From dc3ff78d6da7ac1af536e97f56ac0a0a1dbad05c Mon Sep 17 00:00:00 2001 From: Dmitry Date: Wed, 27 May 2026 15:41:15 +0300 Subject: [PATCH] Refactor Docker Compose configurations and add deployment workflows for cloud-pc and mini-pc services --- .gitea/workflows/deploy-cloud-pc.yml | 31 ++++++ .gitea/workflows/deploy-mini-pc.yml | 31 ++++++ .gitea/workflows/deploy-ru-vps.yml | 31 ++++++ .gitignore | 3 + ansible/ansible.cfg | 6 ++ ansible/inventory/hosts.yml | 31 ++++++ ansible/playbooks/base.yml | 15 +++ ansible/playbooks/bootstrap.yml | 10 ++ ansible/playbooks/dirs.yml | 117 ++++++++++++++++++++++ ansible/roles/bootstrap/defaults/main.yml | 2 + ansible/roles/bootstrap/handlers/main.yml | 4 + ansible/roles/bootstrap/tasks/main.yml | 60 +++++++++++ cloud-pc/.gitea/workflows/deploy.yml | 0 cloud-pc/ada-dev.ru/docker-compose.yml | 7 ++ cloud-pc/gitea-runner/docker-compose.yml | 4 +- cloud-pc/gitea/docker-compose.yml | 5 +- cloud-pc/neural_miad/docker-compose.yml | 6 ++ cloud-pc/nextcloud/docker-compose.yml | 12 +-- cloud-pc/resticprofile/profiles.toml | 55 ++++++++++ cloud-pc/samba/.env.example | 1 + cloud-pc/samba/docker-compose.yml | 16 +++ cloud-pc/syncthing/docker-compose.yml | 14 +++ cloud-pc/watchtower/docker-compose.yml | 9 ++ cloud-pc/zerotier/docker-compose.yml | 15 +++ mini-pc/.gitea/workflows/deploy.yml | 0 mini-pc/adguard/docker-compose.yml | 6 +- mini-pc/caddy/.env.example | 2 + mini-pc/caddy/Caddyfile | 14 +++ mini-pc/caddy/Dockerfile | 8 ++ mini-pc/caddy/docker-compose.yml | 16 +++ mini-pc/gitea-runner/docker-compose.yml | 11 ++ mini-pc/npm_local/docker-compose.yml | 12 --- mini-pc/vaultwarden/docker-compose.yml | 4 +- mini-pc/zerotier/docker-compose.yml | 15 +++ ru-vps/.gitea/workflows/deploy.yml | 0 ru-vps/caddy/Caddyfile | 19 ++++ ru-vps/caddy/docker-compose.yml | 14 +++ ru-vps/gitea-runner/docker-compose.yml | 11 ++ ru-vps/zerotier/docker-compose.yml | 15 +++ 39 files changed, 603 insertions(+), 29 deletions(-) create mode 100644 .gitea/workflows/deploy-cloud-pc.yml create mode 100644 .gitea/workflows/deploy-mini-pc.yml create mode 100644 .gitea/workflows/deploy-ru-vps.yml create mode 100644 .gitignore create mode 100644 ansible/ansible.cfg create mode 100644 ansible/inventory/hosts.yml create mode 100644 ansible/playbooks/base.yml create mode 100644 ansible/playbooks/bootstrap.yml create mode 100644 ansible/playbooks/dirs.yml create mode 100644 ansible/roles/bootstrap/defaults/main.yml create mode 100644 ansible/roles/bootstrap/handlers/main.yml create mode 100644 ansible/roles/bootstrap/tasks/main.yml create mode 100644 cloud-pc/.gitea/workflows/deploy.yml create mode 100644 cloud-pc/ada-dev.ru/docker-compose.yml create mode 100644 cloud-pc/neural_miad/docker-compose.yml create mode 100644 cloud-pc/resticprofile/profiles.toml create mode 100644 cloud-pc/samba/.env.example create mode 100644 cloud-pc/samba/docker-compose.yml create mode 100644 cloud-pc/syncthing/docker-compose.yml create mode 100644 cloud-pc/watchtower/docker-compose.yml create mode 100644 cloud-pc/zerotier/docker-compose.yml create mode 100644 mini-pc/.gitea/workflows/deploy.yml create mode 100644 mini-pc/caddy/.env.example create mode 100644 mini-pc/caddy/Caddyfile create mode 100644 mini-pc/caddy/Dockerfile create mode 100644 mini-pc/caddy/docker-compose.yml create mode 100644 mini-pc/gitea-runner/docker-compose.yml delete mode 100644 mini-pc/npm_local/docker-compose.yml create mode 100644 mini-pc/zerotier/docker-compose.yml create mode 100644 ru-vps/.gitea/workflows/deploy.yml create mode 100644 ru-vps/caddy/Caddyfile create mode 100644 ru-vps/caddy/docker-compose.yml create mode 100644 ru-vps/gitea-runner/docker-compose.yml create mode 100644 ru-vps/zerotier/docker-compose.yml diff --git a/.gitea/workflows/deploy-cloud-pc.yml b/.gitea/workflows/deploy-cloud-pc.yml new file mode 100644 index 0000000..5996ddf --- /dev/null +++ b/.gitea/workflows/deploy-cloud-pc.yml @@ -0,0 +1,31 @@ +name: Deploy cloud-pc + +on: + push: + paths: + - 'cloud-pc/**' + +jobs: + deploy: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + with: + fetch-depth: 2 + - name: Deploy changed stacks + run: | + ssh -o StrictHostKeyChecking=no ${{ secrets.CLOUD-PC_USER }}@${{ secrets.CLOUD-PC_HOST }} << 'ENDSSH' + cd /opt/services + git pull + for dir in $(git diff --name-only HEAD~1 HEAD | grep '^cloud-pc/' | cut -d/ -f2 | sort -u); do + echo "==> Deploying $dir" + cd /opt/services/cloud-pc/$dir + if grep -qE '^[[:space:]]*build:' docker-compose.yml; then + docker compose up -d --build --remove-orphans + else + docker compose pull + docker compose up -d --remove-orphans + fi + cd /opt/services + done + ENDSSH diff --git a/.gitea/workflows/deploy-mini-pc.yml b/.gitea/workflows/deploy-mini-pc.yml new file mode 100644 index 0000000..3e87aaa --- /dev/null +++ b/.gitea/workflows/deploy-mini-pc.yml @@ -0,0 +1,31 @@ +name: Deploy mini-pc + +on: + push: + paths: + - 'mini-pc/**' + +jobs: + deploy: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + with: + fetch-depth: 2 + - name: Deploy changed stacks + run: | + ssh -o StrictHostKeyChecking=no ${{ secrets.MINI-PC_USER }}@${{ secrets.MINI-PC_HOST }} << 'ENDSSH' + cd /opt/services + git pull + for dir in $(git diff --name-only HEAD~1 HEAD | grep '^mini-pc/' | cut -d/ -f2 | sort -u); do + echo "==> Deploying $dir" + cd /opt/services/mini-pc/$dir + if grep -qE '^[[:space:]]*build:' docker-compose.yml; then + docker compose up -d --build --remove-orphans + else + docker compose pull + docker compose up -d --remove-orphans + fi + cd /opt/services + done + ENDSSH diff --git a/.gitea/workflows/deploy-ru-vps.yml b/.gitea/workflows/deploy-ru-vps.yml new file mode 100644 index 0000000..e9bdb15 --- /dev/null +++ b/.gitea/workflows/deploy-ru-vps.yml @@ -0,0 +1,31 @@ +name: Deploy ru-vps + +on: + push: + paths: + - 'ru-vps/**' + +jobs: + deploy: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + with: + fetch-depth: 2 + - name: Deploy changed stacks + run: | + ssh -o StrictHostKeyChecking=no ${{ secrets.RU-VPS_USER }}@${{ secrets.RU-VPS_HOST }} << 'ENDSSH' + cd /opt/services + git pull + for dir in $(git diff --name-only HEAD~1 HEAD | grep '^ru-vps/' | cut -d/ -f2 | sort -u); do + echo "==> Deploying $dir" + cd /opt/services/ru-vps/$dir + if grep -qE '^[[:space:]]*build:' docker-compose.yml; then + docker compose up -d --build --remove-orphans + else + docker compose pull + docker compose up -d --remove-orphans + fi + cd /opt/services + done + ENDSSH diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..4950ce7 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +.env +*.env +!*.env.example diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg new file mode 100644 index 0000000..5cc1c20 --- /dev/null +++ b/ansible/ansible.cfg @@ -0,0 +1,6 @@ +[defaults] +inventory = inventory/hosts.yml + +[ssh_connection] +pipelining = true +ssh_args = -o ControlMaster=auto -o ControlPersist=60s diff --git a/ansible/inventory/hosts.yml b/ansible/inventory/hosts.yml new file mode 100644 index 0000000..dc9fe0a --- /dev/null +++ b/ansible/inventory/hosts.yml @@ -0,0 +1,31 @@ +all: + vars: + ansible_python_interpreter: /usr/bin/python3 + ansible_user: ada + + children: + servers: + hosts: + ru-vps: + ansible_host: vps + + cloud-pc: + ansible_host: 10.122.62.51 + # ansible_host: 192.168.1.5 + ansible_ssh_common_args: '-J mini-pc' + expected_lan_ip: 192.168.1.5 + storage_mounts: + - src: UUID=ae278333-4116-4225-9b95-595496fadd26 + path: /opt/data + fstype: ext4 + - src: UUID=940a9a4e-10cf-4380-9d22-a71549066561 + path: /mnt/backup + fstype: ext4 + - src: UUID=89024d30-1ab6-4b2e-b23b-62837455b24a + path: /opt/samba + fstype: ext4 + + mini-pc: + ansible_host: 10.122.62.95 + ansible_ssh_common_args: '-J vps' + expected_lan_ip: 192.168.1.10 diff --git a/ansible/playbooks/base.yml b/ansible/playbooks/base.yml new file mode 100644 index 0000000..0c28553 --- /dev/null +++ b/ansible/playbooks/base.yml @@ -0,0 +1,15 @@ +- name: Base server setup + hosts: servers + gather_facts: true + become: false + tasks: + - name: Ping hosts + ansible.builtin.ping: + + - name: Check expected LAN IP + ansible.builtin.assert: + that: + - expected_lan_ip in ansible_all_ipv4_addresses + fail_msg: "{{ inventory_hostname }} must have {{ expected_lan_ip }}; found: {{ ansible_all_ipv4_addresses | join(', ') }}" + success_msg: "{{ inventory_hostname }} has {{ expected_lan_ip }}" + when: expected_lan_ip is defined \ No newline at end of file diff --git a/ansible/playbooks/bootstrap.yml b/ansible/playbooks/bootstrap.yml new file mode 100644 index 0000000..10f509d --- /dev/null +++ b/ansible/playbooks/bootstrap.yml @@ -0,0 +1,10 @@ +# Запускать один раз на новом сервере от имени root или пользователя с полным sudo: +# ansible-playbook -i inventory/hosts.yml playbooks/bootstrap.yml -K +# +# После выполнения: Ansible-плейбуки всё равно требуют -K (become), +# но деплой через GitOps (docker compose) работает без пароля. +- name: Bootstrap servers + hosts: servers + become: true + roles: + - bootstrap diff --git a/ansible/playbooks/dirs.yml b/ansible/playbooks/dirs.yml new file mode 100644 index 0000000..631b3da --- /dev/null +++ b/ansible/playbooks/dirs.yml @@ -0,0 +1,117 @@ +- name: Directory structure — cloud-pc + hosts: cloud-pc + become: true + vars: + data_user: ada + data_group: ada + tasks: + - name: Create base mount points + ansible.builtin.file: + path: "{{ item.path }}" + state: directory + owner: "{{ data_user }}" + group: "{{ data_group }}" + mode: "0755" + loop: "{{ storage_mounts | default([]) }}" + + - name: Mount base storage disks + ansible.posix.mount: + path: "{{ item.path }}" + src: "{{ item.src }}" + fstype: "{{ item.fstype }}" + opts: "{{ item.opts | default('defaults,nofail') }}" + state: mounted + loop: "{{ storage_mounts | default([]) }}" + + - name: Create service data and config directories + ansible.builtin.file: + path: "{{ item }}" + state: directory + owner: "{{ data_user }}" + group: "{{ data_group }}" + mode: "0755" + loop: + - /opt/data/postgres + - /opt/data/nextcloud + - /opt/data/gitea + - /opt/data/gitea-runner + - /opt/data/syncthing + - /opt/data/zerotier + - /opt/samba/media + - /opt/samba/documents + - /opt/samba/backups_win + - /opt/configs + - /opt/configs/nextcloud/app + - /opt/configs/syncthing + + - name: Create /opt/services + ansible.builtin.file: + path: /opt/services + state: directory + owner: "{{ data_user }}" + group: "{{ data_group }}" + mode: "0755" + + - name: Create backup directories (3TB) + ansible.builtin.file: + path: "{{ item }}" + state: directory + owner: "{{ data_user }}" + group: "{{ data_group }}" + mode: "0755" + loop: + - /mnt/backup/restic/services + - /mnt/backup/restic/samba + - /mnt/backup/devices/proxmox + - /mnt/backup/devices/ada-x1 + +- name: Directory structure — mini-pc + hosts: mini-pc + become: true + vars: + data_user: ada + data_group: ada + tasks: + - name: Create service directories + ansible.builtin.file: + path: "{{ item }}" + state: directory + owner: "{{ data_user }}" + group: "{{ data_group }}" + mode: "0755" + loop: + - /opt/services + - /opt/data + - /opt/configs + - /opt/data/vaultwarden + - /opt/data/adguard/work + - /opt/data/caddy + - /opt/data/gitea-runner + - /opt/data/npm + - /opt/data/zerotier + - /opt/configs/adguard + - /opt/configs/caddy + - /opt/configs/npm/letsencrypt + +- name: Directory structure — ru-vps + hosts: ru-vps + become: true + vars: + data_user: ada + data_group: ada + tasks: + - name: Create service directories + ansible.builtin.file: + path: "{{ item }}" + state: directory + owner: "{{ data_user }}" + group: "{{ data_group }}" + mode: "0755" + loop: + - /opt/services + - /opt/data + - /opt/configs + - /opt/data/caddy + - /opt/data/gitea-runner + - /opt/data/zerotier + - /opt/configs/caddy diff --git a/ansible/roles/bootstrap/defaults/main.yml b/ansible/roles/bootstrap/defaults/main.yml new file mode 100644 index 0000000..a58a0ba --- /dev/null +++ b/ansible/roles/bootstrap/defaults/main.yml @@ -0,0 +1,2 @@ +bootstrap_user: ada +bootstrap_ssh_public_keys: [ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWNsUQmppB6cQccXX1ZaBbFIcmM6RmghsTVbG9TgoZB ada@ada-x1] diff --git a/ansible/roles/bootstrap/handlers/main.yml b/ansible/roles/bootstrap/handlers/main.yml new file mode 100644 index 0000000..fe201d3 --- /dev/null +++ b/ansible/roles/bootstrap/handlers/main.yml @@ -0,0 +1,4 @@ +- name: restart sshd + ansible.builtin.service: + name: sshd + state: restarted diff --git a/ansible/roles/bootstrap/tasks/main.yml b/ansible/roles/bootstrap/tasks/main.yml new file mode 100644 index 0000000..3b8f68a --- /dev/null +++ b/ansible/roles/bootstrap/tasks/main.yml @@ -0,0 +1,60 @@ +- name: Ensure user exists + ansible.builtin.user: + name: "{{ bootstrap_user }}" + shell: /bin/bash + groups: sudo + append: true + create_home: true + state: present + +# docker group создаётся только после установки Docker. +# Добавление происходит в роли docker, не здесь. + +- name: Add SSH authorized keys + ansible.posix.authorized_key: + user: "{{ bootstrap_user }}" + key: "{{ item }}" + state: present + loop: "{{ bootstrap_ssh_public_keys }}" + when: bootstrap_ssh_public_keys | length > 0 + +# Команды, которые реально нужны без пароля: +# apt / apt-get — обновление пакетов +# systemctl — управление сервисами +# ufw — фаервол +# resticprofile — установка systemd-таймеров бэкапа +# +# Ansible become НЕ входит в этот список намеренно: +# для плейбуков запускать с -K. Это сознательный компромисс +# между удобством и тем, чтобы не давать python3 NOPASSWD (= root). +- name: Configure sudoers — NOPASSWD for specific commands + ansible.builtin.copy: + dest: /etc/sudoers.d/{{ bootstrap_user }} + content: | + {{ bootstrap_user }} ALL=(ALL) NOPASSWD: /usr/bin/apt, /usr/bin/apt-get + {{ bootstrap_user }} ALL=(ALL) NOPASSWD: /usr/bin/systemctl + {{ bootstrap_user }} ALL=(ALL) NOPASSWD: /usr/bin/ufw + {{ bootstrap_user }} ALL=(ALL) NOPASSWD: /usr/local/bin/resticprofile + validate: /usr/sbin/visudo -cf %s + mode: "0440" + +# Drop-in конфиг — не трогаем основной sshd_config. +# Требует Debian 12+ (OpenSSH 8.9+). +- name: Harden SSH + ansible.builtin.copy: + dest: /etc/ssh/sshd_config.d/99-hardening.conf + content: | + PasswordAuthentication no + PermitRootLogin no + PubkeyAuthentication yes + mode: "0644" + notify: restart sshd + +- name: Ensure sshd_config.d is included + ansible.builtin.lineinfile: + path: /etc/ssh/sshd_config + line: Include /etc/ssh/sshd_config.d/*.conf + state: present + insertbefore: BOF + validate: /usr/sbin/sshd -t -f %s + notify: restart sshd diff --git a/cloud-pc/.gitea/workflows/deploy.yml b/cloud-pc/.gitea/workflows/deploy.yml new file mode 100644 index 0000000..e69de29 diff --git a/cloud-pc/ada-dev.ru/docker-compose.yml b/cloud-pc/ada-dev.ru/docker-compose.yml new file mode 100644 index 0000000..d0eda1a --- /dev/null +++ b/cloud-pc/ada-dev.ru/docker-compose.yml @@ -0,0 +1,7 @@ +services: + ada-dev: + image: git.ada-dev.ru/ada/ada-dev.ru:latest + container_name: ada-dev-ru + restart: unless-stopped + ports: + - "7080:80" \ No newline at end of file diff --git a/cloud-pc/gitea-runner/docker-compose.yml b/cloud-pc/gitea-runner/docker-compose.yml index 8775b23..29bc33c 100644 --- a/cloud-pc/gitea-runner/docker-compose.yml +++ b/cloud-pc/gitea-runner/docker-compose.yml @@ -4,8 +4,8 @@ services: restart: always volumes: - /var/run/docker.sock:/var/run/docker.sock - - /srv/stacks/gitea-runner/data:/data + - /opt/data/gitea-runner:/data environment: GITEA_INSTANCE_URL: https://git.ada-dev.ru GITEA_RUNNER_REGISTRATION_TOKEN: ${TOKEN} - GITEA_RUNNER_NAME: cloud-pc-runner \ No newline at end of file + GITEA_RUNNER_NAME: cloud-pc-runner diff --git a/cloud-pc/gitea/docker-compose.yml b/cloud-pc/gitea/docker-compose.yml index 8854701..cb92f7e 100644 --- a/cloud-pc/gitea/docker-compose.yml +++ b/cloud-pc/gitea/docker-compose.yml @@ -16,11 +16,8 @@ services: restart: unless-stopped volumes: - type: bind - source: /srv/stacks/gitea/data + source: /opt/data/gitea target: /data networks: default: name: gitea_default -x-dockge: - urls: - - https://git.ada-dev.ru \ No newline at end of file diff --git a/cloud-pc/neural_miad/docker-compose.yml b/cloud-pc/neural_miad/docker-compose.yml new file mode 100644 index 0000000..31e060d --- /dev/null +++ b/cloud-pc/neural_miad/docker-compose.yml @@ -0,0 +1,6 @@ +services: + neural: + ports: + - 4567:4567 + image: git.ada-dev.ru/ada/lr_miad_nn:latest +networks: {} \ No newline at end of file diff --git a/cloud-pc/nextcloud/docker-compose.yml b/cloud-pc/nextcloud/docker-compose.yml index 66716a0..c581f67 100644 --- a/cloud-pc/nextcloud/docker-compose.yml +++ b/cloud-pc/nextcloud/docker-compose.yml @@ -5,7 +5,7 @@ services: hostname: postgres restart: unless-stopped volumes: - - /srv/stacks/postgresql/data:/var/lib/postgresql/data + - /opt/data/postgres:/var/lib/postgresql/data environment: TZ: Europe/Moscow POSTGRES_DB: ${DB_NAME} @@ -35,8 +35,8 @@ services: - postgres - redis volumes: - - /srv/stacks/nextcloud/nc_data:/var/www/html - - /mnt/pool/nextcloud:/var/www/html/data + - /opt/configs/nextcloud/app:/var/www/html + - /opt/data/nextcloud:/var/www/html/data - /mnt/yandex:/mnt/yandex:shared environment: TZ: Europe/Moscow @@ -57,8 +57,8 @@ services: container_name: cron restart: unless-stopped volumes: - - /srv/stacks/nextcloud/nc_data:/var/www/html - - /mnt/pool/nextcloud:/var/www/html/data + - /opt/configs/nextcloud/app:/var/www/html + - /opt/data/nextcloud:/var/www/html/data entrypoint: /cron.sh depends_on: - nextcloud @@ -69,4 +69,4 @@ services: POSTGRES_USER: ${DB_USER} POSTGRES_PASSWORD: ${DB_PASSWORD} REDIS_HOST: redis -networks: {} \ No newline at end of file +networks: {} diff --git a/cloud-pc/resticprofile/profiles.toml b/cloud-pc/resticprofile/profiles.toml new file mode 100644 index 0000000..b07b565 --- /dev/null +++ b/cloud-pc/resticprofile/profiles.toml @@ -0,0 +1,55 @@ +version = "1" + +[global] + scheduler = "systemd" + +# ── Общие настройки ──────────────────────────────────────────────────────────── +[default] + password-file = "/etc/restic/password" + initialize = true + + [default.forget] + keep-daily = 7 + keep-weekly = 4 + keep-monthly = 6 + schedule-permission = "system" + schedule-after-backup = true + prune = true + + [default.check] + schedule = "Sun 04:00" + schedule-permission = "system" + +# ── Данные и конфиги сервисов ───────────────────────────────────────────────── +[services] + inherit = "default" + repository = "/mnt/backup/restic/services" + + [services.backup] + source = ["/opt/data", "/opt/configs"] + tag = ["cloud-pc", "services"] + exclude-caches = true + one-file-system = true + schedule = "02:00" + schedule-permission = "system" + schedule-log = "/var/log/resticprofile/services.log" + + [services.forget] + schedule = "02:30" + +# ── Samba-шара ──────────────────────────────────────────────────────────────── +[samba] + inherit = "default" + repository = "/mnt/backup/restic/samba" + + [samba.backup] + source = ["/opt/samba"] + tag = ["cloud-pc", "samba"] + exclude-caches = true + one-file-system = true + schedule = "03:00" + schedule-permission = "system" + schedule-log = "/var/log/resticprofile/samba.log" + + [samba.forget] + schedule = "03:30" \ No newline at end of file diff --git a/cloud-pc/samba/.env.example b/cloud-pc/samba/.env.example new file mode 100644 index 0000000..bc90d36 --- /dev/null +++ b/cloud-pc/samba/.env.example @@ -0,0 +1 @@ +SAMBA_PASSWORD=changeme diff --git a/cloud-pc/samba/docker-compose.yml b/cloud-pc/samba/docker-compose.yml new file mode 100644 index 0000000..b818173 --- /dev/null +++ b/cloud-pc/samba/docker-compose.yml @@ -0,0 +1,16 @@ +services: + samba: + image: ghcr.io/servercontainers/samba:latest + container_name: samba + restart: unless-stopped + network_mode: host + volumes: + - /opt/samba/media:/shares/media + - /opt/samba/documents:/shares/documents + - /opt/samba/backups_win:/shares/backups_win + environment: + ACCOUNT_ada: ${SAMBA_PASSWORD} + UID_ada: "1000" + SAMBA_VOLUME_CONFIG_media: "[media]; path = /shares/media; valid users = ada; read only = no" + SAMBA_VOLUME_CONFIG_documents: "[documents]; path = /shares/documents; valid users = ada; read only = no" + SAMBA_VOLUME_CONFIG_backups_win: "[backups_win]; path = /shares/backups_win; valid users = ada; read only = no" diff --git a/cloud-pc/syncthing/docker-compose.yml b/cloud-pc/syncthing/docker-compose.yml new file mode 100644 index 0000000..0804c7b --- /dev/null +++ b/cloud-pc/syncthing/docker-compose.yml @@ -0,0 +1,14 @@ +services: + syncthing: + image: syncthing/syncthing:latest + container_name: syncthing + hostname: cloud-pc + environment: + PUID: "1000" + PGID: "1000" + STGUIADDRESS: 0.0.0.0:8384 + volumes: + - /opt/configs/syncthing:/var/syncthing/config + - /opt/data/syncthing:/var/syncthing/data + network_mode: host + restart: unless-stopped diff --git a/cloud-pc/watchtower/docker-compose.yml b/cloud-pc/watchtower/docker-compose.yml new file mode 100644 index 0000000..a253272 --- /dev/null +++ b/cloud-pc/watchtower/docker-compose.yml @@ -0,0 +1,9 @@ +services: + watchtower: + image: containrrr/watchtower:latest + environment: + - DOCKER_API_VERSION=1.54 + volumes: + - /var/run/docker.sock:/var/run/docker.sock + command: --interval 300 --cleanup + restart: unless-stopped \ No newline at end of file diff --git a/cloud-pc/zerotier/docker-compose.yml b/cloud-pc/zerotier/docker-compose.yml new file mode 100644 index 0000000..39653c3 --- /dev/null +++ b/cloud-pc/zerotier/docker-compose.yml @@ -0,0 +1,15 @@ +services: + zerotier: + container_name: zerotier + restart: unless-stopped + network_mode: host + cap_add: + - NET_ADMIN + - SYS_ADMIN + devices: + - /dev/net/tun + volumes: + - /opt/data/zerotier:/var/lib/zerotier-one + image: zerotier/zerotier:latest + command: ["743993800fa5a34c"] +networks: {} diff --git a/mini-pc/.gitea/workflows/deploy.yml b/mini-pc/.gitea/workflows/deploy.yml new file mode 100644 index 0000000..e69de29 diff --git a/mini-pc/adguard/docker-compose.yml b/mini-pc/adguard/docker-compose.yml index f036fee..1aef04e 100644 --- a/mini-pc/adguard/docker-compose.yml +++ b/mini-pc/adguard/docker-compose.yml @@ -23,8 +23,8 @@ services: - PGID=1000 - TZ=Europe/Moscow volumes: - - /srv/stacks/adguard/work:/opt/adguardhome/work:rw - - /srv/stacks/adguard/conf:/opt/adguardhome/conf:rw + - /opt/data/adguard/work:/opt/adguardhome/work:rw + - /opt/configs/adguard:/opt/adguardhome/conf:rw - /etc/hosts:/etc/hosts:ro ports: - 53:53/tcp # DNS - **mandatory** @@ -43,4 +43,4 @@ services: cap_add: - NET_ADMIN - SYS_MODULE -networks: {} \ No newline at end of file +networks: {} diff --git a/mini-pc/caddy/.env.example b/mini-pc/caddy/.env.example new file mode 100644 index 0000000..e3b5f74 --- /dev/null +++ b/mini-pc/caddy/.env.example @@ -0,0 +1,2 @@ +TIMEWEB_API_URL=https://api.timeweb.cloud/api/v1 +TIMEWEB_API_TOKEN=changeme diff --git a/mini-pc/caddy/Caddyfile b/mini-pc/caddy/Caddyfile new file mode 100644 index 0000000..4646ddf --- /dev/null +++ b/mini-pc/caddy/Caddyfile @@ -0,0 +1,14 @@ +{ + acme_dns timeweb { + ApiURL {env.TIMEWEB_API_URL} + ApiToken {env.TIMEWEB_API_TOKEN} + } +} + +git.ada-dev.ru { + reverse_proxy 192.168.1.5:3002 +} + +cloud.ada-dev.ru { + reverse_proxy 192.168.1.5:8081 +} diff --git a/mini-pc/caddy/Dockerfile b/mini-pc/caddy/Dockerfile new file mode 100644 index 0000000..c52c2eb --- /dev/null +++ b/mini-pc/caddy/Dockerfile @@ -0,0 +1,8 @@ +FROM caddy:2-builder-alpine AS builder + +RUN xcaddy build \ + --with github.com/dmtr636/caddy-dns-timeweb@v1.0.3 + +FROM caddy:2-alpine + +COPY --from=builder /usr/bin/caddy /usr/bin/caddy diff --git a/mini-pc/caddy/docker-compose.yml b/mini-pc/caddy/docker-compose.yml new file mode 100644 index 0000000..864904b --- /dev/null +++ b/mini-pc/caddy/docker-compose.yml @@ -0,0 +1,16 @@ +services: + caddy: + build: . + container_name: caddy + env_file: + - .env + restart: unless-stopped + ports: + - "80:80" + - "443:443" + - "443:443/udp" + volumes: + - ./Caddyfile:/etc/caddy/Caddyfile:ro + - /opt/data/caddy:/data + - /opt/configs/caddy:/config +networks: {} diff --git a/mini-pc/gitea-runner/docker-compose.yml b/mini-pc/gitea-runner/docker-compose.yml new file mode 100644 index 0000000..b515fbf --- /dev/null +++ b/mini-pc/gitea-runner/docker-compose.yml @@ -0,0 +1,11 @@ +services: + gitea-runner: + image: gitea/act_runner:latest + restart: always + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - /opt/data/gitea-runner:/data + environment: + GITEA_INSTANCE_URL: https://git.ada-dev.ru + GITEA_RUNNER_REGISTRATION_TOKEN: ${TOKEN} + GITEA_RUNNER_NAME: mini-pc-runner diff --git a/mini-pc/npm_local/docker-compose.yml b/mini-pc/npm_local/docker-compose.yml deleted file mode 100644 index 8638e0f..0000000 --- a/mini-pc/npm_local/docker-compose.yml +++ /dev/null @@ -1,12 +0,0 @@ -services: - npm: - image: jc21/nginx-proxy-manager:latest - container_name: npm - restart: always - ports: - - "80:80" - - "443:443" - - "81:81" # UI - volumes: - - /srv/stacks/npm/data:/data - - /srv/stacks/npm/letsencrypt:/etc/letsencrypt \ No newline at end of file diff --git a/mini-pc/vaultwarden/docker-compose.yml b/mini-pc/vaultwarden/docker-compose.yml index a322673..961d652 100644 --- a/mini-pc/vaultwarden/docker-compose.yml +++ b/mini-pc/vaultwarden/docker-compose.yml @@ -10,8 +10,8 @@ services: restart: unless-stopped volumes: - type: bind - source: /srv/stacks/vaultwarden/data + source: /opt/data/vaultwarden target: /data networks: default: - name: vaultwarden_default \ No newline at end of file + name: vaultwarden_default diff --git a/mini-pc/zerotier/docker-compose.yml b/mini-pc/zerotier/docker-compose.yml new file mode 100644 index 0000000..39653c3 --- /dev/null +++ b/mini-pc/zerotier/docker-compose.yml @@ -0,0 +1,15 @@ +services: + zerotier: + container_name: zerotier + restart: unless-stopped + network_mode: host + cap_add: + - NET_ADMIN + - SYS_ADMIN + devices: + - /dev/net/tun + volumes: + - /opt/data/zerotier:/var/lib/zerotier-one + image: zerotier/zerotier:latest + command: ["743993800fa5a34c"] +networks: {} diff --git a/ru-vps/.gitea/workflows/deploy.yml b/ru-vps/.gitea/workflows/deploy.yml new file mode 100644 index 0000000..e69de29 diff --git a/ru-vps/caddy/Caddyfile b/ru-vps/caddy/Caddyfile new file mode 100644 index 0000000..c8ec254 --- /dev/null +++ b/ru-vps/caddy/Caddyfile @@ -0,0 +1,19 @@ +ada-dev.ru { + reverse_proxy 10.122.62.51:7080 +} + +cloud.ada-dev.ru { + reverse_proxy 10.122.62.51:8081 +} + +git.ada-dev.ru { + reverse_proxy 10.122.62.51:3002 +} + +pass.ada-dev.ru { + reverse_proxy 10.122.62.95:10380 +} + +# projects.ada-dev.ru { +# reverse_proxy 10.122.62.51:4567 +# } diff --git a/ru-vps/caddy/docker-compose.yml b/ru-vps/caddy/docker-compose.yml new file mode 100644 index 0000000..c6ada90 --- /dev/null +++ b/ru-vps/caddy/docker-compose.yml @@ -0,0 +1,14 @@ +services: + caddy: + image: caddy:2-alpine + container_name: caddy + restart: unless-stopped + ports: + - "80:80" + - "443:443" + - "443:443/udp" + volumes: + - ./Caddyfile:/etc/caddy/Caddyfile:ro + - /opt/data/caddy:/data + - /opt/configs/caddy:/config +networks: {} diff --git a/ru-vps/gitea-runner/docker-compose.yml b/ru-vps/gitea-runner/docker-compose.yml new file mode 100644 index 0000000..328cb2f --- /dev/null +++ b/ru-vps/gitea-runner/docker-compose.yml @@ -0,0 +1,11 @@ +services: + gitea-runner: + image: gitea/act_runner:latest + restart: always + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - /opt/data/gitea-runner:/data + environment: + GITEA_INSTANCE_URL: https://git.ada-dev.ru + GITEA_RUNNER_REGISTRATION_TOKEN: ${TOKEN} + GITEA_RUNNER_NAME: ru-vps-runner diff --git a/ru-vps/zerotier/docker-compose.yml b/ru-vps/zerotier/docker-compose.yml new file mode 100644 index 0000000..39653c3 --- /dev/null +++ b/ru-vps/zerotier/docker-compose.yml @@ -0,0 +1,15 @@ +services: + zerotier: + container_name: zerotier + restart: unless-stopped + network_mode: host + cap_add: + - NET_ADMIN + - SYS_ADMIN + devices: + - /dev/net/tun + volumes: + - /opt/data/zerotier:/var/lib/zerotier-one + image: zerotier/zerotier:latest + command: ["743993800fa5a34c"] +networks: {}