126 lines
3.2 KiB
YAML
126 lines
3.2 KiB
YAML
|
---
|
||
|
|
- hosts: all
|
||
|
|
name: Traefik reverse proxy
|
||
|
|
tasks:
|
||
|
|
- name: Get containers UID
|
||
|
|
ansible.builtin.command: "id -u containers"
|
||
|
|
register: uid_containers
|
||
|
|
changed_when: uid_containers.rc != 0
|
||
|
|
|
||
|
|
- name: Permit traffic from any IP to http port
|
||
|
|
become: true
|
||
|
|
ansible.builtin.ufw:
|
||
|
|
direction: in
|
||
|
|
from_ip: any
|
||
|
|
proto: tcp
|
||
|
|
to_port: 80
|
||
|
|
rule: allow
|
||
|
|
|
||
|
|
- name: Permit traffic from any IP to https port
|
||
|
|
become: true
|
||
|
|
ansible.builtin.ufw:
|
||
|
|
direction: in
|
||
|
|
from_ip: any
|
||
|
|
proto: tcp
|
||
|
|
to_port: 443
|
||
|
|
rule: allow
|
||
|
|
|
||
|
|
- name: Pull traefik image
|
||
|
|
become_user: containers
|
||
|
|
become: true
|
||
|
|
containers.podman.podman_image:
|
||
|
|
name: docker.io/traefik:latest
|
||
|
|
|
||
|
|
- name: Change permission to traefik folder
|
||
|
|
become: true
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: /etc/traefik
|
||
|
|
owner: containers
|
||
|
|
group: containers
|
||
|
|
mode: 0700
|
||
|
|
state: directory
|
||
|
|
|
||
|
|
- name: Copy config directory
|
||
|
|
become: true
|
||
|
|
ansible.builtin.copy:
|
||
|
|
src: files/
|
||
|
|
dest: /etc/traefik/
|
||
|
|
owner: containers
|
||
|
|
group: containers
|
||
|
|
mode: 0600
|
||
|
|
|
||
|
|
- name: Copy config files from templates
|
||
|
|
become: true
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: "templates/{{ item }}.j2"
|
||
|
|
dest: "/etc/traefik/{{ item }}"
|
||
|
|
owner: containers
|
||
|
|
group: containers
|
||
|
|
mode: 0600
|
||
|
|
loop:
|
||
|
|
- traefik.yml
|
||
|
|
- conf/cockpit.yml
|
||
|
|
|
||
|
|
- name: Create podman networks
|
||
|
|
containers.podman.podman_network:
|
||
|
|
name: "{{ item }}"
|
||
|
|
recreate: false
|
||
|
|
state: "present"
|
||
|
|
disable_dns: true
|
||
|
|
become_user: containers
|
||
|
|
become: true
|
||
|
|
loop:
|
||
|
|
- traefik
|
||
|
|
- traefik-portainer
|
||
|
|
- traefik-nextcloud
|
||
|
|
|
||
|
|
- name: Create traefik instance
|
||
|
|
become_user: containers
|
||
|
|
become: true
|
||
|
|
containers.podman.podman_container:
|
||
|
|
name: traefik
|
||
|
|
image: docker.io/traefik:latest
|
||
|
|
state: present
|
||
|
|
ports:
|
||
|
|
- 80:80
|
||
|
|
- 443:443
|
||
|
|
security_opt:
|
||
|
|
- label=type:container_runtime_t
|
||
|
|
volume:
|
||
|
|
- /run/user/{{ uid_containers.stdout }}/podman/podman.sock:/var/run/docker.sock:z
|
||
|
|
- /etc/traefik/:/etc/traefik:Z
|
||
|
|
network:
|
||
|
|
- traefik
|
||
|
|
- traefik-portainer
|
||
|
|
- traefik-nextcloud
|
||
|
|
cap_add:
|
||
|
|
- NET_ADMIN
|
||
|
|
label:
|
||
|
|
io.containers.autoupdate: "registry"
|
||
|
|
traefik.enable: "true"
|
||
|
|
traefik.http.middlewares.traefik-auth.basicauth.users: "{{ vault_traefik_basic_auth }}"
|
||
|
|
traefik.http.routers.traefik.entrypoints: "https"
|
||
|
|
traefik.http.routers.traefik.rule: "Path(`/traefik`)"
|
||
|
|
traefik.http.routers.traefik.middlewares: "traefik-auth@docker"
|
||
|
|
traefik.http.routers.traefik.tls: "true"
|
||
|
|
traefik.http.routers.traefik.tls.certresolver: "wildcard"
|
||
|
|
traefik.http.routers.traefik.tls.domains[0].main: "{{ inventory_hostname }}"
|
||
|
|
traefik.http.routers.traefik.service: "api@internal"
|
||
|
|
generate_systemd:
|
||
|
|
path: /home/containers/.config/systemd/user/
|
||
|
|
restart_policy: on-failure
|
||
|
|
names: true
|
||
|
|
new: true
|
||
|
|
|
||
|
|
- name: Start containers at boot
|
||
|
|
become_user: containers
|
||
|
|
become: true
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
scope: user
|
||
|
|
name: container-{{ item }}.service
|
||
|
|
enabled: true
|
||
|
|
state: started
|
||
|
|
daemon_reload: true
|
||
|
|
loop:
|
||
|
|
- traefik
|