Deploy to localhost instead of seperate VM

ansible.cfg

@@ -1,4 +0,0 @@
-[defaults]
-roles_path = ./roles
-remote_user = ansible
-inventory = ./inventory.yml

handlers.yml

@@ -1,5 +0,0 @@
-- name: restart sentry
-  systemd:
-    name: sentry
-    state: restarted
-    enabled: true

inventory.yml

@@ -1,3 +0,0 @@
-sentry:
-  hosts:
-    192.168.178.73:

playbook.yml

@@ -1,36 +1,9 @@
-- hosts: sentry
+# Note: this playbook requires the `docker` and `docker-compose` pip packages
-  become: true
+# in order for the `docker_compose` module to work
-  become_method: sudo
+- hosts: localhost
-  pre_tasks:
-    - include_role:
-        name: common
-        tasks_from: 'setup.yml'
-    - include_role:
-        name: common
-        tasks_from: 'network.yml'
-    - include_role:
-        name: common
-        tasks_from: 'host.yml'
-    - include_role:
-        name: common
-        tasks_from: 'sudoers.yml'
-      loop:
-        - { src: '../../templates/sudoers.j2', dest: '/etc/sudoers.d/30-ansible-extra' }
-  roles:
-    - common
   tasks:
-    - include_role:
-        name: common
-        tasks_from: 'ssl.yml'
-    - include_role:
-        name: common
-        tasks_from: 'nginx.yml'
-    - import_tasks: 'tasks/docker.yml'
     - import_tasks: 'tasks/main.yml'
-  handlers:
-    - import_tasks: 'handlers.yml'
   vars_files:
     - 'vars/main.yml'
-    - 'vars/network.yml'
     - 'vars/postgres.yml'
     - 'vars/email.yml'

requirements.yml

@@ -1,4 +0,0 @@
-- src: git+https://git.fudiggity.nl/ansible/common.git
-  name: common
-  version: master
-  scm: git

tasks/docker.yml

@@ -1,42 +0,0 @@
-- name: add docker gpg key
-  apt_key:
-    id: '0EBFCD88'
-    url: 'https://download.docker.com/linux/debian/gpg'
-    validate_certs: true
-    state: present
-
-- name: add docker repo
-  apt_repository:
-    repo: 'deb https://download.docker.com/linux/debian buster stable'
-    validate_certs: true
-    state: present
-
-- name: install docker
-  apt:
-    name:
-      - docker-ce
-      - docker-ce-cli
-      - containerd.io
-    state: present
-
-- name: check docker-compose existence
-  stat:
-    path: '/usr/local/bin/docker-compose'
-  register: docker_compose_stat
-
-- name: download docker-compose
-  get_url:
-    url: 'https://github.com/docker/compose/releases/download/1.26.0/docker-compose-Linux-x86_64'
-    dest: '/usr/local/bin/docker-compose'
-    mode: '0755'
-  when: docker_compose_stat.stat.isfile is not defined
-
-- name: add sentry user
-  user:
-    name: sentry
-    create_home: true
-    shell: '/bin/bash'
-    groups:
-      - sudo
-      - docker
-    append: true

tasks/main.yml

@@ -1,51 +1,14 @@
-- name: copy sentry systemd service
-  template:
-    src: '{{ item.src }}'
-    dest: '{{ item.dest }}'
-    owner: '{{ app_user }}'
-    group: '{{ app_user }}'
-    mode: '0644'
-  loop:
-    - { src: 'templates/sentry.systemd.j2', dest: '/etc/systemd/system/sentry.service' }
-  notify: restart sentry
-
-- name: copy firewall templates
-  template:
-    src: '{{ item.src }}'
-    dest: '{{ item.dest }}'
-    owner: root
-    group: root
-    mode: '0600'
-  loop:
-    - { src: 'templates/nftables.j2', dest: '/etc/nftables.conf' }
-
-- name: restart nftables
-  systemd:
-    name: nftables
-    state: restarted
-    enabled: true
-
-- name: ensure sentry is stopped
-  systemd:
-    name: sentry
-    state: stopped
-
-# restart docker after nftables changes so that it applies docker related rules
-- name: restart docker
-  systemd:
-    name: docker
-    state: restarted
-    enabled: true
-
 - name: create sites directory
+  become: true
   file:
-    path: '/srv/sites'
+    path: '/srv/docker'
     state: directory
     owner: root
     group: root
     mode: 0755
 
 - name: create sentry dir
+  become: true
   file:
     path: '{{ app_dir }}'
     state: directory
@@ -54,8 +17,6 @@
     mode: 0755
 
 - name: clone project
-  become_user: '{{ app_user }}'
-  become: true
   git:
     repo: '{{ app_repository }}'
     dest: '{{ app_dir }}'
@@ -73,6 +34,7 @@
     - { src: 'templates/sentry.conf.j2', dest: '{{ app_dir }}/sentry/sentry.conf.py' }
     - { src: 'templates/sentry.config.j2', dest: '{{ app_dir }}/sentry/config.yml' }
 
+# TODO: tag other sentry images aswell
 # can be ran multiple times to upgrade sentry
 - name: run sentry installer
   command: './install.sh'
@@ -80,27 +42,15 @@
     chdir: '{{ app_dir }}'
   environment:
     SENTRY_IMAGE: 'getsentry/sentry:{{ app_branch }}'
-  ignore_errors: true
+    SENTRY_BIND: '{{ bind_address }}'
+  register: installer_output
 
-- name: copy nginx sentry config
+- name: log installer output
-  template:
+  debug:
-    src: 'templates/nginx.j2'
+    var: installer_output.stdout_lines
-    dest: '/etc/nginx/sites-available/{{ app_name }}'
-    owner: root
-    group: root
-    mode: '0644'
 
-- name: link nginx config
+- name: start sentry
-  file:
+  docker_compose:
-    src: '/etc/nginx/sites-available/{{ app_name }}'
+    project_src: '{{ app_dir }}'
-    dest: '/etc/nginx/sites-enabled/{{ app_name }}'
+    build: false
-    owner: root
+    restarted: true
-    group: root
-    mode: '0777'
-    state: link
-
-- name: ensure nginx is restarted
-  systemd:
-    name: nginx
-    state: restarted
-    enabled: true

templates/nftables.j2

@@ -1,33 +0,0 @@
-# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
-#
-# vim:set ts=2 sw=2 et:
-# use uppercase table names for compatibility with docker
-
-flush ruleset
-
-table inet filter {
-	chain INPUT {
-		type filter hook input priority 0; policy drop;
-
-		# accept any localhost traffic
-		iif lo accept
-
-		# accept traffic originated from us
-		ct state { established, related } accept
-
-		tcp dport { 22, 80, 443 } accept
-	}
-
-	chain FORWARD {
-		type filter hook forward priority 0; policy drop;
-		ct state { established, related } accept;
-
-		mark 1 accept
-	}
-}
-
-table ip filter {
-	chain DOCKER-USER {
-		mark set 1
-	}
-}

templates/nginx.j2

@@ -1,26 +0,0 @@
-# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
-#
-server {
-	listen 80;
-	server_name {{ app_name }}.fudiggity.nl;
-	return 301 https://$server_name$request_uri;
-}
-
-server {
-	listen 443 ssl;
-	server_name {{ app_name }}.fudiggity.nl;
-
-	ssl_certificate /etc/ssl/{{ app_name }}/{{ app_name }}.crt;
-	ssl_certificate_key /etc/ssl/{{ app_name }}/local.pem;
-
-	access_log /var/log/nginx/{{ app_name }}.log;
-	error_log /var/log/nginx/{{ app_name }}.log;
-
-	location / {
-		include proxy_params;
-
-		proxy_redirect off;
-
-		proxy_pass http://localhost:9000;
-	}
-}

templates/sentry.systemd.j2

@@ -1,17 +0,0 @@
-# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
-#
-[Unit]
-Description=Sentry
-Requires=docker.service
-After=docker.service
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-User={{ app_user }}
-ExecStart=/usr/local/bin/docker-compose up --detach
-ExecStop=/usr/local/bin/docker-compose down
-WorkingDirectory={{ app_dir }}
-
-[Install]
-WantedBy=multi-user.target

templates/sudoers.j2

@@ -1,3 +0,0 @@
-# {{ ansible_managed }} {{ ansible_date_time.time }} {{ ansible_date_time.date }}
-#
-ansible ALL = (sentry:sentry) NOPASSWD: ALL

vars/main.yml

@@ -1,11 +1,13 @@
-default_user: 'sonny'
+# Can either use a port number or an IP:PORT combo, see SENTRY_BIND
+bind_address: '9000'
 
 app_name: 'sentry'
-app_dir: '/srv/sites/sentry'
+app_dir: '/srv/docker/sentry'
 app_url: 'https://sentry.fudiggity.nl'
 app_repository: 'https://github.com/getsentry/onpremise.git'
 app_branch: '21.7.0'
-app_user: 'sentry'
+
+app_user: 'sonny'
 app_key: !vault |
   $ANSIBLE_VAULT;1.1;AES256
   33666233326139613365306263323464666538303862666561313839646435643866663064356263

vars/network.yml

@@ -1,6 +0,0 @@
-hostname: 'sentry.fudiggity.nl'
-host_interface: 'en*'
-host_ip: '192.168.178.73'
-host_subnet: '24'
-host_gateway: '192.168.178.1'
-host_dns: '192.168.178.1'

vars/postgres.yml

@@ -1,12 +1,5 @@
-postgres_host: '192.168.178.165'
+postgres_host: 'postgres'
-postgres_port: '5432'
+postgres_port: ''
-postgres_db: 'sentry'
+postgres_db: 'postgres'
-postgres_user: 'sentry'
+postgres_user: 'postgres'
-postgres_password: !vault |
+postgres_password: ''
-  $ANSIBLE_VAULT;1.1;AES256
-  62306238313361643131646665646161336162626464393839353238363861376462663936666239
-  3166653966303132393563653832653635623131393536640a653037306539666261346232633930
-  34656431386531303234316137396436653635393061393934393839663032386638633264326133
-  6564366362326462640a323835633561363433393435376434306535636339646662343234356530
-  61656162663462616538313835343665333661303963653635346666323933663761376335373832
-  3761303331613539623761626535336330353836373838363963