From 6d5d638a14baad664de0566bf00717b871cdd632 Mon Sep 17 00:00:00 2001
From: stephen <stephen.lohning@oxnee.com>
Date: Mon, 18 May 2026 20:22:37 +1000
Subject: [PATCH] Initial automated server provision via Ansible

---
 ansible.cfg        | 16 ++++++++
 group_vars/all.yml | 11 ++++++
 inventory.ini      |  2 +
 playbooks/site.yml | 95 ++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 124 insertions(+)

diff --git a/ansible.cfg b/ansible.cfg
index e69de29..3e8b9db 100644
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -0,0 +1,16 @@
+[defaults]
+inventory = inventory.ini
+remote_user = stephen
+private_key_file = ~/.ssh/id_ed25519_ansible
+host_key_checking = False
+stdout_callback = ansible.builtin.default
+result_format = yaml
+
+[privilege_escalation]
+become = True
+become_method = sudo
+become_user = root
+become_ask_pass = False
+
+[ssh_connection]
+pipelining = True
\ No newline at end of file
diff --git a/group_vars/all.yml b/group_vars/all.yml
index e69de29..d5f22b3 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -0,0 +1,11 @@
+---
+# Domain & SSL Settings
+domain_name: dev.oxnee.com
+letsencrypt_email: stephen.lohning@oxnee.com
+
+# Forgejo Settings
+forgejo_version: "9.0.2"
+forgejo_db_user: forgejo
+forgejo_db_name: forgejo
+# Note: Forgejo will prompt you for the DB password during the 
+# first web login, so we don't strictly need to hardcode it here.
\ No newline at end of file
diff --git a/inventory.ini b/inventory.ini
index e69de29..cbb7f40 100644
--- a/inventory.ini
+++ b/inventory.ini
@@ -0,0 +1,2 @@
+[potato]
+192.168.1.210 ansible_user=stephen
\ No newline at end of file
diff --git a/playbooks/site.yml b/playbooks/site.yml
index e69de29..1924945 100644
--- a/playbooks/site.yml
+++ b/playbooks/site.yml
@@ -0,0 +1,95 @@
+---
+- name: Provision Potato Server Infrastructure
+  hosts: potato
+  become: true
+
+  tasks:
+    - name: Update apt cache
+      apt:
+        update_cache: yes
+        cache_valid_time: 3600
+
+    - name: Install System Dependencies
+      apt:
+        name:
+          - cockpit
+          - nginx
+          - certbot
+          - python3-certbot-nginx
+          - git
+        state: present
+
+    # --- FORGEJO SYSTEM USER & DIRECTORIES ---
+    - name: Create Git system user for Forgejo
+      user:
+        name: git
+        home: /home/git
+        shell: /bin/bash
+        system: yes
+
+    - name: Create Forgejo application directories
+      file:
+        path: "{{ item }}"
+        state: directory
+        owner: git
+        group: git
+        mode: '0750'
+      loop:
+        - /var/lib/forgejo
+        - /var/lib/forgejo/data
+        - /var/lib/forgejo/custom
+        - /var/lib/forgejo/log
+        - /etc/forgejo
+
+    # --- FORGEJO BINARY INSTALLATION ---
+    - name: Download Forgejo Linux AMD64 binary
+      get_url:
+        url: "https://codeberg.org/forgejo/forgejo/releases/download/v{{ forgejo_version }}/forgejo-{{ forgejo_version }}-linux-amd64"
+        dest: /usr/local/bin/forgejo
+        mode: '0755'
+        owner: root
+        group: root
+
+    - name: Provision Forgejo Systemd Service Unit
+      copy:
+        dest: /etc/systemd/system/forgejo.service
+        content: |
+          [Unit]
+          Description=Forgejo (Git Service)
+          After=syslog.target
+          After=network.target
+          After=postgresql.service
+
+          [Service]
+          Type=simple
+          User=git
+          Group=git
+          WorkingDirectory=/var/lib/forgejo/
+          Environment=USER=git HOME=/home/git FORGEJO_WORK_DIR=/var/lib/forgejo
+          ExecStart=/usr/local/bin/forgejo web --config /etc/forgejo/app.ini
+          Restart=always
+          RestartSec=2s
+
+          [Install]
+          WantedBy=multi-user.target
+
+    # --- SERVICE MANAGEMENT ---
+    - name: Enable and start system infrastructure services
+      service:
+        name: "{{ item }}"
+        state: started
+        enabled: yes
+      loop:
+        - cockpit
+        - nginx
+        - forgejo
+    # Install System Dependencies for Nginx and Certbot    
+    - name: Remove default Nginx site configuration
+      file:
+        path: /etc/nginx/sites-enabled/default
+        state: absent
+
+    - name: Reload Nginx to apply changes
+      service:
+        name: nginx
+        state: reloaded      
\ No newline at end of file