Tobias Wüst
c10b46276a
Deploy BookStack with linuxserver.io images behind Traefik, including Entra ID OIDC SSO support and a daily backup timer. Stack: - lscr.io/linuxserver/bookstack:version-v26.03.3 - lscr.io/linuxserver/mariadb:11.4.9 - Traefik labels for websecure entrypoint on internal network - Healthcheck via mariadb-admin ping (LSIO image lacks healthcheck.sh) Features: - Persistent APP_KEY generated on first run, stored in volume dir - Optional OIDC SSO via Microsoft Entra ID (configurable per-instance) - Idempotent admin user creation with DB-based existence check - Daily systemd timer backup (DB dump + uploads tar + APP_KEY) with configurable retention Implementation notes: - DB queries use --protocol=tcp with the app user because root@localhost uses unix_socket auth in the LSIO MariaDB image (no password) and root@% does not exist - docker_container_exec uses argv: (list) instead of command: (string) to avoid argument-splitting issues - Migration-wait task ensures users table exists before admin check, since /login returns 200 before Laravel migrations complete - no_log: true on all tasks that reference DB or admin passwords - artisan absolute path (/app/www/artisan) because LSIO image WORKDIR is not the app directory Adds bookstack route to DMZ Traefik service registry.
96 lines
1.9 KiB
YAML
96 lines
1.9 KiB
YAML
---
|
|
- name: Apply base configuration to all servers
|
|
hosts: all_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.base
|
|
|
|
- name: Configure reverse proxy on application servers
|
|
hosts: traefik_servers_backend
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.traefik
|
|
|
|
- name: Configure reverse proxy on DMZ servers
|
|
hosts: traefik_servers_dmz
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.traefik
|
|
|
|
- name: Deploy httpbin service
|
|
hosts: httpbin_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.httpbin
|
|
|
|
- name: Deploy 389ds LDAP service
|
|
hosts: ds389_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.389ds
|
|
|
|
- name: Deploy keycloak service
|
|
hosts: keycloak_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.keycloak
|
|
|
|
- name: Deploy garage service
|
|
hosts: garage_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.garage
|
|
|
|
- name: Deploy collabora service
|
|
hosts: collabora_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.collabora
|
|
|
|
- name: Deploy authentik service
|
|
hosts: authentik_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.authentik
|
|
|
|
- name: Deploy authentik LDAP outpost
|
|
hosts: authentik_outpost_ldap_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.authentik_outpost_ldap
|
|
|
|
- name: Deploy nextcloud service
|
|
hosts: nextcloud_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.nextcloud
|
|
|
|
- name: Deploy drawio service
|
|
hosts: drawio_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.drawio
|
|
|
|
- name: Deploy opencloud service
|
|
hosts: opencloud_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.opencloud
|
|
|
|
- name: Deploy homarr service
|
|
hosts: homarr_servers
|
|
become: yes
|
|
roles:
|
|
- digitalboard.core.homarr
|
|
|
|
#- name: Deploy opnform service
|
|
#hosts: opnform_servers
|
|
#become: yes
|
|
#roles:
|
|
#- digitalboard.core.opnform
|
|
|
|
- name: Deploy BookStack service
|
|
hosts: bookstack_servers
|
|
become: true
|
|
roles:
|
|
- digitalboard.core.bookstack
|