Forgejo config

servers/ansible/inventory.ini

@@ -1,2 +1,2 @@
 [personal]
-ns3763049.ip-213-32-25.eu     ansible_connection=ssh        ansible_user=ansible
+ns3763049.ip-213-32-25.eu     ansible_connection=ssh        ansible_user=ansible ansible_port=222

servers/ansible/playbook.yaml

@@ -1,12 +1,13 @@
-- name: My first play
+- name: Set up servers
   hosts: personal
+  gather_facts: false
   tasks:
-    - name: Ping my hosts
-      ansible.builtin.ping:
+    # - name: Change SSH port
+    #   ansible.builtin.include_role: 
+    #     name: ssh-port
+    - name: Run deferred setup to gather facts
+      setup:
 
-    - name: Print message
-      ansible.builtin.debug:
-        msg: Hello world
     # - name: Copy conduwuit backup
     #   ansible.posix.synchronize:
     #     src: ./conduwuit-testing
@@ -17,6 +18,7 @@
         enabled: true
         state: started
     - name: Copy containers
+      become: true
       ansible.posix.synchronize:
         src: ../containers/
         dest: /etc/containers/systemd
@@ -24,19 +26,23 @@
     - name: Reload systemd generators
       ansible.builtin.command: sudo systemctl daemon-reload
     - name: Install logrotate
+      become: true
       ansible.builtin.package:
         name: logrotate
         state: present
     - name: Copy logrotate config
+      become: true
       ansible.posix.synchronize:
         src: ../logrotate.d/
         dest: /etc/logrotate.d
     - name: find files with possible suspect line endings or perms
+      become: true
       ansible.builtin.find:
         paths: /etc/logrotate.d
         patterns: '*'
       register: output
     - name: fix suspect line endings
+      become: true
       replace: path={{item.path}} regexp="\r"
       with_items: "{{ output.files }}"
     - name: fix logrotate permissions
@@ -56,6 +62,7 @@
         path: /var/log/traefik
         state: directory
     - name: Copy kanidm config
+      become: true
       ansible.posix.synchronize:
         src: ../kanidm/
         dest: /etc/kanidm
@@ -67,18 +74,25 @@
       file:
         path: /var/opt/kanidm_data
         state: directory
+    - name: Creates forgejo data directory
+      file:
+        path: /var/opt/forgejo_data
+        state: directory
     # - name: Generate Element Web config
     #   # run on localhost
     #   local_action: ansible.builtin.command cd ../element-web && node config.js
     - name: Copy Element Web config
+      become: true
       ansible.posix.synchronize:
         src: ../element-web/public/
         dest: /etc/element-web
     - name: Copy homepage config
+      become: true
       ansible.posix.synchronize:
         src: ../homepage/
         dest: /etc/homepage
     - name: Copy sentry relay config
+      become: true
       ansible.posix.synchronize:
         src: ../sentry-relay/
         dest: /etc/sentry-relay
@@ -87,16 +101,19 @@
         path: /var/opt/stalwart-mail
         state: directory
     - name: Copy stalwart config
+      become: true
       ansible.posix.synchronize:
         src: ../stalwart/
         dest: /etc/stalwart
     - name: Copy coturn config
+      become: true
       ansible.posix.synchronize:
         src: ../coturn/
         dest: /etc/coturn
     # Pull mautrix config:
     # rsync --rsync-path="sudo rsync" -r -t -z -P --include "*/" --include="*.yaml" --exclude="*" ansible@213.32.25.24:/var/opt/mautrix/ ./mautrix
     - name: Copy mautrix config
+      become: true
       ansible.posix.synchronize:
         src: ../mautrix/
         dest: /var/opt/mautrix
@@ -123,6 +140,7 @@
         path: /var/opt/freshrss-extensions
         state: directory
     - name: Copy freshrss config
+      become: true
       ansible.posix.synchronize:
         src: ../freshrss/
         dest: /etc/freshrss

servers/ansible/roles/ssh-port/handlers/main.yml

@@ -0,0 +1,5 @@
+    - name: Restart sshd
+      become: true
+      service:
+        name: sshd
+        state: restarted

servers/ansible/roles/ssh-port/tasks/main.yml

@@ -0,0 +1,126 @@
+---
+#   Copyright Red Hat, Inc. All Rights Reserved.
+#
+#   Licensed under the Apache License, Version 2.0 (the "License"); you may
+#   not use this file except in compliance with the License. You may obtain
+#   a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#   WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#   License for the specific language governing permissions and limitations
+#   under the License.
+#
+#   Author: David Moreau Simard <dms@redhat.com>
+
+# ansible_port can change throughout this role, keep a copy around
+- name: Set configured port fact
+  set_fact:
+    configured_port: "{{ ansible_port }}"
+
+# From localhost, check if we're able to reach {{ inventory_hostname }} on
+# port 22
+- name: Check if we're using the default SSH port
+  wait_for:
+    port: "22"
+    state: "started"
+    host: "{{ inventory_hostname }}"
+    connect_timeout: "5"
+    timeout: "5"
+  delegate_to: "localhost"
+  ignore_errors: true
+  register: default_ssh
+
+# If reachable, continue the following tasks with this port
+- name: Set inventory ansible_port to default
+  set_fact:
+    ansible_port: "22"
+  when: default_ssh is defined and
+        default_ssh.state is defined and
+        default_ssh.state == "started"
+  register: ssh_port_set
+
+# If unreachable on port 22, check if we're able to reach
+# {{ inventory_hostname }} on {{ ansible_port }} provided by the inventory
+# from localhost
+- name: Check if we're using the inventory-provided SSH port
+  wait_for:
+    port: "{{ ansible_port }}"
+    state: "started"
+    host: "{{ inventory_hostname }}"
+    connect_timeout: "5"
+    timeout: "10"
+  delegate_to: "localhost"
+  ignore_errors: true
+  register: configured_ssh
+  when: default_ssh is defined and
+        default_ssh.state is undefined
+
+# If {{ ansible_port }} is reachable, we don't need to do anything special
+- name: SSH port is configured properly
+  debug:
+    msg: "SSH port is configured properly"
+  when: configured_ssh is defined and
+        configured_ssh.state is defined and
+        configured_ssh.state == "started"
+  register: ssh_port_set
+
+# If the SSH port is neither the default or the configured, give up.
+- name: Fail if SSH port was not auto-detected (unknown)
+  fail:
+    msg: "The SSH port is neither 22 or {{ ansible_port }}."
+  when: ssh_port_set is undefined
+
+# Sanity check, make sure Ansible is able to connect to the host
+- name: Confirm host connection works
+  ping:
+
+- name: Setup alternate SSH port
+  become: true
+  lineinfile:
+    dest: "/etc/ssh/sshd_config"
+    regexp: "^#?Port"
+    line: "Port {{ configured_port }}"
+  notify: "Restart sshd"
+- name: Creates sshd socket override directory
+  become: true
+  file:
+    path: /etc/systemd/system/sshd.socket.d
+    state: directory
+- name: Setup alternate SSH port (systemd)
+  become: true
+  copy:
+    dest: "/etc/systemd/system/sshd.socket.d/override.conf"
+    content: |
+      [Socket]
+      ListenStream=
+      ListenStream={{ configured_port }}
+  notify: "Restart sshd"
+
+- name: Setup selinux for alternate SSH port
+  ignore_errors: true
+  seport:
+    ports: "{{ configured_port }}"
+    proto: "tcp"
+    setype: "ssh_port_t"
+    state: "present"
+
+
+# We notified "Restart sshd" if we modified the sshd config.
+# By calling flush_handlers, we make sure the handler is run *right now*
+- name: Ensure SSH is reloaded if need be
+  meta: flush_handlers
+
+# We're done, make sure ansible_port is set properly so that any tasks
+# after this use the right ansible_port.
+- name: Ensure we use the configured SSH port for the remainder of the role
+  set_fact:
+    ansible_port: "{{ configured_port }}"
+
+# Gather facts should be set to false when running this role since it will
+# fail if the Ansible SSH port is not set correctly.
+# We run setup to gather facts here once the SSH port is set up.
+- name: Run deferred setup to gather facts
+  setup: