Merge remote-tracking branch 'origin/master'

"restart: unless-stopped"

drone/drone.yaml

@@ -1,10 +0,0 @@
-kind: pipeline
-type: docker
-name: default
-
-steps:
-  - name: build
-    image: python:3.11
-    commands:
-      - pip install -r requirements.txt
-      - python your_script.py

drone/drone_connect_remote_dc=ocker.yaml

@@ -1,6 +0,0 @@
-steps:
-  - name: build
-    image: plugins/docker
-    settings:
-      repo: youruser/your-image
-      docker_host: ssh://user@host

drone/drone_dockler_registry.yaml

@@ -1,7 +0,0 @@
-steps:
-  - name: build
-    image: your_private_registry/your_image:tag
-    image_pull_secrets:
-      - dockerconfigjson
-    commands:
-      - # your build command

playbooks/roles/backups/README.md

@@ -0,0 +1,6 @@
+Custom backups
+=========
+
+Create a crontab job for:
+ - daily and weekly database dumps
+ - archiving the /srv directory

playbooks/roles/backups/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for backups

playbooks/roles/backups/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for backups

playbooks/roles/backups/tasks/main.yml

@@ -0,0 +1,28 @@
+---
+# tasks file for backups
+- name: Create daily cron job for database backup
+  ansible.builtin.cron:
+    name: "Database backup daily at 5am"
+    user: postgres
+    minute: "0"
+    hour: "5"
+    job: "PGPASSWORD='{{ db_password }}' pg_dump -h localhost -p {{ ports.db_port.port }}  -U {{ db_user }} -F c {{ db_name }} > /backups/prod_db_backups/daily_backup_$(date +\%F).dump"
+
+- name: Create weekly cron job for full database backup
+  ansible.builtin.cron:
+    name: "Database backup weekly sunday at 2am"
+    user: postgres
+    weekday: "7"
+    minute: "0"
+    hour: "2"
+    job: "pg_dumpall -h localhost -p {{ ports.db_port.port }}  -U postgres > /backups/prod_db_backups/full_backup_$(date +\%F).dump"
+
+
+- name: Create daily cron job for srv directory  backup
+  ansible.builtin.cron:
+    name: "srv directory backup daily at 5am"
+    user: root
+    minute: "0"
+    hour: "5"
+    job: "tar -czvf /backups/gitea_drone_backups/srv_backup_$(date +%F).tar.gz /srv"
+

playbooks/roles/backups/tests/test.yml

@@ -2,4 +2,4 @@
 - hosts: localhost
   remote_user: root
   roles:
-    - nginx
+    - backups

playbooks/roles/backups/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for backups

playbooks/roles/base-tools/README.md

@@ -1,33 +1,11 @@
-Install base tools for work
+Install tools for work
 =========
 
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the
-role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-No variables.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set
-for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).
+Istall tools for work:
+  
+  - sudo
+  - fail2ban
+  - nano
+  - tree
+  - python3
+  - python3-pip

playbooks/roles/docker-install/README.md

@@ -1,35 +1,5 @@
 Install Docker
 =========
 
-Install Dicker and dependencies
-Requirements
-------------
+Install Docker and dependencies
 
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

playbooks/roles/docker-install/tasks/docker-playbook.yaml.examples

@@ -1,51 +0,0 @@
----
-- name: Deploy Docker
-  hosts: main_server
-  become: yes
-  tasks:
-    - name: Install dependencies
-      apt:
-        name:
-          - apt-transport-https
-          - ca-certificates
-          - curl
-          - gnupg
-          - lsb-release
-        state: present
-        update_cache: yes
-
-    - name: Add Docker GPG key if not exists
-      command: bash -c "curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker.gpg"
-      args:
-        creates: /usr/share/keyrings/docker.gpg
-
-    - name: Add Docker repository
-      apt_repository:
-        repo: "deb [arch=amd64 signed-by=/usr/share/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
-        state: present
-        update_cache: yes
-
-    - name: Install Docker packages
-      apt:
-        name:
-          - docker-ce
-          - docker-ce-cli
-          - containerd.io
-        state: present
-
-    - name: Check docker is active
-      service:
-        name: docker
-        state: started
-        enabled: yes
-
-    - name: Ensure group "docker" exists
-      ansible.builtin.group:
-        name: docker
-        state: present
-
-    - name: Install docker-compose
-      apt:
-        name: docker-compose-plugin
-        state: present
-

playbooks/roles/drone/files/drone-compose.yaml

@@ -3,6 +3,7 @@ services:
     container_name: drone
     image: drone/drone:2.26.0
     environment:
+      DRONE_USER_CREATE: username:${USERNAME},admin:true
       DRONE_RPC_SECRET: '${DRONE_RPC_SECRET}'
       DRONE_SERVER_HOST: '${DRONE_SERVER_HOST}'
       DRONE_GITEA_SERVER: 'https://${GIT_DOMAIN}'
@@ -11,6 +12,8 @@ services:
       DRONE_GITEA_CLIENT_SECRET: '${DRONE_GITEA_CLIENT_SECRET}'
       DRONE_DATABASE_DRIVER: postgres
       DRONE_DATABASE_DATASOURCE: postgres://drone:dronepass@postgres:5432/drone_db?sslmode=disable
+      DRONE_LOGS_PRETTY: true
+      DRONE_LOGS_COLOR: true
     volumes:
       - /srv/cicd/drone:/data
       - /var/run/docker.sock:/var/run/docker.sock

playbooks/roles/gitea/files/docker_files/gitea-compose.yaml

@@ -22,6 +22,7 @@ services:
       GITEA__server__DOMAIN: ${GIT_DOMAIN}
       GITEA__server__SSH_DOMAIN: ${GIT_DOMAIN}
       GITEA__server__ROOT_URL: "https://${GIT_DOMAIN}/"
+      GITEA__server__OFFLINE_MODE: false
       #      GITEA__server__SSH_PORT: 22
       #      GITEA__server__SSH_LISTEN_PORT: 22
       GITEA__server__LFS_START_SERVER: true

playbooks/roles/metrics/files/prometheus_grafana-compose.yaml

@@ -3,6 +3,7 @@ services:
     image: prom/prometheus:v3.4.2
     container_name: prometheus
     volumes:
+      - /srv/monitoring/prometheus-storage:/prometheus
       - ./prometheus.yml:/etc/prometheus/prometheus.yml
     user: root
     networks:
@@ -16,6 +17,7 @@ services:
       - '--nginx.scrape-uri=http://nginx:9888/nginx_status'
     networks:
       - monitoring_net
+    restart: unless-stopped
 
   postgres-exporter:
     image: prometheuscommunity/postgres-exporter:v0.17.1
@@ -25,6 +27,7 @@ services:
     networks:
       monitoring_net:
         ipv4_address: "${POSTGRES_EXPORTER_IP}"
+    restart: unless-stopped
 
   grafana:
     image: grafana/grafana:12.0.2

playbooks/roles/nginx-reconfigure2/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-A brief description of the role goes here.
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

playbooks/roles/nginx-reconfigure2/defaults/main.yml

@@ -1,2 +0,0 @@
----
-# defaults file for nginx

playbooks/roles/nginx-reconfigure2/files/docker_files/certbot/Dockerfile

@@ -1,20 +0,0 @@
-
-#облегченный образ дебиан
-FROM debian:stable-slim
-LABEL authors="RONIS"
-
-# Обновление и установка необходимых пакетов
-RUN apt update && \
-    apt install -y python3-certbot-nginx && \
-    apt install -y cron
-
-
-COPY check_and_create_cert.sh  ./
-
-# Проверка наличия сертификата для домена
-RUN chmod +x ./check_and_create_cert.sh && echo "0 0 1 * * certbot renew --quiet" | tee -a /etc/crontab > /dev/null
-
-
-# Запуск скрипта в контейнере при старте "& cron -f" обеспечивает запуск процесса для поддержки контейнера 
-CMD bash -c "./check_and_create_cert.sh & cron -f"
-

playbooks/roles/nginx-reconfigure2/files/docker_files/certbot/check_and_create_cert.sh

@@ -1,9 +0,0 @@
-#!/bin/sh
-set -e
-if certbot certificates | grep -q "No certificates found."; then
-    echo "Сертификат не найден. Создаю новый..."
-    certbot certonly --webroot --w /var/www/certbot/ -d $DOMAIN_URL -d $GIT_DOMAIN -d $DRONE_DOMAIN -m $DOMAIN_EMAIL --agree-tos --no-eff-email --non-interactive --config-dir /etc/letsencrypt --work-dir /var/lib/letsencrypt --logs-dir /var/log/letsencrypt
-else
-    echo "Сертификат уже существует."
-    certbot renew -n
-fi

playbooks/roles/nginx-reconfigure2/files/docker_files/nginx-compose.yaml

@@ -1,49 +0,0 @@
-services:
-  nginx:
-    container_name: nginx
-    image: nginx:1.28.0-bookworm
-    environment:
-      USER_ID: 1000
-      USER_GID: 1001
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - /srv/proxy/nginx/:/etc/nginx/:ro
-      - /srv/proxy/certbot/letsencrypt:/etc/letsencrypt:ro
-      - /srv/proxy/certbot/www/:/var/www/certbot/
-      - /srv/log/nginx:/var/log/nginx
-      - /srv/proxy/static:/usr/share/nginx/static:ro
-
-    restart: unless-stopped
-    networks:
-      - cicd_net
-      - nginx_net
-      - test_net
-      - prod_net
-
-  certbot:
-    container_name: certbot
-    build: certbot
-    env_file:
-      - .env
-    volumes:
-      - /srv/proxy/certbot/letsencrypt:/etc/letsencrypt
-      - /srv/proxy/certbot/www/:/var/www/certbot
-      - /srv/proxy/var/log/letsencrypt:/var/log/letsencrypt
-    restart: unless-stopped
-    user: root
-    depends_on:
-      - nginx
-    networks:
-      - nginx_net
-
-networks:
-  nginx_net:
-    external: true
-  cicd_net:
-    external: true
-  test_net:
-    external: true
-  prod_net:
-    external: true

playbooks/roles/nginx-reconfigure2/files/nginx/mime.types

@@ -1,10 +0,0 @@
-types {
-    text/html               html;
-    text/css                css;
-    application/javascript  js;
-    text/plain              txt;
-    image/png               png;
-    image/jpeg              jpg jpeg;
-    image/gif               gif;
-    image/svg+xml           svg;
-}

playbooks/roles/nginx-reconfigure2/files/nginx/nginx.conf

@@ -1,108 +0,0 @@
-# user  nginx;
-
-worker_processes auto;
-
-events {
-    worker_connections 1024;
-}
-
-http {
-
-
-    include       mime.types;
-    default_type  application/octet-stream;
-
-
-    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
-                    '$status $body_bytes_sent "$http_referer" '
-                    '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log /var/log/nginx/access.log main;
-    error_log /var/log/nginx/error.log warn;
-
-    proxy_cache_path /tmp/cache keys_zone=my_cache:10m max_size=1g inactive=60m use_temp_path=off;
-
-    client_max_body_size 100M;
-
-    gzip on;
-    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
-    gzip_min_length 1000;
-
-    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=5r/s;
-
-
-
-     upstream web_backend {
-        least_conn;
-         server web_backend1:5000;
-         server web_backend2:5000;
-
-    }
-
-     upstream gitea {
-        least_conn;
-         server gitea:3000;
-    }
-
-     upstream drone {
-        least_conn;
-         server drone:80;
-    }
-
-    server {
-        listen 9888;
-        server_name localhost;
-
-        location /nginx_status {
-            stub_status;
-#             allow 127.0.0.1;
-#             allow 172.18.0.0/16;
-#             deny all;
-        }
-    }
-
-
-
-    server {
-        listen 80;
-        server_name  git.roniss0505.tech;
-
-        include /etc/nginx/shared_locations.conf;
-
-        location / {
-            proxy_pass http://gitea;
-                include /etc/nginx/proxy_common.conf;
-                error_page 502 504 /server_not_available.html;
-            }
-    }
-
-    server {
-        listen 80;
-        server_name roniss0505.tech;
-
-        include /etc/nginx/shared_locations.conf;
-
-        location / {
-            proxy_pass http://drone;
-            include /etc/nginx/proxy_common.conf;
-            error_page 502 504 /server_not_available.html;
-        }
-    }
-    server {
-        listen 80;
-        server_name drone.roniss0505.tech;
-
-        include /etc/nginx/shared_locations.conf;
-
-
-        location /api/ {
-              rewrite ^/api/(.*)$ /$1 break;  #deleting "/api/" from path
-              proxy_pass http://web_backend;
-#             proxy_cache my_cache;
-#             proxy_cache_valid 200 1h;
-#             proxy_cache_valid 404 1m;
-            include /etc/nginx/proxy_common.conf;
-            error_page 502 504 /server_not_available.html;
-        }
-    }
-}

playbooks/roles/nginx-reconfigure2/files/nginx/proxy_common.conf

@@ -1,3 +0,0 @@
-proxy_set_header X-Forwarded-Proto https;
-proxy_set_header X-Forwarded-Host $host;
-proxy_set_header X-Real-IP $remote_addr;

playbooks/roles/nginx-reconfigure2/files/nginx/shared_locations.conf

@@ -1,11 +0,0 @@
-        location /rate_limit/ {
-            limit_req zone=api_limit burst=10 nodelay;
-        }
-
-        location /logs/ {
-            access_log /var/log/nginx/special_access.log;
-        }
-
-        location = /server_not_available.html {
-            root /usr/share/nginx/static;
-        }

playbooks/roles/nginx-reconfigure2/files/static/sewrver_not_availavle.html

@@ -1,59 +0,0 @@
-<!DOCTYPE html>
-<html lang="ru">
-<head>
-    <meta charset="UTF-8"/>
-    <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
-    <title>Сервис недоступен</title>
-    <style>
-        * {
-            margin: 0;
-            padding: 0;
-            box-sizing: border-box;
-        }
-
-        body {
-            height: 100vh;
-            background: linear-gradient(135deg, #4cc713, #2a5298);
-            display: flex;
-            align-items: center;
-            justify-content: center;
-            color: white;
-            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
-            text-align: center;
-            padding: 20px;
-        }
-
-        .container {
-            max-width: 600px;
-        }
-
-
-        .message {
-            background-color: rgba(128, 128, 128, 0.8); /* grey с 80% непрозрачности */
-            display: flex;
-            flex-direction: column;
-            transform-style: preserve-3d;
-            padding: 30px 50px;
-            border-radius: 10px;
-            box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
-        }
-
-        h1 {
-            font-size: 3em;
-            margin-bottom: 0.5em;
-        }
-
-        p {
-            font-size: 1.2em;
-            opacity: 0.8;
-        }
-
-    </style>
-</head>
-<body>
-<div class="message">
-    <h1>Сервис временно недоступен</h1>
-    <p>Мы уже работаем над восстановлением. Попробуйте войти позже.</p>
-</div>
-</body>
-</html>

playbooks/roles/nginx-reconfigure2/handlers/main.yml

@@ -1,2 +0,0 @@
----
-# handlers file for nginx

playbooks/roles/nginx-reconfigure2/tasks/main.yml

@@ -1,23 +0,0 @@
----
-- name: Copy nginx conf
-  ansible.builtin.copy:
-    src: "../files/nginx/"
-    dest: "/srv/proxy/nginx/"
-
-- name: Copy proxy compose
-  ansible.builtin.copy:
-    src: "../files/docker_files/"
-    dest: "/home/{{ main_user }}/workdir/proxy/"
-
-
-- name: Copy proxy static
-  ansible.builtin.copy:
-    src: "../files/static/"
-    dest: "/srv/proxy/static/"
-
-- name: Run nginx-compose
-  community.docker.docker_compose_v2:
-    project_src: "/home/{{ main_user }}/workdir/proxy/"
-    files: nginx-compose.yaml
-    state: present
-    recreate: always

playbooks/roles/nginx-reconfigure2/vars/main.yml

@@ -1,2 +0,0 @@
----
-# vars file for nginx

playbooks/roles/postgres-config/tasks/main.yml

@@ -4,13 +4,16 @@
   lineinfile:
     path: "/etc/postgresql/{{ db_version }}/main/postgresql.conf"
     regexp: '^#?listen_addresses\s*='
-    line: "listen_addresses = 'localhost,{{ host_ip }},{{  docker_networks.monitoring_net.gateway }}'"
+    line: >
+      "listen_addresses = 'localhost,
+      {{ host_ip }},{{  docker_networks.monitoring_net.gateway }},
+      {{  docker_networks.prod_net.gateway }}'"
     create: yes
 
 
 - name: Ensure external IPs
   lineinfile:
-    path: "/etc/postgresql/{{ db_version }}/main/pg_hba.conf"
+    path: "rm"
     regexp: "{{ item.regexp }}"
     line: "{{ item.line }}"
     insertafter: EOF
@@ -18,7 +21,9 @@
     - regexp: '^host\s+all\s+all\s+{{ allowed_ip | regex_escape() }}\s+.*$'
       line: "host    all     all    {{ allowed_ip }}/32    scram-sha-256"
     - regexp: '^host\s+all\s+all\s+{{ postgres_exporter_ip | regex_escape() }}\s+.*$'
-      line: "host    all     all    {{ postgres_exporter_ip }}/32    scram-sha-256"
+      line: "host    all     all    {{ docker_networks.monitoring_net.gateway }}/16   scram-sha-256"
+    - regexp: '^host\s+all\s+all\s+{{ docker_networks.prod_net.gateway | regex_escape() }}\s+.*$'
+      line: "host    all     all    {{ docker_networks.prod_net.gateway }}/16    scram-sha-256"
 
 
 - name: Set custom PostgreSQL port

playbooks/roles/postgres-init/tasks/main.yml

@@ -54,22 +54,7 @@
     grant_option: yes
   become_user: postgres
 
-- name: Create daily cron job for database backup
-  ansible.builtin.cron:
-    name: "Database backup daily at 5am"
-    user: postgres
-    minute: "0"
-    hour: "5"
-    job: "PGPASSWORD='{{ db_password }}' pg_dump -h localhost -p {{ ports.db_port.port }}  -U {{ db_user }} -F c {{ db_name }} > /backups/db_backups/backup_\\$(date +\\%F).dump"
 
-- name: Create weekly cron job for full database backup
-  ansible.builtin.cron:
-    name: "Database backup weekly sunday at 2am"
-    user: postgres
-    weekday: "7"
-    minute: "0"
-    hour: "2"
-    job: 'pg_dumpall -h localhost -p {{ ports.db_port.port }}  -U postgres > /backups/db_backups/full_backup_\\$(date +\\%F).dump'
 #postgres=# CREATE USER db_monitoring WITH PASSWORD 'db_monitoring!';