unifi

README.md

@@ -1,3 +1,9 @@
 # uumas.docker
 
 Roles for services running on docker.
+
+To add a new role:
+1. Add it
+  1. usually meta/main.yml with depend on container
+  1. README.md
+1. Add docs to docs/

docs/all.md

@@ -0,0 +1,21 @@
+# Required variables
+These variables are required by multiple roles. Example values included.
+
+```
+timezone: 'Europe/Helsinki'
+admin_email: 'admin@domain.tld'
+
+smtp_server: smtp.domain.tld
+smtp_from: sender@domain.tld
+```
+
+# Optional variables
+These variables are used by multiple roles and have the following default values:
+
+```
+reverse_proxy_type: caddy # Allowed values: caddy, traefik, none
+
+smtp_from: # not defined, no smtp login by default
+smtp_pw: # not defined, see above
+
+```

docs/element.md

@@ -0,0 +1,23 @@
+# Required variables
+These variables are required. Example values included.
+
+```
+ports:
+  element_http: 8080
+
+element_domains: # not required if reverse_proxy_type is set to none
+  - chat.domain.tld
+  - element.domain.tld
+
+matrix_domain: domain.tld
+matrix_server_domain: matrix.domain.tld
+```
+
+# Optional variables
+These variables are optional and have the following default values:
+```
+matrix_external_url: https://{{ matrix_server_domain }}
+
+jitsi_domain: jitsi.riot.im
+```
+

docs/general.md

@@ -1,6 +0,0 @@
-# Required variables
-These variables are required by some roles. Example values included.
-
-```
-timezone: 'Europe/Helsinki'
-```

docs/gitea.md

@@ -0,0 +1,16 @@
+# Required variables
+These variables are required. Example values included. Some general variables might also be required for this role.
+
+```
+ports:
+  gitea:
+    http: 8080
+    ssh: 2222
+
+docker_vhost_domains: 
+  gitea:
+    - gitea.domain.tld
+
+database_passwords:
+  gitea: secret
+```

docs/hedgedoc.md

@@ -0,0 +1,15 @@
+# Required variables
+These variables are required. Example values included. Some general variables might also be required for this role.
+
+```
+ports:
+  hedgedoc:
+    http: 8080
+
+docker_vhost_domains: 
+  hedgedoc:
+    - hedgedoc.domain.tld
+
+database_passwords:
+  hedgedoc: secret
+```

docs/jitsi.md

@@ -5,5 +5,5 @@ These variables are required. Example values included. Some general variables mi
 ports:
   jitsi_http: 8080
 
-jitsi_external_url: 'https://jitsi.domain.tld'
+jitsi_domain: 'jitsi.domain.tld'
 ```

docs/keycloak.md

@@ -0,0 +1,17 @@
+# Required variables
+These variables are required. Example values included. Some general variables might also be required for this role.
+
+```
+ports:
+  keycloak:
+    http: 8080
+
+docker_vhost_domains: 
+  keycloak:
+    - keycloak.domain.tld
+
+database_passwords:
+  keycloak: secret
+
+keycloak_admin_pw: secret
+```

docs/wekan.md

@@ -0,0 +1,13 @@
+# Required variables
+These variables are required. Example values included. Some general variables might also be required for this role.
+
+```
+ports:
+  wekan:
+    http: 8080
+
+docker_vhost_domains: 
+  hedgedoc:
+    - wekan.domain.tld
+
+```

galaxy.yml

@@ -2,12 +2,11 @@
 
 namespace: uumas
 name: docker
-version: 0.1.1
+version: 0.5.3
 readme: README.md
 repository: https://git.uumas.fi/uumas/ansible-docker
 license_file: LICENSE
 dependencies:
-  uumas.general: '>0.3.0'
+  uumas.general: '>=0.5.0'
 authors:
   - uumas
-

meta/runtime.yml

@@ -1,4 +1,3 @@
 ---
 
 requires_ansible: ">=2.10"
-

roles/container/README.md

@@ -0,0 +1 @@
+Sets up a docker container

roles/container/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+
+reverse_proxy_type: caddy
+docker_additional_env: {}
+docker_published_ports: []

roles/container/meta/main.yml

@@ -0,0 +1,10 @@
+---
+
+dependencies:
+  - docker
+  - role: uumas.general.reverse_proxy
+    vhost_id: "{{ docker_service }}"
+    vhost_domains: "{{ docker_vhost_domains[docker_service] }}"
+    proxy_target_protocol: "{{ docker_proxy_target_protocol | default('http') }}"
+    proxy_target_port: "{{ ports[docker_service][proxy_target_protocol] }}"
+    when: reverse_proxy_type != 'none' and reverse_proxy_type != 'traefik'

roles/container/tasks/main.yml

@@ -0,0 +1,65 @@
+---
+
+- name: "{{ docker_service }} docker network"
+  docker_network:
+    name: "{{ docker_service }}"
+  when: docker_network_mode is not defined or docker_network_mode != 'host'
+
+- name: Set published ports variable
+  set_fact: 
+    container_published_ports: ["127.0.0.1:{{ ports[docker_service][proxy_target_protocol] }}:{{ docker_image_http_port }}"]
+  when: reverse_proxy_type != 'traefik' and (docker_network_mode is not defined or docker_network_mode != 'host')
+
+- name: Set networks variable
+  set_fact:
+    container_networks:
+      - name: "{{ docker_service }}"
+  when: docker_network_mode is not defined or docker_network_mode != 'host'
+
+- name: Include traefik vars
+  include_vars: traefik.yml
+  when: reverse_proxy_type == 'traefik'
+
+- name: Set postgres container env
+  set_fact:
+    db_container_image: 'postgres:14-alpine'
+    db_container_env:
+      POSTGRES_USER: "{{ docker_service }}"
+      POSTGRES_PASSWORD: "{{ database_passwords[docker_service] }}"
+    db_container_data: /var/lib/postgresql/data
+  when: docker_database is defined and docker_database == 'postgres'
+- name: Set mongo container env
+  set_fact:
+    db_container_image: 'mongo:latest'
+    db_container_data: /data/db
+  when: docker_database is defined and docker_database == 'mongo'
+
+- name: "{{ docker_database }} database container for {{ docker_service }}"
+  docker_container:
+    name: "{{ docker_service }}_db"
+    image: "{{ db_container_image }}"
+    pull: yes
+    container_default_behavior: no_defaults
+    env: "{{ db_container_env | default(omit) }}"
+    restart_policy: always
+    volumes:
+      - "{{ docker_service }}_db:{{ db_container_data }}"
+    networks: "{{ container_networks | default(omit) }}"
+  when: docker_database is defined
+
+- name: "Container for {{ docker_service }}"
+  docker_container:
+    name: "{{ docker_service }}"
+    image: "{{ docker_image }}"
+    pull: true
+    container_default_behavior: no_defaults
+    volumes: "{{ docker_volumes | default(omit) }}"
+    published_ports: "{{ container_published_ports | default([]) + docker_published_ports | default(omit) }}"
+    labels: "{{ traefik_labels | default(omit) }}"
+    env: "{{ docker_env | combine(docker_additional_env) }}"
+    entrypoint: "{{ docker_entrypoint | default(omit) }}"
+    restart_policy: always
+    network_mode: "{{ docker_network_mode | default(omit) }}"
+    networks: "{{ container_networks | default(omit) }}"
+  register: container_out
+

roles/container/vars/traefik.yml

@@ -0,0 +1,6 @@
+---
+
+traefik_labels:
+  traefik.enable: 'true'
+  "traefik.http.routers.{{ docker_service }}.rule": "Host(`{{ vhost_domains[docker_service] | join('`) || Host(`') }}`)"
+  "traefik.http.routers.{{ docker_service }}.tls.certresolver": 'le'

roles/docker/tasks/main.yml

@@ -8,7 +8,16 @@
       - curl
       - gnupg
       - lsb-release
-    update_cache: yes
+    update_cache: true
+
+- name: Set dpkg arch (amd64)
+  set_fact:
+    dpkg_arch: amd64
+  when: ansible_architecture == 'x86_64'
+- name: Set dpkg arch (arm64)
+  set_fact:
+    dpkg_arch: arm64
+  when: ansible_architecture == 'aarch64'
 
 - name: Add docker repo signing key
   apt_key:
@@ -16,7 +25,7 @@
     url: 'https://download.docker.com/linux/debian/gpg'
 - name: Add docker repo
   apt_repository:
-    repo: "deb [arch=amd64] https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
+    repo: "deb [arch={{ dpkg_arch }}] https://download.docker.com/linux/{{ ansible_distribution|lower }} {{ ansible_distribution_release }} stable"
     filename: 'docker'
     mode: '644'
 

roles/element/README.md

@@ -0,0 +1 @@
+Installs element in docker

roles/element/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+
+reverse_proxy_type: caddy

roles/element/meta/main.yml

@@ -0,0 +1,9 @@
+---
+
+dependencies:
+  - docker
+  - role: uumas.general.reverse_proxy
+    vhost_id: element
+    vhost_domains: "{{ element_domains }}"
+    proxy_target: http://127.0.0.1:{{ ports.element_http }}
+    when: reverse_proxy_type != 'none' and reverse_proxy_type != 'traefik'

roles/element/tasks/main.yml

@@ -0,0 +1,36 @@
+---
+
+- name: Set element published ports variable
+  set_fact: 
+    element_published_ports: ["127.0.0.1:{{ ports.element_http }}:80"]
+  when: reverse_proxy_type != 'traefik'
+
+- name: Include traefik vars
+  include_vars: traefik.yml
+  when: reverse_proxy_type == 'traefik'
+
+- name: Element web
+  docker_container:
+    name: 'element'
+    image: 'vectorim/element-web:latest'
+    pull: true
+    container_default_behavior: no_defaults
+    volumes:
+      - /app
+    published_ports: "{{ element_published_ports | default(omit) }}"
+    labels: "{{ element_traefik_labels | default(omit) }}"
+    restart_policy: always
+  register: element_out
+
+- name: Get element config volume path from container creation output
+  set_fact:
+    element_config_volume: "{{ element_out.container.Mounts | selectattr('Destination', 'equalto', '/app') | join }}"
+
+- name: Read element config to variable
+  include_vars: element_config.yml
+- name: Put element config in place
+  copy:
+    content: "{{ element_config }}"
+    dest: "{{ element_config_volume.Source }}/config.json"
+    mode: '644'
+

roles/element/vars/element_config.yml

@@ -0,0 +1,35 @@
+---
+
+element_config:
+  default_server_config:
+    m.homeserver:
+      base_url: "{{ matrix_external_url }}"
+      server_name: "{{ matrix_domain }}"
+  disable_custom_urls: true
+  disable_guests: true
+  disable_login_language_selector: false
+  disable_3pid_login: true
+  brand: Element
+  integrations_ui_url: https://scalar.vector.im/
+  integrations_rest_url: https://scalar.vector.im/api
+  integrations_widgets_urls:
+    - https://scalar.vector.im/_matrix/integrations/v1
+    - https://scalar.vector.im/api
+    - https://scalar-staging.vector.im/_matrix/integrations/v1
+    - https://scalar-staging.vector.im/api
+    - https://scalar-staging.riot.im/scalar/api
+  bug_report_endpoint_url: https://element.io/bugreports/submit
+  "defaultCountryCode": GB
+  showLabsSettings: false
+  default_federate: true
+  default_theme: dark
+  roomDirectory:
+    servers:
+      - "{{ matrix_domain }}"
+  enable_presence_by_hs_url:
+    "https://matrix.org": false
+    "https://matrix-client.matrix.org": false
+  settingDefaults:
+    breadcrumbs: true
+  jitsi:
+    preferredDomain: "{{ jitsi_domain | default('jitsi.riot.im') }}"

roles/element/vars/traefik.yml

@@ -0,0 +1,6 @@
+---
+
+element_traefik_labels:
+  traefik.enable: 'true'
+  traefik.http.routers.element.rule: "Host(`{{ element_domains | join('`) || Host(`') }}`)"
+  traefik.http.routers.element.tls.certresolver: 'le'

roles/gitea/README.md

@@ -0,0 +1 @@
+Installs gitea in docker and configures ssh

roles/gitea/meta/main.yml

@@ -0,0 +1,29 @@
+---
+
+dependencies:
+  - role: container
+    docker_service: gitea
+    docker_image: gitea/gitea:latest
+    docker_image_http_port: 3000
+    docker_database: postgres
+    docker_volumes:
+      - gitea_data:/data
+      - /var/lib/gitea/.ssh/:/data/git/.ssh
+    docker_published_ports:
+      - "127.0.0.1:{{ ports.gitea.ssh }}:22"
+    docker_env:
+      USER_UID: '2132'
+      USER_GID: '2132'
+      GITEA__database__DB_TYPE: postgres
+      GITEA__database__USER: gitea
+      GITEA__database__HOST: gitea_db:5432
+      GITEA__database__PASSWD: "{{ database_passwords.gitea }}"
+      GITEA__server__DOMAIN: "{{ docker_vhost_domains.gitea[0] }}"
+      GITEA__server__PROTOCOL: "http"
+      GITEA__server__ROOT_URL: "https://{{ docker_vhost_domains.gitea[0] }}"
+      GITEA__mailer__ENABLED: "true"
+      GITEA__mailer__HOST: "{{ smtp_server }}:587"
+      GITEA__mailer__FROM: "{{ smtp_from }}"
+      GITEA__mailer__MAILER_TYPE: smtp
+      GITERA__mailer__USER: "{{ smtp_user | default(omit) }}"
+      GITERA__mailer__PASSWD: "{{ smtp_pw | default(omit) }}"

roles/gitea/tasks/main.yml

@@ -0,0 +1,28 @@
+---
+
+- name: Create git group on host for gitea ssh
+  group:
+    name: git
+    gid: 2132
+    system: yes
+
+- name: Create git user on host for gitea ssh
+  user:
+    name: git
+    uid: 2132
+    group: git
+    system: yes
+    home: /var/lib/gitea
+    generate_ssh_key: yes
+  register: git_user
+
+- name: Add git user's own ssh key to its authorized keys
+  authorized_key:
+    user: git
+    key: "{{ git_user.ssh_public_key }}"
+
+- name: Put gitea ssh forwarder in place
+  template:
+    src: gitea_ssh_forward.j2
+    dest: /usr/local/bin/gitea
+    mode: '755'

roles/gitea/templates/gitea_ssh_forward.j2

@@ -0,0 +1,2 @@
+#!/bin/sh
+ssh -p {{ ports.gitea.ssh }} -o StrictHostKeyChecking=no git@127.0.0.1 "SSH_ORIGINAL_COMMAND=\"$SSH_ORIGINAL_COMMAND\" $0 $@"

roles/hedgedoc/README.md

@@ -0,0 +1 @@
+Installs hedgedoc in docker

roles/hedgedoc/meta/main.yml

@@ -0,0 +1,18 @@
+---
+
+dependencies:
+  - role: container
+    docker_service: hedgedoc
+    docker_image: quay.io/hedgedoc/hedgedoc:latest
+    docker_image_http_port: 3000
+    docker_database: postgres
+    docker_volumes:
+      - hedgedoc_uploads:/hedgedoc/public/uploads
+    docker_env:
+      CMD_DB_URL: postgres://hedgedoc:{{ database_passwords.hedgedoc }}@hedgedoc_db:5432/hedgedoc
+      CMD_DOMAIN: "{{ docker_vhost_domains.hedgedoc[0] }}"
+      CMD_PROTOCOL_USESSL: "true"
+      CMD_ALLOW_ANONYMOUS: "false"
+      CMD_ALLOW_ANONYMOUS_EDITS: "true"
+      CMD_ALLOW_FREEURL: "true"
+

roles/jitsi/meta/main.yml

@@ -2,4 +2,9 @@
 
 dependencies:
   - docker
-  - uumas.general.caddy
+  - role: uumas.general.reverse_proxy
+    vhost_id: jitsi
+    vhost_domains:
+      - "{{ jitsi_domain }}"
+    proxy_target: http://127.0.0.1:{{ ports.jitsi_http }}
+    when: reverse_proxy_type != 'traefik'

roles/jitsi/tasks/main.yml

@@ -4,44 +4,67 @@
   docker_network:
     name: meet.jitsi
 
+- name: Set jitsi meet web published ports variable
+  set_fact: 
+    jitsi_web_published_ports: ["127.0.0.1:{{ ports.jitsi_http }}:80"]
+  when: reverse_proxy_type != 'traefik'
+
+- name: Include traefik vars
+  include_vars: traefik.yml
+  when: reverse_proxy_type == 'traefik'
+
 - name: Jitsi meet web
   docker_container:
     name: 'jitsi_meet_web'
     image: 'jitsi/web:latest'
-    pull: yes
+    pull: true
     container_default_behavior: no_defaults
-    published_ports:
+    published_ports: "{{ jitsi_web_published_ports | default(omit) }}"
-      - "{{ localhost_ip }}:{{ ports.jitsi_http }}:80"
     env:
       DISABLE_HTTPS: '1'
-      PUBLIC_URL: "{{ jitsi_external_url }}"
+      PUBLIC_URL: "https://{{ jitsi_domain }}"
       TZ: "{{ timezone }}"
       ENABLE_PREJOIN_PAGE: '1'
       ENABLE_REQUIRE_DISPLAY_NAME: '1'
       ENABLE_NOISY_MIC_DETECTION: '0'
-      ENABLE_RECORDING: '0'
+      ENABLE_BREAKOUT_ROOMS: '1'
       JICOFO_AUTH_USER: focus
       XMPP_BOSH_URL_BASE: 'http://xmpp.meet.jitsi:5280'
       XMPP_DOMAIN: meet.jitsi
       XMPP_AUTH_DOMAIN: auth.meet.jitsi
       XMPP_MUC_DOMAIN: muc.meet.jitsi
+    labels: "{{ jitsi_traefik_labels.web | default(omit) }}"
     restart_policy: always
     networks:
       - name: meet.jitsi
         aliases:
           - meet.jitsi
+  register: jitsi_meet_web_out
+
+- set_fact:
+    jitsi_meet_web_config_volume: "{{ jitsi_meet_web_out.container.Mounts | selectattr('Destination', 'equalto', '/config') | join }}"
+
+- name: Disable recording and livestreaming
+  lineinfile:
+    path: "{{ jitsi_meet_web_config_volume.Source }}/config.js"
+    regexp: "^    (\/\/ )?{{ item }}: .*,$"
+    line: "    {{ item }}: false,"
+    state: present
+  loop:
+    - fileRecordingsEnabled
+    - liveStreamingEnabled
 
 - name: Jitsi meet prosody
   docker_container:
     name: 'jitsi_meet_prosody'
     image: 'jitsi/prosody:latest'
-    pull: yes
+    pull: true
     container_default_behavior: no_defaults
     env:
-      PUBLIC_URL: "{{ jitsi_external_url }}"
+      PUBLIC_URL: "https://{{ jitsi_domain }}"
       TZ: "{{ timezone }}"
       ENABLE_LOBBY: '1'
-      JICOFO_COMPONENT_SECRET: "{{ jitsi_pw.jicofo_component }}"
+      ENABLE_BREAKOUT_ROOMS: '1'
       JICOFO_AUTH_USER: focus
       JICOFO_AUTH_PASSWORD: "{{ jitsi_pw.jicofo_auth }}"
       JVB_AUTH_USER: jvb
@@ -63,12 +86,11 @@
   docker_container:
     name: 'jitsi_meet_jicofo'
     image: 'jitsi/jicofo:latest'
-    pull: yes
+    pull: true
     container_default_behavior: no_defaults
     env:
       TZ: "{{ timezone }}"
       JVB_BREWERY_MUC: jvbbrewery
-      JICOFO_COMPONENT_SECRET: "{{ jitsi_pw.jicofo_component }}"
       JICOFO_AUTH_USER: focus
       JICOFO_AUTH_PASSWORD: "{{ jitsi_pw.jicofo_auth }}"
       XMPP_DOMAIN: meet.jitsi
@@ -87,13 +109,13 @@
   docker_container:
     name: 'jitsi_meet_jvb'
     image: 'jitsi/jvb:latest'
-    pull: yes
+    pull: true
     container_default_behavior: no_defaults
     published_ports:
       - "{{ ports.jitsi_jvb | default(10000) }}:10000/udp"
       - "{{ ports.jitsi_jvb_tcp | default(4443) }}:4443"
     env:
-      PUBLIC_URL: "{{ jitsi_external_url }}"
+      PUBLIC_URL: "https://{{ jitsi_domain }}"
       TZ: "{{ timezone }}"
       JVB_PORT: '10000'
       JVB_TCP_PORT: '4443'
@@ -111,14 +133,3 @@
         aliases:
           - meet.jitsi
 
-- name: Add caddy reverse proxy config
-  blockinfile:
-    path: /etc/caddy/Caddyfile
-    marker: "# {mark} ANSIBLE MANAGED BLOCK jitsi"
-    block: |
-      {{ jitsi_external_url }} {
-        reverse_proxy http://{{ localhost_ip }}:{{ ports.jitsi_http }}
-      }
-    validate: 'caddy validate --config %s --adapter caddyfile'
-    backup: yes
-  notify: reload caddy

roles/jitsi/vars/traefik.yml

@@ -0,0 +1,7 @@
+---
+
+jitsi_traefik_labels:
+  web:
+    traefik.enable: 'true'
+    traefik.http.routers.jitsi.rule: "Host(`{{ jitsi_domain }}`)"
+    traefik.http.routers.jitsi.tls.certresolver: 'le'

roles/keycloak/README.md

@@ -0,0 +1 @@
+Installs keycloak in docker

roles/keycloak/meta/main.yml

@@ -0,0 +1,23 @@
+---
+
+dependencies:
+  - role: container
+    docker_service: keycloak
+    docker_image: quay.io/keycloak/keycloak:latest
+    docker_image_http_port: 8080
+    docker_database: postgres
+    docker_entrypoint: 
+      - /opt/keycloak/bin/kc.sh
+      - start
+      - --auto-build
+    docker_env:
+      KEYCLOAK_ADMIN: admin
+      KEYCLOAK_ADMIN_PASSWORD: "{{ keycloak_admin_pw }}"
+      KC_HOSTNAME: "{{ docker_vhost_domains.keycloak[0] }}"
+      KC_HTTP_ENABLED: "true"
+      KC_PROXY: edge
+      KC_DB: postgres
+      KC_DB_URL: jdbc:postgresql://keycloak_db/keycloak
+      KC_DB_USERNAME: keycloak
+      KC_DB_PASSWORD: "{{ database_passwords.keycloak }}"
+

roles/unifi/README.md

@@ -0,0 +1 @@
+Installs unifi controller in docker

roles/unifi/meta/main.yml

@@ -0,0 +1,14 @@
+---
+
+dependencies:
+  - role: container
+    docker_proxy_target_protocol: https
+    docker_service: unifi
+    docker_image: jacobalberty/unifi:latest
+    docker_network_mode: host
+    docker_volumes:
+      - unifi_data:/unifi
+    docker_env:
+      UNIFI_HTTPS_PORT: "{{ ports.unifi.https }}"
+      PORTAL_HTTP_PORT: "8808"
+

roles/wekan/README.md

@@ -0,0 +1 @@
+Installs WeKan in docker

roles/wekan/meta/main.yml

@@ -0,0 +1,15 @@
+---
+
+dependencies:
+  - role: container
+    docker_service: wekan
+    docker_image: quay.io/wekan/wekan
+    docker_image_http_port: 8080
+    docker_database: mongo
+    docker_volumes:
+      - wekan_data:/data
+    docker_env:
+      MONGO_URL: mongodb://wekan_db:27017/wekan
+      ROOT_URL: "https://{{ docker_vhost_domains.wekan[0] }}"
+      WRITABLE_PATH: /data
+

roles/wekan/tasks/main.yml

@@ -0,0 +1,12 @@
+---
+
+- name: Get wekan data volume path from container creation output
+  set_fact:
+    wekan_data_volume: "{{ container_out.container.Mounts | selectattr('Destination', 'equalto', '/data') | join }}"
+
+- name: Set wekan data volume owner
+  file:
+    path: "{{ wekan_data_volume.Source }}"
+    state: directory
+    owner: 999
+    group: 999