mu
diff --git a/.ansible-lint b/.ansible-lint
new file mode 100644
index 0000000..4a24ba6
--- /dev/null
+++ b/.ansible-lint
@@ -0,0 +1,2 @@
+exclude_paths:
+ - .terraform/
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..3fa8c86
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.terraform
diff --git a/dev/ansible.cfg b/ansible.cfg
similarity index 100%
rename from dev/ansible.cfg
rename to ansible.cfg
diff --git a/dev/defaults.yml b/dev/defaults.yml
index 178e899..34cb7f3 100644
--- a/dev/defaults.yml
+++ b/dev/defaults.yml
@@ -11,239 +11,247 @@
with_items:
# NSGlobalDomain defaults
- - # don't quit idle applications
- domain: -g
- key: NSDisableAutomaticTermination
- type: bool
- value: true
- - # disable font smoothing
- key: AppleFontSmoothing
- type: int
- value: 0
- - # full keyboard access
- key: AppleKeyboardUIMode
- type: int
- value: 3
- - # show all extensions by default
- key: AppleShowAllExtensions
- type: bool
- value: true
- - # keyboard repeat rate
- key: KeyRepeat
- type: int
- value: 2
- - # delay before keyboard repeat
- key: InitialKeyRepeat
- type: int
- value: 25
- - # set sidebar item size to small
- key: NSTableViewDefaultSizeMode
- type: int
- value: 1
- - # disable resume
- key: NSQuitAlwaysKeepsWindows
- type: bool
- value: false
- - # add debug menu in web views
- key: WebKitDeveloperExtras
- type: bool
- value: true
- - # tap to click
- key: com.apple.mouse.tapBehavior
- type: bool
- value: true
- - # only show scrollbars when scrolling
- key: AppleShowScrollBars
- type: string
- value: WhenScrolling
-
- # Safari
- - # enable Debug menu in Safari
- domain: com.apple.Safari
- key: IncludeInternalDebugMenu
- type: bool
- value: true
- - # disable Java
- domain: com.apple.Safari
- key: com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaEnabled
- type: bool
- value: false
- - # disable Java
- domain: com.apple.Safari
- key: com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaEnabledForLocalFiles
- type: bool
- value: false
-
- - # disable dashboard
- domain: com.apple.dashboard
- key: mcx-disabled
- type: bool
- value: true
-
- - # don't write .DS_Store to network volumes
- domain: com.apple.desktopservices
- key: DSDontWriteNetworkStores
- type: bool
- value: true
-
- # Dock defaults
- - # automatically hide and show the dock
- domain: com.apple.dock
- key: autohide
- type: bool
- value: true
- - # minimize windows using the scale effect
- domain: com.apple.dock
- key: mineffect
- type: string
- value: scale
- - # don't rearrange spaces
- domain: com.apple.dock
- key: mru-spaces
- type: bool
- value: false
- - domain: com.apple.dock
- key: orientation
- type: string
- value: left
- - # set the bottom left hot corner to sleep the display
- domain: com.apple.dock
- key: wvous-bl-corner
- type: int
- value: 10
- - # set the icon size to 36 pixels
- domain: com.apple.dock
- key: tilesize
- type: int
- value: 36
- - # no dock delay
- domain: com.apple.dock
- key: autohide-delay
- type: float
- value: 0
-
- # Trackpad settings
- - domain: com.apple.driver.AppleBluetoothMultitouch.trackpad
- key: Clicking
- type: int
- value: 1
- - domain: com.apple.driver.AppleBluetoothMultitouch.trackpad
- key: TrackpadFourFingerVertSwipeGesture
- type: int
- value: 0
- - domain: com.apple.driver.AppleBluetoothMultitouch.trackpad
- key: TrackpadThreeFingerDrag
- type: bool
- value: true
- - domain: com.apple.driver.AppleBluetoothMultitouch.trackpad
- key: TrackpadThreeFingerHorizSwipeGesture
- type: int
- value: 0
- - domain: com.apple.driver.AppleBluetoothMultitouch.trackpad
- key: TrackpadThreeFingerVertSwipeGesture
- type: int
- value: 0
-
- # Finder defaults
- - # don't ask when changing file extension
- domain: com.apple.finder
- key: FXEnableExtensionChangeWarning
- type: bool
- value: false
- - # default to list view
- domain: com.apple.finder
- key: FXPreferredViewStyle
- type: string
- value: Nlsv
- - # enable text selection in QuickLook
- domain: com.apple.finder
- key: QLEnableTextSelection
- type: bool
- value: true
- - # show full path in Finder
- domain: com.apple.finder
- key: _FXShowPosixPathInTitle
- type: bool
- value: true
- - # remove the proxy icon hover delay
- domain: com.apple.Finder
- key: NSToolbarTitleViewRolloverDelay
- type: float
- value: 0
- - # show the proxy icon and older titlebar
- # https://twitter.com/chucker/status/1395843084383043584
- domain: com.apple.Finder
- key: NSWindowSupportsAutomaticInlineTitle
- type: bool
- value: false
-
- - # set date format in menubar
- domain: com.apple.menuextra.clock
- key: DateFormat
- type: string
- value: h:mm
-
- - # no window shadows when capturing windows
- domain: com.apple.screencapture
- key: disable-shadow
- type: bool
- value: true
-
- - domain: com.apple.screencapture
- key: location
- type: string
- value: "{{ ansible_env.HOME }}/Downloads"
-
- - domain: com.apple.screensaver
- key: askForPassword
- type: int
- value: 1
-
- - domain: com.apple.Terminal
- key: ShowLineMarks
- type: bool
- value: false
-
- # Other applications
- - domain: com.google.Chrome
- key: AppleEnableSwipeNavigateWithScrolls
- type: bool
- value: false
-
- - domain: org.vim.MacVim
- key: MMLastWindowClosedBehavior
- type: int
- value: 2
-
- - domain: org.vim.MacVim
- key: MMUntitledWindow
- type: int
- value: 1
-
- - domain: org.vim.MacVim
- key: SUCheckAtStartup
- type: int
- value: 1
-
- - domain: org.vim.MacVim
- key: SUEnableAutomaticChecks
- type: int
- value: 1
-
- - domain: com.freron.MailMate
- key: MmAllowedImageURLRegexp
- type: string
- value: https://((i|images|d)\.gr-assets\.com|www\.goodreads\.com|massdrop-s3\.imgix\.net|.*\.cloudfront\.net|s3\.amazonaws\.com|files\.convertkitcdn\.com/assets/pictures)/.*
-
- - domain: com.freron.MailMate
- key: MmSendMessageDelayEnabled
- type: bool
- value: true
-
- - domain: com.freron.MailMate
- key: MmSendMessageDelay
- type: int
- value: 60
+ - # don't quit idle applications
+ domain: -g
+ key: NSDisableAutomaticTermination
+ type: bool
+ value: true
+ - # disable font smoothing
+ key: AppleFontSmoothing
+ type: int
+ value: 0
+ - # full keyboard access
+ key: AppleKeyboardUIMode
+ type: int
+ value: 3
+ - # show all extensions by default
+ key: AppleShowAllExtensions
+ type: bool
+ value: true
+ - # keyboard repeat rate
+ key: KeyRepeat
+ type: int
+ value: 2
+ - # delay before keyboard repeat
+ key: InitialKeyRepeat
+ type: int
+ value: 25
+ - # set sidebar item size to small
+ key: NSTableViewDefaultSizeMode
+ type: int
+ value: 1
+ - # disable resume
+ key: NSQuitAlwaysKeepsWindows
+ type: bool
+ value: false
+ - # add debug menu in web views
+ key: WebKitDeveloperExtras
+ type: bool
+ value: true
+ - # tap to click
+ key: com.apple.mouse.tapBehavior
+ type: bool
+ value: true
+ - # only show scrollbars when scrolling
+ key: AppleShowScrollBars
+ type: string
+ value: WhenScrolling
+
+ # Safari
+ - # enable Debug menu in Safari
+ domain: com.apple.Safari
+ key: IncludeInternalDebugMenu
+ type: bool
+ value: true
+ - # disable Java
+ domain: com.apple.Safari
+ key: com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaEnabled
+ type: bool
+ value: false
+ - # disable Java
+ domain: com.apple.Safari
+ key: com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaEnabledForLocalFiles
+ type: bool
+ value: false
+
+ - # disable dashboard
+ domain: com.apple.dashboard
+ key: mcx-disabled
+ type: bool
+ value: true
+
+ - # don't write .DS_Store to network volumes
+ domain: com.apple.desktopservices
+ key: DSDontWriteNetworkStores
+ type: bool
+ value: true
+
+ # Dock defaults
+ - # automatically hide and show the dock
+ domain: com.apple.dock
+ key: autohide
+ type: bool
+ value: true
+ - # minimize windows using the scale effect
+ domain: com.apple.dock
+ key: mineffect
+ type: string
+ value: scale
+ - # don't rearrange spaces
+ domain: com.apple.dock
+ key: mru-spaces
+ type: bool
+ value: false
+ - domain: com.apple.dock
+ key: orientation
+ type: string
+ value: left
+ - # set the bottom left hot corner to sleep the display
+ domain: com.apple.dock
+ key: wvous-bl-corner
+ type: int
+ value: 10
+ - # set the icon size to 36 pixels
+ domain: com.apple.dock
+ key: tilesize
+ type: int
+ value: 36
+ - # no dock delay
+ domain: com.apple.dock
+ key: autohide-delay
+ type: float
+ value: 0
+
+ # Trackpad settings
+ - domain: com.apple.driver.AppleBluetoothMultitouch.trackpad
+ key: Clicking
+ type: int
+ value: 1
+ - domain: com.apple.driver.AppleBluetoothMultitouch.trackpad
+ key: TrackpadFourFingerVertSwipeGesture
+ type: int
+ value: 0
+ - domain: com.apple.driver.AppleBluetoothMultitouch.trackpad
+ key: TrackpadThreeFingerDrag
+ type: bool
+ value: true
+ - domain: com.apple.driver.AppleBluetoothMultitouch.trackpad
+ key: TrackpadThreeFingerHorizSwipeGesture
+ type: int
+ value: 0
+ - domain: com.apple.driver.AppleBluetoothMultitouch.trackpad
+ key: TrackpadThreeFingerVertSwipeGesture
+ type: int
+ value: 0
+
+ # Finder defaults
+ - # don't ask when changing file extension
+ domain: com.apple.finder
+ key: FXEnableExtensionChangeWarning
+ type: bool
+ value: false
+ - # default to list view
+ domain: com.apple.finder
+ key: FXPreferredViewStyle
+ type: string
+ value: Nlsv
+ - # enable text selection in QuickLook
+ domain: com.apple.finder
+ key: QLEnableTextSelection
+ type: bool
+ value: true
+ - # show full path in Finder
+ domain: com.apple.finder
+ key: _FXShowPosixPathInTitle
+ type: bool
+ value: true
+ - # remove the proxy icon hover delay
+ domain: com.apple.Finder
+ key: NSToolbarTitleViewRolloverDelay
+ type: float
+ value: 0
+ - # show the proxy icon and older titlebar
+ # https://twitter.com/chucker/status/1395843084383043584
+ domain: com.apple.Finder
+ key: NSWindowSupportsAutomaticInlineTitle
+ type: bool
+ value: false
+
+ - # set date format in menubar
+ domain: com.apple.menuextra.clock
+ key: DateFormat
+ type: string
+ value: h:mm
+
+ - # no window shadows when capturing windows
+ domain: com.apple.screencapture
+ key: disable-shadow
+ type: bool
+ value: true
+
+ - domain: com.apple.screencapture
+ key: location
+ type: string
+ value: "{{ ansible_env.HOME }}/Downloads"
+
+ - domain: com.apple.screensaver
+ key: askForPassword
+ type: int
+ value: 1
+
+ - domain: com.apple.Terminal
+ key: ShowLineMarks
+ type: bool
+ value: false
+
+ # Other applications
+ - domain: com.google.Chrome
+ key: AppleEnableSwipeNavigateWithScrolls
+ type: bool
+ value: false
+
+ - domain: org.vim.MacVim
+ key: MMLastWindowClosedBehavior
+ type: int
+ value: 2
+
+ - domain: org.vim.MacVim
+ key: MMUntitledWindow
+ type: int
+ value: 1
+
+ - domain: org.vim.MacVim
+ key: SUCheckAtStartup
+ type: int
+ value: 1
+
+ - domain: org.vim.MacVim
+ key: SUEnableAutomaticChecks
+ type: int
+ value: 1
+
+ - domain: com.freron.MailMate
+ key: MmAllowedImageURLRegexp
+ type: string
+ value: "{{ regexps | join('|') }}"
+ vars:
+ regexps:
+ - https://((i|images|d)\.gr-assets\.com
+ - www\.goodreads\.com
+ - massdrop-s3\.imgix\.net
+ - .*\.cloudfront\.net
+ - s3\.amazonaws\.com
+ - files\.convertkitcdn\.com/assets/pictures)/.*
+
+ - domain: com.freron.MailMate
+ key: MmSendMessageDelayEnabled
+ type: bool
+ value: true
+
+ - domain: com.freron.MailMate
+ key: MmSendMessageDelay
+ type: int
+ value: 60
handlers:
diff --git a/dev/homebrew.yml b/dev/homebrew.yml
index a3a41eb..9aa79f4 100644
--- a/dev/homebrew.yml
+++ b/dev/homebrew.yml
@@ -1,49 +1,62 @@
-- hosts: all
+- name: Homebrew
+ hosts: all
tasks:
- - community.general.homebrew:
+ - name: Install Homebrew formulae
+ community.general.homebrew:
name: "{{ item }}"
loop:
- - chruby
- - difftastic
- - direnv
- - efm-langserver
- - entr
- - exa
- - fasd
- - fd
- - fzf
- - git
- - git-lfs
- - jq
- - luarocks
- - neovim
- - ripgrep
- - ruby-install
- - shellcheck
- - svn # required for source code pro
- - tmux
- - tree
- - zsh
+ - chruby
+ - colima
+ - difftastic
+ - direnv
+ - docker
+ - docker-compose
+ - efm-langserver
+ - entr
+ - exa
+ - fasd
+ - fd
+ - fzf
+ - git
+ - git-lfs
+ - jq
+ - luarocks
+ - neovim
+ - ripgrep
+ - ruby-install
+ - shellcheck
+ # - svn # required for source code pro?
+ - tmux
+ - tree
+ - zsh
- - fabianishere/personal/pam_reattach
+ - fabianishere/personal/pam_reattach
- - community.general.homebrew_cask:
+ - name: Install Homebrew casks
+ community.general.homebrew_cask:
name: "{{ item }}"
loop:
- - alfred
- - bartender
- - dash
- - fantastical
- - firefox
- - google-chrome
- - hammerspoon
- - mailmate
- - obsidian
- - slack
- - topnotch
- - zoom
+ - alfred
+ - bartender
+ - dash
+ - fantastical
+ - firefox-developer-edition
+ - google-chrome
+ - hammerspoon
+ - mailmate
+ - obsidian
+ - slack
+ - topnotch
+ - zoom
- # - homebrew/cask-fonts/font-source-code-pro
- - homebrew/cask-fonts/font-sauce-code-pro-nerd-font
- - homebrew/cask-versions/firefox-developer-edition
+ # - homebrew/cask-fonts/font-source-code-pro
+ - homebrew/cask-fonts/font-sauce-code-pro-nerd-font
+ - homebrew/cask-versions/firefox-developer-edition
+
+ - name: Heed docker-compose caveats
+ block:
+ - name: Create Docker CLI plugins config dir
+ ansible.buitin.file:
+ dest: ~/.docker/cli-plugins
+ state: directory
diff --git a/dev/macos.yml b/dev/macos.yml
index 3bb27c4..1980ca9 100644
--- a/dev/macos.yml
+++ b/dev/macos.yml
@@ -20,12 +20,11 @@
dest: ~/Library/Dictionaries/websters-1913.dictionary
- name: Enable Touch ID for sudo
- block:
- - lineinfile:
- path: /etc/pam.d/sudo
- insertafter: '^auth\s+sufficient'
- regexp: '^auth\s+sufficient\s+pam_tid.so$'
- line: "auth\tsufficient\tpam_tid.so"
+ lineinfile:
+ path: /etc/pam.d/sudo
+ insertafter: '^auth\s+sufficient'
+ regexp: '^auth\s+sufficient\s+pam_tid.so$'
+ line: "auth\tsufficient\tpam_tid.so"
# tmux
- shell: brew --prefix
@@ -35,4 +34,4 @@
insertbefore: '^auth\tsufficient\tpam_tid.so'
regexp: '^auth\s+optional\s+.*pam_reattach.so$'
line: "auth\toptional\t{{ brew_prefix.stdout | trim }}/lib/pam/pam_reattach.so"
- become: yes
+ become: true
diff --git a/dev/main.yml b/dev/main.yml
index e048e3d..fda7e99 100644
--- a/dev/main.yml
+++ b/dev/main.yml
@@ -33,5 +33,4 @@
- hosts: all
tasks:
- - ansible.builtin.command: "luarocks install fennel"
-
+ - ansible.builtin.command: "luarocks install fennel"
diff --git a/dev/hosts.yml b/hosts.yml
similarity index 57%
rename from dev/hosts.yml
rename to hosts.yml
index fe1528d..b59cb75 100644
--- a/dev/hosts.yml
+++ b/hosts.yml
@@ -3,3 +3,6 @@ all:
localhost:
ansible_connection: local
ansible_python_interpreter: "{{ansible_playbook_python}}"
+ ramble-hard:
+ ansible_user: root
+ ansible_python_interpreter: /usr/bin/python3
diff --git a/ramble-hard/main.yml b/ramble-hard/main.yml
new file mode 100644
index 0000000..11496a7
--- /dev/null
+++ b/ramble-hard/main.yml
@@ -0,0 +1,3 @@
+- hosts: ramble-hard
+ tasks:
+
diff --git a/ramble-hard/nginx/main.yml b/ramble-hard/nginx/main.yml
new file mode 100644
index 0000000..dc1cbcf
--- /dev/null
+++ b/ramble-hard/nginx/main.yml
@@ -0,0 +1,65 @@
+---
+
+- name: Set up Lets Encrypt
+ hosts: ramble-hard
+ vars_files:
+ - ../vars.private
+ tasks:
+
+ - apt:
+ update_cache: yes
+
+ - package:
+ name:
+ - certbot
+ - nginx
+
+ - service:
+ name: nginx
+ state: stopped
+
+ - command: >
+ certbot certonly --standalone --preferred-challenges http
+ -n --agree-tos -m {{ lets_encrypt.email }}
+ -d {{ tld }}
+ vars:
+ tld: "{{ item.value['subdomain'] | default(item.key) }}.{{ domain }}"
+ loop: "{{ apps | dict2items }}"
+
+ - service:
+ name: nginx
+ state: started
+
+ - template:
+ src: renew-certs
+ dest: /etc/cron.daily/renew-certs
+ mode: +x
+
+# - name: Set up nginx proxies
+# hosts: ramble-hard
+# vars_files:
+# - ../vars.private
+# tasks:
+
+# - template:
+# src: nginx.conf
+# dest: /etc/nginx/sites-available/{{ item.key }}.conf
+# vars:
+# server_name: "{{ item.value['subdomain'] | default(item.key) }}.{{ domain }}"
+# port: "{{ item.value['port'] }}"
+# loop: "{{ apps | dict2items }}"
+# notify: Restart nginx
+
+# - file:
+# src: /etc/nginx/sites-available/{{ item.key }}.conf
+# dest: /etc/nginx/sites-enabled/{{ item.key }}.conf
+# state: link
+# loop: "{{ apps | dict2items }}"
+# notify: Restart nginx
+
+ # handlers:
+
+ # - name: Restart nginx
+ # service:
+ # name: nginx
+ # state: restarted
diff --git a/ramble-hard/nginx/nginx.conf b/ramble-hard/nginx/nginx.conf
new file mode 100644
index 0000000..8ef2227
--- /dev/null
+++ b/ramble-hard/nginx/nginx.conf
@@ -0,0 +1,37 @@
+server {
+ server_name {{ server_name }};
+
+ listen 80;
+ listen [::]:80;
+
+ location / {
+ return https://$server_name$request_uri;
+ }
+}
+
+
+server {
+ server_name {{ server_name }};
+
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+
+ ssl_trusted_certificate /etc/letsencrypt/live/{{ server_name }}/chain.pem;
+ ssl_certificate /etc/letsencrypt/live/{{ server_name }}/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/{{ server_name }}/privkey.pem;
+
+ ssl_stapling on;
+ ssl_stapling_verify on;
+
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "upgrade";
+ proxy_set_header Host $http_host;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+ client_max_body_size 10m;
+
+ location / {
+ proxy_pass http://127.0.0.1:{{ port }};
+ }
+}
diff --git a/ramble-hard/nginx/renew-certs b/ramble-hard/nginx/renew-certs
new file mode 100644
index 0000000..88192fc
--- /dev/null
+++ b/ramble-hard/nginx/renew-certs
@@ -0,0 +1,2 @@
+#!/bin/sh
+certbot renew -w /var/lib/letsencrypt/ --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx"
diff --git a/ramble-hard/pleroma/01.yml b/ramble-hard/pleroma/01.yml
new file mode 100644
index 0000000..fc720db
--- /dev/null
+++ b/ramble-hard/pleroma/01.yml
@@ -0,0 +1,118 @@
+# https://docs.pleroma.social/backend/installation/otp_en/
+---
+- hosts: ramble-hard
+ become: true
+ tasks:
+
+ # arch="$(uname -m)";if [ "$arch" = "x86_64" ];then arch="amd64";elif [ "$arch" = "armv7l" ];then arch="arm";elif [ "$arch" = "aarch64" ];then arch="arm64";else echo "Unsupported arch: $arch">&2;fi;if getconf GNU_LIBC_VERSION>/dev/null;then libc_postfix="";elif [ "$(ldd 2>&1|head -c 9)" = "musl libc" ];then libc_postfix="-musl";elif [ "$(find /lib/libc.musl*|wc -l)" ];then libc_postfix="-musl";else echo "Unsupported libc">&2;fi;echo "$arch$libc_postfix" # noqa yaml[line-length]
+ - shell: |
+ arch="$(uname -m)"
+ if [ "$arch" = "x86_64" ]; then
+ arch="amd64";
+ elif [ "$arch" = "armv7l" ]; then
+ arch="arm";
+ elif [ "$arch" = "aarch64" ]; then
+ arch="arm64";
+ else
+ echo "Unsupported arch: $arch">&2;
+ fi;
+ if getconf GNU_LIBC_VERSION>/dev/null; then
+ libc_postfix="";
+ elif [ "$(ldd 2>&1|head -c 9)" = "musl libc" ]; then
+ libc_postfix="-musl";
+ elif [ "$(find /lib/libc.musl*|wc -l)" ]; then
+ libc_postfix="-musl";
+ else
+ echo "Unsupported libc">&2;
+ fi;
+ echo "$arch$libc_postfix"
+ register: arch_result
+ - set_fact:
+ pleroma_flavour: "{{ arch_result.stdout | trim }}"
+
+ - apt:
+ update_cache: true
+
+ # apt install curl unzip libncurses5 postgresql postgresql-contrib nginx certbot libmagic-dev
+ # apt install imagemagick ffmpeg libimage-exiftool-perl
+ # apt install postgresql-11-rum
+ - package:
+ name:
+ - curl
+ - unzip
+ - libncurses5
+ - postgresql
+ - postgresql-contrib
+ - nginx
+ - certbot
+ - libmagic-dev
+ - imagemagick
+ - ffmpeg
+ - libimage-exiftool-perl
+ # - postgresql-13-rum
+ notify:
+ - Restart postgres
+
+ # Create a Pleroma user
+ # adduser --system --shell /bin/false --home /opt/pleroma pleroma
+ - user:
+ name: pleroma
+ home: /opt/pleroma
+ shell: /bin/false
+ system: true
+
+ # Clone the release build into a temporary directory and unpack it
+ # su pleroma -s $SHELL -lc "
+ # curl 'https://git.pleroma.social/api/v4/projects/2/jobs/artifacts/stable/download?job=$FLAVOUR' -o /tmp/pleroma.zip
+ # unzip /tmp/pleroma.zip -d /tmp/
+ # "
+ - get_url:
+ url: https://git.pleroma.social/api/v4/projects/2/jobs/artifacts/stable/download?job={{ pleroma_flavour }}
+ dest: /tmp/pleroma.zip
+ - command: unzip /tmp/pleroma.zip -d /tmp/
+
+ # Move the release to the home directory and delete temporary files
+ # su pleroma -s $SHELL -lc "
+ # mv /tmp/release/* /opt/pleroma
+ # rmdir /tmp/release
+ # rm /tmp/pleroma.zip
+ # "
+ - copy:
+ src: /tmp/release/
+ dest: /opt/pleroma/
+ remote_src: true
+ owner: pleroma
+ - file:
+ path: "{{ item }}"
+ state: absent
+ loop:
+ - /tmp/release
+ - /tmp/pleroma.zip
+
+ # Create uploads directory and set proper permissions (skip if planning to use a remote uploader)
+ # Note: It does not have to be `/var/lib/pleroma/uploads`, the config generator will ask about the upload directory later
+ # mkdir -p /var/lib/pleroma/uploads
+ # chown -R pleroma /var/lib/pleroma
+
+ # Create custom public files directory (custom emojis, frontend bundle overrides, robots.txt, etc.)
+ # Note: It does not have to be `/var/lib/pleroma/static`, the config generator will ask about the custom public files directory later
+ # mkdir -p /var/lib/pleroma/static
+ # chown -R pleroma /var/lib/pleroma
+
+ # Create a config directory
+ # mkdir -p /etc/pleroma
+ # chown -R pleroma /etc/pleroma
+ - file:
+ path: "{{ item }}"
+ state: directory
+ owner: pleroma
+ loop:
+ - /var/lib/pleroma/uploads
+ - /var/lib/pleroma/static
+ - /etc/pleroma
+
+ handlers:
+ - name: Restart postgres
+ service:
+ name: postgresql
+ state: restarted
diff --git a/ramble-hard/pleroma/02.yml b/ramble-hard/pleroma/02.yml
new file mode 100644
index 0000000..c028715
--- /dev/null
+++ b/ramble-hard/pleroma/02.yml
@@ -0,0 +1,30 @@
+# https://docs.pleroma.social/backend/installation/otp_en/
+---
+- hosts: ramble-hard
+ become: true
+ tasks:
+
+ # Create the postgres database
+ # su postgres -s $SHELL -lc "psql -f /tmp/setup_db.psql"
+ - command: psql -f /tmp/setup_db.psql
+ become_user: postgres
+
+ # Create the database schema
+ # su pleroma -s $SHELL -lc "./bin/pleroma_ctl migrate"
+ - command: ./bin/pleroma_ctl migrate
+ args:
+ chdir: /opt/pleroma
+ become_user: pleroma
+
+ # If you have installed RUM indexes uncomment and run
+ # su pleroma -s $SHELL -lc "./bin/pleroma_ctl migrate --migrations-path priv/repo/optional_migrations/rum_indexing/"
+ # - command: ./bin/pleroma_ctl migrate --migrations-path priv/repo/optional_migrations/rum_indexing/
+ # args:
+ # chdir: /opt/pleroma
+ # become_user: pleroma
+
+ handlers:
+ - name: Restart postgres
+ service:
+ name: postgresql
+ state: restarted
diff --git a/ramble-hard/pleroma/03.yml b/ramble-hard/pleroma/03.yml
new file mode 100644
index 0000000..b0b75e8
--- /dev/null
+++ b/ramble-hard/pleroma/03.yml
@@ -0,0 +1,89 @@
+# https://docs.pleroma.social/backend/installation/otp_en/
+---
+- hosts: ramble-hard
+ become: true
+ vars_files:
+ - ../vars.private
+ tasks:
+
+ - package:
+ name:
+ - certbot
+ - nginx
+
+ - service:
+ name: nginx
+ state: stopped
+
+ # certbot certonly --standalone --preferred-challenges http -d yourinstance.tld
+ - command: >
+ certbot certonly --standalone --preferred-challenges http
+ -n --agree-tos -m {{ lets_encrypt.email }}
+ -d {{ pleroma.tld }}
+
+ - service:
+ name: nginx
+ state: started
+
+ # cp /opt/pleroma/installation/pleroma.nginx /etc/nginx/sites-available/pleroma.conf
+ # ln -s /etc/nginx/sites-available/pleroma.conf /etc/nginx/sites-enabled/pleroma.conf
+ - copy:
+ src: /opt/pleroma/installation/pleroma.nginx
+ dest: /etc/nginx/sites-available/pleroma.conf
+ remote_src: true
+ notify: Restart nginx
+ - file:
+ src: /etc/nginx/sites-available/pleroma.conf
+ dest: /etc/nginx/sites-enabled/pleroma.conf
+ state: link
+ notify: Restart nginx
+
+ - replace:
+ path: /etc/nginx/sites-available/pleroma.conf
+ regexp: 'example\.tld'
+ replace: "{{ pleroma.tld }}"
+ notify: Restart nginx
+
+ # Copy the service into a proper directory
+ # cp /opt/pleroma/installation/pleroma.service /etc/systemd/system/pleroma.service
+ - copy:
+ src: /opt/pleroma/installation/pleroma.service
+ dest: /etc/systemd/system/pleroma.service
+ remote_src: true
+ # Start pleroma and enable it on boot
+ # systemctl start pleroma
+ # systemctl enable pleroma
+ notify: Restart pleroma
+
+ # Create the directory for webroot challenges
+ # mkdir -p /var/lib/letsencrypt
+ - file:
+ path: /var/lib/letsencrypt
+ state: directory
+
+ # Add it to the daily cron
+ # echo '#!/bin/sh
+ # certbot renew --cert-name yourinstance.tld --webroot -w /var/lib/letsencrypt/ --post-hook "systemctl reload nginx"
+ # ' > /etc/cron.daily/renew-pleroma-cert
+ # chmod +x /etc/cron.daily/renew-pleroma-cert
+ - ansible.builtin.copy:
+ content: |
+ \#!/bin/sh
+ certbot renew --cert-name {{ pleroma.tld }} --webroot -w /var/lib/letsencrypt/ --post-hook "systemctl reload nginx"
+ dest: /etc/cron.daily/renew-pleroma-cert
+ mode: +x
+ # - template:
+ # src: renew-pleroma-cert
+ # dest: /etc/cron.daily/renew-pleroma-cert
+ # mode: +x
+
+ handlers:
+ - name: Restart nginx
+ service:
+ name: nginx
+ state: restarted
+ - name: Restart pleroma
+ service:
+ name: pleroma
+ enabled: true
+ state: restarted
diff --git a/ramble-hard/pleroma/README.md b/ramble-hard/pleroma/README.md
new file mode 100644
index 0000000..c598010
--- /dev/null
+++ b/ramble-hard/pleroma/README.md
@@ -0,0 +1,23 @@
+```sh
+ansible-playbook playbooks/pleroma/01.yml
+
+su pleroma -s $SHELL -lc "./bin/pleroma_ctl instance gen --output /etc/pleroma/config.exs --output-psql /tmp/setup_db.psql"
+
+ansible-playbook playbooks/pleroma/02.yml
+
+# Start the instance to verify that everything is working as expected
+su pleroma -s $SHELL -lc "./bin/pleroma daemon"
+
+# Wait for about 20 seconds and query the instance endpoint, if it shows your
+# uri, name and email correctly, you are configured correctly
+sleep 20 && curl http://localhost:4000/api/v1/instance
+
+# Stop the instance
+su pleroma -s $SHELL -lc "./bin/pleroma stop"
+
+ansible-playbook -l pleroma playbooks/pleroma/03.yml
+
+cd /opt/pleroma
+su pleroma -s $SHELL -lc "./bin/pleroma_ctl user new joeuser joeuser@sld.tld --admin"
+su pleroma -s $SHELL -lc "./bin/pleroma_ctl config migrate_to_db"
+```