refactor(authelia): add state and deployment_method role parameters

galaxy.yml

@@ -1,15 +1,13 @@
 namespace: finallycoffee
 name: services
-version: "0.2.0"
+version: 0.1.10
 readme: README.md
 authors:
 - transcaffeine <transcaffeine@finally.coffee>
 description: Various ansible roles useful for automating infrastructure
 dependencies:
-  "community.general": "^11.0.0"
-  "community.crypto": "^3.0.3"
-  "community.docker": "^4.7.0"
-  "containers.podman": "^1.16.0"
+  "community.crypto": "^2.0.0"
+  "community.docker": "^3.0.0"
 license_file: LICENSE.md
 build_ignore:
 - '*.tar.gz'
@@ -23,4 +21,3 @@ tags:
   - vaultwarden
   - snipeit
   - docker
-  - phpldapadmin

playbooks/phpldapadmin.yml

@@ -1,7 +0,0 @@
----
-- name: Configure and run phpldapadmin
-  hosts: "{{ phpldapadmin_hosts | default('phpldapadmin', true) }}"
-  become: "{{ phpldapadmin_become | default(false) }}"
-  gather_facts: "{{ phpldapadmin_gather_facts | default(false) }}"
-  roles:
-    - role: finallycoffee.services.phpldapadmin

playbooks/pretix.yml

@@ -1,7 +0,0 @@
----
-- name: Install and configure pretix
-  hosts: "{{ pretix_hosts | default('pretix') }}"
-  become: "{{ pretix_become | default(true) }}"
-  gather_facts: "{{ pretix_gather_facts | default(false) }}"
-  roles:
-    - role: pretix

roles/authelia/defaults/main.yml

@@ -1,8 +1,9 @@
 ---
-authelia_version: "4.39.9"
+authelia_version: "4.38.18"
 authelia_user: authelia
 authelia_base_dir: /opt/authelia
 authelia_domain: authelia.example.org
+
 authelia_state: present
 authelia_deployment_method: docker
 
@@ -15,7 +16,7 @@ authelia_notification_storage_file: "{{ authelia_data_dir }}/notifications.txt"
 authelia_user_storage_file: "{{ authelia_data_dir }}/user_database.yml"
 
 authelia_container_name: authelia
-authelia_container_image_server: ghcr.io
+authelia_container_image_server: docker.io
 authelia_container_image_namespace: authelia
 authelia_container_image_name: authelia
 authelia_container_image: >-2
@@ -44,7 +45,8 @@ authelia_container_ports: ~
 authelia_container_networks: ~
 authelia_container_purge_networks: ~
 authelia_container_restart_policy: unless-stopped
-authelia_container_state: started
+authelia_container_state: >-2
+  {{ (authelia_state == 'present' | ternary('started', 'absent') }}
 
 authelia_container_listen_port: 9091
 authelia_tls_minimum_version: TLS1.2
@@ -92,11 +94,7 @@ authelia_config_webauthn_disable: true
 authelia_config_webauthn_timeout: 60s
 authelia_config_webauthn_display_name: "Authelia ({{ authelia_domain }})"
 authelia_config_webauthn_attestation_conveyance_preference: indirect
-authelia_config_webauthn_user_verification: "preferred"
-authelia_config_webauthn_selection_criteria_user_verification: >-2
-  {{ authelia_config_webauthn_user_verification }}
-authelia_config_webauthn_selection_criteria_discoverability: "preferred"
-authelia_config_webauthn_selection_criteria_attachment: ""
+authelia_config_webauthn_user_verification: preferred
 authelia_config_duo_api_hostname: ~
 authelia_config_duo_api_integration_key: ~
 authelia_config_duo_api_secret_key: ~
@@ -111,8 +109,6 @@ authelia_config_authentication_backend_password_reset_disable: false
 authelia_config_authentication_backend_password_reset_custom_url: ~
 authelia_config_authentication_backend_ldap_implementation: custom
 authelia_config_authentication_backend_ldap_url: ldap://127.0.0.1:389
-authelia_config_authentication_backend_ldap_address: >-2
-  {{ authelia_config_authentication_backend_ldap_url }}
 authelia_config_authentication_backend_ldap_timeout: 5s
 authelia_config_authentication_backend_ldap_start_tls: false
 authelia_config_authentication_backend_ldap_tls_skip_verify: false
@@ -163,19 +159,6 @@ authelia_config_session_inactivity: 5m
 authelia_config_session_remember_me_duration: 1M
 authelia_config_session_remember_me: >-2
   {{ authelia_config_session_remember_me_duration }}
-authelia_config_session_cookies:
-  - "{{ authelia_config_session_cookies_default }}"
-authelia_config_session_cookies_default_domain: >-2
-  {{ authelia_config_session_domain }}
-authelia_config_session_cookies_default_authelia_url: >-2
-  https://{{ authelia_config_session_cookies_default_domain }}
-authelia_config_session_cookies_default_default_redirection_url: >-2
-  {{ authelia_config_default_redirection_url }}
-authelia_config_session_cookies_default:
-  domain: "{{ authelia_config_session_cookies_default_domain }}"
-  authelia_url: "{{ authelia_config_session_cookies_default_authelia_url }}"
-  default_redirection_url: >-2
-    {{ authelia_config_session_cookies_default_default_redirection_url }}
 authelia_config_session_redis_host: "{{ authelia_redis_host }}"
 authelia_config_session_redis_port: "{{ authelia_redis_port }}"
 authelia_config_session_redis_username: "{{ authelia_redis_user }}"
@@ -212,10 +195,7 @@ authelia_config_notifier_smtp_disable_require_tls: false
 authelia_config_notifier_smtp_disable_html_emails: false
 authelia_config_notifier_smtp_tls_skip_verify: false
 authelia_config_notifier_smtp_tls_minimum_version: "{{ authelia_tls_minimum_version }}"
-authelia_config_identity_validation_reset_password_jwt_secret: >-2
-  {{ authelia_config_jwt_secret }}
-authelia_config_identity_validation_reset_password_jwt_lifespan: "5 minutes"
-authelia_config_identity_validation_reset_password_jwt_algorithm: "HS256"
+#authelia_config_identity_provider_
 
 authelia_database_type: ~
 authelia_database_host: ~

roles/authelia/tasks/deploy-docker.yml

@@ -1,61 +0,0 @@
----
-- name: Ensure container mounts are present
-  when: authelia_state == 'present'
-  block:
-    - name: Ensure sqlite database file exists before mounting it
-      ansible.builtin.file:
-        path: "{{ authelia_sqlite_storage_file }}"
-        state: touch
-        owner: "{{ authelia_run_user }}"
-        group: "{{ authelia_run_group }}"
-        mode: "0640"
-        access_time: preserve
-        modification_time: preserve
-      when: authelia_config_storage_local_path | default(false, true)
-
-    - name: Ensure user database exists before mounting it
-      ansible.builtin.file:
-        path: "{{ authelia_user_storage_file }}"
-        state: touch
-        owner: "{{ authelia_run_user }}"
-        group: "{{ authelia_run_group }}"
-        mode: "0640"
-        access_time: preserve
-        modification_time: preserve
-      when: authelia_config_authentication_backend_file_path | default(false, true)
-
-    - name: Ensure notification reports file exists before mounting it
-      ansible.builtin.file:
-        path: "{{ authelia_notification_storage_file }}"
-        state: touch
-        owner: "{{ authelia_run_user }}"
-        group: "{{ authelia_run_group }}"
-        mode: "0640"
-        access_time: preserve
-        modification_time: preserve
-      when: authelia_config_notifier_filesystem_filename | default(false, true)
-
-- name: Ensure authelia container image is {{ authelia_state }}
-  community.docker.docker_image:
-    name: "{{ authelia_container_image_ref }}"
-    state: "{{ authelia_state }}"
-    source: pull
-    force_source: "{{ authelia_container_image_force_pull }}"
-  register: authelia_container_image_info
-
-- name: Ensure authelia container is {{ authelia_container_state }}
-  community.docker.docker_container:
-    name: "{{ authelia_container_name }}"
-    image: "{{ authelia_container_image_ref }}"
-    env: "{{ authelia_container_env }}"
-    user: "{{ authelia_run_user }}:{{ authelia_run_group }}"
-    ports: "{{ authelia_container_ports | default(omit, true) }}"
-    labels: "{{ authelia_container_labels }}"
-    volumes: "{{ authelia_container_volumes }}"
-    networks: "{{ authelia_container_networks | default(omit, true) }}"
-    etc_hosts: "{{ authelia_container_etc_hosts | default(omit, true) }}"
-    purge_networks: "{{ authelia_container_purge_networks | default(omit, true)}}"
-    restart_policy: "{{ authelia_container_restart_policy }}"
-    recreate: "{{ authelia_container_recreate | default(omit, true) }}"
-    state: "{{ authelia_container_state }}"
-  register: authelia_container_info

roles/authelia/tasks/main.yml

@@ -1,27 +1,17 @@
 ---
-- name: Check for valid state
+- name: Ensure state is valid
   ansible.builtin.fail:
-    msg: >-2
-      Unsupported state '{{ authelia_state }}'.
-      Supported states are {{ authelia_states | join(', ') }}.
+    msg: "Invalid state '{{ authelia_state }}'! Valid states are {{ authelia_states | join(', ') }}"
   when: authelia_state not in authelia_states
 
-- name: Check for valid authelia deployment method
-  ansible.builtin.fail:
-    msg: >-2
-      Unsupported deployment method '{{ authelia_deployment_method }}'.
-      Supported states are {{ authelia_deployment_methods | join(', ') }}.
-  when: authelia_deployment_method not in authelia_deployment_methods
-
 - name: Ensure user {{ authelia_user }} is {{ authelia_state }}
   ansible.builtin.user:
     name: "{{ authelia_user }}"
     state: "{{ authelia_state }}"
     system: true
-    create_home: false
   register: authelia_user_info
 
-- name: Ensure host directories are {{ authelia_state }}
+- name: Ensure host directories are created with correct permissions
   ansible.builtin.file:
     path: "{{ item.path }}"
     state: "{{ (authelia_state == 'present') | ternary('directory', 'absent') }}"
@@ -39,16 +29,16 @@
     - path: "{{ authelia_asset_dir }}"
       mode: "0750"
 
-- name: Ensure config file is {{ authelia_state }}
+- name: Ensure config file is generated
   ansible.builtin.copy:
     content: "{{ authelia_config | to_nice_yaml(indent=2, width=10000) }}"
     dest: "{{ authelia_config_file }}"
     owner: "{{ authelia_run_user }}"
     group: "{{ authelia_run_group }}"
     mode: "0640"
-  notify: restart-authelia
   when: authelia_state == 'present'
+  notify: restart-authelia
 
-- name: Deploy authelia using {{ authelia_deployment_method }}
+- name: Deploy using {{ authelia_deployment_method }}
   ansible.builtin.include_tasks:
     file: "deploy-{{ authelia_deployment_method }}.yml"

roles/authelia/vars/main.yml

@@ -1,9 +1,9 @@
 ---
 authelia_states:
-  - "present"
-  - "absent"
+  - present
+  - absent
 authelia_deployment_methods:
-  - "docker"
+  - docker
 
 authelia_run_user: "{{ (authelia_user_info.uid) if authelia_user_info is defined else authelia_user }}"
 authelia_run_group: "{{ (authelia_user_info.group) if authelia_user_info is defined else authelia_user }}"
@@ -25,6 +25,7 @@ authelia_container_base_labels:
 authelia_config: "{{ authelia_base_config | combine(authelia_extra_config, recursive=True) }}"
 authelia_top_level_config:
   theme: "{{ authelia_config_theme }}"
+  jwt_secret: "{{ authelia_config_jwt_secret }}"
   log: "{{ authelia_config_log }}"
   telemetry: "{{ authelia_config_telemetry }}"
   totp: "{{ authelia_config_totp }}"
@@ -38,11 +39,12 @@ authelia_top_level_config:
   regulation: "{{ authelia_config_regulation }}"
   storage: "{{ authelia_config_storage }}"
   notifier: "{{ authelia_config_notifier }}"
-  identity_validation: "{{ authelia_config_identity_validation }}"
 
 authelia_base_config: >-2
   {{
     authelia_top_level_config
+    | combine({"default_redirection_url": authelia_config_default_redirection_url}
+      if authelia_config_default_redirection_url | default(false, true) else {})
     | combine(({"server": authelia_config_server })
       | combine({"tls": authelia_config_server_tls}
         if authelia_config_server_tls_key | default(false, true) else {}))
@@ -97,10 +99,7 @@ authelia_config_webauthn:
   timeout: "{{ authelia_config_webauthn_timeout }}"
   display_name: "{{ authelia_config_webauthn_display_name }}"
   attestation_conveyance_preference: "{{ authelia_config_webauthn_attestation_conveyance_preference }}"
-  selection_criteria:
-    attachment: "{{ authelia_config_webauthn_selection_criteria_attachment }}"
-    discoverability: "{{ authelia_config_webauthn_selection_criteria_discoverability }}"
-    user_verification: "{{ authelia_config_webauthn_selection_criteria_user_verification }}"
+  user_verification: "{{ authelia_config_webauthn_user_verification }}"
 authelia_config_duo_api:
   hostname: "{{ authelia_config_duo_api_hostname }}"
   integration_key: "{{ authelia_config_duo_api_integration_key }}"
@@ -129,7 +128,7 @@ authelia_config_authentication_backend_password_reset:
   disable: "{{ authelia_config_authentication_backend_password_reset_disable }}"
 authelia_config_authentication_backend_ldap:
   implementation: "{{ authelia_config_authentication_backend_ldap_implementation }}"
-  address: "{{ authelia_config_authentication_backend_ldap_address }}"
+  url: "{{ authelia_config_authentication_backend_ldap_url }}"
   timeout: "{{ authelia_config_authentication_backend_ldap_timeout }}"
   start_tls: "{{ authelia_config_authentication_backend_ldap_start_tls }}"
   tls:
@@ -183,12 +182,12 @@ authelia_config_session: >-2
   }}
 authelia_config_session_base:
   name: "{{ authelia_config_session_name }}"
+  domain: "{{ authelia_config_session_domain }}"
   same_site: "{{ authelia_config_session_same_site }}"
   secret: "{{ authelia_config_session_secret }}"
   expiration: "{{ authelia_config_session_expiration }}" 
   inactivity: "{{ authelia_config_session_inactivity }}"
   remember_me: "{{ authelia_config_session_remember_me }}"
-  cookies: "{{ authelia_config_session_cookies }}"
 authelia_config_session_redis: >-2
   {{
     {
@@ -275,9 +274,3 @@ authelia_config_notifier_smtp:
   tls:
     skip_verify: "{{ authelia_config_notifier_smtp_tls_skip_verify }}"
     minimum_version: "{{ authelia_config_notifier_smtp_tls_minimum_version }}"
-authelia_config_identity_validation:
-  reset_password: "{{ authelia_config_identity_validation_reset_password }}"
-authelia_config_identity_validation_reset_password:
-  jwt_secret: "{{ authelia_config_identity_validation_reset_password_jwt_secret }}"
-  jwt_lifespan: "{{ authelia_config_identity_validation_reset_password_jwt_lifespan }}"
-  jwt_algorithm: "{{ authelia_config_identity_validation_reset_password_jwt_algorithm }}"

roles/ghost/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 ghost_domain: ~
-ghost_version: "6.0.7"
+ghost_version: "5.105.0"
 ghost_user: ghost
 ghost_user_group: ghost
 ghost_base_path: /opt/ghost

roles/gitea/defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-gitea_version: "1.24.6"
+gitea_version: "1.23.1"
 gitea_user: git
 gitea_run_user: "{{ gitea_user }}"
 gitea_base_path: "/opt/gitea"
@@ -32,7 +32,6 @@ gitea_container_extra_labels: {}
 gitea_container_extra_ports: []
 gitea_container_extra_volumes: []
 gitea_container_state: started
-gitea_container_user: ~
 
 # container defaults
 gitea_container_base_volumes:

roles/gitea/tasks/main.yml

@@ -1,4 +1,5 @@
 ---
+
 - name: Ensure gitea user '{{ gitea_user }}' is present
   ansible.builtin.user:
     name: "{{ gitea_user }}"
@@ -74,7 +75,6 @@
     published_ports: "{{ gitea_container_ports }}"
     restart_policy: "{{ gitea_container_restart_policy }}"
     state: "{{ gitea_container_state }}"
-    user: "{{ gitea_container_user | default(omit, true) }}"
 
 - name: Ensure given configuration is set in the config file
   ansible.builtin.ini_file:

roles/hedgedoc/defaults/main/main.yml

@@ -1,6 +1,6 @@
 ---
 hedgedoc_user: hedgedoc
-hedgedoc_version: "1.10.3"
+hedgedoc_version: "1.10.0"
 
 hedgedoc_state: present
 hedgedoc_deployment_method: docker

roles/hedgedoc/tasks/deploy-podman.yml

@@ -1,31 +0,0 @@
----
-- name: Ensure container image '{{ hedgedoc_container_image }}' is {{ hedgedoc_state }}
-  containers.podman.podman_image:
-    name: "{{ hedgedoc_container_image }}"
-    state: "{{ hedgedoc_state }}"
-    pull: "{{ (hedgedoc_container_image_source == 'pull') | bool }}"
-    force: >-2
-      {{ hedgedoc_container_force_source | default(
-        hedgedoc_container_image_tag | default(false, true), true) }}
-  register: hedgedoc_container_image_info
-  until: hedgedoc_container_image_info is success
-  retries: 5
-  delay: 3
-
-- name: Ensure container '{{ hedgedoc_container_name }}' is {{ hedgedoc_container_state }}
-  containers.podman.podman_container:
-    name: "{{ hedgedoc_container_name }}"
-    image: "{{ hedgedoc_container_image }}"
-    env: "{{ hedgedoc_container_env | default(omit, true) }}"
-    user: "{{ hedgedoc_container_user | default(omit, true) }}"
-    ports: "{{ hedgedoc_container_ports | default(omit, true) }}"
-    labels: "{{ hedgedoc_container_all_labels }}"
-    volumes: "{{ hedgedoc_container_all_volumes }}"
-    etc_hosts: "{{ hedgedoc_container_etc_hosts | default(omit, true) }}"
-    dns_servers: >-2
-      {{ hedgedoc_container_dns_servers | default(omit, true) }}
-    network_mode: >-2
-      {{ hedgedoc_container_network_mode | default(omit, true) }}
-    restart_policy: >-2
-      {{ hedgedoc_container_restart_policy | default(omit, true) }}
-    state: "{{ hedgedoc_container_state }}"

roles/jellyfin/defaults/main.yml

@@ -1,8 +1,7 @@
 ---
 jellyfin_user: jellyfin
-jellyfin_version: "10.10.7"
+jellyfin_version: "10.10.3"
 jellyfin_state: present
-jellyfin_deployment_method: docker
 
 jellyfin_base_path: /opt/jellyfin
 jellyfin_config_path: "{{ jellyfin_base_path }}/config"

roles/jellyfin/tasks/deploy-docker.yml

@@ -1,25 +0,0 @@
----
-- name: Ensure container image '{{ jellyfin_container_image_ref }}' is {{ jellyfin_state }}
-  community.docker.docker_image:
-    name: "{{ jellyfin_container_image_ref }}"
-    state: "{{ jellyfin_state }}"
-    source: "{{ jellyfin_container_image_source }}"
-    force_source: "{{ jellyfin_container_image_tag | default(false, true) }}"
-  register: jellyfin_container_image_pull_result
-  until: jellyfin_container_image_pull_result is succeeded
-  retries: 5
-  delay: 3
-
-- name: Ensure container '{{ jellyfin_container_name }}' is {{ jellyfin_container_state }}
-  community.docker.docker_container:
-    name: "{{ jellyfin_container_name }}"
-    image: "{{ jellyfin_container_image_ref }}"
-    user: "{{ jellyfin_uid }}:{{ jellyfin_gid }}"
-    labels: "{{ jellyfin_container_labels }}"
-    volumes: "{{ jellyfin_container_volumes }}"
-    ports: "{{ jellyfin_container_ports | default(omit, true) }}"
-    networks: "{{ jellyfin_container_networks | default(omit, true) }}"
-    network_mode: "{{ jellyfin_container_network_mode }}"
-    etc_hosts: "{{ jellyfin_container_etc_hosts | default(omit, true) }}"
-    restart_policy: "{{ jellyfin_container_restart_policy }}"
-    state: "{{ jellyfin_container_state }}"

roles/jellyfin/tasks/deploy-podman.yml

@@ -1,22 +0,0 @@
----
-- name: Ensure container image '{{ jellyfin_container_image_ref }}' is {{ jellyfin_state }}
-  containers.podman.podman_image:
-    name: "{{ jellyfin_container_image_ref }}"
-    state: "{{ jellyfin_state }}"
-    pull: "{{ (jellyfin_container_image_source == 'pull') | bool }}"
-    force: "{{ jellyfin_container_image_tag | default(false, true) }}"
-  register: jellyfin_container_image_pull_result
-  until: jellyfin_container_image_pull_result is succeeded
-  retries: 5
-  delay: 3
-
-- name: Ensure container '{{ jellyfin_container_name }}' is {{ jellyfin_container_state }}
-  containers.podman.podman_container:
-    name: "{{ jellyfin_container_name }}"
-    image: "{{ jellyfin_container_image_ref }}"
-    user: "{{ jellyfin_uid }}:{{ jellyfin_gid }}"
-    labels: "{{ jellyfin_container_labels }}"
-    volumes: "{{ jellyfin_container_volumes }}"
-    network: "{{ jellyfin_container_networks | default(omit, True) }}"
-    restart_policy: "{{ jellyfin_container_restart_policy }}"
-    state: "{{ jellyfin_container_state }}"

roles/jellyfin/tasks/main.yml

@@ -6,13 +6,6 @@
       states are {{ jellyfin_states | join(', ') }}.
   when: jellyfin_state not in jellyfin_states
 
-- name: Check if deployment method is valid
-  ansible.builtin.fail:
-    msg: >-2
-      Unsupported state '{{ jellyfin_deployment_method }}'. Supported
-      states are {{ jellyfin_deployment_methods | join(', ') }}.
-  when: jellyfin_deployment_method not in jellyfin_deployment_methods
-
 - name: Ensure jellyfin user '{{ jellyfin_user }}' is {{ jellyfin_state }}
   ansible.builtin.user:
     name: "{{ jellyfin_user }}"
@@ -30,6 +23,25 @@
     mode: "{{ item.mode }}"
   loop: "{{ jellyfin_host_directories }}"
 
-- name: Ensure jellyfin is deployed using {{ jellyfin_deployment_method }}
-  ansible.builtin.include_tasks:
-    file: "deploy-{{ jellyfin_deployment_method }}.yml"
+- name: Ensure container image '{{ jellyfin_container_image_ref }}' is {{ jellyfin_state }}
+  community.docker.docker_image:
+    name: "{{ jellyfin_container_image_ref }}"
+    state: "{{ jellyfin_state }}"
+    source: "{{ jellyfin_container_image_source }}"
+    force_source: "{{ jellyfin_container_image_tag | default(false, true) }}"
+  register: jellyfin_container_image_pull_result
+  until: jellyfin_container_image_pull_result is succeeded
+  retries: 5
+  delay: 3
+
+- name: Ensure container '{{ jellyfin_container_name }}' is {{ jellyfin_container_state }}
+  community.docker.docker_container:
+    name: "{{ jellyfin_container_name }}"
+    image: "{{ jellyfin_container_image_ref }}"
+    user: "{{ jellyfin_uid }}:{{ jellyfin_gid }}"
+    labels: "{{ jellyfin_container_labels }}"
+    volumes: "{{ jellyfin_container_volumes }}"
+    networks: "{{ jellyfin_container_networks | default(omit, True) }}"
+    network_mode: "{{ jellyfin_container_network_mode }}"
+    restart_policy: "{{ jellyfin_container_restart_policy }}"
+    state: "{{ jellyfin_container_state }}"

roles/jellyfin/vars/main.yml

@@ -2,9 +2,6 @@
 jellyfin_states:
   - present
   - absent
-jellyfin_deployment_methods:
-  - docker
-  - podman
 
 jellyfin_container_base_volumes:
   - "{{ jellyfin_config_path }}:/config:z"

roles/keycloak/defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-keycloak_version: "26.3.3"
+keycloak_version: 26.0.7
 keycloak_container_name: keycloak
 
 keycloak_container_image_upstream_registry: quay.io

roles/keycloak/templates/Dockerfile.j2

@@ -10,9 +10,7 @@ ENV KC_DB=$DB_VENDOR
 
 WORKDIR {{ keycloak_container_working_directory }}
 
-{% if keycloak_container_image_add_local_providers | default(true) %}
 ADD ./providers/* providers/
-{% endif %}
 # Workaround to set correct mode on jar files
 USER root
 RUN chmod -R 0770 providers/*

roles/phpldapadmin/README.md

@@ -1,3 +0,0 @@
-# `finallycoffee.services.phpldapadmin`
-
-Role to deploy and configure [phpldapadmin](https://github.com/leenooks/phpLDAPadmin).

roles/phpldapadmin/defaults/main/container.yml

@@ -1,39 +0,0 @@
----
-phpldapadmin_container_name: phpldapadmin
-phpldapadmin_container_image_registry: docker.io
-phpldapadmin_container_image_namespace: phpldapadmin
-phpldapadmin_container_image_name: phpldapadmin
-phpldapadmin_container_image_repository: >-2
-  {{
-    [
-      phpldapadmin_container_image_registry | default([], true),
-      phpldapadmin_container_image_namespace | default([], true),
-      phpldapadmin_container_image_name
-    ] | flatten | join('/')
-  }}
-phpldapadmin_container_image: >-2
-  {{
-    [
-      phpldapadmin_container_image_repository,
-      phpldapadmin_container_image_tag | default(phpldapadmin_version, true)
-    ] | join(':')
-  }}
-phpldapadmin_container_image_tag: ~
-phpldapadmin_container_image_source: pull
-phpldapadmin_container_image_force_source: >-2
-  {{ phpldapadmin_container_image_tag | default(false, true) }}
-phpldapadmin_container_env: ~
-phpldapadmin_container_user: ~
-phpldapadmin_container_ports: ~
-phpldapadmin_container_labels: ~
-phpldapadmin_container_volumes: ~
-phpldapadmin_container_networks: ~
-phpldapadmin_container_network_mode: ~
-phpldapadmin_container_dns_servers: ~
-phpldapadmin_container_etc_hosts: ~
-phpldapadmin_container_memory: ~
-phpldapadmin_container_memory_swap: ~
-phpldapadmin_container_memory_reservation: ~
-phpldapadmin_container_restart_policy: "on-failure"
-phpldapadmin_container_state: >-2
-  {{ (phpldapadmin_state == 'present') | ternary('started', 'absent') }}

roles/phpldapadmin/defaults/main/main.yml

@@ -1,5 +0,0 @@
----
-phpldapadmin_version: "2.3.1"
-
-phpldapadmin_state: present
-phpldapadmin_deployment_method: docker

roles/phpldapadmin/tasks/deploy-docker.yml

@@ -1,27 +0,0 @@
----
-- name: Ensure phpldapadmin container image '{{ phpldapadmin_container_image }}' is {{ phpldapadmin_state }}
-  community.docker.docker_image:
-    name: "{{ phpldapadmin_container_image }}"
-    state: "{{ phpldapadmin_state }}"
-    source: "{{ phpldapadmin_container_image_source }}"
-    force_source: "{{ phpldapadmin_container_image_force_source }}"
-
-- name: Ensure phpldapadmin container '{{ phpldapadmin_container_name }}' is {{ phpldapadmin_container_state }}
-  community.docker.docker_container:
-    name: "{{ phpldapadmin_container_name }}"
-    image: "{{ phpldapadmin_container_image }}"
-    env: "{{ phpldapadmin_container_env | default(omit, true) }}"
-    user: "{{ phpldapadmin_container_user | default(omit, true) }}"
-    ports: "{{ phpldapadmin_container_ports | default(omit, true) }}"
-    labels: "{{ phpldapadmin_container_labels | default(omit, true) }}"
-    volumes: "{{ phpldapadmin_container_volumes | default(omit, true) }}"
-    networks: "{{ phpldapadmin_container_networks | default(omit, true) }}"
-    network_mode: "{{ phpldapadmin_container_network_mode | default(omit, true) }}"
-    dns_servers: "{{ phpldapadmin_container_dns_servers | default(omit, true) }}"
-    etc_hosts: "{{ phpldapadmin_container_etc_hosts | default(omit, true) }}"
-    memory: "{{ phpldapadmin_container_memory | default(omit, true) }}"
-    memory_swap: "{{ phpldapadmin_container_memory_swap | default(omit, true) }}"
-    memory_reservation: >-2
-      {{ phpldapadmin_container_memory_reservation | default(omit, true) }}
-    restart_policy: "{{ phpldapadmin_container_restart_policy | default(omit, true) }}"
-    state: "{{ phpldapadmin_container_state }}"

roles/phpldapadmin/tasks/main.yml

@@ -1,18 +0,0 @@
----
-- name: Ensure 'phpldapadmin_state' is valid
-  ansible.builtin.fail:
-    msg: >-2
-      Unsupported state '{{ phpldapadmin_state }}'!
-      Supported states are {{ phpldapadmin_states | join(', ') }}
-  when: phpldapadmin_state not in phpldapadmin_states
-
-- name: Ensure 'phpldapadmin_deployment_method' is valid
-  ansible.builtin.fail:
-    msg: >-2
-      Unsupported deployment method '{{ phpldapadmin_deployment_method }}'!
-      Supported deployment methods are {{ phpldapadmin_deployment_methods | join(', ') }}
-  when: phpldapadmin_deployment_method not in phpldapadmin_deployment_methods
-
-- name: Deploy using {{ phpldapadmin_deployment_method }}
-  ansible.builtin.import_tasks:
-    file: "deploy-{{ phpldapadmin_deployment_method }}.yml"

roles/phpldapadmin/vars/main.yml

@@ -1,6 +0,0 @@
----
-phpldapadmin_states:
-  - "present"
-  - "absent"
-phpldapadmin_deployment_methods:
-  - "docker"

roles/pretix/README.md

@@ -1,16 +0,0 @@
-# `finallycoffee.services.pretix` ansible role
-
-
-## Troubleshooting
-
-### virtualenv
-
-By default, the virtualenv is located in `/var/lib/pretix/virtualenv`.
-This can be controlled by setting `pretix_virtualenv_dir`.
-
-NOTE: To fix a broken virtualenv, try setting `pretix_virtualenv_state` to `forcereinstall` (see
-[`ansible.builtin.pip` on docs.ansible.com](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/pip_module.html)).
-
-NOTE: To install pip packages or execute migrations in the virtualenv, ansible
-needs to become the unprivilated `pretix_user` (default: `pretix`). This might
-require having the `acl` system package installed.

roles/pretix/defaults/main/main.yml

@@ -1,14 +0,0 @@
----
-pretix_version: "2025.7.1"
-pretix_state: "present"
-pretix_deployment_method: "systemd"
-
-pretix_config_file: "/etc/pretix/pretix.cfg"
-pretix_config_file_owner: "{{ pretix_user_id }}"
-pretix_config_file_group: "{{ pretix_group_id }}"
-pretix_config_file_mode: "0640"
-pretix_config_dir: "{{ pretix_config_file | dirname }}"
-pretix_install_dir: "/var/lib/pretix"
-pretix_virtualenv_dir: "{{ pretix_install_dir }}/virtualenv"
-pretix_data_dir: "{{ pretix_install_dir }}/data"
-pretix_media_dir: "{{ pretix_data_dir }}/media"

roles/pretix/defaults/main/system_packages.yml

@@ -1,21 +0,0 @@
----
-pretix_debian_packages:
-  - "git"
-  - "build-essential"
-  - "python3-dev"
-  - "python3-venv"
-  - "python3"
-  - "python3-pip"
-  - "libxml2-dev"
-  - "libxslt1-dev"
-  - "libffi-dev"
-  - "zlib1g-dev"
-  - "libssl-dev"
-  - "gettext"
-  - "libpq-dev"
-  - "libjpeg-dev"
-  - "libopenjp2-7-dev"
-
-pretix_packages:
-  "debian":
-    "12": "{{ pretix_debian_packages }}"

roles/pretix/defaults/main/systemd.yml

@@ -1,19 +0,0 @@
----
-pretix_systemd_unit_description: "pretix web service"
-pretix_systemd_unit_after: "network.target"
-
-pretix_systemd_service_user: "{{ pretix_user }}"
-pretix_systemd_service_group: "{{ pretix_user }}"
-pretix_systemd_service_environment:
-  VIRTUAL_ENV: "{{ pretix_virtualenv_dir }}"
-pretix_systemd_service_working_directory: "{{ pretix_install_dir }}"
-pretix_systemd_service_exec_start: >-2
-  {{ pretix_virtualenv_dir }}/bin/gunicorn pretix.wsgi
-  --name pretix
-  --workers 5
-  --max-requests 100
-  --log-level=info
-  --bind=127.0.0.1:8345
-pretix_systemd_service_restart: "on-failure"
-
-pretix_systemd_install_wanted_by: "multi-user.target"

roles/pretix/defaults/main/user.yml

@@ -1,7 +0,0 @@
----
-pretix_user: "pretix"
-pretix_user_system: true
-pretix_user_create_home: false
-
-pretix_user_id: "{{ pretix_user_info.uid | default(pretix_user) }}"
-pretix_group_id: "{{ pretix_user_info.group | default(pretix_user) }}"

roles/pretix/defaults/main/virtualenv.yml

@@ -1,11 +0,0 @@
----
-pretix_virtualenv_state: "{{ pretix_state }}"
-pretix_virtualenv_packages:
-  - "pip"
-  - "setuptools"
-  - "wheel"
-  - "gunicorn"
-  - "pretix=={{ pretix_version }}"
-
-pretix_virtualenv_site_packages: false
-pretix_virtualenv_command: "virtualenv"

roles/pretix/meta/main.yml

@@ -1,9 +0,0 @@
----
-allow_duplicates: true
-dependencies: []
-galaxy_info:
-  role_name: pretix
-  description: Ansible role to deploy pretix (https://pretix.eu)
-  galaxy_tags:
-    - pretix
-    - ticketing

roles/pretix/tasks/check.yml

@@ -1,14 +0,0 @@
----
-- name: Ensure 'pretix_state' is valid
-  ansible.builtin.fail:
-    msg: >-2
-      Unsupported pretix_state '{{ pretix_state }}'.
-      Supported states are {{ pretix_states | join(', ') }}
-  when: pretix_state not in pretix_states
-
-- name: Ensure 'pretix_deployment_method' is valid
-  ansible.builtin.fail:
-    msg: >-2
-      Unsupported pretix_state '{{ pretix_deployment_method }}'.
-      Supported states are {{ pretix_deployment_methods | join(', ') }}
-  when: pretix_deployment_method not in pretix_deployment_methods

roles/pretix/tasks/configure.yml

@@ -1,9 +0,0 @@
----
-- name: Ensure configuration file is written
-  ansible.builtin.copy:
-    path: "{{ pretix_config_file }}"
-    content: "{{ pretix_config_file_content }}"
-    owner: "{{ pretix_config_file_owner }}"
-    group: "{{ pretix_config_file_group }}"
-    mode: "{{ pretix_config_file_mode }}"
-  when: ansible_state == 'present'

roles/pretix/tasks/deploy-systemd.yml

@@ -1,19 +0,0 @@
----
-- name: Ensure virtualenv in {{ pretix_virtualenv_dir }} is present
-  ansible.builtin.pip:
-    name: "{{ pretix_virtualenv_packages }}"
-    state: "{{ pretix_virtualenv_state }}"
-    chdir: "{{ pretix_install_dir }}"
-    virtualenv: "{{ pretix_virtualenv_dir }}"
-    virtualenv_command: "{{ pretix_virtualenv_command }}"
-    virtualenv_site_packages: "{{ pretix_virtualenv_site_packages }}"
-  become: true
-  become_user: "{{ pretix_user }}"
-
-# TODO: determine to only do this on a) upgrades or b) initial deployis
-- name: Ensure pretix static assets are built
-  ansible.builtin.command:
-    cmd: "{{ pretix_virtualenv_dir }}/bin/python -m pretix rebuild"
-    chdir: "{{ pretix_install_dir }}"
-  environment:
-    VIRTUAL_ENV: "{{ pretix_virtualenv_dir }}"

roles/pretix/tasks/deploy.yml

@@ -1,5 +0,0 @@
----
-- name: Ensure pretix is deployed using {{ pretix_deployment_method }}
-  ansible.builtin.include_tasks:
-    file: "deploy-{{ pretix_deployment_method }}.yml"
-  when: pretix_state == 'present'

roles/pretix/tasks/main.yml

@@ -1,16 +0,0 @@
----
-- name: Ensure preconditions are met
-  ansible.builtin.include_tasks:
-    file: "check.yml"
-
-- name: Ensure deployment preparations are done
-  ansible.builtin.include_tasks:
-    file: "prepare.yml"
-
-- name: Ensure pretix is configured
-  ansible.builtin.include_tasks:
-    file: "configure.yml"
-
-- name: Ensure pretix is deployed
-  ansible.builtin.include_tasks:
-    file: "deploy.yml"

roles/pretix/tasks/prepare-systemd.yml

@@ -1,19 +0,0 @@
----
-- name: Ensure ansible facts are collected
-  ansible.builtin.setup:
-    gather_subset:
-      - "!all"
-      - "pkg_mgr"
-      - "distribution"
-      - "distribution_release"
-      - "distribution_version"
-      - "distribution_major_version"
-
-- name: Ensure system packages are present (apt)
-  ansible.builtin.apt:
-    name: "{{ package }}"
-    state: "{{ pretix_state }}"
-  loop: "{{ pretix_packages[ansible_distribution | lower] }}"
-  loop_control:
-    loop_var: "package"
-  when: ansible_facts['pkg_mgr'] == 'apt'

roles/pretix/tasks/prepare.yml

@@ -1,29 +0,0 @@
----
-- name: Ensure pretix user '{{ pretix_user }}' is {{ pretix_state }}
-  ansible.builtin.user:
-    name: "{{ pretix_user }}"
-    state: "{{ pretix_state }}"
-    system: "{{ pretix_user_system }}"
-    create_home: "{{ pretix_user_create_home }}"
-  register: pretix_user_info
-
-- name: Ensure host directories are {{ pretix_state }}
-  ansible.builtin.file:
-    path: "{{ item.path }}"
-    owner: "{{ item.owner | default(pretix_user_id) }}"
-    group: "{{ item.group | default(pretix_group_id) }}"
-    mode: "{{ item.mode | default('0750') }}"
-    state: "directory"
-  loop:
-    - path: "{{ pretix_config_dir }}"
-    - path: "{{ pretix_virtualenv_dir }}"
-    - path: "{{ pretix_data_dir }}"
-    - path: "{{ pretix_media_dir }}"
-  when: pretix_state == 'present'
-
-- name: Ensure deployment-type specific preparations for '{{ pretix_deployment_method }}' are run
-  ansible.builtin.include_tasks:
-    file: "prepare-{{ pretix_deployment_method }}.yml"
-  when:
-    - pretix_state == 'present'
-    - pretix_deployment_method in ['systemd']

roles/pretix/templates/pretix.service.j2

@@ -1,16 +0,0 @@
-[Unit]
-Description={{ pretix_systemd_unit_description }}
-After={{ pretix_systemd_unit_after }}
-
-[Service]
-User={{ pretix_systemd_service_user }}
-Group={{ pretix_systemd_service_group }}
-{% for kv in pretix_systemd_service_environment | dict2items %}
-Environment="{{ kv.key }}={{ kv.value }}"
-{% endfor %}
-WorkingDirectory={{ pretix_systemd_service_working_directory }}
-ExecStart={{ pretix_systemd_service_exec_start }}
-Restart={{ pretix_systemd_service_restart }}
-
-[Install]
-WantedBy={{ pretix_systemd_install_wanted_by }}

roles/pretix/vars/main.yml

@@ -1,7 +0,0 @@
----
-pretix_states:
-  - "present"
-  - "absent"
-
-pretix_deployment_methods:
-  - "systemd"

roles/snipe_it/defaults/main/container.yml

@@ -1,6 +1,6 @@
 ---
 snipe_it_container_image_registry: docker.io
-snipe_it_container_image_namespace: 'snipe'
+snipe_it_container_image_namespace: snipe
 snipe_it_container_image_name: 'snipe-it'
 snipe_it_container_image_tag: ~
 snipe_it_container_image_flavour: alpine

roles/snipe_it/defaults/main/main.yml

@@ -1,6 +1,6 @@
 ---
 snipe_it_user: snipeit
-snipe_it_version: "8.3.1"
+snipe_it_version: "7.1.15"
 snipe_it_domain: ~
 snipe_it_state: present
 snipe_it_deployment_method: docker

roles/vaultwarden/defaults/main/main.yml

@@ -1,6 +1,6 @@
 ---
 vaultwarden_user: vaultwarden
-vaultwarden_version: "1.34.3"
+vaultwarden_version: "1.32.7"
 
 vaultwarden_config_file: "/etc/vaultwarden/config.json"
 vaultwarden_config_directory: "{{ vaultwarden_config_file | dirname }}"

roles/vaultwarden/tasks/deploy-docker.yml

@@ -20,5 +20,3 @@
     dns_servers: "{{ vaultwarden_container_dns_servers | default(omit, true) }}"
     restart_policy: "{{ vaultwarden_container_restart_policy | default(omit, true) }}"
     state: "{{ vaultwarden_container_state | default(omit, true) }}"
-    comparisons:
-      'env': 'strict'

roles/vaultwarden/tasks/deploy-podman.yml

@@ -1,22 +0,0 @@
----
-- name: Ensure container image '{{ vaultwarden_container_image }}' is {{ vaultwarden_state }}
-  containers.podman.podman_image:
-    name: "{{ vaultwarden_container_image }}"
-    state: "{{ vaultwarden_state }}"
-    pull: "{{ (vaultwarden_container_image_source == 'pull') | bool }}"
-    force: "{{ vaultwarden_container_image_force_source }}"
-
-- name: Ensure container '{{ vaultwarden_container_name }}' is {{ vaultwarden_container_state }}
-  containers.podman.podman_container:
-    name: "{{ vaultwarden_container_name }}"
-    image: "{{ vaultwarden_container_image }}"
-    env: "{{ vaultwarden_container_env | default(omit, true) }}"
-    user: "{{ vaultwarden_container_user | default(omit, true) }}"
-    ports: "{{ vaultwarden_container_ports | default(omit, true) }}"
-    labels: "{{ vaultwarden_container_labels | default(omit, true) }}"
-    volumes: "{{ vaultwarden_container_volumes }}"
-    network: "{{ vaultwarden_container_networks | default(omit, true) }}"
-    etc_hosts: "{{ vaultwarden_container_etc_hosts | default(omit, true) }}"
-    dns_servers: "{{ vaultwarden_container_dns_servers | default(omit, true) }}"
-    restart_policy: "{{ vaultwarden_container_restart_policy | default(omit, true) }}"
-    state: "{{ vaultwarden_container_state | default(omit, true) }}"

roles/vaultwarden/vars/main.yml

@@ -4,7 +4,6 @@ vaultwarden_states:
   - absent
 vaultwarden_deployment_methods:
   - docker
-  - podman
 vaultwarden_required_variables:
   - vaultwarden_config_domain
 vaultwarden_conditionally_required_variables:

roles/vouch_proxy/defaults/main.yml

@@ -1,6 +1,7 @@
 ---
+
 vouch_proxy_user: vouch-proxy
-vouch_proxy_version: "0.45.0"
+vouch_proxy_version: 0.40.0
 vouch_proxy_base_path: /opt/vouch-proxy
 vouch_proxy_config_path: "{{ vouch_proxy_base_path }}/config"
 vouch_proxy_config_file: "{{ vouch_proxy_config_path }}/config.yaml"