d9

ENABLED=true

.ansible-lint

@@ -6,21 +6,3 @@ skip_list:
   - name[play]
   - var-naming[no-role-prefix]
 quiet: true
-exclude_paths:
-  - .cache/ # implicit unless exclude_paths is defined in config
-  - collections/
-  - .gitlab-ci.yml
-  - friedhof/
-  - playbooks/on-off
-  - roles/geerlingguy-ansible-role-pip
-  - roles/pyratlabs-ansible-role-k3s
-  - roles/robertdebock-ansible-role-bootstrap
-  - roles/gantsign-ansible-role-ctop
-  - roles/geerlingguy-ansible-role-docker
-  - roles/geerlingguy-ansible-role-helm
-  - roles/geerlingguy-ansible-role-nfs
-  - roles/hifis-net-ansible-role-unattended-upgrades
-  - roles/mrlesmithjr-ansible-manage-lvm
-  - roles/oefenweb-ansible-ufw
-  - roles/pandemonium1986-ansible-role-k9s
-  - roles/pyratlabs-ansible-role-gitea

.gitea/workflows/lint.yml

@@ -0,0 +1,31 @@
+---
+name: lint
+on:
+  push
+
+jobs:
+  clone:
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v3
+
+  gitleaks:
+    container:
+      image: zricethezav/gitleaks:latest
+    steps:
+      - run: ls -lah
+      - name: gitleaks
+        run: gitleaks detect --no-git --verbose --source $GITHUB_WORKSPACE
+
+  ansible-lint:
+    container:
+      image: quay.io/ansible/creator-ee
+      env:
+        VAULT-PASS: ${{ secrets.vault_pass }} # Repo-Secret
+    steps:
+      - run: ansible-lint --version
+      - run: echo $VAULT-PASS > ./vault-pass.yml # nach des Secret in Großschreibung
+      - run: ls -lah
+
+      - run: ansible-galaxy install -r ./requirements.yml
+      - run: ansible-lint --force-color --format pep8

.gitignore

@@ -15,3 +15,4 @@ roles/oefenweb-ansible-ufw
 roles/pandemonium1986-ansible-role-k9s
 roles/pyratlabs-ansible-role-gitea
 collections/
+plugins/lookup/__pycache__/

.woodpecker/ansible-lint.yml

@@ -1,19 +0,0 @@
----
-kind: pipeline
-type: docker
-name: ansible-lint
-depends_on:
-  - gitleaks
-steps:
-  ansible-lint:
-    image: quay.io/ansible/creator-ee
-    commands:
-      - ansible-lint --version
-      - echo $VAULT-PASS > ./vault-pass.yml # nach des Secret in Großschreibung
-      - ansible-galaxy install -r requirements.yml
-      - ansible-lint --force-color --format pep8
-    when:
-      event:
-        exclude:
-          - tag
-    secret: [vault-pass] #dieses Secret darf verwendet werden

.woodpecker/gitleaks.yml

@@ -1,13 +0,0 @@
----
-kind: pipeline
-type: docker
-name: gitleaks
-steps:
-  gitleaks:
-    image: zricethezav/gitleaks:latest
-    commands:
-      - gitleaks detect --no-git --verbose --source $CI_WORKSPACE
-    when:
-      event:
-        exclude:
-          - tag

docker-compose/gitea-act-runner/docker-compose.yml.j2

@@ -0,0 +1,18 @@
+version: '3'
+services:
+  runner:
+    container_name: "gitea-act-runner"
+    image: gitea/act_runner:latest
+    restart: always
+    volumes:
+      - data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      GITEA_INSTANCE_URL: "https://git.mgrote.net"
+      GITEA_RUNNER_REGISTRATION_TOKEN: {{ lookup('keepass', 'gitea_runner_token', 'password') }} # muss für jeden Runner neu generiert werden, wird nur einmal benötigt
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+
+
+volumes:
+  data:

group_vars/docker.yml

@@ -50,7 +50,7 @@ docker_users:
   - mg
   - docker-user
 docker_install_compose: true
-docker_add_repo: false # erstelle kein Repo-Eintrag unter /etc/apt/sources.list.d/, steht explizit unter "repos_override"
+docker_add_repo: false # erstelle kein Repo-Eintrag unter /etc/apt/sources.list.d/, steht explizit unter "repos_override", wird nur zum installieren benötigt
 
 ### mgrote_docker-compose-deploy
 docker_compose_base_dir: /home/docker-user

group_vars/gitea.yml

@@ -54,7 +54,7 @@ gitea_show_user_email: false
 gitea_disable_gravatar: true
 gitea_enable_captcha: true
 gitea_only_allow_external_registration: false
-gitea_enable_notify_mail: false
+gitea_enable_notify_mail: true
 gitea_force_private: false
 gitea_oauth2_enabled: true
 gitea_repo_indexer_enabled: true
@@ -96,6 +96,7 @@ gitea_fail2ban_jail_bantime: 600
 gitea_extra_config: |
   [webhook]
   ALLOWED_HOST_LIST = *.mgrote.net
-
+  [actions]
+  ENABLED=true
 gitea_backup_on_upgrade: false
 gitea_backup_location: "{{ gitea_home }}/backups/"

host_vars/docker10.mgrote.net.yml

@@ -76,7 +76,9 @@ compose_files:
     network: traefik
   - name: statping-ng
     state: present
-
+  - name: gitea-act-runner
+    state: present
+    
 ### oefenweb.ufw
 ufw_rules:
   - rule: allow