sr2/ansible-collection-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: initial commit
Some checks failed
Ansible Lint Check / lint (push) Failing after 44s
Details

Browse source
This commit is contained in:
Iain Learmonth 2025-11-08 20:55:40 +00:00
commit ce0eb65c8e
36 changed files with 946 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
roles/podman_link/templates/etc/motd.d/10-data-plate.txt Normal file
View file

@ -0,0 +1,16 @@
=========================================================
A CDR Link instance is hosted on this server.
Podman user: {{ podman_link_podman_rootless_user }}
=========================================================
# Become the podman user
sudo -iu {{ podman_link_podman_rootless_user }}
# Check the Link stack status
systemctl --user status link.target
# Restart the Link stack
systemctl --user restart link.target
# Follow the logs for the Link stack
journalctl --user -fu link.slice
# Reindex Zammad in Opensearch
systemctl --user start zammad-reindex.service
=========================================================

10
roles/podman_link/templates/home/config/containers/systemd/bridge-postgresql.container Normal file
View file

@ -0,0 +1,10 @@
[Container]
ContainerName=bridge-postgresql
EnvironmentFile=common-bridge.env
Image=registry.gitlab.com/digiresilience/link/link-stack/postgresql:3.2.0b1
Volume=/home/{{ podman_link_podman_rootless_user }}/bridge-postgresql-data:/var/lib/postgresql/data:rw,Z
Network=link.network
[Service]
Restart=always
Slice=link.slice

14
roles/podman_link/templates/home/config/containers/systemd/bridge-whatsapp.container Normal file
View file

@ -0,0 +1,14 @@
[Unit]
PartOf=link.service
[Container]
ContainerName=bridge-whatsapp
Environment=BRIDGE_FRONTEND_URL=http://link:3000
ExposeHostPort=5000
Image=registry.gitlab.com/digiresilience/link/link-stack/bridge-whatsapp:3.2.0b1
Volume=/home/{{ podman_link_podman_rootless_user }}/bridge-whatsapp-data:/home/node/baileys:rw,Z
Network=link.network
[Service]
Restart=always
Slice=link.slice

15
roles/podman_link/templates/home/config/containers/systemd/bridge-worker.container Normal file
View file

@ -0,0 +1,15 @@
[Unit]
Requires=bridge-postgresql.service
Wants=bridge-whatsapp.service signal-cli-rest-api.service
After=bridge-postgresql.service
PartOf=link.service
[Container]
ContainerName=bridge-worker
EnvironmentFile=common-bridge.env
Image=registry.gitlab.com/digiresilience/link/link-stack/bridge-worker:3.2.0b1
Network=link.network
[Service]
Restart=always
Slice=link.slice

19
roles/podman_link/templates/home/config/containers/systemd/common-bridge.env Normal file
View file

@ -0,0 +1,19 @@
POSTGRES_USER={{ podman_link_postgres_link_user }}
POSTGRES_PASSWORD={{ podman_link_postgres_link_password }}
POSTGRES_DB={{ podman_link_postgres_link_database }}
NEXTAUTH_URL=https://{{ podman_link_web_hostname }}/link/api/auth
NEXTAUTH_SECRET={{ podman_link_nextauth_secret }}
{% if podman_link_google_client_id is defined %}
GOOGLE_CLIENT_ID={{ podman_link_google_client_id }}
GOOGLE_CLIENT_SECRET={{ podman_link_google_client_secret }}
{% endif %}
BRIDGE_FRONTEND_URL=http://link:3000
BRIDGE_SIGNAL_URL=http://signal-cli-rest-api:8081
BRIDGE_WHATSAPP_URL=http://bridge-whatsapp:5000
DATABASE_NAME={{ podman_link_postgres_link_database }}
DATABASE_HOST=bridge-postgresql
DATABASE_USER={{ podman_link_postgres_link_user }}
DATABASE_PASSWORD={{ podman_link_postgres_link_password }}
DATABASE_PORT=5432
DATABASE_URL=postgresql://{{ podman_link_postgres_link_user }}:{{ podman_link_postgres_link_password }}@bridge-postgresql/{{ podman_link_postgres_link_database}}
TZ=Etc/UTC

12
roles/podman_link/templates/home/config/containers/systemd/common-zammad.env Normal file
View file

@ -0,0 +1,12 @@
POSTGRESQL_HOST=zammad-postgresql
POSTGRESQL_PASS={{ podman_link_postgres_zammad_password }}
POSTGRESQL_USER={{ podman_link_postgres_zammad_user }}
POSTGRESQL_DB={{ podman_link_postgres_zammad_database }}
POSTGRESQL_OPTIONS=?pool=50
REDIS_URL=redis://default:{{ podman_link_zammad_redis_password }}@zammad-redis:6379
MEMCACHE_SERVERS=zammad-memcached:11211
ELASTICSEARCH_HOST=zammad-opensearch
ELASTICSEARCH_USER=admin
ELASTICSEARCH_PASS={{ podman_link_opensearch_password }}
ELASTICSEARCH_SCHEMA=https
ELASTICSEARCH_REINDEX=false

2
roles/podman_link/templates/home/config/containers/systemd/frontend.network Normal file
View file

@ -0,0 +1,2 @@
[Network]
NetworkName=frontend

22
roles/podman_link/templates/home/config/containers/systemd/link.container Normal file
View file

@ -0,0 +1,22 @@
[Unit]
Requires=bridge-postgresql.service bridge-worker.service
After=bridge-postgresql.service bridge-worker.service
PartOf=zammad-nginx.service
[Container]
ContainerName=link
Environment=ZAMMAD_VIRTUAL_HOST={{ podman_link_web_hostname }}
Environment=SETUP_MODE={{ podman_link_setup_mode }}
Environment=LEAFCUTTER_ENABLED={{ podman_link_leafcutter_enabled }}
Environment=LEAFCUTTER_DEFAULT_DASHBOARD_URL={{ podman_link_dashboard_url }}
Environment=ZAMMAD_API_TOKEN={{ podman_link_zammad_api_token }}
Environment=LINK_URL=https://localhost:3000/link
Environment=ZAMMAD_URL=http://zammad-nginx:8080
EnvironmentFile=common-bridge.env
ExposeHostPort=3000
Image=registry.gitlab.com/digiresilience/link/link-stack/link:3.2.0b1
Network=link.network
[Service]
Restart=always
Slice=link.slice

2
roles/podman_link/templates/home/config/containers/systemd/link.network Normal file
View file

@ -0,0 +1,2 @@
[Network]
NetworkName=link

17
roles/podman_link/templates/home/config/containers/systemd/opensearch-dashboards.container Normal file
View file

@ -0,0 +1,17 @@
[Unit]
Requires=zammad-opensearch.service
After=zammad-opensearch.service
PartOf=link.target
[Container]
ContainerName=opensearch-dashboards
#Environment=OPENSEARCH_USERNAME=admin
#Environment=OPENSEARCH_PASSWORD={{ podman_link_opensearch_password }}
Image=registry.gitlab.com/digiresilience/link/link-stack/opensearch-dashboards:3.2.0b1
PublishPort=127.0.0.1:5601:5601
#Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-dashboards-config.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
Network=link.network
[Service]
Restart=always
Slice=link.slice

17
roles/podman_link/templates/home/config/containers/systemd/signal-cli-rest-api.container Normal file
View file

@ -0,0 +1,17 @@
[Unit]
PartOf=link.service
[Container]
ContainerName=signal-cli-rest-api
Environment=MODE=native
Environment=PORT=8081
Environment=SIGNAL_CLI_UID=1002
Environment=SIGNAL_CLI_GID=1002
ExposeHostPort=8081
Image=registry.gitlab.com/digiresilience/link/link-stack/signal-cli-rest-api:3.2.0b1
Volume=/home/{{ podman_link_podman_rootless_user }}/signal-cli-rest-api-data:/home/.local/share/signal-cli:rw,Z
Network=link.network
[Service]
Restart=always
Slice=link.slice

17
roles/podman_link/templates/home/config/containers/systemd/zammad-init.container Normal file
View file

@ -0,0 +1,17 @@
[Unit]
Requires=zammad-storage.target
After=zammad-storage.target
[Container]
ContainerName=zammad-init
EnvironmentFile=common-zammad.env
Exec=zammad-init
Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.2.0b1
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-config-nginx:/etc/nginx/sites-enabled:rw,z
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var:rw,z
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage:ro,z
Network=link.network
[Service]
Restart=on-failure
Slice=link.slice

13
roles/podman_link/templates/home/config/containers/systemd/zammad-memcached.container Normal file
View file

@ -0,0 +1,13 @@
[Unit]
PartOf=zammad-storage.target
[Container]
ContainerName=zammad-memcached
Exec=memcached -m 256M
Image=registry.gitlab.com/digiresilience/link/link-stack/memcached:3.2.0b1
Network=link.network
ExposeHostPort=11211
[Service]
Restart=always
Slice=link.slice

19
roles/podman_link/templates/home/config/containers/systemd/zammad-nginx.container Normal file
View file

@ -0,0 +1,19 @@
[Unit]
Requires=zammad-railsserver.service link.service
After=zammad-railsserver.service link.service
PartOf=link.target
[Container]
ContainerName=zammad-nginx
EnvironmentFile=common-zammad.env
Exec=zammad-nginx
ExposeHostPort=8080
Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.2.0b1
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-config-nginx:/etc/nginx/sites-enabled:rw,z
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var:ro,z
Network=link.network
Network=frontend.network
[Service]
Restart=always
Slice=link.slice

27
roles/podman_link/templates/home/config/containers/systemd/zammad-opensearch.container Normal file
View file

@ -0,0 +1,27 @@
[Unit]
PartOf=zammad-storage.target
[Container]
ContainerName=zammad-opensearch
Environment=discovery.type=single-node
Environment=plugins.security.ssl.transport.enforce_hostname_verification=false
Environment=plugins.security.ssl.transport.resolve_hostname=false
Environment=cluster.routing.allocation.disk.watermark.low=3gb
Environment=cluster.routing.allocation.disk.watermark.high=2gb
Environment=cluster.routing.allocation.disk.watermark.flood_stage=500mb
Environment=cluster.info.update.interval=1m
Environment=node.name=opensearch-node1
Environment=bootstrap.memory_lock=true
Environment=OPENSEARCH_JAVA_OPTS="-Xms{{ podman_link_opensearch_memory_limit }}m -Xmx{{podman_link_opensearch_memory_limit }}m -XX:-HeapDumpOnOutOfMemoryError"
Environment=OPENSEARCH_INITIAL_ADMIN_PASSWORD={{ podman_link_opensearch_password }}
Environment=compatibility.override_main_response_version=true
Image=registry.gitlab.com/digiresilience/link/link-stack/opensearch:3.2.0b2
PublishPort=127.0.0.1:9200:9200
PublishPort=127.0.0.1:9600:9600
Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-data:/usr/share/opensearch/data:rw,Z
Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-config.yml:/usr/share/opensearch/config/opensearch-security/config.yml:rw,Z
Network=link.network
[Service]
Restart=always
Slice=link.slice

19
roles/podman_link/templates/home/config/containers/systemd/zammad-postgresql.container Normal file
View file

@ -0,0 +1,19 @@
[Unit]
PartOf=zammad-storage.target
[Container]
ContainerName=zammad-postgresql
Environment=POSTGRES_PASSWORD={{ podman_link_postgres_zammad_password }}
Environment=POSTGRES_USER={{ podman_link_postgres_zammad_user }}
Environment=POSTGRES_DB={{ podman_link_postgres_zammad_database }}
Environment=POSTGRES_HOST_AUTH_METHOD=scram-sha-256
Environment=POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256
Image=registry.gitlab.com/digiresilience/link/link-stack/postgresql:3.2.0b1
Volume=/home/{{ podman_link_podman_rootless_user }}/postgresql-data:/var/lib/postgresql/data:rw,Z
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-data:/opt/zammad:rw,z
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-backup:/var/tmp/zammad:ro,z
Network=link.network
[Service]
Restart=always
Slice=link.slice

19
roles/podman_link/templates/home/config/containers/systemd/zammad-railsserver.container Normal file
View file

@ -0,0 +1,19 @@
[Unit]
Requires=zammad-storage.target
After=zammad-storage.target
Wants=zammad-init.service zammad-reindex.service
PartOf=zammad-nginx.service
[Container]
ContainerName=zammad-railsserver
EnvironmentFile=common-zammad.env
Exec=zammad-railsserver
Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.2.0b1
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var:rw,z
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage:rw,z
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-database.yml:/opt/zammad/config/database.yml:ro,z
Network=link.network
[Service]
Restart=always
Slice=link.slice

13
roles/podman_link/templates/home/config/containers/systemd/zammad-redis.container Normal file
View file

@ -0,0 +1,13 @@
[Unit]
PartOf=zammad-storage.target
[Container]
ContainerName=zammad-redis
Environment=REDIS_PASSWORD={{ podman_link_zammad_redis_password }}
Image=registry.gitlab.com/digiresilience/link/link-stack/redis:3.2.0b1
Volume=/home/{{ podman_link_podman_rootless_user }}/redis-data:/data:rw,Z
Network=link.network
[Service]
Restart=always
Slice=link.slice

16
roles/podman_link/templates/home/config/containers/systemd/zammad-scheduler.container Normal file
View file

@ -0,0 +1,16 @@
[Unit]
Requires=zammad-storage.target
After=zammad-storage.target
[Container]
ContainerName=zammad-scheduler
EnvironmentFile=common-zammad.env
Exec=zammad-scheduler
Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.2.0b1
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var:rw,z
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage:rw,z
Network=link.network
[Service]
Restart=always
Slice=link.slice

16
roles/podman_link/templates/home/config/containers/systemd/zammad-websocket.container Normal file
View file

@ -0,0 +1,16 @@
[Unit]
Requires=zammad-storage.target
After=zammad-storage.target
[Container]
ContainerName=zammad-websocket
EnvironmentFile=common-zammad.env
Exec=zammad-websocket
Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.2.0b1
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var:rw,z
Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage:rw,z
Network=link.network
[Service]
Restart=always
Slice=link.slice

2
roles/podman_link/templates/home/config/systemd/user/link.slice Normal file
View file

@ -0,0 +1,2 @@
[Unit]
Description=Podman CDR Link Stack by SR2 Communications

9
roles/podman_link/templates/home/config/systemd/user/link.target Normal file
View file

@ -0,0 +1,9 @@
[Unit]
Description=Podman CDR Link Stack by SR2 Communications
Requires=opensearch-dashboards.service
Requires=zammad-nginx.service
After=opensearch-dashboards.service
After=zammad-nginx.service
[Install]
WantedBy=default.target

9
roles/podman_link/templates/home/config/systemd/user/zammad-reindex.service Normal file
View file

@ -0,0 +1,9 @@
[Unit]
Description=Rebuild Zammad search index
Requires=zammad-railsserver.service
After=zammad-railsserver.service
[Service]
Type=oneshot
ExecStart=/usr/bin/podman exec zammad-railsserver bundle exec rake zammad:searchindex:rebuild
Restart=never

10
roles/podman_link/templates/home/config/systemd/user/zammad-storage.target Normal file
View file

@ -0,0 +1,10 @@
[Unit]
Description=Podman CDR Link Data Sources by SR2 Communications
Requires=zammad-opensearch.service
Requires=zammad-postgresql.service
Requires=zammad-redis.service
Requires=zammad-memcached.service
After=zammad-opensearch.service
After=zammad-postgresql.service
After=zammad-redis.service
After=zammad-memcached.service

94
roles/podman_link/templates/home/nginx.conf Normal file
View file

@ -0,0 +1,94 @@
resolver 10.89.0.1 ipv6=off valid=10s;
# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
# scheme used to connect to this server
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
default $http_x_forwarded_proto;
'' $scheme;
}
# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
# server port the client connected to
map $http_x_forwarded_port $proxy_x_forwarded_port {
default $http_x_forwarded_port;
'' $server_port;
}
# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
# Connection header that may have been passed to this server
map $http_upgrade $proxy_connection {
default upgrade;
'' close;
}
# Apply fix for very long server names
server_names_hash_bucket_size 128;
# Default dhparam
# Set appropriate X-Forwarded-Ssl header
map $scheme $proxy_x_forwarded_ssl {
default off;
https on;
}
gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
log_format vhost '$host $remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent"';
access_log off;
# HTTP 1.1 support
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
# Mitigate httpoxy attack (see README for details)
proxy_set_header Proxy "";
server {
listen 80;
listen [::]:80;
server_name {{ podman_link_web_hostname }};
server_tokens off;
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
location / {
return 301 https://{{ podman_link_web_hostname }}$request_uri;
}
}
upstream zammad {
zone zammad_upstream 64k;
server zammad-nginx:8080 resolve;
}
server {
server_name {{ podman_link_web_hostname }};
listen 80 ;
access_log /var/log/nginx/access.log vhost;
return 301 https://$host$request_uri;
}
server {
server_name {{ podman_link_web_hostname }};
listen 443 ssl;
listen [::]:443 ssl;
http2 on;
server_tokens off;
ssl_certificate /etc/letsencrypt/live/{{ podman_link_web_hostname }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ podman_link_web_hostname }}/privkey.pem;
add_header Strict-Transport-Security "max-age=31536000" always;
add_header Referrer-Policy origin always; # make sure outgoing links don't show the URL to the Matomo instance
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
location / {
proxy_pass http://zammad;
}
}

9
roles/podman_link/templates/home/zammad-database.yml Normal file
View file

@ -0,0 +1,9 @@
production:
adapter: postgresql
database: {{ podman_link_postgres_zammad_database }}
pool: 50
timeout: 5000
encoding: utf8
username: {{ podman_link_postgres_zammad_user }}
password: {{ podman_link_postgres_zammad_password }}
host: zammad-postgresql