114 lines
3.1 KiB
YAML
Executable file
114 lines
3.1 KiB
YAML
Executable file
---
|
|
- name: Apply common configuration to all nodes
|
|
hosts: all
|
|
become: true
|
|
# become_method: sudo
|
|
gather_facts: true
|
|
remote_user: ansible
|
|
roles:
|
|
- base
|
|
tags:
|
|
- common
|
|
|
|
tasks:
|
|
- name: Set timezone
|
|
community.general.timezone:
|
|
name: "{{ timezone }}"
|
|
|
|
- name: Apply resolver config
|
|
hosts: resolvers
|
|
gather_facts: true
|
|
roles:
|
|
- { role: resolvers, become: true }
|
|
|
|
- name: Apply ns config
|
|
hosts: ns
|
|
gather_facts: true
|
|
become: true
|
|
roles:
|
|
- role: ns
|
|
|
|
- name: Apply netbox config
|
|
hosts: netbox
|
|
gather_facts: true
|
|
become: true
|
|
roles:
|
|
- role: caddy_ansible.caddy_ansible
|
|
caddy_systemd_network_dependency: true
|
|
caddy_setcap: true
|
|
caddy_systemd_capabilities_enabled: true
|
|
caddy_systemd_capabilities: "CAP_NET_BIND_SERVICE"
|
|
caddy_config: |
|
|
{{ netbox.domain }} {
|
|
bind {{ netbox.bind_address }}
|
|
log {
|
|
level error
|
|
}
|
|
route /static* {
|
|
uri strip_prefix /static
|
|
root * /opt/netbox/netbox/static
|
|
file_server
|
|
}
|
|
@notStatic not path /static*
|
|
encode gzip zstd
|
|
reverse_proxy @notStatic http://localhost:{{ netbox.port }} {
|
|
header_up Host {http.request.host}
|
|
header_up X-Real-IP {http.request.remote.host}
|
|
header_up X-Forwarded-For {http.request.remote.host}
|
|
header_up X-Forwarded-Port {http.request.port}
|
|
header_up X-Forwarded-Proto {http.request.scheme}
|
|
}
|
|
}
|
|
|
|
- name: Apply firewall rules to netbox
|
|
hosts: netbox
|
|
become: true
|
|
# remote_user: graham
|
|
handlers:
|
|
- import_tasks: playbook_handlers.yml
|
|
|
|
tasks:
|
|
- name: Permit traffic in default zone for http service
|
|
ansible.posix.firewalld:
|
|
zone: public
|
|
service: http
|
|
permanent: true
|
|
state: enabled
|
|
|
|
- name: Permit traffic in default zone for https service
|
|
ansible.posix.firewalld:
|
|
zone: public
|
|
service: https
|
|
permanent: true
|
|
state: enabled
|
|
notify:
|
|
- Restart firewalld
|
|
|
|
- name: Tailscale
|
|
hosts: tailscale_home
|
|
roles:
|
|
- role: artis3n.tailscale
|
|
vars:
|
|
# Pull Tailscale auth key from environment variable
|
|
tailscale_authkey: "{{ lookup('ansible.builtin.env', 'TAILSCALE_KEY') }}"
|
|
tailscale_args: "--ssh --advertise-exit-node"
|
|
pre_tasks:
|
|
- name: Debug - Check Tailscale key (will be partially redacted)
|
|
debug:
|
|
msg: "Key exists and starts with: {{ lookup('ansible.builtin.env', 'TAILSCALE_KEY')[0:10] }}..."
|
|
|
|
- name: Install and configure Caddy
|
|
hosts: caddy_servers
|
|
become: true
|
|
roles:
|
|
- caddy
|
|
|
|
# - import_playbook: baseline/proxmox/main.yml
|
|
# - name: Tailscale Home
|
|
# hosts: tailscale_home
|
|
# roles:
|
|
# - role: artis3n.tailscale
|
|
# vars:
|
|
# # Example pulling the API key from the env vars on the host running Ansible
|
|
# tailscale_authkey: "{{ lookup('env', 'TAILSCALE_KEY') }}"
|
|
# tailscale_args: "--ssh --advertise-exit-node --advertise-routes=10.0.16.0/22"
|