Update postgres Docker tag to v17

Close another port, and hopefully get a little more reliability in weird network configurations

ansible/ansible.cfg

@@ -5,8 +5,11 @@ retry_files_enabled = False
 roles_path = $PWD/galaxy_roles:$PWD/roles
 collections_path = $PWD/galaxy_collections
 inventory = ./hosts
-become_ask_pass = True
 interpreter_python = auto_silent
 
+[privilege_escalation]
+become = True
+become_ask_pass = True
+
 [ssh_connection]
 pipelining = True

ansible/group_vars/all/tailscale.yml

@@ -8,4 +8,4 @@ tailscale_port: 41641
 
 tailscale_nodes:
   casey:
-    ip: 100.64.0.1
+    ip: 100.64.0.6

ansible/host_vars/casey/main.yml

@@ -1,3 +1,4 @@
+private_ip: "{{ ansible_tailscale0.ipv4.address }}"
 nginx_https_redirect: true
 
 certbot_certs:

ansible/host_vars/ingress.yml

@@ -1 +1,2 @@
+private_ip: "{{ ansible_tailscale0.ipv4.address }}"
 nginx_https_redirect: true

ansible/main.yml

@@ -9,12 +9,10 @@
 - hosts: casey
   roles:
     - nginx
-    - role: geerlingguy.certbot
-      become: true
+    - geerlingguy.certbot
     - gateway
     - headscale
     - restic
-    - artis3n.tailscale
     - glinet_vpn
 
 - hosts:
@@ -25,7 +23,6 @@
     - tang
   roles:
     - role: geerlingguy.ntp
-      become: true
       vars:
         ntp_timezone: "{{ timezone }}"
         ntp_manage_config: true
@@ -37,8 +34,7 @@
     - renovate
     - gitea-runner
   roles:
-    - role: geerlingguy.docker
-      become: true
+    - geerlingguy.docker
     - docker_cleanup
 
 - hosts:
@@ -53,6 +49,14 @@
   roles:
     - traefik
 
+- hosts:
+    - ingress
+    - walker
+    - casey
+  become: false  # Forcefully run as current user
+  roles:
+    - artis3n.tailscale
+
 - hosts: pve-docker
   roles:
     - pve_docker
@@ -71,17 +75,13 @@
   roles:
     - nginx
     - ingress
-    - artis3n.tailscale
 
 - hosts: pve
   roles:
-    - role: ironicbadger.proxmox_nag_removal
-      become: true
+    - ironicbadger.proxmox_nag_removal
     - zfs
-    - role: ironicbadger.snapraid
-      become: true
-    - role: prometheus.prometheus.node_exporter
-      become: true
+    - ironicbadger.snapraid
+    - prometheus.prometheus.node_exporter
 
 - hosts: forrest
   roles:
@@ -98,13 +98,11 @@
 - hosts: walker
   roles:
     - nginx
-    - role: geerlingguy.certbot
-      become: true
+    - geerlingguy.certbot
     - coredns_docker_proxy
     - plausible
     - restic
     - website
-    - artis3n.tailscale
     - slides
     - comentario
 
@@ -128,6 +126,5 @@
 - hosts: tang
   roles:
     - adguardhome
-    - role: prometheus.prometheus.node_exporter
-      become: true
+    - prometheus.prometheus.node_exporter
     - restic

ansible/roles/adguardhome/handlers/main.yml

@@ -3,11 +3,9 @@
     name: coredns
     state: restarted
     enabled: true
-  become: true
 
 - name: restart systemd-resolved
   service:
     name: systemd-resolved
     state: restarted
     enabled: true
-  become: true

ansible/roles/adguardhome/tasks/main.yml

@@ -1,7 +1,6 @@
 - name: Install adguardhome
   kewlfft.aur.aur:
     name: adguardhome-bin
-  become: true
 
 - name: Disable resolved stub
   template:
@@ -10,7 +9,6 @@
     owner: root
     mode: "0644"
   notify: restart systemd-resolved
-  become: true
 
 - name: Use resolved resolv.conf
   file:
@@ -18,12 +16,10 @@
     dest: /etc/resolv.conf
     state: link
   notify: restart systemd-resolved
-  become: true
 
 - name: Install coredns
   kewlfft.aur.aur:
     name: coredns
-  become: true
 
 - name: Install coredns config file
   template:
@@ -32,4 +28,3 @@
     owner: coredns
     mode: "0644"
   notify: restart coredns
-  become: true

ansible/roles/authentik/files/docker-compose.yml

@@ -19,7 +19,7 @@ x-env: &env
 
 services:
   server:
-    image: ghcr.io/goauthentik/server:2024.6
+    image: ghcr.io/goauthentik/server:2024.8
     restart: unless-stopped
     command: server
     user: "{{ docker_user.id }}"
@@ -42,7 +42,7 @@ services:
       - traefik
 
   worker:
-    image: ghcr.io/goauthentik/server:2024.6
+    image: ghcr.io/goauthentik/server:2024.8
     restart: unless-stopped
     command: worker
     user: "{{ docker_user.id }}"
@@ -57,7 +57,7 @@ services:
       - server
 
   db:
-    image: postgres:15-alpine
+    image: postgres:17-alpine
     restart: unless-stopped
     volumes:
       - /mnt/speed/dbs/postgres/authentik:/var/lib/postgresql/data

ansible/roles/authentik/tasks/main.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -17,4 +16,3 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart authentik
-  become: true

ansible/roles/base/tasks/fail2ban.yml

@@ -1,25 +1,21 @@
 - name: Install fail2ban
   package:
     name: fail2ban
-  become: true
 
 - name: Enable fail2ban
   service:
     name: fail2ban
     enabled: true
-  become: true
 
 - name: fail2ban SSH jail
   template:
     src: files/ssh-jail.conf
     dest: /etc/fail2ban/jail.d/ssh.conf
     mode: "0600"
-  become: true
   register: fail2ban_jail
 
 - name: Restart fail2ban
   service:
     name: fail2ban
     state: restarted
-  become: true
   when: fail2ban_jail.changed

ansible/roles/base/tasks/logrotate.yml

@@ -1,13 +1,11 @@
 - name: Install logrotate
   package:
     name: logrotate
-  become: true
 
 - name: Enable logrotate timer
   service:
     name: logrotate.timer
     enabled: true
-  become: true
   when: ansible_os_family == 'Archlinux'
 
 - name: logrotate fail2ban config
@@ -15,4 +13,3 @@
     src: files/fail2ban-logrotate
     dest: /etc/logrotate.d/fail2ban
     mode: "0600"
-  become: true

ansible/roles/base/tasks/packages.yml

@@ -1,7 +1,6 @@
 - name: Install Base Packages
   package:
     name: "{{ item }}"
-  become: true
   loop:
     - htop
     - neofetch

ansible/roles/base/tasks/ssh.yml

@@ -1,13 +1,11 @@
 - name: Install OpenSSH for Debian
   package:
     name: openssh-server
-  become: true
   when: ansible_os_family == 'Debian'
 
 - name: Install OpenSSH for Arch
   package:
     name: openssh
-  become: true
   when: ansible_os_family == 'Archlinux'
 
 - name: Define context
@@ -22,7 +20,6 @@
     validate: /usr/sbin/sshd -t -f %s
     backup: true
     mode: "644"
-  become: true
   register: sshd_config
 
 - name: Set up authorized keys
@@ -38,11 +35,9 @@
   service:
     name: sshd
     enabled: true
-  become: true
 
 - name: Restart SSH Daemon
   service:
     name: sshd
     state: reloaded
   when: sshd_config.changed
-  become: true

ansible/roles/base/tasks/user.yml

@@ -5,11 +5,9 @@
     comment: "{{ me.name }}"
     shell: /bin/bash
     system: true
-  become: true
 
 - name: Give user sudo access
   user:
     name: "{{ me.user }}"
     groups: "{{ 'sudo' if ansible_os_family == 'Debian' else 'wheel' }}"
     append: true
-  become: true

ansible/roles/comentario/files/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   comentario:
-    image: registry.gitlab.com/comentario/comentario:v3.9.0
+    image: registry.gitlab.com/comentario/comentario:v3.10.0
     restart: unless-stopped
     user: "{{ docker_user.id }}:{{ docker_user.id }}"
     depends_on:
@@ -14,7 +14,7 @@ services:
       - BASE_URL=https://comentario.theorangeone.net
 
   db:
-    image: postgres:14-alpine
+    image: postgres:17-alpine
     restart: unless-stopped
     volumes:
       - ./postgres:/var/lib/postgresql/data

ansible/roles/comentario/tasks/main.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -17,7 +16,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart comentario
-  become: true
 
 - name: Install secrets
   copy:
@@ -26,7 +24,6 @@
     mode: "600"
     owner: "{{ docker_user.name }}"
   notify: restart comentario
-  become: true
 
 - name: Install nginx config
   template:
@@ -34,7 +31,6 @@
     dest: /etc/nginx/http.d/comentario.conf
     mode: "0644"
   notify: reload nginx
-  become: true
   vars:
     server_name: comentario.theorangeone.net
     upstream: comentario-comentario-1.docker:80

ansible/roles/comentario/vars/main.yml

@@ -11,6 +11,9 @@ comentario_secrets:
     gitlab:
       key: "{{ vault_comentario_gitlab_application_id }}"
       secret: "{{ vault_comentario_gitlab_application_secret }}"
+    twitter:
+      key: "{{ vault_comentario_twitter_api_key }}"
+      secret: "{{ vault_comentario_twitter_api_secret  }}"
   smtpServer:
     host: smtp.eu.mailgun.org
     port: 587

ansible/roles/comentario/vars/vault.yml

@@ -1,30 +1,38 @@
 $ANSIBLE_VAULT;1.1;AES256
-33656462373736356363313738643335333930343461366666663532653264363963653732656366
-3034323730613334326462326332323763323665636165390a303639633036303831373966303037
-37376233383138323265396531303739316330396230333464383963333035343735303866626334
-6562393435303264620a633139616164303337363863616138306531656365353964346638646165
-35346539326339623364343662643038336238613535623964666562383662613661616564646433
-30653432666538616565373832353434303565386333643735313866396436393732303466376237
-64383236373364383338613530353830353334326331636436323766353565656664356138386532
-62366266656461663330396562316439393038666534663564633037623237363532363637356336
-63336633393666343064383735363664643936333130636465623139393838373134636265366439
-64326538653236306437346165333934303134313032383135313335626136626162363831613430
-30636436343162376637616262393633306330663362396638393166643131343564646162616530
-62343735343832636661326265396262643136346366663337636335656137393231646438633338
-61613137366661333462363134343732666330373864393636643665396435653064623030626466
-65633536346531383565616130626461376566316535316339326363646336626266376330393939
-33653438656438316532393665333939613334666464656635323566326439363964316535623233
-38636236616637336230363032396635613563313966353334313365663434653138303764393938
-37643561346338323934663936356563363833383435373933396138663334616563666562653935
-33666631373964396265393233636631336632386537663663366439313137656661653265323162
-64656333336165326563323333653036386334386566386664306638656130323665366136373732
-34383532303363646334356534316630363133303031343665353465656239306338386238313262
-30363438383164343661343730386162633430373765313834313739393638333963393234613564
-30356134646431353132316565346331613137353431383863383866306632626336633764393036
-66626466623034666335356539653136633331636365623061613433393335303535333433616137
-65383231373230653838316630303736353237666431366134353534366564656338646265396162
-61663366663532636635663337363063306466626463396630636236363736303963353062376163
-63653530346335393934656531386139663136383132306564383937396364626365373839613766
-62633264336335313932396164373363623061363262616330343735633862623234643365353035
-36616231636461323832663837323232396636363561376563386530306339333431613935613263
-30366335393834643066343763636561346336383463333535323932326663633338
+36376264363334643335646564636336613234393261326366386234663464633966666133383933
+3731363234333962306638323737336237343230653439650a343362336166626633666161313863
+33623130623239626532663063633436616665653135343266336330353538306265323739326262
+3066643432643465350a643436366637623765663265316665386564663933663730383264396336
+39396139396238653065366663333533343336363631616332616362386639313766656136666532
+63336131346563323733333139636233353465643766643562643632653062373737353364336536
+64653162656233383136363339623933643834363931663830656364396637333632613838323461
+38666362663831363363636363346164343032376366346530393864306332326339323836643062
+66346265643039663636616464383330366539343832373839663361393661353861643364633534
+38383461323031626161663938326339386634363165303238333365323235303535333765613734
+30363032386333353962306131373466356137666334303230343561616639363238633630386330
+32383537646430666331313530343033376238646334313335343661313665626631663331656638
+31303637343263343566386634623362373366323136663032663966313836353136616564646563
+66653938326539343130346439666264663962323661386131643432663237643334633837376163
+62393330336434393232646163353539303831336638663135393734393064353964623032616233
+32393037313965313933363236653537306634613265633764636436653332623339316132373964
+39313334653831366533663661653934633338393539326564396236373462623262333530346436
+66646266623666333034346634613365356333343934363963366137303030646638373466643564
+66356265363634623363646266633137363966666361366463383266663032316665373430383031
+33303530323561366531356133363035353732333135303762316337626330333530303563643935
+35303465633536373833386435336638386662353032383861633965393564303839666463616263
+39353934343965316134663634363135616338353734656361343433313837313639303931356233
+39643135353661306461393962646238613062356361386533316362633233353235666262653738
+33616465653435303736636165343239336139383162616463613232656639393338363766396434
+32353965363537666366623066313461316463373130653637343430366231366263616261393564
+36323038383238633239323365326334393132643832373033643432653032613665646666336338
+30316565346630396537363431366337656236363462646435393731323866313366373438386265
+61373366383865336334356638653065333839303663636266393933663833313931333133663966
+35306163373462613335616265316563313062623139343061306465656463336162396266636437
+36646439613433306464383133636466383430363363393762646534343133333732613530626162
+31633430313039643636666365613232373335336235633832666139643937373766336563303266
+34396137656436373438383035316133343132313130636536393536393862386531386531303761
+64613337353463383032636636643963636235346262646366366539646233313939633864306335
+38373465373863383964633038373334386632666236303436376438666132623964396434626439
+38356235353430323236623962396461346438633962333163393535373362373164313132356232
+63313639333862313565396165613265623135626635373134626137633638333561353732313036
+3837

ansible/roles/coredns_docker_proxy/tasks/main.yml

@@ -2,7 +2,6 @@
   docker_network:
     name: coredns
     internal: true
-  become: true
 
 - name: Create install directory
   file:
@@ -10,7 +9,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -20,4 +18,3 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart coredns
-  become: true

ansible/roles/db_auto_backup/files/docker-compose.yml

@@ -9,6 +9,9 @@ services:
       - HEALTHCHECKS_ID={{ vault_db_auto_backup_healthchecks_id }}
     depends_on:
       - docker_proxy
+    networks:
+      - default
+      - backup_private
 
   docker_proxy:
     image: lscr.io/linuxserver/socket-proxy:latest
@@ -20,5 +23,13 @@ services:
       - EXEC=1
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - backup_private
+    tmpfs:
+      - /run
     logging:
       driver: none
+
+networks:
+  backup_private:
+    internal: true

ansible/roles/db_auto_backup/tasks/main.yml

@@ -4,7 +4,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -14,4 +13,3 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart db-auto-backup
-  become: true

ansible/roles/docker_cleanup/tasks/main.yml

@@ -1,7 +1,6 @@
 - name: Install docker-compose
   package:
     name: docker-compose
-  become: true
   when: ansible_os_family != 'Debian'
 
 - name: Install compose-switch
@@ -9,7 +8,6 @@
     url: "{{ docker_compose_url }}"
     dest: "{{ docker_compose_path }}"
     mode: "0755"
-  become: true
   when: ansible_os_family == 'Debian'
 
 - name: Create docker group
@@ -17,7 +15,6 @@
     name: "{{ docker_user.name }}"
     state: present
     gid: "{{ docker_user.id }}"
-  become: true
 
 - name: Create docker user
   user:
@@ -25,21 +22,18 @@
     uid: "{{ docker_user.id }}"
     group: "{{ docker_user.name }}"
     create_home: false
-  become: true
 
 - name: Add user to docker user group
   user:
     name: "{{ me.user }}"
     groups: "{{ docker_user.name }}"
     append: true
-  become: true
 
 - name: Add user to docker group
   user:
     name: "{{ me.user }}"
     groups: docker
     append: true
-  become: true
 
 - name: Clean up docker containers
   cron:
@@ -47,6 +41,8 @@
     hour: 1
     minute: 0
     job: docker system prune -af --volumes
+    cron_file: docker_cleanup
+    user: root
 
 - name: Install util scripts
   copy:
@@ -54,6 +50,7 @@
     dest: "{{ me.home }}"
     mode: "755"
     directory_mode: "755"
+    owner: "{{ me.user }}"
 
 - name: override docker service for zfs dependencies
   include_tasks: zfs-override.yml

ansible/roles/docker_cleanup/tasks/zfs-override.yml

@@ -3,7 +3,6 @@
     path: /etc/systemd/system/docker.service.d
     state: directory
     mode: "0755"
-  become: true
 
 - name: Create override.conf
   copy:
@@ -12,4 +11,3 @@
     owner: root
     group: root
     mode: "0644"
-  become: true

ansible/roles/forgejo/files/docker-compose.yml

@@ -29,7 +29,7 @@ services:
       - traefik
 
   db:
-    image: postgres:14-alpine
+    image: postgres:17-alpine
     restart: unless-stopped
     volumes:
       - /mnt/speed/dbs/postgres/gitea:/var/lib/postgresql/data

ansible/roles/forgejo/tasks/main.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -17,7 +16,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart gitea
-  become: true
 
 - name: Install config file
   template:
@@ -26,7 +24,6 @@
     mode: "{{ docker_compose_file_mask }}"
     owner: "{{ docker_user.name }}"
   notify: restart gitea
-  become: true
 
 - name: Create custom templates directory
   file:
@@ -35,7 +32,6 @@
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
     recurse: true
-  become: true
 
 - name: Install custom footer
   copy:
@@ -44,4 +40,3 @@
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_file_mask }}"
   notify: restart gitea
-  become: true

ansible/roles/forgejo_runner/files/docker-compose.yml

@@ -4,17 +4,41 @@ services:
     user: "{{ docker_user.id }}"
     volumes:
       - /mnt/data:/data
+      - ./config.yml:/data/config.yml
     environment:
       - TZ={{ timezone }}
-      - DOCKER_HOST=tcp://dind:2375
+      - DOCKER_HOST=tcp://docker_proxy:2375
     restart: unless-stopped
     command: forgejo-runner daemon
+    networks:
+      - default
+      - forgejo_private
     depends_on:
-      dind:
-        condition: service_started
+      - docker_proxy
 
-  dind:
-    image: docker:dind
-    privileged: true
-    command: [dockerd, -H, tcp://0.0.0.0:2375, --tls=false]
+  docker_proxy:
+    image: lscr.io/linuxserver/socket-proxy:latest
     restart: unless-stopped
+    environment:
+      - POST=1
+      - CONTAINERS=1
+      - INFO=1
+      - IMAGES=1
+      - VOLUMES=1
+      - NETWORKS=1
+      - ALLOW_START=1
+      - ALLOW_STOP=1
+      - ALLOW_RESTARTS=1
+      - EXEC=1
+    tmpfs:
+      - /run
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - forgejo_private
+    logging:
+      driver: none
+
+networks:
+  forgejo_private:
+    internal: true

ansible/roles/forgejo_runner/tasks/main.yml

@@ -4,24 +4,14 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
-
-- name: Create data directory
-  file:
-    path: /opt/forgejo-runner/data
-    state: directory
-    mode: "700"
-    owner: "{{ docker_user.name }}"
-  become: true
 
 - name: Install config file
   template:
     src: files/config.yml
-    dest: /opt/forgejo-runner/data/config.yml
+    dest: /opt/forgejo-runner/config.yml
     mode: "600"
     owner: "{{ docker_user.name }}"
   notify: restart forgejo-runner
-  become: true
 
 - name: Install compose file
   template:
@@ -31,4 +21,3 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart forgejo-runner
-  become: true

ansible/roles/gateway/tasks/fail2ban.yml

@@ -3,7 +3,6 @@
     src: files/nginx-fail2ban-filter.conf
     dest: /etc/fail2ban/filter.d/nginx-tcp.conf
     mode: "0600"
-  become: true
   register: fail2ban_filter
 
 - name: fail2ban jail
@@ -11,12 +10,10 @@
     src: files/nginx-fail2ban-jail.conf
     dest: /etc/fail2ban/jail.d/nginx.conf
     mode: "0600"
-  become: true
   register: fail2ban_jail
 
 - name: Restart fail2ban
   service:
     name: fail2ban
     state: restarted
-  become: true
   when: fail2ban_filter.changed or fail2ban_jail.changed

ansible/roles/gateway/tasks/nginx.yml

@@ -3,7 +3,6 @@
     src: files/nginx.conf
     dest: /etc/nginx/stream.d/gateway.conf
     mode: "0644"
-  become: true
   register: nginx_config
 
 - name: Install CDN config
@@ -11,12 +10,10 @@
     src: files/nginx-cdn.conf
     dest: /etc/nginx/http.d/cdn.conf
     mode: "0644"
-  become: true
   register: nginx_config
 
 - name: Reload Nginx
   service:
     name: nginx
     state: reloaded
-  become: true
   when: nginx_config.changed

ansible/roles/gateway/tasks/wireguard.yml

@@ -1,7 +1,6 @@
 - name: Install wireguard tools
   package:
     name: "{{ item }}"
-  become: true
   loop:
     - wireguard-tools
     - qrencode
@@ -12,21 +11,18 @@
     dest: /etc/wireguard/wg0.conf
     mode: "0600"
     backup: true
-  become: true
   register: wireguard_conf
 
 - name: Enable wireguard
   service:
     name: wg-quick@wg0
     enabled: true
-  become: true
 
 - name: Restart wireguard
   service:
     name: wg-quick@wg0
     state: restarted
   when: wireguard_conf.changed
-  become: true
 
 - name: Create wireguard client directory
   file:

ansible/roles/glinet_vpn/handlers/main.yml

@@ -2,4 +2,3 @@
   service:
     name: wg-quick@glinet
     state: restarted
-  become: true

ansible/roles/glinet_vpn/tasks/main.yml

@@ -4,7 +4,6 @@
 - name: Install wireguard tools
   package:
     name: "{{ item }}"
-  become: true
   loop:
     - wireguard-tools
     - qrencode
@@ -15,7 +14,6 @@
     dest: /etc/wireguard/glinet.conf
     mode: "0600"
     backup: true
-  become: true
   notify: restart wireguard
 
 - name: Wireguard client config
@@ -24,11 +22,9 @@
     dest: "{{ me.home }}/glinet-vpn.conf"
     mode: "0600"
     owner: "{{ me.user }}"
-  become: true
   notify: restart wireguard
 
 - name: Enable wireguard
   service:
     name: wg-quick@glinet
     enabled: true
-  become: true

ansible/roles/headscale/files/headscale.yml

@@ -63,9 +63,11 @@ noise:
 # IPv6: https://github.com/tailscale/tailscale/blob/22ebb25e833264f58d7c3f534a8b166894a89536/net/tsaddr/tsaddr.go#LL81C52-L81C71
 # IPv4: https://github.com/tailscale/tailscale/blob/22ebb25e833264f58d7c3f534a8b166894a89536/net/tsaddr/tsaddr.go#L33
 # Any other range is NOT supported, and it will cause unexpected issues.
-ip_prefixes:
-  - fd7a:115c:a1e0::/48
-  - 100.64.0.0/10
+prefixes:
+  v6: fd7a:115c:a1e0::/48
+  v4: 100.64.0.0/10
+
+  allocation: sequential
 
 # DERP is a relay system that Tailscale uses when a direct
 # connection cannot be established.
@@ -77,7 +79,7 @@ derp:
   server:
     # If enabled, runs the embedded DERP server and merges it into the rest of the DERP config
     # The Headscale server_url defined above MUST be using https, DERP requires TLS to be in place
-    enabled: true
+    enabled: false
 
     # Region ID to use for the embedded DERP server.
     # The local DERP prevails if the region ID collides with other region ID coming from
@@ -95,7 +97,8 @@ derp:
     stun_listen_addr: 0.0.0.0:3478
 
   # List of externally available DERP maps encoded in JSON
-  urls: []
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
 
   # Locally available DERP map files encoded in YAML
   #
@@ -128,10 +131,25 @@ ephemeral_node_inactivity_timeout: 30m
 node_update_check_interval: 20s
 
 # SQLite config
-db_type: sqlite3
+database:
+  type: sqlite
 
-# For production:
-db_path: /var/lib/headscale/db.sqlite
+  gorm:
+    # Enable prepared statements.
+    prepare_stmt: true
+
+    # Enable parameterized queries.
+    parameterized_queries: true
+
+    # Skip logging "record not found" errors.
+    skip_err_record_not_found: true
+
+    # Threshold for slow queries in milliseconds.
+    slow_threshold: 3000
+
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+    write_ahead_log: true
 
 # # Postgres config
 # If using a Unix socket to connect to Postgres, set the socket path in the 'host' field and leave 'port' blank.
@@ -188,7 +206,9 @@ log:
 # Path to a file containg ACL policies.
 # ACLs can be defined as YAML or HUJSON.
 # https://tailscale.com/kb/1018/acls/
-acl_policy_path: /etc/headscale/acls.json
+policy:
+  mode: file
+  path: /etc/headscale/acls.json
 
 ## DNS
 #
@@ -199,13 +219,13 @@ acl_policy_path: /etc/headscale/acls.json
 # - https://tailscale.com/kb/1081/magicdns/
 # - https://tailscale.com/blog/2021-09-private-dns-with-magicdns/
 #
-dns_config:
+dns:
   # Whether to prefer using Headscale provided DNS or use local.
   override_local_dns: false
 
   # List of DNS servers to expose to clients.
   nameservers:
-    - 1.1.1.1
+    global: []
 
   # NextDNS (see https://tailscale.com/kb/1218/nextdns/).
   # "abc123" is example NextDNS ID, replace with yours.
@@ -251,7 +271,7 @@ dns_config:
   # `base_domain` must be a FQDNs, without the trailing dot.
   # The FQDN of the hosts will be
   # `hostname.user.base_domain` (e.g., _myhost.myuser.example.com_).
-  base_domain: headscale.jakehoward.tech
+  base_domain: hs.sys.theorangeone.net
 
 # Unix socket used for the CLI to connect without authentication
 # Note: for production you will want to set this to something like:

ansible/roles/headscale/handlers/main.yml

@@ -3,4 +3,3 @@
     name: headscale
     state: restarted
     enabled: true
-  become: true

ansible/roles/headscale/tasks/main.yml

@@ -4,7 +4,6 @@
 - name: Install Headscale
   package:
     name: headscale
-  become: true
 
 - name: Install headscale config file
   template:
@@ -13,7 +12,6 @@
     owner: headscale
     mode: "0600"
   notify: restart headscale
-  become: true
 
 - name: Install ACLs
   template:
@@ -22,12 +20,10 @@
     owner: headscale
     mode: "0600"
   notify: restart headscale
-  become: true
 
 - name: Install nginx config
   template:
     src: files/nginx.conf
     dest: /etc/nginx/http.d/headscale.conf
     mode: "0644"
-  become: true
   notify: reload nginx

ansible/roles/http_proxy/handlers/main.yml

@@ -2,4 +2,3 @@
   service:
     name: squid
     state: restarted
-  become: true

ansible/roles/http_proxy/tasks/main.yml

@@ -1,18 +1,15 @@
 - name: Install squid
   package:
     name: squid
-  become: true
 
 - name: Squid config
   template:
     src: files/squid.conf
     dest: /etc/squid/squid.conf
     mode: "0600"
-  become: true
   notify: restart squid
 
 - name: Enable squid
   service:
     name: squid
     enabled: true
-  become: true

ansible/roles/ingress/handlers/main.yml

@@ -2,13 +2,11 @@
   service:
     name: wg-quick@wg0
     state: restarted
-  become: true
 
 - name: reload nginx
   service:
     name: nginx
     state: reloaded
-  become: true
 
 - name: reload nftables
   command:
@@ -16,4 +14,3 @@
       - nft
       - -f
       - /etc/nftables.conf
-  become: true

ansible/roles/ingress/tasks/firewall.yml

@@ -1,7 +1,6 @@
 - name: Install nftables
   package:
     name: nftables
-  become: true
 
 - name: Copy firewall config
   template:
@@ -9,7 +8,6 @@
     dest: /etc/nftables.conf
     validate: nft -c -f %s
     mode: "644"
-  become: true
   notify: reload nftables
 
 - name: Enable nftables
@@ -17,4 +15,3 @@
     name: nftables
     enabled: true
     state: started
-  become: true

ansible/roles/ingress/tasks/nginx.yml

@@ -3,5 +3,4 @@
     src: files/nginx.conf
     dest: /etc/nginx/stream.d/ingress.conf
     mode: "0644"
-  become: true
   notify: reload nginx

ansible/roles/ingress/tasks/wireguard.yml

@@ -1,8 +1,6 @@
 - name: Install Wireguard
   package:
-    name:
-      - wireguard
-  become: true
+    name: wireguard
 
 - name: Get wireguard credentials
   set_fact:
@@ -14,14 +12,12 @@
     dest: /etc/wireguard/wg0.conf
     mode: "0600"
     backup: true
-  become: true
   notify: restart wireguard
 
 - name: Enable wireguard
   service:
     name: wg-quick@wg0
     enabled: true
-  become: true
 
 - name: Enable p2p communication
   sysctl:
@@ -31,4 +27,3 @@
     state: present
     reload: true
     sysctl_file: /etc/sysctl.d/99-sysctl.conf
-  become: true

ansible/roles/jellyfin/tasks/main.yml

@@ -2,23 +2,19 @@
   ansible.builtin.apt_key:
     url: https://repo.jellyfin.org/jellyfin_team.gpg.key
     state: present
-  become: true
 
 - name: Add Jellyfin repository
   apt_repository:
     repo: deb [arch=amd64] https://repo.jellyfin.org/debian {{ ansible_distribution_release }} main
     filename: jellyfin
     state: present
-  become: true
 
 - name: Install jellyfin
   package:
     name: jellyfin
-  become: true
 
 - name: Set media dir permissions
   cron:
     name: Set media permissions
     special_time: daily
     job: chown -R jellyfin:jellyfin /mnt/media
-  become: true

ansible/roles/mastodon/files/docker-compose.yml

@@ -41,7 +41,7 @@ services:
       - traefik.http.services.mastodon-mastodon.loadbalancer.server.scheme=https
 
   db:
-    image: postgres:14-alpine
+    image: postgres:17-alpine
     restart: unless-stopped
     volumes:
       - /mnt/speed/dbs/postgres/mastodon:/var/lib/postgresql/data

ansible/roles/mastodon/tasks/main.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -17,7 +16,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart mastodon
-  become: true
 
 - name: Install media cleanup script
   template:
@@ -25,7 +23,6 @@
     dest: /opt/mastodon/purge-media.sh
     mode: "0755"
     owner: "{{ docker_user.name }}"
-  become: true
 
 - name: Schedule media cleanup
   cron:
@@ -35,4 +32,3 @@
     weekday: 1
     job: /opt/mastodon/purge-media.sh
     user: "{{ me.user }}"
-  become: true

ansible/roles/minio/tasks/main.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -17,4 +16,3 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart minio
-  become: true

ansible/roles/nginx/handlers/main.yml

@@ -2,4 +2,3 @@
   service:
     name: nginx
     state: reloaded
-  become: true

ansible/roles/nginx/tasks/main.yml

@@ -1,7 +1,6 @@
 - name: Install nginx
   package:
     name: nginx
-  become: true
 
 - name: Install nginx modules
   package:
@@ -11,7 +10,6 @@
     - libnginx-mod-http-brotli-filter
     - libnginx-mod-stream
   when: ansible_os_family != 'Archlinux'
-  become: true
 
 - name: Install nginx modules (on Arch)
   kewlfft.aur.aur:
@@ -20,12 +18,10 @@
     - nginx-mod-headers-more
     - nginx-mod-brotli
   when: ansible_os_family == 'Archlinux'
-  become: true
 
 - name: Generate Diffie-Hellman parameters
   community.crypto.openssl_dhparam:
     path: /etc/nginx/dhparams.pem
-  become: true
 
 - name: Create config directories
   file:
@@ -36,7 +32,6 @@
     - http.d
     - stream.d
     - includes
-  become: true
 
 - name: Copy config files
   template:
@@ -44,7 +39,6 @@
     dest: /etc/nginx/includes/{{ item | basename }}
     mode: "0644"
   with_fileglob: files/includes/*.conf
-  become: true
   notify: reload nginx
 
 - name: Install config
@@ -52,7 +46,6 @@
     src: files/nginx.conf
     dest: /etc/nginx/nginx.conf
     mode: "0644"
-  become: true
   notify: reload nginx
 
 - name: Install HTTPS redirect
@@ -60,6 +53,5 @@
     src: files/nginx-https-redirect.conf
     dest: /etc/nginx/http.d/https-redirect.conf
     mode: "0644"
-  become: true
   notify: reload nginx
   when: nginx_https_redirect

ansible/roles/ntfy/tasks/main.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -17,4 +16,3 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart ntfy
-  become: true

ansible/roles/paccache/tasks/main.yml

@@ -1,18 +1,15 @@
 - name: Install Pacman utils
   package:
     name: pacman-contrib
-  become: true
 
 - name: Create hooks directory
   file:
     path: /etc/pacman.d/hooks/
     state: directory
     mode: "0755"
-  become: true
 
 - name: Install pacman hook
   template:
     src: files/paccache.hook
     dest: /etc/pacman.d/hooks/clean_package_cache.hook
     mode: "0644"
-  become: true

ansible/roles/plausible/files/docker-compose.yml

@@ -43,7 +43,7 @@ services:
         hard: 262144
 
   db:
-    image: postgres:14-alpine
+    image: postgres:17-alpine
     restart: unless-stopped
     volumes:
       - ./postgres:/var/lib/postgresql/data

ansible/roles/plausible/tasks/main.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install clickhouse config
   template:
@@ -15,7 +14,6 @@
     dest: /opt/plausible/docker_related_config.xml
     mode: "0644"
   notify: restart plausible
-  become: true
 
 - name: Install clickhouse user config
   template:
@@ -23,7 +21,6 @@
     dest: /opt/plausible/docker_related_user_config.xml
     mode: "0644"
   notify: restart plausible
-  become: true
 
 - name: Install compose file
   template:
@@ -33,7 +30,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart plausible
-  become: true
 
 - name: Install nginx config
   template:
@@ -41,7 +37,6 @@
     dest: /etc/nginx/http.d/plausible.conf
     mode: "0644"
   notify: reload nginx
-  become: true
   vars:
     server_name: plausible.theorangeone.net elbisualp.theorangeone.net
     upstream: plausible-plausible-1.docker:8000

ansible/roles/privatebin/tasks/main.yml

@@ -4,7 +4,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -14,7 +13,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart privatebin
-  become: true
 
 - name: Install config file
   template:
@@ -23,4 +21,3 @@
     mode: "{{ docker_compose_file_mask }}"
     owner: "{{ docker_user.name }}"
   notify: restart privatebin
-  become: true

ansible/roles/prometheus/files/grafana/docker-compose.yml

@@ -35,7 +35,7 @@ services:
       - renderer
 
   db:
-    image: postgres:14-alpine
+    image: postgres:17-alpine
     restart: unless-stopped
     volumes:
       - /mnt/speed/dbs/postgres/grafana/:/var/lib/postgresql/data

ansible/roles/prometheus/tasks/grafana.yml

@@ -8,7 +8,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install grafana compose file
   template:
@@ -18,4 +17,3 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart grafana
-  become: true

ansible/roles/prometheus/tasks/main.yml

@@ -17,7 +17,6 @@
       - "{{ vps_hosts.private_ipv6_range }}"
   register: routes
   changed_when: false
-  become: true
 
 - name: Add route to private services via ingress
   command:
@@ -31,5 +30,4 @@
       - "{{ pve_hosts.ingress.ipv6 }}"
       - dev
       - eth0
-  become: true
   when: vps_hosts.private_ipv6_marker not in routes.stdout

ansible/roles/prometheus/tasks/prometheus.yml

@@ -4,7 +4,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install prometheus config
   template:
@@ -13,7 +12,6 @@
     mode: "{{ docker_compose_file_mask }}"
     owner: "{{ docker_user.name }}"
   notify: reload prometheus
-  become: true
 
 - name: Install prometheus compose file
   template:
@@ -23,7 +21,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart prometheus
-  become: true
 
 - name: Install blackbox config
   template:
@@ -32,7 +29,6 @@
     mode: "{{ docker_compose_file_mask }}"
     owner: "{{ docker_user.name }}"
   notify: restart prometheus
-  become: true
 
 - name: Install alertmanager config
   template:
@@ -41,7 +37,6 @@
     mode: "{{ docker_compose_file_mask }}"
     owner: "{{ docker_user.name }}"
   notify: restart prometheus
-  become: true
 
 - name: Install prometheus alert rules
   copy:
@@ -50,4 +45,3 @@
     mode: "{{ docker_compose_file_mask }}"
     owner: "{{ docker_user.name }}"
   notify: reload prometheus
-  become: true

ansible/roles/pve_docker/files/nextcloud/config.php

@@ -19,7 +19,7 @@ $CONFIG = array (
     0 => 'intersect.jakehoward.tech',
   ),
   'dbtype' => 'mysql',
-  'version' => '29.0.4.1',
+  'version' => '29.0.6.1',
   'overwrite.cli.url' => 'https://intersect.jakehoward.tech',
   'dbname' => 'nextcloud',
   'dbhost' => 'mariadb',

ansible/roles/pve_docker/files/nextcloud/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   nextcloud:
-    image: lscr.io/linuxserver/nextcloud:29.0.4
+    image: lscr.io/linuxserver/nextcloud:29.0.6
     environment:
       - PUID={{ docker_user.id }}
       - PGID={{ docker_user.id }}

ansible/roles/pve_docker/files/quassel/docker-compose.yml

@@ -19,7 +19,7 @@ services:
       - 4242:4242
 
   db:
-    image: postgres:14-alpine
+    image: postgres:17-alpine
     restart: unless-stopped
     environment:
       - POSTGRES_USER=quassel

ansible/roles/pve_docker/files/synapse/docker-compose.yml

@@ -22,7 +22,7 @@ services:
       - traefik
 
   db:
-    image: postgres:14-alpine
+    image: postgres:17-alpine
     restart: unless-stopped
     environment:
       - POSTGRES_USER=synapse

ansible/roles/pve_docker/files/tt-rss/docker-compose.yml

@@ -53,7 +53,7 @@ services:
       - app
 
   db:
-    image: postgres:14-alpine
+    image: postgres:17-alpine
     restart: unless-stopped
     volumes:
       - /mnt/speed/dbs/postgres/tt-rss:/var/lib/postgresql/data

ansible/roles/pve_docker/files/wallabag/docker-compose.yml

@@ -35,7 +35,7 @@ services:
       - /mnt/speed/dbs/redis/wallabag:/data
 
   db:
-    image: postgres:14-alpine
+    image: postgres:17-alpine
     restart: unless-stopped
     volumes:
       - /mnt/speed/dbs/postgres/wallabag/:/var/lib/postgresql/data

ansible/roles/pve_docker/files/whoami/docker-compose.yml

@@ -4,7 +4,7 @@ services:
     restart: unless-stopped
     labels:
       - traefik.enable=true
-      - traefik.http.routers.whoami.rule=Host(`whoami.theorangeone.net`) || Host(`whoami-cdn.theorangeone.net`)
+      - traefik.http.routers.whoami.rule=Host(`whoami.theorangeone.net`) || Host(`whoami-cdn.theorangeone.net`) || Host(`who.0rng.one`)
 
       - traefik.http.routers.whoami-private.rule=Host(`whoami-private.theorangeone.net`)
       - traefik.http.routers.whoami-private.middlewares=tailscale-only@file

ansible/roles/pve_docker/tasks/calibre.yml

@@ -4,7 +4,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install calibre compose file
   template:
@@ -14,7 +13,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   register: compose_file
-  become: true
 
 - name: restart calibre
   shell:

ansible/roles/pve_docker/tasks/librespeed.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install librespeed compose file
   template:
@@ -17,7 +16,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   register: compose_file
-  become: true
 
 - name: restart librespeed
   shell:

ansible/roles/pve_docker/tasks/nextcloud.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install nextcloud compose file
   template:
@@ -17,7 +16,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   register: compose_file
-  become: true
 
 - name: Install nextcloud config
   template:
@@ -26,7 +24,6 @@
     mode: "{{ docker_compose_file_mask }}"
     owner: "{{ docker_user.name }}"
   register: config_file
-  become: true
 
 - name: Install occ script
   template:
@@ -34,7 +31,6 @@
     dest: /opt/nextcloud/occ
     mode: "0755"
     owner: "{{ docker_user.name }}"
-  become: true
 
 - name: restart nextcloud
   shell:
@@ -47,4 +43,3 @@
     name: Set nextcloud data permissions
     special_time: daily
     job: chown -R {{ docker_user.name }}:{{ docker_user.name }} /mnt/tank/files/nextcloud
-  become: true

ansible/roles/pve_docker/tasks/quassel.yml

@@ -4,7 +4,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install quassel compose file
   template:
@@ -14,7 +13,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   register: compose_file
-  become: true
 
 - name: restart quassel
   shell:

ansible/roles/pve_docker/tasks/synapse.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install synapse compose file
   template:
@@ -17,7 +16,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   register: compose_file
-  become: true
 
 - name: Install synapse config
   template:
@@ -26,7 +24,6 @@
     mode: "{{ docker_compose_file_mask }}"
     owner: "{{ docker_user.name }}"
   register: homeserver_config
-  become: true
 
 - name: restart synapse
   shell:

ansible/roles/pve_docker/tasks/tt-rss.yml

@@ -4,7 +4,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Create tt-rss plugins directory
   file:
@@ -13,7 +12,6 @@
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
   register: plugins_dir
-  become: true
 
 - name: Install tt-rss compose file
   template:
@@ -23,7 +21,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   register: compose_file
-  become: true
 
 - name: Install fever plugin
   git:
@@ -41,7 +38,6 @@
     owner: "{{ docker_user.name }}"
     mode: u=rwX,g=rwX,o=rX
     recurse: true
-  become: true
   when: fever_plugin.changed
 
 - name: restart tt-rss

ansible/roles/pve_docker/tasks/wallabag.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install wallabag compose file
   template:
@@ -17,7 +16,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   register: compose_file
-  become: true
 
 - name: restart wallabag
   shell:

ansible/roles/pve_docker/tasks/whoami.yml

@@ -4,7 +4,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install whoami compose file
   template:
@@ -14,7 +13,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   register: compose_file
-  become: true
 
 - name: restart whoami
   shell:

ansible/roles/pve_tailscale_route/tasks/main.yml

@@ -7,7 +7,6 @@
       - "{{ tailscale_cidr }}"
   register: routes
   changed_when: false
-  become: true
 
 - name: Add route to tailscale hosts via ingress
   command:
@@ -18,5 +17,4 @@
       - "{{ tailscale_cidr }}"
       - via
       - "{{ pve_hosts.ingress.ip }}"
-  become: true
   when: tailscale_cidr not in routes.stdout

ansible/roles/qbittorrent/handlers/main.yml

@@ -2,10 +2,8 @@
   service:
     name: nginx
     state: reloaded
-  become: true
 
 - name: restart qbittorrent
   service:
     name: qbittorrent-nox@{{ qbittorrent_user.name }}
     state: restarted
-  become: true

ansible/roles/qbittorrent/tasks/nginx.yml

@@ -3,5 +3,4 @@
     src: files/nginx.conf
     dest: /etc/nginx/http.d/downloads.conf
     mode: "0644"
-  become: true
   notify: reload nginx

ansible/roles/qbittorrent/tasks/qbittorrent.yml

@@ -1,20 +1,17 @@
 - name: Install qbittorrent
   package:
     name: qbittorrent-nox
-  become: true
 
 - name: Create user
   user:
     name: qbittorrent
     system: true
-  become: true
   register: qbittorrent_user
 
 - name: Enable service
   service:
     name: qbittorrent-nox@{{ qbittorrent_user.name }}
     enabled: true
-  become: true
 
 - name: Set configuration
   ini_file:
@@ -42,5 +39,4 @@
     - {section: Preferences, option: Bittorrent\MaxConnecsPerTorrent, value: -1"}
     - {section: Preferences, option: Bittorrent\MaxUploads, value: -1"}
     - {section: Preferences, option: Bittorrent\MaxUploadsPerTorrent, value: -1"}
-  become: true
   notify: restart qbittorrent

ansible/roles/renovate/files/docker-compose.yml

@@ -9,6 +9,9 @@ services:
       - DOCKER_HOST=tcp://docker_proxy:2375
       - LOG_LEVEL=debug  # Noisy, but required for debugging
     restart: unless-stopped
+    networks:
+      - default
+      - renovate_private
     depends_on:
       - redis
       - docker_proxy
@@ -33,5 +36,13 @@ services:
       - IMAGES=1
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - renovate_private
+    tmpfs:
+      - /run
     logging:
       driver: none
+
+networks:
+  renovate_private:
+    internal: true

ansible/roles/renovate/tasks/main.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -17,7 +16,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart renovate
-  become: true
 
 - name: Install config file
   template:
@@ -26,7 +24,6 @@
     mode: "{{ docker_compose_file_mask }}"
     owner: "{{ docker_user.name }}"
   notify: restart renovate
-  become: true
 
 - name: Install custom entrypoint
   template:
@@ -35,4 +32,3 @@
     mode: "0755"
     owner: "{{ docker_user.name }}"
   notify: restart renovate
-  become: true

ansible/roles/restic/tasks/homeassistant.yml

@@ -1,21 +1,18 @@
 - name: Install CIFS utils
   package:
     name: cifs-utils
-  become: true
 
 - name: Create dir for CIFS mount
   file:
     path: /mnt/home-assistant
     state: directory
     mode: "0755"
-  become: true
 
 - name: Create dir for each CIFS mount
   file:
     path: /mnt/home-assistant/{{ item }}
     state: directory
     mode: "0600"
-  become: true
   loop: "{{ restic_homeassistant_mounts }}"
 
 - name: Create mounts
@@ -25,5 +22,4 @@
     opts: username=homeassistant,password={{ vault_homeassistant_smb_password }}
     src: //{{ pve_hosts.homeassistant.ip }}/{{ item }}
     state: mounted
-  become: true
   loop: "{{ restic_homeassistant_mounts }}"

ansible/roles/restic/tasks/main.yml

@@ -1,19 +1,16 @@
 - name: Install restic
   package:
     name: restic
-  become: true
 
 - name: Install runitor
   kewlfft.aur.aur:
     name: runitor-bin
-  become: true
 
 - name: Make user
   user:
     name: restic
     shell: /bin/nologin
     system: false
-  become: true
 
 - name: Install scripts
   template:
@@ -25,7 +22,6 @@
     - backrest.sh
     - restic-backup.sh
     - restic-forget.sh
-  become: true
 
 - name: Install includes files
   copy:
@@ -33,7 +29,6 @@
     dest: /home/restic/restic-include.txt
     mode: "0644"
     owner: restic
-  become: true
 
 - name: Install excludes files
   copy:
@@ -41,7 +36,6 @@
     dest: /home/restic/restic-excludes.txt
     mode: "0644"
     owner: restic
-  become: true
 
 - name: Set restic binary permissions
   file:
@@ -49,13 +43,11 @@
     mode: "0750"
     owner: root
     group: restic
-  become: true
 
 - name: Set cap_sys_chroot=+ep on restic
   community.general.capabilities:
     path: /usr/bin/restic
     capability: cap_dac_read_search=+ep
-  become: true
 
 - name: Schedule backup
   cron:
@@ -64,7 +56,6 @@
     minute: 0
     job: CHECK_UUID={{ vault_restic_healthchecks_id }} /usr/bin/runitor -- /home/restic/restic-backup.sh
     user: restic
-  become: true
 
 - name: Schedule forget
   cron:
@@ -74,7 +65,6 @@
     weekday: 0
     job: CHECK_UUID={{ vault_restic_forget_healthchecks_id }} /usr/bin/runitor -- /home/restic/restic-forget.sh
     user: restic
-  become: true
   when: restic_forget
 
 - name: Install pacman post script
@@ -82,7 +72,6 @@
     src: files/restic-post.sh
     dest: /usr/share/libalpm/scripts/restic-post.sh
     mode: "0700"
-  become: true
   when: ansible_os_family == 'Archlinux'
 
 - name: Install pacman post hook
@@ -90,7 +79,6 @@
     src: files/restic-post.hook
     dest: /usr/share/libalpm/hooks/restic-post.hook
     mode: "0600"
-  become: true
   when: ansible_os_family == 'Archlinux'
 
 - name: Install HomeAssistant mounts

ansible/roles/s3_sync/tasks/main.yml

@@ -4,12 +4,10 @@
 - name: Install rclone
   package:
     name: rclone
-  become: true
 
 - name: Install runitor
   kewlfft.aur.aur:
     name: runitor-bin
-  become: true
 
 - name: Make user
   user:
@@ -17,7 +15,6 @@
     shell: /bin/nologin
     system: false
   register: rclone_user
-  become: true
 
 - name: Create config directory
   file:
@@ -25,7 +22,6 @@
     state: directory
     owner: rclone
     mode: "0700"
-  become: true
 
 - name: Install rclone config
   template:
@@ -33,7 +29,6 @@
     dest: "{{ rclone_user.home }}/.config/rclone/rclone.conf"
     owner: rclone
     mode: "0600"
-  become: true
 
 - name: Create config directory
   file:
@@ -41,7 +36,6 @@
     state: directory
     owner: rclone
     mode: "0700"
-  become: true
 
 - name: Schedule sync
   cron:
@@ -50,4 +44,3 @@
     minute: 0
     job: CHECK_UUID={{ vault_healthchecks_id }} /usr/bin/runitor -- /usr/bin/rclone sync s3:0rng-terraform {{ rclone_user.home }}/sync/0rng-terraform
     user: rclone
-  become: true

ansible/roles/slides/tasks/main.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -17,7 +16,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart slides
-  become: true
 
 - name: Create credentials
   htpasswd:
@@ -30,7 +28,6 @@
   loop_control:
     label: "{{ item.user }}"
   notify: restart slides
-  become: true
 
 - name: Install nginx config
   template:
@@ -38,7 +35,6 @@
     dest: /etc/nginx/http.d/slides.conf
     mode: "0644"
   notify: reload nginx
-  become: true
   vars:
     server_name: slides.jakehoward.tech
     upstream: slides-slides-1.docker:80

ansible/roles/tandoor/files/docker-compose.yml

@@ -34,7 +34,7 @@ services:
       - /opt/recipes/staticfiles
 
   db:
-    image: postgres:14-alpine
+    image: postgres:17-alpine
     restart: unless-stopped
     volumes:
       - /mnt/speed/dbs/postgres/tandoor/:/var/lib/postgresql/data

ansible/roles/tandoor/tasks/main.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -17,4 +16,3 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart tandoor
-  become: true

ansible/roles/traefik/files/docker-compose.yml

@@ -3,7 +3,8 @@ services:
     image: traefik:v2.11
     user: "{{ docker_user.id }}"
     environment:
-      - GANDIV5_PERSONAL_ACCESS_TOKEN={{ vault_gandi_personal_access_token }}
+      - CF_DNS_API_TOKEN={{ vault_cloudflare_api_token }}
+      - GANDIV5_API_KEY={{ vault_gandi_api_key }}
     volumes:
       - ./traefik:/etc/traefik
     restart: unless-stopped
@@ -28,6 +29,8 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
     networks:
       - proxy_private
+    tmpfs:
+      - /run
     logging:
       driver: none
 

ansible/roles/traefik/files/traefik.yml

@@ -50,6 +50,17 @@ api:
 
 certificatesResolvers:
   le:
+    acme:
+      email: "{{ vault_letsencrypt_email }}"
+      storage: /etc/traefik/acme.json
+      dnsChallenge:
+        provider: cloudflare
+        delayBeforeCheck: 0
+        resolvers:
+          - 1.1.1.1:53
+          - 1.0.0.1:53
+
+  gandi:
     acme:
       email: "{{ vault_letsencrypt_email }}"
       storage: /etc/traefik/acme.json
@@ -57,8 +68,8 @@ certificatesResolvers:
         provider: gandiv5
         delayBeforeCheck: 0
         resolvers:
-          - 9.9.9.9:53
-          - 149.112.112.112:53
+          - 1.1.1.1:53
+          - 1.0.0.1:53
 
 serversTransport:
   insecureSkipVerify: true

ansible/roles/traefik/tasks/main.yml

@@ -5,7 +5,6 @@
   docker_network:
     name: traefik
     internal: true
-  become: true
 
 - name: Create install directory
   file:
@@ -13,7 +12,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Create config directory
   file:
@@ -21,7 +19,6 @@
     state: directory
     mode: "{{ docker_compose_directory_mask }}"
     owner: "{{ docker_user.name }}"
-  become: true
 
 - name: Create file provider directory
   file:
@@ -29,7 +26,6 @@
     state: directory
     mode: "{{ docker_compose_directory_mask }}"
     owner: "{{ docker_user.name }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -39,7 +35,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart traefik
-  become: true
 
 - name: Install config
   template:
@@ -50,7 +45,6 @@
     lstrip_blocks: true
     trim_blocks: true
   notify: restart traefik
-  become: true
 
 - name: Install file provider
   template:
@@ -59,7 +53,6 @@
     mode: "{{ docker_compose_file_mask }}"
     owner: "{{ docker_user.name }}"
   notify: restart traefik
-  become: true
 
 - name: Install homeassistant provider
   template:
@@ -69,7 +62,6 @@
     owner: "{{ docker_user.name }}"
   notify: restart traefik
   when: traefik_provider_homeassistant
-  become: true
 
 - name: Install jellyfin provider
   template:
@@ -79,7 +71,6 @@
     owner: "{{ docker_user.name }}"
   notify: restart traefik
   when: traefik_provider_jellyfin
-  become: true
 
 - name: Install grafana provider
   template:
@@ -89,7 +80,6 @@
     owner: "{{ docker_user.name }}"
   notify: restart traefik
   when: traefik_provider_grafana
-  become: true
 
 - name: Install uptime-kuma provider
   template:
@@ -99,4 +89,3 @@
     owner: "{{ docker_user.name }}"
   notify: restart traefik
   when: traefik_provider_uptime_kuma
-  become: true

ansible/roles/traefik/vars/vault.yml

@@ -1,11 +1,14 @@
 $ANSIBLE_VAULT;1.1;AES256
-30393461663462666434333462386264383831333936633961636237616338303335393861626336
-3566306338633735613431393736653061636536353335620a366335623630643137343863636161
-37383436323439393965623436393465626362633134346239356463633936396236666164333762
-3565623930353964620a303965626164396536646336313438346464663236633465353036303935
-30373230393432643330663434313637396234306563336137653861333839623530636465653532
-37363239663939303834633332656365363437356236633933313339656563343130383262626539
-61363762663630366430326635386163613936653938303366636363363334643035396233646430
-32636431616335326264343931343064646363393736303263633038623562623965393763636562
-35316264636264366161326463343730613232663539306532303838656338343535376439343834
-3234663334333866376233336538343264623930653662303835
+63373634636339343234383662613339643138346430336463613834363661376334303131656565
+6439633136396264356263663961383565636138333135660a366239313136663331386139386566
+61653432613237656635316336313064396433393939306330353739343439336165653866343030
+6432366565396639640a636662356238636130326237613632643738643639313664393639323561
+39633939353663386566396534366166646631353461643062373363393566306538653730306362
+36306532343933643830643564313166366530363139623564633061623238303866633037383032
+31313765393134326561626264323336356539376263333765366162613363313138633932396136
+35663737366132613133376431643333663466363737386664663036623839616333653231366536
+38356566653933316462333462616362623535643866636332356563326136356563616632323034
+39303437363535636433353961353964313733333164396538643563343338633432343232346235
+39626331376163356466313435616362613334346132666461633566393662363039393363613366
+63613333643039626161653962353636366364353730383534336662336138643231333864633536
+3232

ansible/roles/uptime_kuma/tasks/main.yml

@@ -4,7 +4,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -14,4 +13,3 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart uptime-kuma
-  become: true

ansible/roles/vaultwarden/files/docker-compose.yml

@@ -35,7 +35,7 @@ services:
       - traefik
 
   db:
-    image: postgres:14-alpine
+    image: postgres:17-alpine
     restart: unless-stopped
     volumes:
       - /mnt/speed/dbs/postgres/vaultwarden/:/var/lib/postgresql/data

ansible/roles/vaultwarden/tasks/main.yml

@@ -4,7 +4,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -14,4 +13,3 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart vaultwarden
-  become: true

ansible/roles/vikunja/files/docker-compose.yml

@@ -38,7 +38,7 @@ services:
       - traefik
 
   db:
-    image: postgres:14-alpine
+    image: postgres:17-alpine
     restart: unless-stopped
     volumes:
       - /mnt/speed/dbs/postgres/vikunja/:/var/lib/postgresql/data

ansible/roles/vikunja/tasks/main.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -17,4 +16,3 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart vikunja
-  become: true

ansible/roles/website/files/docker-compose.yml

@@ -28,7 +28,7 @@ services:
       - redis
 
   db:
-    image: postgres:14-alpine
+    image: postgres:17-alpine
     restart: unless-stopped
     volumes:
       - ./postgres:/var/lib/postgresql/data

ansible/roles/website/tasks/main.yml

@@ -7,7 +7,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -17,7 +16,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart website
-  become: true
 
 - name: Install nginx config
   template:
@@ -25,7 +23,6 @@
     dest: /etc/nginx/http.d/website.conf
     mode: "0644"
   notify: reload nginx
-  become: true
   vars:
     server_name: theorangeone.net
     upstream: website-website-1.docker:8000

ansible/roles/yourls/files/docker-compose.yml

@@ -16,6 +16,7 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.yourls.rule=Host(`0rng.one`)
+      - traefik.http.routers.yourls.tls.certresolver=gandi
     networks:
       - default
       - traefik

ansible/roles/yourls/tasks/main.yml

@@ -4,7 +4,6 @@
     state: directory
     owner: "{{ docker_user.name }}"
     mode: "{{ docker_compose_directory_mask }}"
-  become: true
 
 - name: Install compose file
   template:
@@ -14,7 +13,6 @@
     owner: "{{ docker_user.name }}"
     validate: docker-compose -f %s config
   notify: restart yourls
-  become: true
 
 - name: Install redirect file
   template:
@@ -23,4 +21,3 @@
     mode: "{{ docker_compose_file_mask }}"
     owner: "{{ docker_user.name }}"
   notify: restart yourls
-  become: true

ansible/roles/zfs/tasks/main.yml

@@ -3,7 +3,6 @@
     src: files/zfs-modprobe.conf
     dest: /etc/modprobe.d/zfs.conf
     mode: "0644"
-  become: true
 
 - name: ZFS Scrub
   cron:
@@ -12,14 +11,12 @@
     minute: 0
     weekday: 5
     job: zpool scrub {{ item }}
-  become: true
   loop: "{{ zpools_to_scrub }}"
 
 - name: Give user passwordless access to ZFS commands
   lineinfile:
     path: /etc/sudoers
     line: "{{ me.user }} ALL=(ALL) NOPASSWD: /usr/sbin/zfs,/usr/sbin/zpool"
-  become: true
 
 - name: Sanoid
   include_tasks: sanoid.yml

ansible/roles/zfs/tasks/sanoid.yml

@@ -8,7 +8,6 @@
     - pv
     - lzop
   when: ansible_os_family == 'Archlinux'
-  become: true
 
 - name: Install dependencies for Debian-based distros
   package:
@@ -20,28 +19,24 @@
     - lzop
     - mbuffer
   when: ansible_os_family == 'Debian'
-  become: true
 
 - name: Download
   git:
     repo: https://github.com/jimsalterjrs/sanoid.git
     dest: /opt/sanoid
     version: v2.1.0
-  become: true
 
 - name: Create config directory
   file:
     path: /etc/sanoid
     state: directory
     mode: "0755"
-  become: true
 
 - name: Install default config
   file:
     src: /opt/sanoid/sanoid.defaults.conf
     dest: /etc/sanoid/sanoid.defaults.conf
     state: link
-  become: true
 
 - name: Install executables
   file:
@@ -53,14 +48,12 @@
     - syncoid
     - findoid
     - sleepymutex
-  become: true
 
 - name: Install config
   template:
     src: files/sanoid.conf
     dest: /etc/sanoid/sanoid.conf
     mode: "0755"
-  become: true
 
 - name: Install systemd services
   file:
@@ -68,7 +61,6 @@
     dest: /lib/systemd/system/{{ item }}
     state: link
   loop: "{{ sanoid_services }}"
-  become: true
 
 - name: Enable systemd services
   systemd:
@@ -76,10 +68,8 @@
     enabled: true
     masked: false
   loop: "{{ sanoid_services }}"
-  become: true
 
 - name: Start sanoid timer
   systemd:
     name: sanoid.timer
     state: started
-  become: true

justfile

@@ -5,9 +5,13 @@ export PATH := justfile_directory() + "/env/bin:" + env_var("PATH")
 @default:
   just --list
 
-ansible-setup:
+ansible-setup: ansible-install ansible-galaxy-install
+
+ansible-install:
     python -m venv env
     pip install -r ansible/dev-requirements.txt
+
+ansible-galaxy-install: ansible-install
     cd ansible/ && ansible-galaxy install -r galaxy-requirements.yml --force
 
 @ansible-facts HOST:
@@ -30,7 +34,7 @@ update-secrets:
     bw sync
     cd terraform/ && bw get attachment .env --itemid c4f8b44e-ae62-442d-a9e0-02d0621c2454
 
-ansible-deploy *ARGS:
+ansible-deploy *ARGS: ansible-galaxy-install
     cd ansible/ && ansible-playbook main.yml --vault-password-file=vault-pass.sh -K --diff {{ ARGS }}
 
 ansible-vault ACTION *ARGS:

terraform/0rng.one.tf

@@ -8,7 +8,7 @@ resource "gandi_livedns_record" "orngone_apex" {
   type = "ALIAS" # Gandi doesn't support CNAME-flattening
   ttl  = 3600
   values = [
-    gandi_livedns_record.sys_domain_pve.href
+    cloudflare_record.sys_domain_pve.hostname
   ]
 }
 
@@ -21,3 +21,14 @@ resource "gandi_livedns_record" "orngone_caa" {
     "0 issue \"letsencrypt.org\""
   ]
 }
+
+
+resource "gandi_livedns_record" "orngone_who" {
+  zone = gandi_livedns_domain.orngone.id
+  name = "who"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    "${cloudflare_record.sys_domain_pve.hostname}."
+  ]
+}