new files from source

2026-06-09 10:20:07 +03:00
commit 973546647d
@@ -0,0 +1,2 @@
 [Desktop Entry]
 Icon=/home/thesabear/Downloads/App Images/devops_iac_publicreo.png
@@ -0,0 +1,57 @@
 ---
 - hosts: Docker
  become: true
  become_method: sudo
  become_user: root
  vars:
   GOTIFY_IP: xxx #[Your gotify host IP goes here]
   GOTIFY_PORT: xxx #[Your gotify port goes here]
   GOTIFY_TOKEN: xxx #[Your app token goes here]  
   ansible_python_interpreter: /usr/bin/python3
  tasks:
    - name: prune non-dangling images
      community.docker.docker_prune:
        containers: false
        images: true
        images_filters:
          dangling: false
        networks: false
        volumes: false
        builder_cache: false
    - name: Check if reboot is required
      stat:
        path: /var/run/reboot-required
      register: reboot_required_file
    - name: Show Output of required reboots
      debug: msg="{{ reboot_required_file.stat.exists == true }}" 
    - name: Rebooting machine
      shell: sleep 2 && shutdown -r now "Ansible updates triggered"
      async: 1
      poll: 0
      ignore_errors: true
      when: reboot_required_file.stat.exists
    - name: Waiting for the machine to come back
      local_action: wait_for host={{ ansible_host }} state=started port=22 delay=30
      become: false
      when: reboot_required_file.stat.exists
    - name: notify via Gotify
      uri:
        url: 'http://{{ GOTIFY_IP }}:{{ GOTIFY_PORT }}/message?token={{ GOTIFY_TOKEN }}'
        method: POST
        body:
          title:
            content: clean docker hosts
          message: 
            content: The clean docker playbook has completed for {{ ansible_host }} and is now updated. A required reboot is {{ reboot_required_file.stat.exists == true }}.
          priority:
            content: '5'
        body_format: form-multipart
      register: result
 ...
@@ -0,0 +1,9 @@
 ---
 - name: ping test
  hosts: all
  become: true
  vars:
   ansible_python_interpreter: /usr/bin/python3
  tasks:
    - name: test ping
      ansible.builtin.ping:
@@ -0,0 +1,65 @@
 ### This is just a sample showing the way of removing apps from a VM using Ansible
 ---
 - hosts: all
  become: yes
  vars:
   GOTIFY_IP: xxx #[Your gotify host IP goes here]
   GOTIFY_PORT: xxx #[Your gotify port goes here]
   GOTIFY_TOKEN: xxx #[Your app token goes here]  
  tasks:
    - name: Ansible apt remove crowdsec
      apt:
        name: crowdsec
        state: absent
    - name: Ansible apt remove zabbix
      apt:
        name: zabbix
        state: absent
    - name: Ansible apt remove zabbix-agent
      apt:
        name: zabbix-agent
        state: absent
    - name: Remove dependencies that are no longer required and purge their configuration files
      ansible.builtin.apt:
        autoremove: yes
        purge: true
    - name: Check if reboot is required
      stat:
        path: /var/run/reboot-required
      register: reboot_required_file
    - name: Show Output of required reboots
      debug: msg="{{ reboot_required_file.stat.exists == true }}" 
    - name: Rebooting machine
      shell: sleep 2 && shutdown -r now "Ansible updates triggered"
      async: 1
      poll: 0
      ignore_errors: true
      when: reboot_required_file.stat.exists
    - name: Waiting for the machine to come back
      local_action: wait_for host={{ ansible_host }} state=started port=22 delay=30
      become: no
      when: reboot_required_file.stat.exists        
    - name: notify via Gotify
      uri:
        url: 'http://{{ GOTIFY_IP }}:{{ GOTIFY_PORT }}/message?token={{ GOTIFY_TOKEN }}'
        method: POST
        body:
          title:
            content: APT Packages Update
          message: 
            content: The remove apps playbook has completed for {{ ansible_host }} and is now updated. A required reboot is {{ reboot_required_file.stat.exists == true }}.
          priority:
            content: '5'
        body_format: form-multipart
      register: result
 ...
@@ -0,0 +1,8 @@
 ---
 - hosts: all
  become: true
  tasks:
    - name: Remove specified repository from sources list
      ansible.builtin.apt_repository:
        repo: xxx #put the reponame of the repo you no longer want here
        state: absent
@@ -0,0 +1,89 @@
 ---
 - name: Patching and Updating Linux Systems
  hosts: all
  become: true
  vars:
   GOTIFY_IP: xxx #[Your gotify host IP goes here]
   GOTIFY_PORT: xxx #[Your gotify port goes here]
   GOTIFY_TOKEN: xxx #[Your app token goes here]  
   ansible_python_interpreter: /usr/bin/python3
  tasks:
    - name: Update Debian-based Systems
      when: ansible_os_family == 'Debian' or ansible_os_family == 'Ubuntu'
      apt:
        update_cache: yes
        upgrade: dist
    - name: Update RHEL-based Systems
      when: ansible_os_family == 'RedHat'
      yum:
        name: '*'
        state: latest
    - name: List installed and updated packages
      shell: grep -E "^$(date +%Y-%m-%d).+ (install|upgrade) " /var/log/dpkg.log |cut -d " " -f 3-5
      register: result 
    - name: Check if Docker is installed
      command: which docker
      register: docker_installed
      ignore_errors: true
      changed_when: false
    - name: Upgrade Python pip modules for Docker support (only if Docker is installed)
      when: docker_installed.rc == 0 and ansible_os_family == 'RedHat'
      pip:
        name:
          - docker
          - requests
        state: latest
        executable: pip3  
    - name: Show Output of updated files
      debug: msg="{{ result.stdout_lines }}"
    - name: Check if reboot is required
      stat:
        path: /var/run/reboot-required
      register: reboot_required_file
    - name: Show Output of required reboots
      debug: msg="{{ reboot_required_file.stat.exists == true }}" 
    - name: Rebooting machine
      shell: sleep 2 && shutdown -r now "Ansible updates triggered"
      async: 1
      poll: 0
      ignore_errors: true
      when: reboot_required_file.stat.exists
    - name: Waiting for the machine to come back
      local_action: wait_for host={{ ansible_host }} state=started port=22 delay=30
      become: false
      when: reboot_required_file.stat.exists
 ###
    - name: Remove DNF dependencies that are no longer required.
      when: ansible_os_family == 'RedHat'
      ansible.builtin.dnf:
        autoremove: yes
    - name: Remove APT dependencies that are no longer required.
      when: ansible_os_family == 'Debian' or ansible_os_family == 'Ubuntu'
      ansible.builtin.apt:
        autoremove: yes        
    - name: notify via Gotify
      uri:
        url: 'http://{{ GOTIFY_IP }}:{{ GOTIFY_PORT }}/message?token={{ GOTIFY_TOKEN }}'
        method: POST
        body:
          title:
            content: All Packages Update
          message: 
            content: The upgrade-packages playbook has completed for {{ ansible_host }} and is now updated. A required reboot is {{ reboot_required_file.stat.exists == true }}.
          priority:
            content: '5'
        body_format: form-multipart
      register: result
 ...
@@ -0,0 +1,18 @@
 services:
  actual_server:
    image: actualbudget/actual-server:latest
    container_name: actual
    ports:
      - 5006:5006
    environment:
      - PUID=PUID
      - PGID=PGID
      - TZ=timezone
      # Uncomment any of the lines below to set configuration options.
      # - ACTUAL_HTTPS_KEY=/data/selfhost.key
      # - ACTUAL_HTTPS_CERT=/data/selfhost.crt
      # See all options and more details at https://actualbudget.github.io/docs/Installing/Configuration
      # !! If you are not using any of these options, remove the 'environment:' tag entirely.
    volumes:
      - /path/to/actual-data:/data
    restart: unless-stopped
@@ -0,0 +1,19 @@
  airsonic-advanced:
    image: lscr.io/linuxserver/airsonic-advanced:latest
    container_name: airsonic-advanced
    environment:
      - PUID=PUID
      - PGID=PGID # Note that if you want to use Airsonic's Java jukebox player, then PGID will need to match the group of your sound device (e.g. /dev/snd).
      - TZ=timezone
    volumes:
      - /path/toairsonic-advanced:/config
      - /path/to/music:/music
      - /path/to/playlists:/playlists
      - /path/to/audiobooks:/audiobooks
      - </path/to/other media:/media #optional
    ports:
      - 4040:4040
      - 4041:4041
    devices:
      - /dev/snd:/dev/snd #need this to enable jukebox mode on the server
    restart: unless-stopped  
@@ -0,0 +1,75 @@
 ---
 services:
  postgresql:
    image: docker.io/library/postgres:16-alpine
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    volumes:
      - /path/to/authentik/database:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
      POSTGRES_USER: ${PG_USER:-authentik}
      POSTGRES_DB: ${PG_DB:-authentik}
    env_file:
      - .env
  redis:
    image: docker.io/library/redis:alpine
    command: --save 60 1 --loglevel warning
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    volumes:
      - /path/to/authentik/redis:/data
  server:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.4.2}
    restart: unless-stopped
    command: server
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
    volumes:
      - /path/to/authentik/media:/media
      - /path/to/authentik/custom-templates:/templates
    env_file:
      - .env
    ports:
      - "${HTTP_PORT}:9000"
      - "${HTTPS_PORT}:9443"
    depends_on:
      - postgresql
      - redis
  worker:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.4.2}
    restart: unless-stopped
    command: worker
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
    user: root
    volumes:
      - /path/to/authentik/var/run/docker.sock:/var/run/docker.sock
      - /path/to/authentik/media:/media
      - /path/to/authentik/certs:/certs
      - /path/to/authentik/custom-templates:/templates
    env_file:
      - .env
    depends_on:
      - postgresql
      - redis
@@ -0,0 +1,38 @@
 ---
 services:
  bookstack:
    image: lscr.io/linuxserver/bookstack
    container_name: bookstack
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ} 
      - APP_URL=https://subdomain.example.com
      - DB_HOST=bookstack_db
      - DB_PORT=${DB_PORT}
      - DB_USER=${DB_USER}
      - DB_PASS=${DB_PASS}
      - DB_DATABASE=${DB_DATABASE}
      - APP_DEFAULT_DARK_MODE=true
    volumes:
      - /path/to/bookstack/bookstack_app_data:/config
    ports:
      - ${HTTP_PORT}:80
    restart: unless-stopped
    depends_on:
      - bookstack_db
  bookstack_db:
    image: lscr.io/linuxserver/mariadb
    container_name: bookstack_db
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ} 
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - MYSQL_DATABASE=${MYSQL_DATABASE}
      - MYSQL_USER=${MYSQL_USER}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
    volumes:
      - /path/to/bookstack/bookstack_db_data:/config
    restart: unless-stopped
@@ -0,0 +1,15 @@
 version: '3'
 services:
  calibre-web:
    image: lscr.io/linuxserver/calibre-web:latest
    container_name: calibre-web
    environment:
      - PUID=PUID
      - PGID=PGID
      - TZ=timezone
    volumes:
      - /path/to/calibre-web:/config
      - /path/to/books:/books
    ports:
      - 8083:8083
    restart: unless-stopped
@@ -0,0 +1,18 @@
 version: '3'
 services:
  calibre:
    image: lscr.io/linuxserver/calibre:latest
    container_name: calibre
    environment:
      - PUID=PUID
      - PGID=PGID
      - TZ=timezone
      - CUSTOM_USER=user
      - PASSWORD=password
    volumes:
      - /path/to/calibre:/config
      - /path/to/books:/books
    ports:
      - 8080:8080
      - 8081:8081
    restart: unless-stopped
@@ -0,0 +1,10 @@
 services:
  cloudcmd:
    image: coderaiser/cloudcmd
    container_name: cloudcmd
    ports:
      - 8000:8000
    volumes:
      - ~:/root
      - /:/mnt/fs
    restart: unless-stopped   
@@ -0,0 +1,26 @@
 services:
  diun:
    image: crazymax/diun:latest
    container_name: diun
    command: serve
    volumes:
      - /path/to/diun/data:/data
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ} 
      - LOG_LEVEL=info
      - DIUN_WATCH_WORKERS=20
      - DIUN_WATCH_SCHEDULE=0 7 * * MON    ###    At 07:00 AM, only on Monday
      - DIUN_WATCH_JITTER=30s
      - DIUN_WATCH_RUNONSTARTUP=true
      - DIUN_PROVIDERS_DOCKER=true
      - DIUN_PROVIDERS_DOCKER_WATCHBYDEFAULT=true
      - DIUN_NOTIF_GOTIFY_ENDPOINT=${DIUN_NOTIF_GOTIFY_ENDPOINT}
      - DIUN_NOTIF_GOTIFY_TOKEN=${DIUN_NOTIF_GOTIFY_TOKEN}
      - DIUN_NOTIF_GOTIFY_PRIORITY=1
      - DIUN_NOTIF_GOTIFY_TIMEOUT=10s
    labels:
      - diun.enable=true
    restart: always
@@ -0,0 +1,24 @@
 services:
  node_exporter:
    image: quay.io/prometheus/node-exporter:latest
    container_name: node_exporter
    command:
      - "--path.rootfs=/host"
    network_mode: host
    pid: host
    restart: unless-stopped
    volumes:
      - "/:/host:ro,rslave"
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    container_name: cadvisor
    ports:
      - "8080:8080"
    restart: unless-stopped
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
@@ -0,0 +1,15 @@
 services:
  duplicati:
    image: lscr.io/linuxserver/duplicati:latest
    container_name: duplicati
    environment:
      - PUID=PUID #setting PUID as 0 (root) is required to give permissions for all tasks
      - PGID=PGID #setting PGID as 0 (root) is required to give permissions for all tasks
      - TZ=timezone
    volumes:
      - /path/to/appdata/config:/config
      - /path/to/backups:/backups
      - /path/to/source:/source
    ports:
      - 8200:8200
    restart: unless-stopped  
@@ -0,0 +1,20 @@
 services:
  gitlab:
    image: gitlab/gitlab-ce:latest
    container_name: gitlab
    restart: always
    hostname: "gitlab.example.com"
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        # Add any other gitlab.rb configuration here, each on its own line
        external_url 'http://gitlab.example.com:8929'
        gitlab_rails['gitlab_shell_ssh_port'] = 2424
    ports:
      - "${HTTP_PORT}:80"
      - "${HTTPS_PORT}:443"
      - "${SSH_PORT}:22"
    volumes:
      - "/path/to/gitlab/config:/etc/gitlab"
      - "/path/to/gitlab/logs:/var/log/gitlab"
      - "/path/to/gitlab/data:/var/opt/gitlab"
    shm_size: "2gb"
@@ -0,0 +1,16 @@
 services:
  gotify:
    image: gotify/server
    container_name: gotify
    ports:
      - ${HTTP_PORT}:80
      - ${HTTPS_PORT}:443
    volumes:
      - /path/to/gotify:/app/data
    restart: always
    security_opt:
      - no-new-privileges:true
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ} 
@@ -0,0 +1,60 @@
 services:
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    restart: unless-stopped
    user: "PUID"
    environment:
      - PUID:PUID
      - PGID:PGID
    ports:
      - 9090:9090
    volumes:
      - /path/to/prometheus/config/prometheus.yml:/etc/prometheus/prometheus.yml
      - /path/to/prometheus/prometheus-data:/prometheus
    command:
      - "--web.enable-lifecycle"
      - "--config.file=/etc/prometheus/prometheus.yml"
  node_exporter:
    image: quay.io/prometheus/node-exporter:latest
    container_name: node_exporter
    command:
      - "--path.rootfs=/host"
    network_mode: host
    pid: host
    restart: unless-stopped
    volumes:
      - "/:/host:ro,rslave"
  grafana:
    container_name: grafana
    image: grafana/grafana-oss:latest
    ports:
      - 3000:3000
    user: "0"  
    volumes:
      - /path/to/grafana-data:/var/lib/grafana
    restart: unless-stopped
  pve-exporter:
    image: prompve/prometheus-pve-exporter:latest
    container_name: pve-exporter
    ports:
      - "9221:9221"
    restart: unless-stopped
    volumes:
      - /path/to/pve/pve.yml:/etc/prometheus/pve.yml
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    container_name: cadvisor
    ports:
      - "8080:8080"
    restart: unless-stopped
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
@@ -0,0 +1,14 @@
 version: '3'
 services:
  grocy:
    image: lscr.io/linuxserver/grocy
    container_name: grocy
    environment:
      - PUID=PUID
      - PGID=PGID
      - TZ=timezone
    volumes:
      - /path/to/grocy:/config
    ports:
      - 80:80
    restart: unless-stopped    
@@ -0,0 +1,33 @@
 services:
  homeassistant:
    container_name: home-assistant
    image: "ghcr.io/home-assistant/home-assistant:stable"
    volumes:
      - /path/to/home-assistant/config:/config
      - /etc/localtime:/etc/localtime:ro
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ} 
    restart: unless-stopped
    ports:
      - ${HTTP_PORT}:8123
    depends_on:
      - homeassistant-db
    privileged: true
  homeassistant-db:
    image: docker.io/postgres:16.3
    container_name: homeassistant-db
    restart: unless-stopped
    environment:
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
      # ensure the database gets created correctly
      # https://github.com/matrix-org/synapse/blob/master/docs/postgres.md#set-up-database
      - POSTGRES_INITDB_ARGS=--encoding=UTF-8
    volumes:
      - /path/to/home-assistant/schemas:/var/lib/postgresql/data
    security_opt:
      - no-new-privileges:true
@@ -0,0 +1,7 @@
 services:
  it-tools:
    image: 'corentinth/it-tools:latest'  
    ports:
      - '${HTTP_PORT}:80'  
    restart: unless-stopped  
    container_name: it-tools  
@@ -0,0 +1,79 @@
 services:
  immich-server:
    container_name: immich_server
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ} 
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    command: [ "start.sh", "immich" ]
    volumes:
      - /path/to/upload:/usr/src/app/upload
    env_file:
      - .env
    ports:
      - ${HTTP_PORT}:3001
    depends_on:
      - redis
      - database
    restart: always
  immich-microservices:
    container_name: immich_microservices
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ} 
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    extends:
      file: hwaccel.yml
      service: hwaccel
    command: [ "start.sh", "microservices" ]
    volumes:
      - /path/to/upload:/usr/src/app/upload
    env_file:
      - .env
    depends_on:
      - redis
      - database
    restart: always
  immich-machine-learning:
    container_name: immich_machine_learning
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ} 
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    volumes:
      - /path/to/immich/model-cache:/cache
    env_file:
      - .env
    restart: always
  redis:
    container_name: immich_redis
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ} 
    image: redis:6.2-alpine@sha256:70a7a5b641117670beae0d80658430853896b5ef269ccf00d1827427e3263fa3
    restart: always
  database:
    container_name: immich_postgres
    image: registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
    env_file:
      - .env
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ} 
      - POSTGRES_PASSWORD=${DB_PASSWORD}
      - POSTGRES_USER=${DB_USERNAME}
      - POSTGRES_DB=${DB_DATABASE_NAME}
    volumes:
      - /path/to/immich/pgdata:/var/lib/postgresql/data
    restart: always
 ## there is a known issue with Traefik: see here https://github.com/immich-app/immich/discussions/437#discussioncomment-3609797
@@ -0,0 +1,17 @@
 services:
  jenkins-master:
    image: jenkins/jenkins:latest
    container_name: jenkins-master
    privileged: true
    user: root
    environment:
      - PUID=PUID
      - PGID=PGID
    ports:
      - 8080:8080
      - 50000:50000
    volumes:
      - /path/to/jenkins/jenkins-data:/var/jenkins_home
      - /path/to/jenkins/var/run/docker.sock:/var/run/docker.sock
    restart: unless-stopped
@@ -0,0 +1,447 @@
 services:
    # Frontend
    web:
        image: jitsi/web:${JITSI_IMAGE_VERSION:-stable-9457-2}
        restart: ${RESTART_POLICY:-unless-stopped}
        ports:
            - '${HTTP_PORT}:80'
            - '${HTTPS_PORT}:443'
        volumes:
            - ${CONFIG}/web:/config:Z
            - ${CONFIG}/web/crontabs:/var/spool/cron/crontabs:Z
            - ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts:Z
        environment:
            - AMPLITUDE_ID
            - ANALYTICS_SCRIPT_URLS
            - ANALYTICS_WHITELISTED_EVENTS
            - AUDIO_QUALITY_OPUS_BITRATE
            - AUTO_CAPTION_ON_RECORD
            - BRANDING_DATA_URL
            - BOSH_RELATIVE
            - CHROME_EXTENSION_BANNER_JSON
            - COLIBRI_WEBSOCKET_PORT
            - COLIBRI_WEBSOCKET_JVB_LOOKUP_NAME
            - COLIBRI_WEBSOCKET_REGEX
            - CONFCODE_URL
            - CORS_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN
            - DEFAULT_LANGUAGE
            - DEPLOYMENTINFO_ENVIRONMENT
            - DEPLOYMENTINFO_ENVIRONMENT_TYPE
            - DEPLOYMENTINFO_REGION
            - DEPLOYMENTINFO_SHARD
            - DEPLOYMENTINFO_USERREGION
            - DESKTOP_SHARING_FRAMERATE_AUTO
            - DESKTOP_SHARING_FRAMERATE_MIN
            - DESKTOP_SHARING_FRAMERATE_MAX
            - DIALIN_NUMBERS_URL
            - DIALOUT_AUTH_URL
            - DIALOUT_CODES_URL
            - DISABLE_AUDIO_LEVELS
            - DISABLE_COLIBRI_WEBSOCKET_JVB_LOOKUP
            - DISABLE_DEEP_LINKING
            - DISABLE_GRANT_MODERATOR
            - DISABLE_HTTPS
            - DISABLE_KICKOUT
            - DISABLE_LOCAL_RECORDING
            - DISABLE_POLLS
            - DISABLE_PRIVATE_CHAT
            - DISABLE_PROFILE
            - DISABLE_REACTIONS
            - DISABLE_REMOTE_VIDEO_MENU
            - DISABLE_START_FOR_ALL
            - DROPBOX_APPKEY
            - DROPBOX_REDIRECT_URI
            - DYNAMIC_BRANDING_URL
            - ENABLE_AUDIO_PROCESSING
            - ENABLE_AUTH
            - ENABLE_AUTH_DOMAIN
            - ENABLE_BREAKOUT_ROOMS
            - ENABLE_CALENDAR
            - ENABLE_COLIBRI_WEBSOCKET
            - ENABLE_COLIBRI_WEBSOCKET_UNSAFE_REGEX
            - ENABLE_E2EPING
            - ENABLE_FILE_RECORDING_SHARING
            - ENABLE_GUESTS
            - ENABLE_HSTS
            - ENABLE_HTTP_REDIRECT
            - ENABLE_IPV6
            - ENABLE_LETSENCRYPT
            - ENABLE_NO_AUDIO_DETECTION
            - ENABLE_NOISY_MIC_DETECTION
            - ENABLE_OCTO
            - ENABLE_OPUS_RED
            - ENABLE_PREJOIN_PAGE
            - ENABLE_P2P
            - ENABLE_WELCOME_PAGE
            - ENABLE_CLOSE_PAGE
            - ENABLE_LIVESTREAMING
            - ENABLE_LIVESTREAMING_DATA_PRIVACY_LINK
            - ENABLE_LIVESTREAMING_HELP_LINK
            - ENABLE_LIVESTREAMING_TERMS_LINK
            - ENABLE_LIVESTREAMING_VALIDATOR_REGEXP_STRING
            - ENABLE_LOAD_TEST_CLIENT
            - ENABLE_LOCAL_RECORDING_NOTIFY_ALL_PARTICIPANT
            - ENABLE_LOCAL_RECORDING_SELF_START
            - ENABLE_RECORDING
            - ENABLE_REMB
            - ENABLE_REQUIRE_DISPLAY_NAME
            - ENABLE_SERVICE_RECORDING
            - ENABLE_SIMULCAST
            - ENABLE_STATS_ID
            - ENABLE_STEREO
            - ENABLE_SUBDOMAINS
            - ENABLE_TALK_WHILE_MUTED
            - ENABLE_TCC
            - ENABLE_TRANSCRIPTIONS
            - ENABLE_XMPP_WEBSOCKET
            - ENABLE_JAAS_COMPONENTS
            - ETHERPAD_PUBLIC_URL
            - ETHERPAD_URL_BASE
            - E2EPING_NUM_REQUESTS
            - E2EPING_MAX_CONFERENCE_SIZE
            - E2EPING_MAX_MESSAGE_PER_SECOND
            - GOOGLE_ANALYTICS_ID
            - GOOGLE_API_APP_CLIENT_ID
            - HIDE_PREMEETING_BUTTONS
            - HIDE_PREJOIN_DISPLAY_NAME
            - HIDE_PREJOIN_EXTRA_BUTTONS
            - INVITE_SERVICE_URL
            - JVB_PREFER_SCTP
            - LETSENCRYPT_DOMAIN
            - LETSENCRYPT_EMAIL
            - LETSENCRYPT_USE_STAGING
            - MATOMO_ENDPOINT
            - MATOMO_SITE_ID
            - MICROSOFT_API_APP_CLIENT_ID
            - NGINX_RESOLVER
            - NGINX_WORKER_PROCESSES
            - NGINX_WORKER_CONNECTIONS
            - PEOPLE_SEARCH_URL
            - PREFERRED_LANGUAGE
            - PUBLIC_URL
            - P2P_PREFERRED_CODEC
            - RESOLUTION
            - RESOLUTION_MIN
            - RESOLUTION_WIDTH
            - RESOLUTION_WIDTH_MIN
            - START_AUDIO_MUTED
            - START_AUDIO_ONLY
            - START_SILENT
            - START_WITH_AUDIO_MUTED
            - START_VIDEO_MUTED
            - START_WITH_VIDEO_MUTED
            - TESTING_AV1_SUPPORT
            - TOKEN_AUTH_URL
            - TOOLBAR_BUTTONS
            - TRANSLATION_LANGUAGES
            - TRANSLATION_LANGUAGES_HEAD
            - TZ
            - USE_APP_LANGUAGE
            - VIDEOQUALITY_BITRATE_H264_LOW
            - VIDEOQUALITY_BITRATE_H264_STANDARD
            - VIDEOQUALITY_BITRATE_H264_HIGH
            - VIDEOQUALITY_BITRATE_H264_FULL
            - VIDEOQUALITY_BITRATE_H264_ULTRA
            - VIDEOQUALITY_BITRATE_H264_SS_HIGH
            - VIDEOQUALITY_BITRATE_VP8_LOW
            - VIDEOQUALITY_BITRATE_VP8_STANDARD
            - VIDEOQUALITY_BITRATE_VP8_HIGH
            - VIDEOQUALITY_BITRATE_VP8_FULL
            - VIDEOQUALITY_BITRATE_VP8_ULTRA
            - VIDEOQUALITY_BITRATE_VP8_SS_HIGH
            - VIDEOQUALITY_BITRATE_VP9_LOW
            - VIDEOQUALITY_BITRATE_VP9_STANDARD
            - VIDEOQUALITY_BITRATE_VP9_HIGH
            - VIDEOQUALITY_BITRATE_VP9_FULL
            - VIDEOQUALITY_BITRATE_VP9_ULTRA
            - VIDEOQUALITY_BITRATE_VP9_SS_HIGH
            - VIDEOQUALITY_BITRATE_AV1_LOW
            - VIDEOQUALITY_BITRATE_AV1_STANDARD
            - VIDEOQUALITY_BITRATE_AV1_HIGH
            - VIDEOQUALITY_BITRATE_AV1_FULL
            - VIDEOQUALITY_BITRATE_AV1_ULTRA
            - VIDEOQUALITY_BITRATE_AV1_SS_HIGH
            - VIDEOQUALITY_PREFERRED_CODEC
            - XMPP_AUTH_DOMAIN
            - XMPP_BOSH_URL_BASE
            - XMPP_DOMAIN
            - XMPP_GUEST_DOMAIN
            - XMPP_MUC_DOMAIN
            - XMPP_RECORDER_DOMAIN
            - XMPP_PORT
            - WHITEBOARD_ENABLED
            - WHITEBOARD_COLLAB_SERVER_PUBLIC_URL
        depends_on:
            - jvb
    # XMPP server
    prosody:
        image: jitsi/prosody:${JITSI_IMAGE_VERSION:-stable-9457-2}
        restart: ${RESTART_POLICY:-unless-stopped}
        expose:
            - '${XMPP_PORT:-5222}'
            - '${PROSODY_S2S_PORT:-5269}'
            - '5347'
            - '${PROSODY_HTTP_PORT:-5280}'
        volumes:
            - ${CONFIG}/prosody/config:/config:Z
            - ${CONFIG}/prosody/prosody-plugins-custom:/prosody-plugins-custom:Z
        environment:
            - AUTH_TYPE
            - DISABLE_POLLS
            - ENABLE_AUTH
            - ENABLE_AV_MODERATION
            - ENABLE_BREAKOUT_ROOMS
            - ENABLE_END_CONFERENCE
            - ENABLE_GUESTS
            - ENABLE_IPV6
            - ENABLE_LOBBY
            - ENABLE_RECORDING
            - ENABLE_S2S
            - ENABLE_VISITORS
            - ENABLE_XMPP_WEBSOCKET
            - ENABLE_JAAS_COMPONENTS
            - GC_TYPE
            - GC_INC_TH
            - GC_INC_SPEED
            - GC_INC_STEP_SIZE
            - GC_GEN_MIN_TH
            - GC_GEN_MAX_TH
            - GLOBAL_CONFIG
            - GLOBAL_MODULES
            - JIBRI_RECORDER_USER
            - JIBRI_RECORDER_PASSWORD
            - JIBRI_SIP_BREWERY_MUC
            - JIBRI_XMPP_USER
            - JIBRI_XMPP_PASSWORD
            - JICOFO_AUTH_PASSWORD
            - JICOFO_COMPONENT_SECRET
            - JIGASI_XMPP_USER
            - JIGASI_XMPP_PASSWORD
            - JVB_AUTH_USER
            - JVB_AUTH_PASSWORD
            - JWT_APP_ID
            - JWT_APP_SECRET
            - JWT_ACCEPTED_ISSUERS
            - JWT_ACCEPTED_AUDIENCES
            - JWT_ASAP_KEYSERVER
            - JWT_ALLOW_EMPTY
            - JWT_AUTH_TYPE
            - JWT_ENABLE_DOMAIN_VERIFICATION
            - JWT_SIGN_TYPE
            - JWT_TOKEN_AUTH_MODULE
            - MATRIX_UVS_URL
            - MATRIX_UVS_ISSUER
            - MATRIX_UVS_AUTH_TOKEN
            - MATRIX_UVS_SYNC_POWER_LEVELS
            - MATRIX_LOBBY_BYPASS
            - LOG_LEVEL
            - LDAP_AUTH_METHOD
            - LDAP_BASE
            - LDAP_BINDDN
            - LDAP_BINDPW
            - LDAP_FILTER
            - LDAP_VERSION
            - LDAP_TLS_CIPHERS
            - LDAP_TLS_CHECK_PEER
            - LDAP_TLS_CACERT_FILE
            - LDAP_TLS_CACERT_DIR
            - LDAP_START_TLS
            - LDAP_URL
            - LDAP_USE_TLS
            - MAX_PARTICIPANTS
            - PROSODY_ADMINS
            - PROSODY_AUTH_TYPE
            - PROSODY_C2S_LIMIT
            - PROSODY_C2S_REQUIRE_ENCRYPTION
            - PROSODY_RESERVATION_ENABLED
            - PROSODY_RESERVATION_REST_BASE_URL
            - PROSODY_ENABLE_RATE_LIMITS
            - PROSODY_ENABLE_S2S
            - PROSODY_GUEST_AUTH_TYPE
            - PROSODY_HTTP_PORT
            - PROSODY_LOG_CONFIG
            - PROSODY_MODE
            - PROSODY_RATE_LIMIT_LOGIN_RATE
            - PROSODY_RATE_LIMIT_SESSION_RATE
            - PROSODY_RATE_LIMIT_TIMEOUT
            - PROSODY_RATE_LIMIT_ALLOW_RANGES
            - PROSODY_RATE_LIMIT_CACHE_SIZE
            - PROSODY_S2S_LIMIT
            - PROSODY_S2S_PORT
            - PROSODY_TRUSTED_PROXIES
            - PROSODY_VISITOR_INDEX
            - PROSODY_VISITORS_MUC_PREFIX
            - PUBLIC_URL
            - STUN_HOST
            - STUN_PORT
            - TURN_CREDENTIALS
            - TURN_HOST
            - TURNS_HOST
            - TURN_PORT
            - TURNS_PORT
            - TURN_TRANSPORT
            - TZ
            - VISITORS_MAX_VISITORS_PER_NODE
            - VISITORS_XMPP_DOMAIN
            - VISITORS_XMPP_SERVER
            - VISITORS_XMPP_PORT
            - XMPP_BREAKOUT_MUC_MODULES
            - XMPP_CONFIGURATION
            - XMPP_DOMAIN
            - XMPP_AUTH_DOMAIN
            - XMPP_GUEST_DOMAIN
            - XMPP_MUC_DOMAIN
            - XMPP_INTERNAL_MUC_DOMAIN
            - XMPP_LOBBY_MUC_MODULES
            - XMPP_MODULES
            - XMPP_MUC_MODULES
            - XMPP_MUC_CONFIGURATION
            - XMPP_INTERNAL_MUC_MODULES
            - XMPP_RECORDER_DOMAIN
            - XMPP_PORT
            - XMPP_SERVER_S2S_PORT
            - XMPP_SPEAKERSTATS_MODULES
                aliases:
                    - ${XMPP_SERVER:-xmpp.meet.jitsi}
    # Focus component
    jicofo:
        image: jitsi/jicofo:${JITSI_IMAGE_VERSION:-stable-9457-2}
        restart: ${RESTART_POLICY:-unless-stopped}
        ports:
            - '127.0.0.1:${JICOFO_REST_PORT:-8888}:8888'
        volumes:
            - ${CONFIG}/jicofo:/config:Z
        environment:
            - AUTH_TYPE
            - BRIDGE_AVG_PARTICIPANT_STRESS
            - BRIDGE_STRESS_THRESHOLD
            - ENABLE_AUTH
            - ENABLE_AUTO_OWNER
            - ENABLE_CODEC_VP8
            - ENABLE_CODEC_VP9
            - ENABLE_CODEC_AV1
            - ENABLE_CODEC_H264
            - ENABLE_CODEC_OPUS_RED
            - ENABLE_JVB_XMPP_SERVER
            - ENABLE_OCTO
            - ENABLE_OCTO_SCTP
            - ENABLE_RECORDING
            - ENABLE_SCTP
            - ENABLE_VISITORS
            - ENABLE_AUTO_LOGIN
            - JICOFO_AUTH_LIFETIME
            - JICOFO_AUTH_PASSWORD
            - JICOFO_AUTH_TYPE
            - JICOFO_BRIDGE_REGION_GROUPS
            - JICOFO_ENABLE_AUTH
            - JICOFO_ENABLE_BRIDGE_HEALTH_CHECKS
            - JICOFO_CONF_INITIAL_PARTICIPANT_WAIT_TIMEOUT
            - JICOFO_CONF_SINGLE_PARTICIPANT_TIMEOUT
            - JICOFO_CONF_SOURCE_SIGNALING_DELAYS
            - JICOFO_CONF_MAX_AUDIO_SENDERS
            - JICOFO_CONF_MAX_VIDEO_SENDERS
            - JICOFO_CONF_STRIP_SIMULCAST
            - JICOFO_CONF_SSRC_REWRITING
            - JICOFO_ENABLE_HEALTH_CHECKS
            - JICOFO_ENABLE_REST
            - JICOFO_HEALTH_CHECKS_USE_PRESENCE
            - JICOFO_MAX_MEMORY
            - JICOFO_MULTI_STREAM_BACKWARD_COMPAT
            - JICOFO_OCTO_REGION
            - JICOFO_TRUSTED_DOMAINS
            - JIBRI_BREWERY_MUC
            - JIBRI_REQUEST_RETRIES
            - JIBRI_PENDING_TIMEOUT
            - JIGASI_BREWERY_MUC
            - JIGASI_SIP_URI
            - JIGASI_TRUSTED_DOMAINS
            - JVB_BREWERY_MUC
            - JVB_XMPP_AUTH_DOMAIN
            - JVB_XMPP_INTERNAL_MUC_DOMAIN
            - JVB_XMPP_PORT
            - JVB_XMPP_SERVER
            - MAX_BRIDGE_PARTICIPANTS
            - OCTO_BRIDGE_SELECTION_STRATEGY
            - PROSODY_VISITORS_MUC_PREFIX
            - SENTRY_DSN="${JICOFO_SENTRY_DSN:-0}"
            - SENTRY_ENVIRONMENT
            - SENTRY_RELEASE
            - TZ
            - VISITORS_MAX_PARTICIPANTS
            - VISITORS_MAX_VISITORS_PER_NODE
            - VISITORS_XMPP_AUTH_DOMAIN
            - VISITORS_XMPP_SERVER
            - VISITORS_XMPP_DOMAIN
            - XMPP_DOMAIN
            - XMPP_AUTH_DOMAIN
            - XMPP_INTERNAL_MUC_DOMAIN
            - XMPP_MUC_DOMAIN
            - XMPP_RECORDER_DOMAIN
            - XMPP_SERVER
            - XMPP_PORT
            - MAX_SSRCS_PER_USER
            - MAX_SSRC_GROUPS_PER_USER
        depends_on:
            - prosody
    # Video bridge
    jvb:
        image: jitsi/jvb:${JITSI_IMAGE_VERSION:-stable-9457-2}
        restart: ${RESTART_POLICY:-unless-stopped}
        ports:
            - '${JVB_PORT:-10000}:${JVB_PORT:-10000}/udp'
            - '127.0.0.1:${JVB_COLIBRI_PORT:-8686}:8080'
        volumes:
            - ${CONFIG}/jvb:/config:Z
        environment:
            - AUTOSCALER_SIDECAR_KEY_FILE
            - AUTOSCALER_SIDECAR_KEY_ID
            - AUTOSCALER_SIDECAR_GROUP_NAME
            - AUTOSCALER_SIDECAR_HOST_ID
            - AUTOSCALER_SIDECAR_INSTANCE_ID
            - AUTOSCALER_SIDECAR_PORT
            - AUTOSCALER_SIDECAR_REGION
            - AUTOSCALER_SIDECAR_SHUTDOWN_POLLING_INTERVAL
            - AUTOSCALER_SIDECAR_STATS_POLLING_INTERVAL
            - DOCKER_HOST_ADDRESS
            - ENABLE_COLIBRI_WEBSOCKET
            - ENABLE_JVB_XMPP_SERVER
            - ENABLE_OCTO
            - JVB_ADVERTISE_IPS
            - JVB_ADVERTISE_PRIVATE_CANDIDATES
            - JVB_AUTH_USER
            - JVB_AUTH_PASSWORD
            - JVB_BREWERY_MUC
            - JVB_DISABLE_STUN
            - JVB_INSTANCE_ID
            - JVB_PORT
            - JVB_MUC_NICKNAME
            - JVB_STUN_SERVERS
            - JVB_LOG_FILE
            - JVB_OCTO_BIND_ADDRESS
            - JVB_OCTO_REGION
            - JVB_OCTO_RELAY_ID
            - JVB_REQUIRE_VALID_ADDRESS
            - JVB_WS_DOMAIN
            - JVB_WS_SERVER_ID
            - JVB_XMPP_AUTH_DOMAIN
            - JVB_XMPP_INTERNAL_MUC_DOMAIN
            - JVB_XMPP_PORT
            - JVB_XMPP_SERVER
            - PUBLIC_URL
            - SENTRY_DSN="${JVB_SENTRY_DSN:-0}"
            - SENTRY_ENVIRONMENT
            - SENTRY_RELEASE
            - COLIBRI_REST_ENABLED
            - SHUTDOWN_REST_ENABLED
            - TZ
            - VIDEOBRIDGE_MAX_MEMORY
            - XMPP_AUTH_DOMAIN
            - XMPP_INTERNAL_MUC_DOMAIN
            - XMPP_SERVER
            - XMPP_PORT
        depends_on:
            - prosody
@@ -0,0 +1,39 @@
 services:
  joplin-db:
    image: postgres:15
    container_name: joplin-db
    volumes:
      - /path/to/data:/var/lib/postgresql/data
    ports:
      - 5432:5432
    restart: unless-stopped
    environment:
      - POSTGRES_PASSWORD=db_password
      - POSTGRES_USER=db_user
      - POSTGRES_DB=joplin
  joplin:
    image: joplin/server:latest
    container_name: joplin-server
    depends_on:
      - joplin-db
    ports:
      - 22300:22300
    restart: unless-stopped
    environment:
      - APP_PORT=22300
      - APP_BASE_URL=https://subdomain.websiteurl.com
      - DB_CLIENT=pg
      - POSTGRES_PASSWORD=db_password
      - POSTGRES_DATABASE=joplin
      - POSTGRES_USER=db_user
      - POSTGRES_PORT=5432
      - POSTGRES_HOST=joplin-db
      - MAILER_ENABLED=1
      - MAILER_HOST=smtp.gmail.com
      - MAILER_PORT=465
      - MAILER_SECURE=1
      - [email protected]
      - MAILER_AUTH_PASSWORD=Y0urP@ssw0rd
      - MAILER_NOREPLY_NAME=Joplin
      - [email protected]
@@ -0,0 +1,18 @@
 services:
  mariadb:
    image: lscr.io/linuxserver/mariadb:latest
    container_name: mariadb
    environment:
      - PUID=PUID
      - PGID=PGID
      - TZ=timezone
      - MYSQL_ROOT_PASSWORD=rootpassword
      - MYSQL_DATABASE=database_name #optional
      - MYSQL_USER=user #optional
      - MYSQL_PASSWORD=userpassword #optional
      - REMOTE_SQL=http://URL1/your.sql,https://URL2/your.sql #optional
    volumes:
      - /path/to/mariadb/config:/config
    ports:
      - 3306:3306
    restart: unless-stopped  
@@ -0,0 +1,33 @@
 services:
  db:
    image: mariadb
    restart: unless-stopped
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --innodb-file-per-table=1 --skip-innodb-read-only-compressed
    volumes:
      - /path/to/nextcloud/db:/var/lib/mysql
    env_file:
      - .env
  redis:
    image: redis
    restart: always
    command: redis-server --requirepass  ${REDIS_HOST_PASSWORD}
  app:
    image: nextcloud/nextcloud:latest
    restart: unless-stopped
    ports:
      - ${HTTP_PORT}:80
    links:
      - db
      - redis
    volumes:
      - /path/to/nextcloud/var:/var/www/html
    environment:
      - MYSQL_HOST=${MYSQL_HOST}
      - REDIS_HOST_PASSWORD=${REDIS_HOST_PASSWORD}
    env_file:
      - .env
    depends_on:
      - db
      - redis
@@ -0,0 +1,14 @@
 services:
  minio:
    image: minio/minio
    container_name: minio
    ports:
      - ${HTTP_PORT}:9000
      - ${HTTP_PORT1}:9001
    volumes:
      - /path/to/minio:/data
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
    command: server --console-address ":9001" /data
    restart: always
@@ -0,0 +1,14 @@
 services:
  open-webui:
    image: ghcr.io/open-webui/open-webui:ollama 
    container_name: open-webui
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    ports:
      - ${HTTP_PORT}:8080
    volumes:
      - /path/to/open-webui/ollama:/root/.ollama
      - /path/to/open-webui/app:/app/backend/data
    restart: unless-stopped
@@ -0,0 +1,13 @@
 services:
  organizr:
    image: organizr/organizr
    container_name: organizr
    environment:
      - PUID=PUID
      - PGID=PGID
      - TZ=timezone
    ports:
      - 80:80
    volumes:
      - /path/to/organizr:/config
    restart: unless-stopped   
@@ -0,0 +1,75 @@
 services:
  broker:
    image: docker.io/library/redis:latest
    restart: unless-stopped
    volumes:
      - /path/to/paperless/redisdata:/data
    networks:
      paperless:
  db:
    image: docker.io/library/postgres:latest
    restart: unless-stopped
    volumes:
      - /path/to/paperless/pgdata:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    networks:
      paperless:
  webserver:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    restart: unless-stopped
    depends_on:
      - db
      - broker
      - gotenberg
      - tika
    ports:
      - "8005:8000"
    volumes:
      - /path/to/paperless/data:/usr/src/paperless/data
      - /path/to/paperless/media:/usr/src/paperless/media
      - /path/to/paperless/export:/usr/src/paperless/export
      - /path/to/paperless/consume:/usr/src/paperless/consume
    env_file: .env
    environment:
      PAPERLESS_REDIS: redis://broker:6379
      PAPERLESS_DBHOST: db
      PAPERLESS_DBPASS: ${PAPERLESS_DBPASS}
      PAPERLESS_TIKA_ENABLED: 1
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
      PAPERLESS_URL: ${PAPERLESS_URL}
      PAPERLESS_ADMIN_USER: ${PAPERLESS_ADMIN_USER}
      PAPERLESS_ADMIN_PASSWORD: ${PAPERLESS_ADMIN_PASSWORD}
      PAPERLESS_APPS: "allauth.socialaccount.providers.openid_connect"
      # Find out how to configure Authentik: https://youtu.be/enwFWELCYJo
      PAPERLESS_SOCIALACCOUNT_PROVIDERS: '{"openid_connect": {"APPS": [{"provider_id": "authentik","name": "Authentik SSO","client_id": "0gGOZHjx1iJAlh5wN8m1b7uZKwWnPaClGJNKhQDV","secret": "oqskOOlJ1TJzedWZR9WmcVKmxn1HFqGIroi6oiB5xh03qCofuyIDh2DDaf8OnlTybOMiBQkz9rLNO17s4Bx1aG8aGIErp1n6ly0WwQJOk38Tbq3ctOyZGFagEvysp6o2","settings": { "server_url": "https://authentik.local.thesabear.net/application/o/paperless/.well-known/openid-configuration"}}]}}'
    networks:
      paperless:
  gotenberg:
    image: docker.io/gotenberg/gotenberg:latest
    restart: unless-stopped
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
    command:
      - "gotenberg"
      - "--chromium-disable-javascript=true"
      - "--chromium-allow-list=file:///tmp/.*"
    networks:
      paperless:
  tika:
    image: ghcr.io/paperless-ngx/tika:latest
    restart: unless-stopped
    networks:
      paperless:
 networks:
  paperless:
    external: true
@@ -0,0 +1,39 @@
 services:
  mysql:
    restart: unless-stopped
    image: mysql:8.0
    hostname: mysql
    volumes:
      - /path/to/semaphore/semaphore-mysql:/var/lib/mysql
    environment:
      MYSQL_RANDOM_ROOT_PASSWORD: "yes"
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      MYSQL_USER: ${MYSQL_USER}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
  semaphore:
    container_name: ansiblesemaphore
    restart: unless-stopped
    ports:
      - ${HTTP_PORT}:3000
    image: semaphoreui/semaphore:latest
    environment:
      SEMAPHORE_DB_USER: ${SEMAPHORE_DB_USER}
      SEMAPHORE_DB_PASS: ${SEMAPHORE_DB_PASS}
      SEMAPHORE_DB_HOST: ${SEMAPHORE_DB_HOST} # for postgres, change to: postgres
      SEMAPHORE_DB_PORT: ${SEMAPHORE_DB_PORT} # change to 5432 for postgres
      SEMAPHORE_DB_DIALECT: ${SEMAPHORE_DB_DIALECT} # for postgres, change to: postgres
      SEMAPHORE_DB: ${SEMAPHORE_DB}
      SEMAPHORE_PLAYBOOK_PATH: ${SEMAPHORE_PLAYBOOK_PATH}
      SEMAPHORE_ADMIN_PASSWORD: ${SEMAPHORE_ADMIN_PASSWORD}
      SEMAPHORE_ADMIN_NAME: ${SEMAPHORE_ADMIN_NAME}
      SEMAPHORE_ADMIN_EMAIL: ${SEMAPHORE_ADMIN_EMAIL}
      SEMAPHORE_ADMIN: ${SEMAPHORE_ADMIN}
      SEMAPHORE_ACCESS_KEY_ENCRYPTION: ${SEMAPHORE_ACCESS_KEY_ENCRYPTION}
      TZ: ${TZ}
    volumes:
      - /path/to/semaphore/requirements.txt:/etc/semaphore/requirements.txt
    depends_on:
      - mysql # for postgres, change to: postgres
 volumes:
  semaphore-mysql: # to use postgres, switch to: semaphore-postgres
@@ -0,0 +1,19 @@
 services:
  speedtest-tracker:
    container_name: speedtest-tracker
    image: lscr.io/linuxserver/speedtest-tracker:latest
    ports:
      - "80:80"
      - "443:443"
    environment:
      - PUID=PUID
      - PGID=PGID
      - TZ=timezone
      - APP_KEY=${APP_KEY} # Application key for Laravel framework security. Generate a App Key here - https://speedtest-tracker.dev
      - APP_URL=${APP_URL} # Public URL where the Speedtest Tracker will be accessible.
      - DB_CONNECTION=sqlite # Uses SQLite as the database.
      - SPEEDTEST_SCHEDULE="0 */3 * * *" # Cron schedule, runs every 3 hours.
      - DISPLAY_TIMEZONE=${DISPLAY_TIMEZONE} # Sets the timezone for displaying data in the UI.
    volumes:
      - /path/to/speedtest-tracker/data:/config # Mounts the directory for persistent data.
    restart: unless-stopped
@@ -0,0 +1,14 @@
 version: '3'
 services:
  uptime-kuma:
    image: louislam/uptime-kuma:latest
    container_name: uptime-kuma
    environment:
      - PUID=PUID
      - PGID=PGID
      - TZ=timezone  
    volumes:
      - /path/to/uptime-kuma:/app/data
    ports:
      - 3001:3001
    restart: always  
@@ -0,0 +1,15 @@
 services:
  bitwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    ports:
      - 80:80
    volumes:
      - /path/to/bw-data:/data
    environment:
      - PUID=PUID
      - PGID=PGID
      - TZ=timezone
      - WEBSOCKET_ENABLED='true' # Required to use websockets
      - SIGNUPS_ALLOWED='true'   # set to false to disable signups
@@ -0,0 +1,11 @@
 services:
  whoogle:
    image: benbusby/whoogle-search:latest
    container_name: whoogle
    environment:
      - PUID=PUID
      - PGID=PGID
      - TZ=timezone
    ports:
      - 5000:5000
    restart: unless-stopped
@@ -0,0 +1 @@
 asupersecretpasswordfor ansiblevaultunlock
@@ -0,0 +1,3 @@
 Coming Soon...
 There will soon be a full write-up of the way that the Ansible Roles and Tags laid out during the VM creation via Terraform, is used to configure a VM based on very specific use cases and criteria. The way I have designed the entire workflow is condusive to having a secure Packer built ISO expanded in its capabilites simply by the addition of a new Ansible Role and Tag.
@@ -0,0 +1,8 @@
 [defaults]
 inventory = ./inventory.ini
 roles_path = ./roles:./roles/bootstrap_roles:./roles/cis_hardening:./roles/kestra:./roles/monitoring:./roles/secure_vault:./roles/wazuh_docker
 ansible_python_interpreter = /path/to/ansible-modern/bin/python3
 collections_paths = /path/to/ansible-modern/lib64/python3.11/site-packages/ansible_collections:/path/to/ansible_collections:/usr/share/ansible/collections
 remote_user = ansible
 private_key_file = /path/to/.ssh/key_file
 host_key_checking = False
@@ -0,0 +1,2 @@
 ---
 roles_metadata: "{{ lookup('file', 'roles_metadata.yml') | from_yaml }}"
@@ -0,0 +1,14 @@
 $ANSIBLE_VAULT;1.1;AES256
 64373439343462336430396135326665346633343564656532636363356339326561643161353635
 3636363336663638373932643830646634366336366363370a616235646239386166343964636336
 66303364663462396235626566613266313561376466646631346464653564623630333137383536
 3630363935333333390a633633333264323834323863623035626662326639663731323938633534
 65303062303837636430346435316538336434386464373836336538633933633465376162333138
 63626433643734633634363433666139653736306630393031653566666362343833363936383265
 38656136636434653135633561323839656337623963393731663762333836343665323239356536
 35663433316535313063323264316338353761323537393035373338376634656265363361623037
 32323935333262373437373662646538613665626265626534333862616138373361666639376437
 36613238336332313734316235363265636164363566326636646534646561363666333637323737
 63313336623130306636383362646138656130383661633738623365663762393761306164333536
 39356564636164306332333763663461343462653562343330623862363131653863333363333332
 3162
@@ -0,0 +1,31 @@
 # VM metadata from Terraform provisioning
 vmid: id number here
 vm_name: "vm name"
 target_node: "hypervisor node name"
 template: "template-name"
 cores: 4
 sockets: 1
 memory: 57344
 bridge: vmbr0
 macaddr: "xx:x:x:x:x:x"
 disk_size: 250GB
 disk_storage: "storage name here"
 ip: xx.xx.xx.xx
 vlan: 0
 vm_tags:
  - packages
  - hostname_network
  - root_password
  - disk_resize
  - base_users
  - firewall_ssh
  - endlessh
  - zsh_custom
  - ssh_hardening
  - banners
  - file_permissions
  - service_disable
  - kernel_hardening
  - docker_gitlab_setup
@@ -0,0 +1,32 @@
 # VM metadata from Terraform provisioning
 vmid: id number here
 vm_name: "vm name"
 target_node: "hypervisor node name"
 template: "template-name"
 cores: 1
 sockets: 1
 memory: 4096
 bridge: vmbr0
 macaddr: "xx:x:x:x:x:x"
 disk_size: 20GB
 disk_storage: "storage name here"
 ip: xx.xx.xx.xx
 vlan: 0
 vm_tags:
  - packages
  - hostname_network
  - root_password
  - disk_resize
  - base_users
  - firewall_ssh
  - endlessh
  - zsh_custom
  - vault_agent
  - haproxy
  - ssh_hardening
  - banners
  - file_permissions
  - service_disable
  - kernel_hardening
@@ -0,0 +1,14 @@
 all:
    hosts:
        haproxy:
            ansible_host: xx.xx.xx.xx
            ansible_port: xxxx
            initialized: true
            service: haproxy
        docker:
            ansible_host: xx.xx.xx.xx
            ansible_port: xxxx
            initialized: true
            service: docker
    vars:
        ansible_python_interpreter: /usr/bin/python3
@@ -0,0 +1,8 @@
 all:
  vars:
    ansible_python_interpreter: /usr/bin/python3
  hosts:
    haproxy:
      ansible_host: xx.xx.xx.xx
      ansible_port: 22
      service: haproxy
@@ -0,0 +1,29 @@
 ---
 - name: Compliance stage
  hosts: all
  become: true
  gather_facts: true
  vars:
    stage_name: compliance
  vars_files:
    - /path/to/Infrastrucutre as Code/ansible/roles_metadata.yml
  tasks:
    - name: Run roles for this stage
      ansible.builtin.include_role:
        name: "{{ item }}"
      loop: >-
        {{
          vm_tags
          | select('in',
              roles_metadata
              | dict2items
              | selectattr('value.' ~ stage_name, 'defined')
              | selectattr('value.' ~ stage_name)
              | map(attribute='key')
              | list
            )
          | list
        }}
@@ -0,0 +1,87 @@
 ---
 - name: Initialization stage
  hosts: all
  become: true
  gather_facts: true
  vars:
    stage_name: initialization
    inventory_init: "/path/to/Infrastrucutre as Code/ansible/inventory_initialization.yml"
    inventory_active: "/path/to/Infrastrucutre as Code/ansible/inventory.yml"
  vars_files:
    - /path/to/Infrastrucutre as Code/ansible/roles_metadata.yml
    - /path/to/Infrastrucutre as Code/ansible/group_vars/all/vault_token.yml
  pre_tasks:
    - name: Ensure active inventory exists
      ansible.builtin.file:
        path: "{{ inventory_active }}"
        state: touch
      delegate_to: localhost
      run_once: true
    - name: Load existing active inventory
      ansible.builtin.slurp:
        src: "{{ inventory_active }}"
      register: active_inv_raw
      delegate_to: localhost
      run_once: true
    - name: Parse active inventory YAML (or initialize empty)
      ansible.builtin.set_fact:
        active_inventory: >-
          {{
            (active_inv_raw.content | b64decode | from_yaml)
            if (active_inv_raw.content | b64decode | from_yaml is mapping)
            else {'all': {'hosts': {}}}
          }}
      run_once: true
  tasks:
    - name: Run initialization roles for uninitialized hosts
      ansible.builtin.include_role:
        name: "{{ item }}"
      loop: >-
        {{
          vm_tags
          | select('in',
              roles_metadata
              | dict2items
              | selectattr('value.' ~ stage_name, 'defined')
              | selectattr('value.' ~ stage_name)
              | map(attribute='key')
              | list
            )
          | list
        }}
  post_tasks:
    - name: Append or update host in active inventory
      ansible.builtin.set_fact:
        active_inventory: >-
          {{
            active_inventory |
            combine({
              'all': {
                'hosts': (
                  active_inventory.all.hosts |
                  combine({
                    inventory_hostname: {
                      'ansible_host': hostvars[inventory_hostname]['ansible_host'],
                      'ansible_port': hostvars[inventory_hostname]['ssh_port'] | default(22),
                      'initialized': true
                    }
                  })
                )
              }
            }, recursive=True)
          }}
      delegate_to: localhost
    - name: Write updated active inventory back to file
      ansible.builtin.copy:
        dest: "{{ inventory_active }}"
        content: "{{ active_inventory | to_nice_yaml }}"
      delegate_to: localhost
      run_once: true
@@ -0,0 +1,29 @@
 ---
 - name: Provisioning stage
  hosts: all
  become: true
  gather_facts: true
  vars:
    stage_name: provisioning
  vars_files:
    - /path/to/Infrastrucutre as Code/ansible/roles_metadata.yml
  tasks:
    - name: Run roles for this stage
      ansible.builtin.include_role:
        name: "{{ item }}"
      loop: >-
        {{
          vm_tags
          | select('in',
              roles_metadata
              | dict2items
              | selectattr('value.' ~ stage_name, 'defined')
              | selectattr('value.' ~ stage_name)
              | map(attribute='key')
              | list
            )
          | list
        }}
@@ -0,0 +1,9 @@
 collections:
  - name: community.hashi_vault
  - name: community.general
  - name: ansible.posix
  - name: community.crypto
  - name: community.dns
  - name: middleware_automation.keycloak
  - name: community.network
  - name: community.docker
@@ -0,0 +1,15 @@
 ---
 - name: Configure default home directory and shell for system users
  block:
    - name: Set default home directory and shell for system users
      ansible.builtin.lineinfile:
        path: /etc/default/useradd
        regexp: "^{{ setting.key }}="
        line: "{{ setting.key }}={{ setting.value }}"
        create: yes
        backup: yes
      loop:
        - { key: "HOME", value: "/nonexistent" }
        - { key: "SHELL", value: "/sbin/nologin" }
      loop_control:
        loop_var: setting
@@ -0,0 +1,28 @@
 - name: Expand disk and root filesystem
  block:
    - name: Attempt to grow partition (safe if already full)
      command: growpart /dev/sda 2
      register: growpart_result
      ignore_errors: true
    - name: Determine if partition actually grew
      set_fact:
        partition_grew: >-
          {{ growpart_result.rc == 0 and
             (growpart_result.stdout is defined and 'NOCHANGE' not in growpart_result.stdout) }}
    - name: Resize LVM physical volume if needed
      command: pvresize /dev/sda2
      when: partition_grew
      register: pvresize_result
      changed_when: "'Physical volume' in pvresize_result.stdout and 'resized' in pvresize_result.stdout"
    - name: Extend logical volume if needed
      command: lvextend -l +100%FREE /dev/mapper/rocky-lv_root
      when: partition_grew
      register: lvextend_result
      changed_when: lvextend_result.rc == 0 and "'0 extents found" not in lvextend_result.stderr
    - name: Grow the XFS filesystem if needed
      command: xfs_growfs /
      when: partition_grew and (lvextend_result is changed or lvextend_result is not defined)
@@ -0,0 +1,23 @@
 ---
 docker_old_root: "/var/lib/docker"
 docker_new_root_base: "/opt/docker/docker_data"
 docker_new_root: "{{ docker_new_root_base }}/docker"
 docker_volumes_dir: "/opt/docker/docker_volumes"
 docker_homelab_dir: "/opt/docker/homelab"
 docker_volumes_owner: "user"
 docker_volumes_group: "group"
 git_repo_url: "[email protected]:USER/REPO.git"
 git_repo_version: "main"
 ssh_key_path: "/home/USER/.ssh/id_rsa"
 git_repo_owner: "user"
 git_repo_group: "group"
 docker_daemon_conf: "/etc/docker/daemon.json"
 daemon_json_template: |
  {
    "data-root": "{{ docker_new_root }}"
  }
@@ -0,0 +1,5 @@
 ---
 - name: restart docker
  service:
    name: docker
    state: restarted
@@ -0,0 +1,75 @@
 ---
 # 1. Ensure SSH key exists so git clone works
 - name: Ensure .ssh directory exists
  file:
    path: "{{ ssh_key_path | dirname }}"
    state: directory
    owner: "user"
    group: "user"
    mode: "0700"
 - name: Ensure SSH key exists (don't overwrite)
  copy:
    src: "{{ ssh_key_path }}"
    dest: "{{ ssh_key_path }}"
    owner: "user"
    group: "user"
    mode: "0600"
 # 2. Ensure docker_data directory exists
 - name: Ensure new Docker data root base exists
  file:
    path: "{{ docker_new_root_base }}"
    state: directory
    owner: root
    group: root
    mode: "0755"
 # 3. Stop Docker ONLY if /var/lib/docker still exists
 - name: Stop Docker if old root exists
  service:
    name: docker
    state: stopped
  when: docker_old_root is exists
 # 4. Move /var/lib/docker → new location (idempotent)
 - name: Move Docker data root to new location
  command: "mv {{ docker_old_root }} {{ docker_new_root }}"
  args:
    creates: "{{ docker_new_root }}"
  when: docker_old_root is exists
 # 5. Ensure daemon.json points to new data-root
 - name: Configure Docker daemon.json
  copy:
    dest: "{{ docker_daemon_conf }}"
    content: "{{ daemon_json_template }}"
    owner: root
    group: root
    mode: "0644"
  notify: restart docker
 # 6. Ensure docker_volumes exists
 - name: Ensure docker_volumes directory exists
  file:
    path: "{{ docker_volumes_dir }}"
    state: directory
    owner: "{{ docker_volumes_owner }}"
    group: "{{ docker_volumes_group }}"
    mode: "0755"
 # 7. Ensure homelab directory exists
 - name: Ensure homelab directory exists
  file:
    path: "{{ docker_homelab_dir }}"
    state: directory
    owner: "{{ git_repo_owner }}"
    group: "{{ git_repo_group }}"
    mode: "0755"
 # 8. Start Docker if it was stopped
 - name: Start Docker
  service:
    name: docker
    state: started
  when: docker_new_root is exists
@@ -0,0 +1,4 @@
 ---
 endlessh_port: 22
 endlessh_repo: https://github.com/skeeto/endlessh.git
 endlessh_clone_path: /usr/local/src/endlessh
@@ -0,0 +1,67 @@
 ---
 - name: Ensure endlessh group exists
  ansible.builtin.group:
    name: endlessh
    system: true
 - name: Ensure endlessh user exists
  ansible.builtin.user:
    name: endlessh
    group: endlessh
    system: true
    shell: /usr/sbin/nologin
    create_home: false
 - name: Ensure Endlessh repo is cloned and updated
  ansible.builtin.git:
    repo: "{{ endlessh_repo }}"
    dest: "{{ endlessh_clone_path }}"
    version: master
    update: yes
  register: git_result
 - name: Build Endlessh if repo was updated
  ansible.builtin.command: make
  args:
    chdir: "{{ endlessh_clone_path }}"
  when: git_result.after != git_result.before
  register: make_result
  # no changed_when needed; we'll rely on the copy step to track changes
 - name: Copy Endlessh binary to /usr/local/bin if updated
  ansible.builtin.copy:
    src: "{{ endlessh_clone_path }}/endlessh"
    dest: /usr/local/bin/endlessh
    mode: "0755"
    remote_src: true
  when: git_result.after != git_result.before
  register: copy_result
 - name: Create Endlessh config directory
  ansible.builtin.file:
    path: /etc/endlessh
    state: directory
    mode: "0755"
 - name: Deploy Endlessh config
  ansible.builtin.template:
    src: endlessh_config.j2
    dest: /etc/endlessh/config
    mode: "0644"
 - name: Deploy Endlessh systemd service
  ansible.builtin.template:
    src: endlessh.service.j2
    dest: /etc/systemd/system/endlessh.service
    mode: "0644"
 - name: Reload systemd daemon
  ansible.builtin.systemd:
    daemon_reload: true
 - name: Restart Endlessh if binary updated
  ansible.builtin.systemd:
    name: endlessh
    enabled: true
    state: restarted
  when: copy_result is changed
@@ -0,0 +1,20 @@
 [Unit]
 Description=Endlessh SSH Tarpit
 After=network.target
 [Service]
 ExecStart=/usr/local/bin/endlessh -f /etc/endlessh/config
 Restart=always
 User=endlessh
 Group=endlessh
 AmbientCapabilities=CAP_NET_BIND_SERVICE
 NoNewPrivileges=true
 ProtectSystem=full
 ProtectHome=true
 PrivateTmp=true
 RestrictAddressFamilies=AF_INET AF_INET6
 ReadWritePaths=/etc/endlessh
 LockPersonality=true
 [Install]
 WantedBy=multi-user.target
@@ -0,0 +1,5 @@
 Port {{ endlessh_port }}
 Delay 10000
 MaxLineLength 32
 MaxClients 4096
 LogLevel 1
@@ -0,0 +1,4 @@
 ---
 # Customize if needed; this defaults to port 22 for endlessh
 endlessh_port: 22
 # The SSH port will be dynamically computed as: 10000 + (vmid % 100)
@@ -0,0 +1,69 @@
 ---
 - name: Configure firewall and SSH port
  block:
    - name: Fail if vmid is not defined
      ansible.builtin.fail:
        msg: "'vmid' must be defined to calculate dynamic SSH port"
      when: vmid is not defined
    - name: Calculate SSH port from vmid
      ansible.builtin.set_fact:
        ssh_port: "{{ 10000 + (vmid | int % 100) }}"
    - name: Enable and start firewalld
      ansible.builtin.service:
        name: firewalld
        state: started
        enabled: true
    - name: Set firewalld default zone to drop
      ansible.posix.firewalld:
        zone: public
        state: enabled
        permanent: yes
        target: DROP
    - name: Reload firewalld to apply permanent changes
      ansible.builtin.command: firewall-cmd --reload
    - name: Allow custom SSH port in firewalld
      ansible.posix.firewalld:
        port: "{{ ssh_port }}/tcp"
        permanent: true
        state: enabled
        immediate: true
    - name: Allow Endlessh port in firewalld
      ansible.posix.firewalld:
        port: "{{ endlessh_port }}/tcp"
        permanent: true
        state: enabled
        immediate: true
    - name: Ensure custom SSH port is set in sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?Port\s+'
        line: "Port {{ ssh_port }}"
        backup: yes
        validate: "/usr/sbin/sshd -T -f %s"
      register: sshd_config_changed
    - name: Gather SELinux facts
      ansible.builtin.setup:
        filter: ansible_selinux
    - name: Allow SSH to use custom port in SELinux
      ansible.builtin.command: >
        semanage port -a -t ssh_port_t -p tcp {{ ssh_port }}
      register: semanage_result
      failed_when: semanage_result.rc not in [0, 1]
      changed_when: semanage_result.rc == 0
      when: ansible_selinux.status == "enabled"
    - name: Restart and enable sshd service if needed
      ansible.builtin.service:
        name: sshd
        state: restarted
        enabled: true
      when: sshd_config_changed is changed
@@ -0,0 +1,29 @@
 ---
 - name: Set hostname and update /etc/hosts
  vars:
    default_domain: subdomain.domain
  block:
    - name: Set hostname fact
      ansible.builtin.set_fact:
        short_hostname: "{{ vm_name }}"
        custom_hostname: "{{ vm_name }}.{{ default_domain }}"
    - name: Set system hostname
      ansible.builtin.hostname:
        name: "{{ custom_hostname }}"
    - name: Ensure /etc/hosts contains loopback entry for hostname
      ansible.builtin.lineinfile:
        path: /etc/hosts
        regexp: '^127\.0\.1\.1\s+'
        line: "127.0.1.1 {{ custom_hostname }} {{ short_hostname }}"
        state: present
        create: yes
    - name: Ensure /etc/hosts contains primary network IP entry
      ansible.builtin.lineinfile:
        path: /etc/hosts
        regexp: '^{{ ip }}\s+'
        line: "{{ ip }} {{ custom_hostname }} {{ short_hostname }}"
        state: present
        create: yes
@@ -0,0 +1,10 @@
 ---
 base_packages:
  - firewalld
  - policycoreutils-python-utils
  - git
  - make
  - gcc
  - cloud-utils-growpart
  - lvm2
  - xfsprogs
@@ -0,0 +1,32 @@
 ---
 - name: Package management tasks
  tags: [packages]
  block:
    - name: Clean all cached metadata
      ansible.builtin.command: dnf clean all
      become: true
    - name: Rebuild the DNF cache
      ansible.builtin.command: dnf makecache
      become: true
    - name: Update all packages to latest
      ansible.builtin.dnf:
        name: "*"
        state: latest
        update_cache: true
      become: true
    - name: Reboot if kernel was upgraded
      ansible.builtin.reboot:
        reboot_timeout: 120
        pre_reboot_delay: 10
      when: ansible_facts.packages['kernel'] is defined
      become: true
    - name: Install base system packages
      ansible.builtin.package:
        name: "{{ base_packages }}"
        state: present
        update_cache: true
      become: true
@@ -0,0 +1,39 @@
 ---
 - name: Set Portainer Agent installation directory
  vars:
    portainer_agent_dir: /opt/portainer-agent
  block:
    - name: Create Portainer Agent directory
      become: true
      ansible.builtin.file:
        path: "{{ portainer_agent_dir }}"
        state: directory
        owner: user
        group: user
        mode: "0755"
    - name: Create Portainer Agent docker-compose file
      become: true
      ansible.builtin.copy:
        dest: "{{ portainer_agent_dir }}/docker-compose.yml"
        owner: user
        group: user
        mode: "0644"
        content: |
          services:
            agent:
              image: portainer/agent:latest
              container_name: portainer_agent
              restart: always
              ports:
                - "9001:9001"
              volumes:
                - /var/run/docker.sock:/var/run/docker.sock
                - /var/lib/docker/volumes:/var/lib/docker/volumes
    - name: Ensure Portainer Agent is running
      become: true
      community.docker.docker_compose_v2:
        project_src: "{{ portainer_agent_dir }}"
        state: present # ensures containers exist
        recreate: always # recreates if the definition changed
@@ -0,0 +1,2 @@
 ---
 root_password_plain: "{{ lookup('env', 'ROOT_PASSWORD') }}"
@@ -0,0 +1,16 @@
 ---
 - name: Set root password
  block:
    - name: Fail if root password is not defined
      fail:
        msg: "The variable 'root_password_plain' must be provided (e.g., via GitLab CI/CD Variable)"
      when: root_password_plain is not defined
    - name: Generate root password hash
      set_fact:
        root_password_hash: "{{ root_password_plain | password_hash('sha512') }}"
    - name: Set root user password
      user:
        name: root
        password: "{{ root_password_hash }}"
@@ -0,0 +1,82 @@
 ---
 - name: Customize Zsh for users
  vars:
    zsh_users:
      - user
  block:
    - name: Ensure parent home directory exists (safety)
      ansible.builtin.file:
        path: "/home/{{ user }}"
        state: directory
        owner: "{{ user }}"
        group: "{{ user }}"
        mode: "0755"
      loop: "{{ zsh_users }}"
      loop_control:
        loop_var: user
      become: true
    - name: Remove any old oh-my-zsh
      ansible.builtin.file:
        path: "/home/{{ user }}/.oh-my-zsh"
        state: absent
      loop: "{{ zsh_users }}"
      loop_control:
        loop_var: user
      become: true
    - name: Clone Oh My Zsh as root
      ansible.builtin.git:
        repo: "https://github.com/ohmyzsh/ohmyzsh.git"
        dest: "/home/{{ user }}/.oh-my-zsh"
        version: master
        update: yes
        force: yes
      loop: "{{ zsh_users }}"
      loop_control:
        loop_var: user
      become: true
    - name: Add trusted safe.directory system-wide for Oh My Zsh
      ansible.builtin.command:
        cmd: git config --system --add safe.directory /home/{{ user }}/.oh-my-zsh
      loop: "{{ zsh_users }}"
      loop_control:
        loop_var: user
      become: true
    - name: Install syntax-highlighting plugin
      ansible.builtin.git:
        repo: "https://github.com/zsh-users/zsh-syntax-highlighting.git"
        dest: "/home/{{ user }}/.oh-my-zsh/custom/plugins/zsh-syntax-highlighting"
        version: master
        update: yes
        force: yes
      loop: "{{ zsh_users }}"
      loop_control:
        loop_var: user
      become: true
    - name: Deploy customized .zshrc
      ansible.builtin.template:
        src: zshrc.j2
        dest: "/home/{{ user }}/.zshrc"
        owner: "{{ user }}"
        group: "{{ user }}"
        mode: "0644"
      loop: "{{ zsh_users }}"
      loop_control:
        loop_var: user
      become: true
    - name: Fix ownership recursively for Oh My Zsh directory
      ansible.builtin.file:
        path: "/home/{{ user }}/.oh-my-zsh"
        owner: "{{ user }}"
        group: "{{ user }}"
        recurse: yes
      loop: "{{ zsh_users }}"
      loop_control:
        loop_var: user
      become: true
@@ -0,0 +1,21 @@
 export ZSH="\$HOME/.oh-my-zsh"
 ZSH_THEME="robbyrussell"
 plugins=(git zsh-autosuggestions zsh-syntax-highlighting)
 source \$ZSH/oh-my-zsh.sh
 # Where to save history and how much to keep
 HISTFILE=~/.zsh_history
 HISTSIZE=10000       # In-memory history
 SAVEHIST=10000       # Lines to save to file
 # Recommended options
 setopt APPEND_HISTORY             # Don’t overwrite history file; append to it
 setopt SHARE_HISTORY              # Share history across all sessions
 setopt HIST_IGNORE_DUPS           # Don’t record duplicate commands
 setopt HIST_IGNORE_SPACE          # Ignore commands starting with a space
 setopt HIST_VERIFY                # Edit a command before running from history
 setopt INC_APPEND_HISTORY         # Write history incrementally as commands are run
 PS1='%F{51}%n%F{255}@%F{227}%m %F{84}%~%f %F{15}$ '
 fastfetch
@@ -0,0 +1,11 @@
 ---
 cis_banner: |
  *********************************************************************
  * WARNING: Unauthorized access to this system is prohibited.        *
  * All activities are monitored and recorded.                        *
  *********************************************************************
 cis_motd_banner: |
  *********************************************************************
  * Welcome to the system. Access is restricted to authorized users.  *
  *********************************************************************
@@ -0,0 +1,26 @@
 ---
 # Login banners for /etc/motd, /etc/issue, /etc/issue.net
 - name: Ensure /etc/motd contains standard CIS banner
  ansible.builtin.copy:
    dest: /etc/motd
    owner: root
    group: root
    mode: "0644"
    content: "{{ cis_motd_banner }}"
 - name: Ensure /etc/issue contains standard CIS banner
  ansible.builtin.copy:
    dest: /etc/issue
    owner: root
    group: root
    mode: "0644"
    content: "{{ cis_motd_banner }}"
 - name: Ensure /etc/issue.net contains standard CIS banner
  ansible.builtin.copy:
    dest: /etc/issue.net
    owner: root
    group: root
    mode: "0644"
    content: "{{ cis_banner }}"
@@ -0,0 +1,6 @@
 ---
 # Parent-level defaults
 cis_tag: cis_hardening
 audit_rules_file: /etc/audit/rules.d/cis.rules
 rsyslog_remote: "" # set to "logserver.example.com:514" to forward logs
 txt_grub_args: "" # additional kernel args if needed, e.g. "audit=1"
@@ -0,0 +1,16 @@
 ---
 # Default ownership and permissions for critical files and directories
 file_permissions_list:
  - { path: "/root", mode: "0700", state: "directory" }
  - { path: "/etc/passwd", mode: "0644", state: "file" }
  - { path: "/etc/shadow", mode: "0400", state: "file" }
  - { path: "/etc/group", mode: "0644", state: "file" }
  - { path: "/etc/gshadow", mode: "0400", state: "file" }
  - { path: "/etc/crontab", mode: "0600", state: "file" }
  - { path: "/etc/cron.hourly", mode: "0700", state: "directory" }
  - { path: "/etc/cron.daily", mode: "0700", state: "directory" }
  - { path: "/etc/cron.weekly", mode: "0700", state: "directory" }
  - { path: "/etc/cron.monthly", mode: "0700", state: "directory" }
  - { path: "/etc/cron.d", mode: "0700", state: "directory" }
  - { path: "/etc/rsyslog.conf", mode: "0640", state: "file" }
@@ -0,0 +1,11 @@
 ---
 - name: Ensure system files and directories have correct ownership and permissions
  ansible.builtin.file:
    path: "{{ file_item.path }}"
    owner: root
    group: root
    mode: "{{ file_item.mode }}"
    state: "{{ file_item.state }}"
  loop: "{{ file_permissions_list }}"
  loop_control:
    loop_var: file_item
@@ -0,0 +1,4 @@
 tmp_mount_options: "defaults,nosuid,nodev,noexec,relatime"
 var_tmp_mount_options: "defaults,nosuid,nodev,noexec,relatime"
 home_mount_options: "defaults,nosuid,nodev,relatime"
 dev_shm_mount_options: "defaults,nosuid,nodev,noexec,relatime"
@@ -0,0 +1,34 @@
 ---
 # Remount and persist secure options using defaults variables
 - name: Gather mount facts
  ansible.builtin.setup:
    filter: ansible_mounts
 - name: Ensure /tmp has secure mount options
  ansible.builtin.mount:
    path: /tmp
    fstype: "{{ ansible_mounts | selectattr('mount','equalto','/tmp') | map(attribute='fstype') | first }}"
    opts: "{{ tmp_mount_options }}"
    state: mounted
 - name: Ensure /var/tmp has secure mount options
  ansible.builtin.mount:
    path: /var/tmp
    fstype: "{{ ansible_mounts | selectattr('mount','equalto','/var/tmp') | map(attribute='fstype') | first }}"
    opts: "{{ var_tmp_mount_options }}"
    state: mounted
 - name: Ensure /home has secure mount options
  ansible.builtin.mount:
    path: /home
    fstype: "{{ ansible_mounts | selectattr('mount','equalto','/home') | map(attribute='fstype') | first }}"
    opts: "{{ home_mount_options }}"
    state: mounted
 - name: Ensure /dev/shm has secure mount options
  ansible.builtin.mount:
    path: /dev/shm
    fstype: tmpfs
    opts: "{{ dev_shm_mount_options }}"
    state: mounted
@@ -0,0 +1,17 @@
 ---
 - name: restart rsyslog
  ansible.builtin.service:
    name: rsyslog
    state: restarted
 - name: restart auditd
  ansible.builtin.service:
    name: auditd
    state: restarted
 - name: reload systemd
  ansible.builtin.command: systemctl daemon-reexec
 - name: update initramfs
  ansible.builtin.command: dracut -f
  when: ansible_facts['os_family'] == 'RedHat' or ansible_facts['distribution'] in ['Rocky','RedHat','CentOS']
@@ -0,0 +1,7 @@
 ---
 # Kernel defaults (override per host if needed)
 modprobe_blacklist_file: /etc/modprobe.d/cis_blacklist.conf
 # Additional kernel modules to disable
 blacklist_modules:
  - tipc
@@ -0,0 +1,18 @@
 # blacklist_module.yml
 - name: Check if module {{ mod }} exists on system
  ansible.builtin.shell: "modprobe -n -v {{ mod }}"
  register: modprobe_check
  ignore_errors: true
 - name: Blacklist module {{ mod }} in {{ modprobe_blacklist_file }}
  ansible.builtin.lineinfile:
    path: "{{ modprobe_blacklist_file }}"
    line: "install {{ mod }} /bin/false"
    create: yes
    state: present
  when: modprobe_check.rc == 0
 - name: Unload module {{ mod }} if currently loaded
  ansible.builtin.shell: "modprobe -r {{ mod }}"
  ignore_errors: true
  when: modprobe_check.rc == 0
@@ -0,0 +1,78 @@
 ---
 # Kernel & sysctl hardening (CIS network/kernel items)
 - name: Ensure IPv4 forwarding is disabled
  ansible.builtin.sysctl:
    name: net.ipv4.ip_forward
    value: "0"
    state: present
    reload: yes
 - name: Ensure IPv6 forwarding is disabled
  ansible.builtin.sysctl:
    name: net.ipv6.conf.all.forwarding
    value: "0"
    state: present
    reload: yes
 - name: Ensure source routed packets are not accepted
  ansible.builtin.sysctl:
    name: net.ipv4.conf.all.accept_source_route
    value: "0"
    state: present
    reload: yes
 - name: Ensure ICMP redirects are not accepted
  ansible.builtin.sysctl:
    name: net.ipv4.conf.all.accept_redirects
    value: "0"
    state: present
    reload: yes
 - name: Ensure secure ICMP redirects are not accepted
  ansible.builtin.sysctl:
    name: net.ipv4.conf.all.secure_redirects
    value: "0"
    state: present
    reload: yes
 - name: Ensure Address Space Layout Randomization (ASLR) is enabled
  ansible.builtin.sysctl:
    name: kernel.randomize_va_space
    value: "2"
    state: present
    reload: yes
 - name: Ensure fs.suid_dumpable is 0 (disable core dumps)
  ansible.builtin.sysctl:
    name: fs.suid_dumpable
    value: "0"
    state: present
    reload: yes
 - name: Create /etc/modprobe.d/cis_blacklist.conf with common blacklists
  ansible.builtin.copy:
    dest: /etc/modprobe.d/cis_blacklist.conf
    owner: root
    group: root
    mode: "0644"
    content: |
      # CIS blacklist
      install cramfs /bin/true
      install freevxfs /bin/true
      install jffs2 /bin/true
      install hfs /bin/true
      install hfsplus /bin/true
      install squashfs /bin/true
      install udf /bin/true
 - name: Regenerate initramfs if modprobe blacklist changed
  ansible.builtin.command: dracut -f
  changed_when: false
  when: ansible_facts.get('os_family') == 'RedHat' or ansible_facts.get('distribution') in ['Rocky', 'RedHat', 'CentOS']
 - name: Blacklist all modules
  include_tasks: blacklist_module.yml
  loop: "{{ blacklist_modules }}"
  loop_control:
    loop_var: mod
@@ -0,0 +1,9 @@
 ---
 # Password policy defaults
 pw_minlen: 14
 pw_minclass: 4
 pw_max_days: 365
 pw_min_days: 7
 pw_warn_age: 7
 faillock_deny: 5
 faillock_unlock_time: 900
@@ -0,0 +1,60 @@
 ---
 # Password and PAM related hardening
 - name: Ensure password hashing algorithm is SHA512
  ansible.builtin.lineinfile:
    path: /etc/login.defs
    regexp: "^ENCRYPT_METHOD"
    line: "ENCRYPT_METHOD SHA512"
    create: yes
 - name: Ensure PASS_MAX_DAYS is 365
  ansible.builtin.lineinfile:
    path: /etc/login.defs
    regexp: "^PASS_MAX_DAYS"
    line: "PASS_MAX_DAYS   365"
    create: yes
 - name: Ensure PASS_MIN_DAYS is 7
  ansible.builtin.lineinfile:
    path: /etc/login.defs
    regexp: "^PASS_MIN_DAYS"
    line: "PASS_MIN_DAYS   7"
    create: yes
 - name: Ensure PASS_WARN_AGE is 7
  ansible.builtin.lineinfile:
    path: /etc/login.defs
    regexp: "^PASS_WARN_AGE"
    line: "PASS_WARN_AGE   7"
    create: yes
 - name: Ensure pwquality minlen and requirements
  ansible.builtin.lineinfile:
    path: /etc/security/pwquality.conf
    regexp: "^minlen"
    line: "minlen = 14"
    create: yes
 - name: Ensure pwquality minclass (character classes) is 4
  ansible.builtin.lineinfile:
    path: /etc/security/pwquality.conf
    regexp: "^minclass"
    line: "minclass = 4"
    create: yes
 - name: Ensure pam_faillock preauth is configured
  ansible.builtin.lineinfile:
    path: /etc/pam.d/system-auth
    insertafter: "^auth.*required.*pam_unix.so"
    line: "auth required pam_faillock.so preauth silent audit deny=5 unlock_time=900"
    state: present
    backrefs: no
 - name: Ensure pam_faillock authfail/account lines exist
  ansible.builtin.blockinfile:
    path: /etc/pam.d/system-auth
    insertafter: "^auth.*required.*pam_unix.so"
    block: |
      auth [default=die] pam_faillock.so authfail deny=5 unlock_time=900 audit
      account required pam_faillock.so
@@ -0,0 +1,10 @@
 ---
 unused_services:
  - avahi-daemon
  - bluetooth
  - cups
  - rpcbind
  - nfslock
  - rsh.socket
  - telnet.socket
  - rsyncd
@@ -0,0 +1,10 @@
 - name: Ensure list of unnecessary services are stopped and masked
  ansible.builtin.service:
    name: "{{ svc }}"
    enabled: no
    state: stopped
    masked: yes
  loop: "{{ unused_services }}"
  loop_control:
    loop_var: svc
  ignore_errors: true
@@ -0,0 +1,32 @@
 ---
 # General settings
 ssh_protocol: 2
 ssh_permit_root_login: "no"
 ssh_password_authentication: "no"
 ssh_challenge_response_authentication: "no"
 ssh_kerberos_authentication: "no"
 ssh_gssapi_authentication: "no"
 ssh_use_pam: "yes"
 PrintLastLog: "yes"
 # Session security
 ssh_x11_forwarding: "no"
 ssh_allow_tcp_forwarding: "yes"
 ssh_permit_tunnel: "no"
 ssh_allow_agent_forwarding: "no"
 # Idle timeout / login attempts
 ssh_client_alive_interval: 300
 ssh_client_alive_count_max: 3
 ssh_login_grace_time: 60
 ssh_max_auth_tries: 3
 ssh_max_sessions: 2
 ssh_max_startups: "10:30:60"
 # SSH access restrictions
 ssh_allow_users: "adminuser ansibleuser"
 # Strong encryption
 ssh_ciphers: "aes256-ctr,aes192-ctr,aes128-ctr"
 ssh_macs: "hmac-sha2-512,hmac-sha2-256"
 ssh_kex_algorithms: "[email protected],diffie-hellman-group-exchange-sha256"
@@ -0,0 +1,82 @@
 ---
 - name: Ensure OpenSSH server is installed
  ansible.builtin.package:
    name: openssh-server
    state: present
 - name: Ensure SSH daemon is enabled and running
  ansible.builtin.service:
    name: sshd
    enabled: true
    state: started
 - name: Backup current sshd_config
  ansible.builtin.copy:
    src: /etc/ssh/sshd_config
    dest: /etc/ssh/sshd_config.bak
    owner: root
    group: root
    mode: "0600"
    remote_src: true
 - name: Harden SSH configuration
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "{{ ssh_item.regexp }}"
    line: "{{ ssh_item.line }}"
    state: present
    backrefs: yes
  loop:
    - regexp: "^#?Protocol"
      line: "Protocol {{ ssh_protocol }}"
    - regexp: "^#?PermitRootLogin"
      line: "PermitRootLogin {{ ssh_permit_root_login }}"
    - regexp: "^#?PasswordAuthentication"
      line: "PasswordAuthentication {{ ssh_password_authentication }}"
    - regexp: "^#?ChallengeResponseAuthentication"
      line: "ChallengeResponseAuthentication {{ ssh_challenge_response_authentication }}"
    - regexp: "^#?KerberosAuthentication"
      line: "KerberosAuthentication {{ ssh_kerberos_authentication }}"
    - regexp: "^#?GSSAPIAuthentication"
      line: "GSSAPIAuthentication {{ ssh_gssapi_authentication }}"
    - regexp: "^#?UsePAM"
      line: "UsePAM {{ ssh_use_pam }}"
    - regexp: "^#?X11Forwarding"
      line: "X11Forwarding {{ ssh_x11_forwarding }}"
    - regexp: "^#?AllowTcpForwarding"
      line: "AllowTcpForwarding {{ ssh_allow_tcp_forwarding }}"
    - regexp: "^#?PermitTunnel"
      line: "PermitTunnel {{ ssh_permit_tunnel }}"
    - regexp: "^#?AllowAgentForwarding"
      line: "AllowAgentForwarding {{ ssh_allow_agent_forwarding }}"
    - regexp: "^#?ClientAliveInterval"
      line: "ClientAliveInterval {{ ssh_client_alive_interval }}"
    - regexp: "^#?ClientAliveCountMax"
      line: "ClientAliveCountMax {{ ssh_client_alive_count_max }}"
    - regexp: "^#?LoginGraceTime"
      line: "LoginGraceTime {{ ssh_login_grace_time }}"
    - regexp: "^#?MaxAuthTries"
      line: "MaxAuthTries {{ ssh_max_auth_tries }}"
    - regexp: "^#?MaxSessions"
      line: "MaxSessions {{ ssh_max_sessions }}"
    - regexp: "^#?MaxStartups"
      line: "MaxStartups {{ ssh_max_startups }}"
    - regexp: "^#?Ciphers"
      line: "Ciphers {{ ssh_ciphers }}"
    - regexp: "^#?MACs"
      line: "MACs {{ ssh_macs }}"
    - regexp: "^#?KexAlgorithms"
      line: "KexAlgorithms {{ ssh_kex_algorithms }}"
    - regexp: "^#?PrintLastLog"
      line: "PrintLastLog {{ PrintLastLog }}"
    - regexp: '^\s*#?\s*AllowUsers'
      line: "AllowUsers {{ ssh_allow_users }}"
    - regexp: "^#?Banner"
      line: "Banner /etc/issue.net"
  loop_control:
    loop_var: ssh_item
 - name: Restart SSH service to apply changes
  ansible.builtin.service:
    name: sshd
    state: restarted
@@ -0,0 +1,29 @@
 ---
 # Parent CIS hardening role: import each subrole with single tag
 - import_role:
    name: cis_hardening/kernel_hardening
  tags: [cis_hardening]
 - import_role:
    name: cis_hardening/password_policy
  tags: [cis_hardening]
 - import_role:
    name: cis_hardening/file_permissions
  tags: [cis_hardening]
 - import_role:
    name: cis_hardening/service_disable
  tags: [cis_hardening]
 - import_role:
    name: cis_hardening/banners
  tags: [cis_hardening]
 - import_role:
    name: cis_hardening/ssh_hardening
  tags: [cis_hardening]
 - import_role:
    name: cis_hardening/filesystem_hardening
  tags: [cis_hardening]
@@ -0,0 +1,55 @@
 # Vault connection
 vault_addr: "http://VAULT_IP:VAULT_PORT"
 # Directory paths
 haproxy_certs_dir: "/etc/haproxy/certs"
 haproxy_cert_path: "{{ haproxy_pem_path }}"
 haproxy_pem_path: "{{ haproxy_certs_dir }}/haproxy.pem"
 haproxy_ca_path: "{{ haproxy_certs_dir }}/haproxy_ca.crt"
 # Systemd service names
 haproxy_service: "haproxy"
 # HAProxy tuning
 haproxy_global_maxconn: 4096
 haproxy_timeout_connect_ms: 5000
 haproxy_timeout_client_ms: 60000
 haproxy_timeout_server_ms: 60000
 haproxy_enable_hsts: true
 vault_agent_templates:
  - src: "haproxy.pem.ctmpl"
    dest: "{{ haproxy_pem_path }}"
    service: "haproxy"
  - src: "haproxy_ca.ctmpl"
    dest: "{{ haproxy_ca_path }}"
    service: "haproxy"
 # === Services routed internally through HAProxy ===
 securemtls_services:
  vault:
    hostname: vault.local.DOMAIN_PLACEHOLDER
    balance: roundrobin
    mode: http
    timeout_connect: 5s
    timeout_server: 30s
    default_server_inter: 3s
    default_server_rise: 2
    default_server_fall: 3
    backend_servers:
      - address: VAULT_IP
        port: VAULT_PORT
        proto: http
    headers:
      - "http-request set-header Host vault.local.DOMAIN_PLACEHOLDER"
      - "http-request set-header X-Forwarded-Proto https"
    rewrites:
      - "http-response replace-header Location ^http://VAULT_IP:VAULT_PORT/(.*) https://vault.local.DOMAIN_PLACEHOLDER/\\1"
  technitium:
    hostname: "technitium.local.DOMAIN_PLACEHOLDER"
    backend_mode: http
    backend_servers:
      - address: TECHNITIUM_IP
        port: TECHNITIUM_PORT
        proto: "http"
@@ -0,0 +1,5 @@
 ---
 - name: Reload HAProxy
  systemd:
    name: haproxy
    state: reloaded
@@ -0,0 +1,107 @@
 ---
 - name: Install HAProxy
  dnf:
    name: haproxy
    state: present
 - name: Ensure firewalld is running and enabled
  systemd:
    name: firewalld
    enabled: true
    state: started
 - name: Allow inbound HTTPS (443/tcp)
  ansible.posix.firewalld:
    service: https
    permanent: true
    state: enabled
    immediate: true
 - name: Ensure HAProxy certificate directories exist
  file:
    path: "{{ cert_dir }}"
    state: directory
    owner: haproxy
    group: haproxy
    mode: "0750"
  loop:
    - "{{ haproxy_certs_dir }}"
    - "{{ haproxy_certs_dir }}/clients"
  loop_control:
    loop_var: cert_dir
 - name: Apply SELinux context for HAProxy certs
  command: semanage fcontext -a -t etc_t "{{ haproxy_certs_dir }}(/.*)?"
  become: true
  register: semanage_fcontext_result
  failed_when: false
  changed_when: semanage_fcontext_result.rc == 0
 - name: Restore SELinux context for HAProxy certs
  command: restorecon -Rv "{{ haproxy_certs_dir }}"
  become: true
  changed_when: false
 - name: Allow HAProxy to connect to any port (SELinux)
  ansible.posix.seboolean:
    name: haproxy_connect_any
    state: true
    persistent: true
 - name: Wait for HAProxy PEM and CA files
  wait_for:
    path: "{{ pem_item }}"
    state: present
    timeout: 120
  loop:
    - "{{ haproxy_pem_path }}"
    - "{{ haproxy_ca_path }}"
  loop_control:
    loop_var: pem_item
 - name: Ensure permissions for HAProxy certs
  file:
    path: "{{ cert_item }}"
    owner: haproxy
    group: haproxy
    mode: "0644"
  loop:
    - "{{ haproxy_pem_path }}"
    - "{{ haproxy_ca_path }}"
  loop_control:
    loop_var: cert_item
 - name: Deploy HAProxy configuration
  template:
    src: haproxy.cfg.j2
    dest: /etc/haproxy/haproxy.cfg
    owner: root
    group: root
    mode: "0644"
  notify: Reload HAProxy
 - name: Ensure HAProxy service starts after vault-agent
  lineinfile:
    path: /usr/lib/systemd/system/haproxy.service
    regexp: "^After="
    line: "After=network-online.target vault-agent.service"
    backup: yes
 - name: Reload systemd daemon
  command: systemctl daemon-reload
 - name: Enable and start HAProxy
  systemd:
    name: haproxy
    enabled: yes
    state: started
 - name: Check SELinux mode
  command: getenforce
  register: selinux_state
  changed_when: false
 - name: Warn if SELinux is not enforcing
  debug:
    msg: "⚠️ SELinux is not enforcing — HAProxy cert contexts may not be correctly applied."
  when: selinux_state.stdout != "Enforcing"
@@ -0,0 +1,86 @@
 # ==========================================
 # HAProxy global settings
 # ==========================================
 global
    log /dev/log local0
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    pidfile /run/haproxy.pid
    maxconn {{ haproxy_global_maxconn | default(4096) }}
    user haproxy
    group haproxy
    daemon
 defaults
    log global
    option httplog
    option dontlognull
    timeout connect {{ haproxy_timeout_connect_ms | default('5000') }}
    timeout client {{ haproxy_timeout_client_ms | default('60000') }}
    timeout server {{ haproxy_timeout_server_ms | default('60000') }}
    option http-server-close
    option forwardfor
    retries 3
    maxconn 2000
 # ==========================================
 # HAProxy frontends and backends template
 # ==========================================
 frontend https-in
    mode http
    bind *:443 ssl crt {{ haproxy_pem_path }} ca-file {{ haproxy_ca_path }} verify required alpn h2,http/1.1
    option httplog
    option forwardfor
    timeout client 30s
    http-request set-header X-Client-Cert %[ssl_c_der,base64]
 {% for service_name, service in securemtls_services.items() %}
    acl host_{{ service_name }} hdr(host) -i {{ service.hostname }}
    use_backend {{ service_name }} if host_{{ service_name }}
 {% endfor %}
 # ==========================================
 # Backends
 # ==========================================
 {% for service_name, service in securemtls_services.items() %}
 backend {{ service_name }}
    balance {{ service.balance | default('roundrobin') }}
    mode {{ service.mode | default('http') }}
    timeout connect {{ service.timeout_connect | default('5s') }}
    timeout server {{ service.timeout_server | default('30s') }}
    option {{ service.options | default('http-server-close') }}
    default-server inter {{ service.default_server_inter | default('3s') }}
    default-server rise {{ service.default_server_rise | default('2') }}
    default-server fall {{ service.default_server_fall | default('3') }}
 {% for server in service.backend_servers %}
    {% if server.proto == "https" %}
    server {{ service_name }}-{{ loop.index }} {{ server.address }}:{{ server.port }} ssl verify none check
    {% else %}
    server {{ service_name }}-{{ loop.index }} {{ server.address }}:{{ server.port }} check
    {% endif %}
 {% endfor %}
 {% if service.headers is defined %}
 {% for hdr in service.headers %}
    {{ hdr }}
 {% endfor %}
 {% endif %}
 {% if service.rewrites is defined %}
 {% for rewrite in service.rewrites %}
    {{ rewrite }}
 {% endfor %}
 {% endif %}
 {% endfor %}
 # ==========================================
 # Vault backend for HAProxy
 # ==========================================
 backend vault_backend
    mode tcp
    option ssl-hello-chk
    server vault1 VAULT_IP:VAULT_PORT ssl verify required ca-file {{ haproxy_ca_path }} crt {{ haproxy_cert_path }}
@@ -0,0 +1,28 @@
 # Networking
 technitium_port: 53
 technitium_tls_port: 853
 technitium_admin_port: TECHNITIUM_PORT
 technitium_bind_address: "0.0.0.0"
 # ==========================================================
 # Directory paths
 # ==========================================================
 technitium_certs_dir: "/etc/technitium/certs"
 technitium_crt_path: "{{ technitium_certs_dir }}/technitium.crt"
 technitium_key_path: "{{ technitium_certs_dir }}/technitium.key"
 technitium_ca_path: "{{ technitium_certs_dir }}/technitium_ca.crt"
 # Install paths
 technitium_install_dir: "/opt/technitium/dns"
 technitium_data_dir: "{{ technitium_install_dir }}/data"
 vault_agent_templates:
  - src: "technitium_cert.ctmpl"
    dest: "{{ technitium_crt_path }}"
    service: "technitium"
  - src: "technitium_key.ctmpl"
    dest: "{{ technitium_key_path }}"
    service: "technitium"
  - src: "technitium_ca.ctmpl"
    dest: "{{ technitium_ca_path }}"
    service: "technitium"
@@ -0,0 +1,8 @@
 - name: Reload systemd
  ansible.builtin.systemd:
    daemon_reload: yes
 - name: Restart technitium
  ansible.builtin.systemd:
    name: technitium
    state: restarted
@@ -0,0 +1,125 @@
 ---
 # ==========================================================
 # Install and configure Technitium DNS Server
 # ==========================================================
 - name: Ensure Technitium install directory exists
  ansible.builtin.file:
    path: "{{ technitium_install_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0755"
 - name: Ensure Technitium data directory exists
  ansible.builtin.file:
    path: "{{ technitium_data_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0755"
 - name: Ensure Technitium TLS directory exists
  ansible.builtin.file:
    path: "{{ technitium_certs_dir }}"
    state: directory
    owner: vault
    group: vault
    mode: "0700"
 # ==========================================================
 # Install Technitium if not already installed
 # ==========================================================
 - name: Install Technitium DNS Server
  ansible.builtin.command: bash install.sh
  args:
    chdir: /tmp
    creates: "{{ technitium_install_dir }}/start.sh"
  environment:
    INSTALL_URL: "https://download.technitium.com/dns/install.sh"
  register: technitium_install_result
  ignore_errors: true
  changed_when: technitium_install_result.rc == 0
 # ==========================================================
 # SELinux setup (idempotent)
 # ==========================================================
 - name: Apply SELinux context for Technitium certs
  ansible.builtin.command: semanage fcontext -a -t etc_t '{{ technitium_certs_dir }}(/.*)?'
  register: selinux_ctx
  changed_when: selinux_ctx.rc == 0
  ignore_errors: true
 - name: Restore SELinux context for Technitium certs
  ansible.builtin.command: restorecon -Rv "{{ technitium_certs_dir }}"
  changed_when: false
 # ==========================================================
 # Firewalld setup
 # ==========================================================
 - name: Ensure firewalld is running
  ansible.builtin.systemd:
    name: firewalld
    enabled: true
    state: started
 - name: Open Technitium DNS and admin ports
  ansible.posix.firewalld:
    port: "{{ item.port }}/{{ item.proto }}"
    permanent: true
    state: enabled
    immediate: true
  loop:
    - { port: 53, proto: "udp" }
    - { port: 53, proto: "tcp" }
    - { port: 853, proto: "tcp" }
    - { port: 443, proto: "tcp" }
    - { port: 5380, proto: "tcp" }
 # ==========================================================
 # Systemd service deployment
 # ==========================================================
 - name: Deploy Technitium systemd unit
  ansible.builtin.template:
    src: "technitium.service.j2"
    dest: "/etc/systemd/system/technitium.service"
    owner: root
    group: root
    mode: "0644"
  notify:
    - Reload systemd
    - Restart technitium
 - name: Wait for Vault-Agent to render certificates
  ansible.builtin.wait_for:
    path: "{{ cert_path }}"
    state: present
    timeout: 60
  loop:
    - "{{ technitium_crt_path }}"
    - "{{ technitium_key_path }}"
    - "{{ technitium_ca_path }}"
  loop_control:
    loop_var: cert_path
 - name: Fix ownership and permissions for Technitium certs
  ansible.builtin.file:
    path: "{{ cert.path }}"
    owner: vault
    group: vault
    mode: "{{ cert.mode }}"
  loop:
    - { path: "{{ technitium_crt_path }}", mode: "0644" }
    - { path: "{{ technitium_key_path }}", mode: "0600" }
    - { path: "{{ technitium_ca_path }}", mode: "0644" }
  loop_control:
    loop_var: cert
 # ==========================================================
 # Start and enable service
 # ==========================================================
 - name: Ensure Technitium DNS service is running
  ansible.builtin.systemd:
    name: technitium
    enabled: true
    state: started
@@ -0,0 +1,16 @@
 [Unit]
 Description=Technitium DNS Server
 After=network.target
 [Service]
 Type=simple
 WorkingDirectory={{ technitium_install_dir }}
 #ExecStart={{ technitium_install_dir }}/start.sh
 ExecStart={{ technitium_install_dir }}/start.sh --tls-cert /etc/technitium/certs/technitium.crt --tls-key  /etc/technitium/certs/technitium.key
 Restart=always
 RestartSec=5
 User=root
 Group=root
 [Install]
 WantedBy=multi-user.target
@@ -0,0 +1,4 @@
 technitium_service_name: "technitium"
 technitium_binary_url: "https://download.technitium.com/dns/DnsServerPortable.tar.gz"
 technitium_data_dir: "{{ technitium_install_dir }}/data"
 technitium_conf_file: "{{ technitium_install_dir }}/Technitium.Dns.Server.json"
@@ -0,0 +1,41 @@
 ---
 vault_addr: "http://VAULT_IP:VAULT_PORT"
 vault_agent_config_path: "/etc/vault-agent-config.hcl"
 vault_agent_pid_file: "/var/run/vault-agent.pid"
 vault_agent_user: "root"
 vault_agent_service: "vault-agent"
 vault_agent_systemd_unit: "/etc/systemd/system/vault-agent.service"
 # Paths to role_id / secret_id files (written by bootstrap process)
 vault_role_id_file: "/etc/vault-agent/role_id"
 vault_secret_id_file: "/etc/vault-agent/secret_id"
 # Templates
 vault_templates_dir: "/etc/vault-agent-templates"
 vault_agent_templates:
  # HAProxy
  - src: "haproxy.pem.ctmpl"
    dest: "/etc/haproxy/certs/haproxy.pem"
    service: haproxy
  - src: "haproxy_ca.ctmpl"
    dest: "/etc/haproxy/certs/haproxy_ca.crt"
    service: haproxy
  - src: "thesabear-client.ctmpl"
    dest: "/etc/haproxy/certs/clients/thesabear-client.pem"
    service: "haproxy"
  # Technitium
  - src: "technitium_cert.ctmpl"
    dest: "/etc/technitium/certs/technitium.crt"
    service: technitium
  - src: "technitium_key.ctmpl"
    dest: "/etc/technitium/certs/technitium.key"
    service: technitium
  - src: "technitium_ca.ctmpl"
    dest: "/etc/technitium/certs/technitium_ca.crt"
    service: technitium
 # Default Vault PKI options (can remain)
 pki_mount_path: "pki"
@@ -0,0 +1,3 @@
 {{- with secret "pki/cert/ca" -}}
 {{ trim .Data.certificate "\n" }}
 {{- end }}
@@ -0,0 +1,7 @@
 {% raw %}
 {{- with secret "pki/issue/{{ wildcard_role_name }}" "common_name={{ common_name }}" -}}
 {{ .Data.certificate }}
 {{ .Data.private_key }}
 {{ .Data.issuing_ca }}
 {{- end }}
 {% endraw %}
@@ -0,0 +1,6 @@
 {{ with secret "pki/issue/securevault-wildcard" "common_name=*.local.DOMAIN_PLACEHOLDER" "ttl=8760h" }}
 {{ .Data.certificate }}
 {{ .Data.issuing_ca }}
 {{ .Data.private_key }}
 {{ end }}
		`@@ -0,0 +1,2 @@`
							`[Desktop Entry]`
							`Icon=/home/thesabear/Downloads/App Images/devops_iac_publicreo.png`
		`@@ -0,0 +1,3 @@`
							`Coming Soon...`

							`There will soon be a full write-up of the way that the Ansible Roles and Tags laid out during the VM creation via Terraform, is used to configure a VM based on very specific use cases and criteria. The way I have designed the entire workflow is condusive to having a secure Packer built ISO expanded in its capabilites simply by the addition of a new Ansible Role and Tag.`
		`@@ -0,0 +1,2 @@`
							`---`
							`roles_metadata: "{{ lookup('file', 'roles_metadata.yml') \| from_yaml }}"`
		`@@ -0,0 +1,2 @@`
							`---`
							`root_password_plain: "{{ lookup('env', 'ROOT_PASSWORD') }}"`