAME=Authentik
OAUTH_WELLKNOWN_URL=https://auth.thesatelliteoflove.com/application/o/hoarder/.well-known/openid-configuration OAUTH_WELLKNOWN_URL=https://{{ subdomains.auth }}/application/o/hoarder/.well-known/openid-configuration
OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=true OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=true

12
roles/docker/templates/mmdl-compose.yml.j2
View File

@@ -9,12 +9,12 @@ services:
- .env.local - .env.local
extra_hosts: extra_hosts:
- "host.docker.internal:host-gateway" - "host.docker.internal:host-gateway"
- "auth.thesatelliteoflove.com:172.20.0.5" - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
- "cal.thesatelliteoflove.com:172.20.0.5" - "{{ subdomains.cal }}:{{ docker.hairpin_ip }}"
labels: labels:
glance.name: MMDL glance.name: MMDL
glance.icon: si:task glance.icon: si:task
glance.url: https://tasks.thesatelliteoflove.com/ glance.url: https://{{ subdomains.tasks }}/
glance.description: Task and calendar management glance.description: Task and calendar management
glance.id: mmdl glance.id: mmdl
@@ -26,8 +26,8 @@ services:
environment: environment:
MYSQL_DATABASE: mmdl MYSQL_DATABASE: mmdl
MYSQL_USER: mmdl MYSQL_USER: mmdl
MYSQL_PASSWORD: "{{ vault_mmdl_mysql_password }}" MYSQL_PASSWORD: "{{ vault_mmdl.mysql_password }}"
MYSQL_ROOT_PASSWORD: "{{ vault_mmdl_mysql_root_password }}" MYSQL_ROOT_PASSWORD: "{{ vault_mmdl.mysql_root_password }}"
MYSQL_ALLOW_EMPTY_PASSWORD: "yes" MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
MYSQL_ROOT_HOST: "%" MYSQL_ROOT_HOST: "%"
volumes: volumes:
@@ -43,4 +43,4 @@ volumes:
networks: networks:
default: default:
external: true external: true
name: lava name: {{ docker.network_name }}

24
roles/docker/templates/mmdl-env.j2
View File

@@ -1,32 +1,32 @@
# Database Configuration # Database Configuration
DB_HOST=mmdl_db DB_HOST=mmdl_db
DB_USER=mmdl DB_USER=mmdl
DB_PASS={{ vault_mmdl_mysql_password }} DB_PASS={{ vault_mmdl.mysql_password }}
DB_PORT=3306 DB_PORT=3306
DB_DIALECT=mysql DB_DIALECT=mysql
DB_CHARSET=utf8mb4 DB_CHARSET=utf8mb4
DB_NAME=mmdl DB_NAME=mmdl
# Encryption # Encryption
AES_PASSWORD={{ vault_mmdl_aes_password }} AES_PASSWORD={{ vault_mmdl.aes_password }}
# SMTP Settings # SMTP Settings
SMTP_HOST=smtp.resend.com SMTP_HOST={{ smtp.host }}
SMTP_USERNAME=resend SMTP_USERNAME={{ smtp.username }}
SMTP_PASSWORD={{ resend_key }} SMTP_PASSWORD={{ vault_smtp.password }}
SMTP_FROM=tasks@updates.thesatelliteoflove.com SMTP_FROM=tasks@{{ email_domains.updates }}
SMTP_PORT=587 SMTP_PORT=587
SMTP_SECURE=true SMTP_SECURE=true
# Authentication # Authentication
USE_NEXT_AUTH=true USE_NEXT_AUTH=true
NEXTAUTH_URL=https://tasks.thesatelliteoflove.com NEXTAUTH_URL=https://{{ subdomains.tasks }}
NEXTAUTH_SECRET={{ vault_mmdl_nextauth_secret }} NEXTAUTH_SECRET={{ vault_mmdl.nextauth_secret }}
# Authentik OIDC Configuration # Authentik OIDC Configuration
AUTHENTIK_ISSUER=https://auth.thesatelliteoflove.com/application/o/mmdl AUTHENTIK_ISSUER=https://{{ subdomains.auth }}/application/o/mmdl
AUTHENTIK_CLIENT_ID={{ vault_mmdl_oidc_client_id }} AUTHENTIK_CLIENT_ID={{ vault_mmdl.oidc.client_id }}
AUTHENTIK_CLIENT_SECRET={{ vault_mmdl_oidc_client_secret }} AUTHENTIK_CLIENT_SECRET={{ vault_mmdl.oidc.client_secret }}
# User and Session Management # User and Session Management
ALLOW_USER_REGISTRATION=false ALLOW_USER_REGISTRATION=false
@@ -35,7 +35,7 @@ OTP_VALIDITY_PERIOD=300
SESSION_VALIDITY_PERIOD=30 SESSION_VALIDITY_PERIOD=30
# Application Settings # Application Settings
API_URL=https://tasks.thesatelliteoflove.com API_URL=https://{{ subdomains.tasks }}
DEBUG_MODE=false DEBUG_MODE=false
TEST_MODE=false TEST_MODE=false
SUBTASK_RECURSION_DEPTH=5 SUBTASK_RECURSION_DEPTH=5

6
roles/docker/templates/paperlessngx.env.j2
View File

@@ -24,11 +24,11 @@
# This is required if you will be exposing Paperless-ngx on a public domain # This is required if you will be exposing Paperless-ngx on a public domain
# (if doing so please consider security measures such as reverse proxy) # (if doing so please consider security measures such as reverse proxy)
PAPERLESS_URL=https://paper.thesatelliteoflove.com PAPERLESS_URL=https://{{ subdomains.papers }}
# Adjust this key if you plan to make paperless available publicly. It should # Adjust this key if you plan to make paperless available publicly. It should
# be a very long sequence of random characters. You don't need to remember it. # be a very long sequence of random characters. You don't need to remember it.
PAPERLESS_SECRET_KEY={{ paperlessngx_secret }} PAPERLESS_SECRET_KEY={{ vault_paperlessngx.secret_key }}
# Use this variable to set a timezone for the Paperless Docker containers. If not specified, defaults to UTC. # Use this variable to set a timezone for the Paperless Docker containers. If not specified, defaults to UTC.
PAPERLESS_TIME_ZONE=America/Denver PAPERLESS_TIME_ZONE=America/Denver
@@ -43,4 +43,4 @@ PAPERLESS_TIME_ZONE=America/Denver
# authentik # authentik
PAPERLESS_APPS: "allauth.socialaccount.providers.openid_connect" PAPERLESS_APPS: "allauth.socialaccount.providers.openid_connect"
PAPERLESS_SOCIALACCOUNT_PROVIDERS: '{"openid_connect": {"APPS": [{"provider_id": "authentik","name": "Authentik SSO","client_id": "{{ paperless_oauth_client_id }}","secret": "{{ paperless_oauth_client_secret }}","settings": { "server_url": "https://auth.thesatelliteoflove.com/application/o/paperlessngx/.well-known/openid-configuration"}}]}}' PAPERLESS_SOCIALACCOUNT_PROVIDERS: '{"openid_connect": {"APPS": [{"provider_id": "authentik","name": "Authentik SSO","client_id": "{{ vault_paperlessngx.oidc.client_id }}","secret": "{{ vault_paperlessngx.oidc.client_secret }}","settings": { "server_url": "https://{{ subdomains.auth }}/application/o/paperlessngx/.well-known/openid-configuration"}}]}}'

4
roles/docker/templates/pinry-compose.yml.j2
View File

@@ -5,7 +5,7 @@ services:
labels: labels:
glance.name: Pinry glance.name: Pinry
glance.icon: si:pinterest glance.icon: si:pinterest
glance.url: https://pin.thesatelliteoflove.com glance.url: https://{{ subdomains.pin }}
glance.description: Pinterest clone glance.description: Pinterest clone
glance.id: pinterest glance.id: pinterest
environment: environment:
@@ -18,4 +18,4 @@ volumes:
networks: networks:
default: default:
external: true external: true
name: lava name: {{ docker.network_name }}