1. 10 Oct, 2020 1 commit
  2. 06 Oct, 2020 2 commits
  3. 19 Sep, 2020 12 commits
  4. 18 Sep, 2020 1 commit
  5. 13 Sep, 2020 8 commits
    • Gigadoc 2's avatar
      podman: quote environment lines as well · 457f1214
      Gigadoc 2 authored
    • Gigadoc 2's avatar
      podman: create "volumes" in own file hierarchy · 601ef3ba
      Gigadoc 2 authored
      The built-in podman volumes don't work very well with ansible and have
      other downsides (see the content of this commit). This means the
      existing containers will be moved over to this structure as well, at
      some point.
    • Gigadoc 2's avatar
      podman: enable arbitrary reload commands · 6e445287
      Gigadoc 2 authored
      For now, we just take literal commands, to be flexible. If that turns
      out to be too much trouble later on, it could be made into an
      "in-container" command. On the other hand, the podman role could also
      just export the binary location.
    • Gigadoc 2's avatar
      add matrix-discord · a77896b5
      Gigadoc 2 authored
      A bridge between Matrix rooms and Discord channels.
    • Gigadoc 2's avatar
      add matrix-bifrost · dc7766bf
      Gigadoc 2 authored
      A bridge bridging Matrix with either personal IM networks via libpurple,
      or XMPP chatrooms via xmpp.js. Only half-shot knows why this is one
      project instead of two. I use the latter functionality.
    • Gigadoc 2's avatar
      add rocketchat (dep. mongodb) · 594e19a4
      Gigadoc 2 authored
      This adds Rocket.Chat with its dependency MongoDB as very simple podman
      containers. I am probably going to remove them again soon, it was more
      of an experiment, and both MongoDB and Rocket.Chat are weird.
    • Gigadoc 2's avatar
      add podman role · eaac6d2d
      Gigadoc 2 authored
      This role is the main ingredient for the application container setup. It
      can be used as a normal role, in which case it will just pull in the
      container-router role and install podman. More importantly though, it
      can be included from other roles with the `per-container.yml` tasks
      file. In that case it will "install" a container with the given
      parameters. The usual wisdom is that you don't need to install anything,
      as everything is bundled in the container image, but that is not quite
      true for real world deployments. Here, installation means that we create
      a UID/GID pair for the container to use (please don't just run
      containers as root or with an UID that is used by other containers
      and/or your host system itself), a CNI network configuration (because
      app container people have never heard of running stuff without a load
      balancer, or services that connect to the internet themselves), and a
      systemd service file to launch it with dependencies (somewhat) respected
      (after all, this is why I use podman in the first place).
    • Gigadoc 2's avatar
      add container-router role · 2b8754e7
      Gigadoc 2 authored
      All my container networks are routed, there is no bridging or overlay
      networking going on. As such, the container host also acts as a router,
      and it is also firewalling the containers. Keeping the firewall close to
      the container namespaces themselves (as opposed to just having the
      central router firewall, like I am doing with the VMs for now) helps
      making the internal network less of a "trusted zone", hopefully aiding
      damage control in case of a compromised service. Currently the firewall
      is realised with ferm, I probably have to switch to nftables though
      soon, Fedora has already dropped ferm.
      Note that the container routers don't do NAT: I want to avoid NAT as
      much as possible, so the idea is that only the VM router itself does
      NAT. As a consequence of this, the VM router needs to know any and all
      subnets in use, but that is what the automation is for, right?
  6. 10 Sep, 2020 9 commits
  7. 05 Dec, 2017 3 commits
  8. 04 Dec, 2017 4 commits