1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
# https://github.com/kejadlen/quire
- name: Set up Quire
  hosts: lotus-land-story
  vars:
    version: "{{ versions.quire }}"
  tasks:

    - name: Create quire user
      ansible.builtin.user:
        name: quire
        create_home: true
      register: quire_user

    - name: Create quire data directory
      ansible.builtin.file:
        path: /mnt/lotus-land-story/quire
        state: directory
        mode: "0755"
        owner: "{{ quire_user.name }}"

    - name: Create quire secrets directory
      ansible.builtin.file:
        path: /mnt/lotus-land-story/quire/secrets
        state: directory
        mode: "0700"
        owner: "{{ quire_user.name }}"

    - name: Write secrets
      ansible.builtin.copy:
        content: "{{ item.content }}"
        dest: "/mnt/lotus-land-story/quire/secrets/{{ item.name }}"
        mode: "0600"
        owner: "{{ quire_user.name }}"
      loop:
        - name: gitea_mirror
          content: "{{ quire.gitea_mirror }}"
        - name: github_mirror
          content: "{{ quire.github_mirror }}"
        - name: github_auth_header
          content: "{{ quire.github_auth_header }}"
      loop_control:
        label: "{{ item.name }}"
      no_log: true

    - name: Write quire config
      ansible.builtin.copy:
        content: |
          {:host "quire.kejadlen.dev"
           :secrets {:github_auth_header {:file "/var/quire/secrets/github_auth_header"}
                     :gitea-mirror {:file "/var/quire/secrets/gitea_mirror"}
                     :github-mirror {:file "/var/quire/secrets/github_mirror"}}
           :sentry {:dsn "{{ quire.sentry_dsn }}"}}
        dest: /mnt/lotus-land-story/quire/config.fnl
        mode: "0644"
        owner: "{{ quire_user.name }}"
      no_log: true

    - name: Add quire user to docker group
      ansible.builtin.user:
        name: quire
        groups: docker
        append: true

    - name: Look up docker group
      ansible.builtin.getent:
        database: group
        key: docker

    - name: Add SSH keys for quire user
      ansible.posix.authorized_key:
        user: quire
        key: https://github.com/kejadlen.keys

    - name: Configure sshd for quire
      ansible.builtin.copy:
        dest: /etc/ssh/sshd_config.d/quire.conf
        content: |
          Match User quire
              AuthorizedKeysFile {{ quire_user.home }}/.ssh/authorized_keys
              ForceCommand docker exec --interactive quire quire exec "$SSH_ORIGINAL_COMMAND"
              AllowTcpForwarding no
              AllowAgentForwarding no
              X11Forwarding no
              PermitTTY no
        mode: "0644"
      notify: Restart ssh

    - name: Run Quire
      community.docker.docker_container:
        name: quire
        image: ghcr.io/kejadlen/quire:{{ version }} 
        pull: always
        env:
          QUIRE_LOG: INFO
        volumes:
          - /mnt/lotus-land-story/quire:/var/quire
          - /var/run/docker.sock:/var/run/docker.sock
        networks:
          - name: lotus_land_story
        restart_policy: unless-stopped
        state: started
        user: "{{ quire_user.uid }}"
        groups:
          - "{{ ansible_facts.getent_group.docker[1] }}"

    - name: Run quire-gitweb
      community.docker.docker_container:
        name: quire-gitweb
        image: ghcr.io/kejadlen/quire-gitweb:latest
        volumes:
          - /mnt/lotus-land-story/quire/repos:/var/quire/repos:ro
        networks:
          - name: lotus_land_story
        restart_policy: unless-stopped
        state: started
        user: "{{ quire_user.uid }}"

  handlers:
    - name: Import restarts
      ansible.builtin.import_tasks: restarts.yml

# vim: ft=yaml.ansible