roles/podman_forgejo/templates/forgejo.container

@@ -11,23 +11,8 @@ Environment=FORGEJO__database__HOST=mariadb:3306
 Environment=FORGEJO__database__NAME={{ podman_forgejo_mariadb_database }}
 Environment=FORGEJO__database__USER={{ podman_forgejo_mariadb_user }}
 Environment=FORGEJO__database__PASSWD={{ podman_forgejo_mariadb_password }}
-Environment=FORGEJO__email_0X2E_incoming__ENABLED=true
-Environment=FORGEJO__email_0X2E_incoming__REPLY_TO_ADDRESS={{ podman_forgejo_reply_to }}
-Environment=FORGEJO__email_0X2E_incoming__HOST={{ podman_forgejo_imap_hostname }}
-Environment=FORGEJO__email_0X2E_incoming__PORT=993
-Environment=FORGEJO__email_0X2E_incoming__USERNAME={{ podman_forgejo_imap_username }}
-Environment=FORGEJO__email_0X2E_incoming__PASSWORD={{ podman_forgejo_imap_password }}
-Environment=FORGEJO__email_0X2E_incoming__USE_TLS=true
 Environment=FORGEJO__oauth2_client__ENABLE_AUTO_REGISTRATION=true
 Environment=FORGEJO__server__LANDING_PAGE=/explore/repos
-Environment=FORGEJO__service__ENABLE_NOTIFY_MAIL=true
-Environment=FORGEJO__mailer__ENABLED=true
-Environment=FORGEJO__mailer__PROTOCOL=smtps
-Environment=FORGEJO__mailer__SMTP_ADDR={{ podman_forgejo_smtp_hostname }}
-Environment=FORGEJO__mailer__SMTP_PORT=465
-Environment=FORGEJO__mailer__USER={{ podman_forgejo_smtp_username }}
-Environment=FORGEJO__mailer__PASSWD={{ podman_forgejo_smtp_password }}
-Environment=FORGEJO__mailer__FROM={{ podman_forgejo_smtp_from }}
 Image=codeberg.org/forgejo/forgejo:11
 Network=frontend.network
 Network=forgejo.network

roles/podman_host/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+podman_host_minimum_unpriv_port: "22"
+podman_host_rootless_users: ["podman"]

roles/podman_host/tasks/main.yml

@@ -0,0 +1,69 @@
+---
+- name: set unprivileged port minimum
+  ansible.posix.sysctl:
+    name: net.ipv4.ip_unprivileged_port_start
+    value: "{{ podman_host_minimum_unpriv_port }}"
+    sysctl_set: true
+    sysctl_file: /etc/sysctl.d/zzz-podman-unpriv-port.conf
+    reload: true
+  become: true
+
+- name: create users for rootless podman
+  ansible.builtin.user:
+    name: "{{ item }}"
+  become: true
+  with_items: "{{ podman_host_rootless_users }}"
+
+- name: set XDG_RUNTIME_DIR in .profile for rootless users
+  ansible.builtin.lineinfile:
+    path: "/home/{{ item }}/.bashrc"
+    line: "export XDG_RUNTIME_DIR=/run/user/$(id -u)"
+    create: false
+  become: true
+  become_user: "{{ item }}"
+  with_items: "{{ podman_host_rootless_users }}"
+
+- name: enable linger for rootless users
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/loginctl
+      - enable-linger
+      - "{{ item }}"
+    creates: "/var/lib/systemd/linger/{{ item }}"
+  become: true
+  with_items: "{{ podman_host_rootless_users }}"
+
+- name: create /etc/subuid and /etc/subgid
+  ansible.builtin.template:
+    dest: "/etc/{{ item }}"
+    src: subXid.j2
+  with_items:
+    - subuid
+    - subgid
+  become: true
+
+- name: install podman
+  ansible.builtin.apt:
+    pkg: podman
+    state: latest
+  become: true
+
+- name: create quadlets directory
+  ansible.builtin.file:
+    path: "/home/{{ item }}/.config/containers/systemd"
+    state: directory
+    owner: "{{ item }}"
+    group: "{{ item }}"
+    mode: "0700"
+  with_items: "{{ podman_host_rootless_users }}"
+  become: true
+
+- name: enable podman auto update timer for rootless users
+  ansible.builtin.systemd_service:
+    name: podman-auto-update.timer
+    scope: user
+    state: started
+    enabled: true
+  become: true
+  become_user: "{{ item }}"
+  with_items: "{{ podman_host_rootless_users }}"

roles/podman_host/templates/subXid.j2

@@ -0,0 +1,4 @@
+# {{ ansible_managed }}
+{% for username in podman_host_rootless_users %}
+{{ username }}:{{ 100000 + ((loop.index - 1) * 65536) }}:65536
+{% endfor %}

roles/podman_link/defaults/main.yml

@@ -1,25 +0,0 @@
-podman_link_podman_rootless_user: link
-podman_link_web_hostname: "{{ inventory_hostname }}"
-podman_link_postgres_zammad_user: postgres
-podman_link_postgres_zammad_database: zammad_production
-podman_link_postgres_link_user: link
-podman_link_postgres_link_database: link
-# podman_link_postgres_zammad_password:
-# podman_link_postgres_link_password:
-# podman_link_postgres_root_password:
-# podman_link_zammad_redis_password:
-# podman_link_opensearch_password:
-podman_link_opensearch_memory_limit: 2048
-podman_link_setup_mode: false
-podman_link_leafcutter_enabled: false
-podman_link_dashboard_url: ""
-podman_link_zammad_api_token: ""
-# podman_link_nextauth_secret:
-# podman_link_google_client_id:
-# podman_link_google_client_secret:
-#
-# the following may seem useless, but unless they are included as variables in the environment file template,
-# they automatically get wrapped in quotes by systemd causing zammad to not connect
-podman_link_postgres_zammad_postgresql_host: zammad-postgresql
-podman_link_postgres_zammad_es_host: opensearch
-podman_link_postgres_zammad_memcached_server: zammad-memcached:11211

roles/podman_link/handlers/main.yml

@@ -1,26 +0,0 @@
-- name: restart zammad-init
-  ansible.builtin.systemd_service:
-    name: zammad-init
-    state: restarted
-    scope: user
-    daemon_reload: true
-  become: true
-  become_user: "{{ podman_link_podman_rootless_user }}"
-
-- name: restart zammad-postgresql
-  ansible.builtin.systemd_service:
-    name: zammad-postgresql
-    state: restarted
-    scope: user
-    daemon_reload: true
-  become: true
-  become_user: "{{ podman_link_podman_rootless_user }}"
-
-- name: restart link.slice
-  ansible.builtin.systemd_service:
-    name: link.slice
-    state: restarted
-    scope: user
-    daemon_reload: true
-  become: true
-  become_user: "{{ podman_link_podman_rootless_user }}"

roles/podman_link/tasks/main.yml

@@ -1,229 +0,0 @@
----
-- name: create service configuration directories
-  ansible.builtin.file:
-    path: "/home/{{ podman_link_podman_rootless_user }}/{{ item }}"
-    state: directory
-    owner: "{{ podman_link_podman_rootless_user }}"
-    group: "{{ podman_link_podman_rootless_user }}"
-    mode: "0755"
-  become: true
-  with_items:
-    - zammad-storage
-    - zammad-var
-    - zammad-backup
-    - zammad-data
-    - signal-cli-rest-api-data
-    - bridge-postgresql-data
-    - bridge-whatsapp-data
-    - redis-data
-    - postgresql-data
-
-- name: create configuration directories where containers need to execute scripts
-  ansible.builtin.file:
-    path: "/home/{{ podman_link_podman_rootless_user }}/{{ item }}"
-    state: directory
-    owner: "{{ podman_link_podman_rootless_user }}"
-    group: "{{ podman_link_podman_rootless_user }}"
-    mode: "0777"
-  become: true
-  with_items:
-    - zammad-config-nginx
-    - opensearch-data
-
-- name: install zammad railsserver database configuration file
-  ansible.builtin.template:
-    src: "{{ item }}"
-    dest: "/home/{{ podman_link_podman_rootless_user }}/{{ item }}"
-    owner: "{{ podman_link_podman_rootless_user }}"
-    group: "{{ podman_link_podman_rootless_user }}"
-    mode: "0444"
-  become: true
-  with_items:
-    - zammad-database.yml
-
-- name: install env configuration files
-  ansible.builtin.template:
-    src: "{{ item }}"
-    dest: "/home/{{ podman_link_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
-    owner: "{{ podman_link_podman_rootless_user }}"
-    mode: "0600"
-  become: true
-  with_items:
-    - common-zammad.env
-    - common-bridge.env
-
-- name: Set sysctl settings for elasticsearch
-  sysctl:
-    name: vm.max_map_count
-    value: '262144'
-    state: present
-  become: true
-
-- name: Set vm.overcommit_memory for Memcached
-  sysctl:
-    name: vm.overcommit_memory
-    value: '1'
-    state: present
-  become: true
-
-- name: install opensearch config
-  ansible.builtin.copy:
-    src: templates/opensearch-config.yml
-    dest: "/home/{{ podman_link_podman_rootless_user }}/opensearch-config.yml"
-    mode: "0444"
-    owner: "{{ podman_link_podman_rootless_user }}"
-    group: "{{ podman_link_podman_rootless_user }}"
-  become: true
-
-- name: install podman quadlet for rootless podman user
-  ansible.builtin.template:
-    src: "{{ item }}"
-    dest: "/home/{{ podman_link_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
-    owner: "{{ podman_link_podman_rootless_user }}"
-    mode: "0400"
-  with_items:
-    - link.container
-    - zammad-opensearch.container
-    - opensearch-dashboards.container
-    - bridge-worker.container
-    - bridge-postgresql.container
-    - bridge-whatsapp.container
-    - signal-cli-rest-api.container
-    - zammad-init.container
-    - zammad-nginx.container
-    - zammad-railsserver.container
-    - zammad-scheduler.container
-    - zammad-postgresql.container
-    - zammad-websocket.container
-    - zammad-redis.container
-    - zammad-memcached.container
-  become: true
-
-
-- name: install network quadlets for rootless podman user
-  ansible.builtin.template:
-    src: "{{ item }}"
-    dest: "/home/{{ podman_link_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
-    owner: "{{ podman_link_podman_rootless_user }}"
-    mode: "0400"
-  with_items:
-    - frontend.network
-    - link.network
-  become: true
-
-- name: verify quadlets are correctly defined
-  ansible.builtin.command: /usr/libexec/podman/quadlet -dryrun -user
-  register: podman_link_quadlet_result
-  ignore_errors: true
-  changed_when: false
-  become: true
-  become_user: "{{ podman_link_podman_rootless_user }}"
-
-- name: assert that the quadlet verification succeeded
-  ansible.builtin.assert:
-    that:
-      - podman_link_quadlet_result.rc == 0
-    fail_msg: "'/usr/libexec/podman/quadlet -dryrun -user' failed! Output withheld to prevent leaking secrets."
-
-#- name: set up nginx
-#  ansible.builtin.include_role:
-#    name: irl.wip.podman_nginx
-#  vars:
-#    podman_nginx_frontend_network: frontend
-#    podman_nginx_podman_rootless_user: "{{ podman_link_podman_rootless_user }}"
-#    podman_nginx_primary_hostname: "{{ podman_link_web_hostname }}"
-#    podman_nginx_systemd_service_slice: "link.slice"
-#    podman_nginx_systemd_service_requires: ["zammad-nginx"]
-#
-#
-#- name: create nginx configuration file
-#  ansible.builtin.template:
-#    src: nginx.conf
-#    dest: "/home/{{ podman_link_podman_rootless_user }}/nginx/nginx.conf"
-#    owner: "{{ podman_link_podman_rootless_user }}"
-#    group: "{{ podman_link_podman_rootless_user }}"
-#    mode: "0644"
-#  become: true
-
-- name: install services slice for rootless podman user
-  ansible.builtin.template:
-    src: "link.slice"
-    dest: "/home/{{ podman_link_podman_rootless_user }}/.config/systemd/user/link.slice"
-    owner: "{{ podman_link_podman_rootless_user }}"
-    group:  "{{ podman_link_podman_rootless_user }}"
-    mode: "0655"
-  become: true
-
-- name: make sure services are started on boot
-  ansible.builtin.systemd_service:
-    name: "link.slice"
-    enabled: true
-    state: started
-    daemon_reload: true
-    scope: user
-  become: true
-  become_user: "{{ podman_link_podman_rootless_user }}"
-  notify:
-    - "restart link.slice"
-
-
-- name: set es verify false
-  ansible.builtin.shell: >
-    podman exec zammad-railsserver rails r "Setting.set('es_ssl_verify', false)"
-  become: true
-  become_user: "{{ podman_link_podman_rootless_user }}"
-  notify:
-    - "restart link.slice"
-  register: es_ssl_result
-  retries: 20
-  delay: 5
-  until: es_ssl_result.rc == 0
-
-- name: Run OpenSearch setup script
-  ansible.builtin.shell: |
-    podman exec zammad-opensearch /bin/sh -c '
-      if [ ! -f /tmp/.securityadmin_done ]; then
-        chmod +x /usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh && \
-        /usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh \
-          -cd /usr/share/opensearch/config/opensearch-security/ \
-          -icl \
-          -key /usr/share/opensearch/config/kirk-key.pem \
-          -cert /usr/share/opensearch/config/kirk.pem \
-          -cacert /usr/share/opensearch/config/root-ca.pem \
-          -nhnv && \
-        touch /tmp/.securityadmin_done
-      fi
-    '
-  become: true
-  become_user: "{{ podman_link_podman_rootless_user }}"
-  register: securityadmin_scipt_result
-  retries: 20
-  delay: 5
-  until: securityadmin_scipt_result.rc == 0
-  notify:
-    - "restart link.slice"
-
-- name: set up nginx
-  ansible.builtin.include_role:
-    name: irl.wip.podman_nginx
-  vars:
-    podman_nginx_frontend_network: frontend
-    podman_nginx_podman_rootless_user: "{{ podman_link_podman_rootless_user }}"
-    podman_nginx_primary_hostname: "{{ podman_link_web_hostname }}"
-    podman_nginx_systemd_service_slice: link.slice
-    podman_nginx_systemd_service_requires: ["zammad-nginx"]
-#    podman_nginx_additional_volumes:
-#      - src: "/home/{{ podman_cleaninsights_podman_rootless_user }}/matomo"
-#        dest: "/var/www/html"
-#        options: "ro"
-
-- name: create nginx configuration file
-  ansible.builtin.template:
-    src: nginx.conf
-    dest: "/home/{{ podman_link_podman_rootless_user }}/nginx/nginx.conf"
-    owner: "{{ podman_link_podman_rootless_user }}"
-    group: "{{ podman_link_podman_rootless_user }}"
-    mode: "0644"
-  become: true
-  notify:
-    - "restart link.slice"

roles/podman_link/templates/bridge-postgresql.container

@@ -1,11 +0,0 @@
-[Container]
-ContainerName=bridge-postgresql
-EnvironmentFile=common-bridge.env
-Image=registry.gitlab.com/digiresilience/link/link-stack/postgresql:3.1.0b2
-Volume=/home/{{ podman_link_podman_rootless_user }}/bridge-postgresql-data:/var/lib/postgresql/data
-Network=link.network
-
-
-[Service]
-Restart=always
-Slice=link.slice

roles/podman_link/templates/bridge-whatsapp.container

@@ -1,17 +0,0 @@
-[Unit]
-Requires=bridge-postgresql.service link.service
-After=bridge-postgresql.service link.service
-
-[Container]
-ContainerName=bridge-whatsapp
-Environment=BRIDGE_FRONTEND_URL=http://systemd-link:3000/link
-EnvironmentFile=common-bridge.env
-ExposeHostPort=5000
-Image=registry.gitlab.com/digiresilience/link/link-stack/bridge-whatsapp:3.1.0b2
-Volume=/home/{{ podman_link_podman_rootless_user }}/bridge-whatsapp-data:/home/node/baileys
-Network=link.network
-
-
-[Service]
-Restart=always
-Slice=link.slice

roles/podman_link/templates/bridge-worker.container

@@ -1,13 +0,0 @@
-[Unit]
-Requires=bridge-postgresql.service link.service
-After=bridge-postgresql.service link.service
-
-[Container]
-ContainerName=bridge-worker
-EnvironmentFile=common-bridge.env
-Image=registry.gitlab.com/digiresilience/link/link-stack/bridge-worker:3.1.0b2
-Network=link.network
-
-[Service]
-Restart=always
-Slice=link.slice

roles/podman_link/templates/common-bridge.env

@@ -1,18 +0,0 @@
-POSTGRES_USER={{ podman_link_postgres_link_user }}
-POSTGRES_PASSWORD={{ podman_link_postgres_link_password }}
-POSTGRES_DB={{ podman_link_postgres_link_database }}
-NEXTAUTH_URL=https://{{ podman_link_web_hostname }}/link/api/auth
-NEXTAUTH_SECRET={{ podman_link_nextauth_secret }}
-GOOGLE_CLIENT_ID={{ podman_link_google_client_id }}
-GOOGLE_CLIENT_SECRET={{ podman_link_google_client_secret }}
-BRIDGE_FRONTEND_URL=http://link:3000
-BRIDGE_SIGNAL_URL=http://signal-cli-rest-api:8081
-BRIDGE_WHATSAPP_URL=http://bridge-whatsapp:5000
-DATABASE_NAME={{ podman_link_postgres_link_database }}
-DATABASE_HOST=bridge-postgresql
-DATABASE_USER={{ podman_link_postgres_link_user }}
-DATABASE_PASSWORD={{ podman_link_postgres_link_password }}
-DATABASE_PORT=5432
-DATABASE_URL=postgresql://{{ podman_link_postgres_link_user }}:{{ podman_link_postgres_link_password }}@bridge-postgresql/{{ podman_link_postgres_link_database}}
-TZ=Etc/UTC
-

roles/podman_link/templates/common-zammad.env

@@ -1,13 +0,0 @@
-POSTGRESQL_HOST=zammad-postgresql
-POSTGRESQL_PASS={{ podman_link_postgres_zammad_password }}
-POSTGRESQL_USER={{ podman_link_postgres_zammad_user }}
-POSTGRESQL_DB={{ podman_link_postgres_zammad_database }}
-POSTGRESQL_OPTIONS=?pool=50
-REDIS_URL=redis://default:{{ podman_link_zammad_redis_password }}@zammad-redis:6379
-MEMCACHE_SERVERS=zammad-memcached:11211
-ELASTICSEARCH_HOST=zammad-opensearch
-ELASTICSEARCH_USER=admin
-ELASTICSEARCH_PASS={{ podman_link_opensearch_password }}
-ELASTICSEARCH_SCHEMA=https
-ELASTICSEARCH_REINDEX=true
-ELASTICSEARCH_SSL_VERIFY=false

roles/podman_link/templates/frontend.network

@@ -1,2 +0,0 @@
-[Network]
-NetworkName=frontend

roles/podman_link/templates/link.container

@@ -1,21 +0,0 @@
-[Unit]
-Requires=bridge-postgresql.service
-After=bridge-postgresql.service
-
-[Container]
-ContainerName=link
-Environment=ZAMMAD_VIRTUAL_HOST={{ podman_link_web_hostname }}
-Environment=SETUP_MODE={{ podman_link_setup_mode }}
-Environment=LEAFCUTTER_ENABLED={{ podman_link_leafcutter_enabled }}
-Environment=LEAFCUTTER_DEFAULT_DASHBOARD_URL={{ podman_link_dashboard_url }}
-Environment=ZAMMAD_API_TOKEN={{ podman_link_zammad_api_token }}
-Environment=LINK_URL=https://localhost:3000/link
-Environment=ZAMMAD_URL=http://zammad-nginx:8080
-EnvironmentFile=common-bridge.env
-ExposeHostPort=3000
-Image=registry.gitlab.com/digiresilience/link/link-stack/link:3.1.0b2
-Network=link.network
-
-[Service]
-Restart=always
-Slice=link.slice

roles/podman_link/templates/link.network

@@ -1,2 +0,0 @@
-[Network]
-NetworkName=link

roles/podman_link/templates/link.slice

@@ -1,22 +0,0 @@
-[Unit]
-Description=Link Slice
-Before=slices.target
-Requires=zammad-init.service
-Requires=zammad-memcached.service
-Requires=zammad-postgresql.service
-Requires=zammad-redis.service
-Requires=zammad-railsserver.service
-Requires=zammad-scheduler.service
-Requires=zammad-websocket.service
-Requires=zammad-opensearch.service
-Requires=link.service
-Requires=bridge-postgresql.service
-Requires=zammad-nginx.service
-Requires=signal-cli-rest-api.service
-Requires=bridge-whatsapp.service
-Requires=bridge-worker.service
-Requires=opensearch-dashboards.service
-Requires=nginx.service
-
-[Install]
-WantedBy=default.target

roles/podman_link/templates/nginx.conf

@@ -1,91 +0,0 @@
-# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
-# scheme used to connect to this server
-map $http_x_forwarded_proto $proxy_x_forwarded_proto {
-  default $http_x_forwarded_proto;
-  ''      $scheme;
-}
-# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
-# server port the client connected to
-map $http_x_forwarded_port $proxy_x_forwarded_port {
-  default $http_x_forwarded_port;
-  ''      $server_port;
-}
-# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
-# Connection header that may have been passed to this server
-map $http_upgrade $proxy_connection {
-  default upgrade;
-  '' close;
-}
-# Apply fix for very long server names
-server_names_hash_bucket_size 128;
-# Default dhparam
-# Set appropriate X-Forwarded-Ssl header
-map $scheme $proxy_x_forwarded_ssl {
-  default off;
-  https on;
-}
-gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
-log_format vhost '$host $remote_addr - $remote_user [$time_local] '
-                 '"$request" $status $body_bytes_sent '
-                 '"$http_referer" "$http_user_agent"';
-access_log off;
-# HTTP 1.1 support
-proxy_http_version 1.1;
-proxy_buffering off;
-proxy_set_header Host $http_host;
-proxy_set_header Upgrade $http_upgrade;
-proxy_set_header Connection $proxy_connection;
-proxy_set_header X-Real-IP $remote_addr;
-proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
-proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-# Mitigate httpoxy attack (see README for details)
-proxy_set_header Proxy "";
-
-server {
-    listen 80;
-    listen [::]:80;
-
-    server_name {{ podman_link_web_hostname }};
-    server_tokens off;
-
-    location /.well-known/acme-challenge/ {
-        root /var/www/certbot;
-    }
-
-    location / {
-        return 301 https://{{ podman_link_web_hostname }}$request_uri;
-    }
-}
-
-upstream zammad {
-			server zammad-nginx:8080;
-}
-
-server {
-	server_name {{ podman_link_web_hostname }};
-	listen 80 ;
-	access_log /var/log/nginx/access.log vhost;
-	return 301 https://$host$request_uri;
-}
-
-server {
-	server_name {{ podman_link_web_hostname }};
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    http2 on;
-    server_tokens off;
-
-    ssl_certificate /etc/letsencrypt/live/{{ podman_link_web_hostname }}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/{{ podman_link_web_hostname }}/privkey.pem;
-
-
-	add_header Strict-Transport-Security "max-age=31536000" always;
-	add_header Referrer-Policy origin always; # make sure outgoing links don't show the URL to the Matomo instance
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-	location / {
-		proxy_pass http://zammad;
-	}
-}

roles/podman_link/templates/opensearch-config.yml

@@ -1,36 +0,0 @@
-_meta:
-  type: "config"
-  config_version: 2
-
-config:
-  dynamic:
-    http:
-      anonymous_auth_enabled: false
-      xff:
-        enabled: true
-        remoteIpHeader: "x-forwarded-for"
-        internalProxies: ".*"
-    authc:
-      basic_internal_auth_domain:
-        description: "Authenticate via HTTP Basic against internal users database"
-        http_enabled: true
-        transport_enabled: true
-        order: 0
-        http_authenticator:
-          type: basic
-          challenge: false
-        authentication_backend:
-          type: intern
-      proxy_auth_domain:
-        description: "Authenticate via proxy"
-        http_enabled: true
-        transport_enabled: true
-        order: 1
-        http_authenticator:
-          type: proxy
-          challenge: false
-          config:
-            user_header: "x-forwarded-user"
-            roles_header: "x-forwarded-roles"
-        authentication_backend:
-          type: noop

roles/podman_link/templates/opensearch-dashboards.container

@@ -1,16 +0,0 @@
-[Unit]
-Requires=zammad-opensearch.service
-After=zammad-opensearch.service
-
-[Container]
-ContainerName=opensearch-dashboards
-Environment=OPENSEARCH_USERNAME="kibanaserver"
-Environment=OPENSEARCH_PASSWORD="kibanaserver"
-Image=registry.gitlab.com/digiresilience/link/link-stack/opensearch-dashboards:3.1.0b2
-PublishPort=127.0.0.1:5601:5601
-#Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-dashboards-config.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
-Network=link.network
-
-[Service]
-Restart=always
-Slice=link.slice

roles/podman_link/templates/signal-cli-rest-api.container

@@ -1,16 +0,0 @@
-[Unit]
-Requires=link.service
-After=link.service
-
-[Container]
-ContainerName=signal-cli-rest-api
-Environment=MODE=native
-Environment=PORT=8081
-ExposeHostPort=8081
-Image=registry.gitlab.com/digiresilience/link/link-stack/signal-cli-rest-api:3.1.0b2
-Volume=/home/{{ podman_link_podman_rootless_user }}/signal-cli-rest-api-data:/home/.local/share/signal-cli
-Network=link.network
-
-[Service]
-Restart=always
-slice=link.slice

roles/podman_link/templates/zammad-database.yml

@@ -1,9 +0,0 @@
-production:
-  adapter: postgresql
-  database: {{ podman_link_postgres_zammad_database }}
-  pool: 50
-  timeout: 5000
-  encoding: utf8
-  username: {{ podman_link_postgres_zammad_user }}
-  password: {{ podman_link_postgres_zammad_password }}
-  host: zammad-postgresql

roles/podman_link/templates/zammad-init.container

@@ -1,21 +0,0 @@
-[Unit]
-Requires=zammad-postgresql.service
-After=zammad-postgresql.service
-Requires=zammad-redis.service
-After=zammad-redis.service
-Requires=zammad-memcached.service
-After=zammad-memcached.service
-
-[Container]
-ContainerName=zammad-init
-EnvironmentFile=common-zammad.env
-Exec=zammad-init
-Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
-Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-config-nginx:/etc/nginx/sites-enabled
-Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
-Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage:ro
-Network=link.network
-
-[Service]
-Restart=on-failure
-Slice=link.slice

roles/podman_link/templates/zammad-memcached.container

@@ -1,10 +0,0 @@
-[Container]
-ContainerName=zammad-memcached
-Exec=memcached -m 256M
-Image=registry.gitlab.com/digiresilience/link/link-stack/memcached:3.1.0b2
-Network=link.network
-ExposeHostPort=11211
-
-[Service]
-Restart=always
-Slice=link.slice

roles/podman_link/templates/zammad-nginx.container

@@ -1,18 +0,0 @@
-[Unit]
-Requires=zammad-railsserver.service
-After=zammad-railsserver.service
-
-[Container]
-ContainerName=zammad-nginx
-EnvironmentFile=common-zammad.env
-Exec=zammad-nginx
-ExposeHostPort=8080
-Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
-Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-config-nginx:/etc/nginx/sites-enabled
-Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var:ro
-Network=link.network
-Network=frontend.network
-
-[Service]
-Restart=always
-Slice=link.slice

roles/podman_link/templates/zammad-opensearch.container

@@ -1,24 +0,0 @@
-[Container]
-ContainerName=zammad-opensearch
-Environment=discovery.type=single-node
-Environment=plugins.security.ssl.transport.enforce_hostname_verification=false
-Environment=plugins.security.ssl.transport.resolve_hostname=false
-Environment=cluster.routing.allocation.disk.watermark.low=3gb
-Environment=cluster.routing.allocation.disk.watermark.high=2gb
-Environment=cluster.routing.allocation.disk.watermark.flood_stage=500mb
-Environment=cluster.info.update.interval=1m
-Environment=node.name=opensearch-node1
-Environment=bootstrap.memory_lock=true
-Environment=OPENSEARCH_JAVA_OPTS="-Xms{{ podman_link_opensearch_memory_limit }}m -Xmx{{podman_link_opensearch_memory_limit }}m -XX:-HeapDumpOnOutOfMemoryError"
-Environment=OPENSEARCH_INITIAL_ADMIN_PASSWORD={{ podman_link_opensearch_password }}
-Environment=compatibility.override_main_response_version=true
-Image=registry.gitlab.com/digiresilience/link/link-stack/opensearch:3.1.0b2
-PublishPort=127.0.0.1:9200:9200
-PublishPort=127.0.0.1:9600:9600
-Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-data:/usr/share/opensearch/data
-Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-config.yml:/usr/share/opensearch/config/opensearch-security/config.yml
-Network=link.network
-
-[Service]
-Restart=always
-Slice=link.slice

roles/podman_link/templates/zammad-postgresql.container

@@ -1,17 +0,0 @@
-[Container]
-ContainerName=zammad-postgresql
-Environment=POSTGRES_PASSWORD={{ podman_link_postgres_zammad_password }}
-Environment=POSTGRES_USER={{ podman_link_postgres_zammad_user }}
-Environment=POSTGRES_DB={{ podman_link_postgres_zammad_database }}
-Environment=POSTGRES_HOST_AUTH_METHOD=scram-sha-256
-Environment=POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256
-Image=registry.gitlab.com/digiresilience/link/link-stack/postgresql:3.1.0b2
-Volume=/home/{{ podman_link_podman_rootless_user }}/postgresql-data:/var/lib/postgresql/data
-Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-data:/opt/zammad
-Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-backup:/var/tmp/zammad:ro
-Network=link.network
-
-[Service]
-Restart=always
-Slice=link.slice
-

roles/podman_link/templates/zammad-railsserver.container

@@ -1,17 +0,0 @@
-[Unit]
-Requires=zammad-memcached.service zammad-redis.service zammad-postgresql.service
-After=zammad-memcached.service zammad-redis.service zammad-postgresql.service
-
-[Container]
-ContainerName=zammad-railsserver
-EnvironmentFile=common-zammad.env
-Exec=zammad-railsserver
-Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
-Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
-Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage
-Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-database.yml:/opt/zammad/config/database.yml:ro
-Network=link.network
-
-[Service]
-Restart=always
-Slice=link.slice

roles/podman_link/templates/zammad-redis.container

@@ -1,10 +0,0 @@
-[Container]
-ContainerName=zammad-redis
-Environment=REDIS_PASSWORD={{ podman_link_zammad_redis_password }}
-Image=registry.gitlab.com/digiresilience/link/link-stack/redis:3.1.0b2
-Volume=/home/{{ podman_link_podman_rootless_user }}/redis-data:/data
-Network=link.network
-
-[Service]
-Restart=always
-Slice=link.slice

roles/podman_link/templates/zammad-scheduler.container

@@ -1,16 +0,0 @@
-[Unit]
-Requires=zammad-memcached.service zammad-railsserver.service zammad-redis.service
-After=zammad-memcached.service zammad-railsserver.service zammad-redis.service
-
-[Container]
-ContainerName=zammad-scheduler
-EnvironmentFile=common-zammad.env
-Exec=zammad-scheduler
-Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
-Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
-Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage
-Network=link.network
-
-[Service]
-Restart=always
-Slice=link.slice

roles/podman_link/templates/zammad-websocket.container

@@ -1,16 +0,0 @@
-[Unit]
-Requires=zammad-memcached.service zammad-railsserver.service zammad-redis.service
-After=zammad-memcached.service zammad-railsserver.service zammad-redis.service
-
-[Container]
-ContainerName=zammad-websocket
-EnvironmentFile=common-zammad.env
-Exec=zammad-websocket
-Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
-Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
-Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage
-Network=link.network
-
-[Service]
-Restart=always
-Slice=link.slice

roles/podman_nginx/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+podman_nginx_additional_hostnames: []
+podman_nginx_certbot_testing: false
+# podman_nginx_frontend_network:
+podman_nginx_podman_rootless_user: nginx
+# podman_nginx_primary_hostname:

roles/podman_nginx/handlers/main.yml

@@ -0,0 +1,18 @@
+---
+- name: restart certbot-renew
+  ansible.builtin.systemd_service:
+    name: certbot-renew
+    state: started
+    scope: user
+    daemon_reload: true
+  become: true
+  become_user: "{{ podman_nginx_podman_rootless_user }}"
+
+- name: restart nginx
+  ansible.builtin.systemd_service:
+    name: nginx
+    state: restarted
+    scope: user
+    daemon_reload: true
+  become: true
+  become_user: "{{ podman_nginx_podman_rootless_user }}"

roles/podman_nginx/tasks/main.yml

@@ -0,0 +1,110 @@
+---
+- name: create service configuration directories
+  ansible.builtin.file:
+    path: "/home/{{ podman_nginx_podman_rootless_user }}/{{ item }}"
+    state: directory
+    owner: "{{ podman_nginx_podman_rootless_user }}"
+    group: "{{ podman_nginx_podman_rootless_user }}"
+    mode: "0755"
+  become: true
+  with_items:
+    - .config/systemd/user
+    - certbot/conf
+    - certbot/www
+    - nginx
+
+- name: install podman quadlet for rootless podman user
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "/home/{{ podman_nginx_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
+    owner: "{{ podman_nginx_podman_rootless_user }}"
+    mode: "0400"
+  with_items:
+    - certbot-renew.container
+    - nginx.container
+  notify:
+    - "restart {{ item | split('.') | first }}"
+  become: true
+
+- name: install certbot renewal timer for rootless podman user
+  ansible.builtin.template:
+    src: "certbot-renew.timer"
+    dest: "/home/{{ podman_nginx_podman_rootless_user }}/.config/systemd/user/certbot-renew.timer"
+    owner: "{{ podman_nginx_podman_rootless_user }}"
+    mode: "0400"
+  become: true
+
+- name: verify quadlets are correctly defined
+  ansible.builtin.command: /usr/libexec/podman/quadlet -dryrun -user
+  register: podman_nginx_quadlet_result
+  ignore_errors: true
+  changed_when: false
+  become: true
+  become_user: "{{ podman_nginx_podman_rootless_user }}"
+
+- name: check if certificate exists
+  stat:
+    path: "/home/{{ podman_nginx_podman_rootless_user }}/certbot/conf/live/{{ podman_nginx_primary_hostname }}/fullchain.pem"
+  register: podman_nginx_cert_stat
+  become: yes
+  become_user: "{{ podman_nginx_podman_rootless_user }}"
+
+- name: create temporary nginx configuration (no https)
+  ansible.builtin.template:
+    src: nginx.conf
+    dest: "/home/{{ podman_nginx_podman_rootless_user }}/nginx/nginx.conf"
+    owner: "{{ podman_nginx_podman_rootless_user }}"
+    group: "{{ podman_nginx_podman_rootless_user }}"
+    mode: "0644"
+  become: true
+  when: podman_nginx_cert_stat.stat.exists == false
+
+- name: start nginx
+  ansible.builtin.systemd_service:
+    name: nginx
+    state: started
+    scope: user
+    daemon_reload: true
+  become: true
+  become_user: "{{ podman_nginx_podman_rootless_user }}"
+
+- name: run certbot container to create certificate
+  ansible.builtin.command:
+    cmd: >
+      podman run --name certbot-generate
+      --rm
+      --volume /home/{{ podman_nginx_podman_rootless_user }}/certbot/www:/var/www/certbot:rw
+      --volume /home/{{ podman_nginx_podman_rootless_user }}/certbot/conf:/etc/letsencrypt:rw
+      docker.io/certbot/certbot:latest
+      certonly
+      --register-unsafely-without-email
+      --agree-tos
+      --webroot
+      --webroot-path /var/www/certbot/
+      -d "{{ podman_nginx_primary_hostname }}"
+      {% for hostname in podman_nginx_additional_hostnames %} -d "{{ hostname }}"{% endfor %}
+      {% if podman_nginx_certbot_testing %} --test-cert{% endif %}
+  when: podman_nginx_cert_stat.stat.exists == false
+  become: yes
+  become_user: "{{ podman_nginx_podman_rootless_user }}"
+
+- name: check if certificate exists
+  stat:
+    path: "/home/{{ podman_nginx_podman_rootless_user }}/certbot/conf/live/{{ podman_nginx_primary_hostname }}/fullchain.pem"
+  register: podman_nginx_cert_stat
+  become: yes
+  become_user: "{{ podman_nginx_podman_rootless_user }}"
+
+- name: ensure certificate exists now
+  ansible.builtin.assert:
+    that:
+      - podman_nginx_cert_stat.stat.exists
+    fail_msg: "Failed to get a Lets Encrypt certificate."
+
+- name: start certbot renewal timer
+  ansible.builtin.systemd_service:
+    name: "certbot-renew.timer"
+    state: started
+    scope: user
+  become: true
+  become_user: "{{ podman_nginx_podman_rootless_user }}"

roles/podman_nginx/templates/certbot-renew.container

@@ -0,0 +1,13 @@
+[Unit]
+Description=Run certbot renew
+
+[Container]
+AutoUpdate=registry
+ContainerName=certbot-renew
+Exec=renew
+Image=docker.io/certbot/certbot:latest
+Volume=/home/{{ podman_nginx_podman_rootless_user }}/certbot/www:/var/www/certbot
+Volume=/home/{{ podman_nginx_podman_rootless_user }}/certbot/conf:/etc/letsencrypt
+
+[Service]
+Restart=no

roles/podman_nginx/templates/certbot-renew.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Timer for certbot renewals
+
+[Timer]
+OnCalendar=daily
+Persistent=true
+
+[Install]
+WantedBy=timers.target

roles/podman_nginx/templates/nginx.conf

@@ -0,0 +1,17 @@
+# {{ ansible_managed }}
+
+server {
+    listen 80;
+    listen [::]:80;
+
+    server_name {{ podman_nginx_primary_hostname }};
+    server_tokens off;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://{{ podman_nginx_primary_hostname }}$request_uri;
+    }
+}

roles/podman_nginx/templates/nginx.container

@@ -0,0 +1,16 @@
+[Container]
+ContainerName=nginx
+Image=docker.io/nginx:latest
+{% if podman_nginx_frontend_network is defined %}Network={{ podman_nginx_frontend_network }}.network{% endif +%}
+PublishPort=80:80
+PublishPort=443:443
+Volume=/home/{{ podman_nginx_podman_rootless_user }}/certbot/www:/var/www/certbot/:ro
+Volume=/home/{{ podman_nginx_podman_rootless_user }}/certbot/conf/:/etc/letsencrypt/:ro
+Volume=/home/{{ podman_nginx_podman_rootless_user }}/nginx:/etc/nginx/conf.d/:ro
+
+[Service]
+RuntimeMaxSec=604800
+Restart=always
+
+[Install]
+WantedBy=default.target

roles/vps/tasks/main.yml

@@ -0,0 +1,35 @@
+---
+# https://support.solusvm.com/hc/en-us/articles/21334950006807-How-to-install-Guest-Tools-manually-inside-a-VM-in-SolusVM-2
+
+- name: install required packages
+  apt:
+    pkg:
+      - qemu-guest-agent
+      - cloud-init
+      - tuned
+    state: latest
+    cache_valid_time: 3600
+  become: true
+  when: ansible_distribution == 'Debian'
+
+- name: install required packages
+  dnf:
+    name:
+      - qemu-guest-agent
+      - cloud-init
+      - tuned
+    state: latest
+    update_cache: true
+  become: true
+  when: ansible_distribution == 'AlmaLinux'
+
+- name: check tuned profile
+  command: tuned-adm active
+  register: vps_tuned_profile
+  become: true
+  changed_when: false
+
+- name: start tuned profile
+  shell: tuned-adm profile virtual-guest
+  become: true
+  when: "'virtual-guest' not in vps_tuned_profile.stdout"