ansible playbook no longer maintained

This commit is contained in:
Christoph Haas 2025-06-08 16:34:04 +02:00
parent 12d2271f95
commit 03c20c1f23
5 changed files with 0 additions and 322 deletions

View file

@ -1,3 +0,0 @@
[defaults]
inventory = ./hosts
nocows = true

View file

@ -1,128 +0,0 @@
---
- hosts: localhost
vars:
ruby_version: 2.6.5
handlers:
- name: restart nginx
service: name=nginx state=restarted
tasks:
- name: Install packages
apt: name="{{item}}" state=present
with_items:
- htop
- python3-psycopg2
- ruby
- sudo
- nginx-extras
- apt-transport-https
- ca-certificates
- libssl-dev
- libreadline-dev
- zlib1g-dev
- libbz2-dev
- libpq-dev
- git
- imagemagick
- build-essential
- certbot
# - name: Remove conflicting packages
# apt: name=python-openssl state=absent
# - name: Enable Jessie backports repository
# apt_repository: repo="deb http://ftp.debian.org/debian jessie-backports main"
- name: Set up american locales to avoid warnings about missing locales
locale_gen: name=en_US.UTF-8 state=present
- name: Install PostgreSQL
apt: name=postgresql state=present
- name: Create PostgreSQL user
become: yes
become_user: postgres
postgresql_user: name=debshots
- name: Create PostgreSQL database
become: yes
become_user: postgres
postgresql_db: name=debshots owner=debshots encoding=UTF-8 template=template0
- name: Create application user
user: name=debshots groups=adm home=/opt/debshots shell=/bin/bash
# Install newer Ruby version using rbenv
- name: Get rbenv
become: yes
become_user: debshots
git:
repo: https://github.com/rbenv/rbenv.git
dest: /opt/debshots/.rbenv
force: yes
- name: Get rbenv-install
become: yes
become_user: debshots
git:
repo: https://github.com/rbenv/ruby-build.git
dest: /opt/debshots/.rbenv/plugins/ruby-build
force: yes
- name: enable rbenv
copy:
src: files/debshots-bash-profile
dest: /opt/debshots/.profile
owner: debshots
- name: Copy project to destination
synchronize:
# Path defaults to ansible/files
src: ../..
dest: /opt/debshots
#delete: yes
rsync_opts: --exclude=.git/,--exclude=log/,--exclude=tmp/cache,--exclude=storage/
- name: Build Ruby version
shell: rbenv install -v {{ruby_version}} creates=/opt/debshots/.rbenv/versions/{{ruby_version}}
become: yes
become_user: debshots
become_flags: "-i"
- name: Set Ruby version to version {{ruby_version}}
shell: rbenv local {{ruby_version}}
become: yes
become_user: debshots
become_flags: "-i"
- name: Install Bundler
shell: gem install bundler
become: yes
become_user: debshots
become_flags: "-i"
- name: Switch Bundler into deployment mode
shell: bundle config set deployment 'true'
args:
chdir: /opt/debshots
become: yes
become_user: debshots
become_flags: "-i"
- name: Install dependencies
shell: bundle install
args:
chdir: /opt/debshots
become: yes
become_user: debshots
become_flags: "-i"
- name: Pre-render the static assets
shell: bundle exec rails assets:precompile RAILS_ENV=production
args:
chdir: /opt/debshots
become: yes
become_user: debshots
become_flags: "-i"
- name: Deploy nginx config
copy:
src: files/nginx.conf
dest: /etc/nginx/sites-available/default
notify: restart nginx
# - debug: msg="Please run: certbot certonly --webroot -w /opt/debshots/public -d screenshots.debian.net"

View file

@ -1,27 +0,0 @@
# ~/.profile: executed by the command interpreter for login shells.
# This file is not read by bash(1), if ~/.bash_profile or ~/.bash_login
# exists.
# see /usr/share/doc/bash/examples/startup-files for examples.
# the files are located in the bash-doc package.
# the default umask is set in /etc/profile; for setting the umask
# for ssh logins, install and configure the libpam-umask package.
#umask 022
# if running bash
if [ -n "$BASH_VERSION" ]; then
# include .bashrc if it exists
if [ -f "$HOME/.bashrc" ]; then
. "$HOME/.bashrc"
fi
fi
# set PATH so it includes user's private bin if it exists
if [ -d "$HOME/bin" ] ; then
PATH="$HOME/bin:$PATH"
fi
# rbenv
export PATH="$HOME/.rbenv/bin:$HOME/.rbenv/plugins/ruby-build/bin:$PATH"
eval "$(rbenv init -)"

View file

@ -1,162 +0,0 @@
##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# http://wiki.nginx.org/Pitfalls
# http://wiki.nginx.org/QuickStart
# http://wiki.nginx.org/Configuration
#
# Generally, you will want to move this file somewhere, and start with a clean
# file but keep this around for reference. Or just disable in sites-enabled.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##
#proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=assets:768m use_temp_path=off;
#add_header X-Cache-Status $upstream_cache_status;
#add_header X-Runtime 42;
more_clear_headers 'X-Runtime';
more_clear_headers 'X-Powered-By';
more_clear_headers 'Server';
server_tokens off;
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=10g inactive=60m use_temp_path=off;
log_format proxy '[$time_local] Cache: $upstream_cache_status $upstream_addr $upstream_response_time $status $bytes_sent $remote_addr $request_uri "$http_referer" "$http_user_agent" $scheme';
limit_req_zone $binary_remote_addr zone=one:20m rate=5r/s;
# Frontend caching and static asset delivery
server {
listen *:80 default_server;
listen *:443 ssl;
ssl_certificate /etc/letsencrypt/live/screenshots.debian.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/screenshots.debian.net/privkey.pem;
# Debian SSO based on client certificates
ssl_client_certificate debsso.crt;
ssl_crl debsso.crl;
ssl_verify_client optional;
ssl_verify_depth 1;
#root /opt/debshots/public;
server_name _;
access_log /var/log/nginx/cache-access.log proxy;
add_header X-Cache-Status $upstream_cache_status;
# Pass on the actual HTTP_HOST ("Host:" header) so that Rails can build proper absolute URLs
proxy_set_header Host $host;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
gzip_proxied any;
location / {
try_files /maintenance.html @backend;
add_header X-Coffee front-main;
}
location /json/ {
try_files /maintenance.html @backend;
proxy_cache my_cache;
proxy_pass http://127.0.0.1:3000/;
proxy_cache_lock on;
proxy_cache_use_stale updating;
add_header X-Coffee front-json;
}
location /favicon.ico {
alias /opt/debshots/public/favicon.ico;
}
location /.well-known/ {
alias /opt/debshots/public/.well-known/;
}
location @backend {
proxy_cache my_cache;
proxy_set_header x_debian_sso_dn $ssl_client_s_dn;
proxy_pass http://127.0.0.1:3000;
# Tell the backend if the protocol used was HTTPS. Otherwise you get an infinite
# redirection loop because the backend assumes that HTTP was spoken behind the
# proxy. And Omniauth would incorrectly assume you used a HTTP callback URL.
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# Avoid cache stampede - rather update once and deliver stale content
proxy_cache_lock on;
proxy_cache_use_stale updating;
add_header X-Coffee front-rails;
# Use sendfile mechanism to deliver files directly
proxy_set_header X-Sendfile-Type X-Accel-Redirect;
proxy_set_header X-Accel-Mapping /opt/debshots/public/=/__send_file_accel/;
}
location /assets/ {
alias /opt/debshots/public/assets/;
expires 1h;
add_header X-Coffee front-assets;
}
location /logo/ {
alias /opt/debshots/public/logo/;
expires 1h;
add_header X-Coffee front-logo;
}
location /screenshots/ {
alias /opt/debshots/public/screenshots/;
expires max;
add_header X-Coffee front-screenshots;
}
location /images/ {
alias /opt/debshots/public/images/;
expires 1h;
add_header X-Coffee front-images;
}
}
# Backend rails application
# server {
# listen 127.0.0.1:3000;
# root /opt/debshots/public;
# server_name _;
# access_log /var/log/nginx/rails-access.log;
# # Send thumbnails using X-Sendfile / X-Accel-Redirect
# # The correct thumbnail is computed by the Rails application so it cannot be served directly.
# location /thumbnail/ {
# expires 1h;
# proxy_cache_valid 404 15m;
# add_header X-Coffee back-thumbnail;
# limit_req zone=one burst=30;
# }
# # Send public assets using X-Sendfile / X-Accel-Redirect (e.g. public/images/dummy/...)
# location /public/ {
# expires 1h;
# add_header X-Coffee back-public;
# # passenger_set_header X-Sendfile-Type X-Accel-Redirect;
# # passenger_env_var HTTP_X_ACCEL_MAPPING /opt/debshots/public/=/__send_file_accel/;
# # passenger_pass_header X-Accel-Redirect;
# }
# # Deliver static files directly from Nginx. See https://mattbrictson.com/accelerated-rails-downloads
# location /__send_file_accel/ {
# internal;
# alias /opt/debshots/public/;
# add_header X-Coffee back-accel;
# expires 1d;
# more_clear_headers 'Set-Cookie';
# }
# location /secretstatus {
# stub_status;
# access_log off;
# allow all;
# add_header X-Coffee back-status;
# }
# }

View file

@ -1,2 +0,0 @@
localhost ansible_connection=local