Tobias Wüst
c10b46276a
Deploy BookStack with linuxserver.io images behind Traefik, including Entra ID OIDC SSO support and a daily backup timer. Stack: - lscr.io/linuxserver/bookstack:version-v26.03.3 - lscr.io/linuxserver/mariadb:11.4.9 - Traefik labels for websecure entrypoint on internal network - Healthcheck via mariadb-admin ping (LSIO image lacks healthcheck.sh) Features: - Persistent APP_KEY generated on first run, stored in volume dir - Optional OIDC SSO via Microsoft Entra ID (configurable per-instance) - Idempotent admin user creation with DB-based existence check - Daily systemd timer backup (DB dump + uploads tar + APP_KEY) with configurable retention Implementation notes: - DB queries use --protocol=tcp with the app user because root@localhost uses unix_socket auth in the LSIO MariaDB image (no password) and root@% does not exist - docker_container_exec uses argv: (list) instead of command: (string) to avoid argument-splitting issues - Migration-wait task ensures users table exists before admin check, since /login returns 200 before Laravel migrations complete - no_log: true on all tasks that reference DB or admin passwords - artisan absolute path (/app/www/artisan) because LSIO image WORKDIR is not the app directory Adds bookstack route to DMZ Traefik service registry.
90 lines
No EOL
1.7 KiB
YAML
90 lines
No EOL
1.7 KiB
YAML
---
|
|
all:
|
|
children:
|
|
all_servers:
|
|
hosts:
|
|
dmz:
|
|
ansible_host: 192.168.56.10
|
|
ansible_ssh_private_key_file: .vagrant/machines/dmz/libvirt/private_key
|
|
ansible_user: vagrant
|
|
backend:
|
|
ansible_host: 192.168.56.11
|
|
ansible_ssh_private_key_file: .vagrant/machines/backend/libvirt/private_key
|
|
ansible_user: vagrant
|
|
backend2:
|
|
ansible_host: 192.168.56.12
|
|
ansible_ssh_private_key_file: .vagrant/machines/backend2/libvirt/private_key
|
|
ansible_user: vagrant
|
|
|
|
# Backend servers that host application services
|
|
backend_servers:
|
|
hosts:
|
|
backend:
|
|
backend2:
|
|
|
|
# Reverse proxy servers
|
|
traefik_servers:
|
|
children:
|
|
traefik_servers_dmz:
|
|
traefik_servers_backend:
|
|
|
|
# DMZ reverse proxy (public-facing, file provider mode)
|
|
traefik_servers_dmz:
|
|
hosts:
|
|
dmz:
|
|
|
|
# Backend reverse proxy (docker provider mode)
|
|
traefik_servers_backend:
|
|
hosts:
|
|
backend:
|
|
backend2:
|
|
|
|
# Application servers
|
|
httpbin_servers:
|
|
hosts:
|
|
backend:
|
|
backend2:
|
|
|
|
ds389_servers:
|
|
hosts:
|
|
backend:
|
|
|
|
keycloak_servers:
|
|
hosts:
|
|
backend:
|
|
|
|
authentik_servers:
|
|
hosts:
|
|
backend:
|
|
|
|
authentik_outpost_ldap_servers:
|
|
hosts:
|
|
backend:
|
|
|
|
garage_servers:
|
|
hosts:
|
|
backend:
|
|
|
|
nextcloud_servers:
|
|
hosts:
|
|
backend:
|
|
|
|
homarr_servers:
|
|
hosts:
|
|
backend:
|
|
|
|
collabora_servers:
|
|
hosts:
|
|
backend:
|
|
|
|
drawio_servers:
|
|
hosts:
|
|
backend:
|
|
|
|
opencloud_servers:
|
|
hosts:
|
|
backend:
|
|
|
|
bookstack_servers:
|
|
hosts:
|
|
backend: |