fantognazza/chef-recipes
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Enable DNS in inter-container networks

Browse Source
This commit is contained in:
Francesco Antognazza 2023-02-06 09:59:41 +01:00
parent 44261862ad
commit 29ead64f6a
3 changed files with 249 additions and 252 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

373
containers/nextcloud/tasks.yml
View File

@ -2,201 +2,200 @@
- hosts: all - hosts: all
name: Nextcloud file sharing web service name: Nextcloud file sharing web service
tasks: tasks:
- name: Pull container images - name: Pull container images
become_user: containers become_user: containers
become: true become: true
containers.podman.podman_image: containers.podman.podman_image:
name: docker.io/{{ item }} name: docker.io/{{ item }}
loop: loop:
- nextcloud:latest - nextcloud:latest
- redis:alpine - redis:alpine
- mariadb:latest - mariadb:latest
- name: Create podman volumes - name: Create podman volumes
containers.podman.podman_volume: containers.podman.podman_volume:
state: present state: present
name: "{{ item }}" name: "{{ item }}"
become_user: containers become_user: containers
become: true become: true
loop: loop:
- nextcloud-html - nextcloud-html
- nextcloud-custom_apps - nextcloud-custom_apps
- nextcloud-theme - nextcloud-theme
- nextcloud-data - nextcloud-data
- nextcloud-config - nextcloud-config
- redis-data - redis-data
- nextcloud-db - nextcloud-db
- name: Change permission to nextcloud folder - name: Change permission to nextcloud folder
become: true become: true
ansible.builtin.file: ansible.builtin.file:
path: /etc/nextcloud path: /etc/nextcloud
owner: containers owner: containers
group: containers group: containers
mode: 0700 mode: 0700
state: directory state: directory
- name: Copy nextcloud config directory - name: Copy nextcloud config directory
become: true become: true
ansible.builtin.copy: ansible.builtin.copy:
src: files/nextcloud/ src: files/nextcloud/
dest: /etc/nextcloud/config/ dest: /etc/nextcloud/config/
owner: containers owner: containers
group: containers group: containers
mode: 0600 mode: 0600
- name: Copy systemd service and timer - name: Copy systemd service and timer
become: true become: true
become_user: containers become_user: containers
ansible.builtin.copy: ansible.builtin.copy:
src: files/systemd/ src: files/systemd/
dest: "/home/containers/.config/systemd/user/" dest: "/home/containers/.config/systemd/user/"
owner: containers owner: containers
group: containers group: containers
mode: 0644 mode: 0644
- name: Copy mariadb config directory - name: Copy mariadb config directory
become: true become: true
ansible.builtin.copy: ansible.builtin.copy:
src: files/mariadb/ src: files/mariadb/
dest: /etc/nextcloud/mariadb/ dest: /etc/nextcloud/mariadb/
owner: containers owner: containers
group: containers group: containers
mode: 0600 mode: 0600
- name: Create podman networks - name: Create podman networks
containers.podman.podman_network: containers.podman.podman_network:
name: "{{ item }}" name: "{{ item }}"
recreate: false recreate: false
state: "present" state: "present"
disable_dns: true become_user: containers
become_user: containers become: true
become: true loop:
loop:
- traefik-nextcloud
- mariadb-nextcloud
- redis-nextcloud
- name: Create redis instance
become_user: containers
become: true
containers.podman.podman_container:
name: redis
image: docker.io/redis:latest
state: present
volume:
- redis-data:/data:Z
network:
- redis-nextcloud
generate_systemd:
path: /home/containers/.config/systemd/user/
restart_policy: on-failure
names: true
new: true
- name: Create mariadb instance
become_user: containers
become: true
containers.podman.podman_container:
name: db_nextcloud
image: docker.io/mariadb:latest
state: present
command:
- "--transaction-isolation=READ-COMMITTED"
- "--binlog-format=ROW"
volume:
- nextcloud-db:/var/lib/mysql:Z
- /etc/nextcloud/mariadb/:/etc/mysql/conf.d:Z
network:
- mariadb-nextcloud
env:
MARIADB_ROOT_PASSWORD: "{{ vault_nextcloud_mariadb_root_password }}"
MARIADB_DATABASE: "{{ vault_nextcloud_mariadb_database }}"
MARIADB_USER: "{{ vault_nextcloud_mariadb_user }}"
MARIADB_PASSWORD: "{{ vault_nextcloud_mariadb_password }}"
MARIADB_AUTO_UPGRADE: "true"
generate_systemd:
path: /home/containers/.config/systemd/user/
restart_policy: on-failure
names: true
new: true
- name: Create nextcloud instance
become_user: containers
become: true
containers.podman.podman_container:
name: nextcloud
image: docker.io/nextcloud:latest
state: present
volume:
- nextcloud-html:/var/www/html:Z
- nextcloud-custom_apps:/var/www/html/custom_apps:Z
- nextcloud-theme:/var/www/html/themes:Z
- nextcloud-data:/var/www/html/data:Z
- nextcloud-config:/var/www/html/config:Z
network:
- traefik-nextcloud - traefik-nextcloud
- mariadb-nextcloud - mariadb-nextcloud
- redis-nextcloud - redis-nextcloud
label:
io.containers.autoupdate: "registry"
traefik.enable: "true"
traefik.http.routers.nextcloud.entrypoints: "https"
traefik.http.routers.nextcloud.rule: "Path(`/cloud`)"
traefik.http.routers.nextcloud.tls: "true"
traefik.http.routers.nextcloud.tls.certresolver: "wildcard"
traefik.http.routers.nextcloud.service: "nextcloud"
traefik.http.routers.nextcloud.middlewares: "nextcloud-redirectregex,nextcloud-headers,http-compress@file"
traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.permanent: "true"
traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.regex: "https://(.*)/cloud/.well-known/(card|cal)dav"
traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.replacement: "https://${1}/cloud/remote.php/dav/"
traefik.http.middlewares.nextcloud-headers.headers.stsSeconds: "31536000"
traefik.http.middlewares.nextcloud-headers.headers.stsIncludeSubdomains: "true"
traefik.http.services.nextcloud.loadbalancer.server.port: "80"
traefik.docker.network: "traefik-nextcloud"
env:
REDIS_HOST: "redis"
REDIS_PORT: "6379"
MYSQL_DATABASE: "{{ vault_nextcloud_mariadb_database }}"
MYSQL_USER: "{{ vault_nextcloud_mariadb_user }}"
MYSQL_PASSWORD: "{{ vault_nextcloud_mariadb_password }}"
MYSQL_HOST: "db_nextcloud"
NEXTCLOUD_DATA_DIR: "/var/www/html/data"
SMTP_HOST: "{{ vault_smtp_host }}"
SMTP_SECURE: "{{ vault_smtp_protocol }}"
SMTP_PORT: "{{ vault_smtp_port }}"
SMTP_AUTHTYPE: "LOGIN"
SMTP_NAME: "{{ vault_smtp_user }}"
SMTP_PASSWORD: "{{ vault_smtp_password }}"
MAIL_FROM_ADDRESS: "nextcloud"
MAIL_DOMAIN: "{{ vault_smtp_domain }}"
TRUSTED_PROXIES: "traefik"
generate_systemd:
path: /home/containers/.config/systemd/user/
restart_policy: on-failure
names: true
new: true
- name: Start containers at boot - name: Create redis instance
become_user: containers become_user: containers
become: true become: true
ansible.builtin.systemd: containers.podman.podman_container:
scope: user name: redis
name: container-{{ item }}.service image: docker.io/redis:latest
enabled: true state: present
state: started volume:
daemon_reload: true - redis-data:/data:Z
loop: network:
- nextcloud - redis-nextcloud
- redis generate_systemd:
- db_nextcloud path: /home/containers/.config/systemd/user/
restart_policy: on-failure
names: true
new: true
- name: Enable a timer unit - name: Create mariadb instance
become: true become_user: containers
become_user: containers become: true
ansible.builtin.systemd: containers.podman.podman_container:
scope: user name: db_nextcloud
name: nextcloudcron.timer image: docker.io/mariadb:latest
enabled: true state: present
state: started command:
daemon_reload: true - "--transaction-isolation=READ-COMMITTED"
- "--binlog-format=ROW"
volume:
- nextcloud-db:/var/lib/mysql:Z
- /etc/nextcloud/mariadb/:/etc/mysql/conf.d:Z
network:
- mariadb-nextcloud
env:
MARIADB_ROOT_PASSWORD: "{{ vault_nextcloud_mariadb_root_password }}"
MARIADB_DATABASE: "{{ vault_nextcloud_mariadb_database }}"
MARIADB_USER: "{{ vault_nextcloud_mariadb_user }}"
MARIADB_PASSWORD: "{{ vault_nextcloud_mariadb_password }}"
MARIADB_AUTO_UPGRADE: "true"
generate_systemd:
path: /home/containers/.config/systemd/user/
restart_policy: on-failure
names: true
new: true
- name: Create nextcloud instance
become_user: containers
become: true
containers.podman.podman_container:
name: nextcloud
image: docker.io/nextcloud:latest
state: present
volume:
- nextcloud-html:/var/www/html:Z
- nextcloud-custom_apps:/var/www/html/custom_apps:Z
- nextcloud-theme:/var/www/html/themes:Z
- nextcloud-data:/var/www/html/data:Z
- nextcloud-config:/var/www/html/config:Z
network:
- traefik-nextcloud
- mariadb-nextcloud
- redis-nextcloud
label:
io.containers.autoupdate: "registry"
traefik.enable: "true"
traefik.http.routers.nextcloud.entrypoints: "https"
traefik.http.routers.nextcloud.rule: "PathPrefix(`/cloud`)"
traefik.http.routers.nextcloud.tls: "true"
traefik.http.routers.nextcloud.tls.certresolver: "wildcard"
traefik.http.routers.nextcloud.service: "nextcloud"
traefik.http.routers.nextcloud.middlewares: "nextcloud-redirectregex,nextcloud-headers,http-compress@file"
traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.permanent: "true"
traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.regex: "https://(.*)/cloud/.well-known/(card|cal)dav"
traefik.http.middlewares.nextcloud-redirectregex.redirectRegex.replacement: "https://${1}/cloud/remote.php/dav/"
traefik.http.middlewares.nextcloud-headers.headers.stsSeconds: "31536000"
traefik.http.middlewares.nextcloud-headers.headers.stsIncludeSubdomains: "true"
traefik.http.services.nextcloud.loadbalancer.server.port: "80"
traefik.docker.network: "traefik-nextcloud"
env:
REDIS_HOST: "redis"
REDIS_PORT: "6379"
MYSQL_DATABASE: "{{ vault_nextcloud_mariadb_database }}"
MYSQL_USER: "{{ vault_nextcloud_mariadb_user }}"
MYSQL_PASSWORD: "{{ vault_nextcloud_mariadb_password }}"
MYSQL_HOST: "db_nextcloud"
NEXTCLOUD_DATA_DIR: "/var/www/html/data"
SMTP_HOST: "{{ vault_smtp_host }}"
SMTP_SECURE: "{{ vault_smtp_protocol }}"
SMTP_PORT: "{{ vault_smtp_port }}"
SMTP_AUTHTYPE: "LOGIN"
SMTP_NAME: "{{ vault_smtp_user }}"
SMTP_PASSWORD: "{{ vault_smtp_password }}"
MAIL_FROM_ADDRESS: "nextcloud"
MAIL_DOMAIN: "{{ vault_smtp_domain }}"
TRUSTED_PROXIES: "traefik"
generate_systemd:
path: /home/containers/.config/systemd/user/
restart_policy: on-failure
names: true
new: true
- name: Start containers at boot
become_user: containers
become: true
ansible.builtin.systemd:
scope: user
name: container-{{ item }}.service
enabled: true
state: started
daemon_reload: true
loop:
- nextcloud
- redis
- db_nextcloud
- name: Enable a timer unit
become: true
become_user: containers
ansible.builtin.systemd:
scope: user
name: nextcloudcron.timer
enabled: true
state: started
daemon_reload: true

125
containers/portainer/tasks.yml
View File

@ -2,71 +2,70 @@
- hosts: all - hosts: all
name: Portainer container manager name: Portainer container manager
tasks: tasks:
- name: Get containers UID - name: Get containers UID
ansible.builtin.command: "id -u containers" ansible.builtin.command: "id -u containers"
register: uid_containers register: uid_containers
changed_when: uid_containers.rc != 0 changed_when: uid_containers.rc != 0
- name: Pull portainer image - name: Pull portainer image
become_user: containers become_user: containers
become: true become: true
containers.podman.podman_image: containers.podman.podman_image:
name: docker.io/portainer/portainer-ee:latest name: docker.io/portainer/portainer-ee:latest
- name: Create traefik-portainer network - name: Create traefik-portainer network
containers.podman.podman_network: containers.podman.podman_network:
name: traefik-portainer name: traefik-portainer
recreate: false recreate: false
state: "present" state: "present"
disable_dns: true become_user: containers
become_user: containers become: true
become: true
- name: Create portainer data volume - name: Create portainer data volume
containers.podman.podman_volume: containers.podman.podman_volume:
state: present state: present
name: portainer name: portainer
become_user: containers become_user: containers
become: true become: true
- name: Create portainer instance - name: Create portainer instance
become_user: containers become_user: containers
become: true become: true
containers.podman.podman_container: containers.podman.podman_container:
name: portainer name: portainer
image: docker.io/portainer/portainer-ee:latest image: docker.io/portainer/portainer-ee:latest
state: present state: present
security_opt: security_opt:
- label=type:container_runtime_t - label=type:container_runtime_t
volume: volume:
- /run/user/{{ uid_containers.stdout }}/podman/podman.sock:/var/run/docker.sock:z - /run/user/{{ uid_containers.stdout }}/podman/podman.sock:/var/run/docker.sock:z
- portainer:/data:Z - portainer:/data:Z
network: network:
- traefik-portainer - traefik-portainer
label: label:
io.containers.autoupdate: "registry" io.containers.autoupdate: "registry"
traefik.enable: "true" traefik.enable: "true"
traefik.http.routers.portainer.entrypoints: "https" traefik.http.routers.portainer.entrypoints: "https"
traefik.http.routers.portainer.rule: "Path(`/portainer`)" traefik.http.routers.portainer.rule: "PathPrefix(`/portainer`)"
traefik.http.routers.portainer.tls: "true" traefik.http.routers.portainer.tls: "true"
traefik.http.routers.portainer.tls.certresolver: "wildcard" traefik.http.routers.portainer.tls.certresolver: "wildcard"
traefik.http.routers.portainer.service: "portainer" traefik.http.routers.portainer.service: "portainer"
traefik.http.services.portainer.loadbalancer.server.port: "9000" traefik.http.services.portainer.loadbalancer.server.port: "9000"
traefik.docker.network: "traefik-portainer" traefik.docker.network: "traefik-portainer"
generate_systemd: generate_systemd:
path: /home/containers/.config/systemd/user/ path: /home/containers/.config/systemd/user/
restart_policy: on-failure restart_policy: on-failure
names: true names: true
new: true new: true
- name: Start containers at boot - name: Start containers at boot
become_user: containers become_user: containers
become: true become: true
ansible.builtin.systemd: ansible.builtin.systemd:
scope: user scope: user
name: container-{{ item }}.service name: container-{{ item }}.service
enabled: true enabled: true
state: started state: started
daemon_reload: true daemon_reload: true
loop: loop:
- portainer - portainer

3
containers/traefik/tasks.yml
View File

@ -66,7 +66,6 @@
name: "{{ item }}" name: "{{ item }}"
recreate: false recreate: false
state: "present" state: "present"
disable_dns: true
become_user: containers become_user: containers
become: true become: true
loop: loop:
@ -100,7 +99,7 @@
traefik.enable: "true" traefik.enable: "true"
traefik.http.middlewares.traefik-auth.basicauth.users: "{{ vault_traefik_basic_auth }}" traefik.http.middlewares.traefik-auth.basicauth.users: "{{ vault_traefik_basic_auth }}"
traefik.http.routers.traefik.entrypoints: "https" traefik.http.routers.traefik.entrypoints: "https"
traefik.http.routers.traefik.rule: "Path(`/traefik`)" traefik.http.routers.traefik.rule: "PathPrefix(`/traefik`)"
traefik.http.routers.traefik.middlewares: "traefik-auth@docker" traefik.http.routers.traefik.middlewares: "traefik-auth@docker"
traefik.http.routers.traefik.tls: "true" traefik.http.routers.traefik.tls: "true"
traefik.http.routers.traefik.tls.certresolver: "wildcard" traefik.http.routers.traefik.tls.certresolver: "wildcard"