mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-05-06 04:14:43 +00:00
initial commit
This commit is contained in:
Rasmus Wejlgaard
commit
737d6e0bc1
137 changed files with 25471 additions and 0 deletions
56
.github/workflows/deploy-on-merge.yml
vendored
Normal file
56
.github/workflows/deploy-on-merge.yml
vendored
Normal file
|
|
@ -0,0 +1,56 @@
|
||||||
|
name: Deploy (on merge)
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- main
|
||||||
|
paths-ignore:
|
||||||
|
- 'terraform/**'
|
||||||
|
|
||||||
|
# Requires these repository secrets:
|
||||||
|
# TAILSCALE_AUTHKEY — Tailscale auth key for mesh access
|
||||||
|
# SSH_PRIVATE_KEY — SSH key authorized on target hosts
|
||||||
|
# AGE_SECRET_KEY — age private key for SOPS decryption
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
deploy:
|
||||||
|
name: Deploy to all
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
environment: production
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Set up Tailscale
|
||||||
|
uses: tailscale/github-action@v3
|
||||||
|
with:
|
||||||
|
authkey: ${{ secrets.TAILSCALE_AUTHKEY }}
|
||||||
|
|
||||||
|
- name: Set up SSH key
|
||||||
|
run: |
|
||||||
|
mkdir -p ~/.ssh
|
||||||
|
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
|
||||||
|
chmod 600 ~/.ssh/id_ed25519
|
||||||
|
ssh-keyscan -H 100.67.6.27 100.84.65.101 100.122.219.41 100.117.235.28 100.89.206.60 100.115.45.53 >> ~/.ssh/known_hosts 2>/dev/null || true
|
||||||
|
|
||||||
|
- name: Install tools
|
||||||
|
run: |
|
||||||
|
pip install ansible
|
||||||
|
wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
|
||||||
|
sudo dpkg -i /tmp/sops.deb
|
||||||
|
|
||||||
|
- name: Decrypt secrets
|
||||||
|
env:
|
||||||
|
SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
|
||||||
|
run: |
|
||||||
|
# Decrypt all .enc. files to their plaintext counterparts
|
||||||
|
find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
|
||||||
|
out="${f/.enc/}"
|
||||||
|
sops -d "$f" > "$out"
|
||||||
|
echo "Decrypted: $f -> $out"
|
||||||
|
done
|
||||||
|
|
||||||
|
- name: Run playbook
|
||||||
|
working-directory: ansible/
|
||||||
|
env:
|
||||||
|
ANSIBLE_HOST_KEY_CHECKING: "false"
|
||||||
|
run: ansible-playbook deploy.yml
|
||||||
82
.github/workflows/deploy.yml
vendored
Normal file
82
.github/workflows/deploy.yml
vendored
Normal file
|
|
@ -0,0 +1,82 @@
|
||||||
|
name: Deploy (manual)
|
||||||
|
|
||||||
|
on:
|
||||||
|
workflow_dispatch:
|
||||||
|
inputs:
|
||||||
|
target:
|
||||||
|
description: 'Target host (e.g. helsinki-a, london-b, all)'
|
||||||
|
required: true
|
||||||
|
type: string
|
||||||
|
playbook:
|
||||||
|
description: 'Ansible playbook to run (e.g. site.yml, update.yml)'
|
||||||
|
required: true
|
||||||
|
type: string
|
||||||
|
dry_run:
|
||||||
|
description: 'Dry run (--check mode)'
|
||||||
|
required: false
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
|
||||||
|
# Requires these repository secrets:
|
||||||
|
# TAILSCALE_AUTHKEY — Tailscale auth key for mesh access
|
||||||
|
# SSH_PRIVATE_KEY — SSH key authorized on target hosts
|
||||||
|
# AGE_SECRET_KEY — age private key for SOPS decryption
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
deploy:
|
||||||
|
name: Deploy to ${{ inputs.target }}
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
environment: production # requires manual approval in repo settings
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Set up Tailscale
|
||||||
|
uses: tailscale/github-action@v3
|
||||||
|
with:
|
||||||
|
authkey: ${{ secrets.TAILSCALE_AUTHKEY }}
|
||||||
|
|
||||||
|
- name: Set up SSH key
|
||||||
|
run: |
|
||||||
|
mkdir -p ~/.ssh
|
||||||
|
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
|
||||||
|
chmod 600 ~/.ssh/id_ed25519
|
||||||
|
ssh-keyscan -H 100.67.6.27 100.84.65.101 100.122.219.41 100.117.235.28 100.89.206.60 100.115.45.53 >> ~/.ssh/known_hosts 2>/dev/null || true
|
||||||
|
|
||||||
|
- name: Install tools
|
||||||
|
run: |
|
||||||
|
pip install ansible
|
||||||
|
wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
|
||||||
|
sudo dpkg -i /tmp/sops.deb
|
||||||
|
|
||||||
|
- name: Decrypt secrets
|
||||||
|
env:
|
||||||
|
SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
|
||||||
|
run: |
|
||||||
|
# Decrypt all .enc. files to their plaintext counterparts
|
||||||
|
find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
|
||||||
|
out="${f/.enc/}"
|
||||||
|
sops -d "$f" > "$out"
|
||||||
|
echo "Decrypted: $f -> $out"
|
||||||
|
done
|
||||||
|
|
||||||
|
- name: Run playbook
|
||||||
|
working-directory: ansible/
|
||||||
|
env:
|
||||||
|
ANSIBLE_HOST_KEY_CHECKING: "false"
|
||||||
|
run: |
|
||||||
|
PLAYBOOK="${{ inputs.playbook }}"
|
||||||
|
# Normalize: strip prefix/suffix, then re-add as needed
|
||||||
|
PLAYBOOK="${PLAYBOOK#playbooks/}"
|
||||||
|
PLAYBOOK="${PLAYBOOK%.yml}.yml"
|
||||||
|
if [ "$PLAYBOOK" != "deploy.yml" ]; then
|
||||||
|
PLAYBOOK="playbooks/$PLAYBOOK"
|
||||||
|
fi
|
||||||
|
|
||||||
|
ARGS=""
|
||||||
|
if [ "${{ inputs.target }}" != "all" ]; then
|
||||||
|
ARGS="--limit ${{ inputs.target }}"
|
||||||
|
fi
|
||||||
|
if [ "${{ inputs.dry_run }}" = "true" ]; then
|
||||||
|
ARGS="$ARGS --check --diff"
|
||||||
|
fi
|
||||||
|
ansible-playbook "$PLAYBOOK" $ARGS
|
||||||
34
.github/workflows/lint-ansible.yml
vendored
Normal file
34
.github/workflows/lint-ansible.yml
vendored
Normal file
|
|
@ -0,0 +1,34 @@
|
||||||
|
name: Lint Ansible
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
paths:
|
||||||
|
- 'ansible/**'
|
||||||
|
- '.github/workflows/lint-ansible.yml'
|
||||||
|
pull_request:
|
||||||
|
paths:
|
||||||
|
- 'ansible/**'
|
||||||
|
- '.github/workflows/lint-ansible.yml'
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
ansible-lint:
|
||||||
|
name: ansible-lint
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Check for Ansible files
|
||||||
|
id: check
|
||||||
|
run: |
|
||||||
|
if find ansible/ -name '*.yml' -o -name '*.yaml' | grep -q .; then
|
||||||
|
echo "has_files=true" >> "$GITHUB_OUTPUT"
|
||||||
|
else
|
||||||
|
echo "has_files=false" >> "$GITHUB_OUTPUT"
|
||||||
|
echo "No Ansible YAML files found — skipping lint."
|
||||||
|
fi
|
||||||
|
|
||||||
|
- name: Run ansible-lint
|
||||||
|
if: steps.check.outputs.has_files == 'true'
|
||||||
|
uses: ansible/ansible-lint@v25
|
||||||
|
with:
|
||||||
|
working_directory: ansible/
|
||||||
32
.github/workflows/lint-docker-compose.yml
vendored
Normal file
32
.github/workflows/lint-docker-compose.yml
vendored
Normal file
|
|
@ -0,0 +1,32 @@
|
||||||
|
name: Lint Docker Compose
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
paths:
|
||||||
|
- 'ansible/services/**'
|
||||||
|
- '.github/workflows/lint-docker-compose.yml'
|
||||||
|
pull_request:
|
||||||
|
paths:
|
||||||
|
- 'ansible/services/**'
|
||||||
|
- '.github/workflows/lint-docker-compose.yml'
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
compose-lint:
|
||||||
|
name: docker compose config
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Validate Compose files
|
||||||
|
run: |
|
||||||
|
found=0
|
||||||
|
shopt -s globstar nullglob
|
||||||
|
for f in ansible/services/**/docker-compose.yml ansible/services/**/docker-compose.yaml ansible/services/**/compose.yml ansible/services/**/compose.yaml; do
|
||||||
|
echo "::group::Validating $f"
|
||||||
|
docker compose -f "$f" config --quiet 2>&1 || true
|
||||||
|
echo "::endgroup::"
|
||||||
|
found=1
|
||||||
|
done
|
||||||
|
if [ "$found" -eq 0 ]; then
|
||||||
|
echo "No Compose files found — skipping."
|
||||||
|
fi
|
||||||
113
.github/workflows/terraform.yml
vendored
Normal file
113
.github/workflows/terraform.yml
vendored
Normal file
|
|
@ -0,0 +1,113 @@
|
||||||
|
name: Terraform
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
branches: [main]
|
||||||
|
paths:
|
||||||
|
- 'terraform/**'
|
||||||
|
- '.github/workflows/terraform.yml'
|
||||||
|
pull_request:
|
||||||
|
paths:
|
||||||
|
- 'terraform/**'
|
||||||
|
- '.github/workflows/terraform.yml'
|
||||||
|
|
||||||
|
# Requires these repository secrets:
|
||||||
|
# AGE_SECRET_KEY — age private key for SOPS decryption
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
plan:
|
||||||
|
name: Plan
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Install OpenTofu
|
||||||
|
uses: opentofu/setup-opentofu@v1
|
||||||
|
with:
|
||||||
|
tofu_version: latest
|
||||||
|
|
||||||
|
- name: Install SOPS
|
||||||
|
run: |
|
||||||
|
wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
|
||||||
|
sudo dpkg -i /tmp/sops.deb
|
||||||
|
|
||||||
|
- name: Decrypt secrets
|
||||||
|
env:
|
||||||
|
SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
|
||||||
|
run: |
|
||||||
|
find . -name '*.enc.yml' -o -name '*.enc.yaml' | while read f; do
|
||||||
|
out="${f/.enc/}"
|
||||||
|
sops -d "$f" > "$out"
|
||||||
|
echo "Decrypted: $f -> $out"
|
||||||
|
done
|
||||||
|
|
||||||
|
- name: Set backend credentials
|
||||||
|
working-directory: terraform/
|
||||||
|
run: |
|
||||||
|
echo "AWS_ACCESS_KEY_ID=$(yq '.backblaze_keyID' secrets.yaml)" >> "$GITHUB_ENV"
|
||||||
|
echo "AWS_SECRET_ACCESS_KEY=$(yq '.backblaze_applicationKey' secrets.yaml)" >> "$GITHUB_ENV"
|
||||||
|
|
||||||
|
- name: tofu init
|
||||||
|
working-directory: terraform/
|
||||||
|
run: tofu init
|
||||||
|
|
||||||
|
- name: tofu plan
|
||||||
|
working-directory: terraform/
|
||||||
|
run: tofu plan -out=tfplan
|
||||||
|
|
||||||
|
- name: Upload plan
|
||||||
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
|
||||||
|
uses: actions/upload-artifact@v4
|
||||||
|
with:
|
||||||
|
name: tfplan
|
||||||
|
path: terraform/tfplan
|
||||||
|
retention-days: 1
|
||||||
|
|
||||||
|
apply:
|
||||||
|
name: Apply
|
||||||
|
needs: plan
|
||||||
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
environment: production
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Install OpenTofu
|
||||||
|
uses: opentofu/setup-opentofu@v1
|
||||||
|
with:
|
||||||
|
tofu_version: latest
|
||||||
|
|
||||||
|
- name: Install SOPS
|
||||||
|
run: |
|
||||||
|
wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
|
||||||
|
sudo dpkg -i /tmp/sops.deb
|
||||||
|
|
||||||
|
- name: Decrypt secrets
|
||||||
|
env:
|
||||||
|
SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
|
||||||
|
run: |
|
||||||
|
find . -name '*.enc.yml' -o -name '*.enc.yaml' | while read f; do
|
||||||
|
out="${f/.enc/}"
|
||||||
|
sops -d "$f" > "$out"
|
||||||
|
echo "Decrypted: $f -> $out"
|
||||||
|
done
|
||||||
|
|
||||||
|
- name: Set backend credentials
|
||||||
|
working-directory: terraform/
|
||||||
|
run: |
|
||||||
|
echo "AWS_ACCESS_KEY_ID=$(yq '.backblaze_keyID' secrets.yaml)" >> "$GITHUB_ENV"
|
||||||
|
echo "AWS_SECRET_ACCESS_KEY=$(yq '.backblaze_applicationKey' secrets.yaml)" >> "$GITHUB_ENV"
|
||||||
|
|
||||||
|
- name: tofu init
|
||||||
|
working-directory: terraform/
|
||||||
|
run: tofu init
|
||||||
|
|
||||||
|
- name: Download plan
|
||||||
|
uses: actions/download-artifact@v4
|
||||||
|
with:
|
||||||
|
name: tfplan
|
||||||
|
path: terraform/
|
||||||
|
|
||||||
|
- name: tofu apply
|
||||||
|
working-directory: terraform/
|
||||||
|
run: tofu apply -auto-approve tfplan
|
||||||
35
.github/workflows/validate-caddyfile.yml
vendored
Normal file
35
.github/workflows/validate-caddyfile.yml
vendored
Normal file
|
|
@ -0,0 +1,35 @@
|
||||||
|
name: Validate Caddyfile
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
paths:
|
||||||
|
- 'ansible/services/caddy/**'
|
||||||
|
- '.github/workflows/validate-caddyfile.yml'
|
||||||
|
pull_request:
|
||||||
|
paths:
|
||||||
|
- 'ansible/services/caddy/**'
|
||||||
|
- '.github/workflows/validate-caddyfile.yml'
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
caddy-validate:
|
||||||
|
name: caddy validate
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Check for Caddyfile
|
||||||
|
id: check
|
||||||
|
run: |
|
||||||
|
if [ -f ansible/services/caddy/Caddyfile ]; then
|
||||||
|
echo "has_file=true" >> "$GITHUB_OUTPUT"
|
||||||
|
else
|
||||||
|
echo "has_file=false" >> "$GITHUB_OUTPUT"
|
||||||
|
echo "No Caddyfile found — skipping."
|
||||||
|
fi
|
||||||
|
|
||||||
|
- name: Validate Caddyfile
|
||||||
|
if: steps.check.outputs.has_file == 'true'
|
||||||
|
run: |
|
||||||
|
curl -sL "https://github.com/caddyserver/caddy/releases/latest/download/caddy_$(curl -sL https://api.github.com/repos/caddyserver/caddy/releases/latest | jq -r .tag_name | tr -d v)_linux_amd64.tar.gz" | tar xz caddy
|
||||||
|
chmod +x caddy
|
||||||
|
./caddy validate --config ansible/services/caddy/Caddyfile --adapter caddyfile
|
||||||
54
.github/workflows/validate-terraform.yml
vendored
Normal file
54
.github/workflows/validate-terraform.yml
vendored
Normal file
|
|
@ -0,0 +1,54 @@
|
||||||
|
name: Validate Terraform
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
paths:
|
||||||
|
- 'terraform/**'
|
||||||
|
- '.github/workflows/validate-terraform.yml'
|
||||||
|
pull_request:
|
||||||
|
paths:
|
||||||
|
- 'terraform/**'
|
||||||
|
- '.github/workflows/validate-terraform.yml'
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
tofu-validate:
|
||||||
|
name: tofu validate
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Install OpenTofu
|
||||||
|
uses: opentofu/setup-opentofu@v1
|
||||||
|
with:
|
||||||
|
tofu_version: latest
|
||||||
|
|
||||||
|
- name: Install SOPS
|
||||||
|
run: |
|
||||||
|
wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
|
||||||
|
sudo dpkg -i /tmp/sops.deb
|
||||||
|
|
||||||
|
- name: Decrypt secrets
|
||||||
|
env:
|
||||||
|
SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
|
||||||
|
run: |
|
||||||
|
find . -name '*.enc.yml' -o -name '*.enc.yaml' | while read f; do
|
||||||
|
out="${f/.enc/}"
|
||||||
|
sops -d "$f" > "$out"
|
||||||
|
echo "Decrypted: $f -> $out"
|
||||||
|
done
|
||||||
|
|
||||||
|
- name: Find and validate Terraform roots
|
||||||
|
run: |
|
||||||
|
found=0
|
||||||
|
for dir in $(find terraform/ -name '*.tf' -printf '%h\n' | sort -u); do
|
||||||
|
echo "::group::Validating $dir"
|
||||||
|
cd "$dir"
|
||||||
|
tofu init -backend=false
|
||||||
|
tofu validate
|
||||||
|
cd "$GITHUB_WORKSPACE"
|
||||||
|
echo "::endgroup::"
|
||||||
|
found=1
|
||||||
|
done
|
||||||
|
if [ "$found" -eq 0 ]; then
|
||||||
|
echo "No .tf files found — skipping validation."
|
||||||
|
fi
|
||||||
53
.gitignore
vendored
Normal file
53
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,53 @@
|
||||||
|
# Terraform
|
||||||
|
*.tfstate
|
||||||
|
*.tfstate.backup
|
||||||
|
*.tfstate.*.backup
|
||||||
|
.terraform/
|
||||||
|
.terraform.lock.hcl
|
||||||
|
crash.log
|
||||||
|
override.tf
|
||||||
|
override.tf.json
|
||||||
|
*_override.tf
|
||||||
|
*_override.tf.json
|
||||||
|
|
||||||
|
# Ansible
|
||||||
|
*.retry
|
||||||
|
|
||||||
|
# Secrets — never commit plaintext secrets
|
||||||
|
*.key
|
||||||
|
*.pem
|
||||||
|
*.crt
|
||||||
|
*.p12
|
||||||
|
*.pfx
|
||||||
|
.vault_pass
|
||||||
|
.vault-password
|
||||||
|
secrets.yml
|
||||||
|
secrets.yaml
|
||||||
|
vault.yml
|
||||||
|
vault.yaml
|
||||||
|
**/secret.env
|
||||||
|
**/.env.secret
|
||||||
|
|
||||||
|
# SOPS (encrypted files are OK, but age keys are not)
|
||||||
|
keys.txt
|
||||||
|
*.agekey
|
||||||
|
|
||||||
|
# Editor / OS
|
||||||
|
.vscode/
|
||||||
|
.idea/
|
||||||
|
*.swp
|
||||||
|
*.swo
|
||||||
|
*~
|
||||||
|
.DS_Store
|
||||||
|
Thumbs.db
|
||||||
|
|
||||||
|
# Python
|
||||||
|
__pycache__/
|
||||||
|
*.pyc
|
||||||
|
.venv/
|
||||||
|
venv/
|
||||||
|
|
||||||
|
# Misc
|
||||||
|
*.log
|
||||||
|
*.bak
|
||||||
|
*.tmp
|
||||||
3
.sops.yaml
Normal file
3
.sops.yaml
Normal file
|
|
@ -0,0 +1,3 @@
|
||||||
|
creation_rules:
|
||||||
|
- path_regex: '\.enc\.(yml|yaml|env)$'
|
||||||
|
age: age1r8uh2w2qad2z5sgq9q7l73962q2sp8zz9hdnh6sjuvanxl565vmswn8squ
|
||||||
9
Makefile
Normal file
9
Makefile
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
.PHONY: decrypt
|
||||||
|
|
||||||
|
# Decrypt all SOPS-encrypted files (*.enc.* -> *.*)
|
||||||
|
decrypt:
|
||||||
|
@find . -name "*.enc.*" ! -name "*.example" -not -path "./.git/*" | while read f; do \
|
||||||
|
out=$$(echo "$$f" | sed 's/\.enc\././'); \
|
||||||
|
echo "Decrypting $$f -> $$out"; \
|
||||||
|
sops -d "$$f" > "$$out"; \
|
||||||
|
done
|
||||||
106
README.md
Normal file
106
README.md
Normal file
|
|
@ -0,0 +1,106 @@
|
||||||
|
# pez-infra
|
||||||
|
|
||||||
|
Infrastructure-as-code monorepo for Pez's homelab and cloud fleet. Everything needed to rebuild, configure, and maintain the server infrastructure from scratch.
|
||||||
|
|
||||||
|
## Architecture Overview
|
||||||
|
|
||||||
|
```
|
||||||
|
┌─────────────┐
|
||||||
|
│ Cloudflare │
|
||||||
|
│ DNS + CDN │
|
||||||
|
└──────┬──────┘
|
||||||
|
│
|
||||||
|
┌──────▼──────┐
|
||||||
|
│ helsinki-a │ Hetzner Cloud
|
||||||
|
│ Caddy proxy│ Reverse proxy + TLS
|
||||||
|
└──────┬──────┘
|
||||||
|
│
|
||||||
|
┌────────────┼────────────┐
|
||||||
|
│ Tailscale mesh │
|
||||||
|
│ │
|
||||||
|
┌─────────▼──┐ ┌──────▼──────┐ ┌─▼───────────┐
|
||||||
|
│ london-b │ │ london-a │ │ copenhagen-a │
|
||||||
|
│ Storage │ │ Monitoring │ │ Gaming │
|
||||||
|
│ Docker │ │ Prometheus │ │ Minecraft │
|
||||||
|
│ services │ │ Grafana │ │ WoW (MaNGOS)│
|
||||||
|
└────────────┘ └─────────────┘ └──────────────┘
|
||||||
|
│
|
||||||
|
┌─────────▼──┐ ┌─────────────┐
|
||||||
|
│ nuremberg-a│ │copenhagen-c │
|
||||||
|
│ Mail │ │ (idle) │
|
||||||
|
│ poste.io │ │ │
|
||||||
|
└────────────┘ └─────────────┘
|
||||||
|
```
|
||||||
|
|
||||||
|
### Hosts
|
||||||
|
|
||||||
|
| Host | Location | OS | Tailscale IP | Role |
|
||||||
|
|------|----------|-----|-------------|------|
|
||||||
|
| helsinki-a | Hetzner Cloud | Linux | 100.67.6.27 | Reverse proxy (Caddy), main traffic gateway |
|
||||||
|
| london-b | London | Linux | 100.84.65.101 | Primary storage (ZFS), Docker services |
|
||||||
|
| london-a | London | FreeBSD | 100.122.219.41 | Monitoring (Prometheus, Grafana) |
|
||||||
|
| nuremberg-a | Hetzner Cloud | Alpine Linux | 100.117.235.28 | Mail server (poste.io) |
|
||||||
|
| copenhagen-a | Copenhagen | Linux | 100.89.206.60 | Gaming servers (Minecraft, WoW/MaNGOS) |
|
||||||
|
| copenhagen-c | Copenhagen | Linux | 100.115.45.53 | Idle/available |
|
||||||
|
|
||||||
|
### Traffic Flow
|
||||||
|
|
||||||
|
1. DNS managed by Cloudflare (Terraform)
|
||||||
|
2. Traffic routes to helsinki-a (Caddy reverse proxy)
|
||||||
|
3. Caddy forwards to backend services over Tailscale mesh
|
||||||
|
4. Auth handled by Authelia with LLDAP backend (on london-b)
|
||||||
|
|
||||||
|
## Directory Structure
|
||||||
|
|
||||||
|
```
|
||||||
|
pez-infra/
|
||||||
|
├── ansible/ # Ansible playbooks, roles, inventory, and all managed files
|
||||||
|
│ ├── roles/ # Ansible roles (caddy, docker, dotfiles, etc.)
|
||||||
|
│ ├── services/ # Docker Compose definitions and service configs
|
||||||
|
│ ├── dotfiles/ # Shell config (fish, nvim, tmux, git, etc.)
|
||||||
|
│ └── scripts/ # Utility and maintenance scripts
|
||||||
|
└── terraform/ # Terraform/OpenTofu for Cloudflare, DNS, etc.
|
||||||
|
```
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Prerequisites
|
||||||
|
|
||||||
|
- SSH access to hosts via Tailscale
|
||||||
|
- `ansible` for configuration management
|
||||||
|
- `tofu` (OpenTofu) or `terraform` for infrastructure provisioning
|
||||||
|
- `gh` CLI for GitHub operations
|
||||||
|
|
||||||
|
### Working with this repo
|
||||||
|
|
||||||
|
1. **Clone:** `git clone git@github.com:RWejlgaard/pez-infra.git`
|
||||||
|
2. **Services:** Each service has its own directory under `ansible/services/` with a `docker-compose.yml` and config files
|
||||||
|
4. **Deploy:** Ansible playbooks in `ansible/` handle deployment (see individual playbook docs)
|
||||||
|
5. **Infrastructure:** Terraform configs in `terraform/` manage DNS, tunnels, and access policies
|
||||||
|
|
||||||
|
### Secrets
|
||||||
|
|
||||||
|
Secrets are encrypted in-repo using [SOPS](https://github.com/getsops/sops) + [age](https://github.com/FiloSottile/age). Encrypted files use `.enc.` in their extension (e.g. `secrets.enc.yml`). See **[Secrets Management](docs/secrets.md)** for full setup and usage instructions.
|
||||||
|
|
||||||
|
Quick start: `./ansible/scripts/sops-setup.sh`
|
||||||
|
|
||||||
|
## Documentation
|
||||||
|
|
||||||
|
Comprehensive documentation lives in [`docs/`](docs/):
|
||||||
|
|
||||||
|
- **[Architecture](docs/architecture.md)** — Network topology, traffic flow, design principles
|
||||||
|
- **[Networking](docs/networking.md)** — Tailscale mesh, DNS flow, physical networking
|
||||||
|
- **[Services](docs/services.md)** — Complete service map with ports, auth, and deployment info
|
||||||
|
- **[Monitoring](docs/monitoring.md)** — Prometheus, Grafana, exporters, status page
|
||||||
|
- **[Getting Started](docs/getting-started.md)** — How to work with this repo
|
||||||
|
|
||||||
|
## Consolidated Repos
|
||||||
|
|
||||||
|
This monorepo replaces several standalone repos:
|
||||||
|
|
||||||
|
- `pez-ansible` → `ansible/`
|
||||||
|
- `pez-terraform` → `terraform/`
|
||||||
|
- `pez-grafana` → `services/grafana/`
|
||||||
|
- `pez-proxy` → `services/caddy/`
|
||||||
|
- `pez-docs` → `docs/` and per-host documentation
|
||||||
|
- `server-scripts` → `scripts/` and `ansible/`
|
||||||
41
ansible/Makefile
Normal file
41
ansible/Makefile
Normal file
|
|
@ -0,0 +1,41 @@
|
||||||
|
.PHONY: deploy deploy-check deploy-host update-all update-linux update-freebsd docker-status reboot ping deps
|
||||||
|
|
||||||
|
# Full fleet deploy
|
||||||
|
deploy:
|
||||||
|
ansible-playbook deploy.yml
|
||||||
|
|
||||||
|
# Dry run (check + diff, no changes)
|
||||||
|
deploy-check:
|
||||||
|
ansible-playbook deploy.yml --check --diff
|
||||||
|
|
||||||
|
# Deploy single host: make deploy-host HOST=helsinki-a
|
||||||
|
deploy-host:
|
||||||
|
ansible-playbook deploy.yml --limit $(HOST)
|
||||||
|
|
||||||
|
# Update all packages across the fleet
|
||||||
|
update-all:
|
||||||
|
ansible-playbook playbooks/update-all.yml
|
||||||
|
|
||||||
|
# Update Linux hosts only (apt + apk)
|
||||||
|
update-linux:
|
||||||
|
ansible-playbook playbooks/update-linux.yml
|
||||||
|
|
||||||
|
# Update FreeBSD hosts only (pkg)
|
||||||
|
update-freebsd:
|
||||||
|
ansible-playbook playbooks/update-freebsd.yml
|
||||||
|
|
||||||
|
# Show Docker container status
|
||||||
|
docker-status:
|
||||||
|
ansible-playbook playbooks/docker-status.yml
|
||||||
|
|
||||||
|
# Reboot a specific host: make reboot HOST=copenhagen-c
|
||||||
|
reboot:
|
||||||
|
ansible-playbook playbooks/reboot.yml --limit $(HOST)
|
||||||
|
|
||||||
|
# Ping all hosts
|
||||||
|
ping:
|
||||||
|
ansible all -m ping
|
||||||
|
|
||||||
|
# Install Ansible Galaxy dependencies
|
||||||
|
deps:
|
||||||
|
ansible-galaxy install -r requirements.yml
|
||||||
73
ansible/README.md
Normal file
73
ansible/README.md
Normal file
|
|
@ -0,0 +1,73 @@
|
||||||
|
# Ansible — Deploy & Maintain
|
||||||
|
|
||||||
|
One-command deploy playbook for rebuilding hosts from repo state.
|
||||||
|
|
||||||
|
## Quick Start
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd ansible/
|
||||||
|
|
||||||
|
# Install dependencies
|
||||||
|
make deps
|
||||||
|
|
||||||
|
# Dry run — see what would change
|
||||||
|
make deploy-check
|
||||||
|
|
||||||
|
# Deploy everything
|
||||||
|
make deploy
|
||||||
|
|
||||||
|
# Deploy a single host
|
||||||
|
make deploy-host HOST=helsinki-a
|
||||||
|
```
|
||||||
|
|
||||||
|
## Playbooks
|
||||||
|
|
||||||
|
| Playbook | Purpose | Usage |
|
||||||
|
|----------|---------|-------|
|
||||||
|
| `deploy.yml` | Full host rebuild from repo | `make deploy` or `--limit <host>` |
|
||||||
|
| `playbooks/update-all.yml` | OS package updates (all hosts) | `make update-all` |
|
||||||
|
| `playbooks/update-linux.yml` | Linux-only updates (apt + apk) | `make update-linux` |
|
||||||
|
| `playbooks/update-freebsd.yml` | FreeBSD-only updates (pkg) | `make update-freebsd` |
|
||||||
|
| `playbooks/docker-status.yml` | Show running containers | `make docker-status` |
|
||||||
|
| `playbooks/reboot.yml` | Safe reboot with pre-flight | `make reboot HOST=<host>` |
|
||||||
|
|
||||||
|
## Deploy Stages
|
||||||
|
|
||||||
|
The deploy playbook runs in stages, each independently taggable:
|
||||||
|
|
||||||
|
1. **common** — Baseline packages, SSH hardening, fish shell
|
||||||
|
2. **docker** — Docker engine on container hosts
|
||||||
|
3. **node-exporter** — Prometheus monitoring agent on all hosts
|
||||||
|
4. **services** — Per-host service deployment:
|
||||||
|
- `helsinki-a`: Caddy reverse proxy
|
||||||
|
- `london-b`: Docker Compose services (Nextcloud, Jellyseer, etc.)
|
||||||
|
- `nuremberg-a`: poste.io mail
|
||||||
|
- `copenhagen-a`: Minecraft + MaNGOS systemd services
|
||||||
|
- `london-a`: Prometheus + Grafana (FreeBSD)
|
||||||
|
5. **verify** — Post-deploy health check
|
||||||
|
|
||||||
|
Run a single stage: `ansible-playbook deploy.yml --tags docker`
|
||||||
|
|
||||||
|
## Roles
|
||||||
|
|
||||||
|
| Role | Description |
|
||||||
|
|------|-------------|
|
||||||
|
| `common` | Base packages, SSH hardening, fish shell |
|
||||||
|
| `docker` | Docker engine install and setup |
|
||||||
|
| `docker-services` | Deploy compose files from `services/` |
|
||||||
|
| `dotfiles` | Shell config from `dotfiles/` |
|
||||||
|
| `caddy` | Caddy reverse proxy (helsinki-a) |
|
||||||
|
| `node-exporter` | Prometheus node_exporter |
|
||||||
|
| `systemd-services` | Custom systemd units from `services/` |
|
||||||
|
|
||||||
|
## Inventory
|
||||||
|
|
||||||
|
Hosts are grouped by OS and role. All use Tailscale IPs, SSH as root.
|
||||||
|
Per-host variables in `inventory/host_vars/<hostname>.yml`.
|
||||||
|
|
||||||
|
## Safety Notes
|
||||||
|
|
||||||
|
- **london-b**: Reboot playbook requires interactive confirmation (critical storage)
|
||||||
|
- **copenhagen-a**: Reboot includes netplan pre-flight check (static IP verification)
|
||||||
|
- All playbooks use `ignore_unreachable: true` for fleet operations
|
||||||
|
- `--check --diff` is your friend — always dry-run first on production
|
||||||
12
ansible/ansible.cfg
Normal file
12
ansible/ansible.cfg
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
[defaults]
|
||||||
|
inventory = inventory/hosts.ini
|
||||||
|
roles_path = roles
|
||||||
|
remote_user = root
|
||||||
|
host_key_checking = False
|
||||||
|
pipelining = True
|
||||||
|
gather_facts = True
|
||||||
|
retry_files_enabled = False
|
||||||
|
result_format = yaml
|
||||||
|
|
||||||
|
[ssh_connection]
|
||||||
|
ssh_args = -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
|
||||||
194
ansible/deploy.yml
Normal file
194
ansible/deploy.yml
Normal file
|
|
@ -0,0 +1,194 @@
|
||||||
|
---
|
||||||
|
# deploy.yml — One-command host rebuild
|
||||||
|
#
|
||||||
|
# Rebuilds a host from bare metal to fully configured using repo state.
|
||||||
|
# Assumes: SSH access via Tailscale, root user, host is in inventory.
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# Full fleet: ansible-playbook deploy.yml
|
||||||
|
# Single host: ansible-playbook deploy.yml --limit helsinki-a
|
||||||
|
# Dry run: ansible-playbook deploy.yml --check --diff
|
||||||
|
#
|
||||||
|
# Prerequisites:
|
||||||
|
# - Target host has SSH access via Tailscale
|
||||||
|
# - Target host has a base OS installed (Debian/Alpine/FreeBSD)
|
||||||
|
# - ansible-galaxy install -r requirements.yml
|
||||||
|
|
||||||
|
# ──────────────────────────────────────────────
|
||||||
|
# Stage 1: Common baseline — all hosts
|
||||||
|
# ──────────────────────────────────────────────
|
||||||
|
- name: "Stage 1: Common baseline"
|
||||||
|
hosts: all
|
||||||
|
tags: [common, baseline]
|
||||||
|
roles:
|
||||||
|
- role: common
|
||||||
|
- role: dotfiles
|
||||||
|
|
||||||
|
# ──────────────────────────────────────────────
|
||||||
|
# Stage 2: Docker engine — hosts that run containers
|
||||||
|
# ──────────────────────────────────────────────
|
||||||
|
- name: "Stage 2: Docker engine"
|
||||||
|
hosts: docker_hosts
|
||||||
|
tags: [docker]
|
||||||
|
roles:
|
||||||
|
- role: docker
|
||||||
|
|
||||||
|
# ──────────────────────────────────────────────
|
||||||
|
# Stage 3: Monitoring agent — all hosts
|
||||||
|
# ──────────────────────────────────────────────
|
||||||
|
- name: "Stage 3: Node exporter"
|
||||||
|
hosts: all
|
||||||
|
tags: [monitoring, node_exporter]
|
||||||
|
roles:
|
||||||
|
- role: node_exporter
|
||||||
|
|
||||||
|
# ──────────────────────────────────────────────
|
||||||
|
# Stage 4: Per-host services
|
||||||
|
# ──────────────────────────────────────────────
|
||||||
|
|
||||||
|
# helsinki-a: Caddy reverse proxy
|
||||||
|
- name: "Stage 4a: Caddy (helsinki-a)"
|
||||||
|
hosts: helsinki-a
|
||||||
|
tags: [services, caddy]
|
||||||
|
roles:
|
||||||
|
- role: caddy
|
||||||
|
|
||||||
|
# london-b: Docker services (storage, apps)
|
||||||
|
- name: "Stage 4b: Docker services (london-b)"
|
||||||
|
hosts: london-b
|
||||||
|
tags: [services, london-b]
|
||||||
|
roles:
|
||||||
|
- role: docker_services
|
||||||
|
|
||||||
|
# nuremberg-a: Mail (poste.io via Docker)
|
||||||
|
- name: "Stage 4c: Mail (nuremberg-a)"
|
||||||
|
hosts: nuremberg-a
|
||||||
|
tags: [services, mail]
|
||||||
|
roles:
|
||||||
|
- role: docker_services
|
||||||
|
|
||||||
|
# copenhagen-a: Gaming servers
|
||||||
|
- name: "Stage 4d: Gaming servers (copenhagen-a)"
|
||||||
|
hosts: copenhagen-a
|
||||||
|
tags: [services, gaming]
|
||||||
|
roles:
|
||||||
|
- role: docker_services
|
||||||
|
- role: systemd_services
|
||||||
|
|
||||||
|
# london-a: Monitoring stack (FreeBSD — Prometheus, Grafana)
|
||||||
|
# Note: london-a uses FreeBSD; monitoring roles handle this via conditionals.
|
||||||
|
- name: "Stage 4e: Monitoring stack (london-a)"
|
||||||
|
hosts: london-a
|
||||||
|
tags: [services, monitoring]
|
||||||
|
tasks:
|
||||||
|
- name: Check for Prometheus config
|
||||||
|
delegate_to: localhost
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: "{{ playbook_dir }}/services/prometheus/prometheus.yml"
|
||||||
|
register: prometheus_config
|
||||||
|
|
||||||
|
- name: Deploy Prometheus config
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: "{{ playbook_dir }}/services/prometheus/prometheus.yml"
|
||||||
|
dest: /usr/local/etc/prometheus.yml
|
||||||
|
mode: '0644'
|
||||||
|
backup: true
|
||||||
|
when: prometheus_config.stat.exists
|
||||||
|
notify: Restart prometheus
|
||||||
|
|
||||||
|
- name: Deploy Prometheus alerting rules
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: "{{ playbook_dir }}/services/prometheus/rules/"
|
||||||
|
dest: /usr/local/etc/prometheus/rules/
|
||||||
|
mode: '0644'
|
||||||
|
failed_when: false
|
||||||
|
notify: Restart prometheus
|
||||||
|
|
||||||
|
- name: Ensure unified_alerting section exists in Grafana config
|
||||||
|
ansible.builtin.lineinfile:
|
||||||
|
path: /usr/local/etc/grafana/grafana.ini
|
||||||
|
regexp: '^\[unified_alerting\]'
|
||||||
|
line: '[unified_alerting]'
|
||||||
|
notify: Restart grafana
|
||||||
|
|
||||||
|
- name: Allow provenance status change in Grafana
|
||||||
|
ansible.builtin.lineinfile:
|
||||||
|
path: /usr/local/etc/grafana/grafana.ini
|
||||||
|
regexp: '^allow_prov_status_change'
|
||||||
|
insertafter: '^\[unified_alerting\]'
|
||||||
|
line: 'allow_prov_status_change = true'
|
||||||
|
notify: Restart grafana
|
||||||
|
|
||||||
|
- name: Deploy Grafana dashboards
|
||||||
|
ansible.posix.synchronize:
|
||||||
|
src: "{{ playbook_dir }}/services/grafana/dashboards/"
|
||||||
|
dest: /usr/local/etc/grafana/dashboards/
|
||||||
|
failed_when: false
|
||||||
|
|
||||||
|
- name: Ensure provisioning dir exists
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ grafana_provisioning_dir }}"
|
||||||
|
state: directory
|
||||||
|
mode: '0755'
|
||||||
|
|
||||||
|
- name: Ensure alerting dir exists
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ grafana_provisioning_dir }}/alerting"
|
||||||
|
state: directory
|
||||||
|
mode: '0755'
|
||||||
|
|
||||||
|
- name: Deploy Grafana provisioning
|
||||||
|
ansible.posix.synchronize:
|
||||||
|
src: "{{ playbook_dir }}/services/grafana/provisioning/"
|
||||||
|
dest: "{{ grafana_provisioning_dir }}/"
|
||||||
|
failed_when: false
|
||||||
|
|
||||||
|
- name: Template contact points with PagerDuty key
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: "{{ playbook_dir }}/services/grafana/provisioning/alerting/contact-points.yml"
|
||||||
|
dest: "{{ grafana_provisioning_dir }}/alerting/contact-points.yml"
|
||||||
|
mode: '0640'
|
||||||
|
owner: root
|
||||||
|
group: grafana
|
||||||
|
no_log: true
|
||||||
|
notify: Restart grafana
|
||||||
|
|
||||||
|
handlers:
|
||||||
|
- name: Restart prometheus
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: prometheus
|
||||||
|
state: restarted
|
||||||
|
|
||||||
|
- name: Restart grafana
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: grafana
|
||||||
|
state: restarted
|
||||||
|
|
||||||
|
# ──────────────────────────────────────────────
|
||||||
|
# Stage 5: Verification
|
||||||
|
# ──────────────────────────────────────────────
|
||||||
|
- name: "Stage 5: Post-deploy verification"
|
||||||
|
hosts: all
|
||||||
|
tags: [verify]
|
||||||
|
tasks:
|
||||||
|
- name: Check SSH is working
|
||||||
|
ansible.builtin.ping:
|
||||||
|
|
||||||
|
- name: Gather uptime
|
||||||
|
ansible.builtin.command: uptime
|
||||||
|
changed_when: false
|
||||||
|
register: uptime_result
|
||||||
|
|
||||||
|
- name: Check Docker containers (where applicable)
|
||||||
|
ansible.builtin.command: docker ps --format "table {{ '{{' }}.Names{{ '}}' }}\t{{ '{{' }}.Status{{ '}}' }}"
|
||||||
|
changed_when: false
|
||||||
|
register: docker_status
|
||||||
|
when: "'docker_hosts' in group_names"
|
||||||
|
failed_when: false
|
||||||
|
|
||||||
|
- name: Report host status
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: |
|
||||||
|
Host: {{ inventory_hostname }} ({{ host_description | default('no description') }})
|
||||||
|
Uptime: {{ uptime_result.stdout }}
|
||||||
|
Docker: {{ docker_status.stdout_lines | default(['N/A']) | join('\n') }}
|
||||||
9
ansible/dotfiles/Dockerfile-alpine
Normal file
9
ansible/dotfiles/Dockerfile-alpine
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
FROM alpine:latest
|
||||||
|
|
||||||
|
COPY . /workspace
|
||||||
|
|
||||||
|
WORKDIR /workspace
|
||||||
|
|
||||||
|
RUN apk add make shadow bash sudo
|
||||||
|
|
||||||
|
RUN make
|
||||||
10
ansible/dotfiles/Dockerfile-archlinux
Normal file
10
ansible/dotfiles/Dockerfile-archlinux
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
FROM archlinux:latest
|
||||||
|
|
||||||
|
COPY ../. /workspace
|
||||||
|
|
||||||
|
WORKDIR /workspace
|
||||||
|
|
||||||
|
RUN pacman -Syy
|
||||||
|
RUN pacman -S --noconfirm make sudo git which
|
||||||
|
|
||||||
|
RUN make
|
||||||
10
ansible/dotfiles/Dockerfile-fedora
Normal file
10
ansible/dotfiles/Dockerfile-fedora
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
FROM fedora:latest
|
||||||
|
|
||||||
|
COPY ../. /workspace
|
||||||
|
|
||||||
|
WORKDIR /workspace
|
||||||
|
|
||||||
|
RUN dnf -y update
|
||||||
|
RUN dnf -y install make sudo
|
||||||
|
|
||||||
|
RUN make
|
||||||
9
ansible/dotfiles/Dockerfile-ubuntu
Normal file
9
ansible/dotfiles/Dockerfile-ubuntu
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
FROM ubuntu:latest
|
||||||
|
|
||||||
|
COPY ../. /workspace
|
||||||
|
|
||||||
|
WORKDIR /workspace
|
||||||
|
|
||||||
|
RUN apt install --update -y make sudo
|
||||||
|
|
||||||
|
RUN make
|
||||||
15
ansible/dotfiles/Makefile
Normal file
15
ansible/dotfiles/Makefile
Normal file
|
|
@ -0,0 +1,15 @@
|
||||||
|
full-install:
|
||||||
|
@bash ./install-scripts/01-install-packages.sh
|
||||||
|
@bash ./install-scripts/02-move-files.sh
|
||||||
|
@fish ./install-scripts/03-fisher-install.fish
|
||||||
|
@fish ./install-scripts/04-fish-plugins.fish
|
||||||
|
@fish ./install-scripts/05-tmux-plugins.fish
|
||||||
|
@fish ./install-scripts/06-vim-setup.fish
|
||||||
|
@bash ./install-scripts/07-last-touches.sh
|
||||||
|
@exec fish
|
||||||
|
|
||||||
|
refresh:
|
||||||
|
@bash ./install-scripts/02-move-files.sh
|
||||||
|
@exec fish
|
||||||
|
|
||||||
|
.PHONY: full-install
|
||||||
70
ansible/dotfiles/README.md
Normal file
70
ansible/dotfiles/README.md
Normal file
|
|
@ -0,0 +1,70 @@
|
||||||
|
# Dotfiles
|
||||||
|
|
||||||
|
Shell configuration, editor setup, and terminal config — consolidated from the standalone [dotfiles](https://github.com/RWejlgaard/dotfiles) repo.
|
||||||
|
|
||||||
|
## What's here
|
||||||
|
|
||||||
|
```
|
||||||
|
dotfiles/
|
||||||
|
├── config/
|
||||||
|
│ ├── fish/ # Fish shell config
|
||||||
|
│ │ ├── config.fish # Main config (greeting, editor, TERM)
|
||||||
|
│ │ └── conf.d/ # Auto-sourced by fish
|
||||||
|
│ │ ├── aliases.fish # OS-aware package manager aliases, k8s shortcuts
|
||||||
|
│ │ ├── envvars.fish # PATH and env vars
|
||||||
|
│ │ └── functions.fish # !! expansion, cheat, gitissue
|
||||||
|
│ ├── tmux/
|
||||||
|
│ │ └── tmux.conf # Prefix C-a, Alt keybindings, mouse, TPM plugins
|
||||||
|
│ ├── nvim/
|
||||||
|
│ │ └── init.lua # Lazy.nvim, LSP (Mason), Copilot, Neo-tree, Treesitter
|
||||||
|
│ ├── kitty/
|
||||||
|
│ │ └── kitty.conf # Color scheme, TERM fix
|
||||||
|
│ └── git/
|
||||||
|
│ └── gitconfig # user.name/email, gh credential helper
|
||||||
|
├── install-scripts/ # Numbered install scripts (from upstream dotfiles repo)
|
||||||
|
│ ├── 01-install-packages.sh # OS-aware package install
|
||||||
|
│ ├── 02-move-files.sh # Legacy copy-based deploy (use install.sh instead)
|
||||||
|
│ ├── 03-fisher-install.fish # Fisher plugin manager
|
||||||
|
│ ├── 04-fish-plugins.fish # Tide prompt
|
||||||
|
│ ├── 05-tmux-plugins.fish # TPM + plugins
|
||||||
|
│ ├── 06-vim-setup.fish # Lazy.nvim bootstrap
|
||||||
|
│ └── 07-last-touches.sh # Set fish as default shell, ~/bin
|
||||||
|
├── scripts/ # Utility scripts (Gentoo kernel upgrade helpers)
|
||||||
|
├── install.sh # Main install: symlinks + packages + plugins
|
||||||
|
└── Makefile # Legacy `make` target (calls install-scripts directly)
|
||||||
|
```
|
||||||
|
|
||||||
|
## Quick start
|
||||||
|
|
||||||
|
### Symlinks only (no package install)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
./install.sh --link
|
||||||
|
```
|
||||||
|
|
||||||
|
This creates symlinks from the config files in this directory to their expected locations (`~/.config/fish/`, `~/.tmux.conf`, etc.). Existing files are backed up to `~/.dotfiles-backup/<timestamp>/`.
|
||||||
|
|
||||||
|
### Full install (packages + plugins + shell change)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
./install.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
Runs package installation (OS-aware), symlinks configs, installs Fish/Tmux/Neovim plugins, and sets Fish as the default shell.
|
||||||
|
|
||||||
|
## Fleet notes
|
||||||
|
|
||||||
|
Most servers run Fish as root shell. Current state captured from live fleet (2026-03-22):
|
||||||
|
|
||||||
|
| Host | Shell | Git configured | Dotfiles deployed |
|
||||||
|
|------|-------|----------------|-------------------|
|
||||||
|
| helsinki-a | fish | Yes (pez@pez.sh) | Yes (full) |
|
||||||
|
| london-b | fish | Yes (pez@pez.sh) | Partial (fish default, tmux custom) |
|
||||||
|
| nuremberg-a | fish | No | No |
|
||||||
|
| london-a | sh (FreeBSD) | No | No |
|
||||||
|
| copenhagen-a | fish | No (SpigotMC default) | No |
|
||||||
|
| copenhagen-c | fish | No | No |
|
||||||
|
|
||||||
|
## Relationship to upstream
|
||||||
|
|
||||||
|
This is a copy of [RWejlgaard/dotfiles](https://github.com/RWejlgaard/dotfiles) consolidated into the monorepo. The upstream repo can be archived once this is verified working. Key difference: `install.sh` here uses **symlinks** instead of copies, so editing configs in the repo takes effect immediately.
|
||||||
42
ansible/dotfiles/config/fish/conf.d/aliases.fish
Normal file
42
ansible/dotfiles/config/fish/conf.d/aliases.fish
Normal file
|
|
@ -0,0 +1,42 @@
|
||||||
|
# aliases
|
||||||
|
|
||||||
|
# Package manager aliases
|
||||||
|
if [ uname = "Darwin" ]
|
||||||
|
alias get="brew install"
|
||||||
|
alias search="brew search"
|
||||||
|
else if [ -f /etc/arch-release ]
|
||||||
|
alias get="sudo pacman -S"
|
||||||
|
alias search="pacman -Ss"
|
||||||
|
else if [ -f /etc/lsb-release ]
|
||||||
|
alias get="sudo apt install"
|
||||||
|
alias search="apt search"
|
||||||
|
else if [ -f /etc/alpine-release ]
|
||||||
|
alias get="apk add"
|
||||||
|
alias search="apk search"
|
||||||
|
else if [ uname = "FreeBSD" ]
|
||||||
|
alias get="sudo pkg install -y"
|
||||||
|
alias search="pkg search"
|
||||||
|
else if [ -f /etc/gentoo-release ]
|
||||||
|
alias get="sudo emerge"
|
||||||
|
alias search="emerge --search"
|
||||||
|
end
|
||||||
|
|
||||||
|
alias vim=nvim
|
||||||
|
alias cat="bat -Pp"
|
||||||
|
|
||||||
|
alias k="kubectl"
|
||||||
|
alias kp="kubectl get pods -A"
|
||||||
|
alias kc="kubectx"
|
||||||
|
|
||||||
|
# Gentoo
|
||||||
|
alias gentoo-check-update="sudo emerge --sync; and sudo emerge -avuDNp @world | genlop -p"
|
||||||
|
alias gentoo-upgrade="sudo emerge -avuDN @world"
|
||||||
|
|
||||||
|
function gentoo-package-use
|
||||||
|
sudo vim /etc/portage/package.use/$argv
|
||||||
|
end
|
||||||
|
|
||||||
|
# Volume control (pipewire)
|
||||||
|
function vol
|
||||||
|
wpctl set-volume @DEFAULT_SINK@ $argv% 2>&1 > /dev/null
|
||||||
|
end
|
||||||
7
ansible/dotfiles/config/fish/conf.d/envvars.fish
Normal file
7
ansible/dotfiles/config/fish/conf.d/envvars.fish
Normal file
|
|
@ -0,0 +1,7 @@
|
||||||
|
# Environment variables for fish shell
|
||||||
|
|
||||||
|
# PATH additions
|
||||||
|
export PATH="$HOME/bin:$PATH"
|
||||||
|
export PATH="$HOME/.local/bin:$PATH"
|
||||||
|
|
||||||
|
# Other environment variables goes here
|
||||||
20
ansible/dotfiles/config/fish/conf.d/functions.fish
Normal file
20
ansible/dotfiles/config/fish/conf.d/functions.fish
Normal file
|
|
@ -0,0 +1,20 @@
|
||||||
|
# Replicate the behavior of `!!` in bash
|
||||||
|
function last_history_item
|
||||||
|
echo $history[1]
|
||||||
|
end
|
||||||
|
abbr -a !! --position anywhere --function last_history_item
|
||||||
|
|
||||||
|
# lookup various commands/syntax in a pinch
|
||||||
|
function cheat --description "help <field> <topic>"
|
||||||
|
set args (echo $argv[2..-1] | tr ' ' '+')
|
||||||
|
curl "cht.sh/$argv[1]/$args"
|
||||||
|
end
|
||||||
|
|
||||||
|
# update master and create a branch with value: $1
|
||||||
|
function gitissue
|
||||||
|
git reset --hard
|
||||||
|
git checkout master
|
||||||
|
git pull origin master
|
||||||
|
git branch $argv[1]
|
||||||
|
git checkout $argv[1]
|
||||||
|
end
|
||||||
3
ansible/dotfiles/config/fish/config.fish
Normal file
3
ansible/dotfiles/config/fish/config.fish
Normal file
|
|
@ -0,0 +1,3 @@
|
||||||
|
export fish_greeting="" # Silence welcome message
|
||||||
|
export EDITOR=nvim
|
||||||
|
export TERM=xterm
|
||||||
17
ansible/dotfiles/config/git/gitconfig
Normal file
17
ansible/dotfiles/config/git/gitconfig
Normal file
|
|
@ -0,0 +1,17 @@
|
||||||
|
[user]
|
||||||
|
name = Rasmus Wejlgaard
|
||||||
|
email = pez@pez.sh
|
||||||
|
|
||||||
|
[credential "https://github.com"]
|
||||||
|
helper =
|
||||||
|
helper = !/usr/bin/gh auth git-credential
|
||||||
|
|
||||||
|
[credential "https://gist.github.com"]
|
||||||
|
helper =
|
||||||
|
helper = !/usr/bin/gh auth git-credential
|
||||||
|
|
||||||
|
[init]
|
||||||
|
defaultBranch = main
|
||||||
|
|
||||||
|
[pull]
|
||||||
|
rebase = false
|
||||||
22
ansible/dotfiles/config/kitty/kitty.conf
Normal file
22
ansible/dotfiles/config/kitty/kitty.conf
Normal file
|
|
@ -0,0 +1,22 @@
|
||||||
|
# Kitty config file
|
||||||
|
|
||||||
|
# Preferred color scheme
|
||||||
|
color0 #000000
|
||||||
|
color8 #555555
|
||||||
|
color1 #ff0000
|
||||||
|
color9 #ff0000
|
||||||
|
color2 #00ff00
|
||||||
|
color10 #00ff00
|
||||||
|
color3 #ffff00
|
||||||
|
color11 #ffff00
|
||||||
|
color4 #5555ff
|
||||||
|
color12 #5555ff
|
||||||
|
color5 #ff00ff
|
||||||
|
color13 #ff00ff
|
||||||
|
color6 #00ffff
|
||||||
|
color14 #00ffff
|
||||||
|
color7 #ffffff
|
||||||
|
color15 #ffffff
|
||||||
|
|
||||||
|
# For some reason kitty likes using "xterm-kitty" as TERM (this breaks a lot of stuff) so let's set this to xterm
|
||||||
|
term xterm
|
||||||
281
ansible/dotfiles/config/nvim/init.lua
Normal file
281
ansible/dotfiles/config/nvim/init.lua
Normal file
|
|
@ -0,0 +1,281 @@
|
||||||
|
-- Bootstrap packer, if it's not installed (first run)
|
||||||
|
local fn = vim.fn
|
||||||
|
local install_path = fn.stdpath('data') .. '/site/pack/packer/start/packer.nvim'
|
||||||
|
if fn.empty(fn.glob(install_path)) > 0 then
|
||||||
|
Packer_bootstrap = fn.system({ 'git', 'clone', '--depth', '1', 'https://github.com/wbthomason/packer.nvim',
|
||||||
|
install_path })
|
||||||
|
end
|
||||||
|
|
||||||
|
local lazypath = vim.fn.stdpath 'data' .. '/lazy/lazy.nvim'
|
||||||
|
if not (vim.uv or vim.loop).fs_stat(lazypath) then
|
||||||
|
local lazyrepo = 'https://github.com/folke/lazy.nvim.git'
|
||||||
|
local out = vim.fn.system { 'git', 'clone', '--filter=blob:none', '--branch=stable', lazyrepo, lazypath }
|
||||||
|
if vim.v.shell_error ~= 0 then
|
||||||
|
error('Error cloning lazy.nvim:\n' .. out)
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
---@type vim.Option
|
||||||
|
local rtp = vim.opt.rtp
|
||||||
|
rtp:prepend(lazypath)
|
||||||
|
|
||||||
|
require('lazy').setup({
|
||||||
|
{ 'airblade/vim-gitgutter' }, -- show git changes in the gutter
|
||||||
|
{ 'hashivim/vim-terraform' }, -- terraform syntax highlighting
|
||||||
|
{
|
||||||
|
'junegunn/fzf',
|
||||||
|
run = 'fzf#install()'
|
||||||
|
},
|
||||||
|
{'junegunn/fzf.vim'},
|
||||||
|
{ 'EdenEast/nightfox.nvim' }, -- nightfox theme
|
||||||
|
{ 'nvim-treesitter/nvim-treesitter' }, -- treesitter, makes syntax highlighting better
|
||||||
|
{ 'scrooloose/nerdcommenter' }, -- easy commenting
|
||||||
|
{ 'tpope/vim-fugitive' }, -- git integration with :G{git cmd}
|
||||||
|
{ 'itchyny/lightline.vim' }, -- statusline
|
||||||
|
{ 'wookayin/fzf-ripgrep.vim' }, -- fzf ripgrep integration, for "<leader>/"
|
||||||
|
{ 'yuki-yano/fzf-preview.vim' }, -- fzf preview
|
||||||
|
{ 'wbthomason/packer.nvim' }, -- package manager
|
||||||
|
{ 'fatih/vim-go' }, -- go syntax highlighting
|
||||||
|
{ "ellisonleao/glow.nvim" }, -- markdown preview using :Glow
|
||||||
|
{ 'rhysd/git-messenger.vim' }, -- Show git messages under cursor
|
||||||
|
{ 'onsails/lspkind.nvim' }, -- lsp kind, makes autocomplete look better
|
||||||
|
{ 'zbirenbaum/copilot.lua' }, -- copilot
|
||||||
|
{ 'hrsh7th/vim-vsnip' },
|
||||||
|
{ -- copilot addon for cmp
|
||||||
|
"zbirenbaum/copilot-cmp",
|
||||||
|
after = { "copilot.lua" },
|
||||||
|
config = function()
|
||||||
|
require("copilot_cmp").setup()
|
||||||
|
end
|
||||||
|
},
|
||||||
|
{ 'nvim-lua/plenary.nvim' }, -- lua utility functions
|
||||||
|
{ 'CopilotC-Nvim/CopilotChat.nvim' }, -- copilot chat
|
||||||
|
{ -- adds file bars along the top similar to vscode
|
||||||
|
'romgrk/barbar.nvim',
|
||||||
|
dependencies = { 'kyazdani42/nvim-web-devicons' }
|
||||||
|
},
|
||||||
|
{ -- adds a file explorer similar to vscode
|
||||||
|
"nvim-neo-tree/neo-tree.nvim",
|
||||||
|
branch = "v3.x",
|
||||||
|
dependencies = {
|
||||||
|
"nvim-lua/plenary.nvim",
|
||||||
|
"nvim-tree/nvim-web-devicons", -- not strictly required, but recommended
|
||||||
|
"MunifTanjim/nui.nvim",
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{ -- adds diagnostics for files
|
||||||
|
"folke/trouble.nvim",
|
||||||
|
dependencies = "kyazdani42/nvim-web-devicons",
|
||||||
|
config = function()
|
||||||
|
require("trouble").setup {}
|
||||||
|
end
|
||||||
|
},
|
||||||
|
{ -- better terminal
|
||||||
|
's1n7ax/nvim-terminal',
|
||||||
|
config = function()
|
||||||
|
vim.o.hidden = true
|
||||||
|
require('nvim-terminal').setup()
|
||||||
|
end
|
||||||
|
},
|
||||||
|
{ -- mason, easy download and install of LSPs
|
||||||
|
"williamboman/mason.nvim",
|
||||||
|
"williamboman/mason-lspconfig.nvim",
|
||||||
|
"neovim/nvim-lspconfig"
|
||||||
|
},
|
||||||
|
{ -- LSP
|
||||||
|
'VonHeikemen/lsp-zero.nvim',
|
||||||
|
dependencies = { -- LSP Support
|
||||||
|
{ 'neovim/nvim-lspconfig' }, { 'williamboman/nvim-lsp-installer' }, -- Autocompletion
|
||||||
|
{ 'hrsh7th/nvim-cmp' }, { 'hrsh7th/cmp-buffer' }, { 'hrsh7th/cmp-path' }, { 'saadparwaiz1/cmp_luasnip' },
|
||||||
|
{ 'hrsh7th/cmp-nvim-lsp' }, { 'hrsh7th/cmp-nvim-lua' }, -- Snippets
|
||||||
|
{ 'L3MON4D3/LuaSnip' }, { 'rafamadriz/friendly-snippets' } }
|
||||||
|
},
|
||||||
|
})
|
||||||
|
|
||||||
|
-- settings
|
||||||
|
vim.opt.termguicolors = true
|
||||||
|
vim.opt.guifont = 'FiraCode Nerd Font:h12'
|
||||||
|
vim.opt.number = true
|
||||||
|
vim.opt.smarttab = true
|
||||||
|
vim.opt.tabstop = 8
|
||||||
|
vim.opt.softtabstop = 0
|
||||||
|
vim.opt.expandtab = true
|
||||||
|
vim.opt.shiftwidth = 4
|
||||||
|
vim.opt.backspace = '2'
|
||||||
|
vim.opt.laststatus = 2
|
||||||
|
vim.opt.mouse = 'a'
|
||||||
|
vim.opt.clipboard = 'unnamed'
|
||||||
|
vim.opt.scrolloff = 17
|
||||||
|
vim.cmd('set tabstop=8 softtabstop=0 expandtab shiftwidth=4 smarttab')
|
||||||
|
vim.opt.number = true
|
||||||
|
vim.opt.colorcolumn = '80'
|
||||||
|
vim.g.terraform_fmt_on_save = true
|
||||||
|
|
||||||
|
-- keybindings
|
||||||
|
local opts = {
|
||||||
|
noremap = true,
|
||||||
|
silent = true
|
||||||
|
}
|
||||||
|
vim.api.nvim_set_keymap('n', 'nt', ':Neotree toggle<CR>', opts)
|
||||||
|
vim.api.nvim_set_keymap('n', 'qqq', ':qall<CR>', opts)
|
||||||
|
vim.api.nvim_set_keymap('n', '<C-f>', ':Files<CR>', opts)
|
||||||
|
vim.api.nvim_set_keymap('n', '<leader>/', ':Rg<CR>', opts)
|
||||||
|
|
||||||
|
vim.api.nvim_set_keymap('n', '<leader>v', ':vsplit<CR>', opts)
|
||||||
|
vim.api.nvim_set_keymap('n', '<leader>h', ':split<CR>', opts)
|
||||||
|
vim.api.nvim_set_keymap('n', '<leader>b', ':Buffers<CR>', opts)
|
||||||
|
vim.api.nvim_set_keymap('t', '<leader><ESC>', '<C-\\><C-n>', opts)
|
||||||
|
vim.api.nvim_set_keymap('n', '<leader>d', ':Trouble diagnostics toggle<CR>', opts)
|
||||||
|
vim.api.nvim_set_keymap('n', '<leader>g', ':GitMessenger<CR>', opts)
|
||||||
|
vim.api.nvim_set_keymap('n', 'd', '"_d', opts)
|
||||||
|
vim.api.nvim_set_keymap('v', 'd', '"_d', opts)
|
||||||
|
vim.api.nvim_set_keymap('n', 'c', '"_c', opts)
|
||||||
|
vim.api.nvim_set_keymap('v', 'c', '"_c', opts)
|
||||||
|
|
||||||
|
-- plugins setup
|
||||||
|
require("CopilotChat").setup {}
|
||||||
|
|
||||||
|
require("copilot").setup({
|
||||||
|
suggestion = {
|
||||||
|
enabled = false
|
||||||
|
},
|
||||||
|
panel = {
|
||||||
|
enabled = false
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
require("nvim-lsp-installer").setup {}
|
||||||
|
|
||||||
|
require("neo-tree").setup {
|
||||||
|
close_on_open = false,
|
||||||
|
close_if_last_window = true,
|
||||||
|
window = {
|
||||||
|
width = 40,
|
||||||
|
side = "left",
|
||||||
|
auto_resize = true,
|
||||||
|
mappings = {
|
||||||
|
["o"] = "open"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
filesystem = {
|
||||||
|
hijack_netrw_behavior = "open_current"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
-- Open NeoTree on startup when no file is specified
|
||||||
|
--vim.api.nvim_create_augroup('NeoTreeOnStartup', { clear = true })
|
||||||
|
--vim.api.nvim_create_autocmd('VimEnter', {
|
||||||
|
--group = 'NeoTreeOnStartup',
|
||||||
|
--callback = function()
|
||||||
|
--if vim.fn.argc() == 0 then
|
||||||
|
--vim.cmd('Neotree toggle')
|
||||||
|
--end
|
||||||
|
--end
|
||||||
|
--})
|
||||||
|
|
||||||
|
-- Language Server
|
||||||
|
local lsp_zero = require('lsp-zero')
|
||||||
|
local cmp = require('cmp')
|
||||||
|
|
||||||
|
lsp_zero.on_attach(function(_, bufnr)
|
||||||
|
lsp_zero.default_keymaps({
|
||||||
|
buffer = bufnr
|
||||||
|
})
|
||||||
|
end)
|
||||||
|
|
||||||
|
require('mason').setup({})
|
||||||
|
require('mason-lspconfig').setup({
|
||||||
|
ensure_installed = {
|
||||||
|
'bashls',
|
||||||
|
'dockerls',
|
||||||
|
'gopls',
|
||||||
|
'jsonls',
|
||||||
|
'yamlls',
|
||||||
|
'pyright',
|
||||||
|
},
|
||||||
|
handlers = {
|
||||||
|
lsp_zero.default_setup,
|
||||||
|
lua_ls = function()
|
||||||
|
local lua_opts = lsp_zero.nvim_lua_ls()
|
||||||
|
require('lspconfig').lua_ls.setup(lua_opts)
|
||||||
|
end
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
local lspkind = require('lspkind')
|
||||||
|
lspkind.init({
|
||||||
|
symbol_map = {
|
||||||
|
Copilot = ""
|
||||||
|
}
|
||||||
|
})
|
||||||
|
vim.api.nvim_set_hl(0, "CmpItemKindCopilot", { --
|
||||||
|
fg = "#6CC644"
|
||||||
|
})
|
||||||
|
|
||||||
|
cmp.setup({
|
||||||
|
formatting = {
|
||||||
|
format = lspkind.cmp_format({
|
||||||
|
mode = 'symbol', -- show only symbol annotations
|
||||||
|
maxwidth = 70, -- prevent the popup from showing more than provided characters (e.g 50 will not show more than 50 characters)
|
||||||
|
-- can also be a function to dynamically calculate max width such as
|
||||||
|
-- maxwidth = function() return math.floor(0.45 * vim.o.columns) end,
|
||||||
|
ellipsis_char = '...', -- when popup menu exceed maxwidth, the truncated part would show ellipsis_char instead (must define maxwidth first)
|
||||||
|
show_labelDetails = true, -- show labelDetails in menu. Disabled by default
|
||||||
|
|
||||||
|
-- The function below will be called before any actual modifications from lspkind
|
||||||
|
-- so that you can provide more controls on popup customization. (See [#30](https://github.com/onsails/lspkind-nvim/pull/30))
|
||||||
|
before = function(_, vim_item)
|
||||||
|
-- do some customizations ...
|
||||||
|
return vim_item
|
||||||
|
end
|
||||||
|
})
|
||||||
|
},
|
||||||
|
snippet = {
|
||||||
|
-- REQUIRED - you must specify a snippet engine
|
||||||
|
expand = function(args)
|
||||||
|
vim.fn["vsnip#anonymous"](args.body) -- For `vsnip` users.
|
||||||
|
-- require('luasnip').lsp_expand(args.body) -- For `luasnip` users.
|
||||||
|
-- require('snippy').expand_snippet(args.body) -- For `snippy` users.
|
||||||
|
-- vim.fn["UltiSnips#Anon"](args.body) -- For `ultisnips` users.
|
||||||
|
-- vim.snippet.expand(args.body) -- For native neovim snippets (Neovim v0.10+)
|
||||||
|
end
|
||||||
|
},
|
||||||
|
window = {
|
||||||
|
-- completion = cmp.config.window.bordered(),
|
||||||
|
-- documentation = cmp.config.window.bordered(),
|
||||||
|
},
|
||||||
|
mapping = cmp.mapping.preset.insert({
|
||||||
|
['<C-b>'] = cmp.mapping.scroll_docs(-4),
|
||||||
|
['<C-f>'] = cmp.mapping.scroll_docs(4),
|
||||||
|
['<C-Space>'] = cmp.mapping.complete(),
|
||||||
|
['<C-e>'] = cmp.mapping.abort(),
|
||||||
|
['<CR>'] = cmp.mapping.confirm({
|
||||||
|
select = true
|
||||||
|
}) -- Accept currently selected item. Set `select` to `false` to only confirm explicitly selected items.
|
||||||
|
}),
|
||||||
|
sources = cmp.config.sources({ {
|
||||||
|
name = 'copilot'
|
||||||
|
}, {
|
||||||
|
name = 'nvim_lsp'
|
||||||
|
}, {
|
||||||
|
name = 'nvim_lua'
|
||||||
|
}, {
|
||||||
|
name = 'path'
|
||||||
|
} -- For vsnip users.
|
||||||
|
-- { name = 'luasnip' }, -- For luasnip users.
|
||||||
|
-- { name = 'ultisnips' }, -- For ultisnips users.
|
||||||
|
-- { name = 'snippy' }, -- For snippy users.
|
||||||
|
}, { {
|
||||||
|
name = 'buffer'
|
||||||
|
} })
|
||||||
|
})
|
||||||
|
|
||||||
|
-- enable diagnostics for showing in-line
|
||||||
|
vim.g.diagnostics_active = true
|
||||||
|
vim.diagnostic.config {
|
||||||
|
virtual_text = true,
|
||||||
|
signs = true,
|
||||||
|
underline = true
|
||||||
|
}
|
||||||
|
|
||||||
|
vim.cmd('colorscheme murphy')
|
||||||
88
ansible/dotfiles/config/tmux/tmux.conf
Normal file
88
ansible/dotfiles/config/tmux/tmux.conf
Normal file
|
|
@ -0,0 +1,88 @@
|
||||||
|
set -g prefix C-a
|
||||||
|
unbind-key C-b
|
||||||
|
bind-key C-a send-prefix
|
||||||
|
|
||||||
|
bind -n M-_ split-window -h -c "#{pane_current_path}"
|
||||||
|
bind -n M-- split-window -v -c "#{pane_current_path}"
|
||||||
|
unbind '"'
|
||||||
|
unbind %
|
||||||
|
|
||||||
|
bind -n M-Left select-pane -L
|
||||||
|
bind -n M-Right select-pane -R
|
||||||
|
bind -n M-Up select-pane -U
|
||||||
|
bind -n M-Down select-pane -D
|
||||||
|
|
||||||
|
bind -n M-[ previous-window
|
||||||
|
bind -n M-] next-window
|
||||||
|
|
||||||
|
bind -n M-\{ swap-pane -U
|
||||||
|
bind -n M-\} swap-pane -D
|
||||||
|
|
||||||
|
set -g mouse on
|
||||||
|
|
||||||
|
set-option -g allow-rename off
|
||||||
|
|
||||||
|
set -g base-index 1
|
||||||
|
setw -g pane-base-index 1
|
||||||
|
|
||||||
|
bind-key -n M-S-Up resize-pane -U 5
|
||||||
|
bind-key -n M-S-Down resize-pane -D 5
|
||||||
|
bind-key -n M-S-Left resize-pane -L 5
|
||||||
|
bind-key -n M-S-Right resize-pane -R 5
|
||||||
|
|
||||||
|
bind -n M-q kill-pane
|
||||||
|
bind -n M-S-q kill-window
|
||||||
|
|
||||||
|
bind -n M-1 select-window -t 1
|
||||||
|
bind -n M-2 select-window -t 2
|
||||||
|
bind -n M-3 select-window -t 3
|
||||||
|
bind -n M-4 select-window -t 4
|
||||||
|
bind -n M-5 select-window -t 5
|
||||||
|
bind -n M-6 select-window -t 6
|
||||||
|
bind -n M-7 select-window -t 7
|
||||||
|
bind -n M-8 select-window -t 8
|
||||||
|
bind -n M-9 select-window -t 9
|
||||||
|
|
||||||
|
bind -n M-Enter new-window
|
||||||
|
|
||||||
|
setw -g monitor-activity on
|
||||||
|
set -g visual-activity on
|
||||||
|
|
||||||
|
set -sg escape-time 0
|
||||||
|
|
||||||
|
# Plugins
|
||||||
|
set -g @plugin 'tmux-plugins/tpm'
|
||||||
|
set -g @plugin 'nhdaly/tmux-better-mouse-mode'
|
||||||
|
set -g @plugin 'tmux-plugins/tmux-cpu'
|
||||||
|
|
||||||
|
# pane borders
|
||||||
|
set -g pane-border-style 'fg=colour8'
|
||||||
|
set -g pane-active-border-style 'fg=colour7'
|
||||||
|
|
||||||
|
# statusbar
|
||||||
|
set -g status-position bottom # status bar at the bottom
|
||||||
|
set -g status-justify centre # center window buttons
|
||||||
|
set -g status-style 'fg=colour7'
|
||||||
|
set -g status-left ' #H ' # Hostname on the left
|
||||||
|
set -g @cpu_percentage_format "%3.0f%%"
|
||||||
|
set -g @ram_percentage_format "%3.0f%%"
|
||||||
|
|
||||||
|
# Set CPU and RAM to be shown in the status bar
|
||||||
|
set -g status-right '#[fg=colour7 bg=colour234] CPU: #(~/.tmux/plugins/tmux-cpu/scripts/cpu_percentage.sh)% | RAM: #(~/.tmux/plugins/tmux-cpu/scripts/ram_percentage.sh) | %H:%M:%S '
|
||||||
|
|
||||||
|
# Tmux sections needs a preset length
|
||||||
|
set -g status-right-length 50
|
||||||
|
set -g status-left-length 30
|
||||||
|
|
||||||
|
# window tabs
|
||||||
|
setw -g window-status-current-style 'fg=colour0 bg=colour7'
|
||||||
|
setw -g window-status-current-format ' #I #W ' # Window ID, Window Name
|
||||||
|
|
||||||
|
setw -g window-status-style 'fg=colour8'
|
||||||
|
setw -g window-status-format ' #I #W ' # Window ID, Window Name
|
||||||
|
|
||||||
|
setw -g window-status-bell-style 'fg=colour234 bg=colour0 bold'
|
||||||
|
|
||||||
|
# plugins runs
|
||||||
|
set-option -g status-interval 5
|
||||||
|
run -b '~/.tmux/plugins/tpm/tpm'
|
||||||
73
ansible/dotfiles/install-scripts/01-install-packages.sh
Executable file
73
ansible/dotfiles/install-scripts/01-install-packages.sh
Executable file
|
|
@ -0,0 +1,73 @@
|
||||||
|
#!/bin/bash
|
||||||
|
set -e # exit on error
|
||||||
|
|
||||||
|
PACKAGES=(
|
||||||
|
"tmux"
|
||||||
|
"neovim"
|
||||||
|
"git"
|
||||||
|
"fish"
|
||||||
|
"curl"
|
||||||
|
"bat"
|
||||||
|
"go"
|
||||||
|
"ripgrep"
|
||||||
|
)
|
||||||
|
|
||||||
|
# if MacOS install Homebrew
|
||||||
|
if [ "$(uname)" == "Darwin" ]; then
|
||||||
|
if [ ! -x "$(which brew)" ]; then
|
||||||
|
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
|
||||||
|
fi
|
||||||
|
# install packages
|
||||||
|
brew install "${PACKAGES[@]}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# if Arch install
|
||||||
|
if [ -f /etc/arch-release ]; then
|
||||||
|
# install yay
|
||||||
|
if [ -z "$(which yay)" ] && [ "$EUID" -ne 0 ]; then
|
||||||
|
sudo pacman -S --noconfirm base-devel
|
||||||
|
git clone https://aur.archlinux.org/yay.git
|
||||||
|
cd yay
|
||||||
|
makepkg -si --noconfirm
|
||||||
|
cd ..
|
||||||
|
rm -rf yay
|
||||||
|
fi
|
||||||
|
|
||||||
|
# install packages
|
||||||
|
sudo pacman -S --noconfirm "${PACKAGES[@]}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# if debian or ubuntu install
|
||||||
|
if [ -f /etc/debian_version ]; then
|
||||||
|
# replace "go" with "golang" for debian
|
||||||
|
PACKAGES=("${PACKAGES[@]/go/golang}")
|
||||||
|
|
||||||
|
# install packages
|
||||||
|
export DEBIAN_FRONTEND=noninteractive
|
||||||
|
sudo apt update
|
||||||
|
sudo apt install -y "${PACKAGES[@]}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# if Alpine install
|
||||||
|
if [ -f /etc/alpine-release ]; then
|
||||||
|
# install packages
|
||||||
|
sudo apk add "${PACKAGES[@]}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# if freebsd install
|
||||||
|
if [ "$(uname)" == "FreeBSD" ]; then
|
||||||
|
# install packages
|
||||||
|
sudo pkg install -y "${PACKAGES[@]}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# if RHEL/CentOS/Fedora install
|
||||||
|
if [ -f /etc/redhat-release ]; then
|
||||||
|
# install packages
|
||||||
|
sudo dnf install -y "${PACKAGES[@]}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# if Gentoo
|
||||||
|
if [ -f /etc/gentoo-release ]; then
|
||||||
|
PACKAGES=("${PACKAGES[@]/git/dev-vcs\/git}")
|
||||||
|
sudo emerge "${PACKAGES[@]}"
|
||||||
|
fi
|
||||||
28
ansible/dotfiles/install-scripts/02-move-files.sh
Executable file
28
ansible/dotfiles/install-scripts/02-move-files.sh
Executable file
|
|
@ -0,0 +1,28 @@
|
||||||
|
#!/bin/bash
|
||||||
|
set -e # exit on error
|
||||||
|
|
||||||
|
# create directories
|
||||||
|
mkdir -p ~/.config/nvim
|
||||||
|
mkdir -p ~/.config/fish
|
||||||
|
mkdir -p ~/.config/fish/conf.d
|
||||||
|
mkdir -p ~/.config/kitty
|
||||||
|
|
||||||
|
# vim
|
||||||
|
cp config/vim/init.lua ~/.config/nvim/
|
||||||
|
|
||||||
|
# fish
|
||||||
|
cp config/fish/config.fish ~/.config/fish/
|
||||||
|
cp config/fish/aliases.fish ~/.config/fish/conf.d/
|
||||||
|
cp config/fish/functions.fish ~/.config/fish/conf.d/
|
||||||
|
|
||||||
|
# Only copy envvars.fish if it doesn't exist.
|
||||||
|
# This way we can override it with our own configs.
|
||||||
|
if [ ! -f ~/.config/fish/conf.d/envvars.fish ]; then
|
||||||
|
cp config/fish/envvars.fish ~/.config/fish/conf.d/
|
||||||
|
fi
|
||||||
|
|
||||||
|
# tmux
|
||||||
|
cp config/tmux/tmux.conf ~/.tmux.conf
|
||||||
|
|
||||||
|
# kitty
|
||||||
|
cp config/kitty/kitty.conf ~/.config/kitty/
|
||||||
4
ansible/dotfiles/install-scripts/03-fisher-install.fish
Executable file
4
ansible/dotfiles/install-scripts/03-fisher-install.fish
Executable file
|
|
@ -0,0 +1,4 @@
|
||||||
|
#!/usr/bin/env fish
|
||||||
|
|
||||||
|
# install fisher
|
||||||
|
curl -sL https://git.io/fisher | source && fisher install jorgebucaran/fisher
|
||||||
15
ansible/dotfiles/install-scripts/04-fish-plugins.fish
Executable file
15
ansible/dotfiles/install-scripts/04-fish-plugins.fish
Executable file
|
|
@ -0,0 +1,15 @@
|
||||||
|
#!/usr/bin/env fish
|
||||||
|
|
||||||
|
# tide
|
||||||
|
fisher install IlanCosman/tide
|
||||||
|
|
||||||
|
# setup tide
|
||||||
|
tide configure \
|
||||||
|
--auto \
|
||||||
|
--style=Lean \
|
||||||
|
--prompt_colors='True color' \
|
||||||
|
--show_time='24-hour format' \
|
||||||
|
--lean_prompt_height='One line' \
|
||||||
|
--prompt_spacing=Compact \
|
||||||
|
--icons='Few icons' \
|
||||||
|
--transient=No
|
||||||
9
ansible/dotfiles/install-scripts/05-tmux-plugins.fish
Executable file
9
ansible/dotfiles/install-scripts/05-tmux-plugins.fish
Executable file
|
|
@ -0,0 +1,9 @@
|
||||||
|
#!/usr/bin/env fish
|
||||||
|
|
||||||
|
# install tmux plugin manager if not installed
|
||||||
|
if not test -e ~/.tmux/plugins/tpm
|
||||||
|
git clone https://github.com/tmux-plugins/tpm ~/.tmux/plugins/tpm
|
||||||
|
end
|
||||||
|
|
||||||
|
# install/update tmux plugins
|
||||||
|
env TMUX_PLUGIN_MANAGER_PATH=~/.tmux/plugins ~/.tmux/plugins/tpm/bin/install_plugins
|
||||||
4
ansible/dotfiles/install-scripts/06-vim-setup.fish
Executable file
4
ansible/dotfiles/install-scripts/06-vim-setup.fish
Executable file
|
|
@ -0,0 +1,4 @@
|
||||||
|
#!/usr/bin/env fish
|
||||||
|
|
||||||
|
# With Lazy we don't need any setup, leaving this file here for the future
|
||||||
|
|
||||||
29
ansible/dotfiles/install-scripts/07-last-touches.sh
Executable file
29
ansible/dotfiles/install-scripts/07-last-touches.sh
Executable file
|
|
@ -0,0 +1,29 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# ensure fish is in shells
|
||||||
|
if ! grep -q "$(which fish)" /etc/shells; then
|
||||||
|
echo "$(which fish)" | sudo tee -a /etc/shells
|
||||||
|
fi
|
||||||
|
|
||||||
|
# change shell to fish
|
||||||
|
if ! [ "$(basename $SHELL)" == "fish" ]; then
|
||||||
|
chsh -s $(which fish)
|
||||||
|
fi
|
||||||
|
|
||||||
|
# create local bin directory
|
||||||
|
mkdir -p ~/bin
|
||||||
|
|
||||||
|
# Gentoo specific kernel script
|
||||||
|
if [ -f /etc/gentoo-release ]; then
|
||||||
|
init_system=openrc
|
||||||
|
echo "Gentoo detected, need clarification on which init system is used."
|
||||||
|
echo -e "Which init system?\n\n1> openrc\n2> systemd"
|
||||||
|
read -p "[1]/2: " -n 1;
|
||||||
|
echo
|
||||||
|
if [ "$REPLY" == "2" ]; then
|
||||||
|
init_system=systemd
|
||||||
|
fi
|
||||||
|
|
||||||
|
sudo cp scripts/gentoo-kernel-upgrade-$init_system /usr/bin/gentoo-kernel-upgrade
|
||||||
|
|
||||||
|
fi
|
||||||
97
ansible/dotfiles/install.sh
Executable file
97
ansible/dotfiles/install.sh
Executable file
|
|
@ -0,0 +1,97 @@
|
||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# install.sh — Symlink dotfiles to their expected locations.
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# ./install.sh Full install (packages + symlinks + plugins)
|
||||||
|
# ./install.sh --link Symlinks only (no package install, no plugin setup)
|
||||||
|
#
|
||||||
|
# Safe to re-run: existing files are backed up to ~/.dotfiles-backup/
|
||||||
|
#
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
DOTFILES_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
BACKUP_DIR="$HOME/.dotfiles-backup/$(date +%Y%m%d-%H%M%S)"
|
||||||
|
LINK_ONLY=false
|
||||||
|
|
||||||
|
if [[ "${1:-}" == "--link" ]]; then
|
||||||
|
LINK_ONLY=true
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── helpers ──────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
backup_and_link() {
|
||||||
|
local src="$1"
|
||||||
|
local dst="$2"
|
||||||
|
|
||||||
|
# Create parent directory if needed
|
||||||
|
mkdir -p "$(dirname "$dst")"
|
||||||
|
|
||||||
|
# If destination exists and isn't already the right symlink, back it up
|
||||||
|
if [ -e "$dst" ] || [ -L "$dst" ]; then
|
||||||
|
if [ -L "$dst" ] && [ "$(readlink "$dst")" = "$src" ]; then
|
||||||
|
return 0 # already correct
|
||||||
|
fi
|
||||||
|
mkdir -p "$BACKUP_DIR"
|
||||||
|
mv "$dst" "$BACKUP_DIR/" 2>/dev/null || true
|
||||||
|
echo " backed up: $dst → $BACKUP_DIR/"
|
||||||
|
fi
|
||||||
|
|
||||||
|
ln -sf "$src" "$dst"
|
||||||
|
echo " linked: $dst → $src"
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── symlinks ─────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
echo "Linking dotfiles..."
|
||||||
|
|
||||||
|
# Fish shell
|
||||||
|
backup_and_link "$DOTFILES_DIR/config/fish/config.fish" "$HOME/.config/fish/config.fish"
|
||||||
|
backup_and_link "$DOTFILES_DIR/config/fish/conf.d/aliases.fish" "$HOME/.config/fish/conf.d/aliases.fish"
|
||||||
|
backup_and_link "$DOTFILES_DIR/config/fish/conf.d/envvars.fish" "$HOME/.config/fish/conf.d/envvars.fish"
|
||||||
|
backup_and_link "$DOTFILES_DIR/config/fish/conf.d/functions.fish" "$HOME/.config/fish/conf.d/functions.fish"
|
||||||
|
|
||||||
|
# Tmux
|
||||||
|
backup_and_link "$DOTFILES_DIR/config/tmux/tmux.conf" "$HOME/.tmux.conf"
|
||||||
|
|
||||||
|
# Neovim
|
||||||
|
backup_and_link "$DOTFILES_DIR/config/nvim/init.lua" "$HOME/.config/nvim/init.lua"
|
||||||
|
|
||||||
|
# Kitty
|
||||||
|
backup_and_link "$DOTFILES_DIR/config/kitty/kitty.conf" "$HOME/.config/kitty/kitty.conf"
|
||||||
|
|
||||||
|
# Git
|
||||||
|
backup_and_link "$DOTFILES_DIR/config/git/gitconfig" "$HOME/.gitconfig"
|
||||||
|
|
||||||
|
echo "Done linking."
|
||||||
|
|
||||||
|
if [ "$LINK_ONLY" = true ]; then
|
||||||
|
echo "Symlinks only — skipping packages and plugins."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── packages ─────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "Installing packages..."
|
||||||
|
bash "$DOTFILES_DIR/install-scripts/01-install-packages.sh"
|
||||||
|
|
||||||
|
# ── plugins ──────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
if command -v fish &>/dev/null; then
|
||||||
|
echo ""
|
||||||
|
echo "Setting up Fish plugins..."
|
||||||
|
fish "$DOTFILES_DIR/install-scripts/03-fisher-install.fish"
|
||||||
|
fish "$DOTFILES_DIR/install-scripts/04-fish-plugins.fish"
|
||||||
|
fish "$DOTFILES_DIR/install-scripts/05-tmux-plugins.fish"
|
||||||
|
fish "$DOTFILES_DIR/install-scripts/06-vim-setup.fish"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── final touches ────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "Running final setup..."
|
||||||
|
bash "$DOTFILES_DIR/install-scripts/07-last-touches.sh"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "All done. Restart your terminal or run: exec fish"
|
||||||
30
ansible/dotfiles/pr-test.yml
Normal file
30
ansible/dotfiles/pr-test.yml
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
name: PR Test
|
||||||
|
|
||||||
|
on:
|
||||||
|
pull_request:
|
||||||
|
branches:
|
||||||
|
- master
|
||||||
|
- main
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
test:
|
||||||
|
strategy:
|
||||||
|
matrix:
|
||||||
|
distro:
|
||||||
|
- alpine
|
||||||
|
- archlinux
|
||||||
|
- fedora
|
||||||
|
- ubuntu
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v3
|
||||||
|
|
||||||
|
- name: Set up QEMU
|
||||||
|
uses: docker/setup-qemu-action@v3
|
||||||
|
|
||||||
|
- name: Set up Docker Buildx
|
||||||
|
uses: docker/setup-buildx-action@v3
|
||||||
|
|
||||||
|
- name: Only build
|
||||||
|
run: |
|
||||||
|
docker buildx build --platform linux/amd64 --output "type=image,push=false" -f tests/Dockerfile-${{ matrix.distro }} .
|
||||||
399
ansible/dotfiles/scripts/gentoo-kernel-upgrade-openrc
Executable file
399
ansible/dotfiles/scripts/gentoo-kernel-upgrade-openrc
Executable file
|
|
@ -0,0 +1,399 @@
|
||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# Gentoo Kernel Upgrade Script
|
||||||
|
# This script helps upgrade the gentoo-kernel-bin package safely.
|
||||||
|
#
|
||||||
|
# IMPORTANT: This script modifies boot files. A failed upgrade could
|
||||||
|
# prevent your system from booting. Ensure you have a backup plan.
|
||||||
|
#
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# Colors for output
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
BLUE='\033[0;34m'
|
||||||
|
BOLD='\033[1m'
|
||||||
|
NC='\033[0m' # No Color
|
||||||
|
|
||||||
|
EFI_DIR="/boot/efi"
|
||||||
|
BOOT_DIR="/boot"
|
||||||
|
|
||||||
|
# Print functions
|
||||||
|
info() { echo -e "${BLUE}==>${NC} ${BOLD}$1${NC}"; }
|
||||||
|
warn() { echo -e "${YELLOW}WARNING:${NC} $1"; }
|
||||||
|
error() { echo -e "${RED}ERROR:${NC} $1" >&2; }
|
||||||
|
success() { echo -e "${GREEN}==>${NC} $1"; }
|
||||||
|
|
||||||
|
# Check if running as root
|
||||||
|
check_root() {
|
||||||
|
if [[ $EUID -ne 0 ]]; then
|
||||||
|
error "This script must be run as root"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Prompt user for confirmation
|
||||||
|
confirm() {
|
||||||
|
local prompt="$1"
|
||||||
|
local response
|
||||||
|
echo -e "${YELLOW}${prompt}${NC}"
|
||||||
|
read -p "Type 'yes' to confirm: " response
|
||||||
|
[[ "$response" == "yes" ]]
|
||||||
|
}
|
||||||
|
|
||||||
|
# Get the currently running kernel version
|
||||||
|
get_current_version() {
|
||||||
|
uname -r
|
||||||
|
}
|
||||||
|
|
||||||
|
# Get the latest installed kernel version from /usr/src
|
||||||
|
get_latest_installed_version() {
|
||||||
|
local latest
|
||||||
|
latest=$(ls -1d /usr/src/linux-*-gentoo-dist 2>/dev/null | sort -V | tail -1 | sed 's|.*/linux-||')
|
||||||
|
echo "$latest"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Check for available updates using emerge
|
||||||
|
check_for_updates() {
|
||||||
|
info "Checking for gentoo-kernel-bin updates..."
|
||||||
|
echo
|
||||||
|
|
||||||
|
# Use emerge to check for updates (pretend mode)
|
||||||
|
if emerge -pvu gentoo-kernel-bin 2>/dev/null | grep -q "gentoo-kernel-bin"; then
|
||||||
|
local update_info
|
||||||
|
update_info=$(emerge -pvu gentoo-kernel-bin 2>/dev/null | grep -E "gentoo-kernel-bin|ebuild")
|
||||||
|
echo "$update_info"
|
||||||
|
return 0
|
||||||
|
else
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Install the kernel update
|
||||||
|
install_kernel_update() {
|
||||||
|
info "Installing gentoo-kernel-bin update..."
|
||||||
|
echo
|
||||||
|
|
||||||
|
echo -e "${BOLD}The following command will be executed:${NC}"
|
||||||
|
echo -e " ${BLUE}emerge gentoo-kernel-bin${NC}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if ! confirm "Proceed with kernel package installation?"; then
|
||||||
|
warn "Installation cancelled by user"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
emerge gentoo-kernel-bin
|
||||||
|
|
||||||
|
success "Kernel package installed successfully"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Select the new kernel with eselect
|
||||||
|
select_kernel() {
|
||||||
|
local new_version="$1"
|
||||||
|
|
||||||
|
info "Available kernel versions:"
|
||||||
|
eselect kernel list
|
||||||
|
echo
|
||||||
|
|
||||||
|
# Find the number corresponding to the new version
|
||||||
|
local kernel_num
|
||||||
|
kernel_num=$(eselect kernel list | grep "$new_version" | sed 's/.*\[\([0-9]*\)\].*/\1/')
|
||||||
|
|
||||||
|
if [[ -z "$kernel_num" ]]; then
|
||||||
|
error "Could not find kernel version $new_version in eselect list"
|
||||||
|
echo "Please select the kernel manually:"
|
||||||
|
eselect kernel list
|
||||||
|
read -p "Enter the number to select: " kernel_num
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -e "${BOLD}The following command will be executed:${NC}"
|
||||||
|
echo -e " ${BLUE}eselect kernel set $kernel_num${NC}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if ! confirm "Set kernel $new_version as active?"; then
|
||||||
|
warn "Kernel selection cancelled by user"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
eselect kernel set "$kernel_num"
|
||||||
|
|
||||||
|
# Verify
|
||||||
|
info "Current kernel symlink:"
|
||||||
|
eselect kernel list | grep '\*'
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
# Backup current boot files
|
||||||
|
backup_boot_files() {
|
||||||
|
info "Backing up current boot files..."
|
||||||
|
|
||||||
|
echo -e "${BOLD}The following operations will be performed in ${EFI_DIR}:${NC}"
|
||||||
|
echo -e " ${BLUE}mv vmlinuz.efi -> vmlinuz.efi.bak${NC}"
|
||||||
|
echo -e " ${BLUE}mv initramfs.img -> initramfs.img.bak${NC}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if [[ -f "${EFI_DIR}/vmlinuz.efi.bak" ]] || [[ -f "${EFI_DIR}/initramfs.img.bak" ]]; then
|
||||||
|
warn "Existing backup files will be overwritten!"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! confirm "Backup current boot files?"; then
|
||||||
|
warn "Backup cancelled by user"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
cd "${EFI_DIR}"
|
||||||
|
|
||||||
|
if [[ -f "vmlinuz.efi" ]]; then
|
||||||
|
mv vmlinuz.efi vmlinuz.efi.bak
|
||||||
|
success "Backed up vmlinuz.efi"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -f "initramfs.img" ]]; then
|
||||||
|
mv initramfs.img initramfs.img.bak
|
||||||
|
success "Backed up initramfs.img"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
# Generate new initramfs
|
||||||
|
generate_initramfs() {
|
||||||
|
local version="$1"
|
||||||
|
|
||||||
|
info "Generating new initramfs for kernel ${version}..."
|
||||||
|
echo
|
||||||
|
|
||||||
|
echo -e "${BOLD}The following command will be executed:${NC}"
|
||||||
|
echo -e " ${BLUE}${EFI_DIR}/generate_initramfs.sh ${version} ${EFI_DIR}/initramfs.img${NC}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if ! confirm "Generate initramfs?"; then
|
||||||
|
warn "Initramfs generation cancelled by user"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
bash "${EFI_DIR}/generate_initramfs.sh" "${version}" "${EFI_DIR}/initramfs.img"
|
||||||
|
|
||||||
|
success "Initramfs generated successfully"
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
# Copy new kernel to EFI partition
|
||||||
|
copy_kernel() {
|
||||||
|
local version="$1"
|
||||||
|
local kernel_source="${BOOT_DIR}/vmlinuz-${version}"
|
||||||
|
|
||||||
|
info "Copying new kernel to EFI partition..."
|
||||||
|
echo
|
||||||
|
|
||||||
|
if [[ ! -f "$kernel_source" ]]; then
|
||||||
|
error "Kernel file not found: $kernel_source"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -e "${BOLD}The following command will be executed:${NC}"
|
||||||
|
echo -e " ${BLUE}cp ${kernel_source} ${EFI_DIR}/vmlinuz.efi${NC}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if ! confirm "Copy new kernel to EFI partition?"; then
|
||||||
|
warn "Kernel copy cancelled by user"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
cp "$kernel_source" "${EFI_DIR}/vmlinuz.efi"
|
||||||
|
|
||||||
|
success "Kernel copied successfully"
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
# Cleanup old kernel versions from /boot
|
||||||
|
cleanup_old_versions() {
|
||||||
|
info "Checking for old kernel versions to clean up..."
|
||||||
|
echo
|
||||||
|
|
||||||
|
# Find old initramfs and kernel files (excluding current version)
|
||||||
|
local initramfs_to_delete=()
|
||||||
|
local kernels_to_delete=()
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
while IFS= read -r f; do
|
||||||
|
initramfs_to_delete+=("$f")
|
||||||
|
done < <(ls ${BOOT_DIR}/initramfs-*.img 2>/dev/null | grep -v "$current_version" || true)
|
||||||
|
|
||||||
|
while IFS= read -r f; do
|
||||||
|
kernels_to_delete+=("$f")
|
||||||
|
done < <(ls ${BOOT_DIR}/vmlinuz-* 2>/dev/null | grep -v "$current_version" || true)
|
||||||
|
|
||||||
|
# Check if there's anything to delete
|
||||||
|
if [[ ${#initramfs_to_delete[@]} -eq 0 ]] && [[ ${#kernels_to_delete[@]} -eq 0 ]]; then
|
||||||
|
success "No old kernel versions to clean up"
|
||||||
|
echo
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -e "${BOLD}The following files will be DELETED:${NC}"
|
||||||
|
echo
|
||||||
|
for f in "${initramfs_to_delete[@]}" "${kernels_to_delete[@]}"; do
|
||||||
|
echo -e " ${RED}$f${NC}"
|
||||||
|
done
|
||||||
|
echo
|
||||||
|
|
||||||
|
warn "This action cannot be undone!"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if ! confirm "Delete these old kernel files?"; then
|
||||||
|
warn "Cleanup cancelled by user"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
for f in "${initramfs_to_delete[@]}" "${kernels_to_delete[@]}"; do
|
||||||
|
rm -v "$f"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo
|
||||||
|
success "Old kernel versions cleaned up"
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
# Print summary of what will be done
|
||||||
|
print_summary() {
|
||||||
|
local current="$1"
|
||||||
|
local new="$2"
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo -e "${BOLD}╔════════════════════════════════════════════════════════════════╗${NC}"
|
||||||
|
echo -e "${BOLD}║ GENTOO KERNEL UPGRADE SUMMARY ║${NC}"
|
||||||
|
echo -e "${BOLD}╚════════════════════════════════════════════════════════════════╝${NC}"
|
||||||
|
echo
|
||||||
|
echo -e " Current running kernel: ${YELLOW}${current}${NC}"
|
||||||
|
echo -e " New kernel version: ${GREEN}${new}${NC}"
|
||||||
|
echo
|
||||||
|
echo -e "${BOLD}The following steps will be performed:${NC}"
|
||||||
|
echo " 1. Backup current vmlinuz.efi and initramfs.img"
|
||||||
|
echo " 2. Generate new initramfs using dracut"
|
||||||
|
echo " 3. Copy new kernel to EFI partition"
|
||||||
|
echo
|
||||||
|
echo -e "${RED}${BOLD}WARNING: This process modifies boot files!${NC}"
|
||||||
|
echo -e "${RED}If something goes wrong, your system may not boot.${NC}"
|
||||||
|
echo -e "${RED}Make sure you have a way to recover (live USB, backup, etc.)${NC}"
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
# Main function
|
||||||
|
main() {
|
||||||
|
echo
|
||||||
|
echo -e "${BOLD}╔════════════════════════════════════════════════════════════════╗${NC}"
|
||||||
|
echo -e "${BOLD}║ GENTOO KERNEL UPGRADE HELPER ║${NC}"
|
||||||
|
echo -e "${BOLD}╚════════════════════════════════════════════════════════════════╝${NC}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
check_root
|
||||||
|
|
||||||
|
local current_version
|
||||||
|
current_version=$(get_current_version)
|
||||||
|
info "Currently running kernel: ${current_version}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
# Check for updates
|
||||||
|
if ! check_for_updates; then
|
||||||
|
success "No updates available for gentoo-kernel-bin"
|
||||||
|
echo
|
||||||
|
|
||||||
|
local latest_installed
|
||||||
|
latest_installed=$(get_latest_installed_version)
|
||||||
|
|
||||||
|
if [[ "$latest_installed" != "$current_version" ]] && [[ -n "$latest_installed" ]]; then
|
||||||
|
# Installed kernel differs from running - offer to set up boot files
|
||||||
|
warn "Installed kernel ($latest_installed) differs from running kernel ($current_version)"
|
||||||
|
echo
|
||||||
|
if confirm "Would you like to set up boot files for $latest_installed?"; then
|
||||||
|
print_summary "$current_version" "$latest_installed"
|
||||||
|
|
||||||
|
if ! confirm "Proceed with the upgrade process?"; then
|
||||||
|
echo "Upgrade cancelled."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
select_kernel "$latest_installed"
|
||||||
|
backup_boot_files
|
||||||
|
generate_initramfs "$latest_installed"
|
||||||
|
copy_kernel "$latest_installed"
|
||||||
|
|
||||||
|
echo
|
||||||
|
success "Kernel upgrade complete!"
|
||||||
|
echo
|
||||||
|
echo -e "${BOLD}Next steps:${NC}"
|
||||||
|
echo " 1. Reboot your system"
|
||||||
|
echo " 2. Verify the new kernel is running: uname -r"
|
||||||
|
echo " 3. Run this script again to clean up old versions"
|
||||||
|
echo
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
# Running kernel is the newest - offer cleanup
|
||||||
|
cleanup_old_versions
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
if ! confirm "Would you like to install this kernel update?"; then
|
||||||
|
echo "Update cancelled."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
install_kernel_update
|
||||||
|
|
||||||
|
# Get the new version after installation
|
||||||
|
local new_version
|
||||||
|
new_version=$(get_latest_installed_version)
|
||||||
|
|
||||||
|
if [[ -z "$new_version" ]]; then
|
||||||
|
error "Could not determine new kernel version"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
print_summary "$current_version" "$new_version"
|
||||||
|
|
||||||
|
if ! confirm "Proceed with the upgrade process?"; then
|
||||||
|
echo "Upgrade process cancelled. Kernel package is installed but boot files unchanged."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
select_kernel "$new_version"
|
||||||
|
backup_boot_files
|
||||||
|
generate_initramfs "$new_version"
|
||||||
|
copy_kernel "$new_version"
|
||||||
|
|
||||||
|
echo
|
||||||
|
success "Kernel upgrade complete!"
|
||||||
|
echo
|
||||||
|
echo -e "${BOLD}╔════════════════════════════════════════════════════════════════╗${NC}"
|
||||||
|
echo -e "${BOLD}║ NEXT STEPS ║${NC}"
|
||||||
|
echo -e "${BOLD}╚════════════════════════════════════════════════════════════════╝${NC}"
|
||||||
|
echo
|
||||||
|
echo " 1. ${YELLOW}Reboot your system${NC}"
|
||||||
|
echo " 2. Verify the new kernel is running:"
|
||||||
|
echo " uname -r"
|
||||||
|
echo " Expected: ${GREEN}${new_version}${NC}"
|
||||||
|
echo
|
||||||
|
echo " 3. If the new kernel works correctly, run this script again"
|
||||||
|
echo " to clean up old versions"
|
||||||
|
echo
|
||||||
|
echo " 4. ${RED}If the system fails to boot:${NC}"
|
||||||
|
echo " - Boot from a live USB"
|
||||||
|
echo " - Mount your EFI partition"
|
||||||
|
echo " - Restore backups:"
|
||||||
|
echo " mv vmlinuz.efi.bak vmlinuz.efi"
|
||||||
|
echo " mv initramfs.img.bak initramfs.img"
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
main "$@"
|
||||||
397
ansible/dotfiles/scripts/gentoo-kernel-upgrade-systemd
Executable file
397
ansible/dotfiles/scripts/gentoo-kernel-upgrade-systemd
Executable file
|
|
@ -0,0 +1,397 @@
|
||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# Gentoo Kernel Upgrade Script
|
||||||
|
# This script helps upgrade the gentoo-kernel-bin package safely.
|
||||||
|
#
|
||||||
|
# IMPORTANT: This script modifies boot files. A failed upgrade could
|
||||||
|
# prevent your system from booting. Ensure you have a backup plan.
|
||||||
|
#
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# Colors for output
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
BLUE='\033[0;34m'
|
||||||
|
BOLD='\033[1m'
|
||||||
|
NC='\033[0m' # No Color
|
||||||
|
|
||||||
|
EFI_DIR="/boot/efi"
|
||||||
|
BOOT_DIR="/boot"
|
||||||
|
|
||||||
|
# Print functions
|
||||||
|
info() { echo -e "${BLUE}==>${NC} ${BOLD}$1${NC}"; }
|
||||||
|
warn() { echo -e "${YELLOW}WARNING:${NC} $1"; }
|
||||||
|
error() { echo -e "${RED}ERROR:${NC} $1" >&2; }
|
||||||
|
success() { echo -e "${GREEN}==>${NC} $1"; }
|
||||||
|
|
||||||
|
# Check if running as root
|
||||||
|
check_root() {
|
||||||
|
if [[ $EUID -ne 0 ]]; then
|
||||||
|
error "This script must be run as root"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Prompt user for confirmation
|
||||||
|
confirm() {
|
||||||
|
local prompt="$1"
|
||||||
|
local response
|
||||||
|
echo -e "${YELLOW}${prompt}${NC}"
|
||||||
|
read -p "Type 'yes' to confirm: " response
|
||||||
|
[[ "$response" == "yes" ]]
|
||||||
|
}
|
||||||
|
|
||||||
|
# Get the currently running kernel version
|
||||||
|
get_current_version() {
|
||||||
|
uname -r
|
||||||
|
}
|
||||||
|
|
||||||
|
# Get the latest installed kernel version from /usr/src
|
||||||
|
get_latest_installed_version() {
|
||||||
|
local latest
|
||||||
|
latest=$(ls -1d /usr/src/linux-*-gentoo-dist 2>/dev/null | sort -V | tail -1 | sed 's|.*/linux-||')
|
||||||
|
echo "$latest"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Check for available updates using emerge
|
||||||
|
check_for_updates() {
|
||||||
|
info "Checking for gentoo-kernel-bin updates..."
|
||||||
|
echo
|
||||||
|
|
||||||
|
# Use emerge to check for updates (pretend mode)
|
||||||
|
if emerge -pvu gentoo-kernel-bin 2>/dev/null | grep -q "gentoo-kernel-bin"; then
|
||||||
|
local update_info
|
||||||
|
update_info=$(emerge -pvu gentoo-kernel-bin 2>/dev/null | grep -E "gentoo-kernel-bin|ebuild")
|
||||||
|
echo "$update_info"
|
||||||
|
return 0
|
||||||
|
else
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Install the kernel update
|
||||||
|
install_kernel_update() {
|
||||||
|
info "Installing gentoo-kernel-bin update..."
|
||||||
|
echo
|
||||||
|
|
||||||
|
echo -e "${BOLD}The following command will be executed:${NC}"
|
||||||
|
echo -e " ${BLUE}emerge gentoo-kernel-bin${NC}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if ! confirm "Proceed with kernel package installation?"; then
|
||||||
|
warn "Installation cancelled by user"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
emerge gentoo-kernel-bin
|
||||||
|
|
||||||
|
success "Kernel package installed successfully"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Select the new kernel with eselect
|
||||||
|
select_kernel() {
|
||||||
|
local new_version="$1"
|
||||||
|
|
||||||
|
info "Available kernel versions:"
|
||||||
|
eselect kernel list
|
||||||
|
echo
|
||||||
|
|
||||||
|
# Find the number corresponding to the new version
|
||||||
|
local kernel_num
|
||||||
|
kernel_num=$(eselect kernel list | grep "$new_version" | sed 's/.*\[\([0-9]*\)\].*/\1/')
|
||||||
|
|
||||||
|
if [[ -z "$kernel_num" ]]; then
|
||||||
|
error "Could not find kernel version $new_version in eselect list"
|
||||||
|
echo "Please select the kernel manually:"
|
||||||
|
eselect kernel list
|
||||||
|
read -p "Enter the number to select: " kernel_num
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -e "${BOLD}The following command will be executed:${NC}"
|
||||||
|
echo -e " ${BLUE}eselect kernel set $kernel_num${NC}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if ! confirm "Set kernel $new_version as active?"; then
|
||||||
|
warn "Kernel selection cancelled by user"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
eselect kernel set "$kernel_num"
|
||||||
|
|
||||||
|
# Verify
|
||||||
|
info "Current kernel symlink:"
|
||||||
|
eselect kernel list | grep '\*'
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
# Backup current boot files
|
||||||
|
backup_boot_files() {
|
||||||
|
info "Backing up current boot files..."
|
||||||
|
|
||||||
|
echo -e "${BOLD}The following operations will be performed in ${EFI_DIR}:${NC}"
|
||||||
|
echo -e " ${BLUE}mv vmlinuz.efi -> vmlinuz.efi.bak${NC}"
|
||||||
|
echo -e " ${BLUE}mv initramfs.img -> initramfs.img.bak${NC}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if [[ -f "${EFI_DIR}/vmlinuz.efi.bak" ]] || [[ -f "${EFI_DIR}/initramfs.img.bak" ]]; then
|
||||||
|
warn "Existing backup files will be overwritten!"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! confirm "Backup current boot files?"; then
|
||||||
|
warn "Backup cancelled by user"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
cd "${EFI_DIR}"
|
||||||
|
|
||||||
|
if [[ -f "vmlinuz.efi" ]]; then
|
||||||
|
mv vmlinuz.efi vmlinuz.efi.bak
|
||||||
|
success "Backed up vmlinuz.efi"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -f "initramfs.img" ]]; then
|
||||||
|
mv initramfs.img initramfs.img.bak
|
||||||
|
success "Backed up initramfs.img"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
# Generate new initramfs
|
||||||
|
generate_initramfs() {
|
||||||
|
local version="$1"
|
||||||
|
|
||||||
|
info "Generating new initramfs for kernel ${version}..."
|
||||||
|
echo
|
||||||
|
|
||||||
|
echo -e "${BOLD}The following command will be executed:${NC}"
|
||||||
|
echo -e " ${BLUE}${EFI_DIR}/generate_initramfs.sh ${version} ${EFI_DIR}/initramfs.img${NC}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if ! confirm "Generate initramfs?"; then
|
||||||
|
warn "Initramfs generation cancelled by user"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
bash "${EFI_DIR}/generate_initramfs.sh" "${version}" "${EFI_DIR}/initramfs.img"
|
||||||
|
|
||||||
|
success "Initramfs generated successfully"
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
# Copy new kernel to EFI partition
|
||||||
|
copy_kernel() {
|
||||||
|
local version="$1"
|
||||||
|
local kernel_source="${BOOT_DIR}/kernel-${version}"
|
||||||
|
|
||||||
|
info "Copying new kernel to EFI partition..."
|
||||||
|
echo
|
||||||
|
|
||||||
|
if [[ ! -f "$kernel_source" ]]; then
|
||||||
|
error "Kernel file not found: $kernel_source"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -e "${BOLD}The following command will be executed:${NC}"
|
||||||
|
echo -e " ${BLUE}cp ${kernel_source} ${EFI_DIR}/vmlinuz.efi${NC}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if ! confirm "Copy new kernel to EFI partition?"; then
|
||||||
|
warn "Kernel copy cancelled by user"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
cp "$kernel_source" "${EFI_DIR}/vmlinuz.efi"
|
||||||
|
|
||||||
|
success "Kernel copied successfully"
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
# Cleanup old kernel versions from /boot
|
||||||
|
cleanup_old_versions() {
|
||||||
|
info "Checking for old kernel versions to clean up..."
|
||||||
|
echo
|
||||||
|
|
||||||
|
# Find old initramfs and kernel files (excluding current version)
|
||||||
|
local initramfs_to_delete=()
|
||||||
|
local kernels_to_delete=()
|
||||||
|
|
||||||
|
while IFS= read -r f; do
|
||||||
|
initramfs_to_delete+=("$f")
|
||||||
|
done < <(ls ${BOOT_DIR}/initramfs-*.img 2>/dev/null | grep -v "$current_version" || true)
|
||||||
|
|
||||||
|
while IFS= read -r f; do
|
||||||
|
kernels_to_delete+=("$f")
|
||||||
|
done < <(ls ${BOOT_DIR}/kernel-* 2>/dev/null | grep -v "$current_version" || true)
|
||||||
|
|
||||||
|
# Check if there's anything to delete
|
||||||
|
if [[ ${#initramfs_to_delete[@]} -eq 0 ]] && [[ ${#kernels_to_delete[@]} -eq 0 ]]; then
|
||||||
|
success "No old kernel versions to clean up"
|
||||||
|
echo
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -e "${BOLD}The following files will be DELETED:${NC}"
|
||||||
|
echo
|
||||||
|
for f in "${initramfs_to_delete[@]}" "${kernels_to_delete[@]}"; do
|
||||||
|
echo -e " ${RED}$f${NC}"
|
||||||
|
done
|
||||||
|
echo
|
||||||
|
|
||||||
|
warn "This action cannot be undone!"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if ! confirm "Delete these old kernel files?"; then
|
||||||
|
warn "Cleanup cancelled by user"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
for f in "${initramfs_to_delete[@]}" "${kernels_to_delete[@]}"; do
|
||||||
|
rm -v "$f"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo
|
||||||
|
success "Old kernel versions cleaned up"
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
# Print summary of what will be done
|
||||||
|
print_summary() {
|
||||||
|
local current="$1"
|
||||||
|
local new="$2"
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo -e "${BOLD}╔════════════════════════════════════════════════════════════════╗${NC}"
|
||||||
|
echo -e "${BOLD}║ GENTOO KERNEL UPGRADE SUMMARY ║${NC}"
|
||||||
|
echo -e "${BOLD}╚════════════════════════════════════════════════════════════════╝${NC}"
|
||||||
|
echo
|
||||||
|
echo -e " Current running kernel: ${YELLOW}${current}${NC}"
|
||||||
|
echo -e " New kernel version: ${GREEN}${new}${NC}"
|
||||||
|
echo
|
||||||
|
echo -e "${BOLD}The following steps will be performed:${NC}"
|
||||||
|
echo " 1. Backup current vmlinuz.efi and initramfs.img"
|
||||||
|
echo " 2. Generate new initramfs using dracut"
|
||||||
|
echo " 3. Copy new kernel to EFI partition"
|
||||||
|
echo
|
||||||
|
echo -e "${RED}${BOLD}WARNING: This process modifies boot files!${NC}"
|
||||||
|
echo -e "${RED}If something goes wrong, your system may not boot.${NC}"
|
||||||
|
echo -e "${RED}Make sure you have a way to recover (live USB, backup, etc.)${NC}"
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
# Main function
|
||||||
|
main() {
|
||||||
|
echo
|
||||||
|
echo -e "${BOLD}╔════════════════════════════════════════════════════════════════╗${NC}"
|
||||||
|
echo -e "${BOLD}║ GENTOO KERNEL UPGRADE HELPER ║${NC}"
|
||||||
|
echo -e "${BOLD}╚════════════════════════════════════════════════════════════════╝${NC}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
check_root
|
||||||
|
|
||||||
|
local current_version
|
||||||
|
current_version=$(get_current_version)
|
||||||
|
info "Currently running kernel: ${current_version}"
|
||||||
|
echo
|
||||||
|
|
||||||
|
# Check for updates
|
||||||
|
if ! check_for_updates; then
|
||||||
|
success "No updates available for gentoo-kernel-bin"
|
||||||
|
echo
|
||||||
|
|
||||||
|
local latest_installed
|
||||||
|
latest_installed=$(get_latest_installed_version)
|
||||||
|
|
||||||
|
if [[ "$latest_installed" != "$current_version" ]] && [[ -n "$latest_installed" ]]; then
|
||||||
|
# Installed kernel differs from running - offer to set up boot files
|
||||||
|
warn "Installed kernel ($latest_installed) differs from running kernel ($current_version)"
|
||||||
|
echo
|
||||||
|
if confirm "Would you like to set up boot files for $latest_installed?"; then
|
||||||
|
print_summary "$current_version" "$latest_installed"
|
||||||
|
|
||||||
|
if ! confirm "Proceed with the upgrade process?"; then
|
||||||
|
echo "Upgrade cancelled."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
select_kernel "$latest_installed"
|
||||||
|
backup_boot_files
|
||||||
|
generate_initramfs "$latest_installed"
|
||||||
|
copy_kernel "$latest_installed"
|
||||||
|
|
||||||
|
echo
|
||||||
|
success "Kernel upgrade complete!"
|
||||||
|
echo
|
||||||
|
echo -e "${BOLD}Next steps:${NC}"
|
||||||
|
echo " 1. Reboot your system"
|
||||||
|
echo " 2. Verify the new kernel is running: uname -r"
|
||||||
|
echo " 3. Run this script again to clean up old versions"
|
||||||
|
echo
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
# Running kernel is the newest - offer cleanup
|
||||||
|
cleanup_old_versions
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
if ! confirm "Would you like to install this kernel update?"; then
|
||||||
|
echo "Update cancelled."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
install_kernel_update
|
||||||
|
|
||||||
|
# Get the new version after installation
|
||||||
|
local new_version
|
||||||
|
new_version=$(get_latest_installed_version)
|
||||||
|
|
||||||
|
if [[ -z "$new_version" ]]; then
|
||||||
|
error "Could not determine new kernel version"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
print_summary "$current_version" "$new_version"
|
||||||
|
|
||||||
|
if ! confirm "Proceed with the upgrade process?"; then
|
||||||
|
echo "Upgrade process cancelled. Kernel package is installed but boot files unchanged."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
select_kernel "$new_version"
|
||||||
|
backup_boot_files
|
||||||
|
generate_initramfs "$new_version"
|
||||||
|
copy_kernel "$new_version"
|
||||||
|
|
||||||
|
echo
|
||||||
|
success "Kernel upgrade complete!"
|
||||||
|
echo
|
||||||
|
echo -e "${BOLD}╔════════════════════════════════════════════════════════════════╗${NC}"
|
||||||
|
echo -e "${BOLD}║ NEXT STEPS ║${NC}"
|
||||||
|
echo -e "${BOLD}╚════════════════════════════════════════════════════════════════╝${NC}"
|
||||||
|
echo
|
||||||
|
echo " 1. ${YELLOW}Reboot your system${NC}"
|
||||||
|
echo " 2. Verify the new kernel is running:"
|
||||||
|
echo " uname -r"
|
||||||
|
echo " Expected: ${GREEN}${new_version}${NC}"
|
||||||
|
echo
|
||||||
|
echo " 3. If the new kernel works correctly, run this script again"
|
||||||
|
echo " to clean up old versions"
|
||||||
|
echo
|
||||||
|
echo " 4. ${RED}If the system fails to boot:${NC}"
|
||||||
|
echo " - Boot from a live USB"
|
||||||
|
echo " - Mount your EFI partition"
|
||||||
|
echo " - Restore backups:"
|
||||||
|
echo " mv vmlinuz.efi.bak vmlinuz.efi"
|
||||||
|
echo " mv initramfs.img.bak initramfs.img"
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
main "$@"
|
||||||
16
ansible/group_vars/all/secrets.enc.yaml
Normal file
16
ansible/group_vars/all/secrets.enc.yaml
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
grafana_pagerduty_integration_key: ENC[AES256_GCM,data:eXfaIsRwfqZm5ROIIFpeyuyk4/4wi3M02Bmgl7/SoRk=,iv:4HcB2WTDTrDADwE/ZVK84l6aIxayzz3e7VFZpVNY3Pg=,tag:4mTmfCP9GV9rGY2ALxWhgQ==,type:str]
|
||||||
|
sops:
|
||||||
|
age:
|
||||||
|
- recipient: age1r8uh2w2qad2z5sgq9q7l73962q2sp8zz9hdnh6sjuvanxl565vmswn8squ
|
||||||
|
enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvSFY2QWdpZ3lUUTZDYk5F
|
||||||
|
MVFyMy9rOG1ZejlrQUxPWjFpTlZpS2w1dHlVCmg4VkpYTmhYUk42ZytpOUJ5czg5
|
||||||
|
VmJUQ2VJKzNtdWhiUGhTTVhndmplWG8KLS0tIHhKWkpWVG5CcnI0NkNwWGRCMDM5
|
||||||
|
QVRncWVjR25sR0ViY1pCWkFXYVRURFUKyknDYVq9Bzo3Bdi4/dl3Ryj3qkLiGhrW
|
||||||
|
hlRDiPyTWfMPwffF3SmKCrI60b+Y0QhkZ+/Wym4JuuW1TKQERv4lhw==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
lastmodified: "2026-03-25T19:50:39Z"
|
||||||
|
mac: ENC[AES256_GCM,data:EFguQ9aY0I+y0WEkJCAA19uuRtquZVHdRBTjjGr2BoeVrq16iu1dIeZOH3eMj/b1MvI1NF7DoLJEUsxKZDS2YeTsBF46oOmc0VErR7w1BIlET8FhQANhqtPF0OglwYD5gCsxXjbx25TLfOpP4iHPwLY440Gk3BtWR1TMObD4C+c=,iv:/ncyoPfWMjeCSWI4Hfv1Tm5rRH0+ytT3OBlKNyy7k+I=,tag:VYyCwmBTfBHWF9ICZz7kSg==,type:str]
|
||||||
|
unencrypted_suffix: _unencrypted
|
||||||
|
version: 3.12.2
|
||||||
12
ansible/inventory/host_vars/copenhagen-a.yml
Normal file
12
ansible/inventory/host_vars/copenhagen-a.yml
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
---
|
||||||
|
host_role: gaming
|
||||||
|
host_description: "Gaming servers (Minecraft, WoW/MaNGOS)"
|
||||||
|
host_location: "Copenhagen"
|
||||||
|
|
||||||
|
docker_services:
|
||||||
|
- minecraft
|
||||||
|
|
||||||
|
# MaNGOS runs as systemd services, not Docker
|
||||||
|
systemd_services:
|
||||||
|
- mangos-realmd
|
||||||
|
- mangos-world
|
||||||
4
ansible/inventory/host_vars/copenhagen-c.yml
Normal file
4
ansible/inventory/host_vars/copenhagen-c.yml
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
---
|
||||||
|
host_role: idle
|
||||||
|
host_description: "Idle/available"
|
||||||
|
host_location: "Copenhagen"
|
||||||
6
ansible/inventory/host_vars/helsinki-a.yml
Normal file
6
ansible/inventory/host_vars/helsinki-a.yml
Normal file
|
|
@ -0,0 +1,6 @@
|
||||||
|
---
|
||||||
|
host_role: proxy
|
||||||
|
host_description: "Reverse proxy (Caddy), main traffic gateway"
|
||||||
|
host_location: "Hetzner Cloud"
|
||||||
|
|
||||||
|
caddy_config_src: "{{ playbook_dir }}/services/caddy/Caddyfile"
|
||||||
6
ansible/inventory/host_vars/london-a.yml
Normal file
6
ansible/inventory/host_vars/london-a.yml
Normal file
|
|
@ -0,0 +1,6 @@
|
||||||
|
---
|
||||||
|
host_role: monitoring
|
||||||
|
host_description: "Monitoring stack (Prometheus, Grafana)"
|
||||||
|
host_location: "London"
|
||||||
|
ansible_python_interpreter: /usr/local/bin/python3
|
||||||
|
grafana_provisioning_dir: /usr/local/share/grafana/conf/provisioning
|
||||||
16
ansible/inventory/host_vars/london-b.yml
Normal file
16
ansible/inventory/host_vars/london-b.yml
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
---
|
||||||
|
host_role: storage
|
||||||
|
host_description: "Primary storage (ZFS), Docker services"
|
||||||
|
host_location: "London"
|
||||||
|
|
||||||
|
docker_services:
|
||||||
|
- nextcloud-aio
|
||||||
|
- jellyseerr
|
||||||
|
- navidrome
|
||||||
|
- slskd
|
||||||
|
- authelia
|
||||||
|
- forgejo
|
||||||
|
- bitwarden
|
||||||
|
- miniflux
|
||||||
|
- smartctl-exporter
|
||||||
|
- plex-exporter
|
||||||
5
ansible/inventory/host_vars/nuremberg-a.yml
Normal file
5
ansible/inventory/host_vars/nuremberg-a.yml
Normal file
|
|
@ -0,0 +1,5 @@
|
||||||
|
---
|
||||||
|
host_role: mail
|
||||||
|
host_description: "Mail server (poste.io)"
|
||||||
|
host_location: "Hetzner Cloud"
|
||||||
|
ansible_python_interpreter: /usr/bin/python3
|
||||||
25
ansible/inventory/hosts.ini
Normal file
25
ansible/inventory/hosts.ini
Normal file
|
|
@ -0,0 +1,25 @@
|
||||||
|
# pez-infra fleet inventory
|
||||||
|
# All hosts accessible via Tailscale IPs over SSH as root.
|
||||||
|
|
||||||
|
[linux]
|
||||||
|
helsinki-a ansible_host=100.67.6.27
|
||||||
|
london-b ansible_host=100.84.65.101
|
||||||
|
copenhagen-a ansible_host=100.89.206.60
|
||||||
|
copenhagen-c ansible_host=100.115.45.53
|
||||||
|
|
||||||
|
[alpine]
|
||||||
|
nuremberg-a ansible_host=100.117.235.28
|
||||||
|
|
||||||
|
[freebsd]
|
||||||
|
london-a ansible_host=100.122.219.41
|
||||||
|
|
||||||
|
[docker_hosts]
|
||||||
|
london-b
|
||||||
|
nuremberg-a
|
||||||
|
copenhagen-a
|
||||||
|
|
||||||
|
[monitoring]
|
||||||
|
london-a
|
||||||
|
|
||||||
|
[all:vars]
|
||||||
|
ansible_user=root
|
||||||
16
ansible/playbooks/docker-status.yml
Normal file
16
ansible/playbooks/docker-status.yml
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
---
|
||||||
|
# Show running Docker containers on all docker hosts.
|
||||||
|
# Usage: ansible-playbook playbooks/docker-status.yml
|
||||||
|
|
||||||
|
- name: Docker container status
|
||||||
|
hosts: docker_hosts
|
||||||
|
ignore_unreachable: true
|
||||||
|
tasks:
|
||||||
|
- name: Run docker ps
|
||||||
|
ansible.builtin.command: docker ps --format "table {{ '{{' }}.Names{{ '}}' }}\t{{ '{{' }}.Status{{ '}}' }}\t{{ '{{' }}.Ports{{ '}}' }}"
|
||||||
|
register: docker_ps
|
||||||
|
changed_when: false
|
||||||
|
|
||||||
|
- name: Show containers on {{ inventory_hostname }}
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ docker_ps.stdout_lines }}"
|
||||||
95
ansible/playbooks/monitoring.yml
Normal file
95
ansible/playbooks/monitoring.yml
Normal file
|
|
@ -0,0 +1,95 @@
|
||||||
|
---
|
||||||
|
# Deploy monitoring stack to london-a (Prometheus + Grafana).
|
||||||
|
# Usage: ansible-playbook playbooks/monitoring.yml
|
||||||
|
# ansible-playbook playbooks/monitoring.yml --check --diff
|
||||||
|
|
||||||
|
- name: "Monitoring stack (london-a)"
|
||||||
|
hosts: london-a
|
||||||
|
pre_tasks:
|
||||||
|
- name: Load secrets
|
||||||
|
ansible.builtin.include_vars:
|
||||||
|
file: "{{ playbook_dir }}/../group_vars/all/secrets.yaml"
|
||||||
|
no_log: true
|
||||||
|
tasks:
|
||||||
|
- name: Check for Prometheus config
|
||||||
|
delegate_to: localhost
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: "{{ playbook_dir }}/../services/prometheus/prometheus.yml"
|
||||||
|
register: prometheus_config
|
||||||
|
|
||||||
|
- name: Deploy Prometheus config
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: "{{ playbook_dir }}/../services/prometheus/prometheus.yml"
|
||||||
|
dest: /usr/local/etc/prometheus.yml
|
||||||
|
mode: '0644'
|
||||||
|
backup: true
|
||||||
|
when: prometheus_config.stat.exists
|
||||||
|
notify: Restart prometheus
|
||||||
|
|
||||||
|
- name: Deploy Prometheus alerting rules
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: "{{ playbook_dir }}/../services/prometheus/rules/"
|
||||||
|
dest: /usr/local/etc/prometheus/rules/
|
||||||
|
mode: '0644'
|
||||||
|
failed_when: false
|
||||||
|
notify: Restart prometheus
|
||||||
|
|
||||||
|
- name: Ensure unified_alerting section exists in Grafana config
|
||||||
|
ansible.builtin.lineinfile:
|
||||||
|
path: /usr/local/etc/grafana/grafana.ini
|
||||||
|
regexp: '^\[unified_alerting\]'
|
||||||
|
line: '[unified_alerting]'
|
||||||
|
notify: Restart grafana
|
||||||
|
|
||||||
|
- name: Allow provenance status change in Grafana
|
||||||
|
ansible.builtin.lineinfile:
|
||||||
|
path: /usr/local/etc/grafana/grafana.ini
|
||||||
|
regexp: '^allow_prov_status_change'
|
||||||
|
insertafter: '^\[unified_alerting\]'
|
||||||
|
line: 'allow_prov_status_change = true'
|
||||||
|
notify: Restart grafana
|
||||||
|
|
||||||
|
- name: Deploy Grafana dashboards
|
||||||
|
ansible.posix.synchronize:
|
||||||
|
src: "{{ playbook_dir }}/../services/grafana/dashboards/"
|
||||||
|
dest: /usr/local/etc/grafana/dashboards/
|
||||||
|
failed_when: false
|
||||||
|
|
||||||
|
- name: Ensure provisioning dir exists
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ grafana_provisioning_dir }}"
|
||||||
|
state: directory
|
||||||
|
mode: '0755'
|
||||||
|
|
||||||
|
- name: Ensure alerting dir exists
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ grafana_provisioning_dir }}/alerting"
|
||||||
|
state: directory
|
||||||
|
mode: '0755'
|
||||||
|
|
||||||
|
- name: Deploy Grafana provisioning
|
||||||
|
ansible.posix.synchronize:
|
||||||
|
src: "{{ playbook_dir }}/../services/grafana/provisioning/"
|
||||||
|
dest: "{{ grafana_provisioning_dir }}/"
|
||||||
|
failed_when: false
|
||||||
|
|
||||||
|
- name: Template contact points with PagerDuty key
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: "{{ playbook_dir }}/../services/grafana/provisioning/alerting/contact-points.yml"
|
||||||
|
dest: "{{ grafana_provisioning_dir }}/alerting/contact-points.yml"
|
||||||
|
mode: '0640'
|
||||||
|
owner: root
|
||||||
|
group: grafana
|
||||||
|
no_log: true
|
||||||
|
notify: Restart grafana
|
||||||
|
|
||||||
|
handlers:
|
||||||
|
- name: Restart prometheus
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: prometheus
|
||||||
|
state: restarted
|
||||||
|
|
||||||
|
- name: Restart grafana
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: grafana
|
||||||
|
state: restarted
|
||||||
68
ansible/playbooks/reboot.yml
Normal file
68
ansible/playbooks/reboot.yml
Normal file
|
|
@ -0,0 +1,68 @@
|
||||||
|
---
|
||||||
|
# Reboot a specific host and wait for it to come back.
|
||||||
|
# Usage: ansible-playbook playbooks/reboot.yml --limit <hostname>
|
||||||
|
#
|
||||||
|
# Safety: copenhagen-a has netplan pre-flight check.
|
||||||
|
# london-b should NOT be rebooted without manual approval.
|
||||||
|
|
||||||
|
- name: Reboot host safely
|
||||||
|
hosts: all
|
||||||
|
ignore_unreachable: true
|
||||||
|
tasks:
|
||||||
|
- name: SAFETY — refuse unscoped reboot
|
||||||
|
ansible.builtin.fail:
|
||||||
|
msg: >
|
||||||
|
ABORT: You must use --limit <hostname> to reboot a specific host.
|
||||||
|
Running against all hosts is not allowed.
|
||||||
|
when: play_hosts | length > 1
|
||||||
|
|
||||||
|
- name: SAFETY — london-b requires manual approval
|
||||||
|
ansible.builtin.pause:
|
||||||
|
prompt: >
|
||||||
|
WARNING: london-b is the primary storage server. Rebooting will
|
||||||
|
take down ZFS pools and all Docker services. Type 'yes' to confirm.
|
||||||
|
register: london_b_confirm
|
||||||
|
when: inventory_hostname == 'london-b'
|
||||||
|
|
||||||
|
- name: Abort if london-b not confirmed
|
||||||
|
ansible.builtin.fail:
|
||||||
|
msg: "Reboot of london-b was not confirmed."
|
||||||
|
when: inventory_hostname == 'london-b' and london_b_confirm.user_input != 'yes'
|
||||||
|
|
||||||
|
- name: Check netplan config (copenhagen-a)
|
||||||
|
ansible.builtin.command: netplan get all
|
||||||
|
register: netplan_config
|
||||||
|
failed_when: false
|
||||||
|
changed_when: false
|
||||||
|
when: inventory_hostname == 'copenhagen-a'
|
||||||
|
|
||||||
|
- name: Verify copenhagen-a static IP
|
||||||
|
ansible.builtin.assert:
|
||||||
|
that:
|
||||||
|
- "'192.168.0.251' in netplan_config.stdout"
|
||||||
|
fail_msg: >
|
||||||
|
ABORT: copenhagen-a netplan doesn't show expected static IP
|
||||||
|
192.168.0.251. Check netplan config before rebooting.
|
||||||
|
success_msg: "copenhagen-a netplan OK — static IP present."
|
||||||
|
when: inventory_hostname == 'copenhagen-a'
|
||||||
|
|
||||||
|
- name: Reboot
|
||||||
|
ansible.builtin.reboot:
|
||||||
|
reboot_timeout: 300
|
||||||
|
connect_timeout: 10
|
||||||
|
pre_reboot_delay: 5
|
||||||
|
post_reboot_delay: 15
|
||||||
|
test_command: uptime
|
||||||
|
|
||||||
|
- name: Verify SSH is back
|
||||||
|
ansible.builtin.wait_for_connection:
|
||||||
|
timeout: 120
|
||||||
|
|
||||||
|
- name: Show uptime after reboot
|
||||||
|
ansible.builtin.command: uptime
|
||||||
|
register: uptime_result
|
||||||
|
changed_when: false
|
||||||
|
|
||||||
|
- name: Post-reboot uptime
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ inventory_hostname }} is back: {{ uptime_result.stdout }}"
|
||||||
64
ansible/playbooks/update-all.yml
Normal file
64
ansible/playbooks/update-all.yml
Normal file
|
|
@ -0,0 +1,64 @@
|
||||||
|
---
|
||||||
|
# Update all hosts (apt for Linux, pkg for FreeBSD, apk for Alpine).
|
||||||
|
# Usage: ansible-playbook playbooks/update-all.yml
|
||||||
|
|
||||||
|
- name: Update Linux hosts (apt)
|
||||||
|
hosts: linux
|
||||||
|
ignore_unreachable: true
|
||||||
|
tags: [update, linux]
|
||||||
|
tasks:
|
||||||
|
- name: Apt update + upgrade + autoremove
|
||||||
|
ansible.builtin.apt:
|
||||||
|
update_cache: true
|
||||||
|
upgrade: dist
|
||||||
|
autoremove: true
|
||||||
|
autoclean: true
|
||||||
|
register: apt_result
|
||||||
|
|
||||||
|
- name: Show upgrade summary
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ apt_result.stdout_lines | default(['No output']) }}"
|
||||||
|
|
||||||
|
- name: Check if reboot is required
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: /var/run/reboot-required
|
||||||
|
register: reboot_required
|
||||||
|
|
||||||
|
- name: Notify if reboot needed
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "WARNING: REBOOT REQUIRED on {{ inventory_hostname }}"
|
||||||
|
when: reboot_required.stat.exists
|
||||||
|
|
||||||
|
- name: Update Alpine hosts (apk)
|
||||||
|
hosts: alpine
|
||||||
|
ignore_unreachable: true
|
||||||
|
tags: [update, alpine]
|
||||||
|
tasks:
|
||||||
|
- name: Apk update + upgrade
|
||||||
|
community.general.apk:
|
||||||
|
update_cache: true
|
||||||
|
upgrade: true
|
||||||
|
register: apk_result
|
||||||
|
|
||||||
|
- name: Show upgrade summary
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ apk_result.stdout_lines | default(['No output']) }}"
|
||||||
|
|
||||||
|
- name: Update FreeBSD hosts (pkg)
|
||||||
|
hosts: freebsd
|
||||||
|
ignore_unreachable: true
|
||||||
|
tags: [update, freebsd]
|
||||||
|
tasks:
|
||||||
|
- name: Pkg update
|
||||||
|
ansible.builtin.command: pkg update -f
|
||||||
|
register: pkg_update_result
|
||||||
|
changed_when: "'Updating' in pkg_update_result.stdout"
|
||||||
|
|
||||||
|
- name: Pkg upgrade
|
||||||
|
ansible.builtin.command: pkg upgrade -y
|
||||||
|
register: pkg_upgrade_result
|
||||||
|
changed_when: "'upgraded' in pkg_upgrade_result.stdout or 'installed' in pkg_upgrade_result.stdout"
|
||||||
|
|
||||||
|
- name: Show upgrade summary
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ pkg_upgrade_result.stdout_lines | default(['No output']) }}"
|
||||||
24
ansible/playbooks/update-freebsd.yml
Normal file
24
ansible/playbooks/update-freebsd.yml
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
---
|
||||||
|
# Update FreeBSD hosts only (pkg).
|
||||||
|
# Usage: ansible-playbook playbooks/update-freebsd.yml
|
||||||
|
#
|
||||||
|
# Equivalent to: ansible-playbook playbooks/update-all.yml --tags freebsd
|
||||||
|
# This is a convenience wrapper for when you only want FreeBSD hosts.
|
||||||
|
|
||||||
|
- name: Update FreeBSD hosts (pkg)
|
||||||
|
hosts: freebsd
|
||||||
|
ignore_unreachable: true
|
||||||
|
tasks:
|
||||||
|
- name: Pkg update
|
||||||
|
ansible.builtin.command: pkg update -f
|
||||||
|
register: pkg_update_result
|
||||||
|
changed_when: "'Updating' in pkg_update_result.stdout"
|
||||||
|
|
||||||
|
- name: Pkg upgrade
|
||||||
|
ansible.builtin.command: pkg upgrade -y
|
||||||
|
register: pkg_upgrade_result
|
||||||
|
changed_when: "'upgraded' in pkg_upgrade_result.stdout or 'installed' in pkg_upgrade_result.stdout"
|
||||||
|
|
||||||
|
- name: Show upgrade summary
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ pkg_upgrade_result.stdout_lines | default(['No output']) }}"
|
||||||
46
ansible/playbooks/update-linux.yml
Normal file
46
ansible/playbooks/update-linux.yml
Normal file
|
|
@ -0,0 +1,46 @@
|
||||||
|
---
|
||||||
|
# Update Linux hosts only (apt + Alpine apk).
|
||||||
|
# Usage: ansible-playbook playbooks/update-linux.yml
|
||||||
|
#
|
||||||
|
# Equivalent to: ansible-playbook playbooks/update-all.yml --tags linux,alpine
|
||||||
|
# This is a convenience wrapper for when you only want Linux hosts.
|
||||||
|
|
||||||
|
- name: Update Linux hosts (apt)
|
||||||
|
hosts: linux
|
||||||
|
ignore_unreachable: true
|
||||||
|
tasks:
|
||||||
|
- name: Apt update + upgrade + autoremove
|
||||||
|
ansible.builtin.apt:
|
||||||
|
update_cache: true
|
||||||
|
upgrade: dist
|
||||||
|
autoremove: true
|
||||||
|
autoclean: true
|
||||||
|
register: apt_result
|
||||||
|
|
||||||
|
- name: Show upgrade summary
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ apt_result.stdout_lines | default(['No output']) }}"
|
||||||
|
|
||||||
|
- name: Check if reboot is required
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: /var/run/reboot-required
|
||||||
|
register: reboot_required
|
||||||
|
|
||||||
|
- name: Notify if reboot needed
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "WARNING: REBOOT REQUIRED on {{ inventory_hostname }}"
|
||||||
|
when: reboot_required.stat.exists
|
||||||
|
|
||||||
|
- name: Update Alpine hosts (apk)
|
||||||
|
hosts: alpine
|
||||||
|
ignore_unreachable: true
|
||||||
|
tasks:
|
||||||
|
- name: Apk update + upgrade
|
||||||
|
community.general.apk:
|
||||||
|
update_cache: true
|
||||||
|
upgrade: true
|
||||||
|
register: apk_result
|
||||||
|
|
||||||
|
- name: Show upgrade summary
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ apk_result.stdout_lines | default(['No output']) }}"
|
||||||
11
ansible/requirements.yml
Normal file
11
ansible/requirements.yml
Normal file
|
|
@ -0,0 +1,11 @@
|
||||||
|
---
|
||||||
|
# Ansible Galaxy requirements
|
||||||
|
# Install: ansible-galaxy install -r requirements.yml
|
||||||
|
|
||||||
|
collections:
|
||||||
|
- name: community.docker
|
||||||
|
version: ">=3.0.0"
|
||||||
|
- name: community.general
|
||||||
|
version: ">=7.0.0"
|
||||||
|
- name: ansible.posix
|
||||||
|
version: ">=1.5.0"
|
||||||
5
ansible/roles/caddy/handlers/main.yml
Normal file
5
ansible/roles/caddy/handlers/main.yml
Normal file
|
|
@ -0,0 +1,5 @@
|
||||||
|
---
|
||||||
|
- name: Reload caddy
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: caddy
|
||||||
|
state: reloaded
|
||||||
31
ansible/roles/caddy/tasks/main.yml
Normal file
31
ansible/roles/caddy/tasks/main.yml
Normal file
|
|
@ -0,0 +1,31 @@
|
||||||
|
---
|
||||||
|
# Deploy Caddy reverse proxy on helsinki-a.
|
||||||
|
# Expects Caddyfile in services/caddy/.
|
||||||
|
|
||||||
|
- name: Install Caddy
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: caddy
|
||||||
|
state: present
|
||||||
|
when: ansible_facts["os_family"] == "Debian"
|
||||||
|
|
||||||
|
- name: Check for Caddyfile in repo
|
||||||
|
delegate_to: localhost
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: "{{ playbook_dir }}/services/caddy/Caddyfile"
|
||||||
|
register: caddy_caddyfile_src
|
||||||
|
|
||||||
|
- name: Deploy Caddyfile
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: "{{ playbook_dir }}/services/caddy/Caddyfile"
|
||||||
|
dest: /etc/caddy/Caddyfile
|
||||||
|
mode: '0644'
|
||||||
|
backup: true
|
||||||
|
validate: "caddy validate --config %s --adapter caddyfile"
|
||||||
|
notify: Reload caddy
|
||||||
|
when: caddy_caddyfile_src.stat.exists
|
||||||
|
|
||||||
|
- name: Enable and start Caddy
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: caddy
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
5
ansible/roles/common/handlers/main.yml
Normal file
5
ansible/roles/common/handlers/main.yml
Normal file
|
|
@ -0,0 +1,5 @@
|
||||||
|
---
|
||||||
|
- name: Restart sshd
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: sshd
|
||||||
|
state: restarted
|
||||||
102
ansible/roles/common/tasks/main.yml
Normal file
102
ansible/roles/common/tasks/main.yml
Normal file
|
|
@ -0,0 +1,102 @@
|
||||||
|
---
|
||||||
|
# Common baseline for all Linux hosts.
|
||||||
|
# Installs core packages, configures SSH, sets up the shell environment.
|
||||||
|
|
||||||
|
- name: Update apt cache
|
||||||
|
ansible.builtin.apt:
|
||||||
|
update_cache: true
|
||||||
|
cache_valid_time: 3600
|
||||||
|
when: ansible_facts["os_family"] == "Debian"
|
||||||
|
|
||||||
|
- name: Install baseline packages (Debian)
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name:
|
||||||
|
- curl
|
||||||
|
- wget
|
||||||
|
- git
|
||||||
|
- htop
|
||||||
|
- tmux
|
||||||
|
- vim
|
||||||
|
- jq
|
||||||
|
- unzip
|
||||||
|
- fish
|
||||||
|
- rsync
|
||||||
|
- fail2ban
|
||||||
|
- ufw
|
||||||
|
state: present
|
||||||
|
when: ansible_facts["os_family"] == "Debian"
|
||||||
|
|
||||||
|
- name: Install baseline packages (Alpine)
|
||||||
|
community.general.apk:
|
||||||
|
name:
|
||||||
|
- curl
|
||||||
|
- wget
|
||||||
|
- git
|
||||||
|
- htop
|
||||||
|
- tmux
|
||||||
|
- vim
|
||||||
|
- jq
|
||||||
|
- fish
|
||||||
|
- rsync
|
||||||
|
- shadow
|
||||||
|
- py3-requests
|
||||||
|
state: present
|
||||||
|
when: ansible_facts["os_family"] == "Alpine"
|
||||||
|
|
||||||
|
- name: Install baseline packages (FreeBSD)
|
||||||
|
community.general.pkgng:
|
||||||
|
name:
|
||||||
|
- curl
|
||||||
|
- wget
|
||||||
|
- git
|
||||||
|
- htop
|
||||||
|
- tmux
|
||||||
|
- vim
|
||||||
|
- jq
|
||||||
|
- rsync
|
||||||
|
state: present
|
||||||
|
when: ansible_facts["os_family"] == "FreeBSD"
|
||||||
|
|
||||||
|
- name: Install fish shell
|
||||||
|
ansible.builtin.package:
|
||||||
|
name: fish
|
||||||
|
state: present
|
||||||
|
when: inventory_hostname != 'london-a'
|
||||||
|
|
||||||
|
- name: Get fish shell path
|
||||||
|
ansible.builtin.command: which fish
|
||||||
|
changed_when: false
|
||||||
|
register: common_fish_path
|
||||||
|
when: inventory_hostname != 'london-a'
|
||||||
|
|
||||||
|
- name: Set fish as default shell
|
||||||
|
ansible.builtin.user:
|
||||||
|
name: root
|
||||||
|
shell: "{{ common_fish_path.stdout }}"
|
||||||
|
when: inventory_hostname != 'london-a'
|
||||||
|
|
||||||
|
- name: Ensure SSH directory exists
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /root/.ssh
|
||||||
|
state: directory
|
||||||
|
mode: '0700'
|
||||||
|
|
||||||
|
- name: Harden SSH config
|
||||||
|
ansible.builtin.lineinfile:
|
||||||
|
path: /etc/ssh/sshd_config
|
||||||
|
regexp: "{{ item.regexp }}"
|
||||||
|
line: "{{ item.line }}"
|
||||||
|
state: present
|
||||||
|
loop:
|
||||||
|
- { regexp: '^#?PermitRootLogin', line: 'PermitRootLogin prohibit-password' }
|
||||||
|
- { regexp: '^#?PasswordAuthentication', line: 'PasswordAuthentication no' }
|
||||||
|
- { regexp: '^#?X11Forwarding', line: 'X11Forwarding no' }
|
||||||
|
notify: Restart sshd
|
||||||
|
when: ansible_facts["os_family"] != "FreeBSD"
|
||||||
|
|
||||||
|
- name: Enable fail2ban (Debian)
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: fail2ban
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
when: ansible_facts["os_family"] == "Debian"
|
||||||
31
ansible/roles/docker/tasks/main.yml
Normal file
31
ansible/roles/docker/tasks/main.yml
Normal file
|
|
@ -0,0 +1,31 @@
|
||||||
|
---
|
||||||
|
# Install Docker and docker-compose, start the daemon.
|
||||||
|
|
||||||
|
- name: Install Docker (Debian)
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name:
|
||||||
|
- docker.io
|
||||||
|
- docker-compose
|
||||||
|
state: present
|
||||||
|
when: ansible_facts["os_family"] == "Debian"
|
||||||
|
|
||||||
|
- name: Install Docker (Alpine)
|
||||||
|
community.general.apk:
|
||||||
|
name:
|
||||||
|
- docker
|
||||||
|
- docker-cli-compose
|
||||||
|
state: present
|
||||||
|
when: ansible_facts["os_family"] == "Alpine"
|
||||||
|
|
||||||
|
- name: Enable and start Docker
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: docker
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
- name: Create docker compose project directories
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "/opt/docker/{{ item }}"
|
||||||
|
state: directory
|
||||||
|
mode: '0755'
|
||||||
|
loop: "{{ docker_services | default([]) }}"
|
||||||
32
ansible/roles/docker_services/tasks/main.yml
Normal file
32
ansible/roles/docker_services/tasks/main.yml
Normal file
|
|
@ -0,0 +1,32 @@
|
||||||
|
---
|
||||||
|
# Deploy Docker Compose services from the repo's services/ directory.
|
||||||
|
# Expects docker_services list in host_vars and compose files in services/<name>/.
|
||||||
|
|
||||||
|
- name: Copy docker-compose files
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: "{{ playbook_dir }}/services/{{ item }}/docker-compose.yml"
|
||||||
|
dest: "/opt/docker/{{ item }}/docker-compose.yml"
|
||||||
|
mode: '0644'
|
||||||
|
loop: "{{ docker_services | default([]) }}"
|
||||||
|
register: docker_services_compose_files
|
||||||
|
failed_when: false
|
||||||
|
|
||||||
|
- name: Copy service config files
|
||||||
|
ansible.posix.synchronize:
|
||||||
|
src: "{{ playbook_dir }}/services/{{ item }}/"
|
||||||
|
dest: "/opt/docker/{{ item }}/"
|
||||||
|
rsync_opts:
|
||||||
|
- "--exclude=docker-compose.yml"
|
||||||
|
- "--exclude=README.md"
|
||||||
|
- "--exclude=.gitkeep"
|
||||||
|
loop: "{{ docker_services | default([]) }}"
|
||||||
|
failed_when: false
|
||||||
|
|
||||||
|
- name: Start/update docker compose services
|
||||||
|
community.docker.docker_compose_v2:
|
||||||
|
project_src: "/opt/docker/{{ item.item }}"
|
||||||
|
state: present
|
||||||
|
pull: policy
|
||||||
|
loop: "{{ docker_services_compose_files.results | default([]) }}"
|
||||||
|
when: item is not failed and item is changed
|
||||||
|
failed_when: false
|
||||||
24
ansible/roles/dotfiles/tasks/main.yml
Normal file
24
ansible/roles/dotfiles/tasks/main.yml
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
---
|
||||||
|
# Deploy dotfiles from the repo's dotfiles/ directory.
|
||||||
|
# Symlinks config files into the home directory.
|
||||||
|
|
||||||
|
- name: Check for dotfiles source
|
||||||
|
delegate_to: localhost
|
||||||
|
ansible.builtin.stat:
|
||||||
|
path: "{{ playbook_dir }}/dotfiles"
|
||||||
|
register: dotfiles_dir
|
||||||
|
|
||||||
|
- name: Copy dotfiles
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: "{{ playbook_dir }}/dotfiles/{{ item.src }}"
|
||||||
|
dest: "{{ item.dest }}"
|
||||||
|
mode: '0644'
|
||||||
|
backup: true
|
||||||
|
loop:
|
||||||
|
- { src: 'config/tmux/tmux.conf', dest: '/root/.tmux.conf' }
|
||||||
|
- { src: 'config/fish/config.fish', dest: '/root/.config/fish/config.fish' }
|
||||||
|
- { src: 'config/git/gitconfig', dest: '/root/.gitconfig' }
|
||||||
|
failed_when: false
|
||||||
|
when:
|
||||||
|
- dotfiles_dir.stat.exists
|
||||||
|
- not (inventory_hostname == 'london-a' and item.src is search('fish'))
|
||||||
48
ansible/roles/node_exporter/tasks/main.yml
Normal file
48
ansible/roles/node_exporter/tasks/main.yml
Normal file
|
|
@ -0,0 +1,48 @@
|
||||||
|
---
|
||||||
|
# Install node_exporter for Prometheus monitoring.
|
||||||
|
# Uses system packages on Linux, pkg on FreeBSD.
|
||||||
|
|
||||||
|
- name: Install prometheus-node-exporter (Debian)
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: prometheus-node-exporter
|
||||||
|
state: present
|
||||||
|
when: ansible_facts["os_family"] == "Debian"
|
||||||
|
|
||||||
|
- name: Install prometheus-node-exporter (Alpine)
|
||||||
|
community.general.apk:
|
||||||
|
name: prometheus-node-exporter
|
||||||
|
state: present
|
||||||
|
when: ansible_facts["os_family"] == "Alpine"
|
||||||
|
|
||||||
|
- name: Enable and start node-exporter (Debian)
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: prometheus-node-exporter
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
when: ansible_facts["os_family"] == "Debian"
|
||||||
|
|
||||||
|
- name: Enable and start node-exporter (Alpine)
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: node-exporter
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
when: ansible_facts["os_family"] == "Alpine"
|
||||||
|
|
||||||
|
- name: Install node_exporter (FreeBSD)
|
||||||
|
community.general.pkgng:
|
||||||
|
name: node_exporter
|
||||||
|
state: present
|
||||||
|
when: ansible_facts["os_family"] == "FreeBSD"
|
||||||
|
|
||||||
|
- name: Enable node_exporter (FreeBSD)
|
||||||
|
ansible.builtin.lineinfile:
|
||||||
|
path: /etc/rc.conf
|
||||||
|
regexp: '^node_exporter_enable='
|
||||||
|
line: 'node_exporter_enable="YES"'
|
||||||
|
when: ansible_facts["os_family"] == "FreeBSD"
|
||||||
|
|
||||||
|
- name: Start node_exporter (FreeBSD)
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: node_exporter
|
||||||
|
state: started
|
||||||
|
when: ansible_facts["os_family"] == "FreeBSD"
|
||||||
4
ansible/roles/systemd_services/handlers/main.yml
Normal file
4
ansible/roles/systemd_services/handlers/main.yml
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
---
|
||||||
|
- name: Reload systemd daemon
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
daemon_reload: true
|
||||||
22
ansible/roles/systemd_services/tasks/main.yml
Normal file
22
ansible/roles/systemd_services/tasks/main.yml
Normal file
|
|
@ -0,0 +1,22 @@
|
||||||
|
---
|
||||||
|
# Deploy custom systemd unit files from the repo.
|
||||||
|
# Looks for unit files in services/<name>/<name>.service
|
||||||
|
|
||||||
|
- name: Copy systemd unit files
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: "{{ playbook_dir }}/services/{{ item }}/{{ item }}.service"
|
||||||
|
dest: "/etc/systemd/system/{{ item }}.service"
|
||||||
|
mode: '0644'
|
||||||
|
loop: "{{ systemd_services | default([]) }}"
|
||||||
|
register: systemd_services_unit_files
|
||||||
|
failed_when: false
|
||||||
|
notify: Reload systemd daemon
|
||||||
|
|
||||||
|
- name: Enable and start systemd services
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: "{{ item.item }}"
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
loop: "{{ systemd_services_unit_files.results | default([]) }}"
|
||||||
|
when: item is not failed
|
||||||
|
failed_when: false
|
||||||
15
ansible/scripts/docker-log-cleanup.sh
Executable file
15
ansible/scripts/docker-log-cleanup.sh
Executable file
|
|
@ -0,0 +1,15 @@
|
||||||
|
#!/bin/bash
|
||||||
|
# Truncate large Docker container log files
|
||||||
|
# Deployed on: nuremberg-a
|
||||||
|
# Cron: 0 3 1 * * /usr/local/bin/docker-log-cleanup.sh
|
||||||
|
|
||||||
|
LOG_DIR=/var/lib/docker/containers
|
||||||
|
MAX_SIZE_MB=100
|
||||||
|
|
||||||
|
find "$LOG_DIR" -name '*-json.log' | while read -r logfile; do
|
||||||
|
size_mb=$(du -m "$logfile" | cut -f1)
|
||||||
|
if [ "$size_mb" -gt "$MAX_SIZE_MB" ]; then
|
||||||
|
echo "$(date): Truncating $logfile (${size_mb}MB)" >> /var/log/docker-log-cleanup.log
|
||||||
|
truncate -s 0 "$logfile"
|
||||||
|
fi
|
||||||
|
done
|
||||||
39
ansible/scripts/hdd-backup.sh
Executable file
39
ansible/scripts/hdd-backup.sh
Executable file
|
|
@ -0,0 +1,39 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
BUCKET="b2:london-b-hdd"
|
||||||
|
DIRS=(archive backups stash syncthing ftp)
|
||||||
|
EMAIL="pez@pez.sh"
|
||||||
|
SUBJECT="HDD Backup Report - $(date '+%Y-%m-%d %H:%M')"
|
||||||
|
|
||||||
|
failures=()
|
||||||
|
report=""
|
||||||
|
|
||||||
|
for dir in "${DIRS[@]}"; do
|
||||||
|
src="/hdd/$dir"
|
||||||
|
dst="$BUCKET/$dir"
|
||||||
|
echo "Syncing $src -> $dst"
|
||||||
|
|
||||||
|
output=$(rclone sync "$src" "$dst" -v 2>&1); rc=$?
|
||||||
|
output=$(grep -v "Can't follow symlink without -L/--copy-links" <<< "$output")
|
||||||
|
[[ $rc -ne 0 ]] && failures+=("$dir")
|
||||||
|
|
||||||
|
report+="=== $dir ===\n$output\n\n"
|
||||||
|
done
|
||||||
|
|
||||||
|
# Get bucket storage usage
|
||||||
|
bucket_usage=$(rclone size "$BUCKET" 2>&1) || bucket_usage="(failed to retrieve bucket size)"
|
||||||
|
|
||||||
|
if [[ ${#failures[@]} -gt 0 ]]; then
|
||||||
|
failure_summary="FAILURES: ${failures[*]}"
|
||||||
|
else
|
||||||
|
failure_summary="All syncs completed successfully."
|
||||||
|
fi
|
||||||
|
|
||||||
|
{
|
||||||
|
echo -e "Backup completed: $(date '+%Y-%m-%d %H:%M:%S')"
|
||||||
|
echo -e "$failure_summary\n"
|
||||||
|
echo -e "=== Bucket Usage ===\n$bucket_usage\n"
|
||||||
|
#echo -e "=== Sync Output ===\n$report"
|
||||||
|
} | mutt -s "$SUBJECT" "$EMAIL"
|
||||||
58
ansible/services/README.md
Normal file
58
ansible/services/README.md
Normal file
|
|
@ -0,0 +1,58 @@
|
||||||
|
# Services
|
||||||
|
|
||||||
|
Version-controlled service definitions across the fleet.
|
||||||
|
|
||||||
|
## Directory Structure
|
||||||
|
|
||||||
|
```
|
||||||
|
services/
|
||||||
|
├── systemd/ # systemd unit files (Linux hosts)
|
||||||
|
│ ├── copenhagen-a/
|
||||||
|
│ │ ├── mangos-realmd.service # MaNGOS Zero realm server
|
||||||
|
│ │ ├── mangos-world.service # MaNGOS Zero world server
|
||||||
|
│ │ └── cloudflared.service # Cloudflare tunnel (token redacted)
|
||||||
|
│ └── helsinki-a/
|
||||||
|
│ ├── caddy.service # Caddy reverse proxy (stock unit)
|
||||||
|
│ └── thiswebsitedoesnotexist.service # Node.js app on port 3721
|
||||||
|
└── rc.d/ # FreeBSD rc.conf and rc.d scripts
|
||||||
|
└── london-a/
|
||||||
|
└── rc.conf # /etc/rc.conf — all enabled services
|
||||||
|
```
|
||||||
|
|
||||||
|
## Notes
|
||||||
|
|
||||||
|
### copenhagen-a (Linux)
|
||||||
|
|
||||||
|
| Service | Unit | Status | Notes |
|
||||||
|
|---------|------|--------|-------|
|
||||||
|
| MaNGOS realmd | `mangos-realmd.service` | enabled, custom | Realm server for WoW private server. Depends on MariaDB. |
|
||||||
|
| MaNGOS world | `mangos-world.service` | enabled, custom | World server. Depends on MariaDB and realmd. |
|
||||||
|
| cloudflared | `cloudflared.service` | enabled, custom | Cloudflare tunnel. **Token redacted** — replace `${CLOUDFLARED_TOKEN}` with the real token on deploy. |
|
||||||
|
|
||||||
|
### helsinki-a (Linux)
|
||||||
|
|
||||||
|
| Service | Unit | Status | Notes |
|
||||||
|
|---------|------|--------|-------|
|
||||||
|
| Caddy | `caddy.service` | enabled, stock | Installed via package manager. Config at `/etc/caddy/Caddyfile`. |
|
||||||
|
| thiswebsitedoesnotexist | `thiswebsitedoesnotexist.service` | enabled, custom | Node.js app. Env vars in `/opt/thiswebsitedoesnotexist/.env`. |
|
||||||
|
|
||||||
|
### london-a (FreeBSD)
|
||||||
|
|
||||||
|
No custom rc.d scripts — all services installed via `pkg`. The `rc.conf` captures all enabled services:
|
||||||
|
|
||||||
|
| Service | rc.conf variable | Notes |
|
||||||
|
|---------|-----------------|-------|
|
||||||
|
| Grafana | `grafana_enable="YES"` | Monitoring dashboards |
|
||||||
|
| Prometheus | `prometheus_enable="YES"` | Metrics collection |
|
||||||
|
| node_exporter | `node_exporter_enable="YES"` | Host metrics exporter |
|
||||||
|
| Tailscale | `tailscaled_enable="YES"` | Mesh VPN |
|
||||||
|
| cloudflared | `cloudflared_enable="YES"` | Cloudflare tunnel (tunnel ID in rc.conf) |
|
||||||
|
| InfluxDB | `influxd_enable="YES"` | Time-series database |
|
||||||
|
| libvirtd | `libvirtd_enable="YES"` | Virtualisation daemon |
|
||||||
|
| Redis | `redis_enable="YES"` | In-memory data store |
|
||||||
|
| PostgreSQL | `postgresql_enable="YES"` | Relational database |
|
||||||
|
|
||||||
|
## Security
|
||||||
|
|
||||||
|
- The cloudflared token on copenhagen-a has been **redacted** in the committed unit file. The live service uses the real token.
|
||||||
|
- The cloudflare tunnel ID on london-a is committed as-is (it's not a secret — the tunnel token is separate).
|
||||||
13
ansible/services/authelia/README.md
Normal file
13
ansible/services/authelia/README.md
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
# Authelia
|
||||||
|
|
||||||
|
SSO authentication portal with LLDAP directory and MariaDB backend.
|
||||||
|
|
||||||
|
- **Host:** helsinki-a
|
||||||
|
- **URL:** https://auth.pez.sh (integrated via Caddy forward_auth)
|
||||||
|
- **Components:**
|
||||||
|
- **Authelia** — SSO portal (port 9091, localhost only)
|
||||||
|
- **LLDAP** — Lightweight LDAP directory (port 3890 LDAP, port 17170 web UI)
|
||||||
|
- **MariaDB 11** — Session/config storage
|
||||||
|
- **Config:** `/root/authelia/config/`
|
||||||
|
- **Secrets:** `/root/authelia/secrets/` (JWT, session, encryption keys, passwords)
|
||||||
|
- **LDAP base DN:** `dc=pez,dc=sh`
|
||||||
10
ansible/services/authelia/config.enc.yml.example
Normal file
10
ansible/services/authelia/config.enc.yml.example
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
# Example: services/authelia/config.enc.yml
|
||||||
|
# Authelia secrets — encrypt with: sops -e -i config.enc.yml
|
||||||
|
---
|
||||||
|
jwt_secret: CHANGEME
|
||||||
|
session_secret: CHANGEME
|
||||||
|
storage_encryption_key: CHANGEME
|
||||||
|
lldap_admin_password: CHANGEME
|
||||||
|
mariadb_root_password: CHANGEME
|
||||||
|
mariadb_authelia_password: CHANGEME
|
||||||
|
oidc_hmac_secret: CHANGEME
|
||||||
77
ansible/services/authelia/docker-compose.yml
Normal file
77
ansible/services/authelia/docker-compose.yml
Normal file
|
|
@ -0,0 +1,77 @@
|
||||||
|
# Authelia - SSO/authentication portal with LLDAP + MariaDB
|
||||||
|
# Host: helsinki-a (100.67.6.27)
|
||||||
|
# Data: /root/authelia/
|
||||||
|
# Access: https://auth.pez.sh (via Caddy forward_auth)
|
||||||
|
|
||||||
|
services:
|
||||||
|
authelia:
|
||||||
|
container_name: authelia
|
||||||
|
image: docker.io/authelia/authelia:latest
|
||||||
|
restart: unless-stopped
|
||||||
|
ports:
|
||||||
|
- '127.0.0.1:9091:9091'
|
||||||
|
environment:
|
||||||
|
AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE: /secrets/JWT_SECRET
|
||||||
|
AUTHELIA_SESSION_SECRET_FILE: /secrets/SESSION_SECRET
|
||||||
|
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: /secrets/STORAGE_ENCRYPTION_KEY
|
||||||
|
AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE: /secrets/MYSQL_PASSWORD
|
||||||
|
TZ: UTC
|
||||||
|
volumes:
|
||||||
|
- /root/authelia/config:/config
|
||||||
|
- /root/authelia/secrets:/secrets
|
||||||
|
depends_on:
|
||||||
|
mariadb:
|
||||||
|
condition: service_healthy
|
||||||
|
lldap:
|
||||||
|
condition: service_started
|
||||||
|
networks:
|
||||||
|
- authelia
|
||||||
|
|
||||||
|
mariadb:
|
||||||
|
container_name: authelia-mariadb
|
||||||
|
image: docker.io/library/mariadb:11
|
||||||
|
restart: unless-stopped
|
||||||
|
environment:
|
||||||
|
MYSQL_ROOT_PASSWORD_FILE: /run/secrets/MYSQL_ROOT_PASSWORD
|
||||||
|
MYSQL_DATABASE: authelia
|
||||||
|
MYSQL_USER: authelia
|
||||||
|
MYSQL_PASSWORD_FILE: /run/secrets/MYSQL_PASSWORD
|
||||||
|
TZ: UTC
|
||||||
|
volumes:
|
||||||
|
- /root/authelia/mariadb:/var/lib/mysql
|
||||||
|
- /root/authelia/secrets/MYSQL_ROOT_PASSWORD:/run/secrets/MYSQL_ROOT_PASSWORD:ro
|
||||||
|
- /root/authelia/secrets/MYSQL_PASSWORD:/run/secrets/MYSQL_PASSWORD:ro
|
||||||
|
networks:
|
||||||
|
- authelia
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
|
||||||
|
interval: 10s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 5
|
||||||
|
start_period: 30s
|
||||||
|
|
||||||
|
lldap:
|
||||||
|
container_name: authelia-lldap
|
||||||
|
image: docker.io/lldap/lldap:latest
|
||||||
|
restart: unless-stopped
|
||||||
|
ports:
|
||||||
|
- '17170:17170' # Web UI
|
||||||
|
- '3890:3890' # LDAP
|
||||||
|
environment:
|
||||||
|
UID: '1000'
|
||||||
|
GID: '1000'
|
||||||
|
TZ: UTC
|
||||||
|
LLDAP_LDAP_BASE_DN: dc=pez,dc=sh
|
||||||
|
LLDAP_LDAP_USER_DN: admin
|
||||||
|
LLDAP_LDAP_USER_PASS_FILE: /secrets/LLDAP_ADMIN_PASSWORD
|
||||||
|
LLDAP_JWT_SECRET_FILE: /secrets/LLDAP_JWT_SECRET
|
||||||
|
volumes:
|
||||||
|
- /root/authelia/lldap:/data
|
||||||
|
- /root/authelia/secrets/LLDAP_ADMIN_PASSWORD:/secrets/LLDAP_ADMIN_PASSWORD:ro
|
||||||
|
- /root/authelia/secrets/LLDAP_JWT_SECRET:/secrets/LLDAP_JWT_SECRET:ro
|
||||||
|
networks:
|
||||||
|
- authelia
|
||||||
|
|
||||||
|
networks:
|
||||||
|
authelia:
|
||||||
|
driver: bridge
|
||||||
11
ansible/services/bitwarden/README.md
Normal file
11
ansible/services/bitwarden/README.md
Normal file
|
|
@ -0,0 +1,11 @@
|
||||||
|
# Bitwarden
|
||||||
|
|
||||||
|
Self-hosted password manager (unified deployment).
|
||||||
|
|
||||||
|
- **Host:** helsinki-a
|
||||||
|
- **URL:** https://bitwarden.pez.sh
|
||||||
|
- **Image:** `ghcr.io/bitwarden/self-host:beta` (unified container)
|
||||||
|
- **Database:** MariaDB 10
|
||||||
|
- **Admin:** pez@pez.sh
|
||||||
|
- **Config:** `settings.env` (env file, not committed — contains secrets)
|
||||||
|
- **Data:** Docker volumes (`bitwarden`, `data`)
|
||||||
33
ansible/services/bitwarden/docker-compose.yml
Normal file
33
ansible/services/bitwarden/docker-compose.yml
Normal file
|
|
@ -0,0 +1,33 @@
|
||||||
|
# Bitwarden - Self-hosted password manager
|
||||||
|
# Host: helsinki-a (100.67.6.27)
|
||||||
|
# Data: Docker volume (bitwarden)
|
||||||
|
# Access: https://bitwarden.pez.sh (via Caddy reverse proxy)
|
||||||
|
|
||||||
|
services:
|
||||||
|
bitwarden:
|
||||||
|
image: ghcr.io/bitwarden/self-host:beta
|
||||||
|
restart: always
|
||||||
|
depends_on:
|
||||||
|
- db
|
||||||
|
env_file:
|
||||||
|
- settings.env
|
||||||
|
ports:
|
||||||
|
- "8080:8080"
|
||||||
|
- "8443:8443"
|
||||||
|
volumes:
|
||||||
|
- bitwarden:/etc/bitwarden
|
||||||
|
|
||||||
|
db:
|
||||||
|
image: mariadb:10
|
||||||
|
restart: always
|
||||||
|
environment:
|
||||||
|
MARIADB_USER: bitwarden
|
||||||
|
MARIADB_PASSWORD: "${BW_DB_PASSWORD}"
|
||||||
|
MARIADB_DATABASE: bitwarden_vault
|
||||||
|
MARIADB_RANDOM_ROOT_PASSWORD: "true"
|
||||||
|
volumes:
|
||||||
|
- data:/var/lib/mysql
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
bitwarden:
|
||||||
|
data:
|
||||||
246
ansible/services/caddy/Caddyfile
Normal file
246
ansible/services/caddy/Caddyfile
Normal file
|
|
@ -0,0 +1,246 @@
|
||||||
|
# _ __ ___ ____ _ __ _ __ _____ ___ _
|
||||||
|
# | '_ \ / _ \_ /____| '_ \| '__/ _ \ \/ / | | |
|
||||||
|
# | |_) | __// /_____| |_) | | | (_) > <| |_| |
|
||||||
|
# | .__/ \___/___| | .__/|_| \___/_/\_\\__, |
|
||||||
|
# |_| |_| |___/
|
||||||
|
#
|
||||||
|
|
||||||
|
{
|
||||||
|
admin 100.67.6.27:2019
|
||||||
|
metrics {
|
||||||
|
per_host
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
## LONDON-A SERVICES ##
|
||||||
|
|
||||||
|
# Grafana
|
||||||
|
grafana.pez.solutions, grafana.pez.sh {
|
||||||
|
forward_auth localhost:9091 {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
reverse_proxy 100.122.219.41:3000
|
||||||
|
}
|
||||||
|
|
||||||
|
# Prometheus
|
||||||
|
prometheus.pez.solutions, prometheus.pez.sh {
|
||||||
|
forward_auth localhost:9091 {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
reverse_proxy 100.122.219.41:9090
|
||||||
|
}
|
||||||
|
|
||||||
|
# Alertmanager
|
||||||
|
alertmanager.pez.solutions, alertmanager.pez.sh {
|
||||||
|
forward_auth localhost:9091 {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
reverse_proxy 100.122.219.41:3000
|
||||||
|
}
|
||||||
|
|
||||||
|
## LONDON-B SERVICES ##
|
||||||
|
|
||||||
|
# Jellyfin
|
||||||
|
jellyfin.pez.solutions, jellyfin.pez.sh {
|
||||||
|
reverse_proxy 100.84.65.101:8096
|
||||||
|
}
|
||||||
|
|
||||||
|
# Plex
|
||||||
|
plex.pez.solutions, plex.pez.sh {
|
||||||
|
reverse_proxy 100.84.65.101:32400
|
||||||
|
}
|
||||||
|
|
||||||
|
# Radarr
|
||||||
|
radarr.pez.solutions, radarr.pez.sh {
|
||||||
|
forward_auth localhost:9091 {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
reverse_proxy 100.84.65.101:7878
|
||||||
|
}
|
||||||
|
|
||||||
|
# Sonarr
|
||||||
|
sonarr.pez.solutions, sonarr.pez.sh {
|
||||||
|
forward_auth localhost:9091 {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
reverse_proxy 100.84.65.101:8989
|
||||||
|
}
|
||||||
|
|
||||||
|
# Lidarr
|
||||||
|
lidarr.pez.solutions, lidarr.pez.sh {
|
||||||
|
forward_auth localhost:9091 {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
reverse_proxy 100.84.65.101:8686
|
||||||
|
}
|
||||||
|
|
||||||
|
# Readarr
|
||||||
|
readarr.pez.solutions, readarr.pez.sh {
|
||||||
|
forward_auth localhost:9091 {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
reverse_proxy 100.84.65.101:8787
|
||||||
|
}
|
||||||
|
|
||||||
|
# slskd
|
||||||
|
soulseek.pez.solutions, soulseek.pez.sh {
|
||||||
|
forward_auth localhost:9091 {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
reverse_proxy 100.84.65.101:5030
|
||||||
|
}
|
||||||
|
|
||||||
|
# Prowlarr
|
||||||
|
prowlarr.pez.solutions, prowlarr.pez.sh {
|
||||||
|
forward_auth localhost:9091 {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
reverse_proxy 100.84.65.101:9696
|
||||||
|
}
|
||||||
|
|
||||||
|
# Transmission
|
||||||
|
download.pez.solutions, download.pez.sh {
|
||||||
|
forward_auth localhost:9091 {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
reverse_proxy 100.84.65.101:9091
|
||||||
|
}
|
||||||
|
|
||||||
|
# Overseerr
|
||||||
|
request.pez.solutions, request.pez.sh {
|
||||||
|
reverse_proxy 100.84.65.101:5055
|
||||||
|
}
|
||||||
|
|
||||||
|
# Jellyfin Requests
|
||||||
|
jellyfin-requests.pez.solutions, jellyfin-requests.pez.sh {
|
||||||
|
reverse_proxy 100.84.65.101:5056
|
||||||
|
}
|
||||||
|
|
||||||
|
#WebDAV
|
||||||
|
#https://cloud.pez.sh {
|
||||||
|
# reverse_proxy 100.84.65.101:8080
|
||||||
|
#}
|
||||||
|
|
||||||
|
https://cloud.pez.sh:443 {
|
||||||
|
reverse_proxy 100.84.65.101:11000 # Adjust to match APACHE_PORT and APACHE_IP_BINDING. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#adapting-the-sample-web-server-configurations-below
|
||||||
|
}
|
||||||
|
|
||||||
|
music.pez.sh {
|
||||||
|
reverse_proxy 100.84.65.101:4533
|
||||||
|
}
|
||||||
|
|
||||||
|
## LONDON-C SERVICES ##
|
||||||
|
|
||||||
|
## COPENHAGEN-A SERVICES ##
|
||||||
|
|
||||||
|
## COPENHAGEN-B SERVICES ##
|
||||||
|
|
||||||
|
## COPENHAGEN-C SERVICES ##
|
||||||
|
|
||||||
|
## NUREMBERG-A SERVICES ##
|
||||||
|
|
||||||
|
## HELSINKI-A SERVICES ##
|
||||||
|
|
||||||
|
# Bitwarden (requires HTTPS tweaking)
|
||||||
|
https://bitwarden.pez.sh {
|
||||||
|
reverse_proxy localhost:8443 {
|
||||||
|
transport http {
|
||||||
|
tls_insecure_skip_verify
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# Authelia (requires HTTPS tweaking)
|
||||||
|
auth.pez.solutions, auth.pez.sh {
|
||||||
|
reverse_proxy localhost:9091
|
||||||
|
}
|
||||||
|
|
||||||
|
ldap.pez.sh {
|
||||||
|
reverse_proxy 127.0.0.1:17170
|
||||||
|
}
|
||||||
|
#https://auth.pez.sh {
|
||||||
|
# reverse_proxy 127.0.0.1:9091 {
|
||||||
|
# transport http {
|
||||||
|
# tls_insecure_skip_verify
|
||||||
|
# }
|
||||||
|
# }
|
||||||
|
#}
|
||||||
|
|
||||||
|
# Apps dashboard
|
||||||
|
apps.pez.solutions, apps.pez.sh {
|
||||||
|
root * /srv/apps
|
||||||
|
forward_auth localhost:9091 {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
|
||||||
|
# Pez.solutions
|
||||||
|
pez.solutions {
|
||||||
|
root * /srv/pez.solutions
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
|
||||||
|
# Pez.solutions
|
||||||
|
cloud.pez.solutions {
|
||||||
|
root * /srv/cloud.pez.solutions
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
|
||||||
|
# Pez.sh
|
||||||
|
pez.sh {
|
||||||
|
root * /srv/pez.sh
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
|
||||||
|
# Pez-signup
|
||||||
|
signup.pez.solutions {
|
||||||
|
root * /srv/pez-signup
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
|
||||||
|
# Naveen
|
||||||
|
naveen.pez.sh {
|
||||||
|
root * /srv/naveen
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
|
||||||
|
## HELSINKI-A SERVICES ##
|
||||||
|
|
||||||
|
# Status page
|
||||||
|
status.pez.sh {
|
||||||
|
root * /srv/status
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
|
||||||
|
# Miniflux RSS
|
||||||
|
rss.pez.sh {
|
||||||
|
forward_auth localhost:9091 {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
reverse_proxy 100.84.65.101:8181
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# Forgejo Git Server (auth handled by Forgejo itself)
|
||||||
|
git.pez.sh {
|
||||||
|
reverse_proxy localhost:3000
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# This Website Does Not Exist
|
||||||
|
thiswebsitedoesnotexist.pez.sh {
|
||||||
|
reverse_proxy localhost:3721
|
||||||
|
}
|
||||||
198
ansible/services/caddy/Caddyfile.template
Normal file
198
ansible/services/caddy/Caddyfile.template
Normal file
|
|
@ -0,0 +1,198 @@
|
||||||
|
# Caddyfile template for helsinki-a reverse proxy
|
||||||
|
#
|
||||||
|
# Variables (replace before deploying):
|
||||||
|
# {{HELSINKI_A_IP}} - helsinki-a Tailscale IP (currently 100.67.6.27)
|
||||||
|
# {{LONDON_A_IP}} - london-a Tailscale IP (currently 100.122.219.41)
|
||||||
|
# {{LONDON_B_IP}} - london-b Tailscale IP (currently 100.84.65.101)
|
||||||
|
# {{AUTHELIA_PORT}} - Authelia port (currently 9091)
|
||||||
|
# {{DOMAIN_PRIMARY}} - Primary domain (currently pez.sh)
|
||||||
|
# {{DOMAIN_ALT}} - Alternate domain (currently pez.solutions)
|
||||||
|
#
|
||||||
|
# Authelia forward_auth pattern: see README.md for details.
|
||||||
|
|
||||||
|
{
|
||||||
|
admin {{HELSINKI_A_IP}}:2019
|
||||||
|
metrics {
|
||||||
|
per_host
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
# Snippet: Authelia forward_auth
|
||||||
|
# Include with `import authelia` inside any site block.
|
||||||
|
# ============================================================
|
||||||
|
(authelia) {
|
||||||
|
forward_auth localhost:{{AUTHELIA_PORT}} {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
## LONDON-A SERVICES ##
|
||||||
|
|
||||||
|
# Grafana
|
||||||
|
grafana.{{DOMAIN_ALT}}, grafana.{{DOMAIN_PRIMARY}} {
|
||||||
|
import authelia
|
||||||
|
reverse_proxy {{LONDON_A_IP}}:3000
|
||||||
|
}
|
||||||
|
|
||||||
|
# Prometheus
|
||||||
|
prometheus.{{DOMAIN_ALT}}, prometheus.{{DOMAIN_PRIMARY}} {
|
||||||
|
import authelia
|
||||||
|
reverse_proxy {{LONDON_A_IP}}:9090
|
||||||
|
}
|
||||||
|
|
||||||
|
# Alertmanager
|
||||||
|
alertmanager.{{DOMAIN_ALT}}, alertmanager.{{DOMAIN_PRIMARY}} {
|
||||||
|
import authelia
|
||||||
|
reverse_proxy {{LONDON_A_IP}}:3000
|
||||||
|
}
|
||||||
|
|
||||||
|
## LONDON-B SERVICES ##
|
||||||
|
|
||||||
|
# Jellyfin (no auth — has its own login)
|
||||||
|
jellyfin.{{DOMAIN_ALT}}, jellyfin.{{DOMAIN_PRIMARY}} {
|
||||||
|
reverse_proxy {{LONDON_B_IP}}:8096
|
||||||
|
}
|
||||||
|
|
||||||
|
# Plex (no auth — has its own login)
|
||||||
|
plex.{{DOMAIN_ALT}}, plex.{{DOMAIN_PRIMARY}} {
|
||||||
|
reverse_proxy {{LONDON_B_IP}}:32400
|
||||||
|
}
|
||||||
|
|
||||||
|
# Radarr
|
||||||
|
radarr.{{DOMAIN_ALT}}, radarr.{{DOMAIN_PRIMARY}} {
|
||||||
|
import authelia
|
||||||
|
reverse_proxy {{LONDON_B_IP}}:7878
|
||||||
|
}
|
||||||
|
|
||||||
|
# Sonarr
|
||||||
|
sonarr.{{DOMAIN_ALT}}, sonarr.{{DOMAIN_PRIMARY}} {
|
||||||
|
import authelia
|
||||||
|
reverse_proxy {{LONDON_B_IP}}:8989
|
||||||
|
}
|
||||||
|
|
||||||
|
# Lidarr
|
||||||
|
lidarr.{{DOMAIN_ALT}}, lidarr.{{DOMAIN_PRIMARY}} {
|
||||||
|
import authelia
|
||||||
|
reverse_proxy {{LONDON_B_IP}}:8686
|
||||||
|
}
|
||||||
|
|
||||||
|
# Readarr
|
||||||
|
readarr.{{DOMAIN_ALT}}, readarr.{{DOMAIN_PRIMARY}} {
|
||||||
|
import authelia
|
||||||
|
reverse_proxy {{LONDON_B_IP}}:8787
|
||||||
|
}
|
||||||
|
|
||||||
|
# slskd (Soulseek)
|
||||||
|
soulseek.{{DOMAIN_ALT}}, soulseek.{{DOMAIN_PRIMARY}} {
|
||||||
|
import authelia
|
||||||
|
reverse_proxy {{LONDON_B_IP}}:5030
|
||||||
|
}
|
||||||
|
|
||||||
|
# Prowlarr
|
||||||
|
prowlarr.{{DOMAIN_ALT}}, prowlarr.{{DOMAIN_PRIMARY}} {
|
||||||
|
import authelia
|
||||||
|
reverse_proxy {{LONDON_B_IP}}:9696
|
||||||
|
}
|
||||||
|
|
||||||
|
# Transmission
|
||||||
|
download.{{DOMAIN_ALT}}, download.{{DOMAIN_PRIMARY}} {
|
||||||
|
import authelia
|
||||||
|
reverse_proxy {{LONDON_B_IP}}:9091
|
||||||
|
}
|
||||||
|
|
||||||
|
# Overseerr (no auth — has its own login)
|
||||||
|
request.{{DOMAIN_ALT}}, request.{{DOMAIN_PRIMARY}} {
|
||||||
|
reverse_proxy {{LONDON_B_IP}}:5055
|
||||||
|
}
|
||||||
|
|
||||||
|
# Jellyseerr (no auth — has its own login)
|
||||||
|
jellyfin-requests.{{DOMAIN_ALT}}, jellyfin-requests.{{DOMAIN_PRIMARY}} {
|
||||||
|
reverse_proxy {{LONDON_B_IP}}:5056
|
||||||
|
}
|
||||||
|
|
||||||
|
# Nextcloud AIO
|
||||||
|
https://cloud.{{DOMAIN_PRIMARY}}:443 {
|
||||||
|
reverse_proxy {{LONDON_B_IP}}:11000
|
||||||
|
}
|
||||||
|
|
||||||
|
# Navidrome
|
||||||
|
music.{{DOMAIN_PRIMARY}} {
|
||||||
|
reverse_proxy {{LONDON_B_IP}}:4533
|
||||||
|
}
|
||||||
|
|
||||||
|
# Miniflux RSS
|
||||||
|
rss.{{DOMAIN_PRIMARY}} {
|
||||||
|
import authelia
|
||||||
|
reverse_proxy {{LONDON_B_IP}}:8181
|
||||||
|
}
|
||||||
|
|
||||||
|
## HELSINKI-A SERVICES (localhost) ##
|
||||||
|
|
||||||
|
# Bitwarden
|
||||||
|
https://bitwarden.{{DOMAIN_PRIMARY}} {
|
||||||
|
reverse_proxy localhost:8443 {
|
||||||
|
transport http {
|
||||||
|
tls_insecure_skip_verify
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# Authelia portal
|
||||||
|
auth.{{DOMAIN_ALT}}, auth.{{DOMAIN_PRIMARY}} {
|
||||||
|
reverse_proxy localhost:{{AUTHELIA_PORT}}
|
||||||
|
}
|
||||||
|
|
||||||
|
# LLDAP web UI
|
||||||
|
ldap.{{DOMAIN_PRIMARY}} {
|
||||||
|
reverse_proxy 127.0.0.1:17170
|
||||||
|
}
|
||||||
|
|
||||||
|
# Apps dashboard
|
||||||
|
apps.{{DOMAIN_ALT}}, apps.{{DOMAIN_PRIMARY}} {
|
||||||
|
root * /srv/apps
|
||||||
|
import authelia
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
|
||||||
|
# Static sites
|
||||||
|
{{DOMAIN_ALT}} {
|
||||||
|
root * /srv/pez.solutions
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
|
||||||
|
cloud.{{DOMAIN_ALT}} {
|
||||||
|
root * /srv/cloud.pez.solutions
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
|
||||||
|
{{DOMAIN_PRIMARY}} {
|
||||||
|
root * /srv/pez.sh
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
|
||||||
|
signup.{{DOMAIN_ALT}} {
|
||||||
|
root * /srv/pez-signup
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
|
||||||
|
naveen.{{DOMAIN_PRIMARY}} {
|
||||||
|
root * /srv/naveen
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
|
||||||
|
status.{{DOMAIN_PRIMARY}} {
|
||||||
|
root * /srv/status
|
||||||
|
file_server
|
||||||
|
}
|
||||||
|
|
||||||
|
# Forgejo (auth handled by Forgejo itself)
|
||||||
|
git.{{DOMAIN_PRIMARY}} {
|
||||||
|
reverse_proxy localhost:3000
|
||||||
|
}
|
||||||
|
|
||||||
|
# This Website Does Not Exist
|
||||||
|
thiswebsitedoesnotexist.{{DOMAIN_PRIMARY}} {
|
||||||
|
reverse_proxy localhost:3721
|
||||||
|
}
|
||||||
129
ansible/services/caddy/README.md
Normal file
129
ansible/services/caddy/README.md
Normal file
|
|
@ -0,0 +1,129 @@
|
||||||
|
# Caddy
|
||||||
|
|
||||||
|
Reverse proxy and TLS termination for all homelab services.
|
||||||
|
Runs on **helsinki-a** (`100.67.6.27`) as a system service (not Docker).
|
||||||
|
|
||||||
|
Replaces the standalone `pez-proxy` repo.
|
||||||
|
|
||||||
|
## Structure
|
||||||
|
|
||||||
|
```
|
||||||
|
services/caddy/
|
||||||
|
├── Caddyfile # Live config captured from helsinki-a
|
||||||
|
├── Caddyfile.template # Templatized version with variable placeholders
|
||||||
|
└── README.md
|
||||||
|
```
|
||||||
|
|
||||||
|
## How It Works
|
||||||
|
|
||||||
|
Helsinki-a sits behind Cloudflare DNS and acts as the single entry point for all
|
||||||
|
`*.pez.sh` and `*.pez.solutions` traffic. Caddy handles automatic TLS via
|
||||||
|
Let's Encrypt/ZeroSSL, then reverse-proxies to backend services over the
|
||||||
|
Tailscale mesh.
|
||||||
|
|
||||||
|
### Traffic Flow
|
||||||
|
|
||||||
|
```
|
||||||
|
Internet → Cloudflare → helsinki-a (Caddy) → Tailscale → backend host:port
|
||||||
|
```
|
||||||
|
|
||||||
|
### Admin API
|
||||||
|
|
||||||
|
Caddy's admin API listens on `100.67.6.27:2019` (Tailscale-only, not
|
||||||
|
publicly exposed). Useful for config reloads without downtime:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
caddy reload --config /etc/caddy/Caddyfile
|
||||||
|
# or via API:
|
||||||
|
curl http://100.67.6.27:2019/config/
|
||||||
|
```
|
||||||
|
|
||||||
|
### Metrics
|
||||||
|
|
||||||
|
Caddy exposes Prometheus metrics with `per_host` granularity. Scraped by
|
||||||
|
Prometheus on london-a.
|
||||||
|
|
||||||
|
## Authelia Forward Auth Pattern
|
||||||
|
|
||||||
|
Most admin-facing services are protected by [Authelia](https://www.authelia.com/)
|
||||||
|
SSO. Authelia runs on helsinki-a itself (`localhost:9091`) alongside an LLDAP
|
||||||
|
directory and MariaDB backend (see `services/authelia/`).
|
||||||
|
|
||||||
|
### How forward_auth Works
|
||||||
|
|
||||||
|
Caddy's `forward_auth` directive intercepts every request before it reaches
|
||||||
|
the upstream. It sends a subrequest to Authelia's verification endpoint:
|
||||||
|
|
||||||
|
```
|
||||||
|
forward_auth localhost:9091 {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Flow:**
|
||||||
|
|
||||||
|
1. Client requests `https://grafana.pez.sh/some/page`
|
||||||
|
2. Caddy sends a verification subrequest to `localhost:9091/api/authz/forward-auth`
|
||||||
|
3. Authelia checks the session cookie:
|
||||||
|
- **Valid session** → returns 200; Caddy copies identity headers (`Remote-User`,
|
||||||
|
`Remote-Groups`, `Remote-Name`, `Remote-Email`) and forwards to the upstream
|
||||||
|
- **No/expired session** → returns 401 with redirect; Caddy sends user to
|
||||||
|
`auth.pez.sh` to log in via Authelia's portal
|
||||||
|
4. After login, Authelia sets a session cookie and redirects back to the
|
||||||
|
original URL
|
||||||
|
|
||||||
|
### Which Services Use Authelia
|
||||||
|
|
||||||
|
| Service | Auth | Reason |
|
||||||
|
|---------|------|--------|
|
||||||
|
| Grafana, Prometheus, Alertmanager | Authelia | Admin dashboards |
|
||||||
|
| Radarr, Sonarr, Lidarr, Readarr | Authelia | Media management |
|
||||||
|
| Prowlarr, Transmission (download) | Authelia | Download tools |
|
||||||
|
| slskd (Soulseek) | Authelia | P2P client |
|
||||||
|
| Miniflux (RSS) | Authelia | RSS reader |
|
||||||
|
| Apps dashboard | Authelia | Internal apps page |
|
||||||
|
| Jellyfin, Plex | Own auth | Have built-in user management |
|
||||||
|
| Overseerr, Jellyseerr | Own auth | Have built-in user management |
|
||||||
|
| Nextcloud | Own auth | Has built-in user management |
|
||||||
|
| Navidrome (music) | No auth* | Accessible directly |
|
||||||
|
| Bitwarden | Own auth | Has built-in vault auth |
|
||||||
|
| Forgejo (git) | Own auth | Has built-in user management |
|
||||||
|
| Authelia portal | N/A | Is the auth system itself |
|
||||||
|
| LLDAP web UI | N/A | Admin directory management |
|
||||||
|
|
||||||
|
### Template Snippet
|
||||||
|
|
||||||
|
The template file uses a Caddy snippet to DRY up the auth block:
|
||||||
|
|
||||||
|
```
|
||||||
|
(authelia) {
|
||||||
|
forward_auth localhost:{{AUTHELIA_PORT}} {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
Usage in a site block: `import authelia`
|
||||||
|
|
||||||
|
## Template Variables
|
||||||
|
|
||||||
|
The `Caddyfile.template` replaces hardcoded values with placeholders:
|
||||||
|
|
||||||
|
| Variable | Current Value | Description |
|
||||||
|
|----------|--------------|-------------|
|
||||||
|
| `{{HELSINKI_A_IP}}` | `100.67.6.27` | helsinki-a Tailscale IP |
|
||||||
|
| `{{LONDON_A_IP}}` | `100.122.219.41` | london-a Tailscale IP |
|
||||||
|
| `{{LONDON_B_IP}}` | `100.84.65.101` | london-b Tailscale IP |
|
||||||
|
| `{{AUTHELIA_PORT}}` | `9091` | Authelia verification port |
|
||||||
|
| `{{DOMAIN_PRIMARY}}` | `pez.sh` | Primary domain |
|
||||||
|
| `{{DOMAIN_ALT}}` | `pez.solutions` | Alternate domain |
|
||||||
|
|
||||||
|
## Notes
|
||||||
|
|
||||||
|
- The live Caddyfile on helsinki-a is at `/etc/caddy/Caddyfile`
|
||||||
|
- Caddy auto-provisions TLS certificates for all listed domains
|
||||||
|
- The Alertmanager proxy currently points to port 3000 (same as Grafana) — this may be intentional (Grafana's built-in alerting UI) or a copy-paste issue worth checking
|
||||||
|
- Commented-out WebDAV block was replaced by the Nextcloud AIO reverse proxy
|
||||||
|
- Static sites (`pez.sh`, `pez.solutions`, etc.) are served from `/srv/` on helsinki-a
|
||||||
9
ansible/services/forgejo/README.md
Normal file
9
ansible/services/forgejo/README.md
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
# Forgejo
|
||||||
|
|
||||||
|
Self-hosted Git forge (Gitea fork).
|
||||||
|
|
||||||
|
- **Host:** helsinki-a
|
||||||
|
- **URL:** https://git.pez.sh
|
||||||
|
- **SSH:** git.pez.sh:2222
|
||||||
|
- **Data:** `/srv/forgejo/data`
|
||||||
|
- **Registration:** Disabled (private instance)
|
||||||
26
ansible/services/forgejo/docker-compose.yml
Normal file
26
ansible/services/forgejo/docker-compose.yml
Normal file
|
|
@ -0,0 +1,26 @@
|
||||||
|
# Forgejo - Self-hosted Git forge
|
||||||
|
# Host: helsinki-a (100.67.6.27)
|
||||||
|
# Data: /srv/forgejo/data
|
||||||
|
# Access: https://git.pez.sh (via Caddy reverse proxy)
|
||||||
|
# SSH: git.pez.sh:2222
|
||||||
|
|
||||||
|
services:
|
||||||
|
forgejo:
|
||||||
|
image: codeberg.org/forgejo/forgejo:10
|
||||||
|
container_name: forgejo
|
||||||
|
restart: unless-stopped
|
||||||
|
environment:
|
||||||
|
- USER_UID=1000
|
||||||
|
- USER_GID=1000
|
||||||
|
- FORGEJO__server__ROOT_URL=https://git.pez.sh
|
||||||
|
- FORGEJO__server__SSH_DOMAIN=git.pez.sh
|
||||||
|
- FORGEJO__server__SSH_PORT=22
|
||||||
|
- FORGEJO__server__HTTP_PORT=3000
|
||||||
|
- FORGEJO__server__DISABLE_SSH=false
|
||||||
|
- FORGEJO__service__DISABLE_REGISTRATION=true
|
||||||
|
- FORGEJO__service__REQUIRE_SIGNIN_VIEW=false
|
||||||
|
ports:
|
||||||
|
- '127.0.0.1:3000:3000'
|
||||||
|
- '0.0.0.0:2222:22'
|
||||||
|
volumes:
|
||||||
|
- /srv/forgejo/data:/data
|
||||||
62
ansible/services/grafana/README.md
Normal file
62
ansible/services/grafana/README.md
Normal file
|
|
@ -0,0 +1,62 @@
|
||||||
|
# Grafana
|
||||||
|
|
||||||
|
Grafana dashboards, alerting rules, and provisioning config for the homelab/cloud stack.
|
||||||
|
Runs on **london-a** (FreeBSD, `100.122.219.41`) as a native service (not Docker).
|
||||||
|
|
||||||
|
Migrated from the standalone `pez-grafana` repo.
|
||||||
|
|
||||||
|
## Structure
|
||||||
|
|
||||||
|
```
|
||||||
|
services/grafana/
|
||||||
|
├── dashboards/ # Dashboard JSON files
|
||||||
|
│ ├── infrastructure.json # Infrastructure overview (linux hosts)
|
||||||
|
│ ├── living-room-display.json # Kiosk/TV dashboard
|
||||||
|
│ ├── node-exporter-full.json # Full node exporter metrics
|
||||||
|
│ └── traffic-slo.json # Traffic / SLO tracking
|
||||||
|
└── provisioning/ # Grafana provisioning files
|
||||||
|
├── alerting/
|
||||||
|
│ ├── contact-points.yml # Alert receivers (PagerDuty, email)
|
||||||
|
│ ├── notification-policy.yml # Routing: critical → PagerDuty, warning → email
|
||||||
|
│ ├── rules-critical.yml # Tier 1: pages PagerDuty immediately
|
||||||
|
│ └── rules-warning.yml # Tier 2: email only
|
||||||
|
├── dashboards/
|
||||||
|
│ └── dashboards.yml # Dashboard file provider config
|
||||||
|
└── datasources/
|
||||||
|
└── datasources.json # Prometheus datasource (localhost:9090)
|
||||||
|
```
|
||||||
|
|
||||||
|
## Alert Tiers
|
||||||
|
|
||||||
|
| Tier | Routing | Examples |
|
||||||
|
|----------|------------|--------------------------------------------|
|
||||||
|
| Critical | PagerDuty | Host down, disk >95%, memory >95% |
|
||||||
|
| Warning | Email | Disk >80%, memory >85%, high load/CPU |
|
||||||
|
|
||||||
|
## Deployment
|
||||||
|
|
||||||
|
Deployed via the monorepo's `ansible/deploy.yml` (Stage 4e: Monitoring stack).
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd ansible
|
||||||
|
ansible-playbook deploy.yml --limit london-a --tags monitoring
|
||||||
|
```
|
||||||
|
|
||||||
|
Provisioning files are synced to `/usr/local/etc/grafana/provisioning/` and dashboards
|
||||||
|
to `/usr/local/etc/grafana/dashboards/` on london-a. Grafana is restarted after changes.
|
||||||
|
|
||||||
|
### Notes
|
||||||
|
|
||||||
|
- The old `pez-grafana` repo deployed provisioning to `/usr/local/share/grafana/conf/provisioning/`.
|
||||||
|
The monorepo uses `/usr/local/etc/grafana/` — verify the correct path on london-a before first deploy.
|
||||||
|
- PagerDuty integration key is referenced via `${PAGERDUTY_INTEGRATION_KEY}` env var (not stored in repo).
|
||||||
|
- Grafana password is not committed; pass via `--extra-vars` or env.
|
||||||
|
|
||||||
|
## Importing Dashboards Manually
|
||||||
|
|
||||||
|
```bash
|
||||||
|
curl -X POST -H "Content-Type: application/json" \
|
||||||
|
-u admin:password \
|
||||||
|
-d "{\"dashboard\": $(cat dashboards/infrastructure.json), \"overwrite\": true}" \
|
||||||
|
http://localhost:3000/api/dashboards/db
|
||||||
|
```
|
||||||
1034
ansible/services/grafana/dashboards/infrastructure.json
Normal file
1034
ansible/services/grafana/dashboards/infrastructure.json
Normal file
File diff suppressed because it is too large
Load diff
1011
ansible/services/grafana/dashboards/living-room-display.json
Normal file
1011
ansible/services/grafana/dashboards/living-room-display.json
Normal file
File diff suppressed because it is too large
Load diff
15726
ansible/services/grafana/dashboards/node-exporter-full.json
Normal file
15726
ansible/services/grafana/dashboards/node-exporter-full.json
Normal file
File diff suppressed because it is too large
Load diff
587
ansible/services/grafana/dashboards/traffic-slo.json
Normal file
587
ansible/services/grafana/dashboards/traffic-slo.json
Normal file
|
|
@ -0,0 +1,587 @@
|
||||||
|
{
|
||||||
|
"annotations": {
|
||||||
|
"list": [
|
||||||
|
{
|
||||||
|
"builtIn": 1,
|
||||||
|
"datasource": {
|
||||||
|
"type": "grafana",
|
||||||
|
"uid": "-- Grafana --"
|
||||||
|
},
|
||||||
|
"enable": true,
|
||||||
|
"hide": true,
|
||||||
|
"iconColor": "rgba(0, 211, 255, 1)",
|
||||||
|
"name": "Annotations & Alerts",
|
||||||
|
"type": "dashboard"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"editable": true,
|
||||||
|
"fiscalYearStartMonth": 0,
|
||||||
|
"graphTooltip": 0,
|
||||||
|
"links": [],
|
||||||
|
"panels": [
|
||||||
|
{
|
||||||
|
"datasource": {
|
||||||
|
"type": "prometheus",
|
||||||
|
"uid": "bezqqznn81wqof"
|
||||||
|
},
|
||||||
|
"fieldConfig": {
|
||||||
|
"defaults": {
|
||||||
|
"color": {
|
||||||
|
"mode": "thresholds"
|
||||||
|
},
|
||||||
|
"decimals": 3,
|
||||||
|
"mappings": [],
|
||||||
|
"thresholds": {
|
||||||
|
"mode": "absolute",
|
||||||
|
"steps": [
|
||||||
|
{
|
||||||
|
"color": "red",
|
||||||
|
"value": 0
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"color": "yellow",
|
||||||
|
"value": 99.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"color": "green",
|
||||||
|
"value": 99.99
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"unit": "percent"
|
||||||
|
},
|
||||||
|
"overrides": []
|
||||||
|
},
|
||||||
|
"gridPos": {
|
||||||
|
"h": 10,
|
||||||
|
"w": 4,
|
||||||
|
"x": 0,
|
||||||
|
"y": 0
|
||||||
|
},
|
||||||
|
"id": 3,
|
||||||
|
"options": {
|
||||||
|
"colorMode": "value",
|
||||||
|
"graphMode": "none",
|
||||||
|
"justifyMode": "auto",
|
||||||
|
"orientation": "auto",
|
||||||
|
"percentChangeColorMode": "standard",
|
||||||
|
"reduceOptions": {
|
||||||
|
"calcs": [
|
||||||
|
"lastNotNull"
|
||||||
|
],
|
||||||
|
"fields": "",
|
||||||
|
"values": false
|
||||||
|
},
|
||||||
|
"showPercentChange": false,
|
||||||
|
"textMode": "auto",
|
||||||
|
"wideLayout": true
|
||||||
|
},
|
||||||
|
"pluginVersion": "12.1.0",
|
||||||
|
"targets": [
|
||||||
|
{
|
||||||
|
"disableTextWrap": false,
|
||||||
|
"editorMode": "code",
|
||||||
|
"expr": "clamp_max(\n (sum(caddy_http_response_size_bytes_count{host=~\".*(pez.solutions|pez.sh)\", code!~\"5.*\"}) / (sum(caddy_http_response_size_bytes_count{host=~\".*(pez.solutions|pez.sh)\"}))) * 100,\n 99.999\n)",
|
||||||
|
"fullMetaSearch": false,
|
||||||
|
"hide": false,
|
||||||
|
"includeNullMetadata": true,
|
||||||
|
"legendFormat": "__auto",
|
||||||
|
"range": true,
|
||||||
|
"refId": "A",
|
||||||
|
"useBackend": false
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"title": "SLI",
|
||||||
|
"type": "stat"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"datasource": {
|
||||||
|
"type": "prometheus",
|
||||||
|
"uid": "bezqqznn81wqof"
|
||||||
|
},
|
||||||
|
"fieldConfig": {
|
||||||
|
"defaults": {
|
||||||
|
"color": {
|
||||||
|
"mode": "thresholds"
|
||||||
|
},
|
||||||
|
"decimals": 3,
|
||||||
|
"mappings": [],
|
||||||
|
"thresholds": {
|
||||||
|
"mode": "absolute",
|
||||||
|
"steps": [
|
||||||
|
{
|
||||||
|
"color": "red",
|
||||||
|
"value": 0
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"color": "yellow",
|
||||||
|
"value": 99.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"color": "green",
|
||||||
|
"value": 99.99
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"unit": "percent"
|
||||||
|
},
|
||||||
|
"overrides": []
|
||||||
|
},
|
||||||
|
"gridPos": {
|
||||||
|
"h": 10,
|
||||||
|
"w": 20,
|
||||||
|
"x": 4,
|
||||||
|
"y": 0
|
||||||
|
},
|
||||||
|
"id": 4,
|
||||||
|
"options": {
|
||||||
|
"colorMode": "value",
|
||||||
|
"graphMode": "none",
|
||||||
|
"justifyMode": "center",
|
||||||
|
"orientation": "auto",
|
||||||
|
"percentChangeColorMode": "standard",
|
||||||
|
"reduceOptions": {
|
||||||
|
"calcs": [
|
||||||
|
"lastNotNull"
|
||||||
|
],
|
||||||
|
"fields": "",
|
||||||
|
"values": false
|
||||||
|
},
|
||||||
|
"showPercentChange": false,
|
||||||
|
"textMode": "auto",
|
||||||
|
"wideLayout": true
|
||||||
|
},
|
||||||
|
"pluginVersion": "12.1.0",
|
||||||
|
"targets": [
|
||||||
|
{
|
||||||
|
"disableTextWrap": false,
|
||||||
|
"editorMode": "code",
|
||||||
|
"expr": "clamp_max(\n (\n sum(\n label_replace(\n caddy_http_response_size_bytes_count{host=~\".*(pez.solutions|pez.sh)\", host!~\"(pez.sh|pez.solutions)\", code!~\"5.*\"},\n \"host_prefix\",\n \"$1\",\n \"host\",\n \"([^.]+)\\\\..*\"\n )\n ) by (host_prefix)\n /\n sum(\n label_replace(\n caddy_http_response_size_bytes_count{host=~\".*(pez.solutions|pez.sh)\", host!~\"(pez.sh|pez.solutions)\"},\n \"host_prefix\",\n \"$1\",\n \"host\",\n \"([^.]+)\\\\..*\"\n )\n ) by (host_prefix)\n ) * 100,\n 99.999\n)",
|
||||||
|
"fullMetaSearch": false,
|
||||||
|
"hide": false,
|
||||||
|
"includeNullMetadata": true,
|
||||||
|
"legendFormat": "__auto",
|
||||||
|
"range": true,
|
||||||
|
"refId": "A",
|
||||||
|
"useBackend": false
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"title": "SLI by Host",
|
||||||
|
"type": "stat"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"datasource": {
|
||||||
|
"type": "prometheus",
|
||||||
|
"uid": "bezqqznn81wqof"
|
||||||
|
},
|
||||||
|
"fieldConfig": {
|
||||||
|
"defaults": {
|
||||||
|
"color": {
|
||||||
|
"mode": "palette-classic"
|
||||||
|
},
|
||||||
|
"custom": {
|
||||||
|
"axisBorderShow": false,
|
||||||
|
"axisCenteredZero": false,
|
||||||
|
"axisColorMode": "text",
|
||||||
|
"axisLabel": "",
|
||||||
|
"axisPlacement": "auto",
|
||||||
|
"barAlignment": 0,
|
||||||
|
"barWidthFactor": 0.6,
|
||||||
|
"drawStyle": "line",
|
||||||
|
"fillOpacity": 0,
|
||||||
|
"gradientMode": "none",
|
||||||
|
"hideFrom": {
|
||||||
|
"legend": false,
|
||||||
|
"tooltip": false,
|
||||||
|
"viz": false
|
||||||
|
},
|
||||||
|
"insertNulls": false,
|
||||||
|
"lineInterpolation": "linear",
|
||||||
|
"lineWidth": 1,
|
||||||
|
"pointSize": 5,
|
||||||
|
"scaleDistribution": {
|
||||||
|
"type": "linear"
|
||||||
|
},
|
||||||
|
"showPoints": "auto",
|
||||||
|
"spanNulls": false,
|
||||||
|
"stacking": {
|
||||||
|
"group": "A",
|
||||||
|
"mode": "none"
|
||||||
|
},
|
||||||
|
"thresholdsStyle": {
|
||||||
|
"mode": "off"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"mappings": [],
|
||||||
|
"thresholds": {
|
||||||
|
"mode": "absolute",
|
||||||
|
"steps": [
|
||||||
|
{
|
||||||
|
"color": "green",
|
||||||
|
"value": 0
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"color": "red",
|
||||||
|
"value": 80
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"unit": "reqps"
|
||||||
|
},
|
||||||
|
"overrides": []
|
||||||
|
},
|
||||||
|
"gridPos": {
|
||||||
|
"h": 11,
|
||||||
|
"w": 19,
|
||||||
|
"x": 0,
|
||||||
|
"y": 10
|
||||||
|
},
|
||||||
|
"id": 1,
|
||||||
|
"options": {
|
||||||
|
"legend": {
|
||||||
|
"calcs": [],
|
||||||
|
"displayMode": "list",
|
||||||
|
"placement": "bottom",
|
||||||
|
"showLegend": true
|
||||||
|
},
|
||||||
|
"tooltip": {
|
||||||
|
"hideZeros": false,
|
||||||
|
"mode": "single",
|
||||||
|
"sort": "none"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"pluginVersion": "12.1.0",
|
||||||
|
"targets": [
|
||||||
|
{
|
||||||
|
"datasource": {
|
||||||
|
"type": "prometheus",
|
||||||
|
"uid": "bezqqznn81wqof"
|
||||||
|
},
|
||||||
|
"disableTextWrap": false,
|
||||||
|
"editorMode": "code",
|
||||||
|
"expr": "sum(\n label_replace(\n rate(caddy_http_requests_total{handler!=\"metrics\", host=~\".*(pez.solutions|pez.sh)\"}[$__rate_interval]),\n \"host_prefix\",\n \"$1\",\n \"host\",\n \"([^.]+)\\\\..*\"\n )\n) by (host_prefix)",
|
||||||
|
"fullMetaSearch": false,
|
||||||
|
"includeNullMetadata": false,
|
||||||
|
"legendFormat": "{{host}}",
|
||||||
|
"range": true,
|
||||||
|
"refId": "A",
|
||||||
|
"useBackend": false
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"title": "Traffic Rate by Service",
|
||||||
|
"type": "timeseries"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"datasource": {
|
||||||
|
"type": "prometheus",
|
||||||
|
"uid": "bezqqznn81wqof"
|
||||||
|
},
|
||||||
|
"fieldConfig": {
|
||||||
|
"defaults": {
|
||||||
|
"color": {
|
||||||
|
"mode": "thresholds"
|
||||||
|
},
|
||||||
|
"custom": {
|
||||||
|
"align": "auto",
|
||||||
|
"cellOptions": {
|
||||||
|
"type": "auto"
|
||||||
|
},
|
||||||
|
"inspect": false
|
||||||
|
},
|
||||||
|
"mappings": [],
|
||||||
|
"thresholds": {
|
||||||
|
"mode": "absolute",
|
||||||
|
"steps": [
|
||||||
|
{
|
||||||
|
"color": "green",
|
||||||
|
"value": 0
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"color": "red",
|
||||||
|
"value": 80
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"overrides": []
|
||||||
|
},
|
||||||
|
"gridPos": {
|
||||||
|
"h": 11,
|
||||||
|
"w": 5,
|
||||||
|
"x": 19,
|
||||||
|
"y": 10
|
||||||
|
},
|
||||||
|
"id": 6,
|
||||||
|
"options": {
|
||||||
|
"cellHeight": "sm",
|
||||||
|
"footer": {
|
||||||
|
"countRows": false,
|
||||||
|
"fields": "",
|
||||||
|
"reducer": [
|
||||||
|
"sum"
|
||||||
|
],
|
||||||
|
"show": false
|
||||||
|
},
|
||||||
|
"showHeader": true,
|
||||||
|
"sortBy": [
|
||||||
|
{
|
||||||
|
"desc": true,
|
||||||
|
"displayName": "req/s"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"pluginVersion": "12.1.0",
|
||||||
|
"targets": [
|
||||||
|
{
|
||||||
|
"editorMode": "code",
|
||||||
|
"exemplar": false,
|
||||||
|
"expr": "sum(\n label_replace(\n rate(caddy_http_requests_total{handler!=\"metrics\", host=~\".*(pez.solutions|pez.sh)\", host!~\"(pez.sh|pez.solutions)\"}[$__rate_interval]),\n \"host_prefix\",\n \"$1\",\n \"host\",\n \"([^.]+)\\\\..*\"\n )\n) by (host_prefix) > 0",
|
||||||
|
"format": "table",
|
||||||
|
"instant": true,
|
||||||
|
"legendFormat": "__auto",
|
||||||
|
"range": false,
|
||||||
|
"refId": "A"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"title": "Active Services",
|
||||||
|
"transformations": [
|
||||||
|
{
|
||||||
|
"id": "organize",
|
||||||
|
"options": {
|
||||||
|
"excludeByName": {
|
||||||
|
"Time": true
|
||||||
|
},
|
||||||
|
"includeByName": {},
|
||||||
|
"indexByName": {},
|
||||||
|
"renameByName": {
|
||||||
|
"Value": "req/s",
|
||||||
|
"host_prefix": "Service"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"type": "table"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"datasource": {
|
||||||
|
"type": "prometheus",
|
||||||
|
"uid": "bezqqznn81wqof"
|
||||||
|
},
|
||||||
|
"fieldConfig": {
|
||||||
|
"defaults": {
|
||||||
|
"color": {
|
||||||
|
"mode": "palette-classic"
|
||||||
|
},
|
||||||
|
"custom": {
|
||||||
|
"axisBorderShow": false,
|
||||||
|
"axisCenteredZero": false,
|
||||||
|
"axisColorMode": "text",
|
||||||
|
"axisLabel": "",
|
||||||
|
"axisPlacement": "auto",
|
||||||
|
"barAlignment": 0,
|
||||||
|
"barWidthFactor": 0.6,
|
||||||
|
"drawStyle": "line",
|
||||||
|
"fillOpacity": 0,
|
||||||
|
"gradientMode": "none",
|
||||||
|
"hideFrom": {
|
||||||
|
"legend": false,
|
||||||
|
"tooltip": false,
|
||||||
|
"viz": false
|
||||||
|
},
|
||||||
|
"insertNulls": false,
|
||||||
|
"lineInterpolation": "linear",
|
||||||
|
"lineWidth": 1,
|
||||||
|
"pointSize": 5,
|
||||||
|
"scaleDistribution": {
|
||||||
|
"type": "linear"
|
||||||
|
},
|
||||||
|
"showPoints": "auto",
|
||||||
|
"spanNulls": false,
|
||||||
|
"stacking": {
|
||||||
|
"group": "A",
|
||||||
|
"mode": "none"
|
||||||
|
},
|
||||||
|
"thresholdsStyle": {
|
||||||
|
"mode": "off"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"mappings": [],
|
||||||
|
"thresholds": {
|
||||||
|
"mode": "absolute",
|
||||||
|
"steps": [
|
||||||
|
{
|
||||||
|
"color": "green",
|
||||||
|
"value": 0
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"color": "red",
|
||||||
|
"value": 80
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"unit": "reqps"
|
||||||
|
},
|
||||||
|
"overrides": []
|
||||||
|
},
|
||||||
|
"gridPos": {
|
||||||
|
"h": 11,
|
||||||
|
"w": 12,
|
||||||
|
"x": 0,
|
||||||
|
"y": 21
|
||||||
|
},
|
||||||
|
"id": 2,
|
||||||
|
"options": {
|
||||||
|
"legend": {
|
||||||
|
"calcs": [],
|
||||||
|
"displayMode": "list",
|
||||||
|
"placement": "bottom",
|
||||||
|
"showLegend": true
|
||||||
|
},
|
||||||
|
"tooltip": {
|
||||||
|
"hideZeros": false,
|
||||||
|
"mode": "single",
|
||||||
|
"sort": "none"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"pluginVersion": "12.1.0",
|
||||||
|
"targets": [
|
||||||
|
{
|
||||||
|
"datasource": {
|
||||||
|
"type": "prometheus",
|
||||||
|
"uid": "bezqqznn81wqof"
|
||||||
|
},
|
||||||
|
"disableTextWrap": false,
|
||||||
|
"editorMode": "code",
|
||||||
|
"expr": "sum(rate(caddy_http_response_duration_seconds_count{code!~\"5.*\"}[$__rate_interval]))",
|
||||||
|
"fullMetaSearch": false,
|
||||||
|
"includeNullMetadata": false,
|
||||||
|
"legendFormat": "Good",
|
||||||
|
"range": true,
|
||||||
|
"refId": "A",
|
||||||
|
"useBackend": false
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"title": "Response Codes (Good)",
|
||||||
|
"type": "timeseries"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"datasource": {
|
||||||
|
"type": "prometheus",
|
||||||
|
"uid": "bezqqznn81wqof"
|
||||||
|
},
|
||||||
|
"fieldConfig": {
|
||||||
|
"defaults": {
|
||||||
|
"color": {
|
||||||
|
"mode": "palette-classic"
|
||||||
|
},
|
||||||
|
"custom": {
|
||||||
|
"axisBorderShow": false,
|
||||||
|
"axisCenteredZero": false,
|
||||||
|
"axisColorMode": "text",
|
||||||
|
"axisLabel": "",
|
||||||
|
"axisPlacement": "auto",
|
||||||
|
"axisSoftMin": 0,
|
||||||
|
"barAlignment": 0,
|
||||||
|
"barWidthFactor": 0.6,
|
||||||
|
"drawStyle": "line",
|
||||||
|
"fillOpacity": 0,
|
||||||
|
"gradientMode": "none",
|
||||||
|
"hideFrom": {
|
||||||
|
"legend": false,
|
||||||
|
"tooltip": false,
|
||||||
|
"viz": false
|
||||||
|
},
|
||||||
|
"insertNulls": false,
|
||||||
|
"lineInterpolation": "linear",
|
||||||
|
"lineWidth": 1,
|
||||||
|
"pointSize": 5,
|
||||||
|
"scaleDistribution": {
|
||||||
|
"type": "linear"
|
||||||
|
},
|
||||||
|
"showPoints": "auto",
|
||||||
|
"spanNulls": false,
|
||||||
|
"stacking": {
|
||||||
|
"group": "A",
|
||||||
|
"mode": "none"
|
||||||
|
},
|
||||||
|
"thresholdsStyle": {
|
||||||
|
"mode": "off"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"mappings": [],
|
||||||
|
"thresholds": {
|
||||||
|
"mode": "absolute",
|
||||||
|
"steps": [
|
||||||
|
{
|
||||||
|
"color": "green",
|
||||||
|
"value": 0
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"color": "red",
|
||||||
|
"value": 80
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"unit": "reqps"
|
||||||
|
},
|
||||||
|
"overrides": []
|
||||||
|
},
|
||||||
|
"gridPos": {
|
||||||
|
"h": 11,
|
||||||
|
"w": 12,
|
||||||
|
"x": 12,
|
||||||
|
"y": 21
|
||||||
|
},
|
||||||
|
"id": 5,
|
||||||
|
"options": {
|
||||||
|
"legend": {
|
||||||
|
"calcs": [],
|
||||||
|
"displayMode": "list",
|
||||||
|
"placement": "bottom",
|
||||||
|
"showLegend": true
|
||||||
|
},
|
||||||
|
"tooltip": {
|
||||||
|
"hideZeros": false,
|
||||||
|
"mode": "single",
|
||||||
|
"sort": "none"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"pluginVersion": "12.1.0",
|
||||||
|
"targets": [
|
||||||
|
{
|
||||||
|
"datasource": {
|
||||||
|
"type": "prometheus",
|
||||||
|
"uid": "bezqqznn81wqof"
|
||||||
|
},
|
||||||
|
"disableTextWrap": false,
|
||||||
|
"editorMode": "code",
|
||||||
|
"expr": "sum(rate(caddy_http_response_duration_seconds_count{code=~\"5.*\"}[$__rate_interval])) by (code, host) > 0",
|
||||||
|
"fullMetaSearch": false,
|
||||||
|
"includeNullMetadata": false,
|
||||||
|
"legendFormat": "{{code}} - {{host}}",
|
||||||
|
"range": true,
|
||||||
|
"refId": "A",
|
||||||
|
"useBackend": false
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"title": "Response Codes (Bad)",
|
||||||
|
"type": "timeseries"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"preload": false,
|
||||||
|
"refresh": "5s",
|
||||||
|
"schemaVersion": 41,
|
||||||
|
"tags": [],
|
||||||
|
"templating": {
|
||||||
|
"list": []
|
||||||
|
},
|
||||||
|
"time": {
|
||||||
|
"from": "now-24h",
|
||||||
|
"to": "now"
|
||||||
|
},
|
||||||
|
"timepicker": {},
|
||||||
|
"timezone": "browser",
|
||||||
|
"title": "Traffic / SLO",
|
||||||
|
"uid": "384f28fe-2435-480f-a0f0-723ccdcf8b3b"
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
apiVersion: 1
|
||||||
|
|
||||||
|
# Contact points — defines where alerts are sent.
|
||||||
|
# PagerDuty key is managed via Grafana UI / environment variable; do not commit secrets here.
|
||||||
|
|
||||||
|
contactPoints:
|
||||||
|
- orgId: 1
|
||||||
|
name: PagerDuty
|
||||||
|
receivers:
|
||||||
|
- uid: bf0ukmhpefshsc
|
||||||
|
type: pagerduty
|
||||||
|
settings:
|
||||||
|
integrationKey: "{{ grafana_pagerduty_integration_key }}"
|
||||||
|
disableResolveMessage: false
|
||||||
|
|
||||||
|
- orgId: 1
|
||||||
|
name: email
|
||||||
|
receivers:
|
||||||
|
- uid: email-receiver
|
||||||
|
type: email
|
||||||
|
settings:
|
||||||
|
addresses: pez@pez.sh
|
||||||
|
disableResolveMessage: false
|
||||||
|
|
@ -0,0 +1,31 @@
|
||||||
|
apiVersion: 1
|
||||||
|
|
||||||
|
# Notification routing policy.
|
||||||
|
# Critical alerts (severity=critical) → PagerDuty.
|
||||||
|
# Warning alerts (severity=warning) → email.
|
||||||
|
|
||||||
|
policies:
|
||||||
|
- orgId: 1
|
||||||
|
receiver: PagerDuty
|
||||||
|
group_by:
|
||||||
|
- alertname
|
||||||
|
- server
|
||||||
|
group_wait: 30s
|
||||||
|
group_interval: 5m
|
||||||
|
repeat_interval: 4h
|
||||||
|
routes:
|
||||||
|
- receiver: PagerDuty
|
||||||
|
matchers:
|
||||||
|
- severity = critical
|
||||||
|
group_wait: 0s
|
||||||
|
group_interval: 1m
|
||||||
|
repeat_interval: 1h
|
||||||
|
continue: false
|
||||||
|
|
||||||
|
- receiver: email
|
||||||
|
matchers:
|
||||||
|
- severity = warning
|
||||||
|
group_wait: 2m
|
||||||
|
group_interval: 10m
|
||||||
|
repeat_interval: 8h
|
||||||
|
continue: false
|
||||||
|
|
@ -0,0 +1,358 @@
|
||||||
|
apiVersion: 1
|
||||||
|
|
||||||
|
# Tier 1 — Critical alerts. These page PagerDuty.
|
||||||
|
# Datasource UID: bezqqznn81wqof (Prometheus on london-a)
|
||||||
|
# All alerts use reduce+threshold (not classic_conditions) so $labels.* and $value work in annotations.
|
||||||
|
|
||||||
|
groups:
|
||||||
|
- orgId: 1
|
||||||
|
name: critical-availability
|
||||||
|
folder: Alerting
|
||||||
|
interval: 1m
|
||||||
|
rules:
|
||||||
|
- uid: cff6uy1tufj0ge
|
||||||
|
title: Host Down
|
||||||
|
condition: C
|
||||||
|
data:
|
||||||
|
- refId: A
|
||||||
|
datasourceUid: bezqqznn81wqof
|
||||||
|
model:
|
||||||
|
expr: up{job="node_exporter"}
|
||||||
|
instant: true
|
||||||
|
intervalMs: 1000
|
||||||
|
maxDataPoints: 43200
|
||||||
|
refId: A
|
||||||
|
- refId: B
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: A
|
||||||
|
reducer: last
|
||||||
|
settings:
|
||||||
|
mode: ""
|
||||||
|
refId: B
|
||||||
|
type: reduce
|
||||||
|
- refId: C
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
conditions:
|
||||||
|
- evaluator:
|
||||||
|
params: [1]
|
||||||
|
type: lt
|
||||||
|
operator:
|
||||||
|
type: and
|
||||||
|
query:
|
||||||
|
params: [C]
|
||||||
|
reducer:
|
||||||
|
params: []
|
||||||
|
type: last
|
||||||
|
type: query
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: B
|
||||||
|
refId: C
|
||||||
|
type: threshold
|
||||||
|
noDataState: Alerting
|
||||||
|
execErrState: Alerting
|
||||||
|
for: 2m
|
||||||
|
annotations:
|
||||||
|
summary: "Host {{ $labels.server }} is down"
|
||||||
|
description: "Node exporter on {{ $labels.server }} ({{ $labels.instance }}) has been unreachable for 2+ minutes."
|
||||||
|
labels:
|
||||||
|
severity: critical
|
||||||
|
isPaused: false
|
||||||
|
|
||||||
|
- uid: aff6uy1vxchdse
|
||||||
|
title: Disk Usage Critical (>95%)
|
||||||
|
condition: C
|
||||||
|
data:
|
||||||
|
- refId: A
|
||||||
|
datasourceUid: bezqqznn81wqof
|
||||||
|
model:
|
||||||
|
expr: |
|
||||||
|
(
|
||||||
|
node_filesystem_size_bytes{job="node_exporter", fstype!~"tmpfs|overlay|squashfs|devtmpfs"}
|
||||||
|
- node_filesystem_avail_bytes{job="node_exporter", fstype!~"tmpfs|overlay|squashfs|devtmpfs"}
|
||||||
|
)
|
||||||
|
/ node_filesystem_size_bytes{job="node_exporter", fstype!~"tmpfs|overlay|squashfs|devtmpfs"}
|
||||||
|
* 100
|
||||||
|
instant: true
|
||||||
|
intervalMs: 1000
|
||||||
|
maxDataPoints: 43200
|
||||||
|
refId: A
|
||||||
|
- refId: B
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: A
|
||||||
|
reducer: last
|
||||||
|
settings:
|
||||||
|
mode: ""
|
||||||
|
refId: B
|
||||||
|
type: reduce
|
||||||
|
- refId: C
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
conditions:
|
||||||
|
- evaluator:
|
||||||
|
params: [95]
|
||||||
|
type: gt
|
||||||
|
operator:
|
||||||
|
type: and
|
||||||
|
query:
|
||||||
|
params: [C]
|
||||||
|
reducer:
|
||||||
|
params: []
|
||||||
|
type: last
|
||||||
|
type: query
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: B
|
||||||
|
refId: C
|
||||||
|
type: threshold
|
||||||
|
noDataState: NoData
|
||||||
|
execErrState: Error
|
||||||
|
for: 5m
|
||||||
|
annotations:
|
||||||
|
summary: "Disk critically full on {{ $labels.server }}"
|
||||||
|
description: "Filesystem {{ $labels.mountpoint }} on {{ $labels.server }} is over 95% full (currently {{ $value | printf \"%.1f\" }}%)."
|
||||||
|
labels:
|
||||||
|
severity: critical
|
||||||
|
isPaused: false
|
||||||
|
|
||||||
|
- uid: aff6uy1xq9udca
|
||||||
|
title: Memory Usage Critical (>95%)
|
||||||
|
condition: C
|
||||||
|
data:
|
||||||
|
- refId: A
|
||||||
|
datasourceUid: bezqqznn81wqof
|
||||||
|
model:
|
||||||
|
expr: |
|
||||||
|
(1 - (node_memory_MemAvailable_bytes{job="node_exporter"} / node_memory_MemTotal_bytes{job="node_exporter"})) * 100
|
||||||
|
instant: true
|
||||||
|
intervalMs: 1000
|
||||||
|
maxDataPoints: 43200
|
||||||
|
refId: A
|
||||||
|
- refId: B
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: A
|
||||||
|
reducer: last
|
||||||
|
settings:
|
||||||
|
mode: ""
|
||||||
|
refId: B
|
||||||
|
type: reduce
|
||||||
|
- refId: C
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
conditions:
|
||||||
|
- evaluator:
|
||||||
|
params: [95]
|
||||||
|
type: gt
|
||||||
|
operator:
|
||||||
|
type: and
|
||||||
|
query:
|
||||||
|
params: [C]
|
||||||
|
reducer:
|
||||||
|
params: []
|
||||||
|
type: last
|
||||||
|
type: query
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: B
|
||||||
|
refId: C
|
||||||
|
type: threshold
|
||||||
|
noDataState: NoData
|
||||||
|
execErrState: Error
|
||||||
|
for: 5m
|
||||||
|
annotations:
|
||||||
|
summary: "Memory critically low on {{ $labels.server }}"
|
||||||
|
description: "Memory usage on {{ $labels.server }} ({{ $labels.instance }}) is above 95% for 5+ minutes."
|
||||||
|
labels:
|
||||||
|
severity: critical
|
||||||
|
isPaused: false
|
||||||
|
|
||||||
|
- uid: fff6uy219mo00e
|
||||||
|
title: SMART Disk Health Failure (london-b)
|
||||||
|
condition: C
|
||||||
|
data:
|
||||||
|
- refId: A
|
||||||
|
datasourceUid: bezqqznn81wqof
|
||||||
|
model:
|
||||||
|
expr: smartctl_device_smart_status{job="smartmontools"}
|
||||||
|
instant: true
|
||||||
|
intervalMs: 1000
|
||||||
|
maxDataPoints: 43200
|
||||||
|
refId: A
|
||||||
|
- refId: B
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: A
|
||||||
|
reducer: last
|
||||||
|
settings:
|
||||||
|
mode: ""
|
||||||
|
refId: B
|
||||||
|
type: reduce
|
||||||
|
- refId: C
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
conditions:
|
||||||
|
- evaluator:
|
||||||
|
params: [1]
|
||||||
|
type: lt
|
||||||
|
operator:
|
||||||
|
type: and
|
||||||
|
query:
|
||||||
|
params: [C]
|
||||||
|
reducer:
|
||||||
|
params: []
|
||||||
|
type: last
|
||||||
|
type: query
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: B
|
||||||
|
refId: C
|
||||||
|
type: threshold
|
||||||
|
noDataState: NoData
|
||||||
|
execErrState: Error
|
||||||
|
for: 0m
|
||||||
|
annotations:
|
||||||
|
summary: "Disk SMART health failure on london-b"
|
||||||
|
description: "Drive {{ $labels.device }} on london-b reports SMART health failure. Check immediately."
|
||||||
|
labels:
|
||||||
|
severity: critical
|
||||||
|
isPaused: false
|
||||||
|
|
||||||
|
- orgId: 1
|
||||||
|
name: critical-caddy
|
||||||
|
folder: Alerting
|
||||||
|
interval: 1m
|
||||||
|
rules:
|
||||||
|
- uid: fff6uy1zgpb0gd
|
||||||
|
title: Caddy Down (helsinki-a)
|
||||||
|
condition: C
|
||||||
|
data:
|
||||||
|
- refId: A
|
||||||
|
datasourceUid: bezqqznn81wqof
|
||||||
|
model:
|
||||||
|
expr: up{job="caddy"}
|
||||||
|
instant: true
|
||||||
|
intervalMs: 1000
|
||||||
|
maxDataPoints: 43200
|
||||||
|
refId: A
|
||||||
|
- refId: B
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: A
|
||||||
|
reducer: last
|
||||||
|
settings:
|
||||||
|
mode: ""
|
||||||
|
refId: B
|
||||||
|
type: reduce
|
||||||
|
- refId: C
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
conditions:
|
||||||
|
- evaluator:
|
||||||
|
params: [1]
|
||||||
|
type: lt
|
||||||
|
operator:
|
||||||
|
type: and
|
||||||
|
query:
|
||||||
|
params: [C]
|
||||||
|
reducer:
|
||||||
|
params: []
|
||||||
|
type: last
|
||||||
|
type: query
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: B
|
||||||
|
refId: C
|
||||||
|
type: threshold
|
||||||
|
noDataState: Alerting
|
||||||
|
execErrState: Alerting
|
||||||
|
for: 1m
|
||||||
|
annotations:
|
||||||
|
summary: "Caddy is down on helsinki-a"
|
||||||
|
description: "Caddy (main reverse proxy) on helsinki-a unreachable. External services likely down."
|
||||||
|
labels:
|
||||||
|
severity: critical
|
||||||
|
isPaused: false
|
||||||
|
|
||||||
|
- orgId: 1
|
||||||
|
name: critical-services
|
||||||
|
folder: Alerting
|
||||||
|
interval: 1m
|
||||||
|
rules:
|
||||||
|
- uid: bff6uy2a2rrwgb
|
||||||
|
title: Plex Down (london-b)
|
||||||
|
condition: C
|
||||||
|
data:
|
||||||
|
- refId: A
|
||||||
|
datasourceUid: bezqqznn81wqof
|
||||||
|
model:
|
||||||
|
expr: up{job="plex"}
|
||||||
|
instant: true
|
||||||
|
intervalMs: 1000
|
||||||
|
maxDataPoints: 43200
|
||||||
|
refId: A
|
||||||
|
- refId: B
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: A
|
||||||
|
reducer: last
|
||||||
|
settings:
|
||||||
|
mode: ""
|
||||||
|
refId: B
|
||||||
|
type: reduce
|
||||||
|
- refId: C
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
conditions:
|
||||||
|
- evaluator:
|
||||||
|
params: [1]
|
||||||
|
type: lt
|
||||||
|
operator:
|
||||||
|
type: and
|
||||||
|
query:
|
||||||
|
params: [C]
|
||||||
|
reducer:
|
||||||
|
params: []
|
||||||
|
type: last
|
||||||
|
type: query
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: B
|
||||||
|
refId: C
|
||||||
|
type: threshold
|
||||||
|
noDataState: Alerting
|
||||||
|
execErrState: Alerting
|
||||||
|
for: 5m
|
||||||
|
annotations:
|
||||||
|
summary: "Plex is down on london-b"
|
||||||
|
description: "The Plex exporter on london-b has been unreachable for 5+ minutes."
|
||||||
|
labels:
|
||||||
|
severity: critical
|
||||||
|
isPaused: false
|
||||||
242
ansible/services/grafana/provisioning/alerting/rules-warning.yml
Normal file
242
ansible/services/grafana/provisioning/alerting/rules-warning.yml
Normal file
|
|
@ -0,0 +1,242 @@
|
||||||
|
apiVersion: 1
|
||||||
|
|
||||||
|
# Tier 2 — Warning alerts. These send email only (non-paging).
|
||||||
|
# Datasource UID: bezqqznn81wqof (Prometheus on london-a)
|
||||||
|
# All alerts use reduce+threshold (not classic_conditions) so $labels.* and $value work in annotations.
|
||||||
|
|
||||||
|
groups:
|
||||||
|
- orgId: 1
|
||||||
|
name: warning-resources
|
||||||
|
folder: Alerting
|
||||||
|
interval: 2m
|
||||||
|
rules:
|
||||||
|
- uid: cff6uy23024n4c
|
||||||
|
title: Disk Usage Warning (>80%)
|
||||||
|
condition: C
|
||||||
|
data:
|
||||||
|
- refId: A
|
||||||
|
datasourceUid: bezqqznn81wqof
|
||||||
|
model:
|
||||||
|
expr: |
|
||||||
|
(
|
||||||
|
node_filesystem_size_bytes{job="node_exporter", fstype!~"tmpfs|overlay|squashfs|devtmpfs"}
|
||||||
|
- node_filesystem_avail_bytes{job="node_exporter", fstype!~"tmpfs|overlay|squashfs|devtmpfs"}
|
||||||
|
)
|
||||||
|
/ node_filesystem_size_bytes{job="node_exporter", fstype!~"tmpfs|overlay|squashfs|devtmpfs"}
|
||||||
|
* 100
|
||||||
|
instant: true
|
||||||
|
intervalMs: 1000
|
||||||
|
maxDataPoints: 43200
|
||||||
|
refId: A
|
||||||
|
- refId: B
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: A
|
||||||
|
reducer: last
|
||||||
|
settings:
|
||||||
|
mode: ""
|
||||||
|
refId: B
|
||||||
|
type: reduce
|
||||||
|
- refId: C
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
conditions:
|
||||||
|
- evaluator:
|
||||||
|
params: [80]
|
||||||
|
type: gt
|
||||||
|
operator:
|
||||||
|
type: and
|
||||||
|
query:
|
||||||
|
params: [C]
|
||||||
|
reducer:
|
||||||
|
params: []
|
||||||
|
type: last
|
||||||
|
type: query
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: B
|
||||||
|
refId: C
|
||||||
|
type: threshold
|
||||||
|
noDataState: NoData
|
||||||
|
execErrState: Error
|
||||||
|
for: 10m
|
||||||
|
annotations:
|
||||||
|
summary: "Disk usage high on {{ $labels.server }}"
|
||||||
|
description: "Filesystem {{ $labels.mountpoint }} on {{ $labels.server }} is over 80% full (currently {{ $value | printf \"%.1f\" }}%)."
|
||||||
|
labels:
|
||||||
|
severity: warning
|
||||||
|
isPaused: false
|
||||||
|
|
||||||
|
- uid: dff6uy24szhmod
|
||||||
|
title: Memory Usage Warning (>85%)
|
||||||
|
condition: C
|
||||||
|
data:
|
||||||
|
- refId: A
|
||||||
|
datasourceUid: bezqqznn81wqof
|
||||||
|
model:
|
||||||
|
expr: |
|
||||||
|
(1 - (node_memory_MemAvailable_bytes{job="node_exporter"} / node_memory_MemTotal_bytes{job="node_exporter"})) * 100
|
||||||
|
instant: true
|
||||||
|
intervalMs: 1000
|
||||||
|
maxDataPoints: 43200
|
||||||
|
refId: A
|
||||||
|
- refId: B
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: A
|
||||||
|
reducer: last
|
||||||
|
settings:
|
||||||
|
mode: ""
|
||||||
|
refId: B
|
||||||
|
type: reduce
|
||||||
|
- refId: C
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
conditions:
|
||||||
|
- evaluator:
|
||||||
|
params: [85]
|
||||||
|
type: gt
|
||||||
|
operator:
|
||||||
|
type: and
|
||||||
|
query:
|
||||||
|
params: [C]
|
||||||
|
reducer:
|
||||||
|
params: []
|
||||||
|
type: last
|
||||||
|
type: query
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: B
|
||||||
|
refId: C
|
||||||
|
type: threshold
|
||||||
|
noDataState: NoData
|
||||||
|
execErrState: Error
|
||||||
|
for: 10m
|
||||||
|
annotations:
|
||||||
|
summary: "Memory usage high on {{ $labels.server }}"
|
||||||
|
description: "Memory usage on {{ $labels.server }} ({{ $labels.instance }}) is above 85% for 10+ minutes."
|
||||||
|
labels:
|
||||||
|
severity: warning
|
||||||
|
isPaused: false
|
||||||
|
|
||||||
|
- uid: cff6uy26jey9sd
|
||||||
|
title: CPU Usage High (>85%)
|
||||||
|
condition: C
|
||||||
|
data:
|
||||||
|
- refId: A
|
||||||
|
datasourceUid: bezqqznn81wqof
|
||||||
|
model:
|
||||||
|
expr: |
|
||||||
|
100 - (avg by (server, instance) (rate(node_cpu_seconds_total{job="node_exporter", mode="idle"}[5m])) * 100)
|
||||||
|
instant: true
|
||||||
|
intervalMs: 1000
|
||||||
|
maxDataPoints: 43200
|
||||||
|
refId: A
|
||||||
|
- refId: B
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: A
|
||||||
|
reducer: last
|
||||||
|
settings:
|
||||||
|
mode: ""
|
||||||
|
refId: B
|
||||||
|
type: reduce
|
||||||
|
- refId: C
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
conditions:
|
||||||
|
- evaluator:
|
||||||
|
params: [85]
|
||||||
|
type: gt
|
||||||
|
operator:
|
||||||
|
type: and
|
||||||
|
query:
|
||||||
|
params: [C]
|
||||||
|
reducer:
|
||||||
|
params: []
|
||||||
|
type: last
|
||||||
|
type: query
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: B
|
||||||
|
refId: C
|
||||||
|
type: threshold
|
||||||
|
noDataState: NoData
|
||||||
|
execErrState: Error
|
||||||
|
for: 15m
|
||||||
|
annotations:
|
||||||
|
summary: "CPU usage sustained high on {{ $labels.server }}"
|
||||||
|
description: "CPU on {{ $labels.server }} has been above 85% for 15+ minutes (currently {{ $value | printf \"%.1f\" }}%)."
|
||||||
|
labels:
|
||||||
|
severity: warning
|
||||||
|
isPaused: false
|
||||||
|
|
||||||
|
- uid: eff6uy289uewwb
|
||||||
|
title: System Load High (>2x CPUs)
|
||||||
|
condition: C
|
||||||
|
data:
|
||||||
|
- refId: A
|
||||||
|
datasourceUid: bezqqznn81wqof
|
||||||
|
model:
|
||||||
|
# Compare 15-minute load against number of CPUs
|
||||||
|
expr: |
|
||||||
|
node_load15{job="node_exporter"} / on(instance) group_left() count by (instance) (node_cpu_seconds_total{job="node_exporter", mode="idle"})
|
||||||
|
instant: true
|
||||||
|
intervalMs: 1000
|
||||||
|
maxDataPoints: 43200
|
||||||
|
refId: A
|
||||||
|
- refId: B
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: A
|
||||||
|
reducer: last
|
||||||
|
settings:
|
||||||
|
mode: ""
|
||||||
|
refId: B
|
||||||
|
type: reduce
|
||||||
|
- refId: C
|
||||||
|
datasourceUid: __expr__
|
||||||
|
model:
|
||||||
|
conditions:
|
||||||
|
- evaluator:
|
||||||
|
params: [2]
|
||||||
|
type: gt
|
||||||
|
operator:
|
||||||
|
type: and
|
||||||
|
query:
|
||||||
|
params: [C]
|
||||||
|
reducer:
|
||||||
|
params: []
|
||||||
|
type: last
|
||||||
|
type: query
|
||||||
|
datasource:
|
||||||
|
type: __expr__
|
||||||
|
uid: __expr__
|
||||||
|
expression: B
|
||||||
|
refId: C
|
||||||
|
type: threshold
|
||||||
|
noDataState: NoData
|
||||||
|
execErrState: Error
|
||||||
|
for: 15m
|
||||||
|
annotations:
|
||||||
|
summary: "High system load on {{ $labels.server }}"
|
||||||
|
description: "15-minute load average on {{ $labels.server }} is {{ $value | printf \"%.2f\" }}x the CPU count (threshold: 2x)."
|
||||||
|
labels:
|
||||||
|
severity: warning
|
||||||
|
isPaused: false
|
||||||
|
|
||||||
|
|
@ -0,0 +1,15 @@
|
||||||
|
apiVersion: 1
|
||||||
|
|
||||||
|
# Dashboard provisioning — tells Grafana where to find dashboard JSON files.
|
||||||
|
# Path is relative to the Grafana installation on london-a (FreeBSD).
|
||||||
|
|
||||||
|
providers:
|
||||||
|
- name: default
|
||||||
|
orgId: 1
|
||||||
|
folder: ""
|
||||||
|
type: file
|
||||||
|
disableDeletion: false
|
||||||
|
updateIntervalSeconds: 30
|
||||||
|
options:
|
||||||
|
path: /usr/local/etc/grafana/dashboards
|
||||||
|
foldersFromFilesStructure: false
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
[
|
||||||
|
{
|
||||||
|
"uid": "bezqqznn81wqof",
|
||||||
|
"name": "prometheus",
|
||||||
|
"type": "prometheus",
|
||||||
|
"typeName": "Prometheus",
|
||||||
|
"typeLogoUrl": "public/plugins/prometheus/img/prometheus_logo.svg",
|
||||||
|
"access": "proxy",
|
||||||
|
"url": "http://localhost:9090",
|
||||||
|
"user": "",
|
||||||
|
"database": "",
|
||||||
|
"basicAuth": false,
|
||||||
|
"isDefault": true,
|
||||||
|
"jsonData": {
|
||||||
|
"pdcInjected": false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
8
ansible/services/jellyseerr/README.md
Normal file
8
ansible/services/jellyseerr/README.md
Normal file
|
|
@ -0,0 +1,8 @@
|
||||||
|
# Jellyseerr
|
||||||
|
|
||||||
|
Media request management (Overseerr fork for Jellyfin/Plex).
|
||||||
|
|
||||||
|
- **Host:** london-b
|
||||||
|
- **URL:** https://requests.pez.sh
|
||||||
|
- **Port:** 5056 (host) → 5055 (container)
|
||||||
|
- **Config:** `/var/share/jellyseer/`
|
||||||
17
ansible/services/jellyseerr/docker-compose.yml
Normal file
17
ansible/services/jellyseerr/docker-compose.yml
Normal file
|
|
@ -0,0 +1,17 @@
|
||||||
|
# Jellyseerr - Media request management
|
||||||
|
# Host: london-b (100.84.65.101)
|
||||||
|
# Data: /var/share/jellyseer
|
||||||
|
# Access: https://requests.pez.sh (via Caddy reverse proxy on helsinki-a)
|
||||||
|
|
||||||
|
services:
|
||||||
|
jellyseerr:
|
||||||
|
image: fallenbagel/jellyseerr:latest
|
||||||
|
container_name: jellyseer
|
||||||
|
restart: always
|
||||||
|
ports:
|
||||||
|
- "5056:5055"
|
||||||
|
environment:
|
||||||
|
LOG_LEVEL: debug
|
||||||
|
TZ: Europe/London
|
||||||
|
volumes:
|
||||||
|
- /var/share/jellyseer:/app/config
|
||||||
16
ansible/services/mangos-realmd/mangos-realmd.service
Normal file
16
ansible/services/mangos-realmd/mangos-realmd.service
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
[Unit]
|
||||||
|
Description=MaNGOS Zero Realm Server
|
||||||
|
After=network.target mariadb.service
|
||||||
|
Requires=mariadb.service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
User=mangos
|
||||||
|
Group=mangos
|
||||||
|
WorkingDirectory=/home/mangos/mangos/zero/bin
|
||||||
|
ExecStart=/home/mangos/mangos/zero/bin/realmd
|
||||||
|
Restart=on-failure
|
||||||
|
RestartSec=5
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
16
ansible/services/mangos-world/mangos-world.service
Normal file
16
ansible/services/mangos-world/mangos-world.service
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
[Unit]
|
||||||
|
Description=MaNGOS Zero Realm Server
|
||||||
|
After=network.target mariadb.service
|
||||||
|
Requires=mariadb.service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
User=mangos
|
||||||
|
Group=mangos
|
||||||
|
WorkingDirectory=/home/mangos/mangos/zero/bin
|
||||||
|
ExecStart=/home/mangos/mangos/zero/bin/realmd
|
||||||
|
Restart=on-failure
|
||||||
|
RestartSec=5
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
10
ansible/services/minecraft/README.md
Normal file
10
ansible/services/minecraft/README.md
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
# Minecraft
|
||||||
|
|
||||||
|
PaperMC server.
|
||||||
|
|
||||||
|
- **Host:** copenhagen-a
|
||||||
|
- **Port:** 25565
|
||||||
|
- **Memory:** 3GB
|
||||||
|
- **Data:** Docker volume (`minecraft_minecraftserver`)
|
||||||
|
- **Java:** OpenJDK 21 (bundled in image)
|
||||||
|
- **Note:** copenhagen-a also runs a WoW server (MaNGOS Zero) as system services, not Docker
|
||||||
19
ansible/services/minecraft/docker-compose.yml
Normal file
19
ansible/services/minecraft/docker-compose.yml
Normal file
|
|
@ -0,0 +1,19 @@
|
||||||
|
# Minecraft - PaperMC server
|
||||||
|
# Host: copenhagen-a (100.89.206.60)
|
||||||
|
# Data: Docker volume (minecraft_minecraftserver)
|
||||||
|
|
||||||
|
services:
|
||||||
|
minecraft:
|
||||||
|
image: marctv/minecraft-papermc-server:latest
|
||||||
|
container_name: mcserver
|
||||||
|
restart: always
|
||||||
|
ports:
|
||||||
|
- "25565:25565"
|
||||||
|
environment:
|
||||||
|
MEMORYSIZE: 3G
|
||||||
|
volumes:
|
||||||
|
- minecraft_data:/data
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
minecraft_data:
|
||||||
|
name: minecraft_minecraftserver
|
||||||
10
ansible/services/miniflux/README.md
Normal file
10
ansible/services/miniflux/README.md
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
# Miniflux
|
||||||
|
|
||||||
|
Lightweight RSS reader.
|
||||||
|
|
||||||
|
- **Host:** london-b
|
||||||
|
- **URL:** https://rss.pez.sh
|
||||||
|
- **Database:** PostgreSQL 15 (Alpine)
|
||||||
|
- **Bind address:** Tailscale IP only (100.84.65.101:8181)
|
||||||
|
- **Data:** Docker volume (`miniflux-db`)
|
||||||
|
- **Note:** Passwords templatized — set `MINIFLUX_DB_PASSWORD` and `MINIFLUX_ADMIN_PASSWORD` env vars before deploying
|
||||||
35
ansible/services/miniflux/docker-compose.yml
Normal file
35
ansible/services/miniflux/docker-compose.yml
Normal file
|
|
@ -0,0 +1,35 @@
|
||||||
|
# Miniflux - RSS reader
|
||||||
|
# Host: london-b (100.84.65.101)
|
||||||
|
# Data: Docker volume (miniflux-db)
|
||||||
|
# Access: https://rss.pez.sh (via Caddy reverse proxy on helsinki-a)
|
||||||
|
|
||||||
|
services:
|
||||||
|
miniflux-db:
|
||||||
|
image: postgres:15-alpine
|
||||||
|
container_name: miniflux-db
|
||||||
|
restart: unless-stopped
|
||||||
|
volumes:
|
||||||
|
- miniflux-db:/var/lib/postgresql/data
|
||||||
|
environment:
|
||||||
|
POSTGRES_DB: miniflux
|
||||||
|
POSTGRES_USER: miniflux
|
||||||
|
POSTGRES_PASSWORD: "${MINIFLUX_DB_PASSWORD}"
|
||||||
|
|
||||||
|
miniflux:
|
||||||
|
image: miniflux/miniflux:latest
|
||||||
|
container_name: miniflux
|
||||||
|
restart: unless-stopped
|
||||||
|
depends_on:
|
||||||
|
- miniflux-db
|
||||||
|
ports:
|
||||||
|
- "100.84.65.101:8181:8080"
|
||||||
|
environment:
|
||||||
|
DATABASE_URL: "postgres://miniflux:${MINIFLUX_DB_PASSWORD}@miniflux-db/miniflux?sslmode=disable"
|
||||||
|
RUN_MIGRATIONS: "1"
|
||||||
|
CREATE_ADMIN: "1"
|
||||||
|
ADMIN_USERNAME: pez
|
||||||
|
ADMIN_PASSWORD: "${MINIFLUX_ADMIN_PASSWORD}"
|
||||||
|
BASE_URL: https://rss.pez.sh
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
miniflux-db:
|
||||||
9
ansible/services/navidrome/README.md
Normal file
9
ansible/services/navidrome/README.md
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
# Navidrome
|
||||||
|
|
||||||
|
Personal music streaming server (Subsonic-compatible).
|
||||||
|
|
||||||
|
- **Host:** london-b
|
||||||
|
- **URL:** https://music.pez.sh
|
||||||
|
- **Port:** 4533
|
||||||
|
- **Config:** `/root/navidrome/` (includes `navidrome.toml`)
|
||||||
|
- **Music library:** `/hdd/music` (on ZFS pool)
|
||||||
17
ansible/services/navidrome/docker-compose.yml
Normal file
17
ansible/services/navidrome/docker-compose.yml
Normal file
|
|
@ -0,0 +1,17 @@
|
||||||
|
# Navidrome - Music streaming server
|
||||||
|
# Host: london-b (100.84.65.101)
|
||||||
|
# Data: /root/navidrome (config), /hdd/music (library)
|
||||||
|
# Access: https://music.pez.sh (via Caddy reverse proxy on helsinki-a)
|
||||||
|
|
||||||
|
services:
|
||||||
|
navidrome:
|
||||||
|
image: deluan/navidrome:latest
|
||||||
|
container_name: navidrome
|
||||||
|
restart: unless-stopped
|
||||||
|
ports:
|
||||||
|
- "4533:4533"
|
||||||
|
environment:
|
||||||
|
ND_LOGLEVEL: info
|
||||||
|
volumes:
|
||||||
|
- /root/navidrome:/data
|
||||||
|
- /hdd/music:/music
|
||||||
10
ansible/services/nextcloud-aio/README.md
Normal file
10
ansible/services/nextcloud-aio/README.md
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
# Nextcloud AIO
|
||||||
|
|
||||||
|
All-in-one Nextcloud deployment (self-managed containers).
|
||||||
|
|
||||||
|
- **Host:** london-b
|
||||||
|
- **URL:** https://cloud.pez.sh
|
||||||
|
- **Admin port:** 8080 (mastercontainer management UI)
|
||||||
|
- **Apache port:** 11000 (proxied by Caddy on helsinki-a)
|
||||||
|
- **Data:** Docker volume (`nextcloud_aio_mastercontainer`)
|
||||||
|
- **Note:** The mastercontainer spawns and manages its own sub-containers (database, redis, apache, etc.)
|
||||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Reference in a new issue