2025-12-27 14:13:15 +01:00
|
|
|
---
|
|
|
|
|
# Initial server setup playbook
|
|
|
|
|
# Provisions base infrastructure: hardening, Docker, Traefik
|
|
|
|
|
|
|
|
|
|
- name: Setup base infrastructure
|
|
|
|
|
hosts: all
|
|
|
|
|
become: yes
|
|
|
|
|
|
|
|
|
|
vars:
|
|
|
|
|
# Override these in group_vars or host_vars
|
|
|
|
|
traefik_acme_email: "admin@postxsociety.cloud"
|
|
|
|
|
|
|
|
|
|
pre_tasks:
|
|
|
|
|
- name: Wait for system to be ready
|
|
|
|
|
wait_for_connection:
|
|
|
|
|
timeout: 300
|
|
|
|
|
|
|
|
|
|
- name: Gather facts
|
|
|
|
|
setup:
|
|
|
|
|
|
chore: Post-workshop state - January 23rd, 2026
This commit captures the infrastructure state immediately following
the "Post-Tyranny Tech" workshop on January 23rd, 2026.
Infrastructure Status:
- 13 client servers deployed (white, valk, zwaan, specht, das, uil, vos,
haas, wolf, ree, mees, mus, mol, kikker)
- Services: Authentik SSO, Nextcloud, Collabora Office, Traefik
- Private network architecture with edge NAT gateway
- OIDC integration between Authentik and Nextcloud
- Automated recovery flows and invitation system
- Container update monitoring with Diun
- Uptime monitoring with Uptime Kuma
Changes include:
- Multiple new client host configurations
- Network architecture improvements (private IPs + NAT)
- DNS management automation
- Container update notifications
- Email configuration via Mailgun
- SSH key generation for all clients
- Encrypted secrets for all deployments
- Health check and diagnostic scripts
Known Issues to Address:
- Nextcloud version pinned to v30 (should use 'latest' or v32)
- Zitadel references in templates (migrated to Authentik but templates not updated)
- Traefik dynamic config has obsolete static routes
🤖 Generated with Claude Code (https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-23 20:36:31 +01:00
|
|
|
- name: Load shared secrets (Docker Hub, etc.)
|
|
|
|
|
community.sops.load_vars:
|
|
|
|
|
file: "{{ playbook_dir }}/../../secrets/shared.sops.yaml"
|
|
|
|
|
name: shared_secrets
|
|
|
|
|
age_keyfile: "{{ lookup('env', 'SOPS_AGE_KEY_FILE') }}"
|
|
|
|
|
no_log: true
|
|
|
|
|
|
2025-12-27 14:13:15 +01:00
|
|
|
roles:
|
|
|
|
|
- role: common
|
|
|
|
|
tags: ['common', 'security']
|
|
|
|
|
|
|
|
|
|
- role: docker
|
|
|
|
|
tags: ['docker']
|
|
|
|
|
|
|
|
|
|
- role: traefik
|
|
|
|
|
tags: ['traefik', 'proxy']
|
|
|
|
|
|
|
|
|
|
post_tasks:
|
|
|
|
|
- name: Display server information
|
|
|
|
|
debug:
|
|
|
|
|
msg:
|
|
|
|
|
- "✅ Server setup complete!"
|
|
|
|
|
- "Hostname: {{ ansible_hostname }}"
|
|
|
|
|
- "IP Address: {{ ansible_default_ipv4.address }}"
|
|
|
|
|
- "SSH hardened, UFW enabled, fail2ban active"
|
|
|
|
|
- "Docker installed and running"
|
|
|
|
|
- "Traefik managing SSL certificates automatically"
|