mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-10-31 19:11:03 +00:00
Rasmus Wejlgaard
40b2d49db6
The lunar -> noble upgrade disabled every third-party repo on london-b, so tailscale, jellyfin and plex have been frozen since. The common role can now manage deb822 repos and clean up stale source/keyring files per host, and london-b uses it for tailscale, jellyfin and plex (now on repo.plex.tv with the v2 key). The dead sonarr v3, mono, nvidia, datadog and PPA leftovers go.
83 lines
3.2 KiB
YAML
83 lines
3.2 KiB
YAML
---
|
|
host_role: storage
|
|
host_description: "Primary storage (ZFS), Docker services"
|
|
host_location: "London"
|
|
prometheus_location: london
|
|
|
|
docker_services:
|
|
- jellyseerr
|
|
- navidrome
|
|
- slskd
|
|
- smartctl-exporter
|
|
- plex-exporter
|
|
- bookshelf
|
|
|
|
# Snap-managed services (deployed by media_stack role)
|
|
snap_services:
|
|
- overseerr
|
|
|
|
# APT-managed user services (deployed by media_stack role)
|
|
apt_user_services:
|
|
- syncthing@pez
|
|
|
|
# Third-party apt repos (deployed by common role). The lunar -> noble upgrade
|
|
# disabled all of them (PESO-160). Plex moved to repo.plex.tv with a new key;
|
|
# the old downloads.plex.tv repo stopped at 1.42.2.
|
|
common_apt_repositories:
|
|
- name: tailscale
|
|
uris: https://pkgs.tailscale.com/stable/ubuntu
|
|
suites: "{{ ansible_facts['distribution_release'] }}"
|
|
components: main
|
|
signed_by: "https://pkgs.tailscale.com/stable/ubuntu/{{ ansible_facts['distribution_release'] }}.noarmor.gpg"
|
|
- name: jellyfin
|
|
uris: https://repo.jellyfin.org/ubuntu
|
|
suites: "{{ ansible_facts['distribution_release'] }}"
|
|
components: main
|
|
signed_by: https://repo.jellyfin.org/jellyfin_team.gpg.key
|
|
- name: plexmediaserver
|
|
uris: https://repo.plex.tv/deb
|
|
suites: public
|
|
components: main
|
|
signed_by: https://downloads.plex.tv/plex-keys/PlexSign.v2.key
|
|
|
|
# Leftovers from the upgrade. Sonarr v3 (apt.sonarr.tv) and its mono repo are
|
|
# dead ends, nvidia-container-toolkit isn't used by Docker here, and datadog
|
|
# is retired, so those repos go without replacements.
|
|
common_apt_cleanup_files:
|
|
- /etc/apt/sources.list.d/datadog.list.distUpgrade
|
|
- /etc/apt/sources.list.d/graphics-drivers-ubuntu-ppa-lunar.list.distUpgrade
|
|
- /etc/apt/sources.list.d/graphics-drivers-ubuntu-ppa-lunar.sources
|
|
- /etc/apt/sources.list.d/jcfp-ubuntu-nobetas-lunar.list.distUpgrade
|
|
- /etc/apt/sources.list.d/jcfp-ubuntu-nobetas-lunar.sources
|
|
- /etc/apt/sources.list.d/jellyfin.sources.distUpgrade
|
|
- /etc/apt/sources.list.d/mediaarea.list.distUpgrade
|
|
- /etc/apt/sources.list.d/mediaarea.sources
|
|
- /etc/apt/sources.list.d/mono-official-stable.list.distUpgrade
|
|
- /etc/apt/sources.list.d/nvidia-container-toolkit.list.distUpgrade
|
|
- /etc/apt/sources.list.d/plexmediaserver.list.distUpgrade
|
|
- /etc/apt/sources.list.d/sonarr.list.distUpgrade
|
|
- /etc/apt/sources.list.d/tailscale.list.distUpgrade
|
|
- /etc/apt/keyrings/jellyfin.gpg
|
|
- /usr/share/keyrings/plexmediaserver.gpg
|
|
- /usr/share/keyrings/mono-official-archive-keyring.gpg
|
|
- /usr/share/keyrings/mono-official-archive-keyring.gpg~
|
|
- /usr/share/keyrings/sonarr-keyring.gpg
|
|
- /usr/share/keyrings/sonarr-keyring.gpg~
|
|
- /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
|
|
|
|
zfs_pools:
|
|
- hdd
|
|
|
|
docker_daemon_extra:
|
|
metrics-addr: "0.0.0.0:9323"
|
|
data-root: "/hdd/docker"
|
|
storage-driver: "zfs"
|
|
|
|
common_ufw_allowed_ports:
|
|
- { port: 32400, proto: tcp, comment: "Plex Media Server" }
|
|
- { port: 6881, proto: tcp, comment: "BitTorrent" }
|
|
- { port: 6881, proto: udp, comment: "BitTorrent" }
|
|
# SMB is reachable over Tailscale via the tailscale0 allow-all rule; this
|
|
# entry additionally allows the local London LAN. Deliberately NOT open to
|
|
# the public internet (see PESO-145).
|
|
- { port: 445, proto: tcp, from_ip: "192.168.1.0/24", comment: "Samba (LAN only)" }
|