esh/cinc-repo/policyfiles/lxd2204.rb

name 'lxd2204'

###
# Cookbooks location
###

# ESH
default_source :chef_repo, '../cookbooks'

# Community
default_source :supermarket, 'https://supermarket.chef.io'

###
# Run List
###

run_list %w(
  esh_zfs::package
  esh_zfs::pool
  esh_zfs::scrub
  esh_lxd::setup
  esh_cloudflared::install
  esh_cloudflared::cert
  esh_lxd::containers
  esh_lxd::resolved
)

###
# Attributes
###

###
# esh_zfs
###

default['esh']['zfs']['pools'] = {
  'nvme': {
    'mount_point': 'none',
    'ashift': 12,
    'autotrim': 'on',
    'lz4_compress': 'enabled',
    'compression': 'on',
    'dedup': 'on',
    'target': '/dev/vdb',
  },
  'hdd': {
    'mount_point': 'none',
    'ashift': 12,
    'autotrim': 'off',
    'lz4_compress': 'enabled',
    'compression': 'on',
    'dedup': 'off',
    'target': '/dev/vdc',
  },
  'backup': {
    'mount_point': 'none',
    'ashift': 12,
    'autotrim': 'off',
    'lz4_compress': 'enabled',
    'compression': 'on',
    'dedup': 'on',
    'target': '/dev/vdd',
  },
}

default['esh']['zfs']['scrub']['hc_url'] = 'https://hc-ping.com/'

###
# esh_lxd
###

default['esh']['lxd']['containers'] = {
  'archive': {
    'image': 'debian/11',
    'volumes': {
      'archive-data': {
        'pool': 'nvme',
        'path': '/var/lib/archive-data',
      },
    },
    'cloudflared': {
      'archive': {
        'archive.benpro.fr': 'http://archive:80',
      },
    },
  },
  'arc': {
    'cookbook': 'esh_archivebox',
    'image': 'debian/11',
    'cinc_flavor': 'debian/11',
    'volumes': {
      'arc-data': {
        'pool': 'nvme',
        'path': '/var/lib/arc-data',
      },
    },
    'apparmor': 'unconfined',
    'cloudflared': {
      'arc': {
        'arc.benpro.fr': 'http://arc:8000',
      },
    },
  },
  'ytb': {
    'cookbook': 'esh_piped',
    'image': 'debian/11',
    'cinc_flavor': 'debian/11',
    'volumes': {
      'ytb-postgresql': {
        'pool': 'nvme',
        'path': '/var/lib/postgresql',
      },
    },
    'apparmor': 'unconfined',
    'cloudflared': {
      'ytb': {
        'ytb.benpro.fr': 'http://ytb:80',
        'ytb-proxy.benpro.fr': 'http://ytb:80',
        'ytb-api.benpro.fr': 'http://ytb:80',
      },
    },
  },
  'blog': {
    'cookbook': 'esh_writefreely',
    'image': 'debian/11',
    'cinc_flavor': 'debian/11',
    'volumes': {
      'blog-mysql': {
        'pool': 'nvme',
        'path': '/var/lib/mysql',
      },
    },
    'cloudflared': {
      'blog': {
        'blog.benpro.fr': 'http://blog:80',
      },
    },
  },
  'twt': {
    'cookbook': 'esh_nitter',
    'image': 'debian/11',
    'cinc_flavor': 'debian/11',
    'volumes': {},
    'cloudflared': {
      'twt': {
        'twt.benpro.fr': 'http://twt:80',
      },
    },
  },
  'gallery': {
    'cookbook': 'esh_photoprism',
    'image': 'debian/11',
    'cinc_flavor': 'debian/11',
    'volumes': {
      'gallery-originals': {
        'pool': 'hdd',
        'path': '/var/lib/gallery-originals',
      },
      'gallery-storage': {
        'pool': 'nvme',
        'path': '/var/lib/gallery-storage',
      },
      'gallery-mysql': {
        'pool': 'nvme',
        'path': '/var/lib/mysql',
      },
    },
    'apparmor': 'unconfined',
    'cloudflared': {
      'gallery': {
        'gallery.benpro.fr': 'http://gallery:80',
        'gallery-sync.benpro.fr': 'http://gallery:8384',
      },
    },
  },
}

###
# esh_cloudflared
###

default['esh']['cloudflared']['cert'] = <<~EOT
EOT