From 7364d8111c54b93490965f628720641bd4d938a7 Mon Sep 17 00:00:00 2001 From: cinnaboot Date: Mon, 12 Apr 2021 13:08:19 -0400 Subject: [PATCH] update dokuwiki and add dnat routing save --- lxd_host_playbook.yml | 29 ++++++++++++-- site_vars.yml | 6 +-- tasks/dokuwiki.yml | 91 ++++++++++++++++++++++++++++++++++++------- 3 files changed, 105 insertions(+), 21 deletions(-) diff --git a/lxd_host_playbook.yml b/lxd_host_playbook.yml index 096dfeb..12e89e8 100644 --- a/lxd_host_playbook.yml +++ b/lxd_host_playbook.yml @@ -29,16 +29,31 @@ # - include_tasks: tasks/dokuwiki.yml - import_playbook: tasks/dokuwiki.yml +# +# DNAT routing +# + # NOTE: do host routing last so we can fail on no sudo pass -# TODO: add task for installing iptables & iptables-persistent on debian -# TODO: save rules after updating + +- name: install iptables packages + hosts: lxd_host + tags: install_lxd + tasks: - name: add DNAT rules for ssh to containers hosts: lxd_host tags: dnat_route tasks: - include_vars: file: site_vars.yml - - iptables: + + - name: install iptables and iptables-persistent + become: yes + apt: + name: [iptables, iptables-persistent] + state: present + + - name: add rules on containers + iptables: table: nat chain: PREROUTING in_interface: "{{ host_iface }}" @@ -49,9 +64,15 @@ destination_port: "{{ item.value.sshd_port }}" to_destination: "{{ item.value.ip }}" become: yes - #when: not debug_skip_iptables with_items: "{{ containers | dict2items }}" + - name: save DNAT rules on lxd host + become: yes + community.general.iptables_state: + table: nat + state: saved + path: /etc/iptables/rules.v4 + - name: add DNAT rules for individual containers hosts: lxd_host tags: dnat_route_2 diff --git a/site_vars.yml b/site_vars.yml index db940b3..bbe2940 100644 --- a/site_vars.yml +++ b/site_vars.yml @@ -1,8 +1,4 @@ --- -# NOTE: skip tasks when debugging -debug_skip: True -debug_skip_iptables: True - img_server: https://images.linuxcontainers.org alp_img_alias: alpine/3.13/amd64 lxc_cmd: /snap/bin/lxc @@ -11,6 +7,8 @@ lxd_bridge: lxdbr0 tmp_pubkey: /tmp/controller_key_rsa.pub host_iface: enp2s0 host_cidr: '192.168.11.0/24' + +# TODO: move this info to inventory file containers: #- transmission dokuwiki: diff --git a/tasks/dokuwiki.yml b/tasks/dokuwiki.yml index 64dce77..fe5ed9f 100644 --- a/tasks/dokuwiki.yml +++ b/tasks/dokuwiki.yml @@ -3,14 +3,28 @@ - name: testing ssh connection to container hosts: dokuwiki tags: containers + vars: lighttpd_user: lighttpd lighttpd_group: lighttpd docroot: /var/www/localhost/htdocs + doku_url: https://download.dokuwiki.org/src/dokuwiki/dokuwiki-stable.tgz doku_tar: /tmp/dokuwiki-stable.tgz doku_dir: "{{ docroot }}/dokuwiki" + + use_backup: True + doku_backup_archive: ../data/dokuwiki_backup.tgz + backup_guard: ANSIBLE_BACKUP_GUARD + tasks: + + # TODO: break out lighttpd default config to a separate playlist + + # + # lighttpd config + # + - name: install packages vars: packages: @@ -41,8 +55,6 @@ name: "{{ packages | join(' ') }}" state: present - # TODO: break out lighttpd default config to a separate playlist - - name: copy lighttpd.conf copy: src: ../templates/lighttpd.conf.j2 @@ -54,17 +66,24 @@ enabled: yes state: started + # + # dokuwiki config + # + + # TODO: this should be a separate play + - name: test if dokuwiki was already installed find: paths: "{{ doku_dir }}" pattern: README register: doku_find_result + when: not use_backup - name: download dokuwiki stable get_url: url: "{{ doku_url }}" dest: "{{ doku_tar }}" - when: doku_find_result.matched == 0 + when: not use_backup and doku_find_result.matched == 0 - name: make directory for dokiwiki in docroot file: @@ -72,7 +91,7 @@ state: directory owner: "{{ lighttpd_user }}" group: "{{ lighttpd_group }}" - when: doku_find_result.matched == 0 + when: not use_backup and doku_find_result.matched == 0 - name: unarchive downloaded file unarchive: @@ -81,7 +100,7 @@ dest: /tmp owner: "{{ lighttpd_user }}" group: "{{ lighttpd_group }}" - when: doku_find_result.matched == 0 + when: not use_backup and doku_find_result.matched == 0 - name: find doku temporary directory find: @@ -90,24 +109,70 @@ pattern: "dokuwiki-20*" use_regex: true register: doku_tmp_dir + when: not use_backup - name: copy dokuwiki files to webroot copy: remote_src: yes - src: "{{ doku_tmp_dir.files[0].path }}" + src: "{{ doku_tmp_dir.files[0].path }}/" dest: "{{ doku_dir }}" - when: doku_tmp_dir.matched > 0 + owner: "{{ lighttpd_user }}" + group: "{{ lighttpd_group }}" + when: not use_backup and doku_tmp_dir.matched > 0 - - name: remove archive - file: - path: "{{ doku_tar }}" - state: absent + # NOTE: this is only about 3.5MB + #- name: remove archive + # file: + # path: "{{ doku_tar }}" + # state: absent - name: remove temporary files file: path: "{{ doku_tmp_dir.files[0].path }}" state: absent - when: doku_tmp_dir.matched > 0 + when: not use_backup and doku_tmp_dir.matched > 0 + + # + # install backup data + # + + - name: test for backup guard + find: + path: "{{ doku_dir }}" + pattern: "{{ backup_guard }}" + register: backup_guard_present + + #- name: remove install.php + # file: + # path: "{{ doku_dir }}/install.php" + # state: absent + # when: use_backup and backup_guard_present.matched == 0 - # TODO: copy archived dokuwiki files + #- name: remove default dokuwiki data + # file: + # path: "{{ doku_dir }}/data/" + # state: absent + # when: use_backup and backup_guard_present.matched == 0 + + #- name: remove default dokuwiki conf + # file: + # path: "{{ doku_dir }}/conf/" + # state: absent + # when: use_backup and backup_guard_present.matched == 0 + + - name: extract backup archive + unarchive: + src: "{{ doku_backup_archive }}" + dest: "{{ docroot }}" + owner: "{{ lighttpd_user }}" + group: "{{ lighttpd_group }}" + + - name: add guard file to let ansible know backup is completed + file: + path: "{{ doku_dir }}/{{ backup_guard }}" + state: touch + when: use_backup and backup_guard_present.matched == 0 + # TODO: add play for creating backup data + # TODO: split up plays and move to separate role + # TODO: remember to add custom plugins to backup