PhilandClaude Opus 5.5
9b9be6a2f0
All of Authentik's applications (including Tailscale's tailnet login) have moved to Pocket ID, and its only recent sign-ins were those handovers. Drops its stack, the auth. route and DNS record, the auth subdomain variables, Gotify's leftover hairpin entries, and the dockcheck exclude; the docs now name Pocket ID as the SSO provider. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
122 lines
3.9 KiB
YAML
122 lines
3.9 KiB
YAML
---
|
|
# dns.yml
|
|
- import_playbook: deploy-guard.yml
|
|
|
|
- name: Add A Records for thesatelliteoflove.com and nerder.land
|
|
hosts: localhost
|
|
gather_facts: false
|
|
|
|
# Scoped IAM user (Route53 only) so this doesn't depend on an `aws login` session
|
|
module_defaults:
|
|
amazon.aws.route53:
|
|
access_key: "{{ vault_aws_dns.access_key }}"
|
|
secret_key: "{{ vault_aws_dns.secret_key }}"
|
|
|
|
vars:
|
|
# Domains to manage DNS records for
|
|
domains:
|
|
- name: thesatelliteoflove.com
|
|
dns_records:
|
|
- name: "gondulf"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "starpunk"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "git"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "social"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "audio"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "books"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "paper"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "snippets"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: cal
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: loclog
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: watcher
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: models
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: bookmarks
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: gotify
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: gotify-assistant
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: pdg
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: gokapi
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: id
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: nerder.land
|
|
dns_records:
|
|
- name: "forms"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "listmonk"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "repaircafe"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "repair"
|
|
ip: "{{ network.netcup_ip }}"
|
|
|
|
# DNS records to remove for decommissioned services
|
|
removed_records:
|
|
- name: thesatelliteoflove.com
|
|
dns_records:
|
|
- name: "santa" # Sneaky Klaus, removed
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "home"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "pin"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "code"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "phlog"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "tasks"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "post"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "opds" # dir2opds, replaced by Kavita
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "sync" # kosync, replaced by Kavita
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "auth" # Authentik, replaced by Pocket ID
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "files"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "kanboard"
|
|
ip: "{{ network.netcup_ip }}"
|
|
- name: "grocy"
|
|
ip: "{{ network.netcup_ip }}"
|
|
|
|
tasks:
|
|
- name: Remove A records for decommissioned services
|
|
amazon.aws.route53:
|
|
state: absent
|
|
zone: "{{ item.0.name }}"
|
|
record: "{{ item.1.name + '.' + item.0.name }}"
|
|
type: A
|
|
ttl: 300
|
|
value: "{{ item.1.ip }}"
|
|
loop: "{{ query('subelements', removed_records, 'dns_records') }}"
|
|
loop_control:
|
|
loop_var: item
|
|
|
|
- name: Add A records for subdomains of each domain
|
|
amazon.aws.route53:
|
|
state: present
|
|
zone: "{{ item.0.name }}"
|
|
record: "{{ item.0.name if item.1.name == '@' else item.1.name + '.' + item.0.name }}"
|
|
type: A
|
|
ttl: 300
|
|
value: "{{ item.1.ip }}"
|
|
loop: "{{ query('subelements', domains, 'dns_records') }}"
|
|
loop_control:
|
|
loop_var: item
|