Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
124 lines
3.6 KiB
YAML
124 lines
3.6 KiB
YAML
---
|
|
- name: Get home directory for {{ ansible_user }}
|
|
ansible.builtin.getent:
|
|
database: passwd
|
|
key: "{{ ansible_user }}"
|
|
|
|
- name: Set user home directory fact
|
|
ansible.builtin.set_fact:
|
|
user_home_dir: "{{ ansible_facts['getent_passwd'][ansible_user][4] }}"
|
|
|
|
- name: Create Deluge project directory
|
|
ansible.builtin.file:
|
|
path: "{{ podman_projects_dir | default('/opt/podman') }}/deluge"
|
|
state: directory
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0755"
|
|
|
|
- name: Create Deluge state directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0750"
|
|
loop:
|
|
- "{{ deluge_config_dir }}"
|
|
- "{{ deluge_downloads_dir }}"
|
|
|
|
- name: Get current Deluge image ID
|
|
ansible.builtin.command: "podman image inspect --format {% raw %}{{.Id}}{% endraw %} {{ deluge_image }}:{{ deluge_version }}"
|
|
register: deluge_image_before
|
|
failed_when: false # image may not exist yet on first deploy
|
|
changed_when: false
|
|
become: false
|
|
become_user: "{{ ansible_user }}"
|
|
|
|
- name: Pull Deluge container image
|
|
ansible.builtin.command: "podman pull --quiet {{ deluge_image }}:{{ deluge_version }}"
|
|
register: deluge_pull
|
|
changed_when: deluge_pull.stdout != deluge_image_before.stdout
|
|
become: false
|
|
become_user: "{{ ansible_user }}"
|
|
notify: Restart Deluge
|
|
|
|
- name: Deploy Kubernetes YAML for Deluge
|
|
ansible.builtin.template:
|
|
src: deluge.yaml.j2
|
|
dest: "{{ podman_projects_dir | default('/opt/podman') }}/deluge/deluge.yaml"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0644"
|
|
notify: Restart Deluge
|
|
|
|
- name: Create systemd user directory for Deluge
|
|
ansible.builtin.file:
|
|
path: "{{ user_home_dir }}/.config/systemd/user"
|
|
state: directory
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0755"
|
|
|
|
- name: Create systemd service for Deluge (user scope)
|
|
ansible.builtin.template:
|
|
src: deluge.service.j2
|
|
dest: "{{ user_home_dir }}/.config/systemd/user/deluge.service"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0644"
|
|
notify: Reload systemd user
|
|
|
|
- name: Enable lingering for user {{ ansible_user }}
|
|
ansible.builtin.command: "loginctl enable-linger {{ ansible_user }}"
|
|
changed_when: false
|
|
when: ansible_user != 'root'
|
|
|
|
- name: Enable and start Deluge service (user scope)
|
|
ansible.builtin.systemd:
|
|
name: deluge.service
|
|
enabled: true
|
|
state: started
|
|
scope: user
|
|
become: false
|
|
become_user: "{{ ansible_user }}"
|
|
|
|
- name: Allow torrent traffic through firewall
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ deluge_torrent_port }}"
|
|
proto: any
|
|
from: "{{ item }}"
|
|
direction: in
|
|
comment: "Deluge torrent"
|
|
loop: "{{ deluge_firewall_allowed_sources }}"
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
retries: 5
|
|
delay: 2
|
|
register: _deluge_ufw
|
|
until: _deluge_ufw is succeeded
|
|
|
|
- name: Provision TLS certificate for Deluge
|
|
ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
|
|
vars:
|
|
certbot_hostname: "{{ deluge_nginx_hostname }}"
|
|
when: deluge_nginx_enabled and deluge_nginx_letsencrypt
|
|
|
|
- name: Deploy nginx vhost configuration for Deluge
|
|
ansible.builtin.template:
|
|
src: nginx-vhost.conf.j2
|
|
dest: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/deluge.conf"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: deluge_nginx_enabled
|
|
notify: Reload nginx
|
|
|
|
- name: Remove nginx vhost configuration for Deluge
|
|
ansible.builtin.file:
|
|
path: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/deluge.conf"
|
|
state: absent
|
|
when: not deluge_nginx_enabled
|
|
notify: Reload nginx
|