feat: servidor de testing

Reviewed-on: #79
Reviewed-by: fauno <fauno@sutty.coop.ar>
Testeado por Pirra

abyayala.yml

@@ -14,7 +14,6 @@ matrix:
     roles:
       - rap
     nodos:
-      - llavero
       - marmite
       - nodochasqui
       - yanapak
@@ -59,6 +58,7 @@ matrix:
       - carabobolibre
       - samatuun
       - kaasavi
+      - llavero
 
   - service_name: respaldos
     domains:
@@ -226,3 +226,9 @@ matrix:
       - kaasavi.abyaya.la
     nodo: kaasavi.comun
     force_https: yes
+
+  - service_name: llavero
+    domains:
+      - llavero.abyaya.la
+    nodo: llavero.comun
+    force_https: yes

group_vars/testing/vars

@@ -0,0 +1,2 @@
+host_ip: 157.180.114.62
+main_zone: abyayala.red

hosts.production

@@ -1,5 +1,5 @@
 [localhost]
-127.0.0.1
+127.0.0.1 ansible_connection=local
 
 [hetzner]
 5.161.236.18
@@ -11,3 +11,9 @@ ansible_ssh_user=root
 sutty.nl
 
 [sutty:vars]
+
+[testing]
+157.180.114.62
+
+[testing:vars]
+ansible_ssh_user=root

roles/althost/tasks/compose.yml

@@ -1,13 +1,13 @@
     - name: check if service volumes exists
-      local_action:
-        module: stat
+      stat:
         path: "{{ playbook_dir }}/roles/{{ item.roles[0] | default('proxy') }}/templates/volumes.yml"
+      delegate_to: localhost
       register: volumes_def
 
     - name: check if service networks exists
-      local_action:
-        module: stat
+      stat:
         path: "{{ playbook_dir }}/roles/{{ item.roles[0] | default('proxy') }}/templates/networks.yml"
+      delegate_to: localhost
       register: networks_def
 
     - set_fact:
@@ -22,53 +22,53 @@
       when: networks_def.stat.exists
 
     - name: define services in local composition
-      local_action:
-        module: blockinfile
+      blockinfile:
         path: "{{ local_compose_path }}/docker-compose.yml"
         insertafter: "services:"
         marker: "# {mark} {{ service_name|upper }}"
         block: "{{ services_content }}"
+      delegate_to: localhost
       changed_when: false
 
     - name: define volumes in local composition
-      local_action:
-        module: lineinfile
+      lineinfile:
         path: "{{ local_compose_path }}/docker-compose.yml"
         insertafter: "# volumenes compartidos"
         line: "volumes: #"
         state: present
         regexp: "volumes: #"
+      delegate_to: localhost
       when: volumes_def.stat.exists
       changed_when: false
 
     - name: define volumes content in local composition
-      local_action:
-        module: lineinfile
+      lineinfile:
         path: "{{ local_compose_path }}/docker-compose.yml"
         insertafter: "volumes: #"
         line: "{{ volumes_content }}"
         state: present
         regexp: "{{ volumes_content }}"
+      delegate_to: localhost
       when: volumes_content is defined
       changed_when: false
 
     - name: define networks in local composition
-      local_action:
-        module: lineinfile
+      lineinfile:
         path: "{{ local_compose_path }}/docker-compose.yml"
         insertafter: "# redes compartidas"
         line: "networks: #"
         state: present
         regexp: "networks: #"
+      delegate_to: localhost
       when: networks_def.stat.exists
       changed_when: false
 
     - name: define networks content in local composition
-      local_action:
-        module: lineinfile
+      lineinfile:
         path: "{{ local_compose_path }}/docker-compose.yml"
         insertafter: "networks: #"
         line: "{{ networks_content }}"
         state: present
+      delegate_to: localhost
       when: networks_content is defined
       changed_when: false

roles/althost/tasks/main.yml

@@ -1,28 +1,46 @@
     # DOCKER CE this is specific for Debian
     # https://docs.docker.com/install/linux/docker-ce/debian/
+    # Soporta Debian 12 (bookworm) y Debian 13 (trixie)
     - block:
       - name: "unattended upgrades"
         apt:
           name: "unattended-upgrades"
           state: "present"
-              
+
       - name: required packages
         apt:
-          name: ['apt-transport-https', 'ca-certificates', 'curl', 'gnupg2', 'software-properties-common', 'python3-pip']
+          name: ['ca-certificates', 'curl', 'python3-pip']
           state: present
 
-      - name: docker signing key
-        apt_key:
+      - name: create keyrings directory
+        file:
+          path: /etc/apt/keyrings
+          state: directory
+          mode: '0755'
+
+      - name: download docker gpg key
+        get_url:
           url: https://download.docker.com/linux/debian/gpg
-          state: present
-        
-      - name: docker apt repository
-        apt_repository:
-          repo: deb [arch=amd64] https://download.docker.com/linux/debian bookworm stable
+          dest: /etc/apt/keyrings/docker.asc
+          mode: '0644'
 
-      - name: install docker community edition
+      - name: add docker repository with deb822 format
+        deb822_repository:
+          name: docker
+          types: [deb]
+          uris: https://download.docker.com/linux/debian
+          suites: ["{{ ansible_distribution_release }}"]
+          components: [stable]
+          architectures: [amd64]
+          signed_by: /etc/apt/keyrings/docker.asc
+
+      - name: install docker community edition and compose plugin
         apt:
-          name: docker-ce
+          name:
+            - docker-ce
+            - docker-ce-cli
+            - containerd.io
+            - docker-compose-plugin
           update_cache: yes
 
       - name: is node already in swarm mode
@@ -48,23 +66,11 @@
           state: present
 
       # ansible-docker requirements
-      - name: python package docker-py is deprecated
-        pip:
-          name: docker-py
-          state: absent
-          break_system_packages: true
-
-      - name: ensure python package docker is present
-        pip:
-          name: docker
+      # Use system packages instead of pip to avoid break_system_packages
+      - name: ensure python3-docker package is present
+        apt:
+          name: python3-docker
           state: present
-          break_system_packages: true
-
-      - name: ensure python package docker-compose is present
-        pip:
-          name: docker-compose
-          state: present
-          break_system_packages: true
 
       tags: installation
 
@@ -74,16 +80,16 @@
         file: path={{ compose_path }} state=directory
       
       - name: make sure local compose path exists
-        local_action:
-          module: file
-          path: "{{ local_compose_path }}" 
+        file:
+          path: "{{ local_compose_path }}"
           state: directory
+        delegate_to: localhost
 
       - name: clean docker-compose.yml
-        local_action:
-          module: template
+        template:
           dest: "{{ local_compose_path }}/docker-compose.yml"
           src: roles/althost/templates/docker-compose.yml
+        delegate_to: localhost
         changed_when: false
 
       - name: execute roles per domain mapping

roles/knsupdate/tasks/update_domain.yml

@@ -3,7 +3,7 @@
 
     - name: extract zone and hostname for main zone subdomains
       set_fact:
-        zone: main_zone ~ '.'
+        zone: "{{ main_zone ~ '.' }}"
         hostname: "{{ domain | regex_replace('([a-z0-9-]+)\\.' ~ main_zone|regex_escape , '\\1') }}"
       when: is_abyayala_subdomain
 
@@ -29,6 +29,8 @@
         zone: "{{ domain_parts[-2:] | join('.') }}."
         hostname: "{{ domain_parts[:-2] | join('.') if domain_parts | length > 2 else '@' }}"
       when: not is_abyayala_subdomain and not uses_compound_tld
+    - debug:
+        msg: "{{ lookup('template', 'templates/commands.j2') }}"
 
     - name: knsupdate for this domain
       shell: knsupdate

roles/proxy/files/custom_proxy_includes/sutty.abyaya.la

@@ -1,11 +0,0 @@
-proxy_buffering off;
-proxy_request_buffering off;
-proxy_redirect off;
-proxy_connect_timeout 3m;
-proxy_send_timeout 3m;
-proxy_read_timeout 3m;
-
-limit_conn connection_limit 50;
-limit_req zone=request_limit nodelay burst=20;
-
-add_header Retry-After $retry_after always;

roles/proxy/files/custom_server_includes/sutty.abyaya.la

@@ -1,4 +0,0 @@
-add_header X-Frame-Options "sameorigin";
-add_header X-XSS-Protection "1; mode=block";
-add_header X-Content-Type-Options "nosniff";
-add_header Referrer-Policy "strict-origin-when-cross-origin";

roles/proxy/templates/common.conf

@@ -0,0 +1,4 @@
+    add_header X-Frame-Options "sameorigin";
+    add_header X-XSS-Protection "1; mode=block";
+    add_header X-Content-Type-Options "nosniff";
+    add_header Referrer-Policy "strict-origin-when-cross-origin";

roles/proxy/templates/default_proxy.conf

@@ -12,7 +12,9 @@
 
         gzip_disable "msie6";
         {% endif %}
+
         client_max_body_size 1G;
+
         proxy_ssl_verify off;
         proxy_ssl_server_name on;
         proxy_ssl_name $ssl_server_name;
@@ -27,6 +29,18 @@
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection upgrade;
 
+        proxy_buffering off;
+        proxy_request_buffering off;
+        proxy_redirect off;
+        proxy_connect_timeout 3m;
+        proxy_send_timeout 3m;
+        proxy_read_timeout 3m;
+
+        limit_conn connection_limit 50;
+        limit_req zone=request_limit nodelay burst=20;
+
+        add_header Retry-After $retry_after always;
+
         {% include "files/custom_proxy_includes/" ~ vhost.domains[0] ignore missing %}
 }
       # END PROXY

testnet.yml

@@ -0,0 +1,23 @@
+althost: testnet
+matrix:
+  - service_name: comun
+    roles:
+      - kemal
+    domains:
+      - comun.abyayala.red
+
+  - service_name: dns
+    roles:
+      - knsupdate
+
+  - service_name: vpn
+    roles:
+      - rap
+    nodos:
+      - qi
+
+  - service_name: qi
+    domains:
+      - qi.abyayala.red
+    nodo: qi.comun
+#    force_https: yes