diff options
Diffstat (limited to 'playbooks/roles/outbound/tasks/main.yml')
| -rw-r--r-- | playbooks/roles/outbound/tasks/main.yml | 160 |
1 files changed, 62 insertions, 98 deletions
diff --git a/playbooks/roles/outbound/tasks/main.yml b/playbooks/roles/outbound/tasks/main.yml index 107e71a..45540b4 100644 --- a/playbooks/roles/outbound/tasks/main.yml +++ b/playbooks/roles/outbound/tasks/main.yml @@ -1,119 +1,83 @@ --- -# Headscale setup -- name: Build headscale compose dirs and files - ansible.builtin.file: - state: directory - dest: '/etc/docker/compose/headscale/{{ item.path }}' - with_filetree: '../templates/headscale' - when: item.state == 'directory' - -- name: Build headscale compose templates - ansible.builtin.template: - src: '{{ item.src }}' - dest: '/etc/docker/compose/headscale/{{ item.path }}' - with_filetree: '../templates/headscale' - when: item.state == 'file' - -- name: Daemon-reload and enable headscale - ansible.builtin.systemd_service: +- name: Deploy Headscale + ansible.builtin.import_tasks: manage-docker-compose-service.yml + vars: + service_name: headscale + template_render_dir: "../templates/headscale" + service_destination_dir: "{{ headscale_base }}" state: started - enabled: true - daemon_reload: true - name: docker-compose@headscale - -- name: Perform rollout for headscale - ansible.builtin.shell: - cmd: "/usr/local/bin/docker-rollout rollout -f docker-compose.yml headscale" - chdir: "/etc/docker/compose/headscale" - -# User API Key -- name: Generate API key if homelab build - ansible.builtin.shell: - cmd: docker compose exec -it headscale headscale apikeys create --expiration "{{ api_key_expiration }}" - chdir: /etc/docker/compose/headscale - register: api_key_result - when: generate_api_key + rollout_services: + - name: headscale -- name: Store and display API key - when: generate_api_key +- name: Generate Headscale API key (if requested) + when: generate_api_key | default(false) block: - - name: Define API Key Variable - set_fact: - headscale_api_key: "{{ api_key_result.stdout }}" + - name: Execute API key generation command + ansible.builtin.command: + cmd: "docker compose exec headscale headscale apikeys create --expiration {{ api_key_expiration }}" + chdir: /etc/docker/compose/headscale + register: api_key_result + changed_when: true + + - name: Store and display newly generated API key + block: + - name: Store API Key in fact + ansible.builtin.set_fact: + headscale_api_key: "{{ api_key_result.stdout }}" - - name: Echo new key - ansible.builtin.debug: - msg: "Please store this API Key! {{ headscale_api_key }}" + - name: Display API Key (Requires User Action) + ansible.builtin.debug: + msg: "IMPORTANT: Please store this newly generated Headscale API Key! {{ headscale_api_key }}" - - name: Pause until user confirms - ansible.builtin.pause: - prompt: "Press return when ready!" + - name: Pause for user confirmation (API Key) + ansible.builtin.pause: + prompt: "API Key displayed. Press return to continue..." + when: api_key_result.rc == 0 # Only proceed if key generation succeeded -# System user auth key -- name: Create system key user and auth key if homelab build - when: generate_auth_key +- name: Create Headscale system user and auth key (if requested) + when: generate_auth_key | default(false) # Default to false if var is undefined block: - - name: Create system key user - ansible.builtin.shell: - cmd: docker compose exec -it headscale headscale users create "{{ auth_key_user }}" + # Note: These steps might not be fully idempotent. Re-running will attempt creation again. + - name: Create system key user '{{ auth_key_user }}' + ansible.builtin.command: # Using command module is safer + cmd: "docker compose exec headscale headscale users create {{ auth_key_user }}" chdir: /etc/docker/compose/headscale + register: user_create_result + changed_when: "'User created' in user_create_result.stdout" + failed_when: user_create_result.rc != 0 and 'Cannot create user' not in user_create_result.stderr - - name: Create auth key preauthkey - ansible.builtin.shell: - cmd: docker compose exec -it headscale headscale preauthkeys create --reusable --expiration "{{ auth_key_expiration }}" --user "{{ auth_key_user }}" + - name: Create auth key for user '{{ auth_key_user }}' + ansible.builtin.command: # Using command module is safer + cmd: "docker compose exec headscale headscale preauthkeys create --reusable --expiration {{ auth_key_expiration }} --user {{ auth_key_user }}" chdir: /etc/docker/compose/headscale register: auth_key_result + changed_when: true - - name: Store and display Auth Key + - name: Store and display newly generated Auth Key block: - - name: Define Auth Key Variable - set_fact: + # This stores the *newly generated* key. Be aware of Ansible variable precedence + # if 'headscale_user_auth_key' is also defined elsewhere (like vaults). + # This fact is primarily for immediate display and user interaction below. + - name: Store Auth Key in fact + ansible.builtin.set_fact: headscale_user_auth_key: "{{ auth_key_result.stdout }}" - - name: Echo new auth key + - name: Display Auth Key (Requires User Action) ansible.builtin.debug: - msg: "Please store this Auth Key for user {{ auth_key_user }}! {{ headscale_user_auth_key }}" + msg: "IMPORTANT: Please store this newly generated Auth Key for user '{{ auth_key_user }}'! {{ headscale_user_auth_key }}" - - name: Pause until user confirms + - name: Pause for user confirmation (Auth Key) ansible.builtin.pause: - prompt: "Press return when ready!" - -# Proxy setup (AFTER API key generation) -- name: Build proxy compose dirs and files - ansible.builtin.file: - state: directory - dest: '/etc/docker/compose/proxy/{{ item.path }}' - with_filetree: '../templates/proxy' - when: item.state == 'directory' - -- name: Build proxy compose templates - ansible.builtin.template: - src: '{{ item.src }}' - dest: '/etc/docker/compose/proxy/{{ item.path }}' - with_filetree: '../templates/proxy' - when: item.state == 'file' - -- name: Allow mail ports - with_items: - - "25" - - "587" - - "465" - - "993" - - "4190" - community.general.ufw: - rule: allow - port: "{{ item }}" - state: "enabled" - -- name: Daemon-reload and enable proxy - ansible.builtin.systemd_service: + prompt: "Auth Key displayed. Press return to continue..." + when: auth_key_result.rc == 0 + +- name: Deploy Open Internet -> Headnet Proxy + ansible.builtin.import_tasks: manage-docker-compose-service.yml + vars: + service_name: proxy + template_render_dir: "../templates/proxy" + service_destination_dir: "{{ proxy_base }}" state: started - enabled: true - daemon_reload: true - name: docker-compose@proxy - -- name: Perform rollout for proxy - ansible.builtin.shell: - cmd: "/usr/local/bin/docker-rollout rollout -f docker-compose.yml proxy" - chdir: "/etc/docker/compose/proxy" + rollout_services: + - name: "{{ vpn_proxy_filter_container_name }}" |