forked from irl/ansible-collection-wip
Compare commits
No commits in common. "link" and "main" have entirely different histories.
26 changed files with 0 additions and 716 deletions
|
|
@ -1,25 +0,0 @@
|
||||||
podman_link_podman_rootless_user: link
|
|
||||||
podman_link_web_hostname: "{{ inventory_hostname }}"
|
|
||||||
podman_link_postgres_zammad_user: postgres
|
|
||||||
podman_link_postgres_zammad_database: zammad_production
|
|
||||||
podman_link_postgres_link_user: link
|
|
||||||
podman_link_postgres_link_database: link
|
|
||||||
# podman_link_postgres_zammad_password:
|
|
||||||
# podman_link_postgres_link_password:
|
|
||||||
# podman_link_postgres_root_password:
|
|
||||||
# podman_link_zammad_redis_password:
|
|
||||||
# podman_link_opensearch_password:
|
|
||||||
podman_link_opensearch_memory_limit: 2048
|
|
||||||
podman_link_setup_mode: false
|
|
||||||
podman_link_leafcutter_enabled: false
|
|
||||||
podman_link_dashboard_url: ""
|
|
||||||
podman_link_zammad_api_token: ""
|
|
||||||
# podman_link_nextauth_secret:
|
|
||||||
# podman_link_google_client_id:
|
|
||||||
# podman_link_google_client_secret:
|
|
||||||
#
|
|
||||||
# the following may seem useless, but unless they are included as variables in the environment file template,
|
|
||||||
# they automatically get wrapped in quotes by systemd causing zammad to not connect
|
|
||||||
podman_link_postgres_zammad_postgresql_host: zammad-postgresql
|
|
||||||
podman_link_postgres_zammad_es_host: opensearch
|
|
||||||
podman_link_postgres_zammad_memcached_server: zammad-memcached:11211
|
|
||||||
|
|
@ -1,26 +0,0 @@
|
||||||
- name: restart zammad-init
|
|
||||||
ansible.builtin.systemd_service:
|
|
||||||
name: zammad-init
|
|
||||||
state: restarted
|
|
||||||
scope: user
|
|
||||||
daemon_reload: true
|
|
||||||
become: true
|
|
||||||
become_user: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
|
|
||||||
- name: restart zammad-postgresql
|
|
||||||
ansible.builtin.systemd_service:
|
|
||||||
name: zammad-postgresql
|
|
||||||
state: restarted
|
|
||||||
scope: user
|
|
||||||
daemon_reload: true
|
|
||||||
become: true
|
|
||||||
become_user: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
|
|
||||||
- name: restart link.slice
|
|
||||||
ansible.builtin.systemd_service:
|
|
||||||
name: link.slice
|
|
||||||
state: restarted
|
|
||||||
scope: user
|
|
||||||
daemon_reload: true
|
|
||||||
become: true
|
|
||||||
become_user: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
|
|
@ -1,229 +0,0 @@
|
||||||
---
|
|
||||||
- name: create service configuration directories
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "/home/{{ podman_link_podman_rootless_user }}/{{ item }}"
|
|
||||||
state: directory
|
|
||||||
owner: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
group: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
mode: "0755"
|
|
||||||
become: true
|
|
||||||
with_items:
|
|
||||||
- zammad-storage
|
|
||||||
- zammad-var
|
|
||||||
- zammad-backup
|
|
||||||
- zammad-data
|
|
||||||
- signal-cli-rest-api-data
|
|
||||||
- bridge-postgresql-data
|
|
||||||
- bridge-whatsapp-data
|
|
||||||
- redis-data
|
|
||||||
- postgresql-data
|
|
||||||
|
|
||||||
- name: create configuration directories where containers need to execute scripts
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "/home/{{ podman_link_podman_rootless_user }}/{{ item }}"
|
|
||||||
state: directory
|
|
||||||
owner: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
group: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
mode: "0777"
|
|
||||||
become: true
|
|
||||||
with_items:
|
|
||||||
- zammad-config-nginx
|
|
||||||
- opensearch-data
|
|
||||||
|
|
||||||
- name: install zammad railsserver database configuration file
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: "{{ item }}"
|
|
||||||
dest: "/home/{{ podman_link_podman_rootless_user }}/{{ item }}"
|
|
||||||
owner: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
group: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
mode: "0444"
|
|
||||||
become: true
|
|
||||||
with_items:
|
|
||||||
- zammad-database.yml
|
|
||||||
|
|
||||||
- name: install env configuration files
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: "{{ item }}"
|
|
||||||
dest: "/home/{{ podman_link_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
|
|
||||||
owner: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
mode: "0600"
|
|
||||||
become: true
|
|
||||||
with_items:
|
|
||||||
- common-zammad.env
|
|
||||||
- common-bridge.env
|
|
||||||
|
|
||||||
- name: Set sysctl settings for elasticsearch
|
|
||||||
sysctl:
|
|
||||||
name: vm.max_map_count
|
|
||||||
value: '262144'
|
|
||||||
state: present
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: Set vm.overcommit_memory for Memcached
|
|
||||||
sysctl:
|
|
||||||
name: vm.overcommit_memory
|
|
||||||
value: '1'
|
|
||||||
state: present
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: install opensearch config
|
|
||||||
ansible.builtin.copy:
|
|
||||||
src: templates/opensearch-config.yml
|
|
||||||
dest: "/home/{{ podman_link_podman_rootless_user }}/opensearch-config.yml"
|
|
||||||
mode: "0444"
|
|
||||||
owner: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
group: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: install podman quadlet for rootless podman user
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: "{{ item }}"
|
|
||||||
dest: "/home/{{ podman_link_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
|
|
||||||
owner: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
mode: "0400"
|
|
||||||
with_items:
|
|
||||||
- link.container
|
|
||||||
- zammad-opensearch.container
|
|
||||||
- opensearch-dashboards.container
|
|
||||||
- bridge-worker.container
|
|
||||||
- bridge-postgresql.container
|
|
||||||
- bridge-whatsapp.container
|
|
||||||
- signal-cli-rest-api.container
|
|
||||||
- zammad-init.container
|
|
||||||
- zammad-nginx.container
|
|
||||||
- zammad-railsserver.container
|
|
||||||
- zammad-scheduler.container
|
|
||||||
- zammad-postgresql.container
|
|
||||||
- zammad-websocket.container
|
|
||||||
- zammad-redis.container
|
|
||||||
- zammad-memcached.container
|
|
||||||
become: true
|
|
||||||
|
|
||||||
|
|
||||||
- name: install network quadlets for rootless podman user
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: "{{ item }}"
|
|
||||||
dest: "/home/{{ podman_link_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
|
|
||||||
owner: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
mode: "0400"
|
|
||||||
with_items:
|
|
||||||
- frontend.network
|
|
||||||
- link.network
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: verify quadlets are correctly defined
|
|
||||||
ansible.builtin.command: /usr/libexec/podman/quadlet -dryrun -user
|
|
||||||
register: podman_link_quadlet_result
|
|
||||||
ignore_errors: true
|
|
||||||
changed_when: false
|
|
||||||
become: true
|
|
||||||
become_user: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
|
|
||||||
- name: assert that the quadlet verification succeeded
|
|
||||||
ansible.builtin.assert:
|
|
||||||
that:
|
|
||||||
- podman_link_quadlet_result.rc == 0
|
|
||||||
fail_msg: "'/usr/libexec/podman/quadlet -dryrun -user' failed! Output withheld to prevent leaking secrets."
|
|
||||||
|
|
||||||
#- name: set up nginx
|
|
||||||
# ansible.builtin.include_role:
|
|
||||||
# name: irl.wip.podman_nginx
|
|
||||||
# vars:
|
|
||||||
# podman_nginx_frontend_network: frontend
|
|
||||||
# podman_nginx_podman_rootless_user: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
# podman_nginx_primary_hostname: "{{ podman_link_web_hostname }}"
|
|
||||||
# podman_nginx_systemd_service_slice: "link.slice"
|
|
||||||
# podman_nginx_systemd_service_requires: ["zammad-nginx"]
|
|
||||||
#
|
|
||||||
#
|
|
||||||
#- name: create nginx configuration file
|
|
||||||
# ansible.builtin.template:
|
|
||||||
# src: nginx.conf
|
|
||||||
# dest: "/home/{{ podman_link_podman_rootless_user }}/nginx/nginx.conf"
|
|
||||||
# owner: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
# group: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
# mode: "0644"
|
|
||||||
# become: true
|
|
||||||
|
|
||||||
- name: install services slice for rootless podman user
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: "link.slice"
|
|
||||||
dest: "/home/{{ podman_link_podman_rootless_user }}/.config/systemd/user/link.slice"
|
|
||||||
owner: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
group: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
mode: "0655"
|
|
||||||
become: true
|
|
||||||
|
|
||||||
- name: make sure services are started on boot
|
|
||||||
ansible.builtin.systemd_service:
|
|
||||||
name: "link.slice"
|
|
||||||
enabled: true
|
|
||||||
state: started
|
|
||||||
daemon_reload: true
|
|
||||||
scope: user
|
|
||||||
become: true
|
|
||||||
become_user: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
notify:
|
|
||||||
- "restart link.slice"
|
|
||||||
|
|
||||||
|
|
||||||
- name: set es verify false
|
|
||||||
ansible.builtin.shell: >
|
|
||||||
podman exec zammad-railsserver rails r "Setting.set('es_ssl_verify', false)"
|
|
||||||
become: true
|
|
||||||
become_user: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
notify:
|
|
||||||
- "restart link.slice"
|
|
||||||
register: es_ssl_result
|
|
||||||
retries: 20
|
|
||||||
delay: 5
|
|
||||||
until: es_ssl_result.rc == 0
|
|
||||||
|
|
||||||
- name: Run OpenSearch setup script
|
|
||||||
ansible.builtin.shell: |
|
|
||||||
podman exec zammad-opensearch /bin/sh -c '
|
|
||||||
if [ ! -f /tmp/.securityadmin_done ]; then
|
|
||||||
chmod +x /usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh && \
|
|
||||||
/usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh \
|
|
||||||
-cd /usr/share/opensearch/config/opensearch-security/ \
|
|
||||||
-icl \
|
|
||||||
-key /usr/share/opensearch/config/kirk-key.pem \
|
|
||||||
-cert /usr/share/opensearch/config/kirk.pem \
|
|
||||||
-cacert /usr/share/opensearch/config/root-ca.pem \
|
|
||||||
-nhnv && \
|
|
||||||
touch /tmp/.securityadmin_done
|
|
||||||
fi
|
|
||||||
'
|
|
||||||
become: true
|
|
||||||
become_user: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
register: securityadmin_scipt_result
|
|
||||||
retries: 20
|
|
||||||
delay: 5
|
|
||||||
until: securityadmin_scipt_result.rc == 0
|
|
||||||
notify:
|
|
||||||
- "restart link.slice"
|
|
||||||
|
|
||||||
- name: set up nginx
|
|
||||||
ansible.builtin.include_role:
|
|
||||||
name: irl.wip.podman_nginx
|
|
||||||
vars:
|
|
||||||
podman_nginx_frontend_network: frontend
|
|
||||||
podman_nginx_podman_rootless_user: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
podman_nginx_primary_hostname: "{{ podman_link_web_hostname }}"
|
|
||||||
podman_nginx_systemd_service_slice: link.slice
|
|
||||||
podman_nginx_systemd_service_requires: ["zammad-nginx"]
|
|
||||||
# podman_nginx_additional_volumes:
|
|
||||||
# - src: "/home/{{ podman_cleaninsights_podman_rootless_user }}/matomo"
|
|
||||||
# dest: "/var/www/html"
|
|
||||||
# options: "ro"
|
|
||||||
|
|
||||||
- name: create nginx configuration file
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: nginx.conf
|
|
||||||
dest: "/home/{{ podman_link_podman_rootless_user }}/nginx/nginx.conf"
|
|
||||||
owner: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
group: "{{ podman_link_podman_rootless_user }}"
|
|
||||||
mode: "0644"
|
|
||||||
become: true
|
|
||||||
notify:
|
|
||||||
- "restart link.slice"
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
[Container]
|
|
||||||
ContainerName=bridge-postgresql
|
|
||||||
EnvironmentFile=common-bridge.env
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/postgresql:3.1.0b2
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/bridge-postgresql-data:/var/lib/postgresql/data
|
|
||||||
Network=link.network
|
|
||||||
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=always
|
|
||||||
Slice=link.slice
|
|
||||||
|
|
@ -1,17 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Requires=bridge-postgresql.service link.service
|
|
||||||
After=bridge-postgresql.service link.service
|
|
||||||
|
|
||||||
[Container]
|
|
||||||
ContainerName=bridge-whatsapp
|
|
||||||
Environment=BRIDGE_FRONTEND_URL=http://systemd-link:3000/link
|
|
||||||
EnvironmentFile=common-bridge.env
|
|
||||||
ExposeHostPort=5000
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/bridge-whatsapp:3.1.0b2
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/bridge-whatsapp-data:/home/node/baileys
|
|
||||||
Network=link.network
|
|
||||||
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=always
|
|
||||||
Slice=link.slice
|
|
||||||
|
|
@ -1,13 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Requires=bridge-postgresql.service link.service
|
|
||||||
After=bridge-postgresql.service link.service
|
|
||||||
|
|
||||||
[Container]
|
|
||||||
ContainerName=bridge-worker
|
|
||||||
EnvironmentFile=common-bridge.env
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/bridge-worker:3.1.0b2
|
|
||||||
Network=link.network
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=always
|
|
||||||
Slice=link.slice
|
|
||||||
|
|
@ -1,18 +0,0 @@
|
||||||
POSTGRES_USER={{ podman_link_postgres_link_user }}
|
|
||||||
POSTGRES_PASSWORD={{ podman_link_postgres_link_password }}
|
|
||||||
POSTGRES_DB={{ podman_link_postgres_link_database }}
|
|
||||||
NEXTAUTH_URL=https://{{ podman_link_web_hostname }}/link/api/auth
|
|
||||||
NEXTAUTH_SECRET={{ podman_link_nextauth_secret }}
|
|
||||||
GOOGLE_CLIENT_ID={{ podman_link_google_client_id }}
|
|
||||||
GOOGLE_CLIENT_SECRET={{ podman_link_google_client_secret }}
|
|
||||||
BRIDGE_FRONTEND_URL=http://link:3000
|
|
||||||
BRIDGE_SIGNAL_URL=http://signal-cli-rest-api:8081
|
|
||||||
BRIDGE_WHATSAPP_URL=http://bridge-whatsapp:5000
|
|
||||||
DATABASE_NAME={{ podman_link_postgres_link_database }}
|
|
||||||
DATABASE_HOST=bridge-postgresql
|
|
||||||
DATABASE_USER={{ podman_link_postgres_link_user }}
|
|
||||||
DATABASE_PASSWORD={{ podman_link_postgres_link_password }}
|
|
||||||
DATABASE_PORT=5432
|
|
||||||
DATABASE_URL=postgresql://{{ podman_link_postgres_link_user }}:{{ podman_link_postgres_link_password }}@bridge-postgresql/{{ podman_link_postgres_link_database}}
|
|
||||||
TZ=Etc/UTC
|
|
||||||
|
|
||||||
|
|
@ -1,13 +0,0 @@
|
||||||
POSTGRESQL_HOST=zammad-postgresql
|
|
||||||
POSTGRESQL_PASS={{ podman_link_postgres_zammad_password }}
|
|
||||||
POSTGRESQL_USER={{ podman_link_postgres_zammad_user }}
|
|
||||||
POSTGRESQL_DB={{ podman_link_postgres_zammad_database }}
|
|
||||||
POSTGRESQL_OPTIONS=?pool=50
|
|
||||||
REDIS_URL=redis://default:{{ podman_link_zammad_redis_password }}@zammad-redis:6379
|
|
||||||
MEMCACHE_SERVERS=zammad-memcached:11211
|
|
||||||
ELASTICSEARCH_HOST=zammad-opensearch
|
|
||||||
ELASTICSEARCH_USER=admin
|
|
||||||
ELASTICSEARCH_PASS={{ podman_link_opensearch_password }}
|
|
||||||
ELASTICSEARCH_SCHEMA=https
|
|
||||||
ELASTICSEARCH_REINDEX=true
|
|
||||||
ELASTICSEARCH_SSL_VERIFY=false
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
[Network]
|
|
||||||
NetworkName=frontend
|
|
||||||
|
|
@ -1,21 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Requires=bridge-postgresql.service
|
|
||||||
After=bridge-postgresql.service
|
|
||||||
|
|
||||||
[Container]
|
|
||||||
ContainerName=link
|
|
||||||
Environment=ZAMMAD_VIRTUAL_HOST={{ podman_link_web_hostname }}
|
|
||||||
Environment=SETUP_MODE={{ podman_link_setup_mode }}
|
|
||||||
Environment=LEAFCUTTER_ENABLED={{ podman_link_leafcutter_enabled }}
|
|
||||||
Environment=LEAFCUTTER_DEFAULT_DASHBOARD_URL={{ podman_link_dashboard_url }}
|
|
||||||
Environment=ZAMMAD_API_TOKEN={{ podman_link_zammad_api_token }}
|
|
||||||
Environment=LINK_URL=https://localhost:3000/link
|
|
||||||
Environment=ZAMMAD_URL=http://zammad-nginx:8080
|
|
||||||
EnvironmentFile=common-bridge.env
|
|
||||||
ExposeHostPort=3000
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/link:3.1.0b2
|
|
||||||
Network=link.network
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=always
|
|
||||||
Slice=link.slice
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
[Network]
|
|
||||||
NetworkName=link
|
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Description=Link Slice
|
|
||||||
Before=slices.target
|
|
||||||
Requires=zammad-init.service
|
|
||||||
Requires=zammad-memcached.service
|
|
||||||
Requires=zammad-postgresql.service
|
|
||||||
Requires=zammad-redis.service
|
|
||||||
Requires=zammad-railsserver.service
|
|
||||||
Requires=zammad-scheduler.service
|
|
||||||
Requires=zammad-websocket.service
|
|
||||||
Requires=zammad-opensearch.service
|
|
||||||
Requires=link.service
|
|
||||||
Requires=bridge-postgresql.service
|
|
||||||
Requires=zammad-nginx.service
|
|
||||||
Requires=signal-cli-rest-api.service
|
|
||||||
Requires=bridge-whatsapp.service
|
|
||||||
Requires=bridge-worker.service
|
|
||||||
Requires=opensearch-dashboards.service
|
|
||||||
Requires=nginx.service
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=default.target
|
|
||||||
|
|
@ -1,91 +0,0 @@
|
||||||
# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
|
|
||||||
# scheme used to connect to this server
|
|
||||||
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
|
|
||||||
default $http_x_forwarded_proto;
|
|
||||||
'' $scheme;
|
|
||||||
}
|
|
||||||
# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
|
|
||||||
# server port the client connected to
|
|
||||||
map $http_x_forwarded_port $proxy_x_forwarded_port {
|
|
||||||
default $http_x_forwarded_port;
|
|
||||||
'' $server_port;
|
|
||||||
}
|
|
||||||
# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
|
|
||||||
# Connection header that may have been passed to this server
|
|
||||||
map $http_upgrade $proxy_connection {
|
|
||||||
default upgrade;
|
|
||||||
'' close;
|
|
||||||
}
|
|
||||||
# Apply fix for very long server names
|
|
||||||
server_names_hash_bucket_size 128;
|
|
||||||
# Default dhparam
|
|
||||||
# Set appropriate X-Forwarded-Ssl header
|
|
||||||
map $scheme $proxy_x_forwarded_ssl {
|
|
||||||
default off;
|
|
||||||
https on;
|
|
||||||
}
|
|
||||||
gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
|
|
||||||
log_format vhost '$host $remote_addr - $remote_user [$time_local] '
|
|
||||||
'"$request" $status $body_bytes_sent '
|
|
||||||
'"$http_referer" "$http_user_agent"';
|
|
||||||
access_log off;
|
|
||||||
# HTTP 1.1 support
|
|
||||||
proxy_http_version 1.1;
|
|
||||||
proxy_buffering off;
|
|
||||||
proxy_set_header Host $http_host;
|
|
||||||
proxy_set_header Upgrade $http_upgrade;
|
|
||||||
proxy_set_header Connection $proxy_connection;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
|
|
||||||
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
|
|
||||||
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
|
|
||||||
# Mitigate httpoxy attack (see README for details)
|
|
||||||
proxy_set_header Proxy "";
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
listen [::]:80;
|
|
||||||
|
|
||||||
server_name {{ podman_link_web_hostname }};
|
|
||||||
server_tokens off;
|
|
||||||
|
|
||||||
location /.well-known/acme-challenge/ {
|
|
||||||
root /var/www/certbot;
|
|
||||||
}
|
|
||||||
|
|
||||||
location / {
|
|
||||||
return 301 https://{{ podman_link_web_hostname }}$request_uri;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
upstream zammad {
|
|
||||||
server zammad-nginx:8080;
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
server_name {{ podman_link_web_hostname }};
|
|
||||||
listen 80 ;
|
|
||||||
access_log /var/log/nginx/access.log vhost;
|
|
||||||
return 301 https://$host$request_uri;
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
server_name {{ podman_link_web_hostname }};
|
|
||||||
listen 443 ssl;
|
|
||||||
listen [::]:443 ssl;
|
|
||||||
http2 on;
|
|
||||||
server_tokens off;
|
|
||||||
|
|
||||||
ssl_certificate /etc/letsencrypt/live/{{ podman_link_web_hostname }}/fullchain.pem;
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/{{ podman_link_web_hostname }}/privkey.pem;
|
|
||||||
|
|
||||||
|
|
||||||
add_header Strict-Transport-Security "max-age=31536000" always;
|
|
||||||
add_header Referrer-Policy origin always; # make sure outgoing links don't show the URL to the Matomo instance
|
|
||||||
add_header X-Content-Type-Options "nosniff" always;
|
|
||||||
add_header X-XSS-Protection "1; mode=block" always;
|
|
||||||
location / {
|
|
||||||
proxy_pass http://zammad;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
@ -1,36 +0,0 @@
|
||||||
_meta:
|
|
||||||
type: "config"
|
|
||||||
config_version: 2
|
|
||||||
|
|
||||||
config:
|
|
||||||
dynamic:
|
|
||||||
http:
|
|
||||||
anonymous_auth_enabled: false
|
|
||||||
xff:
|
|
||||||
enabled: true
|
|
||||||
remoteIpHeader: "x-forwarded-for"
|
|
||||||
internalProxies: ".*"
|
|
||||||
authc:
|
|
||||||
basic_internal_auth_domain:
|
|
||||||
description: "Authenticate via HTTP Basic against internal users database"
|
|
||||||
http_enabled: true
|
|
||||||
transport_enabled: true
|
|
||||||
order: 0
|
|
||||||
http_authenticator:
|
|
||||||
type: basic
|
|
||||||
challenge: false
|
|
||||||
authentication_backend:
|
|
||||||
type: intern
|
|
||||||
proxy_auth_domain:
|
|
||||||
description: "Authenticate via proxy"
|
|
||||||
http_enabled: true
|
|
||||||
transport_enabled: true
|
|
||||||
order: 1
|
|
||||||
http_authenticator:
|
|
||||||
type: proxy
|
|
||||||
challenge: false
|
|
||||||
config:
|
|
||||||
user_header: "x-forwarded-user"
|
|
||||||
roles_header: "x-forwarded-roles"
|
|
||||||
authentication_backend:
|
|
||||||
type: noop
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Requires=zammad-opensearch.service
|
|
||||||
After=zammad-opensearch.service
|
|
||||||
|
|
||||||
[Container]
|
|
||||||
ContainerName=opensearch-dashboards
|
|
||||||
Environment=OPENSEARCH_USERNAME="kibanaserver"
|
|
||||||
Environment=OPENSEARCH_PASSWORD="kibanaserver"
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/opensearch-dashboards:3.1.0b2
|
|
||||||
PublishPort=127.0.0.1:5601:5601
|
|
||||||
#Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-dashboards-config.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
|
|
||||||
Network=link.network
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=always
|
|
||||||
Slice=link.slice
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Requires=link.service
|
|
||||||
After=link.service
|
|
||||||
|
|
||||||
[Container]
|
|
||||||
ContainerName=signal-cli-rest-api
|
|
||||||
Environment=MODE=native
|
|
||||||
Environment=PORT=8081
|
|
||||||
ExposeHostPort=8081
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/signal-cli-rest-api:3.1.0b2
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/signal-cli-rest-api-data:/home/.local/share/signal-cli
|
|
||||||
Network=link.network
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=always
|
|
||||||
slice=link.slice
|
|
||||||
|
|
@ -1,9 +0,0 @@
|
||||||
production:
|
|
||||||
adapter: postgresql
|
|
||||||
database: {{ podman_link_postgres_zammad_database }}
|
|
||||||
pool: 50
|
|
||||||
timeout: 5000
|
|
||||||
encoding: utf8
|
|
||||||
username: {{ podman_link_postgres_zammad_user }}
|
|
||||||
password: {{ podman_link_postgres_zammad_password }}
|
|
||||||
host: zammad-postgresql
|
|
||||||
|
|
@ -1,21 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Requires=zammad-postgresql.service
|
|
||||||
After=zammad-postgresql.service
|
|
||||||
Requires=zammad-redis.service
|
|
||||||
After=zammad-redis.service
|
|
||||||
Requires=zammad-memcached.service
|
|
||||||
After=zammad-memcached.service
|
|
||||||
|
|
||||||
[Container]
|
|
||||||
ContainerName=zammad-init
|
|
||||||
EnvironmentFile=common-zammad.env
|
|
||||||
Exec=zammad-init
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-config-nginx:/etc/nginx/sites-enabled
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage:ro
|
|
||||||
Network=link.network
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=on-failure
|
|
||||||
Slice=link.slice
|
|
||||||
|
|
@ -1,10 +0,0 @@
|
||||||
[Container]
|
|
||||||
ContainerName=zammad-memcached
|
|
||||||
Exec=memcached -m 256M
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/memcached:3.1.0b2
|
|
||||||
Network=link.network
|
|
||||||
ExposeHostPort=11211
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=always
|
|
||||||
Slice=link.slice
|
|
||||||
|
|
@ -1,18 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Requires=zammad-railsserver.service
|
|
||||||
After=zammad-railsserver.service
|
|
||||||
|
|
||||||
[Container]
|
|
||||||
ContainerName=zammad-nginx
|
|
||||||
EnvironmentFile=common-zammad.env
|
|
||||||
Exec=zammad-nginx
|
|
||||||
ExposeHostPort=8080
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-config-nginx:/etc/nginx/sites-enabled
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var:ro
|
|
||||||
Network=link.network
|
|
||||||
Network=frontend.network
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=always
|
|
||||||
Slice=link.slice
|
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
[Container]
|
|
||||||
ContainerName=zammad-opensearch
|
|
||||||
Environment=discovery.type=single-node
|
|
||||||
Environment=plugins.security.ssl.transport.enforce_hostname_verification=false
|
|
||||||
Environment=plugins.security.ssl.transport.resolve_hostname=false
|
|
||||||
Environment=cluster.routing.allocation.disk.watermark.low=3gb
|
|
||||||
Environment=cluster.routing.allocation.disk.watermark.high=2gb
|
|
||||||
Environment=cluster.routing.allocation.disk.watermark.flood_stage=500mb
|
|
||||||
Environment=cluster.info.update.interval=1m
|
|
||||||
Environment=node.name=opensearch-node1
|
|
||||||
Environment=bootstrap.memory_lock=true
|
|
||||||
Environment=OPENSEARCH_JAVA_OPTS="-Xms{{ podman_link_opensearch_memory_limit }}m -Xmx{{podman_link_opensearch_memory_limit }}m -XX:-HeapDumpOnOutOfMemoryError"
|
|
||||||
Environment=OPENSEARCH_INITIAL_ADMIN_PASSWORD={{ podman_link_opensearch_password }}
|
|
||||||
Environment=compatibility.override_main_response_version=true
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/opensearch:3.1.0b2
|
|
||||||
PublishPort=127.0.0.1:9200:9200
|
|
||||||
PublishPort=127.0.0.1:9600:9600
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-data:/usr/share/opensearch/data
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-config.yml:/usr/share/opensearch/config/opensearch-security/config.yml
|
|
||||||
Network=link.network
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=always
|
|
||||||
Slice=link.slice
|
|
||||||
|
|
@ -1,17 +0,0 @@
|
||||||
[Container]
|
|
||||||
ContainerName=zammad-postgresql
|
|
||||||
Environment=POSTGRES_PASSWORD={{ podman_link_postgres_zammad_password }}
|
|
||||||
Environment=POSTGRES_USER={{ podman_link_postgres_zammad_user }}
|
|
||||||
Environment=POSTGRES_DB={{ podman_link_postgres_zammad_database }}
|
|
||||||
Environment=POSTGRES_HOST_AUTH_METHOD=scram-sha-256
|
|
||||||
Environment=POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/postgresql:3.1.0b2
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/postgresql-data:/var/lib/postgresql/data
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-data:/opt/zammad
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-backup:/var/tmp/zammad:ro
|
|
||||||
Network=link.network
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=always
|
|
||||||
Slice=link.slice
|
|
||||||
|
|
||||||
|
|
@ -1,17 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Requires=zammad-memcached.service zammad-redis.service zammad-postgresql.service
|
|
||||||
After=zammad-memcached.service zammad-redis.service zammad-postgresql.service
|
|
||||||
|
|
||||||
[Container]
|
|
||||||
ContainerName=zammad-railsserver
|
|
||||||
EnvironmentFile=common-zammad.env
|
|
||||||
Exec=zammad-railsserver
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-database.yml:/opt/zammad/config/database.yml:ro
|
|
||||||
Network=link.network
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=always
|
|
||||||
Slice=link.slice
|
|
||||||
|
|
@ -1,10 +0,0 @@
|
||||||
[Container]
|
|
||||||
ContainerName=zammad-redis
|
|
||||||
Environment=REDIS_PASSWORD={{ podman_link_zammad_redis_password }}
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/redis:3.1.0b2
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/redis-data:/data
|
|
||||||
Network=link.network
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=always
|
|
||||||
Slice=link.slice
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Requires=zammad-memcached.service zammad-railsserver.service zammad-redis.service
|
|
||||||
After=zammad-memcached.service zammad-railsserver.service zammad-redis.service
|
|
||||||
|
|
||||||
[Container]
|
|
||||||
ContainerName=zammad-scheduler
|
|
||||||
EnvironmentFile=common-zammad.env
|
|
||||||
Exec=zammad-scheduler
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage
|
|
||||||
Network=link.network
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=always
|
|
||||||
Slice=link.slice
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Requires=zammad-memcached.service zammad-railsserver.service zammad-redis.service
|
|
||||||
After=zammad-memcached.service zammad-railsserver.service zammad-redis.service
|
|
||||||
|
|
||||||
[Container]
|
|
||||||
ContainerName=zammad-websocket
|
|
||||||
EnvironmentFile=common-zammad.env
|
|
||||||
Exec=zammad-websocket
|
|
||||||
Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
|
|
||||||
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage
|
|
||||||
Network=link.network
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Restart=always
|
|
||||||
Slice=link.slice
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue