--- ### mrlesmithjr.ansible-manage-lvm lvm_groups: - vgname: vg_gitea_data disks: - /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi1 create: true lvnames: - lvname: lv_gitea_data size: +100%FREE create: true filesystem: xfs mount: true mntp: /var/lib/gitea manage_lvm: true pvresize_to_max: true ### mgrote.restic restic_folders_to_backup: "/ /var/lib/gitea" # --one-file-system ist gesetzt, also werden weitere Dateisysteme nicht eingeschlossen, es sei denn sie werden hier explizit angegeben; https://restic.readthedocs.io/en/latest/040_backup.html#excluding-files ### oefenweb.ufw ufw_rules: - rule: allow to_port: 22 protocol: tcp comment: 'ssh' from_ip: 0.0.0.0/0 - rule: allow to_port: "{{ gitea_http_port }}" protocol: tcp comment: 'gitea' from_ip: 0.0.0.0/0 - rule: allow to_port: "{{ gitea_ssh_port }}" protocol: tcp comment: 'gitea' from_ip: 0.0.0.0/0 - rule: allow to_port: 4949 protocol: tcp comment: 'munin' from_ip: 192.168.2.144/24 ### l3d.gitea # config liegt in /etc/gitea/gitea.ini gitea_version: "1.19.1" gitea_app_name: "Gitea" gitea_user: "gitea" gitea_home: "/var/lib/gitea" gitea_repository_root: "{{ gitea_home }}" gitea_user_repo_limit: 300 gitea_root_url: https://git.mgrote.net gitea_offline_mode: true gitea_lfs_server_enabled: false gitea_secret_key: "{{ lookup('keepass', 'gitea_secret_key', 'password') }}" gitea_internal_token: "{{ lookup('keepass', 'gitea_internal_token', 'password') }}" gitea_disable_git_hooks: false gitea_show_user_email: false gitea_disable_gravatar: true gitea_enable_captcha: true gitea_only_allow_external_registration: false gitea_enable_notify_mail: false gitea_force_private: false gitea_oauth2_enabled: true gitea_repo_indexer_enabled: true gitea_mailer_enabled: true gitea_mailer_skip_verify: false gitea_mailer_tls_enabled: true gitea_mailer_host: smtp.strato.de:465 gitea_mailer_from: info@mgrote.net gitea_mailer_user: "info@mgrote.net" gitea_mailer_password: "{{ lookup('keepass', 'postfix_absender_passwort', 'password') }}" gitea_mailer_type: smtp gitea_default_branch: 'master' gitea_db_type: sqlite3 gitea_db_path: "{{ gitea_home }}/data/gitea.db" # for sqlite3 gitea_ssh_listen: 0.0.0.0 gitea_ssh_domain: git.mgrote.net gitea_ssh_port: 2222 gitea_start_ssh: true gitea_http_domain: git.mgrote.net gitea_http_listen: 0.0.0.0 gitea_http_port: 3000 gitea_disable_http_git: false gitea_protocol: http gitea_show_registration_button: false gitea_require_signin: false gitea_disable_registration: true gitea_fail2ban_enabled: true gitea_fail2ban_jail_maxretry: 3 gitea_fail2ban_jail_findtime: 300 gitea_fail2ban_jail_bantime: 600 # wird für drone benötigt, sonst wird der Webhook nicht "gesendet" gitea_extra_config: | [webhook] ALLOWED_HOST_LIST = *.grote.lan gitea_backup_on_upgrade: false gitea_backup_location: "{{ gitea_home }}/backups/" ### mgrote.munin-node munin_node_plugins: - name: timesync src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/systemd/timesync_status - name: systemd_status src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/systemd/systemd_status - name: systemd_mem src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/systemd/systemd_mem config: | [systemd_mem] env.all_services true - name: lvm_ src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/disk/lvm_ config: | [lvm_*] user root - name: fail2ban src: https://git.mgrote.net/mg/munin-plugins/raw/branch/master/extern/fail2ban config: | [fail2ban] env.client /usr/bin/fail2ban-client env.config_dir /etc/fail2ban user root - name: http_response src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/http/http_response config: | [http_response] env.sites http://gitea.grote.lan:3000 https://git.mgrote.net env.max_time 20 env.short_label true env.follow_redirect true - name: drone src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/cicd/drone config: | [drone] env.url http://docker10.grote.lan:81/api/user/repos?latest=true env.token {{ lookup('keepass', 'munin_plugin_drone_token', 'password') }}