manage lewis with nix

move docker swarm ansible to this repo
move thecloud ansible to this repo
support data disks in terraform

legacy/projects/docker_swarm/ansible/roles/traefik/docker-stack.yml.j2

@@ -0,0 +1,135 @@
+# vi: ft=yaml
+version: "3.7"
+
+networks:
+  traefik:
+    external: true
+
+configs:
+  services:
+    external: true
+    name: "{{ services.config_name }}"
+
+volumes:
+  acme:
+    driver_opts:
+      type: "nfs"
+      o: "addr=192.168.30.10,nolock,soft,rw"
+      device: ":/mnt/data/traefik/acme"
+
+services:
+  traefik:
+    image: traefik:3.0.0-beta2
+    networks:
+      - traefik
+    ports:
+      - mode: host
+        protocol: tcp
+        published: 443
+        target: 443
+      - mode: host
+        protocol: tcp
+        published: 80
+        target: 80
+      - mode: host
+        protocol: tcp
+        published: 444
+        target: 444
+    deploy:
+      placement:
+        constraints:
+          - node.role == manager
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.dashboard.entrypoints=localsecure
+        - traefik.http.routers.dashboard.rule=Host(`traefik.kun.is`)
+        - traefik.http.routers.dashboard.service=api@internal
+        - traefik.http.services.dashboard.loadbalancer.server.port=8080
+        - traefik.http.routers.dashboard.tls=true
+        - traefik.http.routers.dashboard.tls.certresolver=letsencrypt
+        - traefik.docker.network=traefik
+
+        - traefik.http.routers.esrom.entrypoints=websecure
+        - traefik.http.routers.esrom.service=esrom@file
+        - traefik.http.routers.esrom.rule=Host(`geokunis2.nl`)
+        - traefik.http.routers.esrom.tls=true
+        - traefik.http.routers.esrom.tls.certresolver=letsencrypt
+
+        - traefik.http.routers.uptime.entrypoints=localsecure
+        - traefik.http.routers.uptime.rule=Host(`uptime.kun.is`)
+        - traefik.http.routers.uptime.service=uptime@file
+        - traefik.http.routers.uptime.tls=true
+        - traefik.http.routers.uptime.tls.certresolver=letsencrypt
+
+        - traefik.http.routers.ntfy.entrypoints=websecure
+        - traefik.http.routers.ntfy.rule=Host(`ntfy.kun.is`)
+        - traefik.http.routers.ntfy.service=ntfy@file
+        - traefik.http.routers.ntfy.tls=true
+        - traefik.http.routers.ntfy.tls.certresolver=letsencrypt
+
+        - traefik.http.routers.apprise.entrypoints=localsecure
+        - traefik.http.routers.apprise.rule=Host(`apprise.kun.is`)
+        - traefik.http.routers.apprise.service=apprise@file
+        - traefik.http.routers.apprise.tls=true
+        - traefik.http.routers.apprise.tls.certresolver=letsencrypt
+
+        - traefik.http.routers.concourse.entrypoints=websecure
+        - traefik.http.routers.concourse.rule=Host(`ci.kun.is`)
+        - traefik.http.routers.concourse.service=concourse@file
+        - traefik.http.routers.concourse.tls=true
+        - traefik.http.routers.concourse.tls.certresolver=letsencrypt
+
+        - traefik.http.routers.discourse.entrypoints=websecure
+        - traefik.http.routers.discourse.rule=Host(`tuindersweijde.geokunis2.nl`)
+        - traefik.http.routers.discourse.service=discourse@file
+        - traefik.http.routers.discourse.tls=true
+        - traefik.http.routers.discourse.tls.certresolver=letsencrypt
+    volumes:
+      - type: bind
+        source: /var/run/docker.sock
+        target: /var/run/docker.sock
+      - type: volume
+        source: acme
+        target: /acme
+        volume:
+          nocopy: true
+    configs:
+      - source: services
+        target: /etc/traefik/services.yml
+    command:
+      - --providers.docker
+      - --providers.docker.swarmmode
+      - --providers.docker.watch
+      - --providers.docker.exposedbydefault=false
+
+      - --providers.file.filename=/etc/traefik/services.yml
+
+      - --api
+      - --api.insecure=false
+      - --api.dashboard=true
+
+      - --entrypoints.web.address=:80
+      - --entrypoints.web.http.redirections.entrypoint=true
+      - --entrypoints.web.http.redirections.entrypoint.to=websecure
+      - --entrypoints.web.http.redirections.entrypoint.scheme=https
+      - --entrypoints.web.http.redirections.entrypoint.permanent=true
+
+      - --entrypoints.websecure.address=:443
+
+      - --entrypoints.localsecure.address=:444
+
+      - --certificatesresolvers.letsencrypt.acme=true
+      - --certificatesresolvers.letsencrypt.acme.email=pim@kunis.nl
+      - --certificatesresolvers.letsencrypt.acme.storage=/acme/acme.json
+      - --certificatesresolvers.letsencrypt.acme.httpchallenge=true
+      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
+
+      - --serversTransport.insecureSkipVerify=true
+
+      - --accesslog=true
+      - --accesslog.fields.defaultmode=keep
+      - --accesslog.fields.names.ClientUsername=drop
+      - --accesslog.fields.headers.defaultmode=keep
+      - --accesslog.fields.headers.names.User-Agent=keep
+      - --accesslog.fields.headers.names.Authorization=drop
+      - --accesslog.fields.headers.names.Content-Type=keep

legacy/projects/docker_swarm/ansible/roles/traefik/services.yml

@@ -0,0 +1,26 @@
+http:
+  services:
+    esrom:
+      loadBalancer:
+        servers:
+          - url: http://esrom.dmz:80/
+    uptime:
+      loadBalancer:
+        servers:
+          - url: http://iris.dmz:3001
+    ntfy:
+      loadBalancer:
+        servers:
+          - url: http://iris.dmz:3002
+    apprise:
+      loadBalancer:
+        servers:
+          - url: http://iris.dmz:3003
+    concourse:
+      loadBalancer:
+        servers:
+          - url: http://concourse.dmz:3000
+    discourse:
+      loadBalancer:
+        servers:
+          - url: http://forum.dmz:80

legacy/projects/docker_swarm/ansible/roles/traefik/tasks/main.yml

@@ -0,0 +1,18 @@
+- name: Create Traefik network
+  docker_network:
+    name: traefik
+    driver: overlay
+
+- name: Create Docker config
+  docker_config:
+    name: traefik_services
+    data: "{{ lookup('file', '{{ role_path }}/services.yml') }}"
+    use_ssh_client: true
+    rolling_versions: true
+  register: services
+
+- name: Deploy Docker stack
+  docker_stack:
+    name: traefik
+    compose:
+      - "{{ lookup('template', '{{ role_path }}/docker-stack.yml.j2') | from_yaml }}"