Skip to content

Commit 0f8d3e2

Browse files
blackandredblackandred
committed
Initial commit
1 parent 0c7e268 commit 0f8d3e2

File tree

12 files changed

+280
-49
lines changed

12 files changed

+280
-49
lines changed

‎.env-dist

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
INVENTORY_GIT_URL=
2+
3+
# better do not change
4+
RKD_WHITELIST_GROUPS=:node
5+
RKD_ALIAS_GROUPS="->:node"

‎.gitignore

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,11 @@
33
*__pycache__*
44
/.venv
55
.venv-setup.log
6+
/inventory
7+
/.env
8+
/.temp/dynamic_vars/*
9+
10+
11+
12+
13+
!.gitkeep

‎.rkd/makefile.py

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎.rkd/makefile.yaml

Lines changed: 39 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,48 @@
11
version: org.riotkit.rkd/yaml/v1
22
imports: []
33
tasks:
4-
:hello:
5-
description: Hello world task
6-
arguments:
7-
"--name":
8-
help: "Your name"
9-
required: True
4+
:node:setup:
5+
description: Sets up the inventory
106
steps: |
11-
echo "Hello $ARG_NAME"
7+
if [[ -d inventory ]]; then
8+
cd inventory; git pull; cd ..
9+
else
10+
git clone $INVENTORY_GIT_URL inventory
11+
fi
1212
13-
:hello:python:
14-
description: Hello world task
15-
arguments:
16-
"--name":
17-
help: "Your name"
18-
required: True
13+
:node:copy-host-defaults:
14+
description: "Copy default values for hosts in the inventory (warning: it will override existing files)"
15+
steps: cp -prv .templates/* ./
16+
17+
:node:list:playbooks:
18+
description: List all available playbooks
1919
steps: |
2020
#!python
21+
import os
22+
for element in os.scandir('playbooks'):
23+
print(element.name)
2124
22-
# those two lines are optional (for your eyes and for IDE - you can also import those classes there)
23-
ctx: ExecutionContext
24-
this: TaskInterface
25-
26-
print('Hello %s' % ctx.get_arg('--name'))
2725
return True
26+
27+
:node:clean:
28+
description: Clean up temporary files
29+
steps: "rm /tmp/.rkt-ansible.*.yaml"
30+
31+
:node:deploy:
32+
description: Run a deployment
33+
arguments:
34+
"playbook":
35+
help: "Playbook name, see :list:playbooks"
36+
"--args":
37+
help: "Additional Ansible commandline arguments"
38+
required: False
39+
"--role":
40+
help: "Limit to a given role"
41+
required: False
42+
steps: |
43+
if [[ $ARG_ROLE ]]; then
44+
ARG_ARGS="$ARG_ARGS -t $ARG_ROLE"
45+
fi
46+
47+
ansible-playbook ./playbooks/$ARG_PLAYBOOK -i inventory/hosts.cfg ${ARG_ARGS}
48+

‎.templates/inventory/group_vars/all.yaml

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
2+
# https://github.com/zwiazeksyndykalistowpolski/server-multi-user
3+
default_role_users:
4+
technical_entrypoint: "/project/make.sh"
5+
enable_technical_entrypoint: false
6+
7+
# technical administrator used for automatic deployments
8+
technical_account: "tech.admin"
9+
technical_password: 'xyz' # mkpasswd --method=SHA-512, also important - single quotes are important
10+
technical_account_id: 1800
11+
technical_group: "technical"
12+
technical_group_id: 4055
13+
users:
14+
accounts: []
15+
16+
17+
# https://github.com/zwiazeksyndykalistowpolski/server-basic-security
18+
default_role_basic_security:
19+
ssh_idle_time: "36000"
20+
ssh_permit_root_login: no
21+
ssh_input_port: "{{ ssh_target_port }}"
22+
change_root_password: no
23+
root_password: ""
24+
configure_firewall: yes
25+
firewall_interface: ens192 # important: adjust this to your needs, invalid value may cut off access to the machine
26+
firewall_whitelist_local_network_addresses: true
27+
firewall_allowed_outgoing_ports:
28+
- "22"
29+
- "{{ ssh_target_port }}"
30+
- "80"
31+
- "443"
32+
33+
34+
# https://github.com/zwiazeksyndykalistowpolski/server-basic-software
35+
default_role_basic_software:
36+
docker: yes
37+
docker_schedule_clean_up: yes
38+
# Enforce docker to be updated (WARNING: will turn off and turn on docker)
39+
enforce_docker_update: no
40+
41+
42+
# https://github.com/riotkit-org/server-tweak
43+
default_role_tune:
44+
# Be careful with setting this to "no", even security upgrades are able to break docker daemon. Its better to manually upgrade system.
45+
remove_unattended_upgrades: yes
46+
remove_qemu_guest_agent: yes
47+
tune_docker: yes
48+
adjust_swappiness: yes
49+
swappiness: 10
50+
51+
52+
# https://github.com/riotkit-org/server-logs
53+
default_role_logs:
54+
configure_logrotate: no
55+
configure_systemd: yes
56+
systemd_max_logs_disk_space: 100M
57+
systemd_max_file_sec: 1month

‎README.md

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,37 @@
1-
# riotkit-universal-node
1+
RiotKit Universal Node
2+
======================
23

3-
Ansible do unwersalnej konfiguracji serwerów, które mają docelowo uruchamiać środowisko dockerowe
4+
Turns a typical cheap virtual node into a dockerized applications environment. Natively integrates with RiotKit's Harbor 2+ for webservices deployment.
5+
6+
First time setup
7+
----------------
8+
9+
```bash
10+
cp .env-dist .env
11+
nano .env
12+
13+
rkd :setup
14+
rkd :copy-host-defaults
15+
```
16+
17+
Features
18+
--------
19+
20+
- Structure and automation
21+
- User accounts management
22+
- Basic security (firewall ports, fail2ban, partial disk encryption)
23+
- Extensibility
24+
- Native integration with RiotKit Harbor
25+
- Logs rotation and logs privacy management
26+
- Inventory in separate GIT repository
27+
28+
Cheap node specification
29+
------------------------
30+
31+
This set of playbooks needs to run at least on this specification:
32+
33+
- CPU: 1-4 cores
34+
- RAM: 1-4 GB
35+
- HDD: 20-40 GB SSD (including OS)
36+
- OS: Ubuntu 16.04+ or latest Debian Stable or Latest Armbian
37+
- Host type: Physical ARM or KVM

‎playbooks/encrypt-disks.yml

Whitespace-only changes.

‎playbooks/harbor.yml

Whitespace-only changes.

‎playbooks/prepare-machine.yml

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
#
2+
# Make sure we still know the port, even when we changed the port for security reasons on previous runs
3+
#
4+
- hosts: all
5+
gather_facts: no
6+
roles:
7+
- role: blackandred.server_ssh_fallback_port
8+
when: ssh_fallback_port is defined and ssh_fallback_port > 0
9+
vars:
10+
fallback_ssh_port: "{{ ssh_fallback_port }}"
11+
12+
13+
#
14+
# Run all roles one-by-one
15+
#
16+
- hosts: all
17+
gather_facts: yes
18+
force_handlers: yes
19+
tasks:
20+
# ==========
21+
# Multi User
22+
# ==========
23+
- name: Users management role
24+
when: role_users is defined
25+
block:
26+
- name: Include required vars
27+
set_fact:
28+
args: "{{ default_role_users | combine(role_users | default({}), recursive=True) }}"
29+
30+
- include_role: name=blackandred.server_multi_user
31+
tags: users
32+
33+
# ==============
34+
# Basic Software
35+
# ==============
36+
- name: Basic Software role
37+
when: role_basic_software is defined
38+
block:
39+
- name: Include required vars
40+
set_fact:
41+
args: "{{ default_role_basic_software | combine(role_basic_software | default({}), recursive=True) }}"
42+
43+
- include_role: name=blackandred.server_basic_software
44+
tags: basic_software
45+
46+
# ========
47+
# Tweaking
48+
# ========
49+
- name: Tweaking role
50+
when: role_tune is defined
51+
block:
52+
- name: Include required vars
53+
set_fact:
54+
args: "{{ default_role_tune | combine(role_tune | default({}), recursive=True) }}"
55+
56+
- include_role: name=blackandred.server_tune
57+
tags: tune
58+
59+
# ====
60+
# Logs
61+
# ====
62+
- name: Logs role
63+
when: role_logs is defined
64+
block:
65+
- name: Include required vars
66+
set_fact:
67+
args: "{{ default_role_logs | combine(role_logs | default({}), recursive=True) }}"
68+
69+
- include_role: name=blackandred.server_logs
70+
tags: logs

‎playbooks/update-machines.yml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
#
2+
# UPDATE MACHINE PLAYBOOK
3+
# =======================
4+
# Performs packages upgrade on target machine. Considers a fact that docker daemon could be corrupted after update
5+
# and will attempt to restart it with all dependent services
6+
#
7+
8+
9+
#
10+
# Make sure we still know the port, even when we changed the port for security reasons on previous runs
11+
#
12+
- hosts: all
13+
gather_facts: no
14+
roles:
15+
- role: blackandred.server_ssh_fallback_port
16+
when: ssh_fallback_port is defined and ssh_fallback_port > 0
17+
vars:
18+
fallback_ssh_port: "{{ ssh_fallback_port }}"
19+
20+
21+
#
22+
# Run all roles one-by-one
23+
#
24+
- hosts: all
25+
gather_facts: yes
26+
force_handlers: yes
27+
tasks:
28+
- name: Detect docker version
29+
become: yes
30+
shell: "dpkg -s docker-ce | grep -i version | awk '{print $2}'"
31+
register: docker_version_before
32+
33+
- name: Perform system upgrade
34+
become: yes
35+
apt:
36+
update_cache: yes
37+
upgrade: dist
38+
39+
- name: Detect docker version
40+
become: yes
41+
shell: "dpkg -s docker-ce | grep -i version | awk '{print $2}'"
42+
register: docker_version_after
43+
44+
- name: Stop dependent services
45+
become: yes
46+
systemd:
47+
name: "{{ item }}"
48+
state: stopped
49+
with_items: "{{ docker_dependent_services }}"
50+
51+
- name: Restart docker daemon
52+
become: yes
53+
systemd:
54+
name: docker
55+
state: restarted
56+
57+
- name: Bring dependent services back
58+
become: yes
59+
systemd:
60+
name: "{{ item }}"
61+
state: started
62+
with_items: "{{ docker_dependent_services }}"

0 commit comments

Comments
 (0)