infrastructure/playbooks/gitlab.archlinux.org.yml

- name: Setup gitlab server
  hosts: gitlab.archlinux.org
  remote_user: root
  roles:
    - { role: common }
    - { role: firewalld }
    - { role: wireguard }
    - { role: sshd }
    - { role: root_ssh }
    - { role: gitlab,
        gitlab_domain: "gitlab.archlinux.org",
        gitlab_primary_addresses: ['159.69.41.129', '[2a01:4f8:c2c:5d2d::1]', '127.0.0.1', '[::1]'],
        gitlab_pages_http_addresses: ['116.203.6.156:80', '[2a01:4f8:c2c:5d2d::2]:80'],
        gitlab_pages_https_addresses: ['116.203.6.156:443', '[2a01:4f8:c2c:5d2d::2]:443']}
    - { role: borg_client, tags: ["borg"] }
    - { role: prometheus_exporters }
    - { role: promtail }
    - { role: fail2ban }
Capitalize the first letter of all task names ansible-lint 6.5.0 complains about: name: All names should start with an uppercase letter. (name[casing]) 2022-08-23 04:49:23 +02:00			`- name: Setup gitlab server`
Add GitLab role 2019-08-11 00:16:40 +02:00			`hosts: gitlab.archlinux.org`
			`remote_user: root`
			`roles:`
			`- { role: common }`
			`- { role: firewalld }`
WireGuard all hosts This is meant as a internal authenticated and encrypted network which we can use for internal services, we don't want to expose to the internet or when encryption is desired but not easily implementable. 2021-07-06 19:47:22 +02:00			`- { role: wireguard }`
Add GitLab role 2019-08-11 00:16:40 +02:00			`- { role: sshd }`
			`- { role: root_ssh }`
Add a way to let us provide additional addresses to machines configured via DHCP 2020-12-13 01:50:20 +01:00			`- { role: gitlab,`
			`gitlab_domain: "gitlab.archlinux.org",`
gitlab: Fix address binding GitLab becomes unhappy if it can't poll localhost. 2021-01-23 22:05:53 +01:00			`gitlab_primary_addresses: ['159.69.41.129', '[2a01:4f8:c2c:5d2d::1]', '127.0.0.1', '[::1]'],`
Add a way to let us provide additional addresses to machines configured via DHCP 2020-12-13 01:50:20 +01:00			`gitlab_pages_http_addresses: ['116.203.6.156:80', '[2a01:4f8:c2c:5d2d::2]:80'],`
Make ansible-lint happy yaml: truthy value should be one of [false, true] (truthy) yaml: wrong indentation: expected 4 but found 2 (indentation) yaml: too few spaces before comment (comments) yaml: missing starting space in comment (comments) yaml: too many blank lines (1 > 0) (empty-lines) yaml: too many spaces after colon (colons) yaml: comment not indented like content (comments-indentation) yaml: no new line character at the end of file (new-line-at-end-of-file) load-failure: Failed to load or parse file parser-error: couldn't resolve module/action 'hosts'. This often indicates a misspelling, missing collection, or incorrect module path. 2021-02-14 14:05:32 +01:00			`gitlab_pages_https_addresses: ['116.203.6.156:443', '[2a01:4f8:c2c:5d2d::2]:443']}`
fix E106 'Role name <role> does not match ``^[a-z][a-z0-9_]+$`` pattern' 2020-08-18 19:15:22 +02:00			`- { role: borg_client, tags: ["borg"] }`
Introduce prometheus exporters role for collection Add a new role called prometheus_exporters which should be run on every machine we have and starts different collectors depending on what group the machine is in. Currently supported our the gitlab runner exporter, rebuilder textcollector, mysqld-exporter, borg textcollector and an node/arch exporter. The arch exporter monitors the security status and pacman out of date packages gauge. 2020-08-31 18:18:53 +02:00			`- { role: prometheus_exporters }`
Implement centralized logging Fix #263 2021-02-26 22:14:05 +01:00			`- { role: promtail }`
By default enable the sshd jail for fail2ban For all hosts we want to have a working fail2ban for sshd brute force attempts through a group_vars/all. For some hosts an override is required to enable postfix or dovecot jails. 2020-10-16 14:06:23 +02:00			`- { role: fail2ban }`