98 lines
2.9 KiB
YAML
98 lines
2.9 KiB
YAML
# Alliance Boréale - Forgejo Tasks (database, nginx, firewall)
|
|
# Date: 2025-10-31
|
|
|
|
---
|
|
# ==========================================
|
|
# DATABASE.YML
|
|
# ==========================================
|
|
- name: "🗄️ Ensure PostgreSQL is installed"
|
|
ansible.builtin.include_role:
|
|
name: postgresql
|
|
when: "'postgresql_servers' in group_names"
|
|
|
|
- name: "🗄️ Create Forgejo database"
|
|
community.postgresql.postgresql_db:
|
|
name: "{{ forgejo.db.name }}"
|
|
encoding: UTF8
|
|
state: present
|
|
become: true
|
|
become_user: postgres
|
|
|
|
- name: "👤 Create Forgejo database user"
|
|
community.postgresql.postgresql_user:
|
|
name: "{{ forgejo.db.user }}"
|
|
password: "{{ forgejo.db.password }}"
|
|
state: present
|
|
become: true
|
|
become_user: postgres
|
|
no_log: true
|
|
|
|
- name: "🔐 Grant privileges to Forgejo user"
|
|
community.postgresql.postgresql_privs:
|
|
database: "{{ forgejo.db.name }}"
|
|
roles: "{{ forgejo.db.user }}"
|
|
type: database
|
|
privs: ALL
|
|
state: present
|
|
become: true
|
|
become_user: postgres
|
|
|
|
# ==========================================
|
|
# NGINX.YML
|
|
# ==========================================
|
|
- name: "📦 Ensure Nginx is installed"
|
|
ansible.builtin.apt:
|
|
name: nginx
|
|
state: present
|
|
|
|
- name: "🔐 Generate self-signed SSL certificate"
|
|
ansible.builtin.command:
|
|
cmd: >
|
|
openssl req -x509 -nodes -days 365 -newkey rsa:2048
|
|
-keyout /etc/ssl/private/{{ forgejo.hostname }}.key
|
|
-out /etc/ssl/certs/{{ forgejo.hostname }}.crt
|
|
-subj "/C=CA/ST=Quebec/L=Montreal/O=Chezlepro/CN={{ forgejo.hostname }}"
|
|
creates: "/etc/ssl/certs/{{ forgejo.hostname }}.crt"
|
|
when: nginx.ssl.cert_source == 'self-signed'
|
|
|
|
- name: "⚙️ Configure Nginx for Forgejo"
|
|
ansible.builtin.template:
|
|
src: nginx-forgejo.conf.j2
|
|
dest: /etc/nginx/sites-available/forgejo
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify: reload nginx
|
|
|
|
- name: "🔗 Enable Nginx site"
|
|
ansible.builtin.file:
|
|
src: /etc/nginx/sites-available/forgejo
|
|
dest: /etc/nginx/sites-enabled/forgejo
|
|
state: link
|
|
notify: reload nginx
|
|
|
|
- name: "✅ Start and enable Nginx"
|
|
ansible.builtin.systemd:
|
|
name: nginx
|
|
state: started
|
|
enabled: true
|
|
|
|
# ==========================================
|
|
# FIREWALL.YML
|
|
# ==========================================
|
|
- name: "🔥 Configure firewall for Forgejo"
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/nftables.conf
|
|
marker: "# {mark} ANSIBLE MANAGED - Forgejo"
|
|
insertbefore: "# Log dropped packets"
|
|
block: |
|
|
# Forgejo - Internal HTTP (backend only)
|
|
ip saddr 127.0.0.1 tcp dport {{ forgejo.http_port }} accept comment "Forgejo HTTP"
|
|
|
|
# Forgejo - SSH (Git over SSH)
|
|
tcp dport {{ forgejo.ssh_port }} accept comment "Forgejo SSH"
|
|
|
|
# Nginx - HTTPS (public)
|
|
tcp dport 443 accept comment "HTTPS (Forgejo via Nginx)"
|
|
tcp dport 80 accept comment "HTTP redirect"
|
|
notify: reload nftables
|