gitea/ansible-lxc-templates
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

+ refactored and solve some problems with mariadb and nginx playbook

Browse Source 
+ apps playbooks - docker, caprover
* simple refactore starter scripts
+ apt update debops playboook prepend launch by default
* sury repo changed
* database users locked to localhost only
* phpmyadmin blowfish generate secret fix
This commit is contained in:
dimti
2025-02-10 23:35:41 +03:00
parent bff53b4c1a
commit 3dfacd0822
25 changed files with 227 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
playbooks/debops/apt.yml Normal file
View File

@ -0,0 +1,22 @@
---
- name: Manage Advanced Package Manager
collections: [ 'debops.debops', 'debops.roles01',
'debops.roles02', 'debops.roles03' ]
hosts: [ 'debian10' ]
become: True
environment: '{{ inventory__environment | d({})
| combine(inventory__group_environment | d({}))
| combine(inventory__host_environment | d({})) }}'
post_tasks:
- name: Upgrade
ansible.builtin.apt:
upgrade: True
roles:
- role: apt
tags: [ 'role::apt', 'skip::apt' ]

2
playbooks/debops/mariadb-custom-db.yml
View File

@ -1,5 +1,7 @@
---
# https://docs.debops.org/en/stable-3.2/ansible/roles/mariadb/defaults/main.html
- name: Manage MariaDB client
collections: [ 'debops.debops', 'debops.roles01',
'debops.roles02', 'debops.roles03' ]

2
playbooks/debops/mariadb.yml
View File

@ -1,5 +1,7 @@
---
# https://docs.debops.org/en/stable-3.2/ansible/roles/mariadb/defaults/main.html
- name: Manage MariaDB client
collections: [ 'debops.debops', 'debops.roles01',
'debops.roles02', 'debops.roles03' ]

17
playbooks/debops/mariadb_server.yml
View File

@ -1,5 +1,7 @@
---
# https://docs.debops.org/en/stable-3.2/ansible/roles/mariadb_server/defaults/main.html
- name: Manage MariaDB server
collections: [ 'debops.debops', 'debops.roles01',
'debops.roles02', 'debops.roles03' ]
@ -14,7 +16,20 @@
mariadb_server__flavor: '{{ ansible_local.mariadb.flavor
|d(mariadb_server__flavor_map[ansible_distribution_release] | d("mariadb_upstream")) }}'
mariadb_server__upstream_version: '11.2'
mariadb_server__bind_address: '0.0.0.0'
mariadb_server__bind_address: '127.0.0.1'
mariadb_server__mysqld_performance_options:
'innodb_buffer_pool_instances': '{{ ansible_processor_vcpus | d(1) }}'
'innodb_buffer_pool_size': '{{ (ansible_memtotal_mb / 2) | int }}M'
'innodb_log_file_size': '{{ (ansible_memtotal_mb / 2) / 4 | int }}M'
'query_cache_type': '1'
'query_cache_size': '1M'
'query_cache_limit': '10M'
'join_buffer_size': '1M'
'performance_schema': 'ON'
'skip-name-resolve': 'ON'
# mariadb_server__options:
# 'query_cache_size': '1M'
roles:
- role: keyring

23
playbooks/debops/nginx.yml
View File

@ -1,5 +1,7 @@
---
# https://docs.debops.org/en/stable-3.2/ansible/roles/nginx/defaults/main.html
- name: Manage nginx webserver
collections: [ 'debops.debops', 'debops.roles01',
'debops.roles02', 'debops.roles03' ]
@ -25,41 +27,38 @@
nginx_ocsp: False
nginx_worker_processes: auto
nginx_manage_ipv6only: False
nginx_default_name: 'welcome'
nginx_default_ssl_name: 'welcome'
# TODO: Replace [::]:443 to 443 and [::]:80 to 80 in site nginx config
nginx_server_localhost:
enabled: False
nginx_listen_port: [ '80' ]
nginx_listen_ssl_port: [ '443' ]
nginx__servers:
- name: '{{ domain_name }}'
type: php
root: '/var/www/{{ site_name }}'
public_dir_name: ''
include_files_begin: '{{ nginx_includes_begin }}'
options: 'set $upstream unix:/run/{{ php__version_preference[0] }}-fpm-www-data.sock;'
location_list:
- pattern: '/'
locations:
- pattern: '~ ^/.*-backend/'
options: |
try_files /index.html @october
set $upstream unix:/run/{{ php__version_preference[0] }}-fpm-backend.sock
client_max_body_size 1000M
try_files /index.html @october;
set $upstream unix:/run/{{ php__version_preference[0] }}-fpm-backend.sock;
client_max_body_size 1000M;
options: try_files /index.html @october;
- pattern: '@october'
options: rewrite ^/.*$ /index.php last;
- pattern: '~* ^(?!/index).*\.php$'
options: return 403;
php_options: |
fastcgi_read_timeout 3000;
php_upstream: $upstream
#location ~ ^(?!.+\.php/)(?<script_name>.+\.php)$ {
php_location_script_name: ~ ^(?<script_name>/index\.php)
#location ~ ^(?<script_name>.+?\.php)(?<path_info>/.*)?$ {
php_location_path_info: ~ ^(?<script_name>/index\.php)(?<path_info>/.*)?

8
playbooks/debops/php-prod.yml
View File

@ -12,12 +12,10 @@
vars:
php__sury_apt_key_id: '{{ php__sury_apt_key_id_map[ansible_distribution] }}'
php__sury_apt_repo: '{{ php__sury_apt_repo_map[ansible_distribution] }}'
php__sury_apt_key_id_map:
'Debian':
- id: '1505 8500 A023 5D97 F5D1 0063 B188 E2B6 95BD 4743'
repo: 'deb https://packages.sury.org/php/ {{ ansible_distribution_release }} main'
repo: 'deb https://packages.sury.su/php/ {{ ansible_distribution_release }} main'
state: '{{ "present" if php__sury|bool else "absent" }}'
# Key replaced due to security concerns
@ -25,8 +23,10 @@
- id: 'DF3D 585D B8F0 EB65 8690 A554 AC0E 4758 4A7A 714D'
state: 'absent'
php__sury_apt_repo_map:
'Debian': 'deb https://packages.sury.org/php/ {{ ansible_distribution_release }} main'
'Debian': 'deb https://packages.sury.su/php/ {{ ansible_distribution_release }} main'
'Ubuntu': 'ppa:ondrej/php'
php__sury_apt_key_id: '{{ php__sury_apt_key_id_map[ansible_distribution] }}'
php__sury_apt_repo: '{{ php__sury_apt_repo_map[ansible_distribution] }}'
php__base_packages:
- unzip
- git

10
playbooks/debops/php-wp.yml
View File

@ -14,14 +14,10 @@
- ./../../vars/php.yml
vars:
php__sury: '{{ ansible_local.php.sury
|d(ansible_distribution_release in [ "buster" ]) | bool }}'
php__sury_apt_key_id: '{{ php__sury_apt_key_id_map[ansible_distribution] }}'
php__sury_apt_repo: '{{ php__sury_apt_repo_map[ansible_distribution] }}'
php__sury_apt_key_id_map:
'Debian':
- id: '1505 8500 A023 5D97 F5D1 0063 B188 E2B6 95BD 4743'
repo: 'deb https://packages.sury.org/php/ {{ ansible_distribution_release }} main'
repo: 'deb https://packages.sury.su/php/ {{ ansible_distribution_release }} main'
state: '{{ "present" if php__sury|bool else "absent" }}'
# Key replaced due to security concerns
@ -29,8 +25,10 @@
- id: 'DF3D 585D B8F0 EB65 8690 A554 AC0E 4758 4A7A 714D'
state: 'absent'
php__sury_apt_repo_map:
'Debian': 'deb https://packages.sury.org/php/ {{ ansible_distribution_release }} main'
'Debian': 'deb https://packages.sury.su/php/ {{ ansible_distribution_release }} main'
'Ubuntu': 'ppa:ondrej/php'
php__sury_apt_key_id: '{{ php__sury_apt_key_id_map[ansible_distribution] }}'
php__sury_apt_repo: '{{ php__sury_apt_repo_map[ansible_distribution] }}'
php__base_packages:
- unzip
- git

10
playbooks/debops/root_account.yml
View File

@ -13,14 +13,8 @@
vars:
root_account__enabled: True
root_account__password: False
# root_account__dotfiles_enabled: True
# root_account__dotfiles_repo: 'https://vcs.wpstudio.ru/gitea/dotfiles.git'
post_tasks:
- name: Tmux Plugins Manager
# Вообще это конструкция не нужна, так как tmux и сам все прекрасно умеет устанавливать, только если бы у него в этот момент была программа git
# Хотя нет, блин, нихрена он не умеет. Последнюю команду он почему не запускает: ~/.tmux/plugins/tpm/bin/install_plugins
shell: test -d ~/.tmux/plugins/tpm || git clone https://github.com/tmux-plugins/tpm ~/.tmux/plugins/tpm && ~/.tmux/plugins/tpm/bin/install_plugins
root_account__dotfiles_enabled: True
root_account__dotfiles_repo: 'https://vcs.wpstudio.ru/gitea/dotfiles.git'
roles:
- role: root_account