update dokuwiki and add dnat routing save

lxd_host_playbook.yml

@@ -29,16 +29,31 @@
         #    - include_tasks: tasks/dokuwiki.yml
 - import_playbook: tasks/dokuwiki.yml
 
+#
+# DNAT routing
+#
+
 # NOTE: do host routing last so we can fail on no sudo pass
-# TODO: add task for installing iptables & iptables-persistent on debian
-# TODO: save rules after updating
+
+- name: install iptables packages
+  hosts: lxd_host
+  tags: install_lxd
+  tasks:
 - name: add DNAT rules for ssh to containers
   hosts: lxd_host
   tags: dnat_route
   tasks:
     - include_vars:
         file: site_vars.yml
-    - iptables:
+
+    - name: install iptables and iptables-persistent
+      become: yes
+      apt:
+        name: [iptables, iptables-persistent]
+        state: present
+
+    - name: add rules on containers
+      iptables:
         table: nat
         chain: PREROUTING
         in_interface: "{{ host_iface }}"
@@ -49,9 +64,15 @@
         destination_port: "{{ item.value.sshd_port }}"
         to_destination: "{{ item.value.ip }}"
       become: yes
-      #when: not debug_skip_iptables
       with_items: "{{ containers | dict2items }}"
 
+    - name: save DNAT rules on lxd host
+      become: yes
+      community.general.iptables_state:
+        table: nat
+        state: saved
+        path: /etc/iptables/rules.v4
+
 - name: add DNAT rules for individual containers
   hosts: lxd_host
   tags: dnat_route_2

site_vars.yml

@@ -1,8 +1,4 @@
 ---
-# NOTE: skip tasks when debugging
-debug_skip: True
-debug_skip_iptables: True
-
 img_server: https://images.linuxcontainers.org
 alp_img_alias: alpine/3.13/amd64
 lxc_cmd: /snap/bin/lxc
@@ -11,6 +7,8 @@ lxd_bridge: lxdbr0
 tmp_pubkey: /tmp/controller_key_rsa.pub
 host_iface: enp2s0
 host_cidr: '192.168.11.0/24'
+
+# TODO: move this info to inventory file
 containers:
   #- transmission
   dokuwiki:

tasks/dokuwiki.yml

@@ -3,14 +3,28 @@
 - name: testing ssh connection to container
   hosts: dokuwiki
   tags: containers
+
   vars:
     lighttpd_user: lighttpd
     lighttpd_group: lighttpd
     docroot: /var/www/localhost/htdocs
+
     doku_url: https://download.dokuwiki.org/src/dokuwiki/dokuwiki-stable.tgz
     doku_tar: /tmp/dokuwiki-stable.tgz
     doku_dir: "{{ docroot }}/dokuwiki"
+
+    use_backup: True
+    doku_backup_archive: ../data/dokuwiki_backup.tgz
+    backup_guard: ANSIBLE_BACKUP_GUARD
+
   tasks:
+
+  # TODO: break out lighttpd default config to a separate playlist
+
+  #
+  # lighttpd config
+  #
+
   - name: install packages
     vars:
       packages:
@@ -41,8 +55,6 @@
       name: "{{ packages | join(' ') }}"
       state: present
 
-  # TODO: break out lighttpd default config to a separate playlist
-
   - name: copy lighttpd.conf
     copy:
       src: ../templates/lighttpd.conf.j2
@@ -54,17 +66,24 @@
       enabled: yes
       state: started
 
+  #
+  # dokuwiki config
+  #
+
+  # TODO: this should be a separate play
+
   - name: test if dokuwiki was already installed
     find:
       paths: "{{ doku_dir }}"
       pattern: README
     register: doku_find_result
+    when: not use_backup
 
   - name: download dokuwiki stable
     get_url:
       url: "{{ doku_url }}"
       dest: "{{ doku_tar }}"
-    when: doku_find_result.matched == 0
+    when: not use_backup and doku_find_result.matched == 0
 
   - name: make directory for dokiwiki in docroot
     file:
@@ -72,7 +91,7 @@
       state: directory
       owner: "{{ lighttpd_user }}"
       group: "{{ lighttpd_group }}"
-    when: doku_find_result.matched == 0
+    when: not use_backup and doku_find_result.matched == 0
 
   - name: unarchive downloaded file
     unarchive:
@@ -81,7 +100,7 @@
       dest: /tmp
       owner: "{{ lighttpd_user }}"
       group: "{{ lighttpd_group }}"
-    when: doku_find_result.matched == 0
+    when: not use_backup and doku_find_result.matched == 0
 
   - name: find doku temporary directory
     find:
@@ -90,24 +109,70 @@
       pattern: "dokuwiki-20*"
       use_regex: true
     register: doku_tmp_dir
+    when: not use_backup
 
   - name: copy dokuwiki files to webroot
     copy:
       remote_src: yes
-      src: "{{ doku_tmp_dir.files[0].path }}"
+      src: "{{ doku_tmp_dir.files[0].path }}/"
       dest: "{{ doku_dir }}"
-    when: doku_tmp_dir.matched > 0
+      owner: "{{ lighttpd_user }}"
+      group: "{{ lighttpd_group }}"
+    when: not use_backup and doku_tmp_dir.matched > 0
 
-  - name: remove archive
-    file:
-      path: "{{ doku_tar }}"
-      state: absent
+  # NOTE: this is only about 3.5MB
+  #- name: remove archive
+  #  file:
+  #    path: "{{ doku_tar }}"
+  #    state: absent
 
   - name: remove temporary files
     file:
       path: "{{ doku_tmp_dir.files[0].path }}"
       state: absent
-    when: doku_tmp_dir.matched > 0
+    when: not use_backup and doku_tmp_dir.matched > 0
+
+  #
+  # install backup data
+  #
+
+  - name: test for backup guard
+    find:
+      path: "{{ doku_dir }}"
+      pattern: "{{ backup_guard }}"
+    register: backup_guard_present
+
+  #- name: remove install.php
+  #  file:
+  #    path: "{{ doku_dir }}/install.php"
+  #    state: absent
+  #  when: use_backup and backup_guard_present.matched == 0
 
-  # TODO: copy archived dokuwiki files
+  #- name: remove default dokuwiki data
+  #  file:
+  #    path: "{{ doku_dir }}/data/"
+  #    state: absent
+  #  when: use_backup and backup_guard_present.matched == 0
+
+  #- name: remove default dokuwiki conf
+  #  file:
+  #    path: "{{ doku_dir }}/conf/"
+  #    state: absent
+  #  when: use_backup and backup_guard_present.matched == 0
+
+  - name: extract backup archive
+    unarchive:
+      src: "{{ doku_backup_archive }}"
+      dest: "{{ docroot }}"
+      owner: "{{ lighttpd_user }}"
+      group: "{{ lighttpd_group }}"
+
+  - name: add guard file to let ansible know backup is completed
+    file:
+      path: "{{ doku_dir }}/{{ backup_guard }}"
+      state: touch
+    when: use_backup and backup_guard_present.matched == 0
 
+  # TODO: add play for creating backup data
+  # TODO: split up plays and move to separate role
+  # TODO: remember to add custom plugins to backup