Stefan Bethke
32b5f147bc
Adds a keycloak_auth_flow role that locally validates flow definitions (structure, nesting depth, known provider IDs, and a set of Keycloak authentication-flow gotchas: conditions silently ignored outside a Conditional subflow, keycloak/keycloak#29515's OTP+WebAuthn sibling bug, conditional-credential config shape/semantics, and more) before deploying them idempotently via middleware_automation.keycloak.keycloak_authentication_v2. Includes the CCCHH realm's actual "browser passkey and token" flow (the realm's real browserFlow binding, not the untouched built-in "browser" flow), exported from the live server so it's now reviewable and redeployable from this repo instead of only editable in the Keycloak admin console.
200 lines
3.9 KiB
YAML
200 lines
3.9 KiB
YAML
---
|
|
- name: Ensure base config is deployment on base_config_hosts
|
|
hosts: base_config_hosts
|
|
roles:
|
|
- base_config
|
|
tags:
|
|
- base_config
|
|
|
|
- name: Ensure secrets deployment on secrets_hosts
|
|
hosts: secrets_hosts
|
|
roles:
|
|
- secrets
|
|
tags:
|
|
- secrets
|
|
|
|
- name: Ensure systemd-networkd config deployment on systemd_networkd_hosts
|
|
hosts: systemd_networkd_hosts
|
|
roles:
|
|
- systemd_networkd
|
|
tags:
|
|
- systemd_networkd
|
|
|
|
- name: Ensure nftables deployment on nftables_hosts
|
|
hosts: nftables_hosts
|
|
roles:
|
|
- nftables
|
|
tags:
|
|
- nftables
|
|
|
|
- name: Ensure unbound deployment on unbound_hosts
|
|
hosts: unbound_hosts
|
|
roles:
|
|
- unbound
|
|
tags:
|
|
- unbound
|
|
|
|
- name: Ensure kea_dhcp deployment on kea_dhcp_hosts
|
|
hosts: kea_dhcp_hosts
|
|
roles:
|
|
- kea_dhcp
|
|
tags:
|
|
- kea_dhcp
|
|
|
|
- name: Ensure deployment of infrastructure authorized keys
|
|
hosts: infrastructure_authorized_keys_hosts
|
|
roles:
|
|
- infrastructure_authorized_keys
|
|
tags:
|
|
- infrastructure_authorized_keys
|
|
|
|
- name: Ensure Nextcloud config
|
|
hosts: nextcloud_hosts
|
|
roles:
|
|
- nextcloud
|
|
tags:
|
|
- nextcloud
|
|
|
|
- name: Ensure ola deployment on ola_hosts
|
|
hosts: ola_hosts
|
|
roles:
|
|
- ola
|
|
tags:
|
|
- ola
|
|
|
|
- name: Ensure foobazdmx deployment on foobazdmx_hosts
|
|
hosts: foobazdmx_hosts
|
|
roles:
|
|
- foobazdmx
|
|
tags:
|
|
- foobazdmx
|
|
|
|
- name: Ensure Dokuwiki config
|
|
hosts: wiki_hosts
|
|
roles:
|
|
- dokuwiki
|
|
tags:
|
|
- dokuwiki
|
|
|
|
- name: Ensure NetBox deployment on netbox_hosts
|
|
hosts: netbox_hosts
|
|
roles:
|
|
- netbox
|
|
tags:
|
|
- netbox
|
|
|
|
- name: Ensure NGINX deployment on nginx_hosts, which are also public_reverse_proxy_hosts, before certbot role runs
|
|
hosts: nginx_hosts:&public_reverse_proxy_hosts
|
|
roles:
|
|
- nginx
|
|
tags:
|
|
- nginx
|
|
- public_reverse_proxy
|
|
|
|
- name: Ensure certbot and certificate deployment on certbot_hosts
|
|
hosts: certbot_hosts
|
|
roles:
|
|
- certbot
|
|
tags:
|
|
- certbot
|
|
|
|
- name: Ensure OnlyOffice custom fonts
|
|
ansible.builtin.import_playbook: onlyoffice_fonts.yaml
|
|
tags:
|
|
- onlyoffice_fonts
|
|
|
|
- name: Ensure Docker Compose deployment on docker_compose_hosts
|
|
hosts: docker_compose_hosts
|
|
roles:
|
|
- docker_compose
|
|
tags:
|
|
- docker_compose
|
|
|
|
- name: Ensure Keycloak authentication flows are configured
|
|
hosts: keycloak_auth_flow_hosts
|
|
roles:
|
|
- keycloak_auth_flow
|
|
tags:
|
|
- keycloak_auth_flow
|
|
|
|
- name: Ensure NGINX deployment on nginx_hosts
|
|
hosts: nginx_hosts:!public_reverse_proxy_hosts
|
|
roles:
|
|
- nginx
|
|
tags:
|
|
- nginx
|
|
|
|
- name: Configure unattended upgrades for all non-hypervisors
|
|
hosts: all:!hypervisors
|
|
become: true
|
|
roles:
|
|
- role: debops.debops.unattended_upgrades
|
|
vars:
|
|
unattended_upgrades__origins:
|
|
- "o=${distro_id},n=${distro_codename}"
|
|
- "o=Docker,n=${distro_codename}"
|
|
- "o=nginx,n=${distro_codename}"
|
|
tags:
|
|
- unattended_upgrades
|
|
|
|
- name: Ensure Alloy is installed and Setup on alloy_hosts
|
|
hosts: alloy_hosts
|
|
become: true
|
|
roles:
|
|
- alloy
|
|
tags:
|
|
- alloy
|
|
|
|
- name: Ensure ansible_pull deployment on ansible_pull_hosts
|
|
hosts: ansible_pull_hosts
|
|
roles:
|
|
- ansible_pull
|
|
tags:
|
|
- ansible_pull
|
|
|
|
- name: Ensure msmtp is setup on msmtp_hosts
|
|
hosts: msmtp_hosts
|
|
roles:
|
|
- msmtp
|
|
tags:
|
|
- msmtp
|
|
|
|
- name: Ensure Renovate is setup on renovate_hosts
|
|
hosts: renovate_hosts
|
|
roles:
|
|
- renovate
|
|
tags:
|
|
- renovate
|
|
|
|
- name: Run ensure_eh22_styleguide_dir Playbook
|
|
ansible.builtin.import_playbook: ensure_eh22_styleguide_dir.yaml
|
|
tags:
|
|
- eh22_styleguide_dir
|
|
|
|
- name: Ensure forgejo-runner is setup on forgejo_runner_hosts
|
|
hosts: forgejo_runner_hosts
|
|
roles:
|
|
- forgejo_runner
|
|
tags:
|
|
- forgejo_runner
|
|
|
|
- name: Setup authoritative dns servers
|
|
hosts: auth-dns
|
|
roles:
|
|
- knot
|
|
tags:
|
|
- knot
|
|
|
|
- name: Setup transmission
|
|
hosts: transmission
|
|
roles:
|
|
- transmission
|
|
tags:
|
|
- transmission
|
|
|
|
- name: Setup dooris
|
|
hosts: dooris
|
|
roles:
|
|
- dooris
|
|
tags:
|
|
- dooris
|