Switch to terraform
This commit is contained in:
Prox
242
ansible/netbird/playbook-ssl.yml
Normal file
242
ansible/netbird/playbook-ssl.yml
Normal file
@@ -0,0 +1,242 @@
|
||||
---
|
||||
# =============================================================================
|
||||
# NetBird v1.6 Deployment - SSL Mode (Let's Encrypt)
|
||||
# =============================================================================
|
||||
# Lightweight deployment without Authentik SSO.
|
||||
# Uses NetBird native user management.
|
||||
#
|
||||
# Prerequisites:
|
||||
# 1. Domain with DNS A record pointing to VPS IP
|
||||
# 2. Port 80 open for ACME challenge
|
||||
# 3. Update inventory.yml with your VPS IP/domain
|
||||
# 4. Update group_vars/netbird_servers.yml with your domain
|
||||
# 5. Create group_vars/vault.yml from vault.yml.example
|
||||
#
|
||||
# Run:
|
||||
# ansible-playbook -i inventory.yml playbook-ssl.yml --ask-vault-pass
|
||||
# =============================================================================
|
||||
|
||||
- name: Deploy NetBird v1.6 (SSL Mode)
|
||||
hosts: netbird_servers
|
||||
become: true
|
||||
vars_files:
|
||||
- group_vars/netbird_servers.yml
|
||||
- group_vars/vault.yml
|
||||
vars:
|
||||
# SSL-specific settings
|
||||
netbird_protocol: "https"
|
||||
relay_protocol: "rels"
|
||||
relay_port: 443
|
||||
signal_port: 443
|
||||
|
||||
tasks:
|
||||
# =========================================================================
|
||||
# Prerequisites
|
||||
# =========================================================================
|
||||
- name: Update apt cache
|
||||
ansible.builtin.apt:
|
||||
update_cache: true
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Install prerequisites
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- jq
|
||||
state: present
|
||||
|
||||
# =========================================================================
|
||||
# Docker Installation
|
||||
# =========================================================================
|
||||
- name: Check if Docker is installed
|
||||
ansible.builtin.command: docker --version
|
||||
register: docker_installed
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
- name: Create keyrings directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/apt/keyrings
|
||||
state: directory
|
||||
mode: "0755"
|
||||
when: docker_installed.rc != 0
|
||||
|
||||
- name: Add Docker GPG key
|
||||
ansible.builtin.shell: |
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
|
||||
chmod a+r /etc/apt/keyrings/docker.gpg
|
||||
args:
|
||||
creates: /etc/apt/keyrings/docker.gpg
|
||||
when: docker_installed.rc != 0
|
||||
|
||||
- name: Add Docker repository
|
||||
ansible.builtin.apt_repository:
|
||||
repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
|
||||
state: present
|
||||
filename: docker
|
||||
when: docker_installed.rc != 0
|
||||
|
||||
- name: Install Docker packages
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
- docker-buildx-plugin
|
||||
- docker-compose-plugin
|
||||
state: present
|
||||
update_cache: true
|
||||
when: docker_installed.rc != 0
|
||||
|
||||
- name: Start and enable Docker
|
||||
ansible.builtin.systemd:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
# =========================================================================
|
||||
# NetBird Directory Structure
|
||||
# =========================================================================
|
||||
- name: Create NetBird directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ netbird_base_dir }}"
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
# =========================================================================
|
||||
# Deploy Configuration Files
|
||||
# =========================================================================
|
||||
- name: Deploy docker-compose.yml
|
||||
ansible.builtin.template:
|
||||
src: templates/docker-compose.yml.j2
|
||||
dest: "{{ netbird_base_dir }}/docker-compose.yml"
|
||||
mode: "0644"
|
||||
|
||||
# Caddyfile is NOT deployed here - shared Caddy handles reverse proxy
|
||||
# See ../caddy/playbook.yml
|
||||
|
||||
- name: Deploy management.json
|
||||
ansible.builtin.template:
|
||||
src: templates/management.json.j2
|
||||
dest: "{{ netbird_base_dir }}/management.json"
|
||||
mode: "0644"
|
||||
|
||||
- name: Deploy dashboard.env
|
||||
ansible.builtin.template:
|
||||
src: templates/dashboard.env.j2
|
||||
dest: "{{ netbird_base_dir }}/dashboard.env"
|
||||
mode: "0640"
|
||||
|
||||
- name: Deploy relay.env
|
||||
ansible.builtin.template:
|
||||
src: templates/relay.env.j2
|
||||
dest: "{{ netbird_base_dir }}/relay.env"
|
||||
mode: "0640"
|
||||
|
||||
- name: Deploy turnserver.conf
|
||||
ansible.builtin.template:
|
||||
src: templates/turnserver.conf.j2
|
||||
dest: "{{ netbird_base_dir }}/turnserver.conf"
|
||||
mode: "0644"
|
||||
|
||||
# =========================================================================
|
||||
# Firewall (UFW)
|
||||
# =========================================================================
|
||||
- name: Install UFW
|
||||
ansible.builtin.apt:
|
||||
name: ufw
|
||||
state: present
|
||||
|
||||
- name: Allow SSH
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "22"
|
||||
proto: tcp
|
||||
|
||||
- name: Allow HTTP (ACME challenge)
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "80"
|
||||
proto: tcp
|
||||
|
||||
- name: Allow HTTPS
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "443"
|
||||
proto: tcp
|
||||
|
||||
- name: Allow TURN UDP
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "3478"
|
||||
proto: udp
|
||||
|
||||
- name: Allow TURN TCP
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "3478"
|
||||
proto: tcp
|
||||
|
||||
- name: Enable UFW
|
||||
community.general.ufw:
|
||||
state: enabled
|
||||
policy: deny
|
||||
|
||||
# =========================================================================
|
||||
# Start Services
|
||||
# =========================================================================
|
||||
- name: Pull Docker images
|
||||
ansible.builtin.command:
|
||||
cmd: docker compose pull
|
||||
chdir: "{{ netbird_base_dir }}"
|
||||
changed_when: true
|
||||
|
||||
- name: Start NetBird services
|
||||
ansible.builtin.command:
|
||||
cmd: docker compose up -d
|
||||
chdir: "{{ netbird_base_dir }}"
|
||||
changed_when: true
|
||||
|
||||
# =========================================================================
|
||||
# Wait for Services
|
||||
# =========================================================================
|
||||
- name: Wait for management container to be running
|
||||
ansible.builtin.command:
|
||||
cmd: docker compose ps management --format json
|
||||
chdir: "{{ netbird_base_dir }}"
|
||||
register: management_container
|
||||
until: "'running' in management_container.stdout"
|
||||
retries: 12
|
||||
delay: 5
|
||||
changed_when: false
|
||||
|
||||
# =========================================================================
|
||||
# Display Summary
|
||||
# =========================================================================
|
||||
- name: Display deployment status
|
||||
ansible.builtin.debug:
|
||||
msg: |
|
||||
============================================
|
||||
NetBird v1.6 Containers Deployed!
|
||||
============================================
|
||||
|
||||
Containers: dashboard, signal, relay, management, coturn
|
||||
|
||||
============================================
|
||||
NEXT STEPS:
|
||||
============================================
|
||||
|
||||
1. Deploy shared Caddy:
|
||||
cd ../caddy && ansible-playbook -i poc-inventory.yml playbook.yml
|
||||
|
||||
2. Then access https://{{ netbird_domain }}
|
||||
|
||||
============================================
|
||||
|
||||
View logs:
|
||||
ssh root@{{ ansible_host }} "cd {{ netbird_base_dir }} && docker compose logs -f"
|
||||
============================================
|
||||
Reference in New Issue
Block a user