Added kafka and springBoot roles, minor cleanup, and use ansible-vault to hide sensitive data

ansible/roles/apache/tasks/letsencrypt.yaml

@@ -0,0 +1,5 @@
+---
+- name: Install python3-certbot-apache
+  ansible.builtin.apt:
+    name: python3-certbot-apache
+    update_cache: true

ansible/roles/apache/tasks/main.yml

@@ -1,4 +1,6 @@
 ---
+- name: Install Apache certbot
+  ansible.builtin.import_tasks: letsencrypt.yaml
 - name: Install apache 2
   ansible.builtin.apt:
     name: apache2

ansible/roles/drone/tasks/drone.yml

@@ -11,13 +11,6 @@
     cmd: openssl rand -hex 16
   register: drone_rpc_secret
   changed_when: false
-- name: Create drone config directory
-  ansible.builtin.file:
-    state: directory
-    path: /etc/drone
-    mode: "755"
-    owner: root
-    group: root
 - name: Copy docker compose file for drone
   ansible.builtin.template:
     src: etc/drone/docker-compose.yml.j2

ansible/roles/gitea/tasks/gitea.yaml

@@ -47,9 +47,9 @@
   ansible.builtin.command:
     chdir: /home/{{ ssh_user }}/gitea/custom/conf
     argv:
-    - bash
-    - -c
-    - grep -e ^SECRET_KEY app.ini | cut -f 3 -d ' '
+      - bash
+      - -c
+      - grep -e ^SECRET_KEY app.ini | cut -f 3 -d ' '
 - name: Read existing internal token
   register: existing_internal_token
   when: config_file.stat.exists

ansible/roles/kafka/meta/main.yaml

@@ -0,0 +1,3 @@
+---
+dependencies:
+  - role: docker

ansible/roles/kafka/tasks/main.yaml

@@ -0,0 +1,24 @@
+---
+- name: Create Kafka directory
+  ansible.builtin.file:
+    state: directory
+    path: /opt/kafka
+    owner: root
+    group: root
+    mode: "755"
+- name: Copy docker compose file for kafka
+  ansible.builtin.template:
+    src: opt/kafka/docker-compose.yaml.j2
+    dest: /opt/kafka/docker-compose.yaml
+    owner: root
+    group: root
+    mode: "644"
+    lstrip_blocks: true
+- name: Create Kafka network
+  community.docker.docker_network:
+    name: kafka
+    state: present
+    appends: true
+- name: Start kafka docker container
+  community.docker.docker_compose:
+    project_src: /opt/kafka

ansible/roles/kafka/templates/opt/kafka/docker-compose.yaml.j2

@@ -0,0 +1,41 @@
+version: '2'
+services:
+  zookeeper:
+    image: confluentinc/cp-zookeeper:latest
+    restart: always
+    environment:
+      ZOOKEEPER_CLIENT_PORT: 2181
+      ZOOKEEPER_TICK_TIME: 2000
+    expose:
+      - "2181"
+    networks:
+      - kafka
+
+  kafka:
+    image: confluentinc/cp-kafka:latest
+    depends_on:
+      - zookeeper
+    expose:
+      - "9092"
+    networks:
+      - kafka
+    restart: always
+    environment:
+      KAFKA_BROKER_ID: 1
+      KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
+      KAFKA_LISTENERS: PLAINTEXT://kafka:9092
+      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9092
+      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT:PLAINTEXT
+      KAFKA_INTER_BROKER_LISTENER_NAME: PLAINTEXT
+      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
+
+  kafkacat:
+    image: confluentinc/cp-kafkacat:7.0.10
+    command: sleep infinity
+    networks:
+      - kafka
+
+networks:
+  kafka:
+    name: kafka
+    external: true

ansible/roles/letsencrypt/tasks/main.yml

@@ -3,7 +3,3 @@
   ansible.builtin.apt:
     name: certbot
     update_cache: true
-- name: Install python3-certbot-apache
-  ansible.builtin.apt:
-    name: python3-certbot-apache
-    update_cache: true

ansible/roles/nginx/handlers/main.yaml

@@ -0,0 +1,9 @@
+---
+- name: Restart nginx
+  ansible.builtin.service:
+    name: nginx
+    state: restarted
+- name: Reload nginx
+  ansible.builtin.service:
+    name: nginx
+    state: reloaded

ansible/roles/nginx/meta/main.yaml

@@ -0,0 +1,3 @@
+---
+dependencies:
+  - role: letsencrypt

ansible/roles/nginx/tasks/letsencrypt.yaml

@@ -0,0 +1,12 @@
+---
+- name: Install python3-certbot-nginx
+  ansible.builtin.apt:
+    name: python3-certbot-nginx
+    update_cache: true
+- name: Create directory for acme challenge
+  ansible.builtin.file:
+    state: directory
+    path: /var/www/html/.well-known/acme-challenge
+    owner: root
+    group: root
+    mode: "700"

ansible/roles/nginx/tasks/main.yaml

@@ -0,0 +1,11 @@
+---
+- name: Install nginx
+  ansible.builtin.apt:
+    name: nginx
+    update_cache: true
+- name: Allow nginx through firewall
+  community.general.ufw:
+    name: Nginx Full
+    rule: allow
+- name: Prepare for Let's Encrypt
+  ansible.builtin.import_tasks: letsencrypt.yaml

ansible/roles/spring_boot/meta/main.yaml

@@ -0,0 +1,6 @@
+---
+dependencies:
+  - role: docker
+  - role: letsencrypt
+  - role: nginx
+  - role: kafka

ansible/roles/spring_boot/tasks/docker.yaml

@@ -0,0 +1,19 @@
+---
+- name: Create Spring Boot application directory
+  ansible.builtin.file:
+    state: directory
+    path: /opt/{{ spring_docker_path }}
+    owner: root
+    group: root
+    mode: "755"
+- name: Copy docker compose file for application
+  ansible.builtin.template:
+    src: opt/application/docker-compose.yaml.j2
+    dest: /opt/{{ spring_docker_path }}/docker-compose.yaml
+    owner: root
+    group: root
+    mode: "644"
+    lstrip_blocks: true
+- name: Start application docker container
+  community.docker.docker_compose:
+    project_src: /opt/{{ spring_docker_path }}

ansible/roles/spring_boot/tasks/main.yaml

@@ -0,0 +1,6 @@
+---
+- name: Set up nginx for Spring Boot application
+  ansible.builtin.import_tasks: nginx.yaml
+  when: spring_use_nginx
+- name: Set up docker-compose
+  ansible.builtin.import_tasks: docker.yaml

ansible/roles/spring_boot/tasks/nginx.yaml

@@ -0,0 +1,38 @@
+---
+- name: Add HTTP site
+  ansible.builtin.template:
+    src: etc/nginx/sites-available/spring_domain.conf.j2
+    dest: /etc/nginx/sites-available/{{ spring_domain }}.conf
+    owner: root
+    group: root
+    mode: "644"
+    force: false
+    lstrip_blocks: true
+- name: Disable default site
+  ansible.builtin.command:
+    cmd: rm /etc/nginx/sites-enabled/default
+    removes: /etc/nginx/sites-enabled/default
+- name: Enable HTTP site
+  ansible.builtin.command:
+    cmd: ln -sf /etc/nginx/sites-available/{{ spring_domain }}.conf /etc/nginx/sites-enabled/{{ spring_domain }}.conf
+    creates: /etc/nginx/sites-enabled/{{ spring_domain }}.conf
+  notify: Reload nginx
+- name: Check certificate existence
+  ansible.builtin.stat:
+    path: "/etc/letsencrypt/live/{{ spring_domain }}/cert.pem"
+  register: certificate
+- name: Generate certificates
+  ansible.builtin.command:
+    cmd: >
+      certbot --nginx --non-interactive --keep-until-expiring
+      --no-eff-email
+      --email {{ admin_mail }}
+      --redirect
+      --renew-with-new-domains --agree-tos -d {{ spring_domain }}
+    creates: "/etc/letsencrypt/live/{{ spring_domain }}/cert.pem"
+  register: certbot_certificate_created
+  notify: Reload nginx
+  failed_when:
+    - "'Successfully received certificate.' not in certbot_certificate_created.stdout"
+  when:
+    - not certificate.stat.exists

ansible/roles/spring_boot/templates/etc/nginx/sites-available/spring_domain.conf.j2

@@ -0,0 +1,18 @@
+server {
+    listen 80;
+    listen [::]:80;
+
+    server_name {{ spring_domain }};
+
+    location ^~ /.well-known/acme-challenge/ {
+        default_type "text/plain";
+    }
+
+    {% for app in spring_apps %}
+    {% if app.expose %}
+    location {{ app.path }} {
+        proxy_pass http://localhost:{{ app.port }};
+    }
+    {% endif %}
+    {% endfor %}
+}

ansible/roles/spring_boot/templates/opt/application/docker-compose.yaml.j2

@@ -0,0 +1,28 @@
+version: '2'
+
+services:
+  {% for app in spring_apps %}
+  {{ app.name }}:
+    image: {{ app.image }}:{{ lookup('ansible.builtin.vars', app.name + '_image_version') }}
+    {% if app.expose %}
+    ports:
+      - "{{ app.port }}:{{ app.port }}"
+    {% else %}
+    expose:
+      - "{{ app.port }}"
+    {% endif %}
+    {% if 'depends_on' in app %}
+    depends_on: {{ app.depends_on }}
+    {% endif %}
+    restart: always
+    networks:
+      - kafka
+    {% if app.has_environment %}
+    environment: {{ lookup('ansible.builtin.vars', app.name + '_environment') }}
+    {% endif %}
+  {% endfor %}
+
+networks:
+  kafka:
+    name: kafka
+    external: true