Timotej Lazar
cf6b682cf8
Create a self-signed CA, set up group configs, add script to allow new connections through the firewall. In the base debian role, drop the default nftables forward chain with drop policy because it clashes with this. If you enable forwarding on a debian host, make sure to configure the firewall.
102 lines
1.2 KiB
YAML
102 lines
1.2 KiB
YAML
# common stuff
|
|
- hosts: '*'
|
|
gather_facts: false
|
|
roles:
|
|
- facts
|
|
|
|
- hosts: '*'
|
|
roles:
|
|
- { role: alpine, when: ansible_distribution == 'Alpine' }
|
|
- { role: debian, when: ansible_distribution == 'Debian' }
|
|
|
|
# hosts
|
|
- hosts: mgmt-gw
|
|
roles:
|
|
|
|
- hosts: ceph-*
|
|
roles:
|
|
- frr
|
|
- telegraf
|
|
- ceph
|
|
|
|
- hosts: proxmox-backup
|
|
roles:
|
|
- proxmox-backup
|
|
- frr
|
|
|
|
- hosts: pve-rc-*, pve-lab-*
|
|
roles:
|
|
- proxmox
|
|
- frr
|
|
|
|
# virtual machines
|
|
- hosts: bookstack
|
|
roles:
|
|
- nginx
|
|
- nginx-php
|
|
|
|
- hosts: dhcp
|
|
roles:
|
|
- dnsmasq
|
|
|
|
- hosts: doc
|
|
roles:
|
|
- nginx
|
|
- nginx-php
|
|
- dokuwiki
|
|
|
|
- hosts: git
|
|
roles:
|
|
- nginx
|
|
- forgejo
|
|
|
|
- hosts: kanboard
|
|
roles:
|
|
- nginx
|
|
- nginx-php
|
|
- kanboard
|
|
|
|
- hosts: matrix
|
|
roles:
|
|
- postgres
|
|
- nginx
|
|
- synapse
|
|
vars:
|
|
user: synapse
|
|
|
|
- hosts: monitor
|
|
roles:
|
|
- nginx
|
|
- influxdb
|
|
- grafana
|
|
|
|
- hosts: netbox
|
|
roles:
|
|
- postgres
|
|
- redis
|
|
- nginx
|
|
- netbox
|
|
vars:
|
|
user: netbox
|
|
|
|
- hosts: unifi
|
|
roles:
|
|
- nginx
|
|
- unifi
|
|
|
|
- hosts: vrata
|
|
roles:
|
|
- nginx
|
|
- ocserv
|
|
|
|
- hosts: web-front
|
|
roles:
|
|
- nginx
|
|
- reverse-proxy
|
|
|
|
- hosts: zid
|
|
roles:
|
|
- opensmtpd
|
|
- nginx
|
|
- friwall
|