From 5736e305e4f7c1b6c194cd1c4b73801e05d349e7 Mon Sep 17 00:00:00 2001 From: Amritanshu Date: Mon, 22 Jan 2024 14:41:55 +0530 Subject: [PATCH] Gitea broken into roles for better management. Changed hosts to gondor so that limiting is not necessary --- gitea/playbook.yml | 140 ++---------------------- gitea/roles/gitea/tasks/main.yaml | 34 ++++++ gitea/roles/nginx/defaults/main.yaml | 2 + gitea/roles/nginx/handlers/main.yaml | 6 + gitea/roles/nginx/tasks/main.yaml | 24 ++++ gitea/roles/passthrough/tasks/main.yaml | 20 ++++ gitea/roles/sshkey/tasks/main.yaml | 47 ++++++++ gitea/roles/user/tasks/main.yaml | 7 ++ 8 files changed, 147 insertions(+), 133 deletions(-) create mode 100644 gitea/roles/gitea/tasks/main.yaml create mode 100644 gitea/roles/nginx/defaults/main.yaml create mode 100644 gitea/roles/nginx/handlers/main.yaml create mode 100644 gitea/roles/nginx/tasks/main.yaml create mode 100644 gitea/roles/passthrough/tasks/main.yaml create mode 100644 gitea/roles/sshkey/tasks/main.yaml create mode 100644 gitea/roles/user/tasks/main.yaml diff --git a/gitea/playbook.yml b/gitea/playbook.yml index 4d739bf..cd23cc2 100755 --- a/gitea/playbook.yml +++ b/gitea/playbook.yml @@ -2,140 +2,14 @@ # DO Community Playbooks: Docker ################################################# --- -- hosts: all +- hosts: gondor become: true vars_files: - vars/default.yml - tasks: - - name: Add the user 'git' - user: - name: "{{ user }}" - comment: Git user - create_home: yes - - - name: Check if ssh passthrough file exists - stat: - path: /usr/local/bin/gitea - register: pass_status - - - name: No need to upload ssh passthrough file - when: pass_status.stat.exists == true - debug: - msg: No need to upload ssh passthrough file as it already exists. - - - name: Upload ssh passthrough file - when: pass_status.stat.exists == false - template: - src: "files/gitea" - dest: "/usr/local/bin/gitea" - owner: "{{ user }}" - group: "{{ user }}" - mode: 0755 - - - name: Ensure SSH Directory exists - file: - path: /home/git/.ssh - state: directory - group: git - owner: git - mode: 0700 - - - name: Check if rsa key exists - stat: - path: /home/git/.ssh/id_rsa - register: key_status - - - name: No need to generate new rsa key - when: key_status.stat.exists == true - debug: - msg: No need to generate new rsa key as it already exists. - - - name: Generate new rsa key - when: key_status.stat.exists == false - shell: ssh-keygen -t rsa -b 4096 -q -f /home/git/.ssh/id_rsa -C "Gitea Host Key" -N "" - - - name: Ensure rsa key permissions - file: - path: /home/git/.ssh/id_rsa - group: git - owner: git - mode: 0600 - - - name: Ensure rsa public key permissions - file: - path: /home/git/.ssh/id_rsa.pub - group: git - owner: git - mode: 0644 - - - name: Add key to authorized_files - when: key_status.stat.exists == false - copy: - remote_src: yes - src: /home/git/.ssh/id_rsa.pub - dest: /home/git/.ssh/authorized_keys - owner: git - group: git - mode: 0644 - - - name: Pull Gitea image - docker_image: - name: "{{ container_image }}" - source: pull - state: present - force_source: yes - - - getent: - database: passwd - key: "{{ user }}" - split: ":" - - - name: Create gitea container - docker_container: - name: "{{ container_name }}" - image: "{{ container_image }}" - state: started - restart_policy: "unless-stopped" - cpus: .10 - memory: "512M" - memory_swap: "512M" - env: - USER_UID: "{{ getent_passwd[user][1] }}" - USER_GID: "{{ getent_passwd[user][2] }}" - published_ports: - - "127.0.0.1:3000:3000" - - "127.0.0.1:2222:22" - volumes: - - /var/lib/gitea:/data - - /etc/timezone:/etc/timezone:ro - - /etc/localtime:/etc/localtime:ro - - "/home/{{ user }}/.ssh/:/data/git/.ssh" - - - name: Check if Nginx conf file exists - stat: path="/etc/nginx/sites-available/{{ http_conf }}" - register: status - - - name: No need to reload Nginx - debug: msg= {{ "No need to reload Nginx as sites-available entries have already been created" }} - - - name: Set Nginx conf file - when: status.stat.exists == false - template: - src: "files/nginx.conf.j2" - dest: "/etc/nginx/sites-available/{{ http_conf }}" - - - name: Enable new site - when: status.stat.exists == false - file: - src: "/etc/nginx/sites-available/{{ http_conf }}" - dest: "/etc/nginx/sites-enabled/{{ http_conf }}" - state: link - notify: Reload Nginx - - handlers: - - name: Reload Nginx - service: - name: nginx - state: reloaded - + roles: + - user + - passthrough + - sshkey + - gitea + - nginx diff --git a/gitea/roles/gitea/tasks/main.yaml b/gitea/roles/gitea/tasks/main.yaml new file mode 100644 index 0000000..1fe8163 --- /dev/null +++ b/gitea/roles/gitea/tasks/main.yaml @@ -0,0 +1,34 @@ +--- +# Tasks for Gitea role +- name: Pull Gitea image + docker_image: + name: "{{ container_image }}" + source: pull + state: present + force_source: yes + +- getent: + database: passwd + key: "{{ user }}" + split: ":" + +- name: Create gitea container + docker_container: + name: "{{ container_name }}" + image: "{{ container_image }}" + state: started + restart_policy: "unless-stopped" + cpus: .10 + memory: "512M" + memory_swap: "512M" + env: + USER_UID: "{{ getent_passwd[user][1] }}" + USER_GID: "{{ getent_passwd[user][2] }}" + published_ports: + - "127.0.0.1:3000:3000" + - "127.0.0.1:2222:22" + volumes: + - /var/lib/gitea:/data + - /etc/timezone:/etc/timezone:ro + - /etc/localtime:/etc/localtime:ro + - "/home/{{ user }}/.ssh/:/data/git/.ssh" diff --git a/gitea/roles/nginx/defaults/main.yaml b/gitea/roles/nginx/defaults/main.yaml new file mode 100644 index 0000000..85c5e6d --- /dev/null +++ b/gitea/roles/nginx/defaults/main.yaml @@ -0,0 +1,2 @@ +--- +# Default variables for Nginx role diff --git a/gitea/roles/nginx/handlers/main.yaml b/gitea/roles/nginx/handlers/main.yaml new file mode 100644 index 0000000..622fd36 --- /dev/null +++ b/gitea/roles/nginx/handlers/main.yaml @@ -0,0 +1,6 @@ +--- +# Handlers for Nginx role +- name: Reload Nginx + service: + name: nginx + state: reloaded diff --git a/gitea/roles/nginx/tasks/main.yaml b/gitea/roles/nginx/tasks/main.yaml new file mode 100644 index 0000000..4441fe7 --- /dev/null +++ b/gitea/roles/nginx/tasks/main.yaml @@ -0,0 +1,24 @@ +--- +# Tasks for Nginx role +- name: Check if Nginx conf file exists + stat: + path: "/etc/nginx/sites-available/{{ http_conf }}" + register: status + +- name: No need to reload Nginx + debug: + msg: "No need to reload Nginx as sites-available entries have already been created" + +- name: Set Nginx conf file + when: status.stat.exists == false + template: + src: "files/nginx.conf.j2" + dest: "/etc/nginx/sites-available/{{ http_conf }}" + +- name: Enable new site + when: status.stat.exists == false + file: + src: "/etc/nginx/sites-available/{{ http_conf }}" + dest: "/etc/nginx/sites-enabled/{{ http_conf }}" + state: link + notify: Reload Nginx diff --git a/gitea/roles/passthrough/tasks/main.yaml b/gitea/roles/passthrough/tasks/main.yaml new file mode 100644 index 0000000..9b54d93 --- /dev/null +++ b/gitea/roles/passthrough/tasks/main.yaml @@ -0,0 +1,20 @@ +--- +# Tasks for Passthrough role +- name: Check if ssh passthrough file exists + stat: + path: /usr/local/bin/gitea + register: pass_status + +- name: No need to upload ssh passthrough file + when: pass_status.stat.exists == true + debug: + msg: No need to upload ssh passthrough file as it already exists. + +- name: Upload ssh passthrough file + when: pass_status.stat.exists == false + template: + src: "files/gitea" + dest: "/usr/local/bin/gitea" + owner: "{{ user }}" + group: "{{ user }}" + mode: 0755 diff --git a/gitea/roles/sshkey/tasks/main.yaml b/gitea/roles/sshkey/tasks/main.yaml new file mode 100644 index 0000000..51594d3 --- /dev/null +++ b/gitea/roles/sshkey/tasks/main.yaml @@ -0,0 +1,47 @@ +--- +# Tasks for SSH Key role +- name: Ensure SSH Directory exists + file: + path: "/home/{{ user }}/.ssh" + state: directory + group: "{{ user }}" + owner: "{{ user }}" + mode: 0700 + +- name: Check if id_ed25519 key exists + stat: + path: "/home/{{ user }}/.ssh/id_ed25519" + register: key_status + +- name: No need to generate new id_ed25519 key + when: key_status.stat.exists == true + debug: + msg: No need to generate new rsa key as it already exists. + +- name: Generate new rsa key + when: key_status.stat.exists == false + shell: ssh-keygen -t ed25519 -q -f /home/git/.ssh/id_ed25519 -C "Gitea Host Key" -N "" + +- name: Ensure id_ed25519 key permissions + file: + path: "/home/{{ user }}/.ssh/id_ed25519" + group: "{{ user }}" + owner: "{{ user }}" + mode: 0600 + +- name: Ensure id_ed25519 public key permissions + file: + path: "/home/{{ user }}/.ssh/id_ed25519.pub" + group: "{{ user }}" + owner: "{{ user }}" + mode: 0644 + +- name: Add key to authorized_files + when: key_status.stat.exists == false + copy: + remote_src: yes + src: "/home/{{ user }}/.ssh/id_ed25519.pub" + dest: "/home/{{ user }}/.ssh/authorized_keys" + owner: "{{ user }}" + group: "{{ user }}" + mode: 0644 diff --git a/gitea/roles/user/tasks/main.yaml b/gitea/roles/user/tasks/main.yaml new file mode 100644 index 0000000..d8518de --- /dev/null +++ b/gitea/roles/user/tasks/main.yaml @@ -0,0 +1,7 @@ +--- +# Tasks for User role +- name: Add the user 'git' + user: + name: "{{ user }}" + comment: Git user + create_home: yes