2023-04-04 08:56:13 +00:00
11 changed files with 90 additions and 45 deletions
--- a/roles/arrstack/templates/custom-init/setup-wg.sh.j2
+++ b/roles/arrstack/templates/custom-init/setup-wg.sh.j2
@ -1,6 +1,5 @@
 #!/usr/bin/env bash
-
-apk add --no-cache wireguard-tools-wg
+set -x

 local_gateway=$(ip route | grep default | awk '{print $3}')
 # This used as the gateway address for NAT-PMP to work properly
@ -19,5 +18,9 @@ ip route add default via "$wg_gateway"
 # Note that the DNS isn't changed, so there's actually a leak there
 # That's on purpose, just in case I want to access local jackett from qbit

+# Still need to figure out how to make this work with IPv6
+# Prevent IPv6 leaks
+# ip -6 route del default
+
 # Finally, optionally allow access to the home network
 # ip route add "\{\{ home_network }}" via "$local_gateway"
--- a/roles/arrstack/templates/docker-compose.yml.j2
+++ b/roles/arrstack/templates/docker-compose.yml.j2
@ -1,9 +1,11 @@
-{% from "contrib/compose_helpers.j2" import traefik_labels with context %}
+{% import 'contrib/compose_helpers.j2' as helpers with context %}
 {##}
-version: "3.7"
+version: "3.9"

 networks:
-  default:
+{#  {{ helpers.default_network(249) | indent(2) }}#}
+  # TODO: Figure out IPv6 leaks
+  ipv4_only:
  traefik_traefik:
    external: true

@ -14,10 +16,13 @@ services:
    cap_add:
      - NET_ADMIN
    labels:
-      - {{ traefik_labels("qbit", port="8080", auth=true) | indent(6) }}
+      - {{ helpers.traefik_labels('qbit', port='8080', auth=true) | indent(6) }}
    restart: unless-stopped
+    environment:
+      - DOCKER_MODS=linuxserver/mods:universal-package-install
+      - INSTALL_PACKAGES=wireguard-tools-wg
    networks:
-      - default
+      - ipv4_only
      - traefik_traefik
    volumes:
      - ./wireguard:/etc/wireguard:ro
@ -31,12 +36,12 @@ services:
    image: linuxserver/prowlarr:latest
    container_name: prowlarr
    labels:
-      - {{ traefik_labels("prowlarr", port="9696", auth=true) | indent(6) }}
+      - {{ helpers.traefik_labels('prowlarr', port='9696', auth=true) | indent(6) }}
    restart: unless-stopped
    depends_on:
      - qbittorrent
    networks:
-      - default
+      - ipv4_only
      - traefik_traefik
    volumes:
      - {{ base_volume_path }}/arrstack/config/prowlarr:/config
@ -45,12 +50,12 @@ services:
    image: linuxserver/sonarr:latest
    container_name: sonarr
    labels:
-      - {{ traefik_labels("sonarr", port="8989", auth=true) | indent(6) }}
+      - {{ helpers.traefik_labels('sonarr', port='8989', auth=true) | indent(6) }}
    restart: unless-stopped
    depends_on:
      - qbittorrent
    networks:
-      - default
+      - ipv4_only
      - traefik_traefik
    volumes:
      - {{ base_volume_path }}/arrstack/config/sonarr:/config
@ -61,12 +66,12 @@ services:
    image: linuxserver/radarr:latest
    container_name: radarr
    labels:
-      - {{ traefik_labels("radarr", port="7878", auth=true) | indent(6) }}
+      - {{ helpers.traefik_labels('radarr', port='7878', auth=true) | indent(6) }}
    restart: unless-stopped
    depends_on:
      - qbittorrent
    networks:
-      - default
+      - ipv4_only
      - traefik_traefik
    volumes:
      - {{ base_volume_path }}/arrstack/config/radarr:/config
--- a/roles/arrstack/templates/wireguard/wg0.conf.j2
+++ b/roles/arrstack/templates/wireguard/wg0.conf.j2
@ -7,5 +7,5 @@ PrivateKey = {{ wg_privkey }}

 [Peer]
 PublicKey = {{ wg_peer_pubkey }}
-AllowedIPs = 0.0.0.0/0
+AllowedIPs = 0.0.0.0/0,::0/0
 Endpoint = {{ wg_peer_endpoint }}
--- a/roles/authentik/templates/docker-compose.yml.j2
+++ b/roles/authentik/templates/docker-compose.yml.j2
@ -1,9 +1,9 @@
-{% from "contrib/compose_helpers.j2" import traefik_labels with context %}
+{% import 'contrib/compose_helpers.j2' as helpers with context %}
 {##}
-version: "3.7"
+version: "3.9"

 networks:
-  default:
+  {{ helpers.default_network(253) | indent(2) }}
  traefik_traefik:
    external: true

@ -12,11 +12,14 @@ services:
    image: ghcr.io/goauthentik/server:${AUTHENTIK_VERSION}
    container_name: authentik_server
    labels:
-      - {{ traefik_labels("auth", port="9000") | indent(6) }}
-      - traefik.http.middlewares.authentik.forwardauth.address=http://authentik_server:9000/outpost.goauthentik.io/auth/traefik
+      - {{ helpers.traefik_labels('auth', port='9000') | indent(6) }}
+      - traefik.http.middlewares.authentik.forwardauth.address=http://localhost:9000/outpost.goauthentik.io/auth/traefik
      - traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true
      - traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version
    restart: unless-stopped
+    # Port forward is needed because traefik can't resolve the container name from the host network
+    ports:
+      - "9000:9000"
    command: server
    env_file:
      - .env.authentik
@ -61,3 +64,5 @@ services:
      interval: 30s
      retries: 5
      timeout: 3s
+    volumes:
+      - {{ base_volume_path }}/authentik/redis:/data
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@ -4,7 +4,7 @@
    name:
     - docker-ce
     - docker-compose-plugin
-     - ufw
+     - firewalld
    state: latest

 - name: Upgrade Debian packages
@ -19,23 +19,41 @@

 - name: Allow SSH
  become: yes
-  ufw:
-    rule: allow
-    name: OpenSSH
+  firewalld:
+    service: ssh
+    permanent: yes
+    state: enabled
+    immediate: yes

 - name: Allow Web
  become: yes
-  ufw:
-    rule: allow
-    name: WWW Full
+  firewalld:
+    service: http
+    permanent: yes
+    state: disabled
+    immediate: yes
+
+- name: Allow Web Secure
+  become: yes
+  firewalld:
+    service: https
+    permanent: yes
+    state: enabled
+    immediate: yes
+
+- name: Allow 443 udp for http3
+  become: yes
+  firewalld:
+    port: 443/udp
+    permanent: yes
+    state: enabled
+    immediate: yes

 - name: Enable Firewall
  become: yes
-  ufw:
+  firewalld:
    state: enabled
-    policy: reject
-    direction: incoming
-    logging: on
+    immediate: yes

 - name: Reboot if needed
  become: yes
--- a/roles/docker_host/tasks/main.yml
+++ b/roles/docker_host/tasks/main.yml
@ -25,9 +25,19 @@
    mode: "0644"
  register: docker_daemon_config

+- name: Remove docker0 from firewalld trusted zone
+  become: yes
+  firewalld:
+    zone: trusted
+    interface: docker0
+    permanent: yes
+    immediate: yes
+    state: disabled
+  register: docker0_firewalld
+
 - name: Restart Docker daemon
  become: yes
  service:
    name: docker
    state: restarted
-  when: docker_daemon_config.changed
+  when: docker_daemon_config.changed or docker0_firewalld.changed
--- a/roles/gitea/templates/docker-compose.yml.j2
+++ b/roles/gitea/templates/docker-compose.yml.j2
@ -1,9 +1,9 @@
-{% from "contrib/compose_helpers.j2" import traefik_labels with context %}
+{% import 'contrib/compose_helpers.j2' as helpers with context %}
 {##}
-version: "3.7"
+version: "3.9"

 networks:
-  default:
+  {{ helpers.default_network(252) | indent(2) }}
  traefik_traefik:
    external: true

@ -12,7 +12,7 @@ services:
    image: gitea/gitea:1.18
    container_name: gitea_server
    labels:
-      - {{ traefik_labels("gitea", port="3000") | indent(6) }}
+      - {{ helpers.traefik_labels('gitea', port='3000') | indent(6) }}
    restart: unless-stopped
    env_file:
      - .env.gitea
--- a/roles/jellyfin/templates/docker-compose.yml.j2
+++ b/roles/jellyfin/templates/docker-compose.yml.j2
@ -1,9 +1,9 @@
-{% from "contrib/compose_helpers.j2" import traefik_labels with context %}
+{% import 'contrib/compose_helpers.j2' as helpers with context %}
 {##}
-version: "3.7"
+version: "3.9"

 networks:
-  default:
+  {{ helpers.default_network(250) | indent(2) }}
  traefik_traefik:
    external: true

@ -12,7 +12,7 @@ services:
    image: jellyfin/jellyfin:10.8.6
    container_name: jellyfin_jellyfin
    labels:
-      - {{ traefik_labels("jellyfin", port="8096") | indent(6) }}
+      - {{ helpers.traefik_labels('jellyfin', port='8096') | indent(6) }}
    restart: unless-stopped
    env_file:
      - .env.jellyfin
--- a/roles/nextcloud/templates/docker-compose.yml.j2
+++ b/roles/nextcloud/templates/docker-compose.yml.j2
@ -1,9 +1,9 @@
-{% from "contrib/compose_helpers.j2" import traefik_labels with context %}
+{% import 'contrib/compose_helpers.j2' as helpers with context %}
 {##}
-version: "3.7"
+version: "3.9"

 networks:
-  default:
+  {{ helpers.default_network(251) | indent(2) }}
  traefik_traefik:
    external: true

@ -83,7 +83,7 @@ services:
    image: nginx:1.23-alpine
    container_name: nextcloud_web
    labels:
-      - {{ traefik_labels("nc") | indent(6) }}
+      - {{ helpers.traefik_labels('nc') | indent(6) }}
    restart: unless-stopped
    links:
      - app
--- a/roles/traefik/templates/traefik.yml.j2
+++ b/roles/traefik/templates/traefik.yml.j2
@ -8,12 +8,16 @@ accessLog:
  filePath: /logs/access.log
  bufferingSize: 100

+experimental:
+  http3: true
+
 entryPoints:
  web:
    address: ":80"
-
  websecure:
    address: ":443"
+    http3:
+      advertisedPort: 443

 certificatesResolvers:
  letsencrypt:
--- a/services.yml
+++ b/services.yml
@ -3,9 +3,9 @@
    - docker_host
    - traefik
    - authentik
+    - gitea
    - nextcloud
    - jellyfin
-    - gitea
    - arrstack
  post_tasks:
    - name: Docker prune objects