README.md

@@ -17,6 +17,7 @@ This project was largely inspired by his own [infra](https://github.com/notthebe
 * Nginx webserver
 * MediaWiki farm
 * Navidrome music server
+* SFTP (not really a service, included in sshd)
 * Syncthing
 * Firewall (UFW)
 

group_vars/all/vars.yml

@@ -20,9 +20,12 @@ admin_username: maestro
 # Username for unpriviledged user
 username: dogeystamp
 
+# Create an SFTP read-only user (leave blank to disable)
+sftp_ro_username: dogeystamp-mobile
+
 # Git repos (could be localhost if Gitea is installed)
 dots_repo: http://localhost:3000/dogeystamp/dots.git
-site_repo: http://localhost:3000/dogeystamp/wb5.git
+site_repo: http://localhost:3000/dogeystamp/wb4.git
 
 # Drive with all the data stored on it (should be separate from OS drive)
 # This is the raw partition, and not the mapped crypt device
@@ -32,8 +35,8 @@ secondary_disk: /dev/sda1
 # This is the raw partition, and not the mapped crypt device
 backup_disk: /dev/sda2
 
-# Username for website deployment
+# Title used for the static website generator
-web_username: ianitor
+web_name: dogeystamp
 
 # Web root for nginx and other applications
 webroot: /srv/http
@@ -50,8 +53,6 @@ util_pack:
   - tmux
   - git
   - cronie
-  # for chronic
-  - moreutils
   - progress
   - rsync
   - man-db
@@ -269,6 +270,9 @@ enable_navidrome: yes
 # Personal website
 enable_website: yes
 
+# SFTP read-only user
+enable_sftpr: no
+
 # Syncthing
 enable_syncthing: yes
 

roles/services/sftp/tasks/main.yml

@@ -0,0 +1,15 @@
+- name: Create sftp read group
+  group:
+    name: sftpr
+
+- name: Create sftp read-only user
+  user:
+    name: "{{ sftp_ro_username }}"
+    groups:
+      - sftpr
+
+- name: Deploy SSH key to sftp user
+  ansible.posix.authorized_key:
+    user: "{{ sftp_ro_username }}"
+    state: present
+    key: "{{ lookup('file', '~/.ssh/keys/{{ ansible_hostname }}_sftp.pub')}}"

roles/services/website/tasks/main.yml

@@ -6,61 +6,48 @@
   set_fact:
     fullroot: "{{ webroot }}/{{ path }}"
 
-- name: Create website deployment user
-  user:
-    name: "{{ web_username }}"
-
 - name: Install required packages
   community.general.pacman:
     name: 
-      - git
+      - cpio
-      - make
       - lowdown
-      - rsync
     state: present
 
+- name: Create site source folder
+  file:
+    owner: http
+    group: http
+    path: "/srv/web_source"
+    state: directory
+    recurse: yes
+  register: site_perm
+
 - name: Fetch site source
   git:
-    dest: "/home/{{ web_username }}/website"
+    dest: "/srv/web_source"
     repo: "{{ site_repo }}"
   register: site_source
-  become_user: "{{ web_username }}"
+  become_user: http
 
 - name: Make site directory in web root
   file:
     group: http
-    owner: "{{ web_username }}"
+    owner: http
     path: "{{ fullroot }}"
     state: directory
   register: site_folder
 
 - name: Deploy source to web root
-  make:
+  shell:
-    chdir: "/home/{{ web_username }}/website"
+    cmd: "./ssg6 src {{ fullroot }} '{{ web_name }}' 'https://{{ path }}'"
-    target: deploy
+    chdir: /srv/web_source
-    params:
+  when: site_source.changed or site_folder.changed or site_perm.changed
-      OUTPUT: "{{ fullroot }}"
+  become_user: http
-  when: site_source.changed or site_folder.changed
-  become_user: "{{ web_username }}"
-
-- name: Send deployment script
-  template:
-    src: deploy.sh.j2
-    dest: "/home/{{ web_username }}/deploy.sh"
-    mode: 0700
-    owner: "{{ web_username }}"
-
-- name: Tell cron to mail to root
-  cron:
-    user: "{{ web_username }}"
-    name: MAILTO
-    env: yes
-    job: root
 
 - name: Cronjob to deploy source
   cron:
-    user: "{{ web_username }}"
+    user: http
     name: "Update and deploy website source"
     minute: 0
-    hour: "*/1"
+    hour: "*/4"
-    job: "chronic /home/{{ web_username }}/deploy.sh"
+    job: "git -C /srv/web_source/ pull && /srv/web_source/ssg6 /srv/web_source/src {{ fullroot }} '{{ web_name }}' 'https://{{ path }}'"

roles/services/website/templates/deploy.sh.j2

@@ -1,7 +0,0 @@
-#!/bin/sh
-# website deployment script
-
-set -e
-
-git -C /home/{{ web_username }}/website pull
-OUTPUT={{ fullroot }} make -C /home/{{ web_username }}/website deploy

run.yml

@@ -55,6 +55,11 @@
         - nameserver
       when: enable_nameserver
 
+    - role: services/sftp
+      tags:
+        - sftp
+      when: enable_sftpr
+
     - role: services/mail
       tags:
         - mail