Feat: add link role

roles/podman_link/templates/bridge-postgresql.container

@@ -0,0 +1,11 @@
+[Container]
+ContainerName=bridge-postgresql
+EnvironmentFile=common-bridge.env
+Image=registry.gitlab.com/digiresilience/link/link-stack/postgresql:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/bridge-postgresql-data:/var/lib/postgresql/data
+Network=link.network
+
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/bridge-whatsapp.container

@@ -0,0 +1,17 @@
+[Unit]
+Requires=bridge-postgresql.service link.service
+After=bridge-postgresql.service link.service
+
+[Container]
+ContainerName=bridge-whatsapp
+Environment=BRIDGE_FRONTEND_URL=http://systemd-link:3000/link
+EnvironmentFile=common-bridge.env
+ExposeHostPort=5000
+Image=registry.gitlab.com/digiresilience/link/link-stack/bridge-whatsapp:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/bridge-whatsapp-data:/home/node/baileys
+Network=link.network
+
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/bridge-worker.container

@@ -0,0 +1,13 @@
+[Unit]
+Requires=bridge-postgresql.service link.service
+After=bridge-postgresql.service link.service
+
+[Container]
+ContainerName=bridge-worker
+EnvironmentFile=common-bridge.env
+Image=registry.gitlab.com/digiresilience/link/link-stack/bridge-worker:3.1.0b2
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/common-bridge.env

@@ -0,0 +1,18 @@
+POSTGRES_USER={{ podman_link_postgres_link_user }}
+POSTGRES_PASSWORD={{ podman_link_postgres_link_password }}
+POSTGRES_DB={{ podman_link_postgres_link_database }}
+NEXTAUTH_URL=https://{{ podman_link_web_hostname }}/link/api/auth
+NEXTAUTH_SECRET={{ podman_link_nextauth_secret }}
+GOOGLE_CLIENT_ID={{ podman_link_google_client_id }}
+GOOGLE_CLIENT_SECRET={{ podman_link_google_client_secret }}
+BRIDGE_FRONTEND_URL=http://link:3000
+BRIDGE_SIGNAL_URL=http://signal-cli-rest-api:8081
+BRIDGE_WHATSAPP_URL=http://bridge-whatsapp:5000
+DATABASE_NAME={{ podman_link_postgres_link_database }}
+DATABASE_HOST=bridge-postgresql
+DATABASE_USER={{ podman_link_postgres_link_user }}
+DATABASE_PASSWORD={{ podman_link_postgres_link_password }}
+DATABASE_PORT=5432
+DATABASE_URL=postgresql://{{ podman_link_postgres_link_user }}:{{ podman_link_postgres_link_password }}@bridge-postgresql/{{ podman_link_postgres_link_database}}
+TZ=Etc/UTC
+

roles/podman_link/templates/common-zammad.env

@@ -0,0 +1,13 @@
+POSTGRESQL_HOST=zammad-postgresql
+POSTGRESQL_PASS={{ podman_link_postgres_zammad_password }}
+POSTGRESQL_USER={{ podman_link_postgres_zammad_user }}
+POSTGRESQL_DB={{ podman_link_postgres_zammad_database }}
+POSTGRESQL_OPTIONS=?pool=50
+REDIS_URL=redis://default:{{ podman_link_zammad_redis_password }}@zammad-redis:6379
+MEMCACHE_SERVERS=zammad-memcached:11211
+ELASTICSEARCH_HOST=zammad-opensearch
+ELASTICSEARCH_USER=admin
+ELASTICSEARCH_PASS={{ podman_link_opensearch_password }}
+ELASTICSEARCH_SCHEMA=https
+ELASTICSEARCH_REINDEX=true
+ELASTICSEARCH_SSL_VERIFY=false

roles/podman_link/templates/frontend.network

@@ -0,0 +1,2 @@
+[Network]
+NetworkName=frontend

roles/podman_link/templates/link.container

@@ -0,0 +1,21 @@
+[Unit]
+Requires=bridge-postgresql.service
+After=bridge-postgresql.service
+
+[Container]
+ContainerName=link
+Environment=ZAMMAD_VIRTUAL_HOST={{ podman_link_web_hostname }}
+Environment=SETUP_MODE={{ podman_link_setup_mode }}
+Environment=LEAFCUTTER_ENABLED={{ podman_link_leafcutter_enabled }}
+Environment=LEAFCUTTER_DEFAULT_DASHBOARD_URL={{ podman_link_dashboard_url }}
+Environment=ZAMMAD_API_TOKEN={{ podman_link_zammad_api_token }}
+Environment=LINK_URL=https://localhost:3000/link
+Environment=ZAMMAD_URL=http://zammad-nginx:8080
+EnvironmentFile=common-bridge.env
+ExposeHostPort=3000
+Image=registry.gitlab.com/digiresilience/link/link-stack/link:3.1.0b2
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/link.network

@@ -0,0 +1,2 @@
+[Network]
+NetworkName=link

roles/podman_link/templates/link.slice

@@ -0,0 +1,22 @@
+[Unit]
+Description=Link Slice
+Before=slices.target
+Requires=zammad-init.service
+Requires=zammad-memcached.service
+Requires=zammad-postgresql.service
+Requires=zammad-redis.service
+Requires=zammad-railsserver.service
+Requires=zammad-scheduler.service
+Requires=zammad-websocket.service
+Requires=zammad-opensearch.service
+Requires=link.service
+Requires=bridge-postgresql.service
+Requires=zammad-nginx.service
+Requires=signal-cli-rest-api.service
+Requires=bridge-whatsapp.service
+Requires=bridge-worker.service
+Requires=opensearch-dashboards.service
+Requires=nginx.service
+
+[Install]
+WantedBy=default.target

roles/podman_link/templates/nginx.conf

@@ -0,0 +1,91 @@
+# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
+# scheme used to connect to this server
+map $http_x_forwarded_proto $proxy_x_forwarded_proto {
+  default $http_x_forwarded_proto;
+  ''      $scheme;
+}
+# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
+# server port the client connected to
+map $http_x_forwarded_port $proxy_x_forwarded_port {
+  default $http_x_forwarded_port;
+  ''      $server_port;
+}
+# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
+# Connection header that may have been passed to this server
+map $http_upgrade $proxy_connection {
+  default upgrade;
+  '' close;
+}
+# Apply fix for very long server names
+server_names_hash_bucket_size 128;
+# Default dhparam
+# Set appropriate X-Forwarded-Ssl header
+map $scheme $proxy_x_forwarded_ssl {
+  default off;
+  https on;
+}
+gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+log_format vhost '$host $remote_addr - $remote_user [$time_local] '
+                 '"$request" $status $body_bytes_sent '
+                 '"$http_referer" "$http_user_agent"';
+access_log off;
+# HTTP 1.1 support
+proxy_http_version 1.1;
+proxy_buffering off;
+proxy_set_header Host $http_host;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection $proxy_connection;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
+proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
+# Mitigate httpoxy attack (see README for details)
+proxy_set_header Proxy "";
+
+server {
+    listen 80;
+    listen [::]:80;
+
+    server_name {{ podman_link_web_hostname }};
+    server_tokens off;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://{{ podman_link_web_hostname }}$request_uri;
+    }
+}
+
+upstream zammad {
+			server zammad-nginx:8080;
+}
+
+server {
+	server_name {{ podman_link_web_hostname }};
+	listen 80 ;
+	access_log /var/log/nginx/access.log vhost;
+	return 301 https://$host$request_uri;
+}
+
+server {
+	server_name {{ podman_link_web_hostname }};
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_tokens off;
+
+    ssl_certificate /etc/letsencrypt/live/{{ podman_link_web_hostname }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ podman_link_web_hostname }}/privkey.pem;
+
+
+	add_header Strict-Transport-Security "max-age=31536000" always;
+	add_header Referrer-Policy origin always; # make sure outgoing links don't show the URL to the Matomo instance
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+	location / {
+		proxy_pass http://zammad;
+	}
+}

roles/podman_link/templates/opensearch-config.yml

@@ -0,0 +1,36 @@
+_meta:
+  type: "config"
+  config_version: 2
+
+config:
+  dynamic:
+    http:
+      anonymous_auth_enabled: false
+      xff:
+        enabled: true
+        remoteIpHeader: "x-forwarded-for"
+        internalProxies: ".*"
+    authc:
+      basic_internal_auth_domain:
+        description: "Authenticate via HTTP Basic against internal users database"
+        http_enabled: true
+        transport_enabled: true
+        order: 0
+        http_authenticator:
+          type: basic
+          challenge: false
+        authentication_backend:
+          type: intern
+      proxy_auth_domain:
+        description: "Authenticate via proxy"
+        http_enabled: true
+        transport_enabled: true
+        order: 1
+        http_authenticator:
+          type: proxy
+          challenge: false
+          config:
+            user_header: "x-forwarded-user"
+            roles_header: "x-forwarded-roles"
+        authentication_backend:
+          type: noop

roles/podman_link/templates/opensearch-dashboards.container

@@ -0,0 +1,16 @@
+[Unit]
+Requires=zammad-opensearch.service
+After=zammad-opensearch.service
+
+[Container]
+ContainerName=opensearch-dashboards
+Environment=OPENSEARCH_USERNAME="kibanaserver"
+Environment=OPENSEARCH_PASSWORD="kibanaserver"
+Image=registry.gitlab.com/digiresilience/link/link-stack/opensearch-dashboards:3.1.0b2
+PublishPort=127.0.0.1:5601:5601
+#Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-dashboards-config.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/signal-cli-rest-api.container

@@ -0,0 +1,16 @@
+[Unit]
+Requires=link.service
+After=link.service
+
+[Container]
+ContainerName=signal-cli-rest-api
+Environment=MODE=native
+Environment=PORT=8081
+ExposeHostPort=8081
+Image=registry.gitlab.com/digiresilience/link/link-stack/signal-cli-rest-api:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/signal-cli-rest-api-data:/home/.local/share/signal-cli
+Network=link.network
+
+[Service]
+Restart=always
+slice=link.slice

roles/podman_link/templates/zammad-database.yml

@@ -0,0 +1,9 @@
+production:
+  adapter: postgresql
+  database: {{ podman_link_postgres_zammad_database }}
+  pool: 50
+  timeout: 5000
+  encoding: utf8
+  username: {{ podman_link_postgres_zammad_user }}
+  password: {{ podman_link_postgres_zammad_password }}
+  host: zammad-postgresql

roles/podman_link/templates/zammad-init.container

@@ -0,0 +1,21 @@
+[Unit]
+Requires=zammad-postgresql.service
+After=zammad-postgresql.service
+Requires=zammad-redis.service
+After=zammad-redis.service
+Requires=zammad-memcached.service
+After=zammad-memcached.service
+
+[Container]
+ContainerName=zammad-init
+EnvironmentFile=common-zammad.env
+Exec=zammad-init
+Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-config-nginx:/etc/nginx/sites-enabled
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage:ro
+Network=link.network
+
+[Service]
+Restart=on-failure
+Slice=link.slice

roles/podman_link/templates/zammad-memcached.container

@@ -0,0 +1,10 @@
+[Container]
+ContainerName=zammad-memcached
+Exec=memcached -m 256M
+Image=registry.gitlab.com/digiresilience/link/link-stack/memcached:3.1.0b2
+Network=link.network
+ExposeHostPort=11211
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/zammad-nginx.container

@@ -0,0 +1,18 @@
+[Unit]
+Requires=zammad-railsserver.service
+After=zammad-railsserver.service
+
+[Container]
+ContainerName=zammad-nginx
+EnvironmentFile=common-zammad.env
+Exec=zammad-nginx
+ExposeHostPort=8080
+Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-config-nginx:/etc/nginx/sites-enabled
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var:ro
+Network=link.network
+Network=frontend.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/zammad-opensearch.container

@@ -0,0 +1,24 @@
+[Container]
+ContainerName=zammad-opensearch
+Environment=discovery.type=single-node
+Environment=plugins.security.ssl.transport.enforce_hostname_verification=false
+Environment=plugins.security.ssl.transport.resolve_hostname=false
+Environment=cluster.routing.allocation.disk.watermark.low=3gb
+Environment=cluster.routing.allocation.disk.watermark.high=2gb
+Environment=cluster.routing.allocation.disk.watermark.flood_stage=500mb
+Environment=cluster.info.update.interval=1m
+Environment=node.name=opensearch-node1
+Environment=bootstrap.memory_lock=true
+Environment=OPENSEARCH_JAVA_OPTS="-Xms{{ podman_link_opensearch_memory_limit }}m -Xmx{{podman_link_opensearch_memory_limit }}m -XX:-HeapDumpOnOutOfMemoryError"
+Environment=OPENSEARCH_INITIAL_ADMIN_PASSWORD={{ podman_link_opensearch_password }}
+Environment=compatibility.override_main_response_version=true
+Image=registry.gitlab.com/digiresilience/link/link-stack/opensearch:3.1.0b2
+PublishPort=127.0.0.1:9200:9200
+PublishPort=127.0.0.1:9600:9600
+Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-data:/usr/share/opensearch/data
+Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-config.yml:/usr/share/opensearch/config/opensearch-security/config.yml
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/zammad-postgresql.container

@@ -0,0 +1,17 @@
+[Container]
+ContainerName=zammad-postgresql
+Environment=POSTGRES_PASSWORD={{ podman_link_postgres_zammad_password }}
+Environment=POSTGRES_USER={{ podman_link_postgres_zammad_user }}
+Environment=POSTGRES_DB={{ podman_link_postgres_zammad_database }}
+Environment=POSTGRES_HOST_AUTH_METHOD=scram-sha-256
+Environment=POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256
+Image=registry.gitlab.com/digiresilience/link/link-stack/postgresql:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/postgresql-data:/var/lib/postgresql/data
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-data:/opt/zammad
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-backup:/var/tmp/zammad:ro
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice
+

roles/podman_link/templates/zammad-railsserver.container

@@ -0,0 +1,17 @@
+[Unit]
+Requires=zammad-memcached.service zammad-redis.service zammad-postgresql.service
+After=zammad-memcached.service zammad-redis.service zammad-postgresql.service
+
+[Container]
+ContainerName=zammad-railsserver
+EnvironmentFile=common-zammad.env
+Exec=zammad-railsserver
+Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-database.yml:/opt/zammad/config/database.yml:ro
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/zammad-redis.container

@@ -0,0 +1,10 @@
+[Container]
+ContainerName=zammad-redis
+Environment=REDIS_PASSWORD={{ podman_link_zammad_redis_password }}
+Image=registry.gitlab.com/digiresilience/link/link-stack/redis:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/redis-data:/data
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/zammad-scheduler.container

@@ -0,0 +1,16 @@
+[Unit]
+Requires=zammad-memcached.service zammad-railsserver.service zammad-redis.service
+After=zammad-memcached.service zammad-railsserver.service zammad-redis.service
+
+[Container]
+ContainerName=zammad-scheduler
+EnvironmentFile=common-zammad.env
+Exec=zammad-scheduler
+Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/zammad-websocket.container

@@ -0,0 +1,16 @@
+[Unit]
+Requires=zammad-memcached.service zammad-railsserver.service zammad-redis.service
+After=zammad-memcached.service zammad-railsserver.service zammad-redis.service
+
+[Container]
+ContainerName=zammad-websocket
+EnvironmentFile=common-zammad.env
+Exec=zammad-websocket
+Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice