From b74a9859b2dca47f23d08e5e90e24fe376aecb2e Mon Sep 17 00:00:00 2001 From: polyfloyd Date: Sat, 26 Apr 2025 18:18:53 +0200 Subject: [PATCH 01/11] Update git_ci role from polyfloyd's infra --- bitlair.yaml | 2 +- git-ci.yaml | 2 +- roles/git-ci/defaults/main.yaml | 2 - roles/git-ci/tasks/main.yaml | 50 ----------- roles/git_ci/defaults/main.yaml | 2 + roles/{git-ci => git_ci}/handlers/main.yaml | 2 +- roles/git_ci/tasks/main.yaml | 83 +++++++++++++++++++ .../templates/forgejo-runner.service | 2 +- 8 files changed, 89 insertions(+), 56 deletions(-) delete mode 100644 roles/git-ci/defaults/main.yaml delete mode 100644 roles/git-ci/tasks/main.yaml create mode 100644 roles/git_ci/defaults/main.yaml rename roles/{git-ci => git_ci}/handlers/main.yaml (85%) create mode 100644 roles/git_ci/tasks/main.yaml rename roles/{git-ci => git_ci}/templates/forgejo-runner.service (84%) diff --git a/bitlair.yaml b/bitlair.yaml index 48db717..4016241 100644 --- a/bitlair.yaml +++ b/bitlair.yaml @@ -26,7 +26,7 @@ - hosts: git-ci roles: - - { role: "git-ci", tags: ["git-ci"] } + - { role: "git_ci", tags: ["git_ci"] } - hosts: git roles: diff --git a/git-ci.yaml b/git-ci.yaml index 711dac4..4a53a08 100644 --- a/git-ci.yaml +++ b/git-ci.yaml @@ -3,4 +3,4 @@ - hosts: git-ci roles: - { role: "common", tags: [ "common" ] } - - { role: "git-ci", tags: [ "git-ci" ] } + - { role: "git_ci", tags: [ "git_ci" ] } diff --git a/roles/git-ci/defaults/main.yaml b/roles/git-ci/defaults/main.yaml deleted file mode 100644 index 2e805ee..0000000 --- a/roles/git-ci/defaults/main.yaml +++ /dev/null @@ -1,2 +0,0 @@ -runner_wd: /var/lib/forgejo-runner -runner_version: 6.3.0 diff --git a/roles/git-ci/tasks/main.yaml b/roles/git-ci/tasks/main.yaml deleted file mode 100644 index d677a61..0000000 --- a/roles/git-ci/tasks/main.yaml +++ /dev/null @@ -1,50 +0,0 @@ ---- - -- name: Install dependencies - ansible.builtin.apt: - name: docker.io - -- name: Download forgejo-runner - ansible.builtin.get_url: - url: "https://code.forgejo.org/forgejo/runner/releases/download/v{{ runner_version }}/forgejo-runner-{{ runner_version }}-linux-amd64" - dest: /usr/local/bin/forgejo-runner - mode: 0755 - notify: restart forgejo-runner - -- name: Create runner dir - ansible.builtin.file: - state: directory - path: "{{ runner_wd }}" - owner: root - group: root - mode: 0755 - -- name: Register runner - ansible.builtin.command: "forgejo-runner register --no-interactive --instance={{ forgejo_url }} --token={{ lookup('passwordstore', 'git/ci subkey=runner_token') }}" - args: - chdir: "{{ runner_wd }}" - creates: "{{ runner_wd }}/.runner" - -- name: Install service file - ansible.builtin.template: - src: forgejo-runner.service - dest: /etc/systemd/system/forgejo-runner.service - owner: root - group: root - mode: 0644 - notify: restart forgejo-runner - -- name: Enable service - ansible.builtin.systemd: - name: forgejo-runner - enabled: true - daemon_reload: true - -- name: Start service - ansible.builtin.systemd: - name: forgejo-runner - state: started - daemon_reload: true - -- name: Flush handlers - ansible.builtin.meta: flush_handlers diff --git a/roles/git_ci/defaults/main.yaml b/roles/git_ci/defaults/main.yaml new file mode 100644 index 0000000..2c54fd9 --- /dev/null +++ b/roles/git_ci/defaults/main.yaml @@ -0,0 +1,2 @@ +--- +git_ci_runner_wd: /var/lib/forgejo-runner diff --git a/roles/git-ci/handlers/main.yaml b/roles/git_ci/handlers/main.yaml similarity index 85% rename from roles/git-ci/handlers/main.yaml rename to roles/git_ci/handlers/main.yaml index 361ba38..05f3913 100644 --- a/roles/git-ci/handlers/main.yaml +++ b/roles/git_ci/handlers/main.yaml @@ -3,6 +3,6 @@ file: ../../common/handlers/main.yaml - name: restart forgejo-runner - ansible.builtin.systemd: + systemd: name: forgejo-runner state: restarted diff --git a/roles/git_ci/tasks/main.yaml b/roles/git_ci/tasks/main.yaml new file mode 100644 index 0000000..c2c4002 --- /dev/null +++ b/roles/git_ci/tasks/main.yaml @@ -0,0 +1,83 @@ +--- +- tags: git_ci + block: + - name: Install dependencies + apt: + name: docker.io + + - name: Query latest forgejo-runner version + uri: + url: https://code.forgejo.org/api/v1/repos/forgejo/runner/tags + return_content: true + register: response + changed_when: false + check_mode: false + failed_when: "response is failed or 'json' not in response" + + - name: Format forgejo-runner latest version + set_fact: + forgejo_runner_version: "{{ response['json'][0]['name'] | trim('v') }}" + + - name: Detect installed forgejo-runner version + shell: + cmd: | + set -o pipefail + forgejo-runner --version | grep --color=never -Po '\d\.\d+(\.\d+)?' || echo none + executable: /bin/bash + register: forgejo_runner_installed_version_shell + changed_when: false + check_mode: false + + - name: Format installed forgejo-runner version + set_fact: + forgejo_runner_installed_version: "{{ forgejo_runner_installed_version_shell.stdout }}" + + - debug: + msg: + - "Forgejo Runner latest version: {{ forgejo_runner_version }}" + - "Forgejo Runner installed version: {{ forgejo_runner_installed_version }}" + + - name: Download forgejo-runner + get_url: + url: "https://code.forgejo.org/forgejo/runner/releases/download/v{{ forgejo_runner_version }}/forgejo-runner-{{ forgejo_runner_version }}-linux-amd64" + dest: /usr/local/bin/forgejo-runner + mode: "0755" + notify: restart forgejo-runner + when: forgejo_runner_installed_version != forgejo_runner_version + + - name: Create runner dir + file: + state: directory + path: "{{ git_ci_runner_wd }}" + owner: root + group: root + mode: "0755" + + - name: Register runner + command: "forgejo-runner register --no-interactive --instance={{ forgejo_url }} --token={{ lookup('passwordstore', 'git/ci subkey=runner_token') }}" + args: + chdir: "{{ git_ci_runner_wd }}" + creates: "{{ git_ci_runner_wd }}/.runner" + + - name: Install service file + template: + src: forgejo-runner.service + dest: /etc/systemd/system/forgejo-runner.service + owner: root + group: root + mode: "0644" + notify: restart forgejo-runner + + - name: Enable service + systemd: + name: forgejo-runner + enabled: true + daemon_reload: true + + - name: Start service + systemd: + name: forgejo-runner + state: started + daemon_reload: true + + - meta: flush_handlers diff --git a/roles/git-ci/templates/forgejo-runner.service b/roles/git_ci/templates/forgejo-runner.service similarity index 84% rename from roles/git-ci/templates/forgejo-runner.service rename to roles/git_ci/templates/forgejo-runner.service index c9550d2..9cd5b5b 100644 --- a/roles/git-ci/templates/forgejo-runner.service +++ b/roles/git_ci/templates/forgejo-runner.service @@ -6,7 +6,7 @@ After=network.target [Service] ExecStart=/usr/local/bin/forgejo-runner daemon -WorkingDirectory={{ runner_wd }} +WorkingDirectory={{ git_ci_runner_wd }} Restart=on-failure RestartSec=10s From bb5f845c1bcd2be123cb9f58328bf4526172e82e Mon Sep 17 00:00:00 2001 From: polyfloyd Date: Sat, 26 Apr 2025 18:23:08 +0200 Subject: [PATCH 02/11] Add new CI runner --- inventory | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/inventory b/inventory index c380b07..86d1bea 100644 --- a/inventory +++ b/inventory @@ -17,7 +17,8 @@ blockchain.bitlair.nl git.bitlair.nl [git-ci] -git-ci.bitlair.nl +git-ci01.bitlair.nl +git-ci02.bitlair.nl [pad] pad.bitlair.nl From ee6b8bee5c0ff974700cdb6024e5a6e56d5e9151 Mon Sep 17 00:00:00 2001 From: polyfloyd Date: Sun, 27 Apr 2025 13:08:31 +0200 Subject: [PATCH 03/11] monitoring/mqtt_exporter: Install from debian package --- group_vars/all.yaml | 3 +++ monitoring.yaml | 1 + roles/common/handlers/main.yaml | 2 +- roles/deb_forgejo/defaults/main.yaml | 1 + roles/deb_forgejo/handlers/default.yaml | 3 +++ roles/deb_forgejo/tasks/main.yaml | 26 ++++++++++++++++++ roles/deb_forgejo/templates/sources.list | 5 ++++ roles/etherpad/tasks/main.yaml | 6 ++--- roles/monitoring/tasks/mqtt_exporter.yaml | 33 +++-------------------- 9 files changed, 47 insertions(+), 33 deletions(-) create mode 100644 roles/deb_forgejo/defaults/main.yaml create mode 100644 roles/deb_forgejo/handlers/default.yaml create mode 100644 roles/deb_forgejo/tasks/main.yaml create mode 100644 roles/deb_forgejo/templates/sources.list diff --git a/group_vars/all.yaml b/group_vars/all.yaml index 3deb227..39de4c0 100644 --- a/group_vars/all.yaml +++ b/group_vars/all.yaml @@ -36,3 +36,6 @@ mqtt_public_host: bitlair.nl debian_repourl: "http://deb.debian.org/debian/" debian_securityurl: "http://security.debian.org/debian-security" +deb_forgejo_repos: + - host: git.polyfloyd.net + owner: polyfloyd diff --git a/monitoring.yaml b/monitoring.yaml index 9e05df0..202cb58 100644 --- a/monitoring.yaml +++ b/monitoring.yaml @@ -4,5 +4,6 @@ roles: - { role: "common", tags: [ "common" ] } - { role: "acme", tags: [ "acme" ] } + - { role: "deb_forgejo", tags: [ "deb_forgejo" ] } - { role: "nginx", tags: [ "nginx" ] } - { role: "monitoring", tags: [ "monitoring" ] } diff --git a/roles/common/handlers/main.yaml b/roles/common/handlers/main.yaml index 3f6d5b8..b35b8d8 100644 --- a/roles/common/handlers/main.yaml +++ b/roles/common/handlers/main.yaml @@ -3,7 +3,7 @@ ansible.builtin.command: cmd: update-grub -- name: Apt update +- name: apt update ansible.builtin.apt: update_cache: true diff --git a/roles/deb_forgejo/defaults/main.yaml b/roles/deb_forgejo/defaults/main.yaml new file mode 100644 index 0000000..21082e1 --- /dev/null +++ b/roles/deb_forgejo/defaults/main.yaml @@ -0,0 +1 @@ +deb_private_host: git.polyfloyd.net diff --git a/roles/deb_forgejo/handlers/default.yaml b/roles/deb_forgejo/handlers/default.yaml new file mode 100644 index 0000000..e7a11ce --- /dev/null +++ b/roles/deb_forgejo/handlers/default.yaml @@ -0,0 +1,3 @@ +--- +- ansible.builtin.import_tasks: + file: ../../common/handlers/main.yaml diff --git a/roles/deb_forgejo/tasks/main.yaml b/roles/deb_forgejo/tasks/main.yaml new file mode 100644 index 0000000..68c3c44 --- /dev/null +++ b/roles/deb_forgejo/tasks/main.yaml @@ -0,0 +1,26 @@ +--- +- tags: deb_forgejo + block: + - name: Install dependencies + apt: + name: apt-transport-https + state: present + + - name: Install packaging key + get_url: + url: https://{{ item.host }}/api/packages/{{ item.owner }}/debian/repository.key + dest: /etc/apt/keyrings/{{ item.host }}-{{ item.owner }}.asc + mode: "0644" + with_items: "{{ deb_forgejo_repos }}" + notify: apt update + + - name: Install sources.list + template: + src: sources.list + dest: /etc/apt/sources.list.d/deb-forgejo.list + owner: root + group: root + mode: "0644" + notify: apt update + + - meta: flush_handlers diff --git a/roles/deb_forgejo/templates/sources.list b/roles/deb_forgejo/templates/sources.list new file mode 100644 index 0000000..9400fd3 --- /dev/null +++ b/roles/deb_forgejo/templates/sources.list @@ -0,0 +1,5 @@ +# {{ ansible_managed }} + +{% for repo in deb_forgejo_repos %} +deb [signed-by=/etc/apt/keyrings/{{ repo.host }}-{{ repo.owner }}.asc] https://{{ repo.host }}/api/packages/{{ repo.owner }}/debian {{ repo.distro | default('stable') }} {{ repo.component | default('main') }} +{% endfor %} diff --git a/roles/etherpad/tasks/main.yaml b/roles/etherpad/tasks/main.yaml index 0f4beb5..38dc4d3 100644 --- a/roles/etherpad/tasks/main.yaml +++ b/roles/etherpad/tasks/main.yaml @@ -15,7 +15,7 @@ -o /usr/share/keyrings/nodesource.gpg args: creates: /usr/share/keyrings/nodesource.gpg - notify: Apt update + notify: apt update - name: Install nodesource source list ansible.builtin.template: @@ -24,7 +24,7 @@ owner: root group: root mode: 0644 - notify: Apt update + notify: apt update - name: Install nodejs apt preference ansible.builtin.template: @@ -33,7 +33,7 @@ owner: root group: root mode: 0644 - notify: Apt update + notify: apt update - ansible.builtin.meta: flush_handlers diff --git a/roles/monitoring/tasks/mqtt_exporter.yaml b/roles/monitoring/tasks/mqtt_exporter.yaml index 0ae5d07..481d2c1 100644 --- a/roles/monitoring/tasks/mqtt_exporter.yaml +++ b/roles/monitoring/tasks/mqtt_exporter.yaml @@ -1,47 +1,22 @@ --- -- name: Clone source - ansible.builtin.git: - repo: https://github.com/polyfloyd/mqtt-exporter.git - version: main - dest: /opt/mqtt_exporter - accept_hostkey: yes - notify: restart mqtt_exporter - - name: Install apt dependencies ansible.builtin.apt: - name: - - jq - - python3-paho-mqtt - - python3-prometheus-client - - python3-yaml + name: mqtt-exporter state: present -- name: Install service - ansible.builtin.template: - src: mqtt_exporter.service - dest: /etc/systemd/system/mqtt_exporter.service - owner: root - group: root - mode: 0644 - notify: - - Daemon reload - - restart mqtt_exporter - - name: Install config file ansible.builtin.template: src: mqtt_exporter_config.yaml - dest: /etc/mqtt_exporter.yaml + dest: /etc/mqtt-exporter.yaml owner: root group: root mode: 0644 - notify: - - Daemon reload - - restart mqtt_exporter + notify: restart mqtt_exporter - ansible.builtin.meta: flush_handlers - name: Start service ansible.builtin.systemd: - name: mqtt_exporter + name: mqtt-exporter state: started enabled: true From 5ab22d0e9653e97030e942159db483652292459c Mon Sep 17 00:00:00 2001 From: polyfloyd Date: Sun, 27 Apr 2025 18:59:37 +0200 Subject: [PATCH 04/11] music: Install mqtt-soundboard from Debian package --- music.yaml | 1 + roles/music/tasks/soundboard.yaml | 38 ++++++++----------------------- 2 files changed, 10 insertions(+), 29 deletions(-) diff --git a/music.yaml b/music.yaml index e4ea70b..17666f3 100644 --- a/music.yaml +++ b/music.yaml @@ -4,6 +4,7 @@ roles: - { role: "common", tags: [ "common" ] } - { role: "acme", tags: [ "acme" ] } + - { role: "deb_forgejo", tags: [ "deb_forgejo" ] } - { role: "go", tags: [ "go" ] } # - { role: "nginx", tags: [ "nginx" ] } - { role: "music", tags: [ "music" ] } diff --git a/roles/music/tasks/soundboard.yaml b/roles/music/tasks/soundboard.yaml index a0ea558..1b72dbf 100644 --- a/roles/music/tasks/soundboard.yaml +++ b/roles/music/tasks/soundboard.yaml @@ -1,28 +1,17 @@ --- - name: Install dependencies ansible.builtin.apt: - name: virtualenv + name: + - mqtt-soundboard + - mplayer state: present -- name: Clone soundboard source - ansible.builtin.git: - repo: https://github.com/polyfloyd/mqtt-soundboard.git - version: main - dest: /opt/soundboard - accept_hostkey: yes - notify: Restart soundboard - -- name: Create virtualenv - ansible.builtin.command: - cmd: virtualenv /opt/soundboard/.venv - args: - creates: /opt/soundboard/.venv - -- name: Install Python dependencies - ansible.builtin.shell: - cmd: . .venv/bin/activate && pip install -r requirements.txt - args: - chdir: /opt/soundboard +- ansible.builtin.file: + path: "{{ item }}" + state: absent + with_items: + - /opt/soundboard + - /etc/systemd/system/soundboard.service - name: Install soundboard config file ansible.builtin.template: @@ -33,15 +22,6 @@ mode: 0644 notify: Restart soundboard -- name: Install soundboard service file - ansible.builtin.template: - src: soundboard.service - dest: /etc/systemd/system/soundboard.service - owner: root - group: root - mode: 0644 - notify: Restart soundboard - - name: Enable soundboard ansible.builtin.systemd: name: soundboard From c267c51e1ea34dc63387ddadbbdac770ded0419b Mon Sep 17 00:00:00 2001 From: BlackDragon-B Date: Sun, 27 Apr 2025 19:50:53 +0200 Subject: [PATCH 05/11] maak chat.bitlair.nl --- chat.yaml | 7 + group_vars/chat.yaml | 34 +++++ roles/chat/defaults/main.yaml | 0 roles/chat/tasks/main.yaml | 143 +++++++++++++++++++ roles/chat/templates/config.js.j2 | 58 ++++++++ roles/chat/templates/nodejs-apt-pref | 5 + roles/chat/templates/nodesource.list | 3 + roles/chat/templates/thelounge-bitlair.patch | 28 ++++ roles/chat/templates/thelounge.service | 17 +++ 9 files changed, 295 insertions(+) create mode 100644 chat.yaml create mode 100644 group_vars/chat.yaml create mode 100644 roles/chat/defaults/main.yaml create mode 100644 roles/chat/tasks/main.yaml create mode 100644 roles/chat/templates/config.js.j2 create mode 100644 roles/chat/templates/nodejs-apt-pref create mode 100644 roles/chat/templates/nodesource.list create mode 100644 roles/chat/templates/thelounge-bitlair.patch create mode 100644 roles/chat/templates/thelounge.service diff --git a/chat.yaml b/chat.yaml new file mode 100644 index 0000000..9560585 --- /dev/null +++ b/chat.yaml @@ -0,0 +1,7 @@ +- hosts: chat + roles: + - { role: "common", tags: [ "common" ] } + - { role: "nft", tags: [ "nft" ] } + - { role: "nginx", tags: [ "nginx" ] } + - { role: "acme", tags: [ "acme" ] } + - { role: "chat", tags: [ "chat" ] } diff --git a/group_vars/chat.yaml b/group_vars/chat.yaml new file mode 100644 index 0000000..8caf096 --- /dev/null +++ b/group_vars/chat.yaml @@ -0,0 +1,34 @@ +--- +root_access: + - blackdragon + - ak + - foobar + - polyfloyd +nodejs_version: 22.x +thelounge_version: "4.4.3" +thelounge_ldap_url: ldaps://ldap.bitlair.nl +thelounge_ldap_filter: (objectClass=inetOrgPerson) +thelounge_ldap_base: ou=Members,dc=bitlair,dc=nl +chat_hostname: chat.bitlair.nl + +acme_domains: + - "{{ chat_hostname }}" + +nginx_sites: + - server_name: "{{ chat_hostname }}" + config: + - |- + location / { + proxy_pass http://127.0.0.1:9000/; + proxy_http_version 1.1; + proxy_set_header Connection "upgrade"; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + + # by default nginx times out connections in one minute + proxy_read_timeout 1d; + } + +group_nft_input: + - "tcp dport { http, https } accept # Allow web-traffic from world" \ No newline at end of file diff --git a/roles/chat/defaults/main.yaml b/roles/chat/defaults/main.yaml new file mode 100644 index 0000000..e69de29 diff --git a/roles/chat/tasks/main.yaml b/roles/chat/tasks/main.yaml new file mode 100644 index 0000000..6fa26d1 --- /dev/null +++ b/roles/chat/tasks/main.yaml @@ -0,0 +1,143 @@ +- name: Install dependencies + ansible.builtin.apt: + state: present + pkg: + - gpg + - apt-transport-https + - build-essential + +- name: Import nodesource signing key + ansible.builtin.shell: + cmd: curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor + -o /usr/share/keyrings/nodesource.gpg + args: + creates: /usr/share/keyrings/nodesource.gpg + notify: Apt update + +- name: Install nodesource source list + ansible.builtin.template: + src: nodesource.list + dest: /etc/apt/sources.list.d/nodesource.list + owner: root + group: root + mode: 0644 + notify: Apt update + +- name: Install nodejs apt preference + ansible.builtin.template: + src: nodejs-apt-pref + dest: /etc/apt/preferences.d/nodejs + owner: root + group: root + mode: 0644 + notify: Apt update + +- ansible.builtin.meta: flush_handlers + +- name: Install nodejs + ansible.builtin.apt: + name: nodejs + +- name: Install yarn + ansible.builtin.shell: + cmd: npm install --global yarn + +- stat: path=/opt/thelounge + register: src_path + +- name: Retreive thelounge source + block: + - name: Checkout source + ansible.builtin.git: + repo: 'https://github.com/revspace/thelounge.git' + dest: /opt/thelounge + version: 9d6dc83 + force: true + + - name: Copy patch + ansible.builtin.template: + src: thelounge-bitlair.patch + dest: /tmp/thelounge-bitlair.patch + + - name: Apply patch + ansible.builtin.shell: + chdir: /opt/thelounge + cmd: git apply /tmp/thelounge-bitlair.patch + when: not src_path.stat.exists + +- name: Build and install thelounge + ansible.builtin.shell: + chdir: /opt/thelounge + cmd: yarn add sharp --ignore-engines && yarn install --include-optional sharp && NODE_ENV=production yarn build && ln -sf $(pwd)/index.js /usr/local/bin/thelounge + +- name: Ensure user thelounge is present + user: + name: thelounge + createhome: no + comment: The Lounge (IRC client) + system: yes + state: present + become: yes + +- name: Ensure JS and JSON syntax checking packages are installed + yarn: + name: "{{ item }}" + global: yes + state: latest # FIXME: Remove when https://github.com/ansible/ansible/pull/39557 makes it in + with_items: + - esprima + - jsonlint + become: yes + changed_when: no # FIXME: Remove when https://github.com/ansible/ansible/pull/39557 makes it in + +- name: Ensure thelounge configuration directory is present + file: + path: /etc/thelounge + owner: thelounge + group: thelounge + state: directory + become: yes + +- name: Ensure The Lounge is configured + template: + src: config.js.j2 + dest: /etc/thelounge/config.js + owner: thelounge + group: thelounge + validate: 'esvalidate %s' + become: yes + +- name: Ensure user configuration directory is present + file: + path: /var/local/thelounge/users + owner: thelounge + group: thelounge + state: directory + become: yes + +- name: Ensure preview storage directory is present + file: + path: /var/local/thelounge/storage + owner: thelounge + group: thelounge + mode: "0770" + state: directory + become: yes + +- name: Copy service file to systemd directory + ansible.builtin.template: + src: thelounge.service # Path to your service file in your Ansible project + dest: /etc/systemd/system/thelounge.service + owner: root + group: root + mode: '0644' + +- name: Reload systemd daemon to read new service file + ansible.builtin.systemd: + daemon_reload: yes + +- name: Enable and start the service + ansible.builtin.systemd: + name: thelounge + state: started + enabled: yes \ No newline at end of file diff --git a/roles/chat/templates/config.js.j2 b/roles/chat/templates/config.js.j2 new file mode 100644 index 0000000..c606576 --- /dev/null +++ b/roles/chat/templates/config.js.j2 @@ -0,0 +1,58 @@ +"use strict"; + +module.exports = { + public: false, + port: 9000, + bind: "0.0.0.0", + reverseProxy: true, + lockNetwork: true, + maxHistory: 10000, + leaveMessage: "Doei!", + defaults: { + name: "Smurfnet", + password: "", + rejectUnauthorized: true, + nick: "", + username: "", + realname: "", + join: "#bitlair", + }, + messageStorage: ["sqlite", "text"], + fileUpload: { + enable: true, + }, + networks: { + Smurfnet: { + host: "irc.smurfnet.ch", + port: 6697, + tls: true, + rejectUnauthorized: false, + }, + "Libera.Chat": { + host: "irc.libera.chat", + port: 6697, + tls: true, + rejectUnauthorized: true, + }, + OFTC: { + host: "irc.oftc.net", + port: 6697, + tls: true, + rejectUnauthorized: true, + }, + }, + identd: { + enable: false, + }, + ldap: { + enable: true, + url: "{{ thelounge_ldap_url }}", + primaryKey: "uid", + searchDN: { + rootDN: "{{ thelounge_ldap_rootDN }}", + rootPassword: "{{ thelounge_ldap_rootPassword }}", + filter: "{{ thelounge_ldap_filter }}", + base: "{{ thelounge_ldap_base }}", + }, + }, +}; diff --git a/roles/chat/templates/nodejs-apt-pref b/roles/chat/templates/nodejs-apt-pref new file mode 100644 index 0000000..6193912 --- /dev/null +++ b/roles/chat/templates/nodejs-apt-pref @@ -0,0 +1,5 @@ +# {{ ansible_managed }} + +Package: nodejs +Pin: origin deb.nodesource.com +Pin-Priority: 1000 diff --git a/roles/chat/templates/nodesource.list b/roles/chat/templates/nodesource.list new file mode 100644 index 0000000..6ac9322 --- /dev/null +++ b/roles/chat/templates/nodesource.list @@ -0,0 +1,3 @@ +# {{ ansible_managed }} + +deb [arch=amd64 signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_{{ nodejs_version }} nodistro main diff --git a/roles/chat/templates/thelounge-bitlair.patch b/roles/chat/templates/thelounge-bitlair.patch new file mode 100644 index 0000000..fdfb795 --- /dev/null +++ b/roles/chat/templates/thelounge-bitlair.patch @@ -0,0 +1,28 @@ +diff --git a/package.json b/package.json +index 2991a6ec..dac43f16 100644 +--- a/package.json ++++ b/package.json +@@ -84,9 +84,7 @@ + "ua-parser-js": "1.0.33", + "uuid": "8.3.2", + "web-push": "3.4.5", +- "yarn": "1.22.17" +- }, +- "optionalDependencies": { ++ "yarn": "1.22.17", + "sqlite3": "5.1.7" + }, + "devDependencies": { +diff --git a/server/plugins/auth/ldap.ts b/server/plugins/auth/ldap.ts +index e6093b0f..d30b9a1c 100644 +--- a/server/plugins/auth/ldap.ts ++++ b/server/plugins/auth/ldap.ts +@@ -134,7 +134,7 @@ const ldapAuth: AuthHandler = (manager, client, user, password, callback) => { + // auth plugin API + function callbackWrapper(valid: boolean) { + if (valid && !client) { +- manager.addUser(user, null, false); ++ manager.addUser(user, null, true); + } + + callback(valid); diff --git a/roles/chat/templates/thelounge.service b/roles/chat/templates/thelounge.service new file mode 100644 index 0000000..3fc7396 --- /dev/null +++ b/roles/chat/templates/thelounge.service @@ -0,0 +1,17 @@ +[Unit] +Description=The Lounge (IRC client) +After=network-online.target +Wants=network-online.target + +[Service] +User=thelounge +Group=thelounge +Type=simple +Environment=THELOUNGE_HOME=/var/local/thelounge +ExecStart=/usr/local/bin/thelounge start +ProtectSystem=yes +ProtectHome=yes +PrivateTmp=yes + +[Install] +WantedBy=multi-user.target From 8e2cc7e77aa0cef21595bdceae0e595c51d7afee Mon Sep 17 00:00:00 2001 From: Mark Janssen -- Sig-I/O Automatisering Date: Sun, 27 Apr 2025 20:04:56 +0200 Subject: [PATCH 06/11] keys --- authorized_keys/blackdragon.keys | 1 + 1 file changed, 1 insertion(+) create mode 100644 authorized_keys/blackdragon.keys diff --git a/authorized_keys/blackdragon.keys b/authorized_keys/blackdragon.keys new file mode 100644 index 0000000..d488f52 --- /dev/null +++ b/authorized_keys/blackdragon.keys @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICLZGbt/we3JQ482/NYcdOKGoKDOj1MgmYFP2GDmjLw/ kyan@flandre From 050205e95c01b8025892972ad8e77f3ff75d9cd0 Mon Sep 17 00:00:00 2001 From: Mark Janssen -- Sig-I/O Automatisering Date: Sun, 27 Apr 2025 21:11:17 +0200 Subject: [PATCH 07/11] Cleanup thelounge playbook --- bitlair.yaml | 6 ++ chat.yaml | 2 + roles/chat/handlers/main.yaml | 10 +++ roles/chat/tasks/main.yaml | 113 +++++++++++------------------- roles/chat/templates/config.js.j2 | 4 +- 5 files changed, 61 insertions(+), 74 deletions(-) create mode 100644 roles/chat/handlers/main.yaml diff --git a/bitlair.yaml b/bitlair.yaml index 4016241..19de646 100644 --- a/bitlair.yaml +++ b/bitlair.yaml @@ -65,3 +65,9 @@ - { role: "acme", tags: ["acme"] } - { role: "nginx", tags: ["nginx"] } - { role: "www", tags: ["www"] } + +- hosts: chat + roles: + - { role: "acme", tags: [ "acme" ] } + - { role: "nginx", tags: [ "nginx" ] } + - { role: "chat", tags: [ "chat" ] } diff --git a/chat.yaml b/chat.yaml index 9560585..a5b4c42 100644 --- a/chat.yaml +++ b/chat.yaml @@ -1,3 +1,5 @@ +--- + - hosts: chat roles: - { role: "common", tags: [ "common" ] } diff --git a/roles/chat/handlers/main.yaml b/roles/chat/handlers/main.yaml new file mode 100644 index 0000000..82e78eb --- /dev/null +++ b/roles/chat/handlers/main.yaml @@ -0,0 +1,10 @@ +--- +- name: Reload systemd + ansible.builtin.systemd: + daemon_reload: yes + +- name: Restart thelounge + ansible.builtin.systemd: + name: thelounge + state: restarted + enabled: true diff --git a/roles/chat/tasks/main.yaml b/roles/chat/tasks/main.yaml index 6fa26d1..097eb1b 100644 --- a/roles/chat/tasks/main.yaml +++ b/roles/chat/tasks/main.yaml @@ -1,7 +1,9 @@ +--- + - name: Install dependencies ansible.builtin.apt: state: present - pkg: + pkg: - gpg - apt-transport-https - build-essential @@ -14,25 +16,30 @@ creates: /usr/share/keyrings/nodesource.gpg notify: Apt update -- name: Install nodesource source list - ansible.builtin.template: - src: nodesource.list - dest: /etc/apt/sources.list.d/nodesource.list - owner: root - group: root - mode: 0644 - notify: Apt update +- name: Ensure directories are present + ansible.builtin.file: + path: "{{ item.path }}" + owner: "thelounge" + group: "thelounge" + state: "{{ item.state | default('directory') }}" + mode: "{{ item.mode | default('0770') }}" + with_items: + - { path: "/etc/thelounge" } + - { path: "/var/local/thelounge/users" } + - { path: "/var/local/thelounge/storage" } + notify: + - Restart thelounge -- name: Install nodejs apt preference +- name: Configure templates ansible.builtin.template: - src: nodejs-apt-pref - dest: /etc/apt/preferences.d/nodejs - owner: root - group: root - mode: 0644 - notify: Apt update - -- ansible.builtin.meta: flush_handlers + src: "{{ item.src }}" + dest: "{{ item.dest }}" + owner: "{{ item.owner | default( 'thelounge' ) }}" + group: "{{ item.group | default( 'thelounge' ) }}" + mode: "{{ item.mode | default('0640') }}" + with_items: + - { src: "nodesource.list", dest: "/etc/apt/sources.list.d/nodesource.list", owner: root, group: root } + - { src: "nodejs-apt-pref", dest: "/etc/apt/preferences.d/nodejs", owner: root, group: root } - name: Install nodejs ansible.builtin.apt: @@ -56,7 +63,7 @@ - name: Copy patch ansible.builtin.template: - src: thelounge-bitlair.patch + src: thelounge-bitlair.patch dest: /tmp/thelounge-bitlair.patch - name: Apply patch @@ -69,16 +76,17 @@ ansible.builtin.shell: chdir: /opt/thelounge cmd: yarn add sharp --ignore-engines && yarn install --include-optional sharp && NODE_ENV=production yarn build && ln -sf $(pwd)/index.js /usr/local/bin/thelounge + notify: + - Restart thelounge - name: Ensure user thelounge is present - user: + ansible.builtin.user: name: thelounge createhome: no comment: The Lounge (IRC client) system: yes state: present - become: yes - + - name: Ensure JS and JSON syntax checking packages are installed yarn: name: "{{ item }}" @@ -87,57 +95,18 @@ with_items: - esprima - jsonlint - become: yes changed_when: no # FIXME: Remove when https://github.com/ansible/ansible/pull/39557 makes it in -- name: Ensure thelounge configuration directory is present - file: - path: /etc/thelounge - owner: thelounge - group: thelounge - state: directory - become: yes - -- name: Ensure The Lounge is configured - template: - src: config.js.j2 - dest: /etc/thelounge/config.js - owner: thelounge - group: thelounge - validate: 'esvalidate %s' - become: yes - -- name: Ensure user configuration directory is present - file: - path: /var/local/thelounge/users - owner: thelounge - group: thelounge - state: directory - become: yes - -- name: Ensure preview storage directory is present - file: - path: /var/local/thelounge/storage - owner: thelounge - group: thelounge - mode: "0770" - state: directory - become: yes - -- name: Copy service file to systemd directory +- name: Configure templates ansible.builtin.template: - src: thelounge.service # Path to your service file in your Ansible project - dest: /etc/systemd/system/thelounge.service - owner: root - group: root - mode: '0644' - -- name: Reload systemd daemon to read new service file - ansible.builtin.systemd: - daemon_reload: yes + src: "{{ item.src }}" + dest: "{{ item.dest }}" + owner: "{{ item.owner | default( 'thelounge' ) }}" + group: "{{ item.group | default( 'thelounge' ) }}" + mode: "{{ item.mode | default('0640') }}" + validate: "{{ item.validate | default([]) }}" + with_items: + - { src: "config.js.j2", dest: "/etc/thelounge/config.js", validate: 'esvalidate %s' } + - { src: "thelounge.service", dest: "/etc/systemd/system/thelounge.service", owner: root, group: root, notify: "Reload systemd" } + notify: "{{ item.notify | default('Restart thelounge') }}" -- name: Enable and start the service - ansible.builtin.systemd: - name: thelounge - state: started - enabled: yes \ No newline at end of file diff --git a/roles/chat/templates/config.js.j2 b/roles/chat/templates/config.js.j2 index c606576..c1b4a0c 100644 --- a/roles/chat/templates/config.js.j2 +++ b/roles/chat/templates/config.js.j2 @@ -49,8 +49,8 @@ module.exports = { url: "{{ thelounge_ldap_url }}", primaryKey: "uid", searchDN: { - rootDN: "{{ thelounge_ldap_rootDN }}", - rootPassword: "{{ thelounge_ldap_rootPassword }}", + rootDN: "{{ lookup('passwordstore', 'chat/thelounge/ldap_rootDN subkey=binddn') }}", + rootPassword: "{{ lookup('passwordstore', 'chat/thelounge/ldap_rootDN') }}", filter: "{{ thelounge_ldap_filter }}", base: "{{ thelounge_ldap_base }}", }, From 4870960b455748ae80b5f8724710e81cf3c24fa3 Mon Sep 17 00:00:00 2001 From: Mark Janssen -- Sig-I/O Automatisering Date: Sun, 27 Apr 2025 21:19:41 +0200 Subject: [PATCH 08/11] Listen on localhost --- group_vars/chat.yaml | 4 +++- roles/chat/defaults/main.yaml | 5 +++++ roles/chat/handlers/main.yaml | 1 + roles/chat/tasks/main.yaml | 14 +++++++------- roles/chat/templates/config.js.j2 | 2 +- roles/chat/templates/thelounge.service | 4 ++-- 6 files changed, 19 insertions(+), 11 deletions(-) diff --git a/group_vars/chat.yaml b/group_vars/chat.yaml index 8caf096..08a3480 100644 --- a/group_vars/chat.yaml +++ b/group_vars/chat.yaml @@ -1,9 +1,11 @@ --- + root_access: - blackdragon - ak - foobar - polyfloyd + nodejs_version: 22.x thelounge_version: "4.4.3" thelounge_ldap_url: ldaps://ldap.bitlair.nl @@ -31,4 +33,4 @@ nginx_sites: } group_nft_input: - - "tcp dport { http, https } accept # Allow web-traffic from world" \ No newline at end of file + - "tcp dport { http, https } accept # Allow web-traffic from world" diff --git a/roles/chat/defaults/main.yaml b/roles/chat/defaults/main.yaml index e69de29..4e52991 100644 --- a/roles/chat/defaults/main.yaml +++ b/roles/chat/defaults/main.yaml @@ -0,0 +1,5 @@ +--- + +chat_user: thelounge +chat_group: thelounge +chat_configdir: "/etc/thelounge" diff --git a/roles/chat/handlers/main.yaml b/roles/chat/handlers/main.yaml index 82e78eb..e03963e 100644 --- a/roles/chat/handlers/main.yaml +++ b/roles/chat/handlers/main.yaml @@ -1,4 +1,5 @@ --- + - name: Reload systemd ansible.builtin.systemd: daemon_reload: yes diff --git a/roles/chat/tasks/main.yaml b/roles/chat/tasks/main.yaml index 097eb1b..7b74982 100644 --- a/roles/chat/tasks/main.yaml +++ b/roles/chat/tasks/main.yaml @@ -19,12 +19,12 @@ - name: Ensure directories are present ansible.builtin.file: path: "{{ item.path }}" - owner: "thelounge" - group: "thelounge" + owner: "{{ chat_user }}" + group: "{{ chat_group }}" state: "{{ item.state | default('directory') }}" mode: "{{ item.mode | default('0770') }}" with_items: - - { path: "/etc/thelounge" } + - { path: "{{ chat_configdir }}" } - { path: "/var/local/thelounge/users" } - { path: "/var/local/thelounge/storage" } notify: @@ -34,8 +34,8 @@ ansible.builtin.template: src: "{{ item.src }}" dest: "{{ item.dest }}" - owner: "{{ item.owner | default( 'thelounge' ) }}" - group: "{{ item.group | default( 'thelounge' ) }}" + owner: "{{ item.owner | default( chat_user ) }}" + group: "{{ item.group | default( chat_group ) }}" mode: "{{ item.mode | default('0640') }}" with_items: - { src: "nodesource.list", dest: "/etc/apt/sources.list.d/nodesource.list", owner: root, group: root } @@ -101,8 +101,8 @@ ansible.builtin.template: src: "{{ item.src }}" dest: "{{ item.dest }}" - owner: "{{ item.owner | default( 'thelounge' ) }}" - group: "{{ item.group | default( 'thelounge' ) }}" + owner: "{{ item.owner | default( chat_user ) }}" + group: "{{ item.group | default( chat_group ) }}" mode: "{{ item.mode | default('0640') }}" validate: "{{ item.validate | default([]) }}" with_items: diff --git a/roles/chat/templates/config.js.j2 b/roles/chat/templates/config.js.j2 index c1b4a0c..ba12695 100644 --- a/roles/chat/templates/config.js.j2 +++ b/roles/chat/templates/config.js.j2 @@ -3,7 +3,7 @@ module.exports = { public: false, port: 9000, - bind: "0.0.0.0", + bind: "127.0.0.1", reverseProxy: true, lockNetwork: true, maxHistory: 10000, diff --git a/roles/chat/templates/thelounge.service b/roles/chat/templates/thelounge.service index 3fc7396..26a11ea 100644 --- a/roles/chat/templates/thelounge.service +++ b/roles/chat/templates/thelounge.service @@ -4,8 +4,8 @@ After=network-online.target Wants=network-online.target [Service] -User=thelounge -Group=thelounge +User={{ chat_user }} +Group={{ chat_group }} Type=simple Environment=THELOUNGE_HOME=/var/local/thelounge ExecStart=/usr/local/bin/thelounge start From 720cd70e4fd5635794c1ab95a9f1ef4b65b9d358 Mon Sep 17 00:00:00 2001 From: polyfloyd Date: Tue, 29 Apr 2025 17:50:18 +0200 Subject: [PATCH 09/11] Move a few things over from GitHub --- roles/services/tasks/discord_bot.yaml | 2 +- roles/services/tasks/mastodon_spacestate.yaml | 2 +- roles/services/tasks/spacestated.yaml | 2 +- roles/services/tasks/wifi_mqtt.yaml | 2 +- roles/www/tasks/calendar.yaml | 2 +- roles/www/tasks/spaceapi.yaml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/roles/services/tasks/discord_bot.yaml b/roles/services/tasks/discord_bot.yaml index 1889db4..19a659f 100644 --- a/roles/services/tasks/discord_bot.yaml +++ b/roles/services/tasks/discord_bot.yaml @@ -21,7 +21,7 @@ - name: Clone source ansible.builtin.git: - repo: https://github.com/bitlair/discord-bot.git + repo: https://git.bitlair.nl/bitlair/discord-bot.git version: main dest: /var/lib/discord-bot accept_hostkey: yes diff --git a/roles/services/tasks/mastodon_spacestate.yaml b/roles/services/tasks/mastodon_spacestate.yaml index 53f979e..9babbbd 100644 --- a/roles/services/tasks/mastodon_spacestate.yaml +++ b/roles/services/tasks/mastodon_spacestate.yaml @@ -7,7 +7,7 @@ - name: Clone source ansible.builtin.git: - repo: https://github.com/bitlair/mastodon-spacestate.git + repo: https://git.bitlair.nl/bitlair/mastodon-spacestate.git version: main dest: /var/lib/mastodon-spacestate accept_hostkey: yes diff --git a/roles/services/tasks/spacestated.yaml b/roles/services/tasks/spacestated.yaml index 92a0ace..e35851e 100644 --- a/roles/services/tasks/spacestated.yaml +++ b/roles/services/tasks/spacestated.yaml @@ -21,7 +21,7 @@ - name: Clone source ansible.builtin.git: - repo: https://github.com/bitlair/spacestated.git + repo: https://git.bitlair.nl/bitlair/spacestated.git version: main dest: /var/lib/spacestated/spacestated accept_hostkey: yes diff --git a/roles/services/tasks/wifi_mqtt.yaml b/roles/services/tasks/wifi_mqtt.yaml index 8bb8353..d69aa34 100644 --- a/roles/services/tasks/wifi_mqtt.yaml +++ b/roles/services/tasks/wifi_mqtt.yaml @@ -8,7 +8,7 @@ - name: Clone source ansible.builtin.git: - repo: https://github.com/bitlair/wifi-mqtt.git + repo: https://git.bitlair.nl/bitlair/wifi-mqtt.git version: main dest: /var/lib/wifi-mqtt accept_hostkey: yes diff --git a/roles/www/tasks/calendar.yaml b/roles/www/tasks/calendar.yaml index f6513a8..16c027e 100644 --- a/roles/www/tasks/calendar.yaml +++ b/roles/www/tasks/calendar.yaml @@ -5,7 +5,7 @@ - name: Clone source ansible.builtin.git: - repo: https://github.com/bitlair/calendar-parser.git + repo: https://git.bitlair.nl/bitlair/wiki-calendar-exporter.git version: main dest: /usr/local/src/bitlair-calendar accept_hostkey: yes diff --git a/roles/www/tasks/spaceapi.yaml b/roles/www/tasks/spaceapi.yaml index 7c8a494..e6b7954 100644 --- a/roles/www/tasks/spaceapi.yaml +++ b/roles/www/tasks/spaceapi.yaml @@ -1,7 +1,7 @@ --- - name: Clone spaceapi source ansible.builtin.git: - repo: https://github.com/bitlair/spaceapi.git + repo: https://git.bitlair.nl/bitlair/spaceapi.git version: main dest: /opt/spaceapi accept_hostkey: true From cedacdec7dcd67e6bf53aadc6cb7fe1294595136 Mon Sep 17 00:00:00 2001 From: polyfloyd Date: Tue, 29 Apr 2025 18:47:52 +0200 Subject: [PATCH 10/11] bank: Increase git sync frequency --- roles/bank/templates/git.cron | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/bank/templates/git.cron b/roles/bank/templates/git.cron index b703657..b334260 100644 --- a/roles/bank/templates/git.cron +++ b/roles/bank/templates/git.cron @@ -1,4 +1,4 @@ SHELL=/bin/bash -#m h dom mon dow user command - 0 * * * * {{ bank_user }} (cd /home/{{ bank_user }}/data.git && git pull -r && git push && git gc --auto && cp revbank.products ../revbank.products) +#m h dom mon dow user command + */10 * * * * {{ bank_user }} (cd /home/{{ bank_user }}/data.git && git pull -r && git push && git gc --auto && cp revbank.products ../revbank.products) From efd0604c3aa9d3c9ff558fdfd36c666d050cd57e Mon Sep 17 00:00:00 2001 From: BlackDragon Date: Wed, 30 Apr 2025 18:44:08 +0200 Subject: [PATCH 11/11] Update roles/chat/templates/config.js.j2 --- roles/chat/templates/config.js.j2 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/chat/templates/config.js.j2 b/roles/chat/templates/config.js.j2 index ba12695..69b1727 100644 --- a/roles/chat/templates/config.js.j2 +++ b/roles/chat/templates/config.js.j2 @@ -3,7 +3,8 @@ module.exports = { public: false, port: 9000, - bind: "127.0.0.1", + bind: "0.0.0.0", + host: "127.0.0.1", reverseProxy: true, lockNetwork: true, maxHistory: 10000,