README.md

@@ -3,7 +3,7 @@
 This is my failsafe (and also my helpful migration tool) for restoring the OpenPunk server. This handles setting everything back up, including:
 
 - gitea
-    - backup and restoring are also supported
+    - sadly, no db migration is supported right now. maybe a future todo?
 - blog
     - cron job for grabbing the `HEAD` of https://github.com/CPunch/openpunk && building the hugo site
 - tor mirror
@@ -30,18 +30,6 @@ ansible-playbook -i hosts --ask-vault-pass run.yml
 ```
 > NOTE: The 'secrets' directory has been omitted from this repo (so it's not going to run without the provided files)
 
-## Backup and restore
-
-Backup Gitea using the 'backup' tag
-```sh
-ansible-playbook -i hosts run.yml --tags backup
-```
-
-then, restore from the backup using the 'restore' tag
-```sh
-ansible-playbook -i hosts run.yml --tags restore
-```
-
 ## Example hosts file
 ```
 [hosts]

roles/essential/tasks/main.yml

@@ -15,15 +15,9 @@
       - fail2ban
       - goaccess
       - htop
-      - sqlite3
       - zsh # :D
       - python3-certbot-nginx
 
-- name: Grab package facts
-  package_facts:
-    manager: auto
-  tags: always
-
 - name: Setup zsh
   user:
     name: "{{ ansible_user }}"

roles/gitea/defaults/main.yml

@@ -1,3 +1,2 @@
 ---
-giteaPort: 3000
+giteaPort: 3000
-giteaBackup: backups/gitea-dump.zip

roles/gitea/tasks/backup.yml

@@ -1,51 +1,26 @@
 ---
-# based on advice from https://docs.gitea.io/en-us/backup-and-restore/
-
 - name: Stop Gitea
   systemd:
     name: gitea
     enabled: yes
     state: stopped
-  tags: backup
-
-- name: Make Temp dir
-  file:
-    path: /etc/gitea/temp
-    state: directory
-    owner: gitea
-  tags: backup
 
 - name: Dump Gitea
   shell:
-    cmd: gitea dump -c /etc/gitea/app.ini --work-path=/etc/gitea --file=gitea-dump.zip --tempdir=/etc/gitea/temp
+    cmd: gitea dump -c /etc/gitea/app.ini --work-path=/etc/gitea --file=gitea-dump.zip
     chdir: /etc/gitea
   become: true
   become_method: su
   become_user: gitea
-  tags: backup
-
-- name: Fetch backup
-  fetch:
-    src: /etc/gitea/gitea-dump.zip
-    dest: "{{ giteaBackup }}"
-    flat: true
-  tags: backup
-
-- name: Remove remote dump
-  file:
-    path: "{{ giteaBackup }}"
-    state: absent
-  tags: backup
-
-- name: Remove Temp
-  file:
-    path: /etc/gitea/temp
-    state: absent
-  tags: backup
 
 - name: Start Gitea
   systemd:
     name: gitea
     enabled: yes
     state: started
-  tags: backup
+
+- name: Fetch backup
+  fetch:
+    src: /etc/gitea/gitea-dump.zip
+    dest: backups/gitea-dump.zip
+    flat: true

roles/gitea/tasks/main.yml

@@ -4,36 +4,42 @@
     path: /etc/apt/trusted.gpg.d/morph027-gitea.gpg
   register: gitea_key
 
-- name: Add Gitea key, repository && install
+- name: Grab package facts
+  package_facts:
+    manager: auto
+
+- name: Install Gitea
   block:
-    - name: Import Gitea key
+    - name: Add Gitea key, repository && install
-      shell: curl -s https://packaging.gitlab.io/gitea/gpg.key | sudo gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/morph027-gitea.gpg --import && sudo chmod 644 /etc/apt/trusted.gpg.d/morph027-gitea.gpg
+      block:
-      when: gitea_key.stat.exists == false or gitea_key.stat.mode != "0644"
+        - name: Import Gitea key
+          shell: curl -s https://packaging.gitlab.io/gitea/gpg.key | sudo gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/morph027-gitea.gpg --import && sudo chmod 644 /etc/apt/trusted.gpg.d/morph027-gitea.gpg
+          when: gitea_key.stat.exists == false or gitea_key.stat.mode != "0644"
 
-    - name: Add Gitea repository
+        - name: Add Gitea repository
-      apt_repository:
+          apt_repository:
-        filename: morph027-gitea
+            filename: morph027-gitea
-        repo: deb https://packaging.gitlab.io/gitea gitea main
+            repo: deb https://packaging.gitlab.io/gitea gitea main
 
-    - name: Add Gitea package
+        - name: Add Gitea package
-      package:
+          package:
-        name: gitea
+            name: gitea
+      when: "'gitea' not in ansible_facts.packages"
 
     - name: Configure Gitea
       template:
         src: templates/app.ini
         dest: /etc/gitea/app.ini
         owner: gitea
-  when: "'gitea' not in ansible_facts.packages"
+        force: no # we don't want to kill our existing config D:
 
-- name: Backup db
+    - name: Reload Gitea
-  include_tasks: backup.yml
+      systemd:
-  tags:
+        name: gitea
-    - never
+        enabled: yes
-    - backup
+        state: started
 
-- name: Restore db
+    - name: Backup db
-  include_tasks: restore.yml
+      include_tasks: backup.yml
-  tags:
+      tags: ['never', 'backup']
-    - never
+  tags: ['gitea', 'backup']
-    - restore

roles/gitea/tasks/restore.yml

@@ -1,92 +0,0 @@
----
-# based on advice from https://docs.gitea.io/en-us/backup-and-restore/
-
-- name: Stop Gitea
-  systemd:
-    name: gitea
-    enabled: yes
-    state: stopped
-  tags: restore
-
-- name: Make restore dir
-  file:
-    path: /etc/gitea/gitea-dump
-    state: directory
-    owner: gitea
-  tags: restore
-
-- name: Extract backup to host
-  unarchive:
-    src: "{{ giteaBackup }}"
-    dest: /etc/gitea/gitea-dump
-    owner: gitea
-  tags: restore
-
-- name: Delete Gitea
-  file:
-    path: /var/lib/gitea
-    state: absent
-  tags: restore
-
-- name: Create Gitea
-  file:
-    path: /var/lib/gitea
-    state: directory
-    owner: gitea
-  tags: restore
-
-- name: Install data
-  copy:
-    src: /etc/gitea/gitea-dump/data/
-    dest: /var/lib/gitea/data
-    remote_src: true
-    owner: gitea
-  tags: restore
-
-- name: Install log
-  copy:
-    src: /etc/gitea/gitea-dump/log/
-    dest: /var/lib/gitea/log/
-    remote_src: true
-    owner: gitea
-  tags: restore
-  ignore_errors: true
-
-- name: Install repositories
-  copy:
-    src: /etc/gitea/gitea-dump/repos/
-    dest: /var/lib/gitea/gitea-repositories/
-    remote_src: true
-    owner: gitea
-  tags: restore
-
-- name: Install config
-  copy:
-    src: /etc/gitea/gitea-dump/app.ini
-    dest: /etc/gitea/app.ini
-    owner: gitea
-    remote_src: true
-  tags: restore
-
-- name: Generate sqlite3 db
-  shell: sqlite3 /var/lib/gitea/data/gitea.db </etc/gitea/gitea-dump/gitea-db.sql
-  become: true
-  become_method: su
-  become_user: gitea
-  tags: restore
-
-- name: Start Gitea
-  systemd:
-    name: gitea
-    enabled: yes
-    state: started
-  tags: restore
-
-- name: Finalize
-  shell:
-    cmd: ./gitea admin regenerate hooks -c /etc/gitea/app.ini
-    chdir: /usr/bin
-  become: true
-  become_method: su
-  become_user: gitea
-  tags: restore

roles/gitea/templates/app.ini

@@ -43,7 +43,6 @@ NO_REPLY_ADDRESS                  = noreply.localhost
 [picture]
 DISABLE_GRAVATAR        = true
 ENABLE_FEDERATED_AVATAR = false
-REPOSITORY_AVATAR_FALLBACK = random
 
 [openid]
 ENABLE_OPENID_SIGNIN = false

roles/nginx/tasks/main.yml

@@ -23,6 +23,12 @@
     force: no
   notify: setup nginx
 
+- name: Uninstall nginx config for git.{{ domain }}
+  file:
+    path: /etc/nginx/conf.d/git.{{ domain }}.conf
+    state: absent
+  notify: setup nginx
+
 - name: Install nginx config for our Hidden Service
   template:
     src: templates/tor.conf

roles/nginx/tasks/setup.yml

@@ -1,6 +1,9 @@
 ---
-- name: Setup certbot
+- name: Setup certbot for {{ domain }}
-  shell: "certbot --nginx --non-interactive --agree-tos --email {{ contact_email }} -d {{ domain }} -d git.{{ domain }}"
+  shell: "certbot --nginx --non-interactive --agree-tos -m {{ contact_email }} -d {{ domain }}"
+
+- name: Setup certbot for git.{{ domain }}
+  shell: "certbot --nginx --non-interactive --agree-tos -m {{ contact_email }} -d git.{{ domain }}"
 
 - name: Reload Nginx
   systemd:

run.yml

@@ -11,12 +11,10 @@
     - role: essential
     - role: firewall
     - role: git
-      tags: secrets
     - role: deadswitch
-      tags: secrets
     - role: blog
     - role: gitea
+      tags: [backup]
     - role: nginx
     - role: goaccess
-    - role: tor
+    - role: tor
-      tags: secrets