docker_server
This roles deploys Docker and configures daemon, together with Traefik inverseproxy
Requirements
This role requires Ansible collection community.docker
Role Variables
Variables defined in defaults/main.yaml:
- default_maintenance_email : default maintenance e-mail used to validate Let's Encrypt certificate (defaults to maintenance@example.org)
- docker_userns_remap : whether remapping of user namespace is being used for Docker (security feature defaults to true)
- docker_internet_access : whether dockers should be granted access to Internet of if networks are internal only
- default_sshd_port: Port on which SSH daemon listens (defaults to 10022)
- host_user : user used to connect to the server
- srv_proxy_pass: Password to access proxy protected pages (AUTH defaults to SuperSecureProxyP4$$)
This role makes use of a few variables which are set in case the target server is part of other groups (but still initialized to false in defaults/main.yml), namely :
- docker_auth
- ldap_url
- sso_url
- docker_nextcloud or docker_owncloud
- cloud_url
- cloud_collabora and cloud_collabora_url
- cloud_onlyoffice and cloud_onlyoffice_url
- docker_odoo
- metabase
Note : all variables defined in defualts_main.yml might be useful in another role, in that case, it would be better to have them overwritten at play or host_vars level in order to make sure the same value is provided to each independant role
Variables from vars directory:
- OS specific (RedHat.yml / Debian.yml) :
- packages_to_remove : list of packages that we want to remove from default delivered servers
- packages_to_install : list of files / directories to remove from default delivered servers
- Global (main.yml):
- pip_packages: Python pip packages to be installed / upgraded
- timezone: for Traefik logs (defaults to "Europe/Paris")
- traefik_version: "v2.4"
This role also makes use of variables gathered from facts :
- ansible_os_family : Family of Operating System (Debian or RedHat)
- ansible_distribution: name of the distribution (Ubuntu, CentOS, etc.)
- ansible_distribution_release; name of the distribution version (Trusty, Xenial, etc.)
This role also configures backup servers where daily docker facts should be pushed :
- backup_sftp_user : user to be configured on backup server used to push facts
- These backup servers should be in group backup_server (if none then corresponding tasks are not pushing anywhere)
Eventually, this role configures 2 variables in host_vars (only if docker_userns_remap is true):
- dockremap_subuid : first subuid used for user namespace remap for Docker
- dockremap_subgid : first subgid used for user namespace remap for Docker
Dependencies
This role does not have dependencies per-se, while it can be dependant on variables defined in other groups (backup_servers, docker_auth, docker_nextcloud, docker_odoo, docker_owncloud)
Example Playbook
- hosts: docker
gather_facts: true
become: true
roles:
- { role: docker_server, tags: docker }
vars:
- { default_maintenance_email: "maintenance@example.org" }
- { default_sshd_port: 10022 }
- { docker_userns_remap: true }
- { docker_internet_access: false }
- { host_user: "testuser" }
- { srv_proxy_pass: "SuperSecureProxyP4$$" }
- { cloud_collabora: true }
- { cloud_collabora_url: "collabora.example.org" }
- { cloud_url: "cloud.example.org" }
- { metabase: false }
- { ldap_url: "ldap.example.org" }
- { sso_url: "sso.example.org" }
License
AGPL-3
Author Information
Le Filament (https://le-filament.com)