Compare commits
No commits in common. "5859751c66446b39c4ba69c6730dedc4eb3ef5c4" and "0281f7d80626905e57ef45ddd790835f84598980" have entirely different histories.
5859751c66
...
0281f7d806
|
|
@ -1,245 +0,0 @@
|
||||||
# Docker Registry DNS Configuration
|
|
||||||
|
|
||||||
## Overview
|
|
||||||
|
|
||||||
The Docker registry at `192.168.200.200:5000` is now accessible via the domain name `registry.directlx.dev` using HTTPS through Nginx Proxy Manager.
|
|
||||||
|
|
||||||
## DNS Resolution
|
|
||||||
|
|
||||||
- **Domain**: registry.directlx.dev
|
|
||||||
- **DNS Resolution**: 192.168.200.71 (NPM - Nginx Proxy Manager)
|
|
||||||
- **Backend**: 192.168.200.200:5000 (Docker Registry)
|
|
||||||
- **Protocol**: HTTPS (SSL terminated at NPM)
|
|
||||||
- **DNS Server**: Pi-hole (192.168.200.100)
|
|
||||||
|
|
||||||
## Usage
|
|
||||||
|
|
||||||
### Docker Push
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Tag your image
|
|
||||||
docker tag my-image:latest registry.directlx.dev/my-image:latest
|
|
||||||
|
|
||||||
# Push to registry
|
|
||||||
docker push registry.directlx.dev/my-image:latest
|
|
||||||
```
|
|
||||||
|
|
||||||
### Docker Pull
|
|
||||||
|
|
||||||
```bash
|
|
||||||
docker pull registry.directlx.dev/my-image:latest
|
|
||||||
```
|
|
||||||
|
|
||||||
### Docker Compose
|
|
||||||
|
|
||||||
Update your `.env` files to use the domain name:
|
|
||||||
|
|
||||||
```env
|
|
||||||
DOCKER_REGISTRY=registry.directlx.dev
|
|
||||||
```
|
|
||||||
|
|
||||||
Then in `docker-compose.yml`:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
services:
|
|
||||||
app:
|
|
||||||
image: ${DOCKER_REGISTRY}/my-image:latest
|
|
||||||
```
|
|
||||||
|
|
||||||
## Verification
|
|
||||||
|
|
||||||
### Test DNS Resolution
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Query Pi-hole directly
|
|
||||||
nslookup registry.directlx.dev 192.168.200.100
|
|
||||||
|
|
||||||
# Check local resolution
|
|
||||||
getent hosts registry.directlx.dev
|
|
||||||
```
|
|
||||||
|
|
||||||
Expected output: `192.168.200.71 registry.directlx.dev`
|
|
||||||
|
|
||||||
### Test Registry Connectivity
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Health check (via HTTPS)
|
|
||||||
curl -I https://registry.directlx.dev/v2/
|
|
||||||
|
|
||||||
# List repositories
|
|
||||||
curl https://registry.directlx.dev/v2/_catalog
|
|
||||||
```
|
|
||||||
|
|
||||||
### Test Docker Integration
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# List tags for a repository
|
|
||||||
curl https://registry.directlx.dev/v2/hiveops-incident/tags/list
|
|
||||||
```
|
|
||||||
|
|
||||||
## Current Repositories
|
|
||||||
|
|
||||||
As of 2026-02-14, the registry contains:
|
|
||||||
|
|
||||||
- atm-incident-backend
|
|
||||||
- atm-incident-frontend
|
|
||||||
- hiveops-agent
|
|
||||||
- hiveops-auth
|
|
||||||
- hiveops-config
|
|
||||||
- hiveops-incident
|
|
||||||
- hiveops-incident-backend
|
|
||||||
- hiveops-incident-frontend
|
|
||||||
- hiveops-mgmt
|
|
||||||
- hiveops-release
|
|
||||||
- hiveops-remote
|
|
||||||
- smart-client
|
|
||||||
|
|
||||||
## Configuration Files
|
|
||||||
|
|
||||||
### Pi-hole DNS Record
|
|
||||||
|
|
||||||
Managed by: `playbooks/configure-directlx-dev-dns.yml`
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
dns_records:
|
|
||||||
- { ip: "192.168.200.71", hostname: "registry" }
|
|
||||||
```
|
|
||||||
|
|
||||||
### NPM Proxy Host Configuration
|
|
||||||
|
|
||||||
Configure in NPM web UI (http://192.168.200.71:81):
|
|
||||||
|
|
||||||
**Domain Names:**
|
|
||||||
- registry.directlx.dev
|
|
||||||
|
|
||||||
**Forward Hostname/IP:** 192.168.200.200
|
|
||||||
**Forward Port:** 5000
|
|
||||||
**Scheme:** http
|
|
||||||
|
|
||||||
**SSL:**
|
|
||||||
- ✅ Force SSL
|
|
||||||
- ✅ HTTP/2 Support
|
|
||||||
- ✅ HSTS Enabled
|
|
||||||
- SSL Certificate: Let's Encrypt or custom
|
|
||||||
|
|
||||||
### Local /etc/hosts (Optional)
|
|
||||||
|
|
||||||
For local workstation access without Pi-hole DNS:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
sudo tee -a /etc/hosts <<EOF
|
|
||||||
192.168.200.71 registry.directlx.dev
|
|
||||||
EOF
|
|
||||||
```
|
|
||||||
|
|
||||||
Or use the Ansible playbook:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
ansible-playbook playbooks/configure-local-dns-localhost.yml --ask-become-pass
|
|
||||||
```
|
|
||||||
|
|
||||||
## Troubleshooting
|
|
||||||
|
|
||||||
### Registry Not Resolving
|
|
||||||
|
|
||||||
**Check DNS:**
|
|
||||||
```bash
|
|
||||||
nslookup registry.directlx.dev 192.168.200.100
|
|
||||||
```
|
|
||||||
|
|
||||||
If no result, re-run the DNS configuration playbook:
|
|
||||||
```bash
|
|
||||||
ansible-playbook playbooks/configure-directlx-dev-dns.yml
|
|
||||||
```
|
|
||||||
|
|
||||||
### Connection Refused
|
|
||||||
|
|
||||||
**Check registry is running:**
|
|
||||||
```bash
|
|
||||||
ansible docker -m shell -a "docker ps | grep registry"
|
|
||||||
```
|
|
||||||
|
|
||||||
**Check firewall:**
|
|
||||||
```bash
|
|
||||||
ansible docker -m shell -a "ufw status" -b
|
|
||||||
```
|
|
||||||
|
|
||||||
### Docker Daemon Configuration
|
|
||||||
|
|
||||||
With HTTPS enabled via NPM, no insecure registry configuration is needed. Docker will trust the SSL certificate.
|
|
||||||
|
|
||||||
If you encounter certificate issues, ensure the CA certificate is trusted on your system.
|
|
||||||
|
|
||||||
## Security Notes
|
|
||||||
|
|
||||||
- ✅ HTTPS enabled via NPM (SSL/TLS encryption)
|
|
||||||
- ✅ Registry accessible only on local network (192.168.200.0/24)
|
|
||||||
- ✅ SSL certificate from Let's Encrypt (valid and trusted)
|
|
||||||
- ⚠️ No authentication configured (suitable for internal use)
|
|
||||||
- For production, consider:
|
|
||||||
- Adding Docker registry authentication
|
|
||||||
- Implementing access controls
|
|
||||||
- Rate limiting at NPM level
|
|
||||||
|
|
||||||
## Quick Setup Guide
|
|
||||||
|
|
||||||
**Complete setup in 2 steps:**
|
|
||||||
|
|
||||||
1. **DNS Configuration** (✅ DONE)
|
|
||||||
```bash
|
|
||||||
ansible-playbook playbooks/configure-directlx-dev-dns.yml
|
|
||||||
```
|
|
||||||
|
|
||||||
2. **NPM Proxy Configuration** (⚠️ REQUIRED)
|
|
||||||
|
|
||||||
See: [NPM Registry Setup Guide](NPM-REGISTRY-SETUP.md)
|
|
||||||
|
|
||||||
Quick summary:
|
|
||||||
- Navigate to NPM Admin (http://192.168.200.71:81)
|
|
||||||
- Add Proxy Host for registry.directlx.dev
|
|
||||||
- Forward to: 192.168.200.200:5000
|
|
||||||
- Enable SSL with Let's Encrypt
|
|
||||||
- Add custom Nginx config (see guide)
|
|
||||||
|
|
||||||
## Related Documentation
|
|
||||||
|
|
||||||
- **[NPM Registry Setup Guide](NPM-REGISTRY-SETUP.md)** - Step-by-step NPM configuration ⭐
|
|
||||||
- [Local DNS Configuration](LOCAL-DNS-CONFIGURATION.md) - General DNS setup
|
|
||||||
- [SSL Offloading Fix](SSL-OFFLOADING-FIX.md) - HTTPS configuration
|
|
||||||
- Global CLAUDE.md - Docker registry URL reference
|
|
||||||
|
|
||||||
## Maintenance
|
|
||||||
|
|
||||||
### Update DNS Record
|
|
||||||
|
|
||||||
Edit `playbooks/configure-directlx-dev-dns.yml` and add/modify:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
dns_records:
|
|
||||||
- { ip: "NEW_IP", hostname: "registry" }
|
|
||||||
```
|
|
||||||
|
|
||||||
Then apply:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
ansible-playbook playbooks/configure-directlx-dev-dns.yml
|
|
||||||
```
|
|
||||||
|
|
||||||
### Clear DNS Cache
|
|
||||||
|
|
||||||
On Pi-hole:
|
|
||||||
```bash
|
|
||||||
ansible pihole -m shell -a "pihole restartdns" -b
|
|
||||||
```
|
|
||||||
|
|
||||||
On local workstation:
|
|
||||||
```bash
|
|
||||||
sudo systemd-resolve --flush-caches
|
|
||||||
resolvectl flush-caches
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
**Created**: 2026-02-14
|
|
||||||
**Last Updated**: 2026-02-14
|
|
||||||
**Author**: DirectLX Infrastructure Team
|
|
||||||
|
|
@ -1,247 +0,0 @@
|
||||||
# Local DNS Configuration for DirectLX Services
|
|
||||||
|
|
||||||
## Problem
|
|
||||||
|
|
||||||
DirectLX services (incident.directlx.dev, hiveops.directlx.dev, etc.) resolve to public IP `45.16.76.42`, which has unreliable connectivity:
|
|
||||||
- Connection timeouts (2+ minutes)
|
|
||||||
- Only ~33% success rate
|
|
||||||
- Intermittent failures
|
|
||||||
|
|
||||||
## Solution
|
|
||||||
|
|
||||||
Configure local DNS resolution to use the internal NPM server (`192.168.200.71`) instead of going through the public IP.
|
|
||||||
|
|
||||||
### Benefits
|
|
||||||
- ✅ Fast local network access (2-4ms vs 2+ minute timeouts)
|
|
||||||
- ✅ 100% reliability on local network
|
|
||||||
- ✅ No dependency on public IP routing
|
|
||||||
- ✅ Seamless HTTPS with valid certificates
|
|
||||||
|
|
||||||
## Playbooks
|
|
||||||
|
|
||||||
### 1. `configure-local-dns-localhost.yml`
|
|
||||||
|
|
||||||
Configure DNS on your local workstation **right now**.
|
|
||||||
|
|
||||||
**Usage:**
|
|
||||||
```bash
|
|
||||||
cd /source/dlx-src/dlx-ansible
|
|
||||||
ansible-playbook playbooks/configure-local-dns-localhost.yml --ask-become-pass
|
|
||||||
```
|
|
||||||
|
|
||||||
**What it does:**
|
|
||||||
- Adds directlx.dev entries to `/etc/hosts`
|
|
||||||
- Points all domains to `192.168.200.71` (NPM server)
|
|
||||||
- Tests connectivity automatically
|
|
||||||
- Shows before/after results
|
|
||||||
|
|
||||||
**Duration:** ~5 seconds
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### 2. `configure-local-dns.yml`
|
|
||||||
|
|
||||||
Deploy local DNS configuration across **all infrastructure hosts**.
|
|
||||||
|
|
||||||
**Usage:**
|
|
||||||
```bash
|
|
||||||
cd /source/dlx-src/dlx-ansible
|
|
||||||
|
|
||||||
# Apply to all hosts except NPM server
|
|
||||||
ansible-playbook -i inventory/hosts.yml playbooks/configure-local-dns.yml
|
|
||||||
|
|
||||||
# Apply to specific group
|
|
||||||
ansible-playbook -i inventory/hosts.yml playbooks/configure-local-dns.yml --limit application
|
|
||||||
|
|
||||||
# Apply to specific host
|
|
||||||
ansible-playbook -i inventory/hosts.yml playbooks/configure-local-dns.yml --limit hiveops
|
|
||||||
```
|
|
||||||
|
|
||||||
**What it does:**
|
|
||||||
- Configures all hosts to use local NPM server
|
|
||||||
- Creates backup of `/etc/hosts` before changes
|
|
||||||
- Uses blockinfile for idempotent updates
|
|
||||||
- Verifies DNS resolution after configuration
|
|
||||||
- Tests HTTPS connectivity (optional)
|
|
||||||
|
|
||||||
**Target hosts:** All hosts except NPM server itself
|
|
||||||
|
|
||||||
**Duration:** ~10-20 seconds per host
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Manual Configuration
|
|
||||||
|
|
||||||
If you prefer to configure manually:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
sudo tee -a /etc/hosts <<'EOF'
|
|
||||||
# DirectLX Local DNS Entries
|
|
||||||
192.168.200.71 incident.directlx.dev
|
|
||||||
192.168.200.71 hiveops.directlx.dev
|
|
||||||
192.168.200.71 mgmt.directlx.dev
|
|
||||||
192.168.200.71 release.directlx.dev
|
|
||||||
192.168.200.71 gitea.directlx.dev
|
|
||||||
192.168.200.71 smartjournal.directlx.dev
|
|
||||||
192.168.200.71 directlx.dev
|
|
||||||
192.168.200.71 www.directlx.dev
|
|
||||||
192.168.200.71 registry.directlx.dev
|
|
||||||
EOF
|
|
||||||
```
|
|
||||||
|
|
||||||
## Verification
|
|
||||||
|
|
||||||
### Test DNS Resolution
|
|
||||||
```bash
|
|
||||||
getent hosts incident.directlx.dev
|
|
||||||
# Expected: 192.168.200.71 incident.directlx.dev
|
|
||||||
```
|
|
||||||
|
|
||||||
### Test HTTPS Connectivity
|
|
||||||
```bash
|
|
||||||
curl -I https://incident.directlx.dev
|
|
||||||
# Expected: HTTP/1.1 200 OK (within 1 second)
|
|
||||||
```
|
|
||||||
|
|
||||||
### Test All Domains
|
|
||||||
```bash
|
|
||||||
for domain in incident.directlx.dev hiveops.directlx.dev mgmt.directlx.dev; do
|
|
||||||
echo "Testing $domain..."
|
|
||||||
time curl -I --max-time 5 https://$domain | head -1
|
|
||||||
done
|
|
||||||
```
|
|
||||||
|
|
||||||
## Rollback
|
|
||||||
|
|
||||||
If you need to remove the configuration:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Restore from backup
|
|
||||||
sudo cp /etc/hosts.backup-<timestamp> /etc/hosts
|
|
||||||
|
|
||||||
# Or remove the Ansible-managed block
|
|
||||||
sudo sed -i '/# DirectLX Local DNS/,/# END DirectLX Local DNS/d' /etc/hosts
|
|
||||||
```
|
|
||||||
|
|
||||||
## Production Considerations
|
|
||||||
|
|
||||||
### Option 1: /etc/hosts (Current Solution)
|
|
||||||
- ✅ Simple and immediate
|
|
||||||
- ✅ No additional dependencies
|
|
||||||
- ❌ Must be applied to each host
|
|
||||||
- ❌ Manual management required
|
|
||||||
|
|
||||||
### Option 2: Pi-hole Split-Horizon DNS (Recommended Long-term)
|
|
||||||
Configure Pi-hole at `192.168.200.100` with local DNS records:
|
|
||||||
|
|
||||||
**Benefits:**
|
|
||||||
- ✅ Centralized management
|
|
||||||
- ✅ Automatic for all network clients
|
|
||||||
- ✅ No per-host configuration
|
|
||||||
- ✅ Easy to update
|
|
||||||
|
|
||||||
**Implementation:**
|
|
||||||
1. Log in to Pi-hole admin (`http://192.168.200.100/admin`)
|
|
||||||
2. Navigate to **Local DNS** → **DNS Records**
|
|
||||||
3. Add A records for each domain:
|
|
||||||
- Domain: `incident.directlx.dev` → IP: `192.168.200.71`
|
|
||||||
- Domain: `hiveops.directlx.dev` → IP: `192.168.200.71`
|
|
||||||
- Domain: `mgmt.directlx.dev` → IP: `192.168.200.71`
|
|
||||||
- Domain: `registry.directlx.dev` → IP: `192.168.200.71`
|
|
||||||
- etc.
|
|
||||||
|
|
||||||
### Option 3: Internal DNS Server (Enterprise)
|
|
||||||
Set up authoritative DNS for `directlx.dev` zone with split-horizon configuration.
|
|
||||||
|
|
||||||
## How It Works
|
|
||||||
|
|
||||||
### Before
|
|
||||||
```
|
|
||||||
Client → DNS Query → 45.16.76.42 (public IP)
|
|
||||||
Client → HTTPS Request → 45.16.76.42 → [timeout/unreliable]
|
|
||||||
```
|
|
||||||
|
|
||||||
### After
|
|
||||||
```
|
|
||||||
Client → /etc/hosts → 192.168.200.71 (local NPM)
|
|
||||||
Client → HTTPS Request → 192.168.200.71 (NPM) → 192.168.200.112 (backend)
|
|
||||||
```
|
|
||||||
|
|
||||||
## Network Architecture
|
|
||||||
|
|
||||||
```
|
|
||||||
┌─────────────────┐
|
|
||||||
│ Your Workstation│
|
|
||||||
│ 10.10.10.119 │
|
|
||||||
└────────┬────────┘
|
|
||||||
│
|
|
||||||
│ Local Network Route
|
|
||||||
│
|
|
||||||
┌────▼─────────────────┐
|
|
||||||
│ NPM (Nginx Proxy) │
|
|
||||||
│ 192.168.200.71 │
|
|
||||||
│ Port 443 (HTTPS) │
|
|
||||||
└────┬─────────────────┘
|
|
||||||
│
|
|
||||||
│ Proxy Pass
|
|
||||||
│
|
|
||||||
┌────▼──────────────────┐
|
|
||||||
│ HiveOps Backend │
|
|
||||||
│ 192.168.200.112:8080 │
|
|
||||||
└───────────────────────┘
|
|
||||||
```
|
|
||||||
|
|
||||||
## Troubleshooting
|
|
||||||
|
|
||||||
### Issue: Still getting timeouts
|
|
||||||
|
|
||||||
**Check DNS resolution:**
|
|
||||||
```bash
|
|
||||||
getent hosts incident.directlx.dev
|
|
||||||
```
|
|
||||||
Should show `192.168.200.71`, not `45.16.76.42`.
|
|
||||||
|
|
||||||
**Check /etc/hosts:**
|
|
||||||
```bash
|
|
||||||
grep directlx /etc/hosts
|
|
||||||
```
|
|
||||||
Should show entries with `192.168.200.71`.
|
|
||||||
|
|
||||||
### Issue: DNS resolving to wrong IP
|
|
||||||
|
|
||||||
**Check systemd-resolved cache:**
|
|
||||||
```bash
|
|
||||||
sudo systemd-resolve --flush-caches
|
|
||||||
resolvectl flush-caches
|
|
||||||
```
|
|
||||||
|
|
||||||
**Check NSS resolution order:**
|
|
||||||
```bash
|
|
||||||
grep hosts /etc/nsswitch.conf
|
|
||||||
```
|
|
||||||
Should show `files` before `dns`: `hosts: files dns`
|
|
||||||
|
|
||||||
### Issue: Certificate warnings
|
|
||||||
|
|
||||||
If you get SSL certificate warnings, it means you're connecting via IP instead of hostname.
|
|
||||||
|
|
||||||
**Solution:** Ensure you're using the domain name, not the IP:
|
|
||||||
```bash
|
|
||||||
# Wrong
|
|
||||||
curl https://192.168.200.71
|
|
||||||
|
|
||||||
# Correct
|
|
||||||
curl https://incident.directlx.dev
|
|
||||||
```
|
|
||||||
|
|
||||||
## Related Documentation
|
|
||||||
|
|
||||||
- [SSL Offloading Fix](SSL-OFFLOADING-FIX.md) - Spring Boot SSL configuration
|
|
||||||
- [Express Proxy Config](EXPRESS-PROXY-CONFIG.md) - Express.js proxy settings
|
|
||||||
- NPM Configuration - Located in `/data/nginx/proxy_host/` on 192.168.200.71
|
|
||||||
|
|
||||||
## Author
|
|
||||||
|
|
||||||
- **Created:** 2026-02-06
|
|
||||||
- **Purpose:** Fix unreliable public IP connectivity to DirectLX services
|
|
||||||
- **Repository:** dlx-src/dlx-ansible
|
|
||||||
|
|
@ -1,360 +0,0 @@
|
||||||
# NPM Configuration for Docker Registry (registry.directlx.dev)
|
|
||||||
|
|
||||||
## Overview
|
|
||||||
|
|
||||||
This guide configures Nginx Proxy Manager to proxy `registry.directlx.dev` to the backend Docker registry at `192.168.200.200:5000` with HTTPS/SSL termination.
|
|
||||||
|
|
||||||
## Prerequisites
|
|
||||||
|
|
||||||
- ✅ DNS configured: registry.directlx.dev → 192.168.200.71
|
|
||||||
- ✅ NPM running at 192.168.200.71
|
|
||||||
- ✅ Docker registry running at 192.168.200.200:5000
|
|
||||||
- ⚠️ NPM admin access required
|
|
||||||
|
|
||||||
## Step-by-Step Configuration
|
|
||||||
|
|
||||||
### 1. Access NPM Admin Panel
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Open in browser
|
|
||||||
http://192.168.200.71:81/
|
|
||||||
|
|
||||||
# Default credentials (if first time):
|
|
||||||
# Email: admin@example.com
|
|
||||||
# Password: changeme
|
|
||||||
```
|
|
||||||
|
|
||||||
### 2. Create Proxy Host
|
|
||||||
|
|
||||||
Navigate to: **Hosts** → **Proxy Hosts** → **Add Proxy Host**
|
|
||||||
|
|
||||||
#### Details Tab
|
|
||||||
|
|
||||||
**Domain Names:**
|
|
||||||
```
|
|
||||||
registry.directlx.dev
|
|
||||||
```
|
|
||||||
|
|
||||||
**Scheme:** `http`
|
|
||||||
|
|
||||||
**Forward Hostname / IP:** `192.168.200.200`
|
|
||||||
|
|
||||||
**Forward Port:** `5000`
|
|
||||||
|
|
||||||
**Options:**
|
|
||||||
- ☐ Cache Assets
|
|
||||||
- ☑ Block Common Exploits
|
|
||||||
- ☑ Websockets Support (for Docker registry v2 API)
|
|
||||||
- ☐ Access List
|
|
||||||
|
|
||||||
#### SSL Tab
|
|
||||||
|
|
||||||
**SSL Certificate:**
|
|
||||||
- Select existing Let's Encrypt certificate for `*.directlx.dev`, OR
|
|
||||||
- Request New SSL Certificate:
|
|
||||||
- ☑ Force SSL
|
|
||||||
- ☑ HTTP/2 Support
|
|
||||||
- ☑ HSTS Enabled
|
|
||||||
- ☑ HSTS Subdomains
|
|
||||||
- Email: `your-email@example.com`
|
|
||||||
- ☑ I Agree to the Let's Encrypt Terms of Service
|
|
||||||
|
|
||||||
**Note:** If using wildcard certificate, ensure DNS challenge is configured.
|
|
||||||
|
|
||||||
#### Advanced Tab (IMPORTANT for Docker Registry)
|
|
||||||
|
|
||||||
Add the following custom Nginx configuration:
|
|
||||||
|
|
||||||
```nginx
|
|
||||||
# Docker Registry v2 API requires specific headers
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
|
|
||||||
# Increase timeouts for large image pushes
|
|
||||||
proxy_connect_timeout 300;
|
|
||||||
proxy_send_timeout 300;
|
|
||||||
proxy_read_timeout 300;
|
|
||||||
send_timeout 300;
|
|
||||||
|
|
||||||
# Disable buffering for chunked uploads
|
|
||||||
proxy_request_buffering off;
|
|
||||||
|
|
||||||
# Allow large body sizes for Docker images (5GB max)
|
|
||||||
client_max_body_size 5120M;
|
|
||||||
|
|
||||||
# Disable access log for registry (too verbose)
|
|
||||||
access_log off;
|
|
||||||
```
|
|
||||||
|
|
||||||
### 3. Save and Test
|
|
||||||
|
|
||||||
Click **Save** to create the proxy host.
|
|
||||||
|
|
||||||
### 4. Verify Configuration
|
|
||||||
|
|
||||||
#### Test DNS Resolution
|
|
||||||
|
|
||||||
```bash
|
|
||||||
nslookup registry.directlx.dev
|
|
||||||
# Should return: 192.168.200.71
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Test HTTPS Access
|
|
||||||
|
|
||||||
```bash
|
|
||||||
curl -I https://registry.directlx.dev/v2/
|
|
||||||
# Expected: HTTP/2 200
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Test Docker Registry API
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# List repositories
|
|
||||||
curl -s https://registry.directlx.dev/v2/_catalog | jq '.'
|
|
||||||
|
|
||||||
# Expected output:
|
|
||||||
# {
|
|
||||||
# "repositories": [
|
|
||||||
# "atm-incident-backend",
|
|
||||||
# "hiveops-incident",
|
|
||||||
# ...
|
|
||||||
# ]
|
|
||||||
# }
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Test Docker Pull
|
|
||||||
|
|
||||||
```bash
|
|
||||||
docker pull registry.directlx.dev/hiveops-incident:latest
|
|
||||||
```
|
|
||||||
|
|
||||||
## Troubleshooting
|
|
||||||
|
|
||||||
### 502 Bad Gateway
|
|
||||||
|
|
||||||
**Cause:** NPM can't reach backend registry
|
|
||||||
|
|
||||||
**Check backend is running:**
|
|
||||||
```bash
|
|
||||||
ansible docker -m shell -a "docker ps | grep registry"
|
|
||||||
ansible docker -m shell -a "curl -I http://localhost:5000/v2/"
|
|
||||||
```
|
|
||||||
|
|
||||||
**Check firewall:**
|
|
||||||
```bash
|
|
||||||
ansible docker -m shell -a "ufw status" -b
|
|
||||||
```
|
|
||||||
|
|
||||||
### SSL Certificate Error
|
|
||||||
|
|
||||||
**Cause:** Let's Encrypt can't verify domain
|
|
||||||
|
|
||||||
**Solution:**
|
|
||||||
1. Ensure port 80/443 are open on NPM server
|
|
||||||
2. Verify DNS propagation: `nslookup registry.directlx.dev`
|
|
||||||
3. Check NPM logs: **Tools** → **Error Logs**
|
|
||||||
|
|
||||||
### 413 Request Entity Too Large
|
|
||||||
|
|
||||||
**Cause:** `client_max_body_size` too small
|
|
||||||
|
|
||||||
**Solution:** Add to Advanced tab:
|
|
||||||
```nginx
|
|
||||||
client_max_body_size 5120M;
|
|
||||||
```
|
|
||||||
|
|
||||||
### Connection Timeout on Large Pushes
|
|
||||||
|
|
||||||
**Cause:** Timeout values too low
|
|
||||||
|
|
||||||
**Solution:** Add to Advanced tab:
|
|
||||||
```nginx
|
|
||||||
proxy_connect_timeout 300;
|
|
||||||
proxy_send_timeout 300;
|
|
||||||
proxy_read_timeout 300;
|
|
||||||
send_timeout 300;
|
|
||||||
```
|
|
||||||
|
|
||||||
### Docker Push Hangs
|
|
||||||
|
|
||||||
**Cause:** Request buffering enabled
|
|
||||||
|
|
||||||
**Solution:** Add to Advanced tab:
|
|
||||||
```nginx
|
|
||||||
proxy_request_buffering off;
|
|
||||||
```
|
|
||||||
|
|
||||||
## Docker Client Configuration
|
|
||||||
|
|
||||||
### No Additional Configuration Required
|
|
||||||
|
|
||||||
With HTTPS enabled, Docker will work without insecure registry configuration:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Just works!
|
|
||||||
docker pull registry.directlx.dev/my-image:latest
|
|
||||||
docker push registry.directlx.dev/my-image:latest
|
|
||||||
```
|
|
||||||
|
|
||||||
### Legacy HTTP Configuration (NOT RECOMMENDED)
|
|
||||||
|
|
||||||
If you need HTTP-only access (not recommended):
|
|
||||||
|
|
||||||
Edit `/etc/docker/daemon.json`:
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"insecure-registries": ["registry.directlx.dev"]
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
Restart Docker:
|
|
||||||
```bash
|
|
||||||
sudo systemctl restart docker
|
|
||||||
```
|
|
||||||
|
|
||||||
## Testing the Complete Setup
|
|
||||||
|
|
||||||
### 1. Tag and Push Test Image
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Pull a small test image
|
|
||||||
docker pull alpine:latest
|
|
||||||
|
|
||||||
# Tag for your registry
|
|
||||||
docker tag alpine:latest registry.directlx.dev/test-alpine:latest
|
|
||||||
|
|
||||||
# Push to registry
|
|
||||||
docker push registry.directlx.dev/test-alpine:latest
|
|
||||||
```
|
|
||||||
|
|
||||||
### 2. Verify Upload
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Check repository exists
|
|
||||||
curl -s https://registry.directlx.dev/v2/_catalog | jq '.repositories[] | select(. == "test-alpine")'
|
|
||||||
|
|
||||||
# Check tags
|
|
||||||
curl -s https://registry.directlx.dev/v2/test-alpine/tags/list | jq '.'
|
|
||||||
```
|
|
||||||
|
|
||||||
### 3. Pull from Another Machine
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Remove local image
|
|
||||||
docker rmi registry.directlx.dev/test-alpine:latest
|
|
||||||
|
|
||||||
# Pull from registry
|
|
||||||
docker pull registry.directlx.dev/test-alpine:latest
|
|
||||||
|
|
||||||
# Verify
|
|
||||||
docker images | grep test-alpine
|
|
||||||
```
|
|
||||||
|
|
||||||
### 4. Cleanup
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Remove test image from local
|
|
||||||
docker rmi alpine:latest registry.directlx.dev/test-alpine:latest
|
|
||||||
```
|
|
||||||
|
|
||||||
## NPM Configuration Summary
|
|
||||||
|
|
||||||
| Setting | Value |
|
|
||||||
|---------|-------|
|
|
||||||
| Domain | registry.directlx.dev |
|
|
||||||
| Scheme | http |
|
|
||||||
| Forward Host | 192.168.200.200 |
|
|
||||||
| Forward Port | 5000 |
|
|
||||||
| SSL | Enabled (Let's Encrypt) |
|
|
||||||
| Force SSL | Yes |
|
|
||||||
| HTTP/2 | Yes |
|
|
||||||
| HSTS | Yes |
|
|
||||||
| Max Body Size | 5120M |
|
|
||||||
| Timeouts | 300s |
|
|
||||||
|
|
||||||
## Security Considerations
|
|
||||||
|
|
||||||
### ✅ Implemented
|
|
||||||
- HTTPS/TLS encryption (via Let's Encrypt)
|
|
||||||
- SSL certificate validation
|
|
||||||
- Block common exploits enabled
|
|
||||||
- Large body size limits (prevents DoS)
|
|
||||||
- Access logging disabled (prevents log spam)
|
|
||||||
|
|
||||||
### ⚠️ Not Implemented (Consider for Production)
|
|
||||||
- Authentication (Docker registry supports basic auth, tokens, OAuth)
|
|
||||||
- Access lists (NPM can restrict by IP/network)
|
|
||||||
- Rate limiting (prevent abuse)
|
|
||||||
- Image scanning (vulnerability detection)
|
|
||||||
- Content trust (signed images)
|
|
||||||
|
|
||||||
### Authentication Setup (Optional)
|
|
||||||
|
|
||||||
To add basic authentication to the registry:
|
|
||||||
|
|
||||||
1. Generate htpasswd file on docker server:
|
|
||||||
```bash
|
|
||||||
ansible docker -m shell -a "docker run --rm --entrypoint htpasswd httpd:alpine -Bbn username password > /opt/docker-registry/auth/htpasswd"
|
|
||||||
```
|
|
||||||
|
|
||||||
2. Update registry configuration to use auth:
|
|
||||||
```yaml
|
|
||||||
auth:
|
|
||||||
htpasswd:
|
|
||||||
realm: Registry Realm
|
|
||||||
path: /auth/htpasswd
|
|
||||||
```
|
|
||||||
|
|
||||||
3. Restart registry container
|
|
||||||
|
|
||||||
4. Docker login:
|
|
||||||
```bash
|
|
||||||
docker login registry.directlx.dev
|
|
||||||
```
|
|
||||||
|
|
||||||
## Related Documentation
|
|
||||||
|
|
||||||
- [Docker Registry DNS Configuration](DOCKER-REGISTRY-DNS.md)
|
|
||||||
- [Local DNS Configuration](LOCAL-DNS-CONFIGURATION.md)
|
|
||||||
- [SSL Offloading Fix](SSL-OFFLOADING-FIX.md)
|
|
||||||
|
|
||||||
## Maintenance
|
|
||||||
|
|
||||||
### Update SSL Certificate
|
|
||||||
|
|
||||||
Certificates auto-renew via Let's Encrypt. To force renewal:
|
|
||||||
|
|
||||||
1. NPM Admin → **SSL Certificates**
|
|
||||||
2. Find `registry.directlx.dev` certificate
|
|
||||||
3. Click **...** → **Renew Certificate**
|
|
||||||
|
|
||||||
### Monitor Logs
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# NPM access logs (if enabled)
|
|
||||||
ansible npm -m shell -a "tail -f /data/logs/proxy-host-*.log"
|
|
||||||
|
|
||||||
# NPM error logs
|
|
||||||
ansible npm -m shell -a "tail -f /data/logs/error.log"
|
|
||||||
|
|
||||||
# Registry logs
|
|
||||||
ansible docker -m shell -a "docker logs -f registry" -b
|
|
||||||
```
|
|
||||||
|
|
||||||
### Backup Configuration
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Backup NPM database
|
|
||||||
ansible npm -m shell -a "sqlite3 /data/database.sqlite .dump > /tmp/npm-backup.sql"
|
|
||||||
|
|
||||||
# Download backup
|
|
||||||
ansible npm -m fetch -a "src=/tmp/npm-backup.sql dest=./backups/"
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
**Created**: 2026-02-14
|
|
||||||
**Last Updated**: 2026-02-14
|
|
||||||
**Author**: DirectLX Infrastructure Team
|
|
||||||
|
|
@ -1,244 +0,0 @@
|
||||||
# PostgreSQL User Management
|
|
||||||
|
|
||||||
This guide covers creating and managing PostgreSQL users on the postgres server (192.168.200.103).
|
|
||||||
|
|
||||||
## Quick Reference
|
|
||||||
|
|
||||||
### Create Superuser with Random Password
|
|
||||||
```bash
|
|
||||||
ansible-playbook playbooks/create-postgres-user.yml -e "pg_username=hiveops pg_superuser=true"
|
|
||||||
```
|
|
||||||
|
|
||||||
### Create User with Specific Password
|
|
||||||
```bash
|
|
||||||
ansible-playbook playbooks/create-postgres-user.yml -e "pg_username=myapp pg_password=SecurePass123"
|
|
||||||
```
|
|
||||||
|
|
||||||
### Create Database Creator User
|
|
||||||
```bash
|
|
||||||
ansible-playbook playbooks/create-postgres-user.yml -e "pg_username=dbadmin pg_createdb=true"
|
|
||||||
```
|
|
||||||
|
|
||||||
### Create Basic User (No Special Privileges)
|
|
||||||
```bash
|
|
||||||
ansible-playbook playbooks/create-postgres-user.yml -e "pg_username=readonly"
|
|
||||||
```
|
|
||||||
|
|
||||||
## Playbook Variables
|
|
||||||
|
|
||||||
| Variable | Required | Default | Description |
|
|
||||||
|----------|----------|---------|-------------|
|
|
||||||
| `pg_username` | Yes | - | PostgreSQL username to create |
|
|
||||||
| `pg_password` | No | Auto-generated | Password (random 32-char base64 if not provided) |
|
|
||||||
| `pg_superuser` | No | `false` | Grant SUPERUSER privilege |
|
|
||||||
| `pg_createdb` | No | `false` | Grant CREATEDB privilege |
|
|
||||||
| `pg_createrole` | No | `false` | Grant CREATEROLE privilege |
|
|
||||||
| `pg_login` | No | `true` | Allow user to login |
|
|
||||||
| `pg_save_credentials` | No | `false` | Save credentials to `/tmp/postgres-user-*.txt` |
|
|
||||||
|
|
||||||
## Examples
|
|
||||||
|
|
||||||
### Example 1: HiveOps Application User (Superuser)
|
|
||||||
```bash
|
|
||||||
ansible-playbook playbooks/create-postgres-user.yml \
|
|
||||||
-e "pg_username=hiveops" \
|
|
||||||
-e "pg_superuser=true" \
|
|
||||||
-e "pg_save_credentials=true"
|
|
||||||
```
|
|
||||||
|
|
||||||
**Output:**
|
|
||||||
- Random password generated
|
|
||||||
- Superuser privileges
|
|
||||||
- Credentials saved to `/tmp/postgres-user-hiveops-*.txt`
|
|
||||||
|
|
||||||
### Example 2: Application User with Database Creation
|
|
||||||
```bash
|
|
||||||
ansible-playbook playbooks/create-postgres-user.yml \
|
|
||||||
-e "pg_username=smartjournal" \
|
|
||||||
-e "pg_createdb=true" \
|
|
||||||
-e "pg_password=MySecurePassword123"
|
|
||||||
```
|
|
||||||
|
|
||||||
**Output:**
|
|
||||||
- Specific password used
|
|
||||||
- Can create databases
|
|
||||||
- Cannot create other users
|
|
||||||
|
|
||||||
### Example 3: Read-Only Application User
|
|
||||||
```bash
|
|
||||||
# First create the user
|
|
||||||
ansible-playbook playbooks/create-postgres-user.yml \
|
|
||||||
-e "pg_username=reporting"
|
|
||||||
|
|
||||||
# Then grant SELECT permissions manually
|
|
||||||
ansible postgres -m shell \
|
|
||||||
-a "psql -d mydb -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO reporting;'" \
|
|
||||||
--become-user=postgres -b
|
|
||||||
```
|
|
||||||
|
|
||||||
### Example 4: Multiple Users at Once
|
|
||||||
```bash
|
|
||||||
# Create a variables file
|
|
||||||
cat > /tmp/users.yml <<EOF
|
|
||||||
---
|
|
||||||
users:
|
|
||||||
- username: hiveops
|
|
||||||
superuser: true
|
|
||||||
- username: smartjournal
|
|
||||||
createdb: true
|
|
||||||
- username: readonly
|
|
||||||
superuser: false
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Run for each user
|
|
||||||
for user in hiveops smartjournal readonly; do
|
|
||||||
ansible-playbook playbooks/create-postgres-user.yml \
|
|
||||||
-e "pg_username=$user" \
|
|
||||||
-e "@/tmp/users.yml"
|
|
||||||
done
|
|
||||||
```
|
|
||||||
|
|
||||||
## Ad-Hoc User Management
|
|
||||||
|
|
||||||
### Change User Password
|
|
||||||
```bash
|
|
||||||
ansible postgres -m shell \
|
|
||||||
-a "psql -c \"ALTER USER hiveops WITH PASSWORD 'new_password';\"" \
|
|
||||||
--become-user=postgres -b
|
|
||||||
```
|
|
||||||
|
|
||||||
### Grant Superuser to Existing User
|
|
||||||
```bash
|
|
||||||
ansible postgres -m shell \
|
|
||||||
-a "psql -c 'ALTER USER myuser WITH SUPERUSER;'" \
|
|
||||||
--become-user=postgres -b
|
|
||||||
```
|
|
||||||
|
|
||||||
### Revoke Superuser from User
|
|
||||||
```bash
|
|
||||||
ansible postgres -m shell \
|
|
||||||
-a "psql -c 'ALTER USER myuser WITH NOSUPERUSER;'" \
|
|
||||||
--become-user=postgres -b
|
|
||||||
```
|
|
||||||
|
|
||||||
### List All Users
|
|
||||||
```bash
|
|
||||||
ansible postgres -m shell \
|
|
||||||
-a "psql -c '\du'" \
|
|
||||||
--become-user=postgres -b
|
|
||||||
```
|
|
||||||
|
|
||||||
### Drop User
|
|
||||||
```bash
|
|
||||||
ansible postgres -m shell \
|
|
||||||
-a "psql -c 'DROP USER myuser;'" \
|
|
||||||
--become-user=postgres -b
|
|
||||||
```
|
|
||||||
|
|
||||||
## Database Permissions
|
|
||||||
|
|
||||||
### Grant All Privileges on Database
|
|
||||||
```bash
|
|
||||||
ansible postgres -m shell \
|
|
||||||
-a "psql -c 'GRANT ALL PRIVILEGES ON DATABASE mydb TO hiveops;'" \
|
|
||||||
--become-user=postgres -b
|
|
||||||
```
|
|
||||||
|
|
||||||
### Grant SELECT on All Tables
|
|
||||||
```bash
|
|
||||||
ansible postgres -m shell \
|
|
||||||
-a "psql -d mydb -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO readonly;'" \
|
|
||||||
--become-user=postgres -b
|
|
||||||
```
|
|
||||||
|
|
||||||
### Grant CREATE on Schema
|
|
||||||
```bash
|
|
||||||
ansible postgres -m shell \
|
|
||||||
-a "psql -d mydb -c 'GRANT CREATE ON SCHEMA public TO myuser;'" \
|
|
||||||
--become-user=postgres -b
|
|
||||||
```
|
|
||||||
|
|
||||||
## Security Best Practices
|
|
||||||
|
|
||||||
1. **Use Strong Passwords**: Always use the auto-generated passwords or strong passwords (32+ characters)
|
|
||||||
2. **Principle of Least Privilege**: Only grant necessary permissions
|
|
||||||
3. **Superuser Sparingly**: Only create superusers when absolutely necessary
|
|
||||||
4. **Save Credentials Securely**: Use `pg_save_credentials=true` and move to vault
|
|
||||||
5. **Rotate Passwords**: Change passwords periodically for sensitive accounts
|
|
||||||
|
|
||||||
## Connection Examples
|
|
||||||
|
|
||||||
### psql Command Line
|
|
||||||
```bash
|
|
||||||
psql -h 192.168.200.103 -U hiveops -d mydatabase
|
|
||||||
```
|
|
||||||
|
|
||||||
### Spring Boot (application.properties)
|
|
||||||
```properties
|
|
||||||
spring.datasource.url=jdbc:postgresql://192.168.200.103:5432/hiveops
|
|
||||||
spring.datasource.username=hiveops
|
|
||||||
spring.datasource.password=j2ONAsFC6xPHk/VhktBE1qDKwUFsZQwjZvxf/rpViaE=
|
|
||||||
```
|
|
||||||
|
|
||||||
### Python (psycopg2)
|
|
||||||
```python
|
|
||||||
import psycopg2
|
|
||||||
|
|
||||||
conn = psycopg2.connect(
|
|
||||||
host="192.168.200.103",
|
|
||||||
port=5432,
|
|
||||||
database="hiveops",
|
|
||||||
user="hiveops",
|
|
||||||
password="j2ONAsFC6xPHk/VhktBE1qDKwUFsZQwjZvxf/rpViaE="
|
|
||||||
)
|
|
||||||
```
|
|
||||||
|
|
||||||
### Node.js (pg)
|
|
||||||
```javascript
|
|
||||||
const { Pool } = require('pg');
|
|
||||||
|
|
||||||
const pool = new Pool({
|
|
||||||
host: '192.168.200.103',
|
|
||||||
port: 5432,
|
|
||||||
database: 'hiveops',
|
|
||||||
user: 'hiveops',
|
|
||||||
password: 'j2ONAsFC6xPHk/VhktBE1qDKwUFsZQwjZvxf/rpViaE='
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
## Troubleshooting
|
|
||||||
|
|
||||||
### User Already Exists
|
|
||||||
The playbook will update the existing user with new privileges/password if it already exists.
|
|
||||||
|
|
||||||
### Permission Denied
|
|
||||||
Ensure you're using `-b` (become) flag and the postgres user exists on the server.
|
|
||||||
|
|
||||||
### Connection Refused
|
|
||||||
Check that PostgreSQL is listening on the network interface:
|
|
||||||
```bash
|
|
||||||
ansible postgres -m shell \
|
|
||||||
-a "grep listen_addresses /etc/postgresql/*/main/postgresql.conf" -b
|
|
||||||
```
|
|
||||||
|
|
||||||
Should be: `listen_addresses = '*'`
|
|
||||||
|
|
||||||
### Authentication Failed
|
|
||||||
Check `pg_hba.conf` for connection rules:
|
|
||||||
```bash
|
|
||||||
ansible postgres -m shell \
|
|
||||||
-a "cat /etc/postgresql/*/main/pg_hba.conf" -b
|
|
||||||
```
|
|
||||||
|
|
||||||
## History
|
|
||||||
|
|
||||||
### 2026-02-14
|
|
||||||
- Created playbook for automated PostgreSQL user creation
|
|
||||||
- Initial user created: `hiveops` (superuser)
|
|
||||||
- Password: `j2ONAsFC6xPHk/VhktBE1qDKwUFsZQwjZvxf/rpViaE=`
|
|
||||||
|
|
||||||
## Related Documentation
|
|
||||||
- [PostgreSQL Official Documentation](https://www.postgresql.org/docs/)
|
|
||||||
- [Security Best Practices](https://www.postgresql.org/docs/current/auth-methods.html)
|
|
||||||
- Ansible Project: `/source/dlx-src/dlx-ansible/`
|
|
||||||
- Playbook: `playbooks/create-postgres-user.yml`
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
---
|
|
||||||
# Nginx web server specific variables
|
|
||||||
|
|
||||||
common_firewall_allowed_ports:
|
|
||||||
- "22/tcp" # SSH
|
|
||||||
- "80/tcp" # HTTP
|
|
||||||
- "443/tcp" # HTTPS
|
|
||||||
|
|
@ -1,40 +0,0 @@
|
||||||
---
|
|
||||||
- name: Configure Pi-hole DNS for directlx.dev services (via NPM)
|
|
||||||
hosts: pihole
|
|
||||||
vars:
|
|
||||||
dns_domain: directlx.dev
|
|
||||||
# All services routed through NPM (192.168.200.71)
|
|
||||||
dns_records:
|
|
||||||
- { ip: "192.168.200.71", hostname: "www" }
|
|
||||||
- { ip: "192.168.200.71", hostname: "gitea" }
|
|
||||||
- { ip: "192.168.200.71", hostname: "mgmt" }
|
|
||||||
- { ip: "192.168.200.71", hostname: "hiveops" }
|
|
||||||
- { ip: "192.168.200.71", hostname: "browser" }
|
|
||||||
- { ip: "192.168.200.71", hostname: "smartjournal" }
|
|
||||||
- { ip: "192.168.200.71", hostname: "incidents" }
|
|
||||||
- { ip: "192.168.200.71", hostname: "remote" }
|
|
||||||
- { ip: "192.168.200.71", hostname: "registry" }
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Copy DNS update script
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: ../templates/pihole-hosts.py.j2
|
|
||||||
dest: /tmp/update_pihole_hosts_directlx.py
|
|
||||||
mode: '0755'
|
|
||||||
|
|
||||||
- name: Update Pi-hole DNS hosts for directlx.dev
|
|
||||||
ansible.builtin.command: python3 /tmp/update_pihole_hosts_directlx.py
|
|
||||||
register: update_result
|
|
||||||
changed_when: "'updated' in update_result.stdout.lower()"
|
|
||||||
notify: Restart pihole-FTL
|
|
||||||
|
|
||||||
- name: Cleanup script
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: /tmp/update_pihole_hosts_directlx.py
|
|
||||||
state: absent
|
|
||||||
|
|
||||||
handlers:
|
|
||||||
- name: Restart pihole-FTL
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: pihole-FTL
|
|
||||||
state: restarted
|
|
||||||
|
|
@ -1,70 +0,0 @@
|
||||||
---
|
|
||||||
- name: Configure Local DNS Resolution on This Workstation
|
|
||||||
hosts: localhost
|
|
||||||
connection: local
|
|
||||||
become: true
|
|
||||||
vars:
|
|
||||||
npm_server_ip: "192.168.200.71"
|
|
||||||
directlx_domains:
|
|
||||||
- incident.directlx.dev
|
|
||||||
- hiveops.directlx.dev
|
|
||||||
- mgmt.directlx.dev
|
|
||||||
- release.directlx.dev
|
|
||||||
- gitea.directlx.dev
|
|
||||||
- smartjournal.directlx.dev
|
|
||||||
- directlx.dev
|
|
||||||
- www.directlx.dev
|
|
||||||
- registry.directlx.dev
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Backup /etc/hosts
|
|
||||||
ansible.builtin.copy:
|
|
||||||
src: /etc/hosts
|
|
||||||
dest: "/etc/hosts.backup-{{ ansible_date_time.epoch }}"
|
|
||||||
remote_src: true
|
|
||||||
mode: '0644'
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Add DirectLX local DNS entries
|
|
||||||
ansible.builtin.blockinfile:
|
|
||||||
path: /etc/hosts
|
|
||||||
marker: "# {mark} DirectLX Local DNS"
|
|
||||||
block: |
|
|
||||||
# DirectLX services - use local NPM server
|
|
||||||
{% for domain in directlx_domains %}
|
|
||||||
{{ npm_server_ip }} {{ domain }}
|
|
||||||
{% endfor %}
|
|
||||||
create: false
|
|
||||||
backup: false
|
|
||||||
|
|
||||||
- name: Test DNS resolution
|
|
||||||
ansible.builtin.shell: |
|
|
||||||
echo "Testing DNS resolution..."
|
|
||||||
getent hosts incident.directlx.dev
|
|
||||||
echo ""
|
|
||||||
echo "Testing HTTPS connectivity..."
|
|
||||||
curl -I --max-time 5 https://incident.directlx.dev 2>&1 | head -3
|
|
||||||
register: test_results
|
|
||||||
changed_when: false
|
|
||||||
failed_when: false
|
|
||||||
|
|
||||||
- name: Display results
|
|
||||||
ansible.builtin.debug:
|
|
||||||
msg: |
|
|
||||||
============================================================
|
|
||||||
✅ Local DNS Configuration Complete!
|
|
||||||
============================================================
|
|
||||||
|
|
||||||
{{ test_results.stdout }}
|
|
||||||
|
|
||||||
You can now access DirectLX services reliably:
|
|
||||||
- https://incident.directlx.dev
|
|
||||||
- https://hiveops.directlx.dev
|
|
||||||
- https://mgmt.directlx.dev
|
|
||||||
- https://release.directlx.dev
|
|
||||||
- https://gitea.directlx.dev
|
|
||||||
- https://smartjournal.directlx.dev
|
|
||||||
- https://registry.directlx.dev (Docker Registry)
|
|
||||||
|
|
||||||
All domains resolve to NPM: {{ npm_server_ip }}
|
|
||||||
============================================================
|
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
---
|
|
||||||
- name: Configure local machine to use Pi-hole DNS
|
|
||||||
hosts: localhost
|
|
||||||
connection: local
|
|
||||||
become: true
|
|
||||||
vars:
|
|
||||||
pihole_ip: 192.168.200.100
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Create systemd-resolved drop-in directory
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: /etc/systemd/resolved.conf.d
|
|
||||||
state: directory
|
|
||||||
mode: '0755'
|
|
||||||
|
|
||||||
- name: Configure systemd-resolved to use Pi-hole
|
|
||||||
ansible.builtin.copy:
|
|
||||||
dest: /etc/systemd/resolved.conf.d/pihole.conf
|
|
||||||
content: |
|
|
||||||
[Resolve]
|
|
||||||
DNS={{ pihole_ip }}
|
|
||||||
FallbackDNS=8.8.8.8 8.8.4.4
|
|
||||||
Domains=~.
|
|
||||||
mode: '0644'
|
|
||||||
notify: Restart systemd-resolved
|
|
||||||
|
|
||||||
- name: Flush DNS cache
|
|
||||||
ansible.builtin.command: resolvectl flush-caches
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
handlers:
|
|
||||||
- name: Restart systemd-resolved
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: systemd-resolved
|
|
||||||
state: restarted
|
|
||||||
|
|
@ -1,149 +0,0 @@
|
||||||
---
|
|
||||||
# Playbook: Create PostgreSQL User
|
|
||||||
# Description: Creates a PostgreSQL user with specified privileges
|
|
||||||
# Usage:
|
|
||||||
# Basic user:
|
|
||||||
# ansible-playbook playbooks/create-postgres-user.yml -e "pg_username=myuser"
|
|
||||||
#
|
|
||||||
# With specific password:
|
|
||||||
# ansible-playbook playbooks/create-postgres-user.yml -e "pg_username=myuser pg_password=mypassword"
|
|
||||||
#
|
|
||||||
# With specific privileges:
|
|
||||||
# ansible-playbook playbooks/create-postgres-user.yml -e "pg_username=myuser pg_superuser=true"
|
|
||||||
# ansible-playbook playbooks/create-postgres-user.yml -e "pg_username=myuser pg_createdb=true"
|
|
||||||
#
|
|
||||||
# Variables:
|
|
||||||
# pg_username: Username to create (required)
|
|
||||||
# pg_password: Password for user (optional, will generate random if not provided)
|
|
||||||
# pg_superuser: Grant SUPERUSER privilege (default: false)
|
|
||||||
# pg_createdb: Grant CREATEDB privilege (default: false)
|
|
||||||
# pg_createrole: Grant CREATEROLE privilege (default: false)
|
|
||||||
# pg_login: Allow user to login (default: true)
|
|
||||||
|
|
||||||
- name: Create PostgreSQL User
|
|
||||||
hosts: postgres
|
|
||||||
become: true
|
|
||||||
gather_facts: false
|
|
||||||
|
|
||||||
vars:
|
|
||||||
pg_superuser: false
|
|
||||||
pg_createdb: false
|
|
||||||
pg_createrole: false
|
|
||||||
pg_login: true
|
|
||||||
pg_generate_password: "{{ pg_password is not defined }}"
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Validate required variables
|
|
||||||
ansible.builtin.assert:
|
|
||||||
that:
|
|
||||||
- pg_username is defined
|
|
||||||
- pg_username | length > 0
|
|
||||||
fail_msg: "pg_username is required. Usage: ansible-playbook playbooks/create-postgres-user.yml -e 'pg_username=myuser'"
|
|
||||||
|
|
||||||
- name: Generate random password if not provided
|
|
||||||
ansible.builtin.shell: openssl rand -base64 32
|
|
||||||
register: generated_password
|
|
||||||
delegate_to: localhost
|
|
||||||
become: false
|
|
||||||
when: pg_generate_password | bool
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Set password variable
|
|
||||||
ansible.builtin.set_fact:
|
|
||||||
pg_password: "{{ generated_password.stdout if pg_generate_password | bool else pg_password }}"
|
|
||||||
|
|
||||||
- name: Build role attributes
|
|
||||||
ansible.builtin.set_fact:
|
|
||||||
role_attrs: >-
|
|
||||||
{{
|
|
||||||
(pg_superuser | bool) | ternary('SUPERUSER', 'NOSUPERUSER')
|
|
||||||
}}
|
|
||||||
{{
|
|
||||||
(pg_createdb | bool) | ternary('CREATEDB', 'NOCREATEDB')
|
|
||||||
}}
|
|
||||||
{{
|
|
||||||
(pg_createrole | bool) | ternary('CREATEROLE', 'NOCREATEROLE')
|
|
||||||
}}
|
|
||||||
{{
|
|
||||||
(pg_login | bool) | ternary('LOGIN', 'NOLOGIN')
|
|
||||||
}}
|
|
||||||
|
|
||||||
- name: Check if user already exists
|
|
||||||
ansible.builtin.shell: |
|
|
||||||
psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='{{ pg_username }}'"
|
|
||||||
become_user: postgres
|
|
||||||
register: user_exists
|
|
||||||
changed_when: false
|
|
||||||
failed_when: false
|
|
||||||
|
|
||||||
- name: Create PostgreSQL user
|
|
||||||
ansible.builtin.shell: |
|
|
||||||
psql -c "CREATE USER {{ pg_username }} WITH {{ role_attrs }} PASSWORD '{{ pg_password }}';"
|
|
||||||
become_user: postgres
|
|
||||||
when: user_exists.stdout != "1"
|
|
||||||
register: user_created
|
|
||||||
|
|
||||||
- name: Update existing user
|
|
||||||
ansible.builtin.shell: |
|
|
||||||
psql -c "ALTER USER {{ pg_username }} WITH {{ role_attrs }} PASSWORD '{{ pg_password }}';"
|
|
||||||
become_user: postgres
|
|
||||||
when: user_exists.stdout == "1"
|
|
||||||
register: user_updated
|
|
||||||
|
|
||||||
- name: Verify user creation
|
|
||||||
ansible.builtin.shell: |
|
|
||||||
psql -c '\du {{ pg_username }}'
|
|
||||||
become_user: postgres
|
|
||||||
register: user_details
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Display user information
|
|
||||||
ansible.builtin.debug:
|
|
||||||
msg:
|
|
||||||
- "=========================================="
|
|
||||||
- "PostgreSQL User Created Successfully"
|
|
||||||
- "=========================================="
|
|
||||||
- "Username: {{ pg_username }}"
|
|
||||||
- "Password: {{ pg_password }}"
|
|
||||||
- "Server: {{ ansible_host }}"
|
|
||||||
- "Port: 5432"
|
|
||||||
- ""
|
|
||||||
- "Connection String:"
|
|
||||||
- "postgresql://{{ pg_username }}:{{ pg_password }}@{{ ansible_host }}:5432/database_name"
|
|
||||||
- ""
|
|
||||||
- "Privileges:"
|
|
||||||
- " Superuser: {{ pg_superuser }}"
|
|
||||||
- " Create DB: {{ pg_createdb }}"
|
|
||||||
- " Create Role: {{ pg_createrole }}"
|
|
||||||
- " Login: {{ pg_login }}"
|
|
||||||
- ""
|
|
||||||
- "User Details:"
|
|
||||||
- "{{ user_details.stdout_lines }}"
|
|
||||||
- ""
|
|
||||||
- "⚠️ IMPORTANT: Save this password securely!"
|
|
||||||
- "=========================================="
|
|
||||||
|
|
||||||
- name: Save credentials to file (optional)
|
|
||||||
ansible.builtin.copy:
|
|
||||||
content: |
|
|
||||||
# PostgreSQL User Credentials
|
|
||||||
# Created: {{ ansible_date_time.iso8601 }}
|
|
||||||
|
|
||||||
Username: {{ pg_username }}
|
|
||||||
Password: {{ pg_password }}
|
|
||||||
Server: {{ ansible_host }}
|
|
||||||
Port: 5432
|
|
||||||
|
|
||||||
Connection String:
|
|
||||||
postgresql://{{ pg_username }}:{{ pg_password }}@{{ ansible_host }}:5432/database_name
|
|
||||||
|
|
||||||
Privileges:
|
|
||||||
- Superuser: {{ pg_superuser }}
|
|
||||||
- Create DB: {{ pg_createdb }}
|
|
||||||
- Create Role: {{ pg_createrole }}
|
|
||||||
- Login: {{ pg_login }}
|
|
||||||
dest: "/tmp/postgres-user-{{ pg_username }}-{{ ansible_date_time.epoch }}.txt"
|
|
||||||
mode: '0600'
|
|
||||||
delegate_to: localhost
|
|
||||||
become: false
|
|
||||||
when: pg_save_credentials | default(false) | bool
|
|
||||||
Loading…
Reference in New Issue