rm on-fire-within
diff --git a/on-fire-within/README.md b/on-fire-within/README.md
deleted file mode 100644
index 31c91bf..0000000
--- a/on-fire-within/README.md
+++ /dev/null
@@ -1,16 +0,0 @@
-# On Fire Within
-
-## Setup
-
-- [Installing Hass.io](https://www.home-assistant.io/hassio/installation/)
-
-1. `ansible-playbook playbooks/pi/bootstrap.yml`
-1. `ansible-playbook on-fire-within/bootstrap.yml`
-1. `curl -fsSL get.docker.com | sh`
- - `sudo usermod -aG docker alpha`
-1. `curl -sL "https://raw.githubusercontent.com/home-assistant/hassio-installer/master/hassio_install.sh" | bash -s -- -m raspberrypi4`
-1. `ansible-playbook on-fire-within/main.yml`
-
-## Notes
-
-- `/usr/share/hassio`
diff --git a/on-fire-within/hass-io.yml b/on-fire-within/hass-io.yml
deleted file mode 100644
index fc95122..0000000
--- a/on-fire-within/hass-io.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-# https://www.home-assistant.io/hassio/installation/
-
-- hosts: on-fire-within
- become: yes
- tasks:
- # Forgot what I need this for...
- - name: install software-properties-common
- apt: name=software-properties-common
-
- - name: install other dependencies for hass.io
- apt:
- name:
- - apparmor-utils
- - apt-transport-https
- - avahi-daemon
- - ca-certificates
- - curl
- - dbus
- - jq
- - network-manager
- - socat
-
- # https://www.home-assistant.io/integrations/bluetooth_tracker/
- - bluetooth
- - libbluetooth-dev
- update_cache: yes
- - service:
- name: ModemManager
- enabled: false
-
- # homekit
- - name: install dependenies for homekit
- apt: name=libavahi-compat-libdnssd-dev
diff --git a/on-fire-within/main.yml b/on-fire-within/main.yml
deleted file mode 100644
index c3ef453..0000000
--- a/on-fire-within/main.yml
+++ /dev/null
@@ -1,322 +0,0 @@
-- import_playbook: pi.yml
-- import_playbook: tailscale.yml
-- import_playbook: hass-io.yml
-- import_playbook: pi-hole.yml
-
-- hosts: on-fire-within
- become: true
- vars_files:
- - vars.private
- tasks:
-
- - name: Set authorized keys from GitHub
- ansible.posix.authorized_key:
- user: alpha
- state: present
- key: https://github.com/kejadlen.keys
-
- - name: Install dependencies
- ansible.builtin.apt:
- name:
- - git
- - vim
-
- # Needed for Docker stuff
- - docker-compose
- - python3-pip
- - python-backports-shutil-get-terminal-size
- - python-backports.ssl-match-hostname
-
- - name: Install python docker packages
- pip:
- name:
- - docker
- - docker-compose
- state: latest
-
- - name: Create necessary dirs
- file:
- path: "{{ item }}"
- state: directory
- with_items:
- - /etc/minio
- - /etc/mitmproxy
- - /etc/smokeping
- - /etc/smokeping/config
- - /etc/smokeping/data
- - /etc/traefik
- - /mnt/mushu/minio
- - /mnt/mushu/syncthing
-
- - name: Mount USB drive
- ansible.posix.mount:
- path: /mnt/mushu
- src: /dev/sda
- fstype: ext4
- state: mounted
-
- - name: Configure ddclient
- ansible.builtin.copy:
- content: |
- daemon=300
-
- use=web
- ssl=yes
- protocol=googledomains
-
- {% for host in ddclient_hosts %}
- login={{ host.login }}, password={{ host.password }} {{ host.host }}
- {% endfor %}
- dest: /etc/ddclient/ddclient.conf
- mode: "0600"
- vars:
- ddclient_hosts: "{{ ddclient.hosts }}"
- notify: Restart ddclient
-
- - name: Traefik static configuration
- ansible.builtin.copy:
- content: |
- providers:
- docker:
- exposedByDefault: false
- file:
- filename: /etc/traefik/dynamic_conf.toml
- watch: true
-
- entryPoints:
- http:
- address: ":80"
- https:
- address: ":443"
-
- certificatesResolvers:
- le:
- acme:
- email: {{ email }}
- storage: "/etc/traefik/acme.json"
- httpChallenge:
- entryPoint: http
-
- api:
- insecure: true
-
- accessLog: {}
- dest: /etc/traefik/traefik.yml
- mode: 0600
-
- # https://docs.syncthing.net/users/faq.html#inotify-limits
- - name: Increase inotify limit for syncthing
- ansible.builtin.lineinfile:
- path: /etc/sysctl.conf
- regexp: '^fs.inotify.max_user_watches='
- line: fs.inotify.max_user_watches=204800
-
- # The docker_compose module overwrites our existing variables, so this is a
- # workaround to save off ones that we need later on in the playbook.
- #
- # https://github.com/ansible/ansible/issues/33960
- - name: Save original host facts
- ansible.builtin.set_fact:
- "{{ item }}_original": "{{ lookup('vars', item) }}"
- with_items:
- - minio
- - traefik
- tags:
- - debug
-
- - name: Save Tailscale IP addresses
- tags: [docker]
- block:
- - command: tailscale ip -4
- register: tailscale_ipv4
- - command: tailscale ip -2
- register: tailscale_ipv6
-
- - name: Docker ALL the things!
- tags: [docker]
- community.docker.docker_compose_v2:
- project_name: on-fire-within
- pull: true
- definition:
- version: '2'
- services:
- minio:
- image: kejadlen/minio:latest
- container_name: minio
- environment:
- MINIO_ACCESS_KEY: "{{ minio.access_key }}"
- MINIO_SECRET_KEY: "{{ minio.secret_key }}"
- volumes:
- - /etc/minio:/root/.minio
- - /mnt/mushu/minio:/data
- user: 0:0 # root
- labels:
- - traefik.enable=true
- - traefik.http.routers.minio.rule=Host(`{{ traefik.host_rules.minio }}`)
- - traefik.http.routers.minio.tls=true
- - traefik.http.routers.minio.tls.certresolver=le
- - traefik.http.services.minio.loadbalancer.server.port=9000
- # mitmproxy:
- # image: mitmproxy/mitmproxy:latest-ARMv7
- # container_name: mitmproxy
- # command: mitmweb --web-iface ""
- # volumes:
- # - /etc/mitmproxy:/home/mitmproxy/.mitmproxy
- # labels:
- # - traefik.enable=true
- # - traefik.tcp.routers.mitmproxy.rule=HostSNI(`{{ traefik.host_rules.mitmproxy }}`)
- # - traefik.tcp.routers.mitmproxy.tls.passthrough=true
- # - traefik.tcp.services.mitmproxy.loadbalancer.server.port=8080
- # - traefik.http.routers.mitmproxy-web.rule=Host(`{{ traefik.host_rules.mitmproxy_web }}`)
- # - traefik.http.routers.mitmproxy-web.tls.certresolver=le
- # - traefik.http.services.mitmproxy-web.loadbalancer.server.port=8081
- pihole:
- image: pihole/pihole:2024.06.0
- container_name: pihole
- ports:
- - 53:53/tcp
- - 53:53/udp
- environment:
- TZ: America/Los_Angeles
- VIRTUAL_HOST: "{{ pihole.host }}"
- WEBPASSWORD: "{{ pihole.password }}"
- LOCAL_IPV4: "{{ tailscale_ipv4 | trim }}"
- LOCAL_IPV6: "{{ tailscale_ipv6 | trim }}"
- volumes:
- - /etc/pihole:/etc/pihole
- - /etc/dnsmasq.d:/etc/dnsmasq.d
- dns:
- - 127.0.0.1
- - 1.1.1.1
- labels:
- - traefik.enable=true
- - traefik.http.routers.pihole.rule=Host(`{{ traefik.host_rules.pihole }}`)
- - traefik.http.routers.pihole.tls=true
- - traefik.http.routers.pihole.tls.certresolver=le
- - traefik.http.services.pihole.loadbalancer.server.port=80
- restart: unless-stopped
- syncthing:
- image: syncthing/syncthing:1.23.5
- container_name: syncthing
- ports:
- - 22000:22000/tcp # TCP file transfers
- - 22000:22000/udp # QUIC file transfers
- - 21027:21027/udp # Receive local discovery broadcasts
- volumes:
- - /etc/syncthing:/var/syncthing
- - /mnt/mushu/syncthing:/sync
- environment:
- PUID: 0
- PGID: 0
- labels:
- - traefik.enable=true
- - traefik.http.routers.syncthing.rule=Host(`{{ traefik.host_rules.syncthing }}`)
- - traefik.http.routers.syncthing.tls=true
- - traefik.http.routers.syncthing.tls.certresolver=le
- - traefik.http.services.syncthing.loadbalancer.server.port=8384
- restart: unless-stopped
- smokeping:
- image: lscr.io/linuxserver/smokeping:arm32v7-2.7.3-r9-ls36
- container_name: smokeping
- environment:
- - MASTER_URL=https://smokeping.kejadlen.dev/smokeping/
- volumes:
- - /etc/smokeping/config:/config
- - /etc/smokeping/data:/data
- labels:
- - traefik.enable=true
- - traefik.http.routers.smokeping.rule=Host(`smokeping.kejadlen.dev`)
- - traefik.http.routers.smokeping.tls=true
- - traefik.http.routers.smokeping.tls.certresolver=le
- - traefik.http.services.smokeping.loadbalancer.server.port=80
- restart: unless-stopped
- traefik:
- image: traefik:v2.10.4
- container_name: traefik
- ports:
- - 80:80
- - 8080:8080
- - 443:443
- volumes:
- - /var/run/docker.sock:/var/run/docker.sock
- - /etc/traefik:/etc/traefik
- labels:
- - traefik.enable=true
- - traefik.http.middlewares.auth.basicauth.users=alpha:{{ traefik.password | password_hash("md5") | replace("$", "$$") }}
- - traefik.http.routers.traefik.rule=Host(`{{ traefik.host_rules.traefik }}`)
- - traefik.http.routers.traefik.tls=true
- - traefik.http.routers.traefik.tls.certresolver=le
- - traefik.http.routers.traefik.middlewares=auth
- - traefik.http.routers.traefik.service=api@internal
- restart: unless-stopped
-
- - name: Route Home Assistant through Traefik
- block:
- # - shell: ip -4 addr show docker0 | grep -Po 'inet \K[\d.]+' | head -n 1
- - shell: docker network inspect on-fire-within_default | jq --raw-output .[0].IPAM.Config[0].Gateway
- register: docker_gateway_result
- - shell: docker network inspect on-fire-within_default | jq --raw-output .[0].IPAM.Config[0].Gateway
- register: docker_subnet_result
- - set_fact:
- docker_gateway: "{{ docker_gateway_result.stdout | trim }}"
- docker_subnet: "{{ docker_subnet_result.stdout | trim }}"
- - copy:
- content: |
- [http.routers]
- [http.routers.appdaemon]
- rule = "Host(`{{ traefik_original.host_rules.appdaemon }}`)"
- service = "appdaemon"
- [http.routers.appdaemon.tls]
- certResolver = "le"
- [http.routers.hassio]
- rule = "Host(`{{ traefik_original.host_rules.hassio }}`)"
- service = "hassio"
- [http.routers.hassio.tls]
- certResolver = "le"
-
- [http.services]
- [http.services.appdaemon.loadBalancer]
- [[http.services.appdaemon.loadBalancer.servers]]
- url = "http://{{ docker_gateway }}:5050/"
- [http.services.hassio.loadBalancer]
- [[http.services.hassio.loadBalancer.servers]]
- url = "http://{{ docker_gateway }}:8123/"
- dest: /etc/traefik/dynamic_conf.toml
- mode: 0600
- notify: Restart Traefik
- tags:
- - debug
-
- - name: Ship logs via rsyslog
- ansible.builtin.copy:
- content: |
- *.* action(type="omfwd"
- protocol="tcp"
- target="lotus-land-story"
- port="514"
- Template="RSYSLOG_SyslogProtocol23Format"
- TCP_Framing="octet-counted"
- KeepAlive="on")
- dest: /etc/rsyslog.d/50-promtail.conf
- mode: "0644"
- notify: Restart rsyslog
-
- handlers:
- - name: Restart Traefik
- docker_container:
- name: traefik
- restart: yes
- ignore_errors: yes
-
- - name: Restart Home Assistant
- docker_container:
- name: homeassistant
- restart: yes
- ignore_errors: yes
-
- - name: Restart rsyslog
- ansible.builtin.service:
- name: rsyslog
- state: restarted
-
-# vim: ft=yaml.ansible
diff --git a/on-fire-within/pi-hole.yml b/on-fire-within/pi-hole.yml
deleted file mode 100644
index df927b4..0000000
--- a/on-fire-within/pi-hole.yml
+++ /dev/null
@@ -1,66 +0,0 @@
-- hosts: on-fire-within
- become: yes
- vars_files:
- - vars.private
- tasks:
-
- # Workaround for https://github.com/pi-hole/docker-pi-hole/issues/1048
- # - https://github.com/pi-hole/docker-pi-hole/issues/1042#issuecomment-1086728157
- # - https://github.com/pi-hole/docker-pi-hole/issues/1043#issuecomment-1086936352
- - name: Work around a Docker libseccomp issue w/Pi-Hole
- block:
- - apt_key:
- keyserver: keyserver.ubuntu.com
- id: "{{ item }}"
- loop:
- - 0E98404D386FA1D9
- - 6ED0E7B82643E131
- - apt_repository:
- repo: deb http://deb.debian.org/debian buster-backports main
- filename: buster-backports
- state: present
- - shell: apt-cache policy libseccomp2 | grep buster-backports -B1 | head -n1 | sed -e 's/^\s*\**\s*\(\S*\).*/\1/'
- register: libseccomp2_version
- - apt:
- update_cache: yes
- name: libseccomp2={{ libseccomp2_version.stdout_lines[0] }}
-
- # https://docs.pi-hole.net/guides/dns/unbound/
- - name: Set up Pi-hole as recursive DNS server
- block:
- - name: Install unbound
- apt:
- name: unbound
- - name: Configure unbound
- ansible.builtin.copy:
- src: unbound.conf
- dest: /etc/unbound/unbound.conf.d/pi-hole.conf
- notify: Restart unbound
- - name: Use the same limit for FTL as unbound
- ansible.builtin.lineinfile:
- path: /etc/dnsmasq.d/99-edns.conf
- line: edns-packet-max=1232
- create: true
-
- - name: Disable resolvconf.conf entry for unbound
- block:
- - name: Disable unbound-resolvconf.service
- service:
- name: unbound-resolvconf
- enabled: false
- - name: Disable resolvconf_resolvers.conf from being generated
- ansible.builtin.replace:
- path: /etc/resolvconf.conf
- regexp: '^unbound_conf='
- replace: '#unbound_conf='
- - name: Remove resolvconf_resolvers.conf
- ansible.builtin.file:
- path: /etc/unbound/unbound.conf.d/resolvconf_resolvers.conf
- state: absent
- notify: Restart unbound
-
- handlers:
- - name: Restart unbound
- ansible.builtin.service:
- name: unbound
- state: restarted
diff --git a/on-fire-within/pi.yml b/on-fire-within/pi.yml
deleted file mode 100644
index 96ac691..0000000
--- a/on-fire-within/pi.yml
+++ /dev/null
@@ -1,44 +0,0 @@
-# https://www.raspberrypi.org/documentation/configuration/security.md
-
-- hosts: on-fire-within
- become: yes
- tasks:
- - name: disable ssh password logins
- lineinfile:
- path: /etc/ssh/sshd_config
- regexp: '^(#\s*)?{{ item }} '
- line: "{{ item }} no"
- notify: reload ssh
- with_items:
- - ChallengeResponseAuthentication
- - PasswordAuthentication
- - UsePAM
-
- - name: disable pi user
- user:
- name: pi
- password: !
-
- - name: install fail2ban
- package:
- name: fail2ban
- state: present
-
- - name: create jail.local
- copy:
- content: |
- [sshd]
- enabled = true
- dest: /etc/fail2ban/jail.local
- notify: reload fail2ban
-
- handlers:
- - name: reload ssh
- service:
- name: ssh
- state: reloaded
-
- - name: reload fail2ban
- service:
- name: fail2ban
- state: reloaded
diff --git a/on-fire-within/tailscale.yml b/on-fire-within/tailscale.yml
deleted file mode 100644
index 9e64972..0000000
--- a/on-fire-within/tailscale.yml
+++ /dev/null
@@ -1,67 +0,0 @@
-# https://tailscale.com/download/linux/rpi
-
-# TODO Conditionalize this on the OS and merge into ../playbooks/tailscale.yml
-- name: Install Tailscale
- hosts: on-fire-within
- become: true
- tasks:
-
- # sudo apt-get install apt-transport-https
- - name: Install apt-transport-https
- ansible.builtin.package:
- name: apt-transport-https
- state: present
-
- # curl -fsSL https://pkgs.tailscale.com/stable/raspbian/buster.gpg | sudo apt-key add -
- - name: Add Tailscale signing key
- ansible.builtin.apt_key:
- url: https://pkgs.tailscale.com/stable/raspbian/buster.gpg
- state: present
-
- # curl -fsSL https://pkgs.tailscale.com/stable/raspbian/buster.list | sudo tee /etc/apt/sources.list.d/tailscale.list
- - name: Add Tailscale apt repo
- ansible.builtin.apt_repository:
- repo: deb https://pkgs.tailscale.com/stable/raspbian buster main
- state: present
- filename: tailscale
-
- # sudo apt-get update
- - name: Update apt-get
- ansible.builtin.apt:
- update_cache: true
-
- # sudo apt-get install tailscale
- - name: Install Tailscale
- ansible.builtin.package:
- name: tailscale
- state: present
-
-- name: Restrict tailscaled logging
- hosts: on-fire-within
- become: true
- tasks:
-
- - name: Create systemd override dir for tailscaled
- ansible.builtin.file:
- path: /etc/systemd/system/tailscaled.service.d
- state: directory
- mode: "0644"
-
- - name: Create systemd override
- ansible.builtin.copy:
- content: |
- [Service]
- LogLevelMax=notice
- dest: /etc/systemd/system/tailscaled.service.d/override.conf
- mode: "0644"
- notify:
- - Restart Tailscale
-
- handlers:
-
- - name: Restart Tailscale
- ansible.builtin.systemd:
- name: tailscaled
- state: restarted
- daemon_reload: true
-
diff --git a/on-fire-within/unbound.conf b/on-fire-within/unbound.conf
deleted file mode 100644
index cb2ee53..0000000
--- a/on-fire-within/unbound.conf
+++ /dev/null
@@ -1,66 +0,0 @@
-server:
- # If no logfile is specified, syslog is used
- # logfile: "/var/log/unbound/unbound.log"
- verbosity: 1
-
- interface: 127.0.0.1
- port: 5335
- do-ip4: yes
- do-udp: yes
- do-tcp: yes
-
- # May be set to yes if you have IPv6 connectivity
- do-ip6: no
-
- # You want to leave this to no unless you have *native* IPv6. With 6to4 and
- # Terredo tunnels your web browser should favor IPv4 for the same reasons
- prefer-ip6: no
-
- # Use this only when you downloaded the list of primary root servers!
- # If you use the default dns-root-data package, unbound will find it automatically
- #root-hints: "/var/lib/unbound/root.hints"
-
- # Trust glue only if it is within the server's authority
- harden-glue: yes
-
- # Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
- harden-dnssec-stripped: yes
-
- # Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
- # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
- use-caps-for-id: no
-
- # Reduce EDNS reassembly buffer size.
- # IP fragmentation is unreliable on the Internet today, and can cause
- # transmission failures when large DNS messages are sent via UDP. Even
- # when fragmentation does work, it may not be secure; it is theoretically
- # possible to spoof parts of a fragmented DNS message, without easy
- # detection at the receiving end. Recently, there was an excellent study
- # >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<<
- # by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/)
- # in collaboration with NLnet Labs explored DNS using real world data from the
- # the RIPE Atlas probes and the researchers suggested different values for
- # IPv4 and IPv6 and in different scenarios. They advise that servers should
- # be configured to limit DNS messages sent over UDP to a size that will not
- # trigger fragmentation on typical network links. DNS servers can switch
- # from UDP to TCP when a DNS response is too big to fit in this limited
- # buffer size. This value has also been suggested in DNS Flag Day 2020.
- edns-buffer-size: 1232
-
- # Perform prefetching of close to expired message cache entries
- # This only applies to domains that have been frequently queried
- prefetch: yes
-
- # One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
- num-threads: 1
-
- # Ensure kernel buffer is large enough to not lose messages in traffic spikes
- so-rcvbuf: 1m
-
- # Ensure privacy of local IP ranges
- private-address: 192.168.0.0/16
- private-address: 169.254.0.0/16
- private-address: 172.16.0.0/12
- private-address: 10.0.0.0/8
- private-address: fd00::/8
- private-address: fe80::/10