| 
					
				 | 
			
			
				@@ -1,139 +0,0 @@ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-docker 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-====== 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-This role will install Docker and given a list of containers to deploy, will do the following: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-1. Create needed docker networks 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-2. Open up necessary firewall ports 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-3. Generate docker-compose files (1 per container) 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-4. Ensure container user/group exists 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-5. Ensure container persistent directories exist with correct perms and SELinux contexts 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-6. Generate a systemd service file per container 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-7. Setup systemd timers to automatically pull new and purge old container images 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-Requirements 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				------------- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-This role is only tested on Fedora/CentOS machines. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-Variables 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				---------- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-`container_user`: user name to run containers as (will be generated if not exists)<br> 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-`container_uid`: uid of above user name<br> 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-`container_group`: group name of container_user<br> 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-`container_gid`: gid of above group name<br> 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-Automated pulls and purges are handled by systemd timers. Any valid [systemd timer calendar event expression](https://www.freedesktop.org/software/systemd/man/systemd.timer.html#OnCalendar=) may be passed to them: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-`docker_pull_timer`: weekly<br> 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-`docker_purge_timer`: monthly 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    global_env_vars: # will be set on any container which has include_global_env_vars: true 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-      - PUID={{ container_uid }} 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-      - PGID={{ container_gid }} 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-      - TZ=America/Los_Angeles 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    firewall_ports: # list of ports to open up on the host 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-      - 80/tcp 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-      - 443/tcp 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-Since this role sets up each container individually, if multiple containers need to talk directly to each other container networks must be outlined: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-This role sets up each container as an individual docker-compose.yml file with a 1-to-1 relationship with it's systemd service. This means we can not rely on docker-compose's built-in networking feature for connecting multiple containers together. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-Outline any networks you need via container_networks: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    container_networks: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-      - name: nginx-proxy 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-        driver: bridge 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-        subnet: 172.21.10.0/24 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-        ip_range: 172.21.10.0/24 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-        gateway: 172.21.10.1 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-And specify those networks in the corresponding container's dictionary: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    containers: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-      - name: swag 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-        active: true 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-        image: linuxserver/swag 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-        ports: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          - 80:80 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          - 443:443 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-        volumes: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          - /opt/swag:/config 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-        include_global_env_vars: true 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-        environment: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          - URL=myexamplesite.biz 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          - VALIDATION=http 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          - SUBDOMAINS=www,git, 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          - EMAIL=admin@myexamplesite.biz 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-        restart: unless-stopped 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-        memlimit: 300m 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-        networks: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          - nginx-proxy 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-        - name: gogs 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          active: true 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          image: gogs/gogs 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          ports: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-            - "10022:22" # https://github.com/go-yaml/yaml/issues/34#issuecomment-55772666 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          volumes: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-            - /opt/gogs:/data 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          include_global_env_vars: false 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          restart: unless-stopped 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          memlimit: 500m 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-          networks: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-            - nginx-proxy 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-Usage 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				------ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-This role creates docker-compose.yml files for each entry in the list of containers under the filename:<br> 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-`/root/docker/<name>/docker-compose.yml` 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-It also generates systemd services files of the name:<br> 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-`/etc/systemd/system/<name>.service` 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-This file is a simple wrapper around docker-compose: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    [root@shareunderware ~]# systemctl cat swag.service 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    # /etc/systemd/system/swag.service 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    # This file is managed by Ansible. Any local changes may be wiped out! 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    [Unit] 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    Description=systemd wrapper around docker swag service 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    Requires=docker.service 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    After=docker.service 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    [Service] 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    Restart=always 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    User=root 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    Group=docker 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    ExecStartPre=/usr/bin/docker-compose -f /root/docker/swag/docker-compose.yml down -v 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    ExecStart=/usr/bin/docker-compose -f /root/docker/swag/docker-compose.yml up 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    ExecStop=/usr/bin/docker-compose -f /root/docker/swag/docker-compose.yml down -v 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    [Install] 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    WantedBy=multi-user.target 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-This method allows the logs to be captured via journald and can be queried just like any other service: 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    [root@shareunderware ~]# journalctl -fu swag.service  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    Apr 25 04:20:59 shareunderware docker-compose[1956]: swag    | [cont-init.d] 70-templates: exited 0. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    Apr 25 04:20:59 shareunderware docker-compose[1956]: swag    | [cont-init.d] 90-custom-folders: executing... 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    Apr 25 04:20:59 shareunderware docker-compose[1956]: swag    | [cont-init.d] 90-custom-folders: exited 0. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    Apr 25 04:20:59 shareunderware docker-compose[1956]: swag    | [cont-init.d] 99-custom-files: executing... 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    Apr 25 04:20:59 shareunderware docker-compose[1956]: swag    | [custom-init] no custom files found exiting... 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    Apr 25 04:20:59 shareunderware docker-compose[1956]: swag    | [cont-init.d] 99-custom-files: exited 0. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    Apr 25 04:20:59 shareunderware docker-compose[1956]: swag    | [cont-init.d] done. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    Apr 25 04:20:59 shareunderware docker-compose[1956]: swag    | [services.d] starting services 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    Apr 25 04:20:59 shareunderware docker-compose[1956]: swag    | [services.d] done. 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-    Apr 25 04:21:03 shareunderware docker-compose[1956]: swag    | Server ready 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-License 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-------- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				- 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-GPLv3 
			 |