Digitalboard/reference-ansible
6
1
Fork 0
Code Pull requests Activity Actions
No description
56 commits 4 branches 0 tags 282 KiB
Find a file
Tobias Wüst c10b46276a feat(bookstack): add role for self-hosted BookStack deployment 
Deploy BookStack with linuxserver.io images behind Traefik, including
Entra ID OIDC SSO support and a daily backup timer.

Stack:
- lscr.io/linuxserver/bookstack:version-v26.03.3
- lscr.io/linuxserver/mariadb:11.4.9
- Traefik labels for websecure entrypoint on internal network
- Healthcheck via mariadb-admin ping (LSIO image lacks healthcheck.sh)

Features:
- Persistent APP_KEY generated on first run, stored in volume dir
- Optional OIDC SSO via Microsoft Entra ID (configurable per-instance)
- Idempotent admin user creation with DB-based existence check
- Daily systemd timer backup (DB dump + uploads tar + APP_KEY)
  with configurable retention

Implementation notes:
- DB queries use --protocol=tcp with the app user because root@localhost
  uses unix_socket auth in the LSIO MariaDB image (no password) and
  root@% does not exist
- docker_container_exec uses argv: (list) instead of command: (string)
  to avoid argument-splitting issues
- Migration-wait task ensures users table exists before admin check,
  since /login returns 200 before Laravel migrations complete
- no_log: true on all tasks that reference DB or admin passwords
- artisan absolute path (/app/www/artisan) because LSIO image WORKDIR
  is not the app directory

Adds bookstack route to DMZ Traefik service registry.
2026-05-20 17:40:39 +02:00
inventories feat(bookstack): add role for self-hosted BookStack deployment 2026-05-20 17:40:39 +02:00
playbooks feat(bookstack): add role for self-hosted BookStack deployment 2026-05-20 17:40:39 +02:00
.gitignore fix: (vagrant) rearanged the staging of the services 2026-05-18 20:58:29 +02:00
ansible.cfg chore: add readme entry and configration for openbao secrets management 2026-03-27 16:46:18 +01:00
Makefile chore: start modeling gymburgdorf demo and test bao secret lookup 2026-04-10 17:23:41 +02:00
README.md chore: start modeling gymburgdorf demo and test bao secret lookup 2026-04-10 17:23:41 +02:00
requirements.yml chore: add readme entry and configration for openbao secrets management 2026-03-27 16:46:18 +01:00
Vagrantfile chore: increase vagrant vm ram to 8192 2026-04-10 15:19:29 +02:00

README.md

reference-ansible

Secrets

Secrets are managed using OpenBao. The bao CLI needs to be installed. e.g sudo pacman -S openbao python-hvac

Authenticate and export token before running playbooks:

export BAO_ADDR=https://bao.digitalboard.ch
bao login -method=oidc -path=Digitalboard
export VAULT_TOKEN=$(bao print token)