update(vaultwarden): bump version to 1.37.4

login failure

README.md

@@ -40,6 +40,17 @@ concise area of concern.
 - [`vouch_proxy`](roles/vouch_proxy/README.md): Deploys [vouch-proxy](https://github.com/vouch/vouch-proxy),
   an authorization proxy for arbitrary webapps working with `nginx`s' `auth_request` module.
 
+## Playbooks
+
+- [`authelia`](playbooks/authelia.md)
+- [`hedgedoc`](playbooks/hedgedoc.md)
+- [`jellyfin`](playbooks/jellyfin.md)
+- [`keycloak`](playbooks/keycloak.md)
+- [`gitea`](playbooks/gitea.md)
+- [`phpldapadmin`](playbooks/phpldapadmin.md)
+- [`snipe_it`](playbooks/snipe_it.md)
+- [`vaultwarden`](playbooks/vaultwarden.md)
+
 ## License
 
 [CNPLv7+](LICENSE.md): Cooperative Nonviolent Public License

galaxy.yml

@@ -1,15 +1,16 @@
 namespace: finallycoffee
 name: services
-version: "0.2.1"
+version: "0.2.2"
 readme: README.md
 authors:
 - transcaffeine <transcaffeine@finally.coffee>
 description: Various ansible roles useful for automating infrastructure
 dependencies:
-  "community.general": "^11.0.0"
-  "community.crypto": "^3.0.3"
-  "community.docker": "^4.7.0"
-  "containers.podman": "^1.16.0"
+  "community.general": ">=11.0.0"
+  "community.crypto": ">=3.0.3"
+  "community.docker": ">=4.7.0"
+  "containers.podman": ">=1.16.0"
+  "finallycoffee.base": ">=0.3.0"
 license_file: LICENSE.md
 build_ignore:
 - '*.tar.gz'
@@ -25,3 +26,4 @@ tags:
   - docker
   - phpldapadmin
   - pretix
+  - keycloak

playbooks/anubis.yml

@@ -0,0 +1,7 @@
+---
+- name: Ensure anubis is installed and configured
+  hosts: "{{ anubis_hosts | default('anubis') }}"
+  gather_facts: "{{ anubis_gather_facts | default(false) }}"
+  become: "{{ anubis_become | default(false) }}"
+  roles:
+    - role: finallycoffee.services.anubis

playbooks/authelia.md

@@ -0,0 +1,7 @@
+# `finallycoffee.services.authelia` ansible playbook
+
+## Feature toggles
+
+- `authelia_configure_postgesql_client` (default `false`)
+- `authelia_configure_lego_rfc2136` (default `false`)
+- `authelia_configure_caddy_reverse_proxy` (default `false`)

playbooks/authelia.yml

@@ -0,0 +1,118 @@
+---
+- import_playbook: finallycoffee.databases.postgresql_client
+  when: authelia_configure_postgresql_client | default(false)
+  vars:
+    postgresql_hosts: >-2
+      {{ authelia_postgresql_hosts | default(authelia_hosts | default('authelia')) }}
+    postgresql_become: >-2
+      {{ authelia_postgresql_become | default(authelia_become | default(false)) }}
+    postgresql_client_username: "{{ authelia_database_user }}"
+    postgresql_client_password: "{{ authelia_database_pass }}"
+    postgresql_client_database: "{{ authelia_database_name }}"
+    postgresql_client_database_lc_ctype: 'C'
+    postgresql_client_database_lc_collate: 'C'
+  tags:
+    - authelia
+    - authelia-postgresql-client
+    - postgresql-client
+
+- import_playbook: finallycoffee.base.lego_certificate
+  when: authelia_configure_lego_rfc2136 | default(false)
+  vars:
+    target_domains:
+      - "{{ authelia_domain }}"
+    target_acme_zone: "{{ acme_domain }}"
+    target_acme_account_email: "{{ authelia_lego_acme_account_email }}"
+    target_dns_server: "{{ dns_server }}"
+    target_dns_tsig_key: "{{ dns_tsig_keydata }}"
+    target_dns_additional_records: "{{ authelia_dns_records }}"
+    target_hosts: >-2
+      {{ authelia_lego_hosts | default(authelia_hosts | default('authelia')) }}
+    target_become: >-2
+      {{ authelia_lego_become | default(authelia_become | default(false)) }}
+    target_gather_facts: >-2
+      {{ authelia_lego_gather_facts | default(false) }}
+  tags:
+    - authelia
+    - authelia-lego
+    - lego
+
+- name: Install and configure authelia
+  hosts: "{{ authelia_hosts | default('authelia') }}"
+  become: "{{ authelia_become | default(false) }}"
+  gather_facts: "{{ authelia_gather_facts | default(false) }}"
+  pre_tasks:
+    - name: Ensure valkey user exists
+      ansible.builtin.user:
+        name: "{{ valkey_user }}"
+        state: present
+        system: true
+        create_home: false
+      register: valkey_user_info
+      when: valkey_state == 'present'
+      tags:
+        - authelia
+        - authelia-valkey
+    - name: Create host folder for valkey unix socket
+      ansible.builtin.file:
+        path: "{{ authelia_redis_unix_socket }}"
+        state: directory
+        mode: "0755"
+        owner: "{{ valkey_user_info.uid | default(valkey_user) }}"
+        group: "{{ valkey_user_info.group | default(valkey_user) }}"
+      when: valkey_state == 'present'
+      tags:
+        - authelia
+        - authelia-valkey
+        - valkey
+  roles:
+    - name: finallycoffee.databases.valkey
+      vars:
+        valkey_secret: "{{ authelia_redis_pass }}"
+        valkey_config_user:
+          - "default on +@all -DEBUG ~* >{{ valkey_secret }}"
+        valkey_config_unixsocketperm: 666
+        valkey_container_networks: []
+        valkey_container_purge_networks: true
+        valkey_container_volumes:
+          - "{{ authelia_redis_unix_socket }}:{{ authelia_redis_unix_socket }}"
+        valkey_container_image_registry: "{{ nexus_docker_hub_domain }}"
+      tags:
+        - authelia
+        - authelia-valkey
+    - name: finallycoffee.services.authelia
+      vars:
+        authelia_redis_host: "{{ valkey_config_unixsocket }}"
+        authelia_redis_port: ~
+        authelia_container_extra_volumes:
+          - "{{ authelia_redis_unix_socket }}:{{ authelia_redis_unix_socket }}"
+          - "{{ authelia_postgres_unix_socket }}:{{ authelia_postgres_unix_socket }}"
+        authelia_container_ports:
+          - "{{ authelia_host_bind_ip }}:{{ authelia_container_listen_port }}"
+      tags:
+        - authelia
+  vars:
+    valkey_instance: >-2
+      {{ authelia_instance_name | default('authelia') }}
+    authelia_redis_unix_socket: >-2
+      {{ authelia_redis_unix_socket_path
+        | default('/var/run/redis-' + valkey_instance + '-socket', true) }}
+    valkey_config_unixsocket: >-2
+      {{ authelia_valkey_config_unixsocket
+        | default(authelia_redis_unix_socket + '/redis.sock') }}
+
+- import_playbook: finallycoffee.base.caddy_reverse_proxy
+  when: authelia_configure_caddy_reverse_proxy | default(false)
+  vars:
+    caddy_site_name: "{{ authelia_domain }}"
+    caddy_reverse_proxy_backend_addr: "http://{{ authelia_host_bind_ip }}"
+    target_hosts: >-2
+      {{ authelia_caddy_hosts | default(authelia_hosts | default('authelia')) }}
+    target_become: >-2
+      {{ authelia_caddy_become | default(authelia_become | default(false)) }}
+    target_gather_facts: >-2
+      {{ authelia_caddy_gather_facts | default(false) }}
+  tags:
+    - authelia
+    - authelia-caddy
+    - caddy

playbooks/gitea.md

@@ -0,0 +1,7 @@
+# `finallycoffee.services.gitea` ansible playbook
+
+## Feature toggles
+
+- `gitea_configure_postgesql_client` (default `true`)
+- `gitea_configure_lego_rfc2136` (default `true`)
+- `gitea_configure_caddy_reverse_proxy` (default `false`)

playbooks/gitea.yml

@@ -0,0 +1,74 @@
+---
+- import_playbook: finallycoffee.databases.postgresql_client
+  when: gitea_configure_postgresql_client | default(true) | bool
+  vars:
+    postgresql_become: "{{ gitea_postgresql_client_become | default(true) }}"
+    postgresql_hosts: >-2
+      {{ gitea_postgresql_hosts | default(gitea_hosts | default('gitea')) }}
+    postgresql_client_username: "{{ gitea_database_user }}"
+    postgresql_client_password: "{{ gitea_database_pass }}"
+    postgresql_client_database: "{{ gitea_database_name }}"
+    postgresql_client_database_lc_collate: >-2
+      {{ gitea_postgresql_database_lc_collate | default('en_US.UTF-8') }}
+    postgresql_client_database_lc_ctype: >-2
+      {{ gitea_postgresql_database_lc_ctype | default('en_US.UTF-8') }}
+  tags:
+    - gitea-postgresql
+
+- import_playbook: finallycoffee.base.lego_certificate
+  when: gitea_configure_lego_rfc2136 | default(true) | bool
+  vars:
+    target_domains:
+      - "{{ gitea_domain }}"
+    target_acme_zone: "{{ acme_domain }}"
+    target_acme_account_email: "{{ gitea_lego_acme_account_email }}"
+    target_dns_server: "{{ dns_server }}"
+    target_dns_additional_records: "{{ gitea_dns_records }}"
+    target_dns_tsig_key: "{{ dns_tsig_keydata }}"
+    target_hosts: >-2
+      {{ gitea_lego_hosts | default(gitea_hosts | default('gitea')) }}
+    target_gather_facts: >-2
+      {{ gitea_gather_facts | default(false) | bool }}
+  tags:
+    - gitea-lego
+
+- name: Install and configure gitea
+  hosts: "{{ gitea_hosts | default('gitea') }}"
+  become: "{{ gitea_become | default(true, true) }}"
+  gather_facts: "{{ gitea_gather_facts | default(false) | bool }}"
+  pre_tasks:
+    - name: Ensure referenced docker container networks are present
+      community.docker.docker_network:
+        name: "{{ network.name }}"
+        state: "present"
+      loop: "{{ gitea_container_networks | default([]) }}"
+      loop_control:
+        loop_var: "network"
+        label: "{{ network.name }}"
+  roles:
+    - name: finallycoffee.services.gitea
+
+- import_playbook: finallycoffee.services.anubis
+  when: gitea_configure_anubis | default(false)
+  vars:
+    anubis_hosts: "{{ gitea_hosts | default('gitea') }}"
+    anubis_become: "{{ gitea_become | default(true, true) }}"
+    anubis_gather_facts: "{{ gitea_gather_facts | default(false) }}"
+    anubis_config_target: "http://{{ gitea_host_bind_ip }}"
+    anubis_config_bind: "{{ gitea_anubis_config_bind_ip }}"
+
+- import_playbook: finallycoffee.base.caddy_reverse_proxy
+  when: gitea_configure_caddy_reverse_proxy | default(false)
+  vars:
+    caddy_site_name: "{{ gitea_domain }}"
+    caddy_reverse_proxy_backend_addr: >-2
+      http://{{ gitea_configure_anubis | default(false)
+        | ternary(gitea_anubis_config_bind_ip, gitea_host_bind_ip) }}
+    target_hosts: >-2
+      {{ gitea_caddy_hosts | default(gitea_hosts | default('gitea')) }}
+    target_become: >-2
+      {{ gitea_caddy_become | default(gitea_become | default(true, true)) }}
+    target_gather_facts: >-2
+      {{ gitea_caddy_gather_facts | default(false) }}
+  tags:
+    - gitea-caddy

playbooks/hedgedoc.md

@@ -0,0 +1,7 @@
+# `finallycoffee.services.hedgedoc` ansible playbook
+
+## Feature toggles
+
+- `hedgedoc_configure_postgesql_client` (default `true`)
+- `hedgedoc_configure_lego_rfc2136` (default `true`)
+- `hedgedoc_configure_caddy_reverse_proxy` (default `false`)

playbooks/hedgedoc.yml

@@ -1,6 +1,60 @@
 ---
-- name: Install and configure hedgedoc
+- import_playbook: finallycoffee.databases.postgresql_client
+  when: hedgedoc_configure_postgresql_client | default(true) 
+  vars:
+    postgresql_hosts: >-2
+      {{ hedgedoc_postgresql_hosts | default(hedgedoc_hosts | default('hedgedoc')) }}
+    postgresql_become: >-2
+      {{ hedgedoc_postgresql_become | default(hedgedoc_become | default(true)) }}
+    postgresql_client_username: "{{ hedgedoc_database_user }}"
+    postgresql_client_password: "{{ hedgedoc_database_pass }}"
+    postgresql_client_database: "{{ hedgedoc_database_name }}"
+    postgresql_client_database_lc_collate: "en_US.UTF-8"
+    postgresql_client_database_lc_ctype: "en_US.UTF-8"
+  tags:
+    - hedgedoc
+    - hedgedoc-postgresql
+
+- import_playbook: finallycoffee.base.lego_certificate
+  when: hedgedoc_configure_lego_rfc2136 | default(true)
+  vars:
+    target_hosts: >-2
+      {{ hedgedoc_lego_hosts | default(hedgedoc_hosts | default('hedgedoc')) }}
+    target_gather_facts: >-2
+      {{ hedgedoc_lego_gather_facts | default(hedgedoc_gather_facts | default(false)) }}
+    target_become: >-2
+      {{ hedgedoc_lego_become | default(hedgedoc_become | default(true, false)) }}
+    target_domains:
+      - "{{ hedgedoc_domain }}"
+    target_acme_zone: "{{ acme_domain }}"
+    target_acme_account_email: "{{ hedgedoc_lego_acme_account_email }}"
+    target_dns_server: "{{ dns_server }}"
+    target_dns_additional_records: "{{ hedgedoc_dns_records }}"
+    target_dns_tsig_key: "{{ dns_tsig_keydata }}"
+  tags:
+    - hedgedoc
+    - hedgedoc-lego
+
+- name: Deploy Hedgedoc
   hosts: "{{ hedgedoc_hosts | default('hedgedoc') }}"
   become: "{{ hedgedoc_become | default(true, false) }}"
+  gather_facts: "{{ hedgedoc_gather_facts | default(false) }}"
   roles:
     - role: finallycoffee.services.hedgedoc
+  tags:
+    - hedgedoc
+
+- import_playbook: finallycoffee.base.caddy_reverse_proxy
+  when: hedgedoc_configure_caddy_reverse_proxy | default(false)
+  vars:
+    caddy_site_name: "{{ hedgedoc_domain }}"
+    caddy_reverse_proxy_backend_addr: "http://{{ hedgedoc_host_bind_ip }}"
+    target_hosts: >-2
+      {{ hedgedoc_caddy_hosts | default(hedgedoc_hosts | default('hedgedoc')) }}
+    target_become: >-2
+      {{ hedgedoc_caddy_become | default(hedgedoc_become | default(true, false)) }}
+    target_gather_facts: >-2
+      {{ hedgedoc_caddy_gather_facts | default(false) }}
+  tags:
+    - hedgedoc
+    - hedgedoc-caddy

playbooks/jellyfin.md

@@ -0,0 +1,6 @@
+# `finallycoffee.services.jellyfin` ansible playbook
+
+## Feature toggles
+
+- `jellyfin_configure_lego_rfc2136` (default `false`)
+- `jellyfin_configure_caddy_reverse_proxy` (default `false`)

playbooks/jellyfin.yml

@@ -1,6 +1,44 @@
 ---
-- name: Install and configure jellyfin
+- import_playbook: finallycoffee.base.lego_certificate
+  when: jellyfin_configure_lego_rfc2136 | default(false)
+  vars:
+    target_domains:
+      - "{{ jellyfin_domain }}"
+    target_acme_zone: "{{ acme_domain }}"
+    target_acme_account_email: "{{ jellyfin_lego_acme_account_email }}"
+    target_dns_server: "{{ dns_server }}"
+    target_dns_tsig_key: "{{ dns_tsig_keydata }}"
+    target_dns_additional_records: "{{ jellyfin_dns_records }}"
+    target_hosts: >-2
+      {{ jellyfin_lego_hosts | default(jellyfin_hosts | default('jellyfin')) }}
+    target_become: >-2
+      {{ jellyfin_lego_become | default(jellyfin_become | default(false)) }}
+    target_gather_facts: >-2
+      {{ jellyfin_lego_gather_facts | default(false) }}
+  tags:
+    - jellyfin
+    - jellyfin-lego
+
+- name: Install jellyfin, a selfhosted media streaming platform
   hosts: "{{ jellyfin_hosts | default('jellyfin') }}"
-  become: "{{ jellyfin_become | default(true, false) }}"
+  become: "{{ jellyfin_become | default(false) }}"
+  gather_facts: "{{ jellyfin_gather_facts | default(false) }}"
   roles:
     - role: finallycoffee.services.jellyfin
+  tags:
+    - jellyfin
+
+- import_playbook: finallycoffee.base.caddy_reverse_proxy
+  when: jellyfin_configure_caddy_reverse_proxy | default(false)
+  vars:
+    caddy_site_name: "{{ jellyfin_domain }}"
+    caddy_reverse_proxy_backend_addr: "http://{{ jellyfin_host_bind_ip }}"
+    target_hosts: >-2
+      {{ jellyfin_caddy_hosts | default(jellyfin_hosts | default('jellyfin')) }}
+    target_become: >-2
+      {{ jellyfin_caddy_become | default(jellyfin_become | default(false)) }}
+    target_gather_facts: >-2
+      {{ jellyfin_caddy_gather_facts | default(false) }}
+  tags:
+    - jellyfin
+    - jellyfin-caddy

playbooks/keycloak.md

@@ -0,0 +1,7 @@
+# `finallycoffee.services.keycloak` ansible playbook
+
+## Feature toggles
+
+- `keycloak_configure_postgesql_client` (default `false`)
+- `keycloak_configure_lego_rfc2136` (default `true`)
+- `keycloak_configure_caddy_reverse_proxy` (default `false`)

playbooks/keycloak.yml

@@ -0,0 +1,67 @@
+---
+- import_playbook: finallycoffee.databases.postgresql_client
+  when: keycloak_configure_postgresql_client | default(false)
+  vars:
+    postgresql_hosts: >-2
+      {{ keycloak_postgresql_client_host | default(keycloak_hosts | default('keycloak')) }}
+    postgresql_become: >-2
+      {{ keycloak_postgresql_client_become | default(keycloak_become | default(false)) }}
+    postgresql_client_username: "{{ keycloak_database_username }}"
+    postgresql_client_password: "{{ keycloak_database_password }}"
+    postgresql_client_database: "{{ keycloak_database_database }}"
+    postgresql_client_database_lc_ctype: 'C'
+    postgresql_client_database_lc_collate: 'C'
+    postgresql_client_database_contype: host
+    postgresql_client_address: >-2
+      {{ keycloak_postgresql_client_address | default('172.17.0.0/24') }}
+  tags:
+    - keycloak
+    - keycloak-postgresql
+
+- import_playbook: finallycoffee.base.lego_certificate
+  when: keycloak_configure_lego_rfc2136 | default(true) | bool
+  vars:
+    target_domains:
+      - "{{ keycloak_domain }}"
+    target_acme_zone: "{{ acme_domain }}"
+    target_acme_account_email: "{{ keycloak_lego_acme_account_email }}"
+    target_dns_server: "{{ dns_server }}"
+    target_dns_additional_records: "{{ keycloak_dns_records }}"
+    target_dns_tsig_key: "{{ dns_tsig_keydata }}"
+    target_hosts: >-2
+      {{ keycloak_lego_hosts | default(keycloak_hosts | default('keycloak')) }}
+    target_become: >-2
+      {{ keycloak_lego_become | default(keycloak_become | default(false)) }}
+    target_gather_facts: >-2
+      {{ keycloak_lego_gather_facts | default(false) | bool }}
+  tags:
+    - keycloak
+    - keycloak-lego
+
+- name: Set up and configure keycloak
+  hosts: "{{ keycloak_hosts | default('keycloak') }}"
+  become: "{{ keycloak_become | default(false) }}"
+  gather_facts: "{{ keycloak_gather_facts | default(false) }}"
+  roles:
+    - role: finallycoffee.services.keycloak
+  tags:
+    - keycloak
+
+- import_playbook: finallycoffee.base.caddy_reverse_proxy
+  when: keycloak_configure_caddy_reverse_proxy | default(false)
+  vars:
+    caddy_site_name: "{{ keycloak_domain }}"
+    caddy_reverse_proxy_backend_addr: "http://{{ keycloak_host_bind_ip }}"
+    caddy_reverse_proxy_template_block: >-2
+      {{ keycloak_caddy_reverse_proxy_template_block | default(true, false) }}
+    caddy_reverse_proxy_block: >-2
+      {{ keycloak_caddy_reverse_proxy_block | default('') }}
+    target_hosts: >-2
+      {{ keycloak_caddy_hosts | default(keycloak_hosts | default('keycloak')) }}
+    target_become: >-2
+      {{ keycloak_caddy_become | default(keycloak_become | default(false)) }}
+    target_gather_facts: >-2
+      {{ keycloak_caddy_gather_facts | default(false) }}
+  tags:
+    - keycloak
+    - keycloak-caddy

playbooks/phpldapadmin.md

@@ -0,0 +1,6 @@
+# `finallycoffee.services.phpldapadmin` ansible playbook
+
+## Feature toggles
+
+- `phpldapadmin_configure_lego_rfc2136` (default `false`)
+- `phpldapadmin_configure_caddy_reverse_proxy` (default `false`)

playbooks/phpldapadmin.yml

@@ -1,7 +1,46 @@
 ---
+- import_playbook: finallycoffee.base.lego_certificate
+  when: phpldapadmin_configure_lego_rfc2136 | default(false)
+  vars:
+    target_domains:
+      - "{{ phpldapadmin_domain }}"
+    target_acme_zone: "{{ acme_domain }}"
+    target_acme_account_email: "{{ phpldapadmin_lego_acme_account_email }}"
+    target_dns_server: "{{ dns_server }}"
+    target_dns_tsig_key: "{{ dns_tsig_keydata }}"
+    target_dns_additional_records: "{{ phpldapadmin_dns_records }}"
+    target_hosts: >-2
+      {{ phpldapadmin_lego_hosts | default(phpldapadmin_hosts | default('phpldapadmin')) }}
+    target_become: >-2
+      {{ phpldapadmin_lego_become | default(phpldapadmin_become | default(false)) }}
+    target_gather_facts: >-2
+      {{ phpldapadmin_lego_gather_facts | default(false) }}
+  tags:
+    - phpldapadmin
+    - phpldapadmin-lego
+
 - name: Configure and run phpldapadmin
   hosts: "{{ phpldapadmin_hosts | default('phpldapadmin', true) }}"
   become: "{{ phpldapadmin_become | default(false) }}"
   gather_facts: "{{ phpldapadmin_gather_facts | default(false) }}"
   roles:
     - role: finallycoffee.services.phpldapadmin
+  tags:
+    - phpldapadmin
+
+- import_playbook: finallycoffee.base.caddy_reverse_proxy
+  when: phpldapadmin_configure_caddy_reverse_proxy | default(false)
+  vars:
+    caddy_site_name: "{{ phpldapadmin_domain }}"
+    caddy_reverse_proxy_extra_config: >-2
+      header_up -X-Forwarded-Port
+    caddy_reverse_proxy_backend_addr: "http://{{ phpldapadmin_host_bind_ip }}"
+    target_hosts: >-2
+      {{ phpldapadmin_caddy_hosts | default(phpldapadmin_hosts | default('phpldapadmin')) }}
+    target_become: >-2
+      {{ phpldapadmin_caddy_become | default(phpldapadmin_become | default(false)) }}
+    target_gather_facts: >-2
+      {{ phpldapadmin_caddy_gather_facts | default(false) }}
+  tags:
+    - phpldapadmin
+    - phpldapadmin-caddy

playbooks/pretix.yml

@@ -9,6 +9,10 @@
     postgresql_client_username: "{{ pretix_postgresql_user | default('pretix') }}"
     postgresql_client_password: >-2
       {{ pretix_postgresql_password | mandatory(msg='pretix postgresql password is required') }}
+  tags:
+    - postgresql
+    - pretix
+    - pretix-postgresql
 
 - import_playbook: finallycoffee.base.lego_certificate
   when: pretix_acquire_lego_certificate | default(false)
@@ -22,6 +26,10 @@
     target_dns_additional_records: "{{ pretix_dns_records }}"
     target_dns_tsig_key: "{{ dns_tsig_keydata }}"
     target_gather_facts: "{{ pretix_gather_facts | default(false) }}"
+  tags:
+    - lego
+    - pretix
+    - pretix-lego
 
 - import_playbook: finallycoffee.databases.valkey
   when: pretix_configure_valkey | default(true)
@@ -36,6 +44,9 @@
     valkey_config_bind:
       - "0.0.0.0"
       - "-::"
+  tags:
+    - pretix
+    - pretix-valkey
 
 - name: Install and configure pretix
   hosts: "{{ pretix_hosts | default('pretix') }}"
@@ -54,11 +65,14 @@
           redis://:{{ pretix_redis_secret }}@{{ pretix_redis_bind_addr }}/1
         pretix_config_celery_broker: >-2
           redis://:{{ pretix_redis_secret }}@{{ pretix_redis_bind_addr }}/2
+      tags:
+        - pretix-only
     - role: finallycoffee.base.nginx
       when: pretix_configure_nginx | default(true)
       vars:
         nginx_container_name: "nginx-pretix"
         nginx_container_labels: "{{ pretix_nginx_container_labels | default({}, true) }}"
+        nginx_container_ports: "{{ pretix_nginx_container_ports | default([], true) }}"
         nginx_config_file: "{{ nginx_base_path }}/nginx-pretix.conf"
         nginx_config: |+
           server {
@@ -101,12 +115,33 @@
               }
           }
         pretix_detected_python_version: >-2
-          python{{ ansible_python.version.major }}.{{ ansible_python.version.minor }}
+          python{{ ansible_facts['python'].version.major }}.{{ ansible_facts['python'].version.minor }}
         pretix_static_asset_dir: >-2
           {{ pretix_virtualenv_dir }}/lib/{{ pretix_python_version | default(pretix_detected_python_version) }}/site-packages/pretix/static.dist/
         nginx_container_volumes:
           - "{{ nginx_config_file }}:/etc/nginx/conf.d/nginx.conf:ro"
           - "{{ pretix_media_dir }}:{{ pretix_media_dir }}:ro"
           - "{{ pretix_static_asset_dir }}:{{ pretix_static_asset_dir }}:ro"
+      tags:
+        - pretix-nginx
+        - nginx
   vars:
     pretix_redis_bind_addr: "127.0.10.1:6739"
+  tags:
+    - pretix
+
+- import_playbook: finallycoffee.base.caddy_reverse_proxy
+  when: pretix_configure_caddy_reverse_proxy | default(false)
+  vars:
+    caddy_site_name: "{{ pretix_domain }}"
+    caddy_reverse_proxy_backend_addr: "http://{{ pretix_host_bind_addr }}"
+    target_hosts: >-2
+      {{ pretix_caddy_hosts | default(pretix_hosts | default('pretix')) }}
+    target_become: >-2
+      {{ pretix_caddy_become | default(pretix_become | default(true, true)) }}
+    target_gather_facts: >-2
+      {{ pretix_caddy_gather_facts | default(false) }}
+  tags:
+    - pretix
+    - pretix-caddy
+    - caddy

playbooks/snipe_it.md

@@ -0,0 +1,7 @@
+# `finallycoffee.services.snipe_it` ansible playbook
+
+## Feature toggles
+
+- `snipe_it_configure_mariadb` (default `true`)
+- `snipe_it_configure_lego_rfc2136` (default `false`)
+- `snipe_it_configure_caddy_reverse_proxy` (default `false`)

playbooks/snipe_it.yml

@@ -1,6 +1,58 @@
 ---
-- name: Install and configure Snipe-IT
+- import_playbook: finallycoffee.base.lego_certificate
+  when: snipe_it_configure_lego_rfc2136 | default(false)
+  vars:
+    target_domains:
+      - "{{ snipe_it_domain }}"
+    target_acme_zone: "{{ acme_domain }}"
+    target_acme_account_email: "{{ snipe_it_lego_acme_account_email }}"
+    target_dns_server: "{{ dns_server }}"
+    target_dns_tsig_key: "{{ dns_tsig_keydata }}"
+    target_dns_additional_records: "{{ snipe_it_dns_records }}"
+    target_hosts: >-2
+      {{ snipe_it_lego_hosts | default(snipe_it_hosts | default('snipe_it')) }}
+    target_become: >-2
+      {{ snipe_it_lego_become | default(snipe_it_become | default(false)) }}
+    target_gather_facts: >-2
+      {{ snipe_it_lego_gather_facts | default(false) }}
+  tags:
+    - snipe-it
+    - snipe-it-lego
+
+- name: Set up snipe-it, an asset management system
   hosts: "{{ snipe_it_hosts | default('snipe_it') }}"
-  become: "{{ snipe_it_become | default(true, false) }}"
+  become: "{{ snipe_it_become | default(false) }}"
   roles:
+    - role: finallycoffee.databases.mariadb
+      when: snipe_it_configure_mariadb | default(true, true)
+      vars:
+        mariadb_root_password: "{{ snipe_it_builtin_database_root_pass }}"
+        mariadb_database: "{{ snipe_it_config_db_database }}"
+        mariadb_username: "{{ snipe_it_config_db_username }}"
+        mariadb_password: "{{ snipe_it_config_db_password }}"
+        mariadb_container_name: "snipe-it-mysql"
+        mariadb_container_ports: "{{ snipe_it_builtin_database_container_ports }}"
+        mariadb_base_path: "/databases/snipe-it/mariadb"
+      tags:
+        - snipe-it
+        - snipe-it-mariadb
     - role: finallycoffee.services.snipe_it
+      tags:
+        - snipe-it
+
+- import_playbook: finallycoffee.base.caddy_reverse_proxy
+  when: snipe_it_configure_caddy_reverse_proxy | default(false)
+  vars:
+    caddy_site_name: "{{ snipe_it_domain }}"
+    caddy_reverse_proxy_backend_addr: "http://{{ snipe_it_host_bind_addr }}"
+    caddy_reverse_proxy_extra_config: >-2
+      {{ snipe_it_caddy_reverse_proxy_extra_config | default('') }}
+    target_hosts: >-2
+      {{ snipe_it_caddy_hosts | default(snipe_it_hosts | default('snipe_it')) }}
+    target_become: >-2
+      {{ snipe_it_caddy_become | default(snipe_it_become | default(false)) }}
+    target_gather_facts: >-2
+      {{ snipe_it_caddy_gather_facts | default(false) }}
+  tags:
+    - snipe-it
+    - snipe-it-caddy

playbooks/unifi_controller.yml

@@ -0,0 +1,43 @@
+---
+- import_playbook: finallycoffee.base.lego_certificate
+  when: unifi_controller_enable_lego_certificate | default(false) | bool
+  vars:
+    target_become: "{{ unifi_controller_become | default(false) }}"
+    target_hosts: "{{ unifi_controller_hosts | default('unifi_controller') }}"
+    target_gather_facts: "{{ unifi_controller_gather_facts | default(false) }}"
+    target_domains:
+      - "{{ unifi_controller_domain }}"
+    target_acme_zone: "{{ acme_domain }}"
+    target_acme_account_email: "{{ unifi_controller_lego_acme_account_email }}"
+    target_dns_server: "{{ dns_server }}"
+    target_dns_additional_records: "{{ unifi_controller_dns_records | default([]) }}"
+    target_dns_tsig_key: "{{ dns_tsig_keydata }}"
+  tags:
+    - unifi-controller
+    - unifi-controller-lego
+
+- name: Deploy unifi controller
+  hosts: "{{ unifi_controller_hosts | default('unifi_controller') }}"
+  become: "{{ unifi_controller_become | default(false) }}"
+  gather_facts: "{{ unifi_controller_gather_facts | default(false) }}"
+  roles:
+    - role: finallycoffee.services.unifi_controller
+  tags:
+    - unifi-controller
+
+- import_playbook: finallycoffee.base.caddy_reverse_proxy
+  when: unifi_controller_configure_caddy_reverse_proxy | default(false)
+  vars:
+    caddy_site_name: "{{ unifi_controller_domain }}"
+    caddy_reverse_proxy_backend_addr: "https://{{ unifi_controller_bind_addr }}"
+    caddy_reverse_proxy_extra_config: >-2
+      {{ unifi_controller_caddy_reverse_proxy_extra_config | default('', true) }}
+    target_hosts: >-2
+      {{ unifi_controller_caddy_hosts | default(unifi_controller_hosts | default('unifi_controller')) }}
+    target_become: >-2
+      {{ unifi_controller_caddy_become | default(unifi_controller_become | default(false)) }}
+    target_gather_facts: >-2
+      {{ unifi_controller_caddy_gather_facts | default(false) }}
+  tags:
+    - unifi-controller
+    - unifi-controller-caddy

playbooks/vaultwarden.md

@@ -0,0 +1,6 @@
+# `finallycoffee.services.vaultwarden` ansible playbook
+
+## Feature toggles
+
+- `vaultwarden_configure_lego_rfc2136` (default `false`)
+- `vaultwarden_configure_caddy_reverse_proxy` (default `false`)

playbooks/vaultwarden.yml

@@ -1,6 +1,43 @@
 ---
+- import_playbook: finallycoffee.base.lego_certificate
+  when: vaultwarden_configure_lego_rfc2136 | default(false)
+  vars:
+    target_domains: "{{ vaultwarden_lego_cert_domains }}"
+    target_acme_zone: "{{ acme_domain }}"
+    target_acme_account_email: "{{ vaultwarden_lego_acme_account_email }}"
+    target_dns_server: "{{ dns_server }}"
+    target_dns_tsig_key: "{{ dns_tsig_keydata }}"
+    target_dns_additional_records: "{{ vaultwarden_dns_records }}"
+    target_hosts: >-2
+      {{ vaultwarden_lego_hosts | default(vaultwarden_hosts | default('vaultwarden')) }}
+    target_become: >-2
+      {{ vaultwarden_lego_become | default(vaultwarden_become | default(false)) }}
+    target_gather_facts: >-2
+      {{ vaultwarden_lego_gather_facts | default(false) }}
+  tags:
+    - vaultwarden
+    - vaultwarden-lego
+
 - name: Install and configure vaultwarden
   hosts: "{{ vaultwarden_hosts | default('vaultwarden') }}"
-  become: "{{ vaultwarden_become | default(true, false) }}"
+  become: "{{ vaultwarden_become | default(false) }}"
+  gather_facts: "{{ vaultwarden_gather_facts | default(false) }}"
   roles:
     - role: finallycoffee.services.vaultwarden
+  tags:
+    - vaultwarden
+
+- import_playbook: finallycoffee.base.caddy_reverse_proxy
+  when: vaultwarden_configure_caddy_reverse_proxy | default(false)
+  vars:
+    caddy_site_name: "{{ vaultwarden_domain }}"
+    caddy_reverse_proxy_backend_addr: "http://{{ vaultwarden_host_bind_ip }}"
+    target_hosts: >-2
+      {{ vaultwarden_caddy_hosts | default(vaultwarden_hosts | default('vaultwarden')) }}
+    target_become: >-2
+      {{ vaultwarden_caddy_become | default(vaultwarden_become | default(false)) }}
+    target_gather_facts: >-2
+      {{ vaultwarden_caddy_gather_facts | default(false) }}
+  tags:
+    - vaultwarden
+    - vaultwarden-caddy

roles/anubis/README.md

@@ -0,0 +1,5 @@
+# `finallycoffee.services.anubis`
+
+Install [Anubis](https://anubis.techaro.lol/), a HTTP proxy which
+detects (AI) scrapers by providing a lightweight, non-interactive
+browser challenge to clients likely to match scrapers.

roles/anubis/defaults/main/config.yml

@@ -0,0 +1,20 @@
+---
+anubis_config_dir: "{{ anubis_config_file | dirname }}"
+anubis_config_file: "/etc/anubis/{{ anubis_service }}.env"
+anubis_bot_policy_file: "{{ anubis_config_dir }}/{{ anubis_service }}.botPolicies.yaml"
+
+anubis_config_bind: "8923"
+anubis_config_metrics_bind: "[::1]:8240"
+anubis_config_difficulty: "4"
+anubis_config_policy_fname: "{{ anubis_bot_policy_file }}"
+anubis_config_target: ~
+
+anubis_default_config:
+  "BIND": "{{ anubis_config_bind }}"
+  "METRICS_BIND": "{{ anubis_config_metrics_bind }}"
+  "DIFFICULTY": "{{ anubis_config_difficulty }}"
+  "POLICY_FNAME": "{{ anubis_config_policy_fname }}"
+  "TARGET": "{{ anubis_config_target }}"
+anubis_config: {}
+anubis_merged_config: >-2
+  {{ anubis_default_config | combine(anubis_config | default({}, true)) }}

roles/anubis/defaults/main/main.yml

@@ -0,0 +1,10 @@
+---
+anubis_version: "1.27.0"
+anubis_base_path: "/opt/anubis"
+anubis_bin_path: "{{ anubis_base_path }}/bin"
+anubis_state: "present"
+
+anubis_os_name: "linux"
+anubis_architecture: "amd64"
+
+anubis_service: "gitea"

roles/anubis/defaults/main/package.yml

@@ -0,0 +1,32 @@
+---
+anubis_package_server: "https://github.com"
+anubis_package_namespace: "TecharoHQ"
+anubis_package_repository: "anubis"
+# https://github.com/TecharoHQ/anubis/releases/download/v1.25.0/anubis-1.25.0-linux-amd64.tar.gz
+anubis_package_url: >-2
+  {{
+    [
+      anubis_package_server,
+      anubis_package_namespace,
+      anubis_package_repository,
+      'releases/download',
+      'v' + anubis_version,
+      [
+        anubis_package_repository,
+        anubis_version,
+        anubis_os_name,
+        anubis_architecture
+      ] | flatten | join('-') + '.tar.gz'
+    ] | flatten | join('/')
+  }}
+anubis_tarball_path: "{{ anubis_base_path }}/anubis-{{ anubis_version }}.tar.gz"
+anubis_package_path: >-2
+  {{ anubis_bin_path }}/anubis-{{ anubis_version }}-{{ anubis_os_name }}-{{ anubis_architecture }}
+anubis_tarball_binary: >-2
+  {{ anubis_package_path }}/bin/anubis
+anubis_tarball_systemd_unit_path: >-2
+  {{ anubis_package_path }}/run/{{ anubis_systemd_template_service_name }}
+anubis_tarball_bot_policies: >-2
+  {{ anubis_package_path }}/doc/botPolicies.yaml
+anubis_tarball_default_config_file: >-2
+  {{ anubis_package_path }}/run/default.env

roles/anubis/defaults/main/systemd.yml

@@ -0,0 +1,8 @@
+---
+anubis_systemd_service: "anubis@{{ anubis_service }}.service"
+anubis_systemd_template_service_name: "anubis@.service"
+anubis_systemd_unit_dir: "/etc/systemd/system"
+anubis_systemd_service_enabled: >-2
+  {{ anubis_state == 'present' }}
+anubis_systemd_service_state: >-2
+  {{ (anubis_state == 'present') | ternary('started', 'stopped') }}

roles/anubis/defaults/main/user.yml

@@ -0,0 +1,5 @@
+---
+anubis_user: "anubis"
+anubis_user_state: "{{ anubis_state }}"
+anubis_user_system: true
+anubis_user_create_home: false

roles/anubis/meta/main.yml

@@ -0,0 +1,10 @@
+---
+allow_duplicates: true
+dependencies: []
+galaxy_info:
+  role_name: anubis
+  description: Ansible role to deploy anubis
+  galaxy_tags:
+    - anubis
+    - ai
+    - llm

roles/anubis/tasks/configure.yml

@@ -0,0 +1,18 @@
+---
+- name: Ensure 'anubis_config_target' is populated
+  ansible.builtin.fail:
+    msg: >-2
+      Variable 'anubis_config_target' must be populated!
+  when: anubis_config_target | ansible.builtin.type_debug == 'NoneType'
+
+- name: Configure anubis for service '{{ anubis_service }}'
+  ansible.builtin.lineinfile:
+    path: "{{ anubis_config_file }}"
+    line: "{{ config_entry.key }}={{ config_entry.value }}"
+    regexp: "^{{ config_entry.key }}="
+    state: present
+  when: anubis_state == 'present'
+  loop: "{{ anubis_merged_config | dict2items }}"
+  loop_control:
+    loop_var: "config_entry"
+    label: "{{ config_entry.key }}={{ config_entry.value }}"

roles/anubis/tasks/deploy.yml

@@ -0,0 +1,10 @@
+---
+- name: Ensure systemd service {{ anubis_systemd_service }} is enabled
+  ansible.builtin.systemd_service:
+    name: "{{ anubis_systemd_service }}"
+    enabled: "{{ anubis_systemd_service_enabled }}"
+
+- name: Ensure systemd service {{ anubis_systemd_service }} is {{ anubis_systemd_service_state }}
+  ansible.builtin.systemd_service:
+    name: "{{ anubis_systemd_service }}"
+    state: "{{ anubis_systemd_service_state }}"

roles/anubis/tasks/install.yml

@@ -0,0 +1,51 @@
+---
+- name: Download and install anubis@{{ anubis_version }}
+  when: anubis_state == 'present'
+  block:
+    - name: Download anubis tarball from {{ anubis_package_url }} to '{{ anubis_tarball_path }}'
+      ansible.builtin.get_url:
+        url: "{{ anubis_package_url }}"
+        url_username: "{{ anubis_package_server_username | default(omit) }}"
+        url_password: "{{ anubis_package_server_password | default(omit) }}"
+        dest: "{{ anubis_tarball_path }}"
+
+    - name: Create folder '{{ anubis_bin_path }}' to extract archive into
+      ansible.builtin.file:
+        dest: "{{ anubis_bin_path }}"
+        state: directory
+
+    - name: Uncompress release tarball into {{ anubis_bin_path }}
+      ansible.builtin.unarchive:
+        src: "{{ anubis_tarball_path }}"
+        dest: "{{ anubis_bin_path }}"
+        remote_src: true
+      ignore_errors: "{{ ansible_check_mode }}"
+
+    - name: Ensure anubis binary is installed
+      ansible.builtin.copy:
+        src: "{{ anubis_tarball_binary }}"
+        dest: "/usr/bin/anubis"
+        remote_src: true
+
+    - name: Install systemd unit
+      ansible.builtin.copy:
+        src: "{{ anubis_tarball_systemd_unit_path }}"
+        dest: "{{ anubis_systemd_unit_dir }}"
+        remote_src: true
+
+    - name: Ensure configuration folder '{{ anubis_config_dir }}' exists
+      ansible.builtin.file:
+        dest: "{{ anubis_config_dir }}"
+        state: "directory"
+
+    - name: Copy default configuration to {{ anubis_config_file }}
+      ansible.builtin.copy:
+        src: "{{ anubis_tarball_default_config_file }}"
+        dest: "{{ anubis_config_file }}"
+        remote_src: true
+
+    - name: Copy bot policy for service '{{ anubis_service }}' to {{ anubis_bot_policy_file }}
+      ansible.builtin.copy:
+        src: "{{ anubis_tarball_bot_policies }}"
+        dest: "{{ anubis_bot_policy_file }}"
+        remote_src: true

roles/anubis/tasks/main.yml

@@ -0,0 +1,33 @@
+---
+- name: Ensure 'anubis_state' is valid
+  ansible.builtin.fail:
+    msg: >-2
+      Invalid state '{{ anubis_state }}'! Supported
+      states are {{ anubis_states | join(', ') }}
+  when: anubis_state not in anubis_states
+
+- name: Ensure anubis user '{{ anubis_user }}' is {{ anubis_user_state }}
+  ansible.builtin.user:
+    name: "{{ anubis_user }}"
+    state: "{{ anubis_user_state }}"
+    system: "{{ anubis_user_system }}"
+    create_home: "{{ anubis_user_create_home }}"
+
+- name: Ensure anubis base path '{{ anubis_base_path }}' is {{ anubis_state }}
+  ansible.builtin.file:
+    path: "{{ anubis_base_path }}"
+    state: "directory"
+  when: anubis_state == 'present'
+
+- name: Ensure anubis is installed
+  ansible.builtin.include_tasks:
+    file: "install.yml" 
+
+- name: Ensure anubis is configured
+  ansible.builtin.include_tasks:
+    file: "configure.yml"
+  when: anubis_state == 'present'
+
+- name: Ensure anubis is deployed
+  ansible.builtin.include_tasks:
+    file: "deploy.yml"

roles/anubis/vars/main.yml

@@ -0,0 +1,4 @@
+---
+anubis_states:
+  - "present"
+  - "absent"

roles/authelia/defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-authelia_version: "4.39.13"
+authelia_version: "4.39.28"
 authelia_user: authelia
 authelia_base_dir: /opt/authelia
 authelia_domain: authelia.example.org
@@ -31,8 +31,8 @@ authelia_container_image_ref: >-2
   {{ authelia_container_image }}:{{ authelia_container_image_tag | default(authelia_version, true) }}
 authelia_container_image_force_pull: "{{ authelia_container_image_tag | default(false, True) }}"
 authelia_container_env:
-  PUID: "{{ authelia_run_user }}"
-  PGID: "{{ authelia_run_group }}"
+  PUID: "{{ authelia_run_user | string }}"
+  PGID: "{{ authelia_run_group | string }}"
 authelia_container_labels: >-2
   {{ authelia_container_base_labels | combine(authelia_container_extra_labels) }}
 authelia_container_extra_labels: {}

roles/authelia/tasks/main.yml

@@ -28,7 +28,6 @@
     owner: "{{ item.owner | default(authelia_user) }}"
     group: "{{ item.group | default(authelia_user) }}"
     mode: "{{ item.mode | default('0750') }}"
-  when: item.path | default(false, true) | bool
   loop:
     - path: "{{ authelia_base_dir }}"
       mode: "0755"

roles/ghost/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 ghost_domain: ~
-ghost_version: "6.5.1"
+ghost_version: "6.67.0"
 ghost_user: ghost
 ghost_user_group: ghost
 ghost_base_path: /opt/ghost

roles/gitea/defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-gitea_version: "1.25.1"
+gitea_version: "1.27.3"
 gitea_user: git
 gitea_run_user: "{{ gitea_user }}"
 gitea_base_path: "/opt/gitea"
@@ -44,8 +44,8 @@ gitea_container_base_ports:
   - "127.0.0.1:{{ git_container_port_ssh }}:{{ git_container_port_ssh }}"
 
 gitea_container_base_env:
-  USER_UID: "{{ gitea_user_res.uid | default(gitea_user) }}"
-  USER_GID: "{{ gitea_user_res.group | default(gitea_user) }}"
+  USER_UID: "{{ gitea_user_res.uid | default(gitea_user) | string }}"
+  USER_GID: "{{ gitea_user_res.group | default(gitea_user) | string }}"
 
 gitea_container_base_labels:
   version: "{{ gitea_version }}"

roles/hedgedoc/defaults/main/main.yml

@@ -1,6 +1,6 @@
 ---
 hedgedoc_user: hedgedoc
-hedgedoc_version: "1.10.3"
+hedgedoc_version: "1.12.0"
 
 hedgedoc_state: present
 hedgedoc_deployment_method: docker

roles/jellyfin/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 jellyfin_user: jellyfin
-jellyfin_version: "10.11.2"
+jellyfin_version: "12.1"
 jellyfin_state: present
 jellyfin_deployment_method: docker
 

roles/keycloak/defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-keycloak_version: "26.4.2"
+keycloak_version: "26.8.0"
 keycloak_container_name: keycloak
 
 keycloak_container_image_upstream_registry: quay.io
@@ -39,7 +39,7 @@ keycloak_container_command: >-2
   --db-password {{ keycloak_database_password }}
   --db-url jdbc:postgresql://{{ keycloak_database_hostname }}{{ keycloak_database_port | ternary(':' ~ keycloak_database_port, '') }}/{{ keycloak_database_database }}
   {{ keycloak_container_extra_start_flags | default([]) | join(' ') }}
-  --proxy-headers=xforwarded
+  --proxy-headers xforwarded
   --hostname {{ keycloak_config_hostname }}
   --optimized
 

roles/phpldapadmin/defaults/main/main.yml

@@ -1,5 +1,5 @@
 ---
-phpldapadmin_version: "2.3.4"
+phpldapadmin_version: "2.3.11"
 
 phpldapadmin_state: present
 phpldapadmin_deployment_method: docker

roles/pretix/defaults/main/main.yml

@@ -1,5 +1,5 @@
 ---
-pretix_version: "2025.9.0"
+pretix_version: "2026.7.0"
 pretix_state: "present"
 pretix_deployment_method: "systemd"
 

roles/pretix/defaults/main/system_packages.yml

@@ -20,3 +20,4 @@ pretix_debian_packages:
 pretix_packages:
   "debian":
     "12": "{{ pretix_debian_packages }}"
+    "13": "{{ pretix_debian_packages }}"

roles/pretix/defaults/main/systemd.yml

@@ -44,7 +44,7 @@ pretix_cron_systemd_timer_name: "pretix-cron.timer"
 pretix_cron_systemd_timer_description: "pretix cron timer"
 pretix_cron_systemd_timer_file_path: >-2
   /etc/systemd/system/{{ pretix_cron_systemd_timer_name }}
-pretix_cron_systemd_timer_on_active_sec: 1800
+pretix_cron_systemd_timer_on_unit_active_sec: 1800
 pretix_cron_systemd_timer_on_startup_sec: >-2
-  {{ pretix_cron_systemd_timer_on_active_sec }}
+  {{ pretix_cron_systemd_timer_on_unit_active_sec }}
 pretix_cron_systemd_timer_accuracy_sec: 60

roles/pretix/tasks/prepare-systemd.yml

@@ -13,13 +13,13 @@
   ansible.builtin.apt:
     name: "{{ package }}"
     state: "{{ pretix_state }}"
-  loop: "{{ pretix_packages[ansible_distribution | lower][ansible_distribution_major_version] }}"
+  loop: "{{ pretix_packages[ansible_facts['distribution'] | lower][ansible_facts['distribution_major_version']] }}"
   loop_control:
     loop_var: "package"
   when: ansible_facts['pkg_mgr'] == 'apt'
 
 # TODO: add pretix worker and cron
-- name: Ensure systemd unit {{ pretix_systemd_unit_name }} is {{ pretix_state }}
+- name: Ensure systemd unit {{ pretix_systemd_service_name }} is {{ pretix_state }}
   ansible.builtin.template:
     src: "pretix.service.j2"
     dest: "{{ pretix_systemd_unit_file_path }}"
@@ -27,7 +27,7 @@
   notify:
     - pretix_restart
 
-- name: Ensure systemd unit {{ pretix_worker_systemd_unit_name }} is {{ pretix_state }}
+- name: Ensure systemd unit {{ pretix_worker_systemd_service_name }} is {{ pretix_state }}
   ansible.builtin.template:
     src: "pretix.service.j2"
     dest: "{{ pretix_worker_systemd_unit_file_path }}"

roles/pretix/templates/pretix-cron.timer.j2

@@ -2,7 +2,7 @@
 Description={{ pretix_cron_systemd_timer_description }}
 
 [Timer]
-OnActiveSec={{ pretix_cron_systemd_timer_on_active_sec }}
+OnUnitActiveSec={{ pretix_cron_systemd_timer_on_unit_active_sec }}
 OnStartupSec={{ pretix_cron_systemd_timer_on_startup_sec }}
 AccuracySec={{ pretix_cron_systemd_timer_accuracy_sec }}
 

roles/snipe_it/defaults/main/main.yml

@@ -1,6 +1,6 @@
 ---
 snipe_it_user: snipeit
-snipe_it_version: "8.3.4"
+snipe_it_version: "8.8.0"
 snipe_it_domain: ~
 snipe_it_state: present
 snipe_it_deployment_method: docker

roles/unifi_controller/README.md

@@ -0,0 +1,16 @@
+# `finallycoffee.services.unifi_controller` ansible role
+
+Deploy [`jacobalberty/unifi-docker`](https://github.com/jacobalberty/unifi-docker)
+using either `docker` or `podman` (configure using
+`unifi_controller_deployment_method`).
+
+## Configuration
+
+Change the default bind IP of `::` by setting
+`unifi_controller_bind_ip`. By default, the ports
+`1900/udp` (SSDP), `3478/udp` (STUN), `10001/udp`,
+`8080/tcp` (HTTP), `8443/tcp` (HTTPS) and `6789/tcp`
+are exposed.
+
+For more information on which ports are needed when, see
+[Unifi's required ports reference](https://help.ui.com/hc/en-us/articles/218506997-Required-Ports-Reference).

roles/unifi_controller/defaults/main/container.yml

@@ -0,0 +1,41 @@
+---
+unifi_controller_container_name: "unifi-controller"
+unifi_controller_container_image_registry: "docker.io"
+unifi_controller_container_image_namespace: "jacobalberty"
+unifi_controller_container_image_repository: "unifi"
+unifi_controller_container_image_tag: ~
+unifi_controller_container_image_name: >-2
+  {{ [
+    unifi_controller_container_image_registry | default([]),
+    unifi_controller_container_image_namespace | default([]),
+    unifi_controller_container_image_repository
+  ] | flatten | join('/') }}
+unifi_controller_container_image: >-2
+  {{ [
+    unifi_controller_container_image_name,
+    unifi_controller_container_image_tag | default('v' + unifi_controller_version, true)
+  ] | join(':') }}
+unifi_controller_container_image_source: "pull"
+unifi_controller_container_image_force_source: >-2
+  {{ unifi_controller_container_image_tag | default(false, true) | bool }}
+unifi_controller_container_image_pull: >-2
+  {{ unifi_controller_container_image_source == 'pull' }}
+unifi_controller_container_image_force_pull: >-2
+  {{ unifi_controller_container_image_pull and unifi_controller_container_image_force_source }}
+unifi_controller_container_ports:
+  - "{{ unifi_controller_bind_ip }}:8080:8080/tcp" # HTTP: device + app communication
+  - "{{ unifi_controller_bind_ip }}:8443:8443/tcp" # HTTPS: app web page + API
+  - "{{ unifi_controller_bind_ip }}:1900:1900/udp" # SSDP: layer 2 discovery
+  - "{{ unifi_controller_bind_ip }}:3478:3478/udp" # STUN: device adoption and communication
+  - "{{ unifi_controller_bind_ip }}:10001:10001/udp" # device discovery (during adoption)
+unifi_controller_container_user: >-2
+  {{ unifi_controller_run_uid }}:{{ unifi_controller_run_gid }}
+unifi_controller_container_restart_policy: "on-failure"
+unifi_controller_container_default_volumes:
+  - "{{ unifi_controller_base_path }}:/unifi:rw"
+unifi_controller_container_volumes: []
+unifi_controller_container_merged_volumes: >-2
+  {{ unifi_controller_container_default_volumes | default([])
+  + unifi_controller_container_volumes | default([]) }}
+unifi_controller_container_state: >-2
+  {{ (unifi_controller_state == 'present') | ternary('started', 'absent') }}

roles/unifi_controller/defaults/main/main.yml

@@ -0,0 +1,9 @@
+---
+unifi_controller_version: "10.0.162"
+unifi_controller_base_path: "/var/lib/unifi-controller"
+unifi_controller_log_path: "{{ unifi_controller_base_path }}/log"
+unifi_controller_data_path: "{{ unifi_controller_base_path }}/data"
+unifi_controller_bind_ip: "[::]"
+
+unifi_controller_state: "present"
+unifi_controller_deployment_method: "docker"

roles/unifi_controller/defaults/main/user.yml

@@ -0,0 +1,8 @@
+---
+unifi_controller_user: unifi
+unifi_controller_user_create_home: false
+unifi_controller_user_system: true
+unifi_controller_run_uid: >-2
+  {{ unifi_controller_user_info.uid | default(unifi_controller_user) }}
+unifi_controller_run_gid: >-2
+  {{ unifi_controller_user_info.group | default(unifi_controller_user) }}

roles/unifi_controller/meta/main.yml

@@ -0,0 +1,11 @@
+---
+allow_duplicates: true
+dependencies: []
+galaxy_info:
+  role_name: unifi_controller
+  description: Ansible role to deploy unifi (network) controller in a container
+  galaxy_tags:
+    - unifi
+    - unifi_controller
+    - docker
+    - podman

roles/unifi_controller/tasks/deploy-docker.yml

@@ -0,0 +1,18 @@
+---
+- name: Ensure container image '{{ unifi_controller_container_image }}' is {{ unifi_controller_state }}
+  community.docker.docker_image:
+    name: "{{ unifi_controller_container_image }}"
+    state: "{{ unifi_controller_state }}"
+    source: "{{ unifi_controller_container_image_source }}"
+    force_source: "{{ unifi_controller_container_image_force_source }}"
+
+- name: Ensure container '{{ unifi_controller_container_name }}' is {{ unifi_controller_container_state }}
+  community.docker.docker_container:
+    name: "{{ unifi_controller_container_name }}"
+    image: "{{ unifi_controller_container_image }}"
+    env: "{{ unifi_controller_container_env | default(omit, true) }}"
+    user: "{{ unifi_controller_container_user }}"
+    ports: "{{ unifi_controller_container_ports }}"
+    volumes: "{{ unifi_controller_container_merged_volumes }}"
+    restart_policy: "{{ unifi_controller_container_restart_policy }}"
+    state: "{{ unifi_controller_container_state }}"

roles/unifi_controller/tasks/deploy-podman.yml

@@ -0,0 +1,17 @@
+---
+- name: Ensure container image '{{ unifi_controller_container_image }}' is {{ unifi_controller_state }}
+  containers.podman.podman_image:
+    name: "{{ unifi_controller_container_image }}"
+    state: "{{ unifi_controller_state }}"
+    pull: "{{ unifi_controller_container_image_pull }}"
+    force: "{{ unifi_controller_container_image_force_pull }}"
+
+- name: Ensure container '{{ unifi_controller_container_name }}' is {{ unifi_controller_container_state }}
+  containers.podman.podman_container:
+    name: "{{ unifi_controller_container_name }}"
+    image: "{{ unifi_controller_container_image }}"
+    user: "{{ unifi_controller_container_user }}"
+    ports: "{{ unifi_controller_container_ports }}"
+    volumes: "{{ unifi_controller_container_merged_volumes }}"
+    restart_policy: "{{ unifi_controller_container_restart_policy }}"
+    state: "{{ unifi_controller_container_state }}"

roles/unifi_controller/tasks/main.yml

@@ -0,0 +1,18 @@
+---
+- name: Ensure unifi controller run user '{{ unifi_controller_user }}' is {{ unifi_controller_state }}
+  ansible.builtin.user:
+    name: "{{ unifi_controller_user }}"
+    state: "{{ unifi_controller_state }}"
+  register: unifi_controller_user_info
+
+- name: Ensure unifi controller base path '{{ unifi_controller_base_path }}' is {{ unifi_controller_state }}
+  ansible.builtin.file:
+    path: "{{ unifi_controller_base_path }}"
+    state: "{{ (unifi_controller_state == 'present') | ternary('directory', 'absent') }}"
+    owner: "{{ unifi_controller_run_uid }}"
+    group: "{{ unifi_controller_run_gid }}"
+    mode: "0755"
+
+- name: Deploy unifi controller with {{ unifi_controller_deployment_method }}
+  ansible.builtin.include_tasks:
+    file: "deploy-{{ unifi_controller_deployment_method }}.yml"

roles/unifi_controller/vars/main.yml

@@ -0,0 +1,7 @@
+---
+unifi_controller_states:
+  - "present"
+  - "absent"
+unifi_controller_deployment_methods:
+  - "docker"
+  - "podman"

roles/vaultwarden/defaults/main/main.yml

@@ -1,6 +1,6 @@
 ---
 vaultwarden_user: vaultwarden
-vaultwarden_version: "1.34.3"
+vaultwarden_version: "1.37.4"
 
 vaultwarden_config_file: "/etc/vaultwarden/config.json"
 vaultwarden_config_directory: "{{ vaultwarden_config_file | dirname }}"

roles/vaultwarden/tasks/deploy-docker.yml

@@ -5,6 +5,10 @@
     state: "{{ vaultwarden_state }}"
     source: "{{ vaultwarden_container_image_source }}"
     force_source: "{{ vaultwarden_container_image_force_source }}"
+  register: vaultwarden_container_image_info
+  until: vaultwarden_container_image_info is success
+  retries: 10
+  delay: 3
 
 - name: Ensure container '{{ vaultwarden_container_name }}' is {{ vaultwarden_container_state }}
   community.docker.docker_container:

roles/vaultwarden/tasks/deploy-podman.yml

@@ -5,6 +5,10 @@
     state: "{{ vaultwarden_state }}"
     pull: "{{ (vaultwarden_container_image_source == 'pull') | bool }}"
     force: "{{ vaultwarden_container_image_force_source }}"
+  register: vaultwarden_container_image_info
+  until: vaultwarden_container_image_info is success
+  retries: 10
+  delay: 3
 
 - name: Ensure container '{{ vaultwarden_container_name }}' is {{ vaultwarden_container_state }}
   containers.podman.podman_container: