03bf0efe44
Replace ansible-galaxy init placeholders across the collection and correct documentation that drifted from the code, after a multi-agent review of every role README against its defaults, tasks and templates. Collection level: - README: role table for all 16 roles, requirements and role-ordering - galaxy.yml: declare community.docker and community.general deps, real description/tags/urls; normalize license to MIT-0 - meta/runtime.yml: requires_ansible '>=2.15.0' - plugins/README: document the homarr_layout filter and garage_credentials lookup instead of scaffold boilerplate Per-role meta/main.yml and README for the placeholder roles (389ds, authentik, authentik_outpost_ldap, base, collabora, drawio, garage, homarr, httpbin, keycloak, nextcloud, opencloud, traefik). Correctness fixes found during review: - keycloak: wrong domain default, drop invented keycloak_cert_resolver, document the provisioning feature - garage: root_domain is .s3.<first-entry>, not the bare domain - opnform: jwt/front_api secrets use `openssl rand -hex 32`; align the validation fail_msg in tasks/main.yml accordingly - send: S3 example references garage_s3_domains[0] (was singular) - opencloud: document required opencloud_wopi_domain License normalized to MIT-0 across galaxy.yml, role meta and READMEs to match the SPDX headers.
68 lines
3.8 KiB
Markdown
68 lines
3.8 KiB
Markdown
# Ansible Collection — digitalboard.core
|
|
|
|
This collection bundles the Ansible roles used to deploy the
|
|
[Digitalboard](https://git.digitalboard.ch/Digitalboard) platform: a set of
|
|
self-hosted, Docker-Compose-based services running behind Traefik, with
|
|
single sign-on provided by authentik or Keycloak.
|
|
|
|
Each role provisions one service (or building block) as a self-contained
|
|
Docker Compose stack. Roles are consumed from the deployment repository
|
|
[reference-ansible](https://git.digitalboard.ch/Digitalboard/reference-ansible),
|
|
where inventories and playbooks tie the roles to concrete hosts.
|
|
|
|
## Roles
|
|
|
|
| Role | Description |
|
|
| --- | --- |
|
|
| `base` | Host baseline: Docker, apt packages and convenience tooling on Debian/Ubuntu. |
|
|
| `traefik` | Traefik v3 reverse proxy as a public DMZ proxy (file provider) or backend proxy (docker provider). |
|
|
| `authentik` | [authentik](https://goauthentik.io) IdP (server + worker + Postgres); resources via blueprints. |
|
|
| `authentik_outpost_ldap` | authentik LDAP outpost exposing an LDAP interface for apps that cannot speak OIDC. |
|
|
| `keycloak` | [Keycloak](https://www.keycloak.org/) IdP with a PostgreSQL backend. |
|
|
| `389ds` | [389 Directory Server](https://www.port389.org/) LDAP directory via Docker Compose. |
|
|
| `nextcloud` | [Nextcloud](https://nextcloud.com/) (fpm) + Postgres + Redis, optional Collabora/draw.io/notify_push. |
|
|
| `opencloud` | [OpenCloud](https://opencloud.eu/) file platform via Docker Compose. |
|
|
| `collabora` | [Collabora Online](https://www.collaboraonline.com/) (CODE), used as the WOPI backend for Nextcloud. |
|
|
| `bookstack` | [BookStack](https://www.bookstackapp.com/) wiki (LSIO + MariaDB) with OIDC SSO and daily backups. |
|
|
| `drawio` | [draw.io](https://www.drawio.com/) diagram editor, with optional authentik ForwardAuth gating. |
|
|
| `homarr` | [Homarr](https://github.com/homarr-labs/homarr) dashboard with seeded admin user and OIDC group. |
|
|
| `opnform` | [OpnForm](https://github.com/OpnForm/OpnForm) self-hosted form builder (api + ui + db + redis). |
|
|
| `send` | [Send](https://github.com/timvisee/send) (timvisee fork) file sharing with a Redis backend. |
|
|
| `garage` | [Garage](https://garagehq.deuxfleurs.fr/) S3-compatible object storage with key/bucket provisioning. |
|
|
| `httpbin` | [httpbin](https://httpbin.org/) HTTP request/response testing service for validating Traefik ingress. |
|
|
|
|
## Usage
|
|
|
|
Roles are not run from this repository directly. They are consumed from the
|
|
deployment repository
|
|
[reference-ansible](https://git.digitalboard.ch/Digitalboard/reference-ansible),
|
|
which holds the inventories, group/host variables and playbooks. See that
|
|
repository's `docs/` directory for getting-started instructions, how to run
|
|
Ansible and how secrets are managed.
|
|
|
|
Per-role variables and their defaults are documented in each role's own
|
|
`README.md` and `meta/argument_specs.yml`.
|
|
|
|
## Requirements
|
|
|
|
- A Debian/Ubuntu target host (the `base` role bootstraps Docker there).
|
|
- ansible-core 2.15 or newer on the controller.
|
|
- The `community.docker` collection (used by nearly every role) and
|
|
`community.general` (used by the `keycloak` role). Both are declared as
|
|
`dependencies` in `galaxy.yml` and pulled in automatically when this
|
|
collection is installed via `ansible-galaxy`.
|
|
|
|
The role READMEs use `community.hashi_vault` lookups in their examples to source
|
|
secrets from HashiCorp Vault. That is a documented convention, not a hard
|
|
dependency of the roles — supply the variables however you prefer.
|
|
|
|
## Role ordering
|
|
|
|
Within a play, apply the roles in dependency order: `base` first (Docker and the
|
|
host baseline), then `traefik` (the shared reverse proxy and its Docker network),
|
|
then the individual service roles (`authentik`, `keycloak`, `nextcloud`, …),
|
|
which attach to Traefik's network and expect Docker to be present.
|
|
|
|
## License
|
|
|
|
MIT-0. See individual roles for per-role license metadata.
|