diff --git a/README.md b/README.md index 9e53044..92f615e 100644 --- a/README.md +++ b/README.md @@ -1,43 +1 @@ -### Minio setup: - -`mc admin user add splitpro ` -`mc mb /splitpro` -Bucket user `policy.json`: -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": ["s3:ListBucket"], - "Resource": ["arn:aws:s3:::splitpro"] - }, - { - "Effect": "Allow", - "Action": [ - "s3:GetObject", - "s3:PutObject", - "s3:DeleteObject" - ], - "Resource": ["arn:aws:s3:::splitpro/*"] - } - ] -} -``` -`mc admin policy create splitpro-rw policy.json` -`mc admin policy attach splitpro-rw --user splitpro` -Bucket `anonymous_policy.json`: -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": "*", - "Action": "s3:GetObject", - "Resource": "arn:aws:s3:::splitpro/*" - } - ] -} -``` -`mc anonymous set-json anonymous_policy.json /splitpro` \ No newline at end of file +# splitpro diff --git a/compose.yml b/compose.yml deleted file mode 100644 index e3e3bbb..0000000 --- a/compose.yml +++ /dev/null @@ -1,60 +0,0 @@ -services: - splitpro: - image: ossapps/splitpro:v2.0.0-beta.5 - environment: - AUTHENTIK_ID: "${AUTHENTIK_ID}" - AUTHENTIK_SECRET: "${AUTHENTIK_SECRET}" - AUTHENTIK_ISSUER: "${AUTHENTIK_ISSUER}" - NEXTAUTH_SECRET: "${NEXTAUTH_SECRET}" - DATABASE_URL: "postgresql://postgres:${POSTGRES_PASSWORD}@splitpro_db" - NEXTAUTH_URL: "https://splitpro.urmel.de" - HOSTNAME: "0.0.0.0" # Fixes implemenntatiion bug where only hostname would be used to accept connections - DEFAULT_HOMEPAGE: "/balances" - ENABLE_SENDING_INVITES: true - DISABLE_EMAIL_SIGNUP: true - FROM_EMAIL: "${FROM_EMAIL}" - EMAIL_SERVER_HOST: mail.postale.io - EMAIL_SERVER_PORT: 465 - EMAIL_SERVER_USER: "${FROM_EMAIL}" - EMAIL_SERVER_PASSWORD: "${FROM_EMAIL_PASSWORD}" - - R2_URL: "https://s3.urmel.de" - R2_PUBLIC_URL: "https://s3.urmel.de/splitpro" - R2_BUCKET: "splitpro" - R2_SECRET_KEY: "${S3_SECRET}" - R2_ACCESS_KEY: "splitpro" - depends_on: - - splitpro_db - networks: - - db - - proxy - labels: - traefik.enable: true - traefik.http.routers.splitpro.rule: "Host(`splitpro.urmel.de`)" - traefik.http.routers.splitpro.tls: true - traefik.http.routers.splitpro.tls.certResolver: hetzner - traefik.http.services.splitpro-https.loadbalancer.server.port: 3000 - - splitpro_db: - image: ossapps/postgres:17.7-trixie - environment: - POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}" - volumes: - - data:/var/lib/postgresql/data - networks: - - db - restart: always - command: > - postgres - -c shared_preload_libraries=pg_cron - -c cron.database_name=postgres - -c cron.timezone=UTC - -volumes: - data: - -networks: - db: - proxy: - name: traefik_exposed - external: true \ No newline at end of file diff --git a/defaults/main.yml b/defaults/main.yml new file mode 100644 index 0000000..8fa8ca2 --- /dev/null +++ b/defaults/main.yml @@ -0,0 +1,17 @@ +path: /srv/{{ role_name }} + +splitpro_override: {} +splitpro_defaults: + version: "latest" + db_version: "17.7-trixie" + url: "" + db_password: "" + nextauth_secret: "" + oidc: + client_id: "" + client_secret: "" + issuer: "" + mail: + host: "" + address: "" + password: "" diff --git a/handlers/main.yml b/handlers/main.yml new file mode 100644 index 0000000..cb41418 --- /dev/null +++ b/handlers/main.yml @@ -0,0 +1,8 @@ +- name: restart container + community.docker.docker_compose_v2: + project_src: "{{ path }}" + project_name: "{{ role_name }}" + recreate: "always" + services: ["splitpro"] + state: "restarted" + when: not _splitpro_already_restarted diff --git a/meta/main.yml b/meta/main.yml new file mode 100644 index 0000000..abb2304 --- /dev/null +++ b/meta/main.yml @@ -0,0 +1,21 @@ +--- +galaxy_info: + author: "Niklas Freese " + description: splitpro + company: "Urmel Services" + license: AGPL-3.0-or-later + min_ansible_version: 2.1 + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: + - role: traefik + - role: minio diff --git a/tasks/main.yml b/tasks/main.yml new file mode 100644 index 0000000..d3969f6 --- /dev/null +++ b/tasks/main.yml @@ -0,0 +1,21 @@ +--- +- name: "set local variables from overrides and defaults" + set_fact: + splitpro: "{{ (splitpro_defaults | combine(splitpro_override, recursive=True)) if splitpro_override else splitpro_defaults }}" + +- name: ensure that path exists + file: + path: "{{ path }}/config/splitpro" + state: directory + +- name: template docker compose + template: + src: compose.yml.j2 + dest: "{{ path }}/compose.yml" + +- name: ensure everything is up + community.docker.docker_compose_v2: + project_src: "{{ path }}" + project_name: "{{ role_name }}" + recreate: always + state: "present" diff --git a/templates/compose.yml.j2 b/templates/compose.yml.j2 new file mode 100644 index 0000000..15cf1a0 --- /dev/null +++ b/templates/compose.yml.j2 @@ -0,0 +1,54 @@ +services: + splitpro: + image: "ossapps/splitpro:{{ splitpro.version }}" + environment: + AUTHENTIK_ID: "{{ splitpro.oidc.client_id }}" + AUTHENTIK_SECRET: "{{ splitpro.oidc.client_secret }}" + AUTHENTIK_ISSUER: "{{ splitpro.oidc.issuer }}" + NEXTAUTH_SECRET: "{{ splitpro.nextauth_secret }}" + DATABASE_URL: "postgresql://postgres:{{ splitpro.db_password }}@splitpro_db" + NEXTAUTH_URL: "https://{{ splitpro.url }}" + HOSTNAME: "0.0.0.0" # Fixes implemenntatiion bug where only hostname would be used to accept connections + DEFAULT_HOMEPAGE: "/balances" + ENABLE_SENDING_INVITES: true + DISABLE_EMAIL_SIGNUP: true + FROM_EMAIL: "{{ splitpro.mail.address }}" + EMAIL_SERVER_HOST: "{{ splitpro.mail.host }}" + EMAIL_SERVER_PORT: 465 + EMAIL_SERVER_USER: "{{ splitpro.mail.address }}" + EMAIL_SERVER_PASSWORD: "{{ splitpro.mail.password }}" + networks: + - db + - proxy + depends_on: + - splitpro_db + volumes: + - ./data/splitpro-uploads:/app/uploads + labels: + traefik.enable: true + traefik.http.routers.splitpro.rule: "Host(`{{ splitpro.url }}`)" + traefik.http.routers.splitpro.tls: true + traefik.http.routers.splitpro.tls.certResolver: hetzner + traefik.http.services.splitpro-https.loadbalancer.server.port: 3000 + + splitpro_db: + image: "ossapps/postgres:{{ splitpro.db_version }}" + environment: + POSTGRES_PASSWORD: "{{ splitpro.db_password }}" + volumes: + - ./data/db:/var/lib/postgresql/data + networks: + - db + restart: always + command: > + postgres + -c shared_preload_libraries=pg_cron + -c cron.database_name=postgres + -c cron.timezone=UTC + + +networks: + db: {} + proxy: + name: traefik_exposed + external: true