update ansible collection namespace

README.md

@@ -2,7 +2,7 @@
 
 Terraform + Ansible setup for a self-hosted [Dokploy](https://dokploy.com/) instance.
 
-## Setup
+## Terraform Setup
 
 1. Create a Hetzner Cloud API key
 2. Create a Cloudflare DNS key with `Zone.DNS` edit permission
@@ -74,3 +74,10 @@ env:
   TF_VAR_cloudflare_api_token: ${{ secrets.TF_VAR_CLOUDFLARE_API_TOKEN }}
   TF_VAR_domain_name: ${{ secrets.TF_VAR_DOMAIN_NAME }}
 ```
+
+## Ansible Setup
+
+```yaml
+env:
+  ANSIBLE_SSH_KEY: ${{ secrets.ANSIBLE_SSH_KEY }}
+```

ansible/playbook.yml

@@ -3,6 +3,7 @@
 - name: Setup dokploy machine
   hosts: all
   roles:
-    - role: studio.ansible.base
+    - role: studiovitali.ansible.base
-    - role: studio.ansible.users
+    - role: studiovitali.ansible.users
-    - role: studio.ansible.security
+    - role: studiovitali.ansible.security
+    - role: dokploy

ansible/requirements.yml

@@ -1,7 +1,7 @@
 ## ansible/requirements.yml
 
 collections:
-  - name: studio.ansible
+  - name: studiovitali.ansible
     source: https://git.studiovita.li/studio/ansible.git ## HTTPS
     type: git
     version: dokploy

ansible/roles/dokploy/defaults/main.yml

@@ -0,0 +1,14 @@
+---
+# Official Dokploy installer
+dokploy_installer_url: "https://dokploy.com/install.sh"
+dokploy_installer_path: "/usr/local/bin/dokploy-install.sh"
+
+# Pin to a specific release tag for reproducible installs
+dokploy_version: "latest"
+
+# Packages the installer expects on a minimal Debian image
+# dokploy_prerequisites:
+#   - ca-certificates
+#   - curl
+#   - openssl
+#   - iproute2

ansible/roles/dokploy/tasks/main.yml

@@ -0,0 +1,33 @@
+---
+# - name: Install Dokploy prerequisites
+#   ansible.builtin.apt:
+#     name: "{{ dokploy_prerequisites }}"
+#     state: present
+#     update_cache: true
+
+- name: Download Dokploy installer
+  ansible.builtin.get_url:
+    url: "{{ dokploy_installer_url }}"
+    dest: "{{ dokploy_installer_path }}"
+    mode: "0755"
+
+# The upstream installer is not idempotent & exits non-zero if the swarm is already initialized. Guard on the presence of the dokploy swarm service
+- name: Check if Dokploy is already installed
+  ansible.builtin.command: docker service inspect dokploy
+  register: dokploy_installed
+  changed_when: false
+  failed_when: false
+
+- name: Install Dokploy
+  ansible.builtin.command: "{{ dokploy_installer_path }}"
+  environment:
+    DOKPLOY_VERSION: "{{ dokploy_version }}"
+  changed_when: true
+  when: dokploy_installed.rc != 0
+
+# - name: Update Dokploy (opt-in)
+#   ansible.builtin.command: "{{ dokploy_installer_path }} update"
+#   environment:
+#     DOKPLOY_VERSION: "{{ dokploy_version }}"
+#   changed_when: true
+#   when: dokploy_installed.rc == 0

terraform/main.tf

@@ -10,7 +10,9 @@ resource "hcloud_server" "dokploy" {
   image        = var.hcloud_image
   server_type  = var.hcloud_server_type
   location     = var.hcloud_location
-  ssh_keys     = [hcloud_ssh_key.ansible.id]
+  user_data    = templatefile("${path.module}/templates/user_data.tpl", {
+    ssh_public_key = var.ssh_public_key
+  })
   firewall_ids = [hcloud_firewall.host.id]
 
   public_net {
@@ -76,7 +78,7 @@ resource "cloudflare_dns_record" "subdomain" {
 
 # Write IP to Ansible inventory
 resource "local_file" "ansible_inventory" {
-  content = templatefile("${path.module}/../ansible/inventory.tpl", {
+  content = templatefile("${path.module}/templates/ansible_inventory.tpl", {
     public_ip = local.public_ip
   })
   filename = "${path.module}/../ansible/inventory.ini"

terraform/templates/user_data.tpl

@@ -0,0 +1,9 @@
+# cloud-config
+users:
+  - name: ansible
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - ${ssh_public_key}
+ssh_pwauth: false
+disable_root: true