PhilandClaude Opus 5.5
e569a56417
lava was created by hand without an ip_range, so any container could be given Caddy's fixed IP (172.20.0.5). After a reboot the containers race for the low addresses and Caddy often fails with "Address already in use". - The docker role now creates lava as 172.20.0.0/16 with dynamic addresses limited to 172.20.128.0/17, so 172.20.0.x is free for fixed IPs, and warns if the network still has the old layout. - Gitea gets fixed IP 172.20.0.6 once the network has the reserved range, since its ufw-docker SSH rule points at its IP. - ufw-docker allow rules for Caddy (80, 443) and Gitea SSH are managed by the playbook and follow IP changes. - migrate-lava-network.yml recreates the existing network once: it takes down every compose project on lava (volumes kept), recreates the network, and brings them back up, Caddy first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
55 lines
1.5 KiB
YAML
55 lines
1.5 KiB
YAML
- name: make caddy directories
|
|
ansible.builtin.file:
|
|
path: "{{ item}}"
|
|
state: directory
|
|
loop:
|
|
- /opt/stacks/caddy
|
|
|
|
- name: Install apache2-utils for htpasswd
|
|
ansible.builtin.apt:
|
|
name: apache2-utils
|
|
state: present
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
become: true
|
|
when: vault_dir2opds is defined
|
|
|
|
- name: Generate bcrypt hash for dir2opds basic auth
|
|
ansible.builtin.shell: |
|
|
htpasswd -bnB "{{ vault_dir2opds.basic_auth_user }}" "{{ vault_dir2opds.basic_auth_password }}" | awk -F: '{print $1, $2}'
|
|
register: dir2opds_basic_auth_hash_result
|
|
changed_when: false
|
|
no_log: true
|
|
when: vault_dir2opds is defined
|
|
|
|
- name: template Caddyfile
|
|
ansible.builtin.template:
|
|
src: Caddyfile.j2
|
|
dest: /opt/stacks/caddy/Caddyfile
|
|
owner: root
|
|
mode: '0640'
|
|
group: docker
|
|
notify: restart caddy
|
|
|
|
- name: template caddy compose file
|
|
ansible.builtin.template:
|
|
src: caddy-compose.yml.j2
|
|
dest: /opt/stacks/caddy/compose.yml
|
|
owner: root
|
|
mode: '0644'
|
|
|
|
- name: deploy caddy stack
|
|
community.docker.docker_compose_v2:
|
|
project_src: /opt/stacks/caddy
|
|
recreate: never
|
|
files:
|
|
- compose.yml
|
|
|
|
# Lets public traffic through to Caddy. Re-adds the rule if Caddy's IP changed.
|
|
- name: allow public traffic to caddy
|
|
ansible.builtin.command: /usr/local/bin/ufw-docker.sh allow caddy-caddy-1 {{ item }}
|
|
loop: [80/tcp, 443/tcp, 443/udp]
|
|
register: caddy_ufw
|
|
changed_when: "'Skipping' not in caddy_ufw.stdout"
|
|
when: not ansible_check_mode
|