150 lines
4.0 KiB
Markdown
150 lines
4.0 KiB
Markdown
|
# Ansible / Dev TODO
|
||
|
|
Cluster/Ansible Setup
|
||
|
|
- [x] Setup Playbook
|
||
|
|
- [x] Root as local var: `work/dtu/python-support/*`
|
||
|
|
- [x] Get 2 DO Droplets
|
||
|
|
- [x] Provision DNS
|
||
|
|
- [ ] Key Fingerprint as local var
|
||
|
|
- [x] Setup Wireguard wg0 between DO Droplets
|
||
|
|
- [ ] Setup unattended-upgrades
|
||
|
|
|
||
|
|
Swarm
|
||
|
|
- [x] Install Docker
|
||
|
|
- [x] Check Swarm ports on wg0: https://docs.docker.com/engine/swarm/swarm-tutorial/
|
||
|
|
- [x] Init Swarm manager & worker
|
||
|
|
- [x] Install rclone volume plugin: https://rclone.org/docker/
|
||
|
|
- [ ] Label big one as 'storage'
|
||
|
|
|
||
|
|
Stack: cleanup
|
||
|
|
- [x] Security Audit
|
||
|
|
- [x] **Deploy Stack**
|
||
|
|
|
||
|
|
Stack: mesh
|
||
|
|
- [x] Install Configs
|
||
|
|
- [x] **Deploy Stack**
|
||
|
|
|
||
|
|
- [x] rclone `acme.json` to R2 w/crypt
|
||
|
|
- [ ] Security Audit
|
||
|
|
|
||
|
|
Stack: site-support
|
||
|
|
- [x] Generate Configs
|
||
|
|
- [x] Install Configs
|
||
|
|
- [x] **Deploy Stack**
|
||
|
|
|
||
|
|
- [ ] Security Audit
|
||
|
|
|
||
|
|
Stack: updater
|
||
|
|
- [ ] config: main
|
||
|
|
- [ ] config: cleanup
|
||
|
|
- [ ] config: mesh
|
||
|
|
- [ ] config: site-support
|
||
|
|
- [ ] Install Configs
|
||
|
|
- [ ] **Deploy Stack**
|
||
|
|
|
||
|
|
- [ ] Security Audit
|
||
|
|
|
||
|
|
Stack: auth
|
||
|
|
- [ ] Write Stack
|
||
|
|
- [ ] storage: authentik-postgres
|
||
|
|
- [ ] storage: authentik-redis
|
||
|
|
- [ ] *Test Deploy*
|
||
|
|
|
||
|
|
- [ ] configs: Blueprints (export from prototyping)
|
||
|
|
- [ ] Install Configs
|
||
|
|
- [ ] role: API Setup of Things
|
||
|
|
- [ ] **Deploy Stack**
|
||
|
|
|
||
|
|
- [ ] updater: Integrate update-check
|
||
|
|
- [ ] Security Audit
|
||
|
|
|
||
|
|
Stack: s3
|
||
|
|
- [ ] Write Stack
|
||
|
|
- https://geek-cookbook.funkypenguin.co.nz/recipes/minio/
|
||
|
|
- Restrict to 'storage' label.
|
||
|
|
|
||
|
|
- [ ] ...?
|
||
|
|
- [ ] Install Configs
|
||
|
|
- [ ] Install Secrets
|
||
|
|
- [ ] storage: minio
|
||
|
|
- [ ] *Test Deploy*
|
||
|
|
|
||
|
|
- [ ] role: API Setup of Things
|
||
|
|
- [ ] **Deploy Stack**
|
||
|
|
|
||
|
|
- [ ] auth: Integrate OIDC
|
||
|
|
- https://min.io/docs/minio/container/operations/external-iam.html
|
||
|
|
- https://goauthentik.io/integrations/services/minio/
|
||
|
|
- [ ] updater: integrate
|
||
|
|
- [ ] Security Audit
|
||
|
|
|
||
|
|
Stack: chat
|
||
|
|
- [ ] Write Stack
|
||
|
|
- https://geek-cookbook.funkypenguin.co.nz/recipes/minio/
|
||
|
|
- Restrict to 'storage' label.
|
||
|
|
|
||
|
|
- [ ] ...?
|
||
|
|
- [ ] Install Configs
|
||
|
|
- [ ] Install Secrets
|
||
|
|
- [ ] storage: zulip-postgres
|
||
|
|
- [ ] storage: zulip-rabbitmq
|
||
|
|
- [ ] storage: zulip-redis
|
||
|
|
- [ ] s3: zulip
|
||
|
|
- [ ] *Test Deploy*
|
||
|
|
|
||
|
|
- [ ] auth: Integrate OIDC
|
||
|
|
- https://zulip.readthedocs.io/en/latest/production/authentication-methods.html#openid-connect
|
||
|
|
- Backup SAML: https://goauthentik.io/integrations/services/zulip/
|
||
|
|
- [ ] role: API Setup of Things
|
||
|
|
- [ ] **Deploy Stack**
|
||
|
|
|
||
|
|
- [ ] updater: Integrate
|
||
|
|
- [ ] Security Audit
|
||
|
|
|
||
|
|
Stack: git
|
||
|
|
- [ ] Install Configs
|
||
|
|
- [ ] Install Secrets
|
||
|
|
- [ ] *Test Deploy*
|
||
|
|
|
||
|
|
- [ ] storage: gitea-redis
|
||
|
|
- [ ] storage: gitea-postgres
|
||
|
|
- [ ] storage: gitea-mellisearch
|
||
|
|
- https://www.meilisearch.com/docs/learn/cookbooks/docker
|
||
|
|
- [ ] s3: gitea
|
||
|
|
- [ ] s3 via rclone: gitea (repositories)
|
||
|
|
- [ ] role: API Setup of Things
|
||
|
|
- [ ] **Deploy Stack**
|
||
|
|
|
||
|
|
- [ ] Configure gitea-actions w/auto-setup
|
||
|
|
- [ ] manual: Migrate docker-mdbook, site-support.
|
||
|
|
|
||
|
|
|
||
|
|
Bonus:
|
||
|
|
- Play with `uptime`.
|
||
|
|
- Backups!
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
# Playbook Creation Notes
|
||
|
|
- [x] mesh should use a non-`local` driver.
|
||
|
|
- [ ] Implement rolling updates to services within stacks, whose configs have changed.
|
||
|
|
- Note `rolling_updates` in the `docker_config` ansible module.
|
||
|
|
- With a little information-gathering, I'm certain we can prevent actually stopping stacks on deploy and instead only do the secret rotation as described in the Docker documentation: https://docs.docker.com/engine/swarm/secrets/#example-rotate-a-secret
|
||
|
|
- NOTE that the rclone volume stuff is always gonna need manual stop/start. Is jank. Such is the life.
|
||
|
|
|
||
|
|
- [ ] Automatic R2 Bucket Creation
|
||
|
|
- [ ] Only do the delays when we actually need to stop stacks / unmount volumes
|
||
|
|
|
||
|
|
- [ ] Encrypted use of R2 bucket.
|
||
|
|
- https://rclone.org/crypt/
|
||
|
|
|
||
|
|
- [ ] Templated security.txt in site-support
|
||
|
|
- [ ] Templated limits to not kill the demo hosts in ex. site-support :)
|
||
|
|
|
||
|
|
- [ ] Please, please, a nice README.md in site-support?
|
||
|
|
|
||
|
|
- [ ] Move DNS stuff out to the stacks. Trust me!
|
||
|
|
- [ ] Invest in some delegation to roles. These playbooks be gettin messy.
|
||
|
|
|
||
|
|
- [ ] Figure out a way to deal with concurrent `acme.json` in Traefik. For now I've set it to one replica and `vfs_cache_mode=full` (I think `none` may be wonky with this particular need of Traefik?)
|
||
|
|
- Needs more testing!
|