Adyrem
7ba749c620
Ansible Lint / lint (push) Successful in 4s
Proxmox host role: - Admin user setup, SSH hardening (port 2222, no root login) - claude-code SFTP chroot user - Unattended upgrades, DuckDNS dynamic DNS updater (vault-encrypted token) - WireGuard VPN server (10.10.10.0/24) with Fedora client registered - Proxmox firewall management via pvesh API (idempotent Python script) Public Gitea exposure: - Traefik: add HTTPS entrypoint, Let's Encrypt ACME (HTTP-01), StripPrefix middleware for /git subpath, HTTP→HTTPS redirect - Gitea ROOT_URL updated to https://adyrem.duckdns.org/git/ - Pi-hole split DNS: adyrem.duckdns.org → 10.10.1.3 for internal hairpin bypass SSH config fixes: - StrictHostKeyChecking no → accept-new across all hosts - Proxmox jump host: port 2222, user adyrem (root login disabled) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
96 lines
2.3 KiB
YAML
96 lines
2.3 KiB
YAML
---
|
|
- name: Install dependencies
|
|
ansible.builtin.apt:
|
|
name:
|
|
- curl
|
|
- ca-certificates
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Create traefik user
|
|
ansible.builtin.user:
|
|
name: traefik
|
|
system: true
|
|
shell: /usr/sbin/nologin
|
|
home: /etc/traefik
|
|
create_home: false
|
|
|
|
- name: Create traefik directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: traefik
|
|
group: traefik
|
|
mode: "0750"
|
|
loop:
|
|
- /etc/traefik
|
|
- /etc/traefik/conf.d
|
|
|
|
- name: Create acme.json for Let's Encrypt certificate storage
|
|
ansible.builtin.copy:
|
|
dest: /etc/traefik/acme.json
|
|
content: ""
|
|
owner: traefik
|
|
group: traefik
|
|
mode: "0600"
|
|
force: false
|
|
|
|
- name: Check installed Traefik version
|
|
ansible.builtin.command:
|
|
cmd: /usr/local/bin/traefik version
|
|
register: traefik_installed_version
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Download Traefik binary
|
|
ansible.builtin.get_url:
|
|
url: "https://github.com/traefik/traefik/releases/download/v{{ traefik_version }}/traefik_v{{ traefik_version }}_linux_amd64.tar.gz"
|
|
dest: /tmp/traefik.tar.gz
|
|
mode: "0644"
|
|
when: traefik_version not in (traefik_installed_version.stdout | default(''))
|
|
|
|
- name: Extract Traefik binary
|
|
ansible.builtin.unarchive:
|
|
src: /tmp/traefik.tar.gz
|
|
dest: /usr/local/bin
|
|
include:
|
|
- traefik
|
|
remote_src: true
|
|
mode: "0755"
|
|
when: traefik_version not in (traefik_installed_version.stdout | default(''))
|
|
notify: Restart traefik
|
|
|
|
- name: Write Traefik static config
|
|
ansible.builtin.template:
|
|
src: traefik.yml.j2
|
|
dest: /etc/traefik/traefik.yml
|
|
owner: traefik
|
|
group: traefik
|
|
mode: "0640"
|
|
notify: Restart traefik
|
|
|
|
- name: Write Traefik dynamic routes config
|
|
ansible.builtin.template:
|
|
src: routes.yml.j2
|
|
dest: /etc/traefik/conf.d/routes.yml
|
|
owner: traefik
|
|
group: traefik
|
|
mode: "0640"
|
|
notify: Restart traefik
|
|
|
|
- name: Write Traefik systemd service
|
|
ansible.builtin.template:
|
|
src: traefik.service.j2
|
|
dest: /etc/systemd/system/traefik.service
|
|
mode: "0644"
|
|
notify:
|
|
- Reload systemd
|
|
- Restart traefik
|
|
|
|
- name: Enable and start Traefik
|
|
ansible.builtin.systemd:
|
|
name: traefik
|
|
state: started
|
|
enabled: true
|
|
daemon_reload: true
|