add scurvy
This commit is contained in:
parent
a5ddb4f7f6
commit
f761f69683
4
deploy-scurvy.yml
Normal file
4
deploy-scurvy.yml
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
- name: scurvy setup
|
||||||
|
hosts: scurvy
|
||||||
|
roles:
|
||||||
|
- scurvy
|
||||||
2
group_vars/scurvy.yml
Normal file
2
group_vars/scurvy.yml
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
---
|
||||||
|
openvpn_user: "{{ lookup('env', 'OPENVPN_USER') }}"
|
||||||
@ -45,3 +45,6 @@ mail.simponic.xyz ansible_user=root ansible_connection=ssh
|
|||||||
|
|
||||||
[roundcube]
|
[roundcube]
|
||||||
europa ansible_user=root ansible_connection=ssh
|
europa ansible_user=root ansible_connection=ssh
|
||||||
|
|
||||||
|
[scurvy]
|
||||||
|
europa ansible_user=root ansible_connection=ssh
|
||||||
|
|||||||
@ -0,0 +1,13 @@
|
|||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
server_name jellyfin.internal.simponic.xyz;
|
||||||
|
|
||||||
|
location /.well-known/acme-challenge {
|
||||||
|
root /var/www/letsencrypt;
|
||||||
|
try_files $uri $uri/ =404;
|
||||||
|
}
|
||||||
|
|
||||||
|
location / {
|
||||||
|
rewrite ^ https://jellyfin.internal.simponic.xyz$request_uri? permanent;
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,13 @@
|
|||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
server_name scurvy.internal.simponic.xyz;
|
||||||
|
|
||||||
|
location /.well-known/acme-challenge {
|
||||||
|
root /var/www/letsencrypt;
|
||||||
|
try_files $uri $uri/ =404;
|
||||||
|
}
|
||||||
|
|
||||||
|
location / {
|
||||||
|
rewrite ^ https://scurvy.internal.simponic.xyz$request_uri? permanent;
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,32 @@
|
|||||||
|
server {
|
||||||
|
listen 443 ssl;
|
||||||
|
server_name jellyfin.internal.simponic.xyz;
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/jellyfin.internal.simponic.xyz/fullchain.pem;
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/jellyfin.internal.simponic.xyz/privkey.pem;
|
||||||
|
ssl_trusted_certificate /etc/letsencrypt/live/jellyfin.internal.simponic.xyz/fullchain.pem;
|
||||||
|
|
||||||
|
ssl_session_cache shared:SSL:50m;
|
||||||
|
ssl_session_timeout 5m;
|
||||||
|
ssl_stapling on;
|
||||||
|
ssl_stapling_verify on;
|
||||||
|
|
||||||
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||||
|
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
|
||||||
|
|
||||||
|
ssl_dhparam /etc/nginx/dhparams.pem;
|
||||||
|
ssl_prefer_server_ciphers on;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://127.0.0.1:8096;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
proxy_set_header Host $server_name;
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
|
||||||
|
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,32 @@
|
|||||||
|
server {
|
||||||
|
listen 443 ssl;
|
||||||
|
server_name scurvy.internal.simponic.xyz;
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/scurvy.internal.simponic.xyz/fullchain.pem;
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/scurvy.internal.simponic.xyz/privkey.pem;
|
||||||
|
ssl_trusted_certificate /etc/letsencrypt/live/scurvy.internal.simponic.xyz/fullchain.pem;
|
||||||
|
|
||||||
|
ssl_session_cache shared:SSL:50m;
|
||||||
|
ssl_session_timeout 5m;
|
||||||
|
ssl_stapling on;
|
||||||
|
ssl_stapling_verify on;
|
||||||
|
|
||||||
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||||
|
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
|
||||||
|
|
||||||
|
ssl_dhparam /etc/nginx/dhparams.pem;
|
||||||
|
ssl_prefer_server_ciphers on;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://127.0.0.1:9000;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
proxy_set_header Host $server_name;
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
|
||||||
|
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
|
||||||
|
}
|
||||||
|
}
|
||||||
22
roles/scurvy/tasks/main.yml
Normal file
22
roles/scurvy/tasks/main.yml
Normal file
@ -0,0 +1,22 @@
|
|||||||
|
---
|
||||||
|
- name: ensure scurvy docker/compose exist
|
||||||
|
file:
|
||||||
|
path: /etc/docker/compose/scurvy
|
||||||
|
state: directory
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: 0700
|
||||||
|
|
||||||
|
- name: build scurvy docker-compose.yml.j2
|
||||||
|
template:
|
||||||
|
src: ../templates/docker-compose.yml.j2
|
||||||
|
dest: /etc/docker/compose/scurvy/docker-compose.yml
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: u=rw,g=r,o=r
|
||||||
|
|
||||||
|
- name: daemon-reload and enable scurvy
|
||||||
|
ansible.builtin.systemd_service:
|
||||||
|
state: restarted
|
||||||
|
enabled: true
|
||||||
|
name: docker-compose@scurvy
|
||||||
61
roles/scurvy/templates/docker-compose.yml.j2
Normal file
61
roles/scurvy/templates/docker-compose.yml.j2
Normal file
@ -0,0 +1,61 @@
|
|||||||
|
version: '3'
|
||||||
|
services:
|
||||||
|
gluetun:
|
||||||
|
image: qmcgaw/gluetun
|
||||||
|
container_name: gluetun
|
||||||
|
cap_add:
|
||||||
|
- NET_ADMIN
|
||||||
|
devices:
|
||||||
|
- /dev/net/tun:/dev/net/tun
|
||||||
|
ports:
|
||||||
|
- 127.0.0.1:9000:8080/tcp
|
||||||
|
- 127.0.0.1:6881:6881
|
||||||
|
- 127.0.0.1:6881:6881/udp
|
||||||
|
volumes:
|
||||||
|
- /gluetun
|
||||||
|
environment:
|
||||||
|
- VPN_SERVICE_PROVIDER=mullvad
|
||||||
|
- VPN_TYPE=openvpn
|
||||||
|
- OPENVPN_USER={{ openvpn_user }}
|
||||||
|
- SERVER_CITIES=Salt Lake City UT
|
||||||
|
|
||||||
|
qbittorrent:
|
||||||
|
image: hotio/qbittorrent:latest
|
||||||
|
container_name: qbittorrent
|
||||||
|
environment:
|
||||||
|
- PUID=1000
|
||||||
|
- PGID=1000
|
||||||
|
volumes:
|
||||||
|
- qbittorrent_config:/config:rw
|
||||||
|
- type: bind
|
||||||
|
source: /mnt/hdd-01
|
||||||
|
target: /hdd-01
|
||||||
|
- type: bind
|
||||||
|
source: /mnt/ssd-01
|
||||||
|
target: /ssd-01
|
||||||
|
restart: unless-stopped
|
||||||
|
network_mode: "container:gluetun"
|
||||||
|
|
||||||
|
jellyfin:
|
||||||
|
image: lscr.io/linuxserver/jellyfin:latest
|
||||||
|
container_name: jellyfin
|
||||||
|
environment:
|
||||||
|
- JELLYFIN_PublishedServerUrl=https://jellyfin.internal.simponic.xyz
|
||||||
|
ports:
|
||||||
|
- 127.0.0.1:8096:8096
|
||||||
|
devices:
|
||||||
|
- /dev/dri:/dev/dri
|
||||||
|
volumes:
|
||||||
|
- type: bind
|
||||||
|
source: /mnt/hdd-01
|
||||||
|
target: /hdd-01
|
||||||
|
- type: bind
|
||||||
|
source: /mnt/ssd-01
|
||||||
|
target: /ssd-01
|
||||||
|
- jellyfin_config:/config:rw
|
||||||
|
- jellyfin_cache:/cache:rw
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
jellyfin_config:
|
||||||
|
jellyfin_cache:
|
||||||
|
qbittorrent_config:
|
||||||
Loading…
Reference in New Issue
Block a user