dogeystamp
864c1bdfd3
docker is now listening on localhost, with a haproxy on the services server to forward the ports outwards. this is because docker tends to disregard UFW's rules, but haproxy should be better in that regard. meanwhile, the firewall rules have been configured properly to only allow the bastion IP in over the wireguard connection, for proper authentication.
86 lines
1.9 KiB
YAML
86 lines
1.9 KiB
YAML
# Copy this to inventory.yml and modify accordingly
|
|
|
|
|
|
# fallback_host is only used during setup before the static IP (local_ip) is configured.
|
|
# Set fallback_host using `nmap 192.168.0.0/24 -p 22` to find the dynamic IP of your Pi
|
|
#
|
|
# local_ip is used after first setup.
|
|
#
|
|
# vpn_ip is used for the WireGuard network.
|
|
|
|
# Make entries in your .ssh/config for ease of use
|
|
# Example:
|
|
#
|
|
# Host your_fleet_host
|
|
# HostName 192.168.0.86
|
|
# Port 2500
|
|
# IdentityFile ~/.ssh/keys/your_fleet_host
|
|
|
|
|
|
all:
|
|
hosts:
|
|
your_bastion_host:
|
|
fallback_host: 192.168.0.123
|
|
local_ip: 192.168.0.3
|
|
vpn_ip: 10.66.77.1
|
|
ansible_port: 2500
|
|
ansible_connection: ssh
|
|
ansible_ssh_private_key_file: ~/.ssh/keys/your_bastion_host
|
|
timezone: America/Toronto
|
|
your_fleet_host:
|
|
fallback_host: 192.168.0.124
|
|
local_ip: 192.168.0.86
|
|
vpn_ip: 10.66.77.86
|
|
ansible_port: 2500
|
|
ansible_connection: ssh
|
|
ansible_ssh_private_key_file: ~/.ssh/keys/your_fleet_host
|
|
timezone: America/Toronto
|
|
children:
|
|
fleet:
|
|
children:
|
|
gitea:
|
|
hosts:
|
|
your_fleet_host:
|
|
syncthing:
|
|
hosts:
|
|
your_fleet_host:
|
|
synapse:
|
|
hosts:
|
|
your_fleet_host:
|
|
navidrome:
|
|
hosts:
|
|
your_fleet_host:
|
|
paperless:
|
|
hosts:
|
|
your_fleet_host:
|
|
bastion:
|
|
children:
|
|
ddclient:
|
|
hosts:
|
|
your_bastion_host:
|
|
nameserver:
|
|
hosts:
|
|
your_bastion_host:
|
|
caddy:
|
|
hosts:
|
|
your_bastion_host:
|
|
haproxy:
|
|
hosts:
|
|
your_bastion_host:
|
|
your_fleet_host:
|
|
wireguard:
|
|
hosts:
|
|
your_bastion_host:
|
|
your_fleet_host:
|
|
sshd:
|
|
hosts:
|
|
your_bastion_host:
|
|
your_fleet_host:
|
|
mailserver:
|
|
hosts:
|
|
your_bastion_host:
|
|
your_fleet_host:
|
|
website:
|
|
hosts:
|
|
your_bastion_host:
|