working ansible role
This commit is contained in:
parent
365c5c22af
commit
f39495e19c
44
README.md
44
README.md
@ -1,43 +1 @@
|
||||
### Minio setup:
|
||||
|
||||
`mc admin user add <server_alias> splitpro <secret_key>`
|
||||
`mc mb <server_alias>/splitpro`
|
||||
Bucket user `policy.json`:
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": ["s3:ListBucket"],
|
||||
"Resource": ["arn:aws:s3:::splitpro"]
|
||||
},
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"s3:GetObject",
|
||||
"s3:PutObject",
|
||||
"s3:DeleteObject"
|
||||
],
|
||||
"Resource": ["arn:aws:s3:::splitpro/*"]
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
`mc admin policy create <server_alias> splitpro-rw policy.json`
|
||||
`mc admin policy attach <server_alias> splitpro-rw --user splitpro`
|
||||
Bucket `anonymous_policy.json`:
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Principal": "*",
|
||||
"Action": "s3:GetObject",
|
||||
"Resource": "arn:aws:s3:::splitpro/*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
`mc anonymous set-json anonymous_policy.json <server_alias>/splitpro`
|
||||
# splitpro
|
||||
|
||||
60
compose.yml
60
compose.yml
@ -1,60 +0,0 @@
|
||||
services:
|
||||
splitpro:
|
||||
image: ossapps/splitpro:v2.0.0-beta.5
|
||||
environment:
|
||||
AUTHENTIK_ID: "${AUTHENTIK_ID}"
|
||||
AUTHENTIK_SECRET: "${AUTHENTIK_SECRET}"
|
||||
AUTHENTIK_ISSUER: "${AUTHENTIK_ISSUER}"
|
||||
NEXTAUTH_SECRET: "${NEXTAUTH_SECRET}"
|
||||
DATABASE_URL: "postgresql://postgres:${POSTGRES_PASSWORD}@splitpro_db"
|
||||
NEXTAUTH_URL: "https://splitpro.urmel.de"
|
||||
HOSTNAME: "0.0.0.0" # Fixes implemenntatiion bug where only hostname would be used to accept connections
|
||||
DEFAULT_HOMEPAGE: "/balances"
|
||||
ENABLE_SENDING_INVITES: true
|
||||
DISABLE_EMAIL_SIGNUP: true
|
||||
FROM_EMAIL: "${FROM_EMAIL}"
|
||||
EMAIL_SERVER_HOST: mail.postale.io
|
||||
EMAIL_SERVER_PORT: 465
|
||||
EMAIL_SERVER_USER: "${FROM_EMAIL}"
|
||||
EMAIL_SERVER_PASSWORD: "${FROM_EMAIL_PASSWORD}"
|
||||
|
||||
R2_URL: "https://s3.urmel.de"
|
||||
R2_PUBLIC_URL: "https://s3.urmel.de/splitpro"
|
||||
R2_BUCKET: "splitpro"
|
||||
R2_SECRET_KEY: "${S3_SECRET}"
|
||||
R2_ACCESS_KEY: "splitpro"
|
||||
depends_on:
|
||||
- splitpro_db
|
||||
networks:
|
||||
- db
|
||||
- proxy
|
||||
labels:
|
||||
traefik.enable: true
|
||||
traefik.http.routers.splitpro.rule: "Host(`splitpro.urmel.de`)"
|
||||
traefik.http.routers.splitpro.tls: true
|
||||
traefik.http.routers.splitpro.tls.certResolver: hetzner
|
||||
traefik.http.services.splitpro-https.loadbalancer.server.port: 3000
|
||||
|
||||
splitpro_db:
|
||||
image: ossapps/postgres:17.7-trixie
|
||||
environment:
|
||||
POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
|
||||
volumes:
|
||||
- data:/var/lib/postgresql/data
|
||||
networks:
|
||||
- db
|
||||
restart: always
|
||||
command: >
|
||||
postgres
|
||||
-c shared_preload_libraries=pg_cron
|
||||
-c cron.database_name=postgres
|
||||
-c cron.timezone=UTC
|
||||
|
||||
volumes:
|
||||
data:
|
||||
|
||||
networks:
|
||||
db:
|
||||
proxy:
|
||||
name: traefik_exposed
|
||||
external: true
|
||||
17
defaults/main.yml
Normal file
17
defaults/main.yml
Normal file
@ -0,0 +1,17 @@
|
||||
path: /srv/{{ role_name }}
|
||||
|
||||
splitpro_override: {}
|
||||
splitpro_defaults:
|
||||
version: "latest"
|
||||
db_version: "17.7-trixie"
|
||||
url: ""
|
||||
db_password: ""
|
||||
nextauth_secret: ""
|
||||
oidc:
|
||||
client_id: ""
|
||||
client_secret: ""
|
||||
issuer: ""
|
||||
mail:
|
||||
host: ""
|
||||
address: ""
|
||||
password: ""
|
||||
8
handlers/main.yml
Normal file
8
handlers/main.yml
Normal file
@ -0,0 +1,8 @@
|
||||
- name: restart container
|
||||
community.docker.docker_compose_v2:
|
||||
project_src: "{{ path }}"
|
||||
project_name: "{{ role_name }}"
|
||||
recreate: "always"
|
||||
services: ["splitpro"]
|
||||
state: "restarted"
|
||||
when: not _splitpro_already_restarted
|
||||
21
meta/main.yml
Normal file
21
meta/main.yml
Normal file
@ -0,0 +1,21 @@
|
||||
---
|
||||
galaxy_info:
|
||||
author: "Niklas Freese <niklas@urmel.de>"
|
||||
description: splitpro
|
||||
company: "Urmel Services"
|
||||
license: AGPL-3.0-or-later
|
||||
min_ansible_version: 2.1
|
||||
# If this a Container Enabled role, provide the minimum Ansible Container version.
|
||||
# min_ansible_container_version:
|
||||
|
||||
galaxy_tags: []
|
||||
# List tags for your role here, one per line. A tag is a keyword that describes
|
||||
# and categorizes the role. Users find roles by searching for tags. Be sure to
|
||||
# remove the '[]' above, if you add tags to this list.
|
||||
#
|
||||
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
|
||||
# Maximum 20 tags per role.
|
||||
|
||||
dependencies:
|
||||
- role: traefik
|
||||
- role: minio
|
||||
21
tasks/main.yml
Normal file
21
tasks/main.yml
Normal file
@ -0,0 +1,21 @@
|
||||
---
|
||||
- name: "set local variables from overrides and defaults"
|
||||
set_fact:
|
||||
splitpro: "{{ (splitpro_defaults | combine(splitpro_override, recursive=True)) if splitpro_override else splitpro_defaults }}"
|
||||
|
||||
- name: ensure that path exists
|
||||
file:
|
||||
path: "{{ path }}/config/splitpro"
|
||||
state: directory
|
||||
|
||||
- name: template docker compose
|
||||
template:
|
||||
src: compose.yml.j2
|
||||
dest: "{{ path }}/compose.yml"
|
||||
|
||||
- name: ensure everything is up
|
||||
community.docker.docker_compose_v2:
|
||||
project_src: "{{ path }}"
|
||||
project_name: "{{ role_name }}"
|
||||
recreate: always
|
||||
state: "present"
|
||||
54
templates/compose.yml.j2
Normal file
54
templates/compose.yml.j2
Normal file
@ -0,0 +1,54 @@
|
||||
services:
|
||||
splitpro:
|
||||
image: "ossapps/splitpro:{{ splitpro.version }}"
|
||||
environment:
|
||||
AUTHENTIK_ID: "{{ splitpro.oidc.client_id }}"
|
||||
AUTHENTIK_SECRET: "{{ splitpro.oidc.client_secret }}"
|
||||
AUTHENTIK_ISSUER: "{{ splitpro.oidc.issuer }}"
|
||||
NEXTAUTH_SECRET: "{{ splitpro.nextauth_secret }}"
|
||||
DATABASE_URL: "postgresql://postgres:{{ splitpro.db_password }}@splitpro_db"
|
||||
NEXTAUTH_URL: "https://{{ splitpro.url }}"
|
||||
HOSTNAME: "0.0.0.0" # Fixes implemenntatiion bug where only hostname would be used to accept connections
|
||||
DEFAULT_HOMEPAGE: "/balances"
|
||||
ENABLE_SENDING_INVITES: true
|
||||
DISABLE_EMAIL_SIGNUP: true
|
||||
FROM_EMAIL: "{{ splitpro.mail.address }}"
|
||||
EMAIL_SERVER_HOST: "{{ splitpro.mail.host }}"
|
||||
EMAIL_SERVER_PORT: 465
|
||||
EMAIL_SERVER_USER: "{{ splitpro.mail.address }}"
|
||||
EMAIL_SERVER_PASSWORD: "{{ splitpro.mail.password }}"
|
||||
networks:
|
||||
- db
|
||||
- proxy
|
||||
depends_on:
|
||||
- splitpro_db
|
||||
volumes:
|
||||
- ./data/splitpro-uploads:/app/uploads
|
||||
labels:
|
||||
traefik.enable: true
|
||||
traefik.http.routers.splitpro.rule: "Host(`{{ splitpro.url }}`)"
|
||||
traefik.http.routers.splitpro.tls: true
|
||||
traefik.http.routers.splitpro.tls.certResolver: hetzner
|
||||
traefik.http.services.splitpro-https.loadbalancer.server.port: 3000
|
||||
|
||||
splitpro_db:
|
||||
image: "ossapps/postgres:{{ splitpro.db_version }}"
|
||||
environment:
|
||||
POSTGRES_PASSWORD: "{{ splitpro.db_password }}"
|
||||
volumes:
|
||||
- ./data/db:/var/lib/postgresql/data
|
||||
networks:
|
||||
- db
|
||||
restart: always
|
||||
command: >
|
||||
postgres
|
||||
-c shared_preload_libraries=pg_cron
|
||||
-c cron.database_name=postgres
|
||||
-c cron.timezone=UTC
|
||||
|
||||
|
||||
networks:
|
||||
db: {}
|
||||
proxy:
|
||||
name: traefik_exposed
|
||||
external: true
|
||||
Loading…
x
Reference in New Issue
Block a user