feat: added traefik and node_exporter
Sven Ketelsen
5 years ago
parent
7eefe6b28f
commit
c63d557861
@ -1,20 +1,30 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
36356561396566663330633733666665333231653532633630393364633161613966643163343361
|
||||
3063643237303932343339643464316363633334306431630a383632646263323365643835623932
|
||||
30316336663265366337623834393134363761313035343263386233626533316634663238323636
|
||||
3137353262353531370a613036643361346430656537636363666462363633306364316435373638
|
||||
37346661666330323763323164653264613138663239323136326666666133623061663134636136
|
||||
35343636316131646336636363326265646261336438623834656562613534616166306461666662
|
||||
61656638396136376331633639386638336563666264333062346633376566303136313037346438
|
||||
63353931633831616464343565393839323334313338663838336465663565633165633937306435
|
||||
35306338643039306137663437383563316465346532366361633864383661396461626433326133
|
||||
39626135666132613261353437613835633137656430663630333331636536376365666265633536
|
||||
31353032303930366131636434646132633137376262653439316632643535356538656265333734
|
||||
37346632386433326435646638326166653236633163663162633433353032373734643165313235
|
||||
30333635313766663531383830633864326230363836623465386262396165386365346438356333
|
||||
66346335346331393939386264633730383461663662343039303936653863346130343964613431
|
||||
32663037323833666633393238663835653138323336656336616639656436623961313064366438
|
||||
35363438616361653634303131653132393263303964373830336463393930353562363836343331
|
||||
35333331633336356166396630653834373030313333613666383335613032376163353562613530
|
||||
31633964336430366432633664356463333336376563383761343666663362633864656437356462
|
||||
396232323765356262626366343266316136
|
||||
37303936393666363130613561666665623364303361613938633232363532313830316231353935
|
||||
3335653838653863326334623161336336653435373664310a363561353430356166373766393836
|
||||
31303463343336613665326636643837633362636335343830396438363634656639376463353965
|
||||
6131343431653439340a363930643966386237323763613566393235303437376132393865323230
|
||||
63616136386133326131656565306233343831343030313935663764353330653231666533333238
|
||||
37343938363431333936613065613633396231306365346435623362653437326536663135333532
|
||||
38303838663865623737663866633839333835363864616330626335323338626331316263653233
|
||||
39343965666461653538303632636564336338313162663833623365396465336232366236383034
|
||||
61393839616164386565373930623338323130626330316565383338623634663338366233613963
|
||||
32306431383136346263633364626265363737353363396131313461656139393239306537343435
|
||||
34643830373965303339373831393465366565663936663061663434633131303033333436346566
|
||||
31376330613939356534613534313335653464616436393137396165326262636538656137326532
|
||||
63396138383364646339353539363230306461373732333037663862306161333966313462356363
|
||||
36656639346238313839623232373738376530633361373565353063323065626634306532626539
|
||||
37393038633761396539353233666563316535323965363233656134393365356339626565656134
|
||||
63323864653566646531393830396337353139653831343866303039313631613334313431643161
|
||||
39383264646566636538626433333937333230383564316437353464613862316532343564316530
|
||||
64623935383037326563613533313361333435326166343339616461386437356238376263356334
|
||||
33373166613033626130333962366464663262393134623838633937653837653332393061626637
|
||||
66653730396436313339616562626230363231303136333235663534626266613831646631633530
|
||||
39356263346231373463373761626430376431633135353939656664613632633965323838633362
|
||||
65633335643866633530346236653435343565663936376266663862363130303032323436646133
|
||||
66643833653363323935353636343430346561346262383436663838636536386638356438663430
|
||||
65363262396339323530303663333730313836346565623430633232366138376261393831643137
|
||||
37373734333538313566306631373233353364656438323435373265306531396534656265633532
|
||||
31643831353931393139663861346234333233353566333435373338393166376333343235303034
|
||||
37376565643162303531396566313531643933376663343663636230376338666565323263666539
|
||||
65373832373931393265333432313232633536646331633833613561366532363239326538333565
|
||||
3134
|
||||
|
||||
@ -0,0 +1 @@
|
||||
---
|
||||
@ -0,0 +1 @@
|
||||
---
|
||||
@ -0,0 +1 @@
|
||||
---
|
||||
@ -0,0 +1,39 @@
|
||||
---
|
||||
|
||||
- name: 'Insert/Update caddy configuration in {{ caddy_config_file_path_full }}'
|
||||
blockinfile:
|
||||
marker: '# {mark} managed by ansible (reverse proxy config for {{ current_service }})'
|
||||
path: '{{ caddy_config_file_path_full }}'
|
||||
state: "{{ 'present' if reverse_proxy == 'caddy' else 'absent' }}"
|
||||
create: yes
|
||||
block: |
|
||||
{% for service in current_services %}
|
||||
{{ http_s }}://{{ service.external }} {
|
||||
proxy / {{ service.internal }} {
|
||||
transparent
|
||||
}
|
||||
tls {{ caddy_tls }}
|
||||
{% if service.basicauth is defined %}
|
||||
basicauth {{ service.basicauth }}
|
||||
{% endif %}
|
||||
}
|
||||
{% endfor %}
|
||||
tags:
|
||||
- update_deployment
|
||||
|
||||
- name: "Stop caddy"
|
||||
shell: docker-compose down
|
||||
args:
|
||||
chdir: '{{ service_base_path }}/caddy'
|
||||
ignore_errors: yes
|
||||
when: reverse_proxy == 'caddy'
|
||||
tags:
|
||||
- update_deployment
|
||||
|
||||
- name: "Start caddy"
|
||||
shell: docker-compose up -d
|
||||
args:
|
||||
chdir: '{{ service_base_path }}/caddy'
|
||||
when: reverse_proxy == 'caddy'
|
||||
tags:
|
||||
- update_deployment
|
||||
@ -0,0 +1,55 @@
|
||||
---
|
||||
|
||||
- name: "Check if landing page service table exists"
|
||||
stat:
|
||||
path: "{{ caddy_landing_page_service_table_file_path_full }}"
|
||||
register: check_caddy_landing_page_service_table_file
|
||||
tags:
|
||||
- update_deployment
|
||||
|
||||
- name: "Read landing page service table data"
|
||||
slurp:
|
||||
src: "{{ caddy_landing_page_service_table_file_path_full }}"
|
||||
register: landing_page_service_table_plain
|
||||
when: check_caddy_landing_page_service_table_file.stat.exists
|
||||
tags:
|
||||
- update_deployment
|
||||
|
||||
- name: "Set landing page service table as variable"
|
||||
set_fact:
|
||||
landing_page_service_table: "{{ landing_page_service_table_plain['content'] | b64decode }}"
|
||||
when: check_caddy_landing_page_service_table_file.stat.exists
|
||||
tags:
|
||||
- update_deployment
|
||||
|
||||
- name: "Read landing page service table data"
|
||||
set_fact:
|
||||
landing_page_service_table: []
|
||||
when: not check_caddy_landing_page_service_table_file.stat.exists
|
||||
tags:
|
||||
- update_deployment
|
||||
|
||||
- name: "Update landing page service table variable"
|
||||
set_fact:
|
||||
landing_page_service_table: "{{ ([item] + landing_page_service_table) | unique(attribute='current_name') }}"
|
||||
with_items: "{{ current_services }}"
|
||||
tags:
|
||||
- update_deployment
|
||||
|
||||
- name: 'Ensures {{ caddy_landing_page_service_table_folder_path_full }} directory exists'
|
||||
file:
|
||||
state: directory
|
||||
path: '{{ caddy_landing_page_service_table_folder_path_full }}'
|
||||
tags:
|
||||
- update_deployment
|
||||
- update_config
|
||||
|
||||
- name: "Write landing page service table"
|
||||
copy:
|
||||
content: "{{ landing_page_service_table | to_nice_json }}"
|
||||
dest: "{{ caddy_landing_page_service_table_file_path_full }}"
|
||||
owner: "{{ docker_owner }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: 0644
|
||||
tags:
|
||||
- update_deployment
|
||||
@ -0,0 +1,58 @@
|
||||
---
|
||||
|
||||
- name: 'Ensures {{ current_base_path }}/{{ current_destination }} directory exists'
|
||||
file:
|
||||
state: directory
|
||||
path: '{{ current_base_path }}/{{ current_destination }}'
|
||||
tags:
|
||||
- update_deployment
|
||||
- update_config
|
||||
|
||||
- name: 'Ensure directory structure for {{ current_config }} exists'
|
||||
file:
|
||||
path: "{{ current_base_path }}/{{ current_destination }}/{{ item.path }}"
|
||||
state: directory
|
||||
owner: "{{ current_owner }}"
|
||||
group: "{{ current_group }}"
|
||||
mode: 0755
|
||||
with_filetree: "templates/{{ current_config }}"
|
||||
when: item.state == "directory"
|
||||
tags:
|
||||
- update_config
|
||||
|
||||
- name: Ensure docker files are populated from templates
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ current_base_path }}/{{ current_destination }}/{{ item.path | regex_replace('\\.j2$', '') }}"
|
||||
owner: "{{ current_owner }}"
|
||||
group: "{{ current_group }}"
|
||||
mode: 0644
|
||||
with_filetree: "templates/_docker"
|
||||
when: item.state == 'file' and item.src is match('.*\.j2$')
|
||||
tags:
|
||||
- update_deployment
|
||||
- update_config
|
||||
|
||||
- name: Ensure config template files are populated from templates
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ current_base_path }}/{{ current_destination }}/{{ item.path | regex_replace('\\.j2$', '') }}"
|
||||
owner: "{{ current_owner }}"
|
||||
group: "{{ current_group }}"
|
||||
mode: 0644
|
||||
with_filetree: "templates/{{ current_config }}"
|
||||
when: item.state == 'file' and item.src is match('.*\.j2$')
|
||||
tags:
|
||||
- update_config
|
||||
|
||||
- name: Ensure config files are populated from templates
|
||||
copy:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ current_base_path }}/{{ current_destination }}/{{ item.path }}"
|
||||
owner: "{{ current_owner }}"
|
||||
group: "{{ current_group }}"
|
||||
mode: 0644
|
||||
with_filetree: "templates/{{ current_config }}"
|
||||
when: item.state == 'file' and item.src is not match('.*\.j2$')
|
||||
tags:
|
||||
- update_config
|
||||
@ -0,0 +1 @@
|
||||
---
|
||||
@ -0,0 +1 @@
|
||||
---
|
||||
@ -0,0 +1 @@
|
||||
---
|
||||
@ -0,0 +1 @@
|
||||
---
|
||||
@ -0,0 +1,14 @@
|
||||
---
|
||||
|
||||
- name: "Register variable for docker networks"
|
||||
shell: docker network ls
|
||||
register: docker_networks
|
||||
|
||||
- name: "Docker network create back-tier"
|
||||
shell: docker network create back-tier
|
||||
when: docker_networks.stdout.find("back-tier") == -1
|
||||
|
||||
- name: "Docker network create front-tier"
|
||||
shell: docker network create front-tier
|
||||
when: docker_networks.stdout.find("front-tier") == -1
|
||||
|
||||
@ -0,0 +1,2 @@
|
||||
---
|
||||
|
||||
@ -0,0 +1,123 @@
|
||||
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
|
||||
|
||||
# This is the sshd server system-wide configuration file. See
|
||||
# sshd_config(5) for more information.
|
||||
|
||||
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
|
||||
|
||||
# The strategy used for options in the default sshd_config shipped with
|
||||
# OpenSSH is to specify options with their default value where
|
||||
# possible, but leave them commented. Uncommented options override the
|
||||
# default value.
|
||||
|
||||
Include /etc/ssh/sshd_config.d/*.conf
|
||||
|
||||
#Port 22
|
||||
#AddressFamily any
|
||||
ListenAddress 5.9.148.23
|
||||
ListenAddress 212.121.131.106
|
||||
|
||||
#HostKey /etc/ssh/ssh_host_rsa_key
|
||||
#HostKey /etc/ssh/ssh_host_ecdsa_key
|
||||
#HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# Ciphers and keying
|
||||
#RekeyLimit default none
|
||||
|
||||
# Logging
|
||||
#SyslogFacility AUTH
|
||||
#LogLevel INFO
|
||||
|
||||
# Authentication:
|
||||
|
||||
#LoginGraceTime 2m
|
||||
PermitRootLogin yes
|
||||
#StrictModes yes
|
||||
#MaxAuthTries 6
|
||||
#MaxSessions 10
|
||||
|
||||
#PubkeyAuthentication yes
|
||||
|
||||
# Expect .ssh/authorized_keys2 to be disregarded by default in future.
|
||||
#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2
|
||||
|
||||
#AuthorizedPrincipalsFile none
|
||||
|
||||
#AuthorizedKeysCommand none
|
||||
#AuthorizedKeysCommandUser nobody
|
||||
|
||||
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
|
||||
#HostbasedAuthentication no
|
||||
# Change to yes if you don't trust ~/.ssh/known_hosts for
|
||||
# HostbasedAuthentication
|
||||
#IgnoreUserKnownHosts no
|
||||
# Don't read the user's ~/.rhosts and ~/.shosts files
|
||||
#IgnoreRhosts yes
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
PasswordAuthentication no
|
||||
#PermitEmptyPasswords no
|
||||
|
||||
# Change to yes to enable challenge-response passwords (beware issues with
|
||||
# some PAM modules and threads)
|
||||
ChallengeResponseAuthentication no
|
||||
|
||||
# Kerberos options
|
||||
#KerberosAuthentication no
|
||||
#KerberosOrLocalPasswd yes
|
||||
#KerberosTicketCleanup yes
|
||||
#KerberosGetAFSToken no
|
||||
|
||||
# GSSAPI options
|
||||
#GSSAPIAuthentication no
|
||||
#GSSAPICleanupCredentials yes
|
||||
#GSSAPIStrictAcceptorCheck yes
|
||||
#GSSAPIKeyExchange no
|
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the ChallengeResponseAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
||||
# the setting of "PermitRootLogin yes
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and ChallengeResponseAuthentication to 'no'.
|
||||
UsePAM yes
|
||||
|
||||
#AllowAgentForwarding yes
|
||||
#AllowTcpForwarding yes
|
||||
#GatewayPorts no
|
||||
X11Forwarding yes
|
||||
#X11DisplayOffset 10
|
||||
#X11UseLocalhost yes
|
||||
#PermitTTY yes
|
||||
PrintMotd no
|
||||
#PrintLastLog yes
|
||||
#TCPKeepAlive yes
|
||||
#PermitUserEnvironment no
|
||||
#Compression delayed
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
#UseDNS no
|
||||
#PidFile /var/run/sshd.pid
|
||||
#MaxStartups 10:30:100
|
||||
#PermitTunnel no
|
||||
#ChrootDirectory none
|
||||
#VersionAddendum none
|
||||
|
||||
# no default banner path
|
||||
#Banner none
|
||||
|
||||
# Allow client to pass locale environment variables
|
||||
AcceptEnv LANG LC_*
|
||||
|
||||
# override default of no subsystems
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
|
||||
# Example of overriding settings on a per-user basis
|
||||
#Match User anoncvs
|
||||
# X11Forwarding no
|
||||
# AllowTcpForwarding no
|
||||
# PermitTTY no
|
||||
# ForceCommand cvs server
|
||||
@ -0,0 +1,68 @@
|
||||
---
|
||||
|
||||
node_exporter_id: "{{ service_name }}-node-exporter"
|
||||
|
||||
node_exporter_image_name: "prom/node-exporter"
|
||||
node_exporter_image_version: "v1.1.2"
|
||||
|
||||
node_exporter_docker: {
|
||||
networks: [
|
||||
{
|
||||
name: front-tier,
|
||||
external: true,
|
||||
},
|
||||
],
|
||||
services: [
|
||||
{
|
||||
name: "{{ node_exporter_id }}",
|
||||
image_name: "{{ node_exporter_image_name }}",
|
||||
image_version: "{{ node_exporter_image_version }}",
|
||||
command: [
|
||||
'"--path.procfs=/host/proc"',
|
||||
'"--path.sysfs=/host/sys"',
|
||||
'"--no-collector.systemd"',
|
||||
'"--no-collector.logind"',
|
||||
'"--no-collector.ntp"',
|
||||
'"--no-collector.bonding"',
|
||||
'"--no-collector.bcache"',
|
||||
'"--no-collector.arp"',
|
||||
'"--no-collector.edac"',
|
||||
'"--no-collector.infiniband"',
|
||||
'"--no-collector.ipvs"',
|
||||
'"--no-collector.mdadm"',
|
||||
'"--no-collector.nfs"',
|
||||
'"--no-collector.nfsd"',
|
||||
'"--no-collector.wifi"',
|
||||
'"--no-collector.hwmon"',
|
||||
'"--no-collector.conntrack"',
|
||||
'"--no-collector.timex"',
|
||||
'"--no-collector.zfs"',
|
||||
'"--collector.tcpstat"',
|
||||
'"--collector.interrupts"',
|
||||
'"--collector.meminfo_numa"',
|
||||
'"--collector.processes"',
|
||||
'"--collector.textfile"',
|
||||
'"--collector.textfile.directory=/rootfs/textfiles"',
|
||||
'"--collector.filesystem.ignored-mount-points"',
|
||||
'"^/(sys|proc|dev|host|etc|run|run/lock|boot|var/lib/docker|run/docker/netns|var/lib/docker/aufs)($$|/)"',
|
||||
],
|
||||
labels: [
|
||||
'"traefik.enable=true"',
|
||||
'"traefik.http.routers.{{ node_exporter_id }}.service={{ node_exporter_id }}"',
|
||||
'"traefik.http.routers.{{ node_exporter_id }}.rule=Host(`{{ service_url }}`)"',
|
||||
'"traefik.http.routers.{{ node_exporter_id }}.entrypoints=admin-system"',
|
||||
'"traefik.http.routers.{{ node_exporter_id }}.tls=true"',
|
||||
'"traefik.http.routers.{{ node_exporter_id }}.tls.certresolver=letsencrypt"',
|
||||
'"traefik.http.services.{{ node_exporter_id }}.loadbalancer.server.port={{ service_port_node_exporter }}"',
|
||||
],
|
||||
volumes: [
|
||||
'"/proc:/host/proc:ro"',
|
||||
'"/sys:/host/sys:ro"',
|
||||
'"/:/rootfs:ro"',
|
||||
],
|
||||
networks: [
|
||||
'"front-tier"'
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -0,0 +1 @@
|
||||
---
|
||||
@ -0,0 +1 @@
|
||||
---
|
||||
@ -0,0 +1,61 @@
|
||||
---
|
||||
|
||||
- name: "Send mattermost messsge"
|
||||
uri:
|
||||
url: "{{ mattermost_hook_smardigo }}"
|
||||
method: POST
|
||||
body: "{{ lookup('template','mattermost-deploy-start.json.j2') }}"
|
||||
body_format: json
|
||||
headers:
|
||||
Content-Type: "application/json"
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
when:
|
||||
- send_status_messages
|
||||
|
||||
- name: "Check docker networks"
|
||||
include_role:
|
||||
name: _docker
|
||||
tasks_from: networks
|
||||
|
||||
- name: "Check if node-exporter/docker-compose.yml exists"
|
||||
stat:
|
||||
path: '{{ service_base_path }}/node-exporter/docker-compose.yml'
|
||||
register: check_docker_compose_file
|
||||
|
||||
- name: "Stop node-exporter"
|
||||
shell: docker-compose down
|
||||
args:
|
||||
chdir: '{{ service_base_path }}/node-exporter'
|
||||
when: check_docker_compose_file.stat.exists
|
||||
ignore_errors: yes
|
||||
|
||||
- name: "Deploy service configuration for node-exporter"
|
||||
include_role:
|
||||
name: _deploy
|
||||
tasks_from: configs
|
||||
vars:
|
||||
current_config: "node-exporter"
|
||||
current_base_path: "{{ service_base_path }}"
|
||||
current_destination: "node-exporter"
|
||||
current_owner: "{{ docker_owner }}"
|
||||
current_group: "{{ docker_group }}"
|
||||
current_docker: "{{ node_exporter_docker }}"
|
||||
|
||||
- name: "Start node-exporter"
|
||||
shell: docker-compose up -d
|
||||
args:
|
||||
chdir: '{{ service_base_path }}/node-exporter'
|
||||
|
||||
- name: "Send mattermost messsge"
|
||||
uri:
|
||||
url: "{{ mattermost_hook_smardigo }}"
|
||||
method: POST
|
||||
body: "{{ lookup('template','mattermost-deploy-end.json.j2') }}"
|
||||
body_format: json
|
||||
headers:
|
||||
Content-Type: "application/json"
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
when:
|
||||
- send_status_messages
|
||||
@ -0,0 +1 @@
|
||||
---
|
||||
@ -0,0 +1,77 @@
|
||||
---
|
||||
|
||||
traefik_id: "{{ service_name }}-traefik"
|
||||
|
||||
traefik_image_name: "traefik"
|
||||
traefik_image_version: "v2.4"
|
||||
|
||||
caddy_docker: {
|
||||
networks: [
|
||||
{
|
||||
name: front-tier,
|
||||
external: 'true',
|
||||
},
|
||||
],
|
||||
services: [
|
||||
{
|
||||
name: "{{ traefik_id }}",
|
||||
image_name: "{{ traefik_image_name }}",
|
||||
image_version: "{{ traefik_image_version }}",
|
||||
environment: [
|
||||
'DO_AUTH_TOKEN: "{{ digitalocean_authentication_token }}"',
|
||||
],
|
||||
volumes: [
|
||||
'"./acme.json:/acme.json"',
|
||||
'"./traefik.toml:/traefik.toml:ro"',
|
||||
'"./traefik_dynamic.toml:/traefik_dynamic.toml:ro"',
|
||||
'"/var/run/docker.sock:/var/run/docker.sock:ro"',
|
||||
'"./config/static_files:/var/www/static_files:ro"',
|
||||
],
|
||||
networks: [
|
||||
'"front-tier"'
|
||||
],
|
||||
ports: [
|
||||
{
|
||||
external: "0.0.0.0:{{ http_port }}",
|
||||
internal: "{{ http_port }}"
|
||||
},
|
||||
{
|
||||
external: "0.0.0.0:{{ https_port }}",
|
||||
internal: "{{ https_port }}"
|
||||
},
|
||||
{
|
||||
external: "0.0.0.0:{{ service_port_portainer }}",
|
||||
internal: "{{ service_port_portainer }}"
|
||||
},
|
||||
{
|
||||
external: "0.0.0.0:{{ service_port_pgadmin }}",
|
||||
internal: "{{ service_port_pgadmin }}"
|
||||
},
|
||||
{
|
||||
external: "0.0.0.0:{{ service_port_phpmyadmin }}",
|
||||
internal: "{{ service_port_phpmyadmin }}"
|
||||
},
|
||||
{
|
||||
external: "0.0.0.0:{{ admin_port_traefik }}",
|
||||
internal: "{{ admin_port_traefik }}"
|
||||
},
|
||||
{
|
||||
external: "0.0.0.0:{{ monitor_port_service }}",
|
||||
internal: "{{ monitor_port_service }}"
|
||||
},
|
||||
{
|
||||
external: "0.0.0.0:{{ monitor_port_system }}",
|
||||
internal: "{{ monitor_port_system }}"
|
||||
},
|
||||
{
|
||||
external: "0.0.0.0:{{ monitor_port_docker }}",
|
||||
internal: "{{ monitor_port_docker }}"
|
||||
},
|
||||
],
|
||||
dns: [
|
||||
'"8.8.8.8"',
|
||||
'"8.8.8.4"',
|
||||
],
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -0,0 +1 @@
|
||||
---
|
||||
@ -0,0 +1 @@
|
||||
---
|
||||
@ -0,0 +1,91 @@
|
||||
---
|
||||
|
||||
- name: "Send mattermost messsge"
|
||||
uri:
|
||||
url: "{{ mattermost_hook_smardigo }}"
|
||||
method: POST
|
||||
body: "{{ lookup('template','mattermost-deploy-start.json.j2') }}"
|
||||
body_format: json
|
||||
headers:
|
||||
Content-Type: "application/json"
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
when:
|
||||
- send_status_messages
|
||||
|
||||
- name: "Check docker networks"
|
||||
include_role:
|
||||
name: _docker
|
||||
tasks_from: networks
|
||||
|
||||
- name: "Check if traefik/docker-compose.yml exists"
|
||||
stat:
|
||||
path: '{{ service_base_path }}/traefik/docker-compose.yml'
|
||||
register: check_docker_compose_file
|
||||
|
||||
- name: "Stop traefik"
|
||||
shell: docker-compose down
|
||||
args:
|
||||
chdir: '{{ service_base_path }}/traefik'
|
||||
when: check_docker_compose_file.stat.exists
|
||||
ignore_errors: yes
|
||||
|
||||
- name: "Deploy service configuration for traefik"
|
||||
include_role:
|
||||
name: _deploy
|
||||
tasks_from: configs
|
||||
vars:
|
||||
current_config: "traefik"
|
||||
current_base_path: "{{ service_base_path }}"
|
||||
current_destination: "traefik"
|
||||
current_owner: "{{ docker_owner }}"
|
||||
current_group: "{{ docker_group }}"
|
||||
current_docker: "{{ caddy_docker }}"
|
||||
|
||||
- name: "Ensure acme.json exists"
|
||||
copy:
|
||||
content: ""
|
||||
dest: '{{ service_base_path }}/traefik/acme.json'
|
||||
force: no
|
||||
owner: "{{ docker_owner }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: '0600'
|
||||
|
||||
- name: "Update landing page"
|
||||
include_role:
|
||||
name: _deploy
|
||||
tasks_from: caddy_landing_page
|
||||
vars:
|
||||
current_services: []
|
||||
|
||||
- name: "Update landing page for traefik"
|
||||
include_role:
|
||||
name: _deploy
|
||||
tasks_from: caddy_landing_page
|
||||
vars:
|
||||
current_services: [
|
||||
{
|
||||
current_name: "traefik",
|
||||
current_url: "{{ http_s }}://{{ stage_server_url_host }}:{{ admin_port_traefik }}",
|
||||
current_version: "{{ traefik_image_version }}",
|
||||
current_date: "{{ ansible_date_time.iso8601 }}",
|
||||
},
|
||||
]
|
||||
|
||||
- name: "Start traefik"
|
||||
shell: docker-compose up -d
|
||||
args:
|
||||
chdir: '{{ service_base_path }}/traefik'
|
||||
|
||||
- name: "Send mattermost messsge"
|
||||
uri:
|
||||
url: "{{ mattermost_hook_smardigo }}"
|
||||
method: POST
|
||||
body: "{{ lookup('template','mattermost-deploy-end.json.j2') }}"
|
||||
body_format: json
|
||||
headers:
|
||||
Content-Type: "application/json"
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
when:
|
||||
- send_status_messages
|
||||
@ -0,0 +1 @@
|
||||
---
|
||||
@ -0,0 +1,115 @@
|
||||
[log]
|
||||
# level = "DEBUG"
|
||||
format = "json"
|
||||
|
||||
[accessLog]
|
||||
format = "json"
|
||||
# [accessLog.filters]
|
||||
# statusCodes = ["200", "300-302"]
|
||||
# [accessLog.fields]
|
||||
# defaultMode = "keep"
|
||||
[accessLog.fields.names]
|
||||
"StartLocal" = "drop"
|
||||
# "ClientAddr" = "drop"
|
||||
# "ClientHost" = "drop"
|
||||
# "ClientPort" = "drop"
|
||||
"ClientUsername" = "drop"
|
||||
|
||||
[api]
|
||||
dashboard = true
|
||||
|
||||
[metrics]
|
||||
[metrics.prometheus]
|
||||
manualRouting = true
|
||||
addServicesLabels = true
|
||||
addEntryPointsLabels = true
|
||||
buckets = [0.1,0.3,1.2,5.0]
|
||||
entryPoint = "admin-service"
|
||||
|
||||
[entryPoints]
|
||||
### http -> https ###
|
||||
[entryPoints.web]
|
||||
address = ":{{ http_port }}"
|
||||
[entryPoints.web.http.redirections.entryPoint]
|
||||
to = "websecure"
|
||||
scheme = "https"
|
||||
|
||||
### production service port ###
|
||||
[entryPoints.websecure]
|
||||
address = ":{{ https_port }}"
|
||||
|
||||
### portainer as a service for the host ###
|
||||
[entryPoints.service-portainer ]
|
||||
address = ":{{ service_port_portainer }}"
|
||||
[entryPoints.service-portainer.http.redirections.entryPoint]
|
||||
to = "service-portainer"
|
||||
scheme = "https"
|
||||
|
||||
### postgres admin service for the host ###
|
||||
[entryPoints.admin-postgres]
|
||||
address = ":{{ service_port_pgadmin }}"
|
||||
[entryPoints.admin-postgres.http.redirections.entryPoint]
|
||||
to = "admin-postgres"
|
||||
scheme = "https"
|
||||
|
||||
### mysql admin service for the host ###
|
||||
[entryPoints.admin-mysql]
|
||||
address = ":{{ service_port_phpmyadmin }}"
|
||||
[entryPoints.admin-mysql.http.redirections.entryPoint]
|
||||
to = "admin-mysql"
|
||||
scheme = "https"
|
||||
|
||||
### traefik admin service for the host ###
|
||||
[entryPoints.admin-traefik]
|
||||
address = ":{{ admin_port_traefik }}"
|
||||
[entryPoints.admin-traefik.http.redirections.entryPoint]
|
||||
to = "admin-traefik"
|
||||
scheme = "https"
|
||||
|
||||
### system monitoring port - host metrics ###
|
||||
[entryPoints.admin-system]
|
||||
address = ":{{ monitor_port_system }}"
|
||||
[entryPoints.admin-system.http.redirections.entryPoint]
|
||||
to = "admin-system"
|
||||
scheme = "https"
|
||||
|
||||
### system monitoring port - docker metrics ###
|
||||
[entryPoints.admin-docker]
|
||||
address = ":{{ monitor_port_docker }}"
|
||||
[entryPoints.admin-docker.http.redirections.entryPoint]
|
||||
to = "admin-docker"
|
||||
scheme = "https"
|
||||
|
||||
### service monitoring port - metrics for all served services ###
|
||||
[entryPoints.admin-service]
|
||||
address = ":{{ monitor_port_service }}"
|
||||
[entryPoints.admin-service.http.redirections.entryPoint]
|
||||
to = "admin-service"
|
||||
scheme = "https"
|
||||
|
||||
[certificatesResolvers.letsencrypt.acme]
|
||||
email = "{{ lets_encrypt_email }}"
|
||||
storage = "acme.json"
|
||||
{% if letsencrypt_caserver_directory_url is defined %}
|
||||
caserver = "{{ letsencrypt_caserver_directory_url }}"
|
||||
{% endif %}
|
||||
[certificatesResolvers.letsencrypt.acme.dnsChallenge]
|
||||
provider = "digitalocean"
|
||||
resolvers = ["8.8.8.8:53"]
|
||||
|
||||
[certificatesResolvers.letsencrypt-http.acme]
|
||||
email = "{{ lets_encrypt_email }}"
|
||||
storage = "acme.json"
|
||||
{% if letsencrypt_caserver_directory_url is defined %}
|
||||
caserver = "{{ letsencrypt_caserver_directory_url }}"
|
||||
{% endif %}
|
||||
[certificatesResolvers.letsencrypt-http.acme.httpChallenge]
|
||||
entrypoint = "web"
|
||||
|
||||
[providers.docker]
|
||||
watch = true
|
||||
network = "front-tier"
|
||||
exposedByDefault = false
|
||||
|
||||
[providers.file]
|
||||
filename = "traefik_dynamic.toml"
|
||||
@ -0,0 +1,23 @@
|
||||
# secure admin resources with basic authentication
|
||||
[http.middlewares.traefik-auth.basicAuth]
|
||||
users = [
|
||||
"{{ reverse_proxy_admin_username }}:{{ reverse_proxy_admin_password }}"
|
||||
]
|
||||
|
||||
# admin api (dashboard, rest api, ...)
|
||||
[http.routers.api]
|
||||
rule = "Host(`{{ stage_server_name }}.{{ domain }}`)"
|
||||
entrypoints = ["admin-traefik"]
|
||||
middlewares = ["traefik-auth"]
|
||||
service = "api@internal"
|
||||
[http.routers.api.tls]
|
||||
certResolver = "letsencrypt"
|
||||
|
||||
# metrics api (prometheus)
|
||||
[http.routers.metrics]
|
||||
rule = "Host(`{{ stage_server_name }}.{{ domain }}`) && Path(`/metrics`)"
|
||||
entrypoints = ["admin-service"]
|
||||
middlewares = ["traefik-auth"]
|
||||
service = "prometheus@internal"
|
||||
[http.routers.metrics.tls]
|
||||
certResolver = "letsencrypt"
|
||||
Loading…
Reference in New Issue