added versioning, moving services to subreposetorys

dev-helpers.sh

@@ -20,24 +20,34 @@ function unlock(){
 }
 
 
-function pull-services(){
-    local pull_all=false
-    while getopts "a" opt; do
-        case $opt in
-            a)
-                pull_all=true
-                ;;
-            *)
-                ;;
-        esac
-    done
-    shift $((OPTIND -1))
-    local services=()
-    if [ "$pull_all" = true ]; then
-        services=($(find roles/))
+function clone-roles(){
+    local gitea_org="${1:-Urmel-Ansible-Roles}"
+    local gitea_url="${GITEA_URL:-git.urmel.de}"
+    local api="https://${gitea_url}/api/v1/orgs/${gitea_org}/repos"
+    local page=1
+    local repos
+
+    while :; do
+        repos=$(curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" \
+            "${api}?limit=50&page=${page}") || return 1
+        [ "$(echo "$repos" | jq 'length')" -eq 0 ] && break
+
+        while read -r name; do
+            if [ -d "roles/${name}" ]; then
+                echo "Skipping ${name} (already cloned)"
             else
-        services=($(cat config.ini | grep "services" | cut -d= -f2- | tr ',' ' '))
+                echo "Cloning ${name}"
+                git clone "git@${gitea_url}:${gitea_org}/${name}.git" "roles/${name}" || return 1
             fi
+        done < <(echo "$repos" | jq -r '.[].name')
+
+        page=$((page + 1))
+    done
+}
+
+function pull-services(){
+    local services=()
+    services=($(find roles/))
 
     for service in "${services[@]}"; do
         echo "Pulling $service"

inventory/host_vars/DebianMain.yml

@@ -31,6 +31,7 @@ ddns_override:
       token: "{{ _speedup_bitwarden_hetzner_fields.api_token }}"
 
 traefik_override:
+  version: "v3.6.7"
   expose_additional_ports:
     - 2022
   include_external_services:
@@ -47,6 +48,7 @@ traefik_override:
   basic_auth_password: "{{ (bitwarden_records_urmel_services['Traefik'].fields | selectattr('name', '==', 'auth_string') | first).value }}"
 
 authentik_override:
+  version: "2025.10.3"
   url: "auth.urmel.de"
   db_password: "{{ (bitwarden_records_urmel_services['Authentik'].fields | selectattr('name', '==', 'db_password') | first).value }}"
   secret: "{{ (bitwarden_records_urmel_services['Authentik'].fields | selectattr('name', '==', 'secret') | first).value }}"
@@ -59,6 +61,7 @@ authentik_override:
 
 
 nextcloud_override:
+  version: "32.0.5"
   url: "nextcloud.urmel.de"
   data_path: "/mnt/nextcloud"
   db_password: "{{ _speedup_nextcloud_fields.db_password }}"
@@ -82,12 +85,15 @@ nextcloud_override:
 
 
   collabora:
+    version: "25.04.8.1.1"
     url: "collabora.urmel.de"
     password: "{{ _speedup_nextcloud_fields.collabora_password }}"
   drawio:
+    version: "29.3.5"
     url: "drawio.urmel.de"
 
 vaultwarden_override:
+  version: "1.37.4"
   url: "vaultwarden.urmel.de"
   admin_token: "{{ (bitwarden_records_urmel_services['Vaultwarden'].fields | selectattr('name', '==', 'admin_token') | first).value }}"
   oidc:

inventory/host_vars/beDebianMain.yml

@@ -3,6 +3,7 @@ _speedup_bitwarden_hetzner_fields: "{{ dict(_speedup_bitwarden_hetzner_record.fi
 
 
 traefik_override:
+  version: "v3.6.7"
   main_domain: "be.urmel.de"
   http_port: "8080"
   https_port: "8443"

main.py

@@ -1,6 +0,0 @@
-def main():
-    print("Hello from server!")
-
-
-if __name__ == "__main__":
-    main()

roles/base_server/README.md

@@ -1 +0,0 @@
-# base

roles/base_server/defaults/main.yml

@@ -1,3 +0,0 @@
-path: /srv/{{ role_name }}
-base_override: {}
-base_defaults: {}

roles/base_server/files/etc.docker.deamon.json

@@ -1,4 +0,0 @@
-{
-  "ipv6": true,
-  "fixed-cidr-v6": "fd00:0000:0000:0001::/64"
-}

roles/base_server/meta/main.yml

@@ -1,17 +0,0 @@
----
-galaxy_info:
-  author: "Niklas Freese <niklas@urmel.de>"
-  description: Base
-  company: "Urmel Services"
-  license: AGPL-3.0-or-later
-  min_ansible_version: 2.1
-  # If this a Container Enabled role, provide the minimum Ansible Container version.
-  # min_ansible_container_version:
-
-  galaxy_tags: []
-    # List tags for your role here, one per line. A tag is a keyword that describes
-    # and categorizes the role. Users find roles by searching for tags. Be sure to
-    # remove the '[]' above, if you add tags to this list.
-    #
-    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
-    #       Maximum 20 tags per role.

roles/base_server/tasks/main.yml

@@ -1,45 +0,0 @@
----
-- name: "set local variables from overrides and defaults"
-  set_fact:
-    base: "{{ (base_defaults | combine(base_override, recursive=True)) if base_override else base_defaults }}"
-
-- name: Install requirerd packages
-  package:
-    name:
-      - docker.io
-      - docker-compose
-      - docker-doc
-      - netfilter-persistent
-      - netplan.io
-    state: latest
-
-- name: Install devhelpers
-  package:
-    name:
-      - vim
-      - curl
-    state: latest
-
-- name: copy docker deamon.json
-  ansible.builtin.copy:
-    src: etc.docker.deamon.json
-    dest: /etc/docker/daemon.json
-
-- name: Enable systemd networking
-  ansible.builtin.systemd_service:
-    state: started
-    enabled: true
-    daemon_reload: true
-    name: systemd-networkd
-
-- name: Restart docker
-  ansible.builtin.systemd_service:
-    state: restarted
-    daemon_reload: true
-    enabled: true
-    name: docker
-
-- name: Add .bashrc
-  template:
-    src: .bashrc.j2
-    dest: "/root/.bashrc"

roles/base_server/templates/.bashrc.j2

@@ -1,2 +0,0 @@
-
-alias dc="docker compose"

roles/ddns/defaults/main.yml

@@ -2,6 +2,7 @@ path: /srv/{{ role_name }}
 
 ddns_override: {}
 ddns_defaults:
+  version: latest
   domains: {}
 #     - provider: ""
 #       domain: ""

roles/ddns/templates/compose.yml.j2

@@ -1,7 +1,7 @@
 ---
 services:
   ddns:
-    image: qmcgaw/ddns-updater
+    image: qmcgaw/ddns-updater:{{ ddns.version }}
     restart: always
     network_mode: bridge
     environment:

roles/pihole/defaults/main.yml

@@ -2,6 +2,7 @@ path: /srv/{{ role_name }}
 
 dns_override: {}
 dns_defaults:
+  version: "latest"
   api_key: ""
   domain: ""
   local_domains: []

roles/pihole/templates/compose.yml.j2

@@ -1,7 +1,7 @@
 ---
 services:
   pihole:
-    image: pihole/pihole:latest
+    image: pihole/pihole:{{ pihole.version }}
     ports:
       - "53:53/tcp"
       - "53:53/udp"

roles/wireguard/defaults/main.yml

@@ -1,4 +1,5 @@
 path: /srv/{{ role_name }}
 
 wireguard_override: {}
-wireguard_defaults: {}
+wireguard_defaults:
+  version: "latest"

roles/wireguard/templates/compose.yml.j2

@@ -1,7 +1,7 @@
 ---
 services:
   wireguard:
-    image: lscr.io/linuxserver/wireguard:latest
+    image: lscr.io/linuxserver/wireguard:{{ wireguard.version }}
     container_name: wireguard
     cap_add:
       - NET_ADMIN