Adyrem
bc838dfcb6
Ansible Lint / lint (push) Successful in 7s
- New jellyfin Ansible role: Docker stack (Jellyfin, qBittorrent, Radarr, Sonarr, Prowlarr, FlareSolverr, Jellyseerr) with NVIDIA GPU passthrough - configure_services.yml automates download clients, root folders, Prowlarr indexers/apps, qBittorrent credential pre-seeding, and Jellyseerr setup - Fix TPB Cardigann season search: apibay.org returns 0 for season-level queries (e.g. the.boys.s05); patch strips season/ep from tv-search params and locks the definition file read-only to survive Prowlarr refreshes - Fix Pi-hole update_hosts.py regex: use re.DOTALL + count=1 to handle multi-line arrays without overwriting the DHCP section - Add phone WireGuard peer, devbox Traefik/DNS entries, TLS cert plumbing, firewall rule for Traefik IP to Proxmox web UI Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
131 lines
3.1 KiB
YAML
131 lines
3.1 KiB
YAML
---
|
|
- name: Install dependencies
|
|
ansible.builtin.apt:
|
|
name:
|
|
- curl
|
|
- ca-certificates
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Create traefik user
|
|
ansible.builtin.user:
|
|
name: traefik
|
|
system: true
|
|
shell: /usr/sbin/nologin
|
|
home: /etc/traefik
|
|
create_home: false
|
|
|
|
- name: Create traefik directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: traefik
|
|
group: traefik
|
|
mode: "0750"
|
|
loop:
|
|
- /etc/traefik
|
|
- /etc/traefik/conf.d
|
|
|
|
- name: Create acme.json for Let's Encrypt certificate storage
|
|
ansible.builtin.copy:
|
|
dest: /etc/traefik/acme.json
|
|
content: ""
|
|
owner: traefik
|
|
group: traefik
|
|
mode: "0600"
|
|
force: false
|
|
|
|
- name: Check installed Traefik version
|
|
ansible.builtin.command:
|
|
cmd: /usr/local/bin/traefik version
|
|
register: traefik_installed_version
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Download Traefik binary
|
|
ansible.builtin.get_url:
|
|
url: "https://github.com/traefik/traefik/releases/download/v{{ traefik_version }}/traefik_v{{ traefik_version }}_linux_amd64.tar.gz"
|
|
dest: /tmp/traefik.tar.gz
|
|
mode: "0644"
|
|
when: traefik_version not in (traefik_installed_version.stdout | default(''))
|
|
|
|
- name: Extract Traefik binary
|
|
ansible.builtin.unarchive:
|
|
src: /tmp/traefik.tar.gz
|
|
dest: /usr/local/bin
|
|
include:
|
|
- traefik
|
|
remote_src: true
|
|
mode: "0755"
|
|
when: traefik_version not in (traefik_installed_version.stdout | default(''))
|
|
notify: Restart traefik
|
|
|
|
- name: Create traefik certs directory
|
|
ansible.builtin.file:
|
|
path: /etc/traefik/certs
|
|
state: directory
|
|
owner: traefik
|
|
group: traefik
|
|
mode: "0750"
|
|
|
|
- name: Copy homelab TLS certificate
|
|
ansible.builtin.copy:
|
|
src: "{{ playbook_dir }}/../../certs/wildcard.homelab.pem"
|
|
dest: /etc/traefik/certs/homelab.pem
|
|
owner: traefik
|
|
group: traefik
|
|
mode: "0640"
|
|
notify: Restart traefik
|
|
|
|
- name: Copy homelab TLS key
|
|
ansible.builtin.copy:
|
|
src: "{{ playbook_dir }}/../../certs/wildcard.homelab-key.pem"
|
|
dest: /etc/traefik/certs/homelab-key.pem
|
|
owner: traefik
|
|
group: traefik
|
|
mode: "0640"
|
|
notify: Restart traefik
|
|
|
|
- name: Write Traefik TLS config
|
|
ansible.builtin.template:
|
|
src: tls.yml.j2
|
|
dest: /etc/traefik/conf.d/tls.yml
|
|
owner: traefik
|
|
group: traefik
|
|
mode: "0640"
|
|
notify: Restart traefik
|
|
|
|
- name: Write Traefik static config
|
|
ansible.builtin.template:
|
|
src: traefik.yml.j2
|
|
dest: /etc/traefik/traefik.yml
|
|
owner: traefik
|
|
group: traefik
|
|
mode: "0640"
|
|
notify: Restart traefik
|
|
|
|
- name: Write Traefik dynamic routes config
|
|
ansible.builtin.template:
|
|
src: routes.yml.j2
|
|
dest: /etc/traefik/conf.d/routes.yml
|
|
owner: traefik
|
|
group: traefik
|
|
mode: "0640"
|
|
notify: Restart traefik
|
|
|
|
- name: Write Traefik systemd service
|
|
ansible.builtin.template:
|
|
src: traefik.service.j2
|
|
dest: /etc/systemd/system/traefik.service
|
|
mode: "0644"
|
|
notify:
|
|
- Reload systemd
|
|
- Restart traefik
|
|
|
|
- name: Enable and start Traefik
|
|
ansible.builtin.systemd:
|
|
name: traefik
|
|
state: started
|
|
enabled: true
|
|
daemon_reload: true
|