ansible tests

Author: Tom Softreck

.env.example

@@ -0,0 +1,21 @@
+# Domain configuration
+DOMAIN=yourdomain.com
+
+# Subdomains
+TRAEFIK_SUBDOMAIN=traefik
+PROJEKT1_SUBDOMAIN=projekt1
+PROJEKT2_SUBDOMAIN=projekt2
+
+# Email for Let's Encrypt notifications
+LETSENCRYPT_EMAIL=[email protected]
+
+# Timezone
+TZ=Europe/Warsaw
+
+# Ports
+HTTP_PORT=80
+HTTPS_PORT=443
+DASHBOARD_PORT=8083
+
+# Traefik basic auth (generate with: htpasswd -nb admin yourpassword)
+TRAEFIK_BASIC_AUTH=admin:$$2y$$05$$5HXxP9X8wJqTgYz5jK5u8uJq5VZ5QkXJ5zQ9X8wJqTgYz5jK5u8uJ

docker-compose.prod.yml

@@ -1,92 +1,93 @@
 version: '3.8'
 
+x-env: &env
+  env_file: .env
+  environment:
+    - TZ=${TZ}
+
 services:
-  # Traefik - reverse proxy with dashboard
   traefik:
     image: traefik:v2.10
-    container_name: traefik
-    command:
+    command: 
       - "--api.insecure=false"
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
-      - "--entrypoints.dashboard.address=:8082"
-      # Enable automatic HTTPS with Let's Encrypt
+      - "--entrypoints.dashboard.address=:${DASHBOARD_PORT}"
+      # Let's Encrypt configuration
       - "--certificatesresolvers.leresolver.acme.httpchallenge=true"
       - "--certificatesresolvers.leresolver.acme.httpchallenge.entrypoint=web"
-      - "--certificatesresolvers.leresolver.acme.email=[email protected]"
+      - "--certificatesresolvers.leresolver.acme.email=${LETSENCRYPT_EMAIL}"
       - "--certificatesresolvers.leresolver.acme.storage=/letsencrypt/acme.json"
       # Enable dashboard
       - "--api.dashboard=true"
       # Use podman network
-      - "--providers.docker.network=prod_network"
+      - "--providers.docker.network=podman"
     ports:
-      - "8081:80"        # HTTP traffic (mapped from 80 to 8081)
-      - "8443:443"       # HTTPS traffic (mapped from 443 to 8443)
-      - "8082:8080"      # Dashboard - should be restricted in production
+      - "${HTTP_PORT}:80"         # HTTP
+      - "${HTTPS_PORT}:443"       # HTTPS
+      - "${DASHBOARD_PORT}:${DASHBOARD_PORT}"     # Dashboard
     volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - "/run/user/1000/podman/podman.sock:/var/run/docker.sock:ro"
       - "./letsencrypt:/letsencrypt"
       - "./traefik/traefik.log:/traefik.log"
-      - "./traefik/access.log:/access.log"
     environment:
-      - TZ=Europe/Warsaw
-    restart: unless-stopped
+      - DOCKER_HOST=unix:///var/run/docker.sock
+      - TZ=${TZ}
     networks:
-      - prod_network
+      - podman
+    restart: unless-stopped
     labels:
       - "traefik.enable=true"
       # Dashboard protection
-      - "traefik.http.routers.dashboard.rule=Host(`traefik.devopsterminal.com`)"
+      - "traefik.http.routers.dashboard.rule=Host(`${TRAEFIK_SUBDOMAIN}.${DOMAIN}`)"
       - "traefik.http.routers.dashboard.service=api@internal"
       - "traefik.http.routers.dashboard.entrypoints=websecure"
       - "traefik.http.routers.dashboard.tls.certresolver=leresolver"
       - "traefik.http.routers.dashboard.middlewares=auth"
-      # Basic auth for dashboard (user:admin, password:changeme)
-      - "traefik.http.middlewares.auth.basicauth.users=admin:$$2y$$05$$5HXxP9X8wJqTgYz5jK5u8uJq5VZ5QkXJ5zQ9X8wJqTgYz5jK5u8uJ"
+      # Basic auth for dashboard
+      - "traefik.http.middlewares.auth.basicauth.users=${TRAEFIK_BASIC_AUTH}"
 
-  # Project 1 Service
   projekt1:
     build: ./projekt1
-    container_name: projekt1
-    restart: unless-stopped
     networks:
-      - prod_network
+      - podman
+    expose:
+      - 5000
+    environment:
+      - FLASK_ENV=production
+    restart: unless-stopped
     labels:
       - "traefik.enable=true"
-      # Main domain
-      - "traefik.http.routers.projekt1.rule=Host(`projekt1.devopsterminal.com`)"
+      - "traefik.http.routers.projekt1.rule=Host(`${PROJEKT1_SUBDOMAIN}.${DOMAIN}`)"
       - "traefik.http.routers.projekt1.entrypoints=websecure"
       - "traefik.http.routers.projekt1.tls.certresolver=leresolver"
       - "traefik.http.services.projekt1.loadbalancer.server.port=5000"
       # Redirect HTTP to HTTPS
-      - "traefik.http.routers.projekt1-http.rule=Host(`projekt1.devopsterminal.com`)"
+      - "traefik.http.routers.projekt1-http.rule=Host(`${PROJEKT1_SUBDOMAIN}.${DOMAIN}`)"
       - "traefik.http.routers.projekt1-http.entrypoints=web"
       - "traefik.http.routers.projekt1-http.middlewares=redirect-to-https@docker"
-    environment:
-      - FLASK_ENV=production
 
-  # Project 2 Service
   projekt2:
     build: ./projekt2
-    container_name: projekt2
-    restart: unless-stopped
     networks:
-      - prod_network
+      - podman
+    expose:
+      - 5000
+    environment:
+      - FLASK_ENV=production
+    restart: unless-stopped
     labels:
       - "traefik.enable=true"
-      # Main domain
-      - "traefik.http.routers.projekt2.rule=Host(`projekt2.devopsterminal.com`)"
+      - "traefik.http.routers.projekt2.rule=Host(`${PROJEKT2_SUBDOMAIN}.${DOMAIN}`)"
       - "traefik.http.routers.projekt2.entrypoints=websecure"
       - "traefik.http.routers.projekt2.tls.certresolver=leresolver"
       - "traefik.http.services.projekt2.loadbalancer.server.port=5000"
       # Redirect HTTP to HTTPS
-      - "traefik.http.routers.projekt2-http.rule=Host(`projekt2.devopsterminal.com`)"
+      - "traefik.http.routers.projekt2-http.rule=Host(`${PROJEKT2_SUBDOMAIN}.${DOMAIN}`)"
       - "traefik.http.routers.projekt2-http.entrypoints=web"
       - "traefik.http.routers.projekt2-http.middlewares=redirect-to-https@docker"
-    environment:
-      - FLASK_ENV=production
 
   # Global redirect middleware
   traefik-http-redirect:
@@ -95,13 +96,13 @@ services:
     volumes:
       - ./traefik/redirect.toml:/etc/traefik/redirect.toml
     networks:
-      - prod_network
+      - podman
     labels:
       - "traefik.enable=true"
       - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
       - "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
 
 networks:
-  prod_network:
-    name: prod_network
-    external: false
+  podman:
+    name: podman
+    external: true