ansible-playbook.yaml

---
- name: basic system setup
  hosts: all
  roles:
    # todo: create user, add to sudoers, disable SSH root login
    # https://github.com/stadtnavi/digitransit-ansible/blob/d0dbc92af8d795510b1e1d02dd9f4c96c573d5f4/roles/base/tasks/main.yml#L77-L93

    - role: geerlingguy.security
      vars:
        security_ssh_permit_root_login: "yes"
        security_fail2ban_enabled: true
  tasks:

    - name: configure journald to persist logs
      lineinfile:
        path: /etc/systemd/journald.conf
        regex: ^(# *)?Storage\b
        line: Storage=persistent
    - name: configure journald to compress logs
      lineinfile:
        path: /etc/systemd/journald.conf
        regex: ^(# *)?Compress\b
        line: Compress=yes
    - name: configure journald to store at most 100gb of logs
      lineinfile:
        path: /etc/systemd/journald.conf
        regex: ^(# *)?SystemMaxUse\b
        line: SystemMaxUse=100G
    - name: configure journald to keep 4gb free
      lineinfile:
        path: /etc/systemd/journald.conf
        regex: ^(# *)?SystemKeepFree\b
        line: SystemKeepFree=4G
    - name: configure journald to keep 2gb free
      lineinfile:
        path: /etc/systemd/journald.conf
        regex: ^(# *)?RuntimeKeepFree\b
        line: RuntimeKeepFree=2G
    - name: put logrotate config
      ansible.builtin.copy:
        src: lib/recorded-hafas-data
        dest: /etc/logrotate.d/recorded-hafas-data
    - name: run logrotate hourly instead of daily
      lineinfile:
        path: /etc/systemd/system/timers.target.wants/logrotate.timer
        regex: ^OnCalendar=daily
        line: OnCalendar=hourly
    - name: enable & start journald
      ansible.builtin.shell: |
        systemctl daemon-reload
        systemctl restart systemd-journald

    - name: install basic administration tools (sudo, Mosh, etc.)
      package:
        name:
          - sudo
          - mosh
          - tree
          - jq
          - htop
          - miller
          - moreutils
          - unzip

    # configure firewall
    - name: put fail2ban config
      ansible.builtin.copy:
        src: lib/jail.local
        dest: /etc/fail2ban/
    - name: reload & restart fail2ban
      ansible.builtin.shell: |
        fail2ban-client reload
        fail2ban-client restart
        fail2ban-client status
    - name: let UFW deny everything
      community.general.ufw:
        policy: deny
    - name: let UFW allow rate-limited SSH
      community.general.ufw:
        rule: limit
        name: OpenSSH
    - name: let UFW allow Mosh
      community.general.ufw:
        rule: allow
        name: mosh
    - name: let UFW allow HTTP
      community.general.ufw:
        rule: allow
        port: '80'
        proto: tcp
    - name: let UFW allow HTTPS
      community.general.ufw:
        rule: allow
        port: '443'
        proto: tcp
    - name: let UFW allow 443/udp (HTTP/3)
      community.general.ufw:
        rule: allow
        port: '443'
        proto: udp
    - name: enable UFW
      community.general.ufw:
        state: enabled

- name: install Node.js
  hosts: all
  roles:
    # install Node.js from NodeSource's repo
    - role: geerlingguy.nodejs
      vars:
        nodejs_version: '22.x'
        nodejs_npm_global_packages:
          - nats-streaming-cli

- name: install Caddy
  hosts:
    - hafas-rest-api
    - hafas-gtfs-rt-server
  roles:
    - role: caddy_ansible.caddy_ansible
      vars:
        caddy_packages:
          - 'github.com/mholt/caddy-ratelimit'
        caddy_systemd_capabilities_enabled: true
        # > By default the Caddyfile is templated on each run. By setting this variable you can ensure the file is created on the first run but never updated after.
        caddy_config_update: false
  tasks:
    # todo: instead, just put StandardOutput=null in caddy's [Service] section to disable logging completely?
    - name: put rsyslogd override config muting `local7`
      ansible.builtin.copy:
        src: lib/syslog-mute-local7-facility.conf
        dest: /etc/rsyslog.d/22-mute-local7-facility.conf
    - name: reload rsyslogd
      ansible.builtin.shell: |
        systemctl restart rsyslog
    - name: create caddy.service.d
      ansible.builtin.file:
        path: /etc/systemd/system/caddy.service.d/
        state: directory
    - name: put caddy.service override config
      ansible.builtin.copy:
        src: lib/caddy-syslog-facility.conf
        dest: /etc/systemd/system/caddy.service.d/syslog-facility.conf
    - name: restart Caddy systemd service
      ansible.builtin.shell: |
        systemctl daemon-reload
        systemctl restart caddy

    - name: put entrypoint Caddyfile
      ansible.builtin.template:
        src: Caddyfile
        dest: /etc/caddy/Caddyfile
        owner: 'www-data'
    - name: reload Caddy config
      ansible.builtin.shell: |
        systemctl reload caddy

- name: install Redis
  hosts:
    - hafas-rest-api
    - hafas-gtfs-rt-server
  tasks:
    - name: install Redis
      package:
        name:
          - redis
    - name: configure Redis to use at most 300mb memory
      lineinfile:
        path: /etc/redis/redis.conf
        regex: ^(# *)?maxmemory\b
        line: maxmemory 300mb
    - name: configure Redis to remove LFU keys
      lineinfile:
        path: /etc/redis/redis.conf
        regex: ^(# *)?maxmemory-policy\b
        line: maxmemory-policy allkeys-lfu

- name: install PostgreSQL
  hosts:
    - hafas-gtfs-rt-server
  roles:
    - role: geerlingguy.postgresql
      become: yes
  tasks:
    - name: set password of "postgres" user
      ansible.builtin.shell: |
        sudo -u postgres psql -c "ALTER USER postgres PASSWORD 'password'"
    - name: install PostGIS
      package:
        name:
          - postgis

- name: deploy a.v5.bvg.transport.rest
  hosts:
    - bvg-rest-5
  tasks:
    - name: clone derhuerst/bvg-rest:5
      ansible.builtin.git:
        repo: 'https://github.com/derhuerst/bvg-rest.git'
        dest: /srv/a.v5.bvg.transport.rest
        version: '5'
    - name: npm install
      community.general.npm:
        path: /srv/a.v5.bvg.transport.rest
    - name: npm run build
      shell: npm run build
      args:
        chdir: /srv/a.v5.bvg.transport.rest
    - name: create systemd service
      ansible.builtin.copy:
        src: lib/a.v5.bvg.transport.rest.service
        dest: /etc/systemd/system/
    - name: put Caddyfile
      ansible.builtin.copy:
        src: lib/a.v5.bvg.transport.rest.Caddyfile
        dest: /etc/caddy/
        owner: 'www-data'
    - name: enable & start systemd service
      ansible.builtin.shell: |
        systemctl daemon-reload
        systemctl enable a.v5.bvg.transport.rest
        systemctl start a.v5.bvg.transport.rest
    - name: reload Caddy config
      ansible.builtin.shell: |
        systemctl reload caddy

- name: deploy a.v5.db.transport.rest
  hosts:
    - db-rest-5
  tasks:
    - name: clone derhuerst/db-rest:5
      ansible.builtin.git:
        repo: 'https://github.com/derhuerst/db-rest.git'
        dest: /srv/a.v5.db.transport.rest
        version: '5'
    - name: npm install
      community.general.npm:
        path: /srv/a.v5.db.transport.rest
    - name: npm run build
      shell: npm run build
      args:
        chdir: /srv/a.v5.db.transport.rest
    - name: create systemd service
      ansible.builtin.copy:
        src: lib/a.v5.db.transport.rest.service
        dest: /etc/systemd/system/
    - name: put Caddyfile
      ansible.builtin.copy:
        src: lib/a.v5.db.transport.rest.Caddyfile
        dest: /etc/caddy/
        owner: 'www-data'
    - name: enable & start systemd service
      ansible.builtin.shell: |
        systemctl daemon-reload
        systemctl enable a.v5.db.transport.rest
        systemctl start a.v5.db.transport.rest
    - name: reload Caddy config
      ansible.builtin.shell: |
        systemctl reload caddy

- name: deploy a.v5.vbb.transport.rest
  hosts:
    - vbb-rest-5
  tasks:
    - name: clone derhuerst/vbb-rest:5
      ansible.builtin.git:
        repo: 'https://github.com/derhuerst/vbb-rest.git'
        dest: /srv/a.v5.vbb.transport.rest
        version: '5'
    - name: npm install
      community.general.npm:
        path: /srv/a.v5.vbb.transport.rest
    - name: npm run build
      shell: npm run build
      args:
        chdir: /srv/a.v5.vbb.transport.rest
    - name: create systemd service
      ansible.builtin.copy:
        src: lib/a.v5.vbb.transport.rest.service
        dest: /etc/systemd/system/
    - name: put Caddyfile
      ansible.builtin.copy:
        src: lib/a.v5.vbb.transport.rest.Caddyfile
        dest: /etc/caddy/
        owner: 'www-data'
    - name: enable & start systemd service
      ansible.builtin.shell: |
        systemctl daemon-reload
        systemctl enable a.v5.vbb.transport.rest
        systemctl start a.v5.vbb.transport.rest
    - name: reload Caddy config
      ansible.builtin.shell: |
        systemctl reload caddy

- name: deploy a.v6.bvg.transport.rest
  hosts:
    - bvg-rest-6
  tasks:
    - name: clone derhuerst/bvg-rest:6
      ansible.builtin.git:
        repo: 'https://github.com/derhuerst/bvg-rest.git'
        dest: /srv/a.v6.bvg.transport.rest
        version: '6'
    - name: npm install
      community.general.npm:
        path: /srv/a.v6.bvg.transport.rest
    - name: npm run build
      shell: npm run build
      args:
        chdir: /srv/a.v6.bvg.transport.rest
      environment:
        HOSTNAME: a.v6.bvg.transport.rest
    - name: create systemd service
      ansible.builtin.copy:
        src: lib/a.v6.bvg.transport.rest.service
        dest: /etc/systemd/system/
    - name: put Caddyfile
      ansible.builtin.copy:
        src: lib/a.v6.bvg.transport.rest.Caddyfile
        dest: /etc/caddy/
        owner: 'www-data'
    - name: enable & start systemd service
      ansible.builtin.shell: |
        systemctl daemon-reload
        systemctl enable a.v6.bvg.transport.rest
        systemctl start a.v6.bvg.transport.rest
    - name: reload Caddy config
      ansible.builtin.shell: |
        systemctl reload caddy

- name: deploy a.v6.db.transport.rest
  hosts:
    - db-rest-6
  tasks:
    - name: clone derhuerst/db-rest:6
      ansible.builtin.git:
        repo: 'https://github.com/derhuerst/db-rest.git'
        dest: /srv/a.v6.db.transport.rest
        version: '6'
    - name: npm install
      community.general.npm:
        path: /srv/a.v6.db.transport.rest
    - name: npm run build
      shell: npm run build
      args:
        chdir: /srv/a.v6.db.transport.rest
      environment:
        HOSTNAME: a.v6.db.transport.rest
    - name: create systemd service
      ansible.builtin.copy:
        src: lib/a.v6.db.transport.rest.service
        dest: /etc/systemd/system/
    - name: put Caddyfile
      ansible.builtin.copy:
        src: lib/a.v6.db.transport.rest.Caddyfile
        dest: /etc/caddy/
        owner: 'www-data'
    - name: enable & start systemd service
      ansible.builtin.shell: |
        systemctl daemon-reload
        systemctl enable a.v6.db.transport.rest
        systemctl start a.v6.db.transport.rest
    - name: reload Caddy config
      ansible.builtin.shell: |
        systemctl reload caddy

- name: deploy a.v6.vbb.transport.rest
  hosts:
    - vbb-rest-6
  tasks:
    - name: clone derhuerst/vbb-rest:6
      ansible.builtin.git:
        repo: 'https://github.com/derhuerst/vbb-rest.git'
        dest: /srv/a.v6.vbb.transport.rest
        version: '6'
    - name: npm install
      community.general.npm:
        path: /srv/a.v6.vbb.transport.rest
    - name: npm run build
      shell: npm run build
      args:
        chdir: /srv/a.v6.vbb.transport.rest
      environment:
        HOSTNAME: a.v6.vbb.transport.rest
    - name: create systemd service
      ansible.builtin.copy:
        src: lib/a.v6.vbb.transport.rest.service
        dest: /etc/systemd/system/
    - name: put Caddyfile
      ansible.builtin.copy:
        src: lib/a.v6.vbb.transport.rest.Caddyfile
        dest: /etc/caddy/
        owner: 'www-data'
    - name: enable & start systemd service
      ansible.builtin.shell: |
        systemctl daemon-reload
        systemctl enable a.v6.vbb.transport.rest
        systemctl start a.v6.vbb.transport.rest
    - name: reload Caddy config
      ansible.builtin.shell: |
        systemctl reload caddy

- name: deploy v1.nottingham-city.transport.rest
  hosts:
    - thuya
  tasks:
    - name: put Caddyfile
      ansible.builtin.copy:
        src: lib/v1.nottingham-city.transport.rest.Caddyfile
        dest: /etc/caddy/
        owner: 'www-data'
    - name: reload Caddy config
      ansible.builtin.shell: |
        systemctl reload caddy