118 lines
3.7 KiB
YAML
118 lines
3.7 KiB
YAML
- name: Create directory and templated file
|
|
hosts: nuculabs
|
|
become: true
|
|
become_method: sudo
|
|
vars_files:
|
|
- variables.yaml
|
|
|
|
tasks:
|
|
# Create necessary directories.
|
|
- name: "Create directories"
|
|
block:
|
|
- name: Create PeerTube data directory
|
|
ansible.builtin.file:
|
|
path: "/{{ peertube.data_directory }}"
|
|
state: directory
|
|
mode: "0755"
|
|
ignore_errors: true
|
|
- name: Create PeerTube config directory
|
|
ansible.builtin.file:
|
|
path: "/{{ peertube.config_directory }}"
|
|
state: directory
|
|
mode: "0754"
|
|
ignore_errors: true
|
|
- name: Create PostgresSQL directory
|
|
ansible.builtin.file:
|
|
path: "/{{ postgres.postgres_directory }}"
|
|
state: directory
|
|
mode: "0754"
|
|
ignore_errors: true
|
|
# Ensure dependencies are installed
|
|
- name: "Install dependencies"
|
|
block:
|
|
- name: Ensure Podman is installed
|
|
ansible.builtin.package:
|
|
name: podman
|
|
state: present
|
|
- name: Ensure Udica is installed
|
|
ansible.builtin.package:
|
|
name: udica
|
|
state: present
|
|
- name: Ensure container-selinux is installed
|
|
ansible.builtin.package:
|
|
name: container-selinux
|
|
state: present
|
|
# Pull docker images
|
|
- name: "Pull container images"
|
|
block:
|
|
- name: Pull PeerTube image
|
|
containers.podman.podman_image:
|
|
name: "{{ peertube.image_name }}"
|
|
state: present
|
|
- name: Pull Postgres image
|
|
containers.podman.podman_image:
|
|
name: "{{ postgres.image_name }}"
|
|
state: present
|
|
- name: Pull Redis image
|
|
containers.podman.podman_image:
|
|
name: "{{ redis.image_name }}"
|
|
state: present
|
|
- name: Add firewall ports
|
|
block:
|
|
- name: Create firewalld service
|
|
ansible.builtin.copy:
|
|
src: ./templates/firewall/peertube.xml
|
|
dest: /etc/firewalld/services/peertube.xml
|
|
mode: "0644"
|
|
notify:
|
|
- reload firewalld
|
|
- name: Enable firewalld service
|
|
ansible.posix.firewalld:
|
|
service: peertube
|
|
state: enabled
|
|
permanent: true
|
|
immediate: true
|
|
offline: true
|
|
notify:
|
|
- reload firewalld
|
|
- name: "Load CIL policies"
|
|
block:
|
|
- name: Copy peertube cil
|
|
ansible.builtin.copy:
|
|
src: ./templates/cil/peertube.cil
|
|
dest: /tmp/peertube.cil
|
|
mode: "0644"
|
|
- name: Copy postgres cil
|
|
ansible.builtin.copy:
|
|
src: ./templates/cil/postgres.cil
|
|
dest: /tmp/postgres.cil
|
|
mode: "0644"
|
|
- name: Load PeertTube CIL policy
|
|
ansible.builtin.command:
|
|
argv:
|
|
- semodule
|
|
- -i
|
|
- /tmp/peertube.cil
|
|
- /usr/share/udica/templates/base_container.cil
|
|
- /usr/share/udica/templates/net_container.cil
|
|
- name: Load Postgres CIL policy
|
|
ansible.builtin.command:
|
|
argv:
|
|
- semodule
|
|
- -i
|
|
- /tmp/postgres.cil
|
|
- /usr/share/udica/templates/base_container.cil
|
|
- /usr/share/udica/templates/net_container.cil
|
|
- name: "Allow samba access from container"
|
|
ansible.builtin.command:
|
|
argv:
|
|
- semanage
|
|
- boolean
|
|
- -m
|
|
- virt_use_samba
|
|
- --on
|
|
handlers:
|
|
- name: reload firewalld
|
|
ansible.builtin.service:
|
|
name: firewalld
|
|
state: reloaded
|