131 lines
No EOL
3.6 KiB
YAML
131 lines
No EOL
3.6 KiB
YAML
---
|
|
- name: Provision Potato Server Infrastructure
|
|
hosts: potato
|
|
become: true
|
|
|
|
tasks:
|
|
- name: Update apt cache
|
|
apt:
|
|
update_cache: yes
|
|
cache_valid_time: 3600
|
|
|
|
- name: Install System Dependencies
|
|
apt:
|
|
name:
|
|
- cockpit
|
|
- nginx
|
|
- certbot
|
|
- python3-certbot-nginx
|
|
- git
|
|
state: present
|
|
|
|
# --- FORGEJO SYSTEM USER & DIRECTORIES ---
|
|
- name: Create Git system user for Forgejo
|
|
user:
|
|
name: git
|
|
home: /home/git
|
|
shell: /bin/bash
|
|
system: yes
|
|
|
|
- name: Create Forgejo application directories
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: git
|
|
group: git
|
|
mode: '0750'
|
|
loop:
|
|
- /var/lib/forgejo
|
|
- /var/lib/forgejo/data
|
|
- /var/lib/forgejo/custom
|
|
- /var/lib/forgejo/log
|
|
- /etc/forgejo
|
|
|
|
# --- FORGEJO BINARY INSTALLATION ---
|
|
- name: Download Forgejo Linux AMD64 binary
|
|
get_url:
|
|
url: "https://codeberg.org/forgejo/forgejo/releases/download/v{{ forgejo_version }}/forgejo-{{ forgejo_version }}-linux-amd64"
|
|
dest: /usr/local/bin/forgejo
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Provision Forgejo Systemd Service Unit
|
|
copy:
|
|
dest: /etc/systemd/system/forgejo.service
|
|
content: |
|
|
[Unit]
|
|
Description=Forgejo (Git Service)
|
|
After=syslog.target
|
|
After=network.target
|
|
After=postgresql.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=git
|
|
Group=git
|
|
WorkingDirectory=/var/lib/forgejo/
|
|
Environment=USER=git HOME=/home/git FORGEJO_WORK_DIR=/var/lib/forgejo
|
|
ExecStart=/usr/local/bin/forgejo web --config /etc/forgejo/app.ini
|
|
Restart=always
|
|
RestartSec=2s
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|
|
# --- SERVICE MANAGEMENT ---
|
|
- name: Enable and start system infrastructure services
|
|
service:
|
|
name: "{{ item }}"
|
|
state: started
|
|
enabled: yes
|
|
loop:
|
|
- cockpit
|
|
- nginx
|
|
- forgejo
|
|
|
|
- name: Remove default Nginx site configuration
|
|
file:
|
|
path: /etc/nginx/sites-enabled/default
|
|
state: absent
|
|
|
|
# --- NEW: NGINX REVERSE PROXY CONFIGURATION ---
|
|
- name: Configure Nginx reverse proxy for Forgejo
|
|
copy:
|
|
dest: "/etc/nginx/sites-available/{{ domain_name }}"
|
|
content: |
|
|
server {
|
|
listen 80;
|
|
server_name {{ domain_name }};
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:3000;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|
|
|
|
- name: Enable Forgejo Nginx site config symlink
|
|
file:
|
|
src: "/etc/nginx/sites-available/{{ domain_name }}"
|
|
dest: "/etc/nginx/sites-enabled/{{ domain_name }}"
|
|
state: link
|
|
|
|
- name: Reload Nginx to apply proxy routing
|
|
service:
|
|
name: nginx
|
|
state: reloaded
|
|
|
|
# --- NEW: LET'S ENCRYPT CERTIFICATE PROVISIONING ---
|
|
- name: Obtain SSL certificate from Let's Encrypt via Certbot
|
|
command: >
|
|
certbot --nginx
|
|
-d {{ domain_name }}
|
|
--email {{ letsencrypt_email }}
|
|
--agree-tos
|
|
--non-interactive
|
|
--keep-until-expiring
|
|
args:
|
|
creates: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem" |