Compare commits
15 Commits
a464d287b7
...
2a8b5464e6
Author | SHA1 | Date |
---|---|---|
Lukáš Kucharczyk | 2a8b5464e6 | |
Lukáš Kucharczyk | e43907992a | |
Lukáš Kucharczyk | 6638b4d357 | |
Lukáš Kucharczyk | bdb6b109af | |
Lukáš Kucharczyk | 17a5d0550d | |
Lukáš Kucharczyk | 45f14658e4 | |
Lukáš Kucharczyk | a13a7adf67 | |
Lukáš Kucharczyk | 069314f9d6 | |
Lukáš Kucharczyk | c418b61ede | |
Lukáš Kucharczyk | f5824a5ffe | |
Lukáš Kucharczyk | 1ad9787b17 | |
Lukáš Kucharczyk | 2593c84400 | |
Lukáš Kucharczyk | 6b70fa2587 | |
Lukáš Kucharczyk | 6702afc8f7 | |
Lukáš Kucharczyk | 7a17b16980 |
|
@ -3,8 +3,9 @@
|
|||
roles:
|
||||
- docker
|
||||
- nginx
|
||||
- jellyfin
|
||||
- openldap
|
||||
- portainer
|
||||
- jellyfin
|
||||
- postgres
|
||||
- authelia
|
||||
- keycloak
|
||||
|
|
|
@ -17,8 +17,8 @@
|
|||
ports:
|
||||
- "9091:9091"
|
||||
networks:
|
||||
- name: bridge
|
||||
- name: nginx-internal
|
||||
- name: external
|
||||
- name: openldap
|
||||
volumes:
|
||||
- "{{ data_folder }}/authelia:/config"
|
||||
- name: copy nginx endpoint conf
|
||||
|
|
|
@ -1,7 +1,7 @@
|
|||
server {
|
||||
listen 80;
|
||||
server_name auth.{{ base_domain }};
|
||||
return 301 https://$host$request_uri;
|
||||
listen 80;
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
|
|
|
@ -26,9 +26,19 @@ authentication_backend:
|
|||
password: {{ vault_openldap_admin_password }}
|
||||
access_control:
|
||||
default_policy: deny
|
||||
networks:
|
||||
- name: local
|
||||
networks:
|
||||
- 192.168.0.0/24
|
||||
rules:
|
||||
- domain: "*.{{ base_domain }}"
|
||||
networks:
|
||||
- local
|
||||
policy: bypass
|
||||
- domain: portainer.{{ base_domain }}
|
||||
policy: one_factor
|
||||
- domain: keycloak.{{ base_domain }}
|
||||
policy: one_factor
|
||||
session:
|
||||
name: authelia_session
|
||||
secret: somerandomsecret
|
||||
|
|
|
@ -3,6 +3,9 @@
|
|||
name:
|
||||
- docker
|
||||
- python-pip
|
||||
- neovim
|
||||
- fish
|
||||
- curlie
|
||||
state: present
|
||||
update_cache: true
|
||||
- name: start
|
||||
|
@ -12,8 +15,9 @@
|
|||
- name: add user to group
|
||||
user:
|
||||
name: lukas
|
||||
groups: docker
|
||||
groups: docker,wheel
|
||||
append: true
|
||||
shell: /usr/bin/fish
|
||||
- name: install python docker
|
||||
pip:
|
||||
name:
|
||||
|
|
|
@ -12,7 +12,7 @@
|
|||
name: 'jellyfin'
|
||||
image: linuxserver/jellyfin
|
||||
networks:
|
||||
- name: nginx-internal
|
||||
- name: external
|
||||
volumes:
|
||||
- "{{ data_folder }}/jellyfin:/config"
|
||||
- "{{ media.tv }}:/data/tv"
|
||||
|
@ -29,7 +29,6 @@
|
|||
devices:
|
||||
- /dev/dri:/dev/dri
|
||||
state: started
|
||||
restart: yes
|
||||
- name: copy jellyfin nginx config
|
||||
template:
|
||||
src: jellyfin.conf.j2
|
||||
|
|
|
@ -1,6 +1,7 @@
|
|||
server {
|
||||
server_name "jellyfin.{{ base_domain }}";
|
||||
listen 80;
|
||||
return 301 https://$host$request_uri;
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
|
|
|
@ -5,8 +5,9 @@
|
|||
ports:
|
||||
- "8080:8080"
|
||||
networks:
|
||||
- name: external
|
||||
- name: postgres
|
||||
- name: nginx-internal
|
||||
- name: openldap
|
||||
env:
|
||||
"KEYCLOAK_USER": "{{ vault_keycloak_user }}"
|
||||
"KEYCLOAK_PASSWORD": "{{ vault_keycloak_password }}"
|
||||
|
|
|
@ -1,6 +1,7 @@
|
|||
server {
|
||||
server_name "keycloak.{{ base_domain }}";
|
||||
listen 80;
|
||||
return 301 https://$host$request_uri;
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
|
|
|
@ -14,11 +14,11 @@
|
|||
- name: generate self-signed certs
|
||||
import_tasks: self-signed.yml
|
||||
when: self_signed
|
||||
- name: create nginx bridge network
|
||||
- name: create external bridge network
|
||||
docker_network:
|
||||
name: nginx-internal
|
||||
name: external
|
||||
attachable: true
|
||||
internal: true
|
||||
internal: false
|
||||
state: present
|
||||
- name: copy nginx.conf
|
||||
template:
|
||||
|
@ -37,8 +37,7 @@
|
|||
name: 'nginx'
|
||||
image: nginx
|
||||
networks:
|
||||
- name: bridge
|
||||
- name: nginx-internal
|
||||
- name: external
|
||||
volumes:
|
||||
- "{{ data_folder }}/nginx/conf.d:/etc/nginx/conf.d"
|
||||
- "{{ data_folder }}/nginx/nginx.conf:/etc/nginx/nginx.conf"
|
||||
|
@ -54,4 +53,3 @@
|
|||
NGINX_HOST: "{{ base_domain }}"
|
||||
NGINX_PORT: '80'
|
||||
state: started
|
||||
restart: yes
|
||||
|
|
|
@ -6,13 +6,19 @@
|
|||
loop:
|
||||
- "{{ data_folder }}/openldap"
|
||||
- "{{ data_folder }}/openldap/data"
|
||||
- name: create network
|
||||
docker_network:
|
||||
name: openldap
|
||||
attachable: true
|
||||
internal: true
|
||||
state: present
|
||||
- name: run container
|
||||
docker_container:
|
||||
name: "openldap"
|
||||
image: osixia/openldap
|
||||
hostname: openldap
|
||||
networks:
|
||||
- name: nginx-internal
|
||||
- name: openldap
|
||||
ports:
|
||||
- "389:389"
|
||||
- "636:636"
|
||||
|
@ -24,4 +30,3 @@
|
|||
LDAP_ADMIN_PASSWORD: "{{ vault_openldap_admin_password }}"
|
||||
LDAP_REMOVE_CONFIG_AFTER_SETUP: "false"
|
||||
state: started
|
||||
restart: yes
|
|
@ -1,6 +0,0 @@
|
|||
dn: dc=kucharczyk,dc=xyz
|
||||
objectclass: top
|
||||
objectclass: dcObject
|
||||
objectclass: organization
|
||||
dc: kucharczyk
|
||||
o: Homelab
|
|
@ -0,0 +1,19 @@
|
|||
- name: run container
|
||||
docker_container:
|
||||
name: 'portainer'
|
||||
image: portainer/portainer-ce
|
||||
networks:
|
||||
- name: external
|
||||
- name: openldap
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock"
|
||||
ports:
|
||||
- "8000:8000"
|
||||
- "9000:9000"
|
||||
state: started
|
||||
- name: copy nginx conf
|
||||
template:
|
||||
src: portainer.conf.j2
|
||||
dest: "{{ data_folder }}/nginx/conf.d/{{ role_name }}.{{ base_domain }}.conf"
|
||||
mode: "755"
|
||||
notify: reload nginx
|
|
@ -0,0 +1,20 @@
|
|||
server {
|
||||
server_name portainer.{{ base_domain }};
|
||||
listen 80;
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
server_name portainer.{{ base_domain }};
|
||||
listen 443 ssl http2;
|
||||
|
||||
include /etc/nginx/snippets/authelia-endpoint.conf;
|
||||
|
||||
location / {
|
||||
include /etc/nginx/snippets/proxy.conf;
|
||||
include /etc/nginx/snippets/authelia-auth.conf;
|
||||
|
||||
set $upstream http://portainer:9000; # This example assumes a Docker deployment
|
||||
proxy_pass $upstream;
|
||||
}
|
||||
}
|
Loading…
Reference in New Issue