mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-09-16 18:02:55 +02:00
Ruben Hensen
120 lines
3.0 KiB
YAML
120 lines
3.0 KiB
YAML
---
|
|
- name: Install Nginx
|
|
ansible.builtin.apt:
|
|
name: nginx
|
|
state: present
|
|
|
|
- name: Install nginx stream modules
|
|
ansible.builtin.apt:
|
|
name: libnginx-mod-stream
|
|
state: present
|
|
|
|
- name: Create stream.d directory
|
|
ansible.builtin.file:
|
|
path: /etc/nginx/stream.d
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Deploy nginx.conf
|
|
ansible.builtin.template:
|
|
src: nginx.conf.j2
|
|
dest: /etc/nginx/nginx.conf
|
|
mode: "0644"
|
|
notify: reload nginx
|
|
|
|
- name: Remove default site
|
|
ansible.builtin.file:
|
|
path: /etc/nginx/sites-enabled/default
|
|
state: absent
|
|
notify: reload nginx
|
|
|
|
- name: Deploy mail site config
|
|
ansible.builtin.template:
|
|
src: mail.conf.j2
|
|
dest: /etc/nginx/sites-available/mail.conf
|
|
mode: "0644"
|
|
notify: reload nginx
|
|
|
|
- name: Enable mail site
|
|
ansible.builtin.file:
|
|
src: /etc/nginx/sites-available/mail.conf
|
|
dest: /etc/nginx/sites-enabled/mail.conf
|
|
state: link
|
|
notify: reload nginx
|
|
|
|
- name: Deploy K8s upstream config (initial only)
|
|
ansible.builtin.template:
|
|
src: k8s-upstream.conf.j2
|
|
dest: "{{ nginx_k8s_upstream_conf }}"
|
|
mode: "0644"
|
|
force: false
|
|
notify: reload nginx
|
|
|
|
- name: Deploy K8s backend IP config (initial only)
|
|
ansible.builtin.template:
|
|
src: k8s-backend-ip.conf.j2
|
|
dest: /etc/nginx/k8s-backend-ip.conf
|
|
mode: "0644"
|
|
force: false
|
|
notify: reload nginx
|
|
|
|
- name: Deploy K8s HTTP proxy config
|
|
ansible.builtin.template:
|
|
src: k8s-proxy.conf.j2
|
|
dest: /etc/nginx/sites-available/k8s-proxy.conf
|
|
mode: "0644"
|
|
notify: reload nginx
|
|
|
|
- name: Enable K8s proxy site
|
|
ansible.builtin.file:
|
|
src: /etc/nginx/sites-available/k8s-proxy.conf
|
|
dest: /etc/nginx/sites-enabled/k8s-proxy.conf
|
|
state: link
|
|
notify: reload nginx
|
|
|
|
- name: Deploy K8s IP update script
|
|
ansible.builtin.copy:
|
|
dest: /usr/local/bin/update-k8s-ip
|
|
content: |
|
|
#!/bin/bash
|
|
NEW_IP="$SSH_ORIGINAL_COMMAND"
|
|
|
|
if ! echo "$NEW_IP" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
|
|
echo "Invalid IP: $NEW_IP"
|
|
exit 1
|
|
fi
|
|
|
|
CONF="{{ nginx_k8s_upstream_conf }}"
|
|
CURRENT_IP=$(grep -oP 'server \K[0-9.]+' "$CONF" 2>/dev/null)
|
|
|
|
if [ "$CURRENT_IP" = "$NEW_IP" ]; then
|
|
echo "IP unchanged: $NEW_IP"
|
|
exit 0
|
|
fi
|
|
|
|
printf 'upstream k8s_tls {\n server %s:443;\n}\n' "$NEW_IP" > "$CONF"
|
|
printf 'set $k8s_ip %s;\n' "$NEW_IP" > /etc/nginx/k8s-backend-ip.conf
|
|
|
|
nginx -t && systemctl reload nginx
|
|
echo "Updated K8s backend IP to $NEW_IP"
|
|
mode: "0755"
|
|
|
|
- name: Ensure .ssh directory exists for root
|
|
ansible.builtin.file:
|
|
path: /root/.ssh
|
|
state: directory
|
|
mode: "0700"
|
|
|
|
- name: Deploy SSH authorized key for K8s IP updater
|
|
ansible.builtin.authorized_key:
|
|
user: root
|
|
key: "{{ nginx_k8s_updater_ssh_pubkey }}"
|
|
key_options: 'command="/usr/local/bin/update-k8s-ip",no-port-forwarding,no-X11-forwarding,no-agent-forwarding'
|
|
when: nginx_k8s_updater_ssh_pubkey is defined
|
|
|
|
- name: Enable and start Nginx
|
|
ansible.builtin.systemd:
|
|
name: nginx
|
|
enabled: true
|
|
state: started
|