Added playbook to uninstall puppet/openvox packages

inventory/group_vars/all.yml

@@ -9,6 +9,26 @@ packages_common:
   - 'wget'
   - 'zip'
 
+# common apache config
+apache_listen_ip: '*'
+apache_listen_port: 80
+# merge apache config arrays
+apache_mods_enabled: >-
+  {{
+    (apache_mods_enabled_gitea | default([]))
+    + (apache_mods_enabled_munin | default([]))
+  }}
+apache_vhosts: >-
+  {{
+    (apache_vhosts_gitea | default([]))
+    + (apache_vhosts_munin | default([]))
+  }}
+
+munin_node_allowed_ips:
+  - '^10\.7\.10\.95$'
+  - '^127\.0\.0\.1$'
+  - '^::1$'
+
 ntp_enabled: True
 ntp_timezone: 'America/New_York'
 ntp_package: 'chrony'

inventory/group_vars/gitea_servers.yml

@@ -16,31 +16,17 @@ gitea_require_signin: False
 gitea_enable_push_create_org: True
 gitea_enable_push_create_user: True
 
-# Nginx reverse proxy config
-nginx_worker_processes: "{{ ansible_processor_vcpus|default(ansible_processor_count) }}"
-nginx_worker_connections: '1024'
-nginx_multi_accept: 'off'
-nginx_remove_default_vhost: True
-nginx_vhosts:
-  - listen: '80 default_server'
-    server_name: 'gitea.int.metaunix.net git.metaunix.net'
+# Apache reverse proxy config
+apache_mods_enabled_gitea:
+  - proxy
+  - proxy_http
+  - rewrite
+  - headers
+apache_vhosts_gitea:
+  - servername: git.metaunix.net
+    serveralias: "git.int.metaunix.net gitea.int.metaunix.net {{ ansible_fqdn }}"
+    documentroot: /var/www/html
     extra_parameters: |
-      # Proxy settings for Gitea
-      location / {
-        proxy_pass http://127.0.0.1:3000;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_read_timeout 30;
-      }
-
-      # Optional: serve /assets directly if needed
-      location /assets/ {
-        proxy_pass http://127.0.0.1:3000/assets/;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_read_timeout 30;
-      }
+      ProxyPreserveHost On
+      ProxyPass / http://127.0.0.1:3000/
+      ProxyPassReverse / http://127.0.0.1:3000/

inventory/group_vars/munin_masters.yml

@@ -0,0 +1,52 @@
+---
+
+# Apache frontend configs
+apache_mods_enabled_munin:
+  - proxy
+  - proxy_http
+  - cgi
+  - rewrite
+  - headers
+apache_vhosts_munin:
+  - servername: munin.int.metaunix.net
+    serveralias: "{{ ansible_fqdn }}"
+    documentroot: /var/cache/munin/www
+    extra_parameters: |
+      ScriptAlias /munin-cgi/ /usr/lib/munin/cgi/
+
+      <Directory "/usr/lib/munin/cgi">
+          Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
+          Require all granted
+      </Directory>
+
+      <Directory "/var/cache/munin/www">
+          Require all granted
+      </Directory>
+
+      DirectoryIndex index.html
+
+munin_local_conf_remove: True
+munin_html_strategy: 'cgi'
+munin_graph_strategy: 'cgi'
+munin_max_processes: 4
+munin_alerts:
+  - name: 'Gregory Ballantine'
+    email: 'gballantine@metaunix.net'
+    subject: 'Munin-notification for ${var:group} :: ${var:host}'
+    level: 'warning critical'
+munin_hosts:
+  - name: 'mustafar'
+    address: '127.0.0.1'
+    extra: ['use_node_name yes']
+  - name: 'lb-v3'
+    address: 'lb-v3.int.metaunix.ent'
+    extra: ['use_node_name yes']
+  - name: 'ks-v2.int.metaunx.net'
+    address: 'ks-v2.int.metaunix.net'
+    extra: ['use_node_name yes']
+  - name: 'ns3.int.metaunix.net'
+    address: 'ns3.int.metaunix.net'
+    extra: ['use_node_name yes']
+  - name: 'ns4.int.metaunix.net'
+    address: 'ns4.int.metaunix.net'
+    extra: ['use_node_name yes']

inventory/hosts.ini

@@ -13,6 +13,9 @@ lb-v3 ansible_host=lb-v3.int.metaunix.net
 [kickstart_servers]
 ks-v2 ansible_host=ks-v2.int.metaunix.net
 
+[munin_masters]
+mustafar ansible_host=mustafar
+
 [nameservers]
 #ns1 ansible_host=ns1.int.metaunix.net
 #ns2 ansible_host=ns2.int.metaunix.net

playbooks/apache.yml

@@ -0,0 +1,10 @@
+---
+
+- name: Install Apache
+  hosts:
+    - gitea_servers
+    - munin_masters
+  become: True
+
+  roles:
+    - geerlingguy.apache

playbooks/base.yml

@@ -0,0 +1,36 @@
+---
+
+- name: Uninstall Puppet/OpenVox packages
+  hosts: all
+  become: yes
+  tasks:
+    - name: Uninstall puppet package
+      package:
+        name: 'puppet-agent'
+        state: absent
+    - name: Uninstall puppet-release package
+      package:
+        name: 'puppet8-release'
+        state: absent
+    - name: Uninstall openvox package
+      package:
+        name: 'openvox-agent'
+        state: absent
+    - name: Uninstall openvox-release package
+      package:
+        name: 'openvox8-release'
+        state: absent
+
+- name: Disable Puppet Service if present
+  hosts: all
+  become: yes
+  tasks:
+    - name: Check if Puppet service exists
+      ansible.builtin.service_facts:
+
+    - name: Stop and disable Puppet agent
+      ansible.builtin.service:
+        name: puppet
+        state: stopped
+        enabled: False
+      when: "'puppet.service' in services or 'puppet' in services"

playbooks/gitea.yml

@@ -6,10 +6,3 @@
 
   roles:
     - roles-ansible.gitea
-
-- name: Install Nginx
-  hosts: gitea_servers
-  become: True
-
-  roles:
-    - geerlingguy.nginx

playbooks/munin.yml

@@ -0,0 +1,15 @@
+---
+
+- name: Install Munin master
+  hosts: munin_masters
+  become: True
+
+  roles:
+    - geerlingguy.munin
+
+- name: Install Munin node
+  hosts: all
+  become: True
+
+  roles:
+    - geerlingguy.munin-node

playbooks/nginx.yml

@@ -0,0 +1,8 @@
+---
+
+- name: Install Nginx
+  hosts: web_servers
+  become: True
+
+  roles:
+    - geerlingguy.nginx

playbooks/site.yml

@@ -1,7 +1,11 @@
 ---
 
 - import_playbook: ntp.yml
+- import_playbook: base.yml
 - import_playbook: auth.yml
 - import_playbook: packages.yml
+- import_playbook: munin.yml
 - import_playbook: gitea.yml
+- import_playbook: apache.yml
+- import_playbook: nginx.yml
 - import_playbook: dev.yml

requirements.yml

@@ -5,8 +5,14 @@ collections:
 roles:
   - src: arillso.sudoers
     version: 2.3.0
+  - src: geerlingguy.apache
+    version: 4.2.0
   - src: geerlingguy.git
     version: 3.0.1
+  - src: geerlingguy.munin
+    version: 2.2.0
+  - src: geerlingguy.munin-node
+    version: 1.4.0
   - src: geerlingguy.nginx
     version: 3.3.0
   - src: geerlingguy.nodejs