{"id":13929126,"url":"https://github.com/okfde/fragdenstaat.de-ansible","last_synced_at":"2026-01-30T23:45:59.626Z","repository":{"id":22793648,"uuid":"97332834","full_name":"okfde/fragdenstaat.de-ansible","owner":"okfde","description":"Ansible Deployment for fragdenstaat.de","archived":false,"fork":false,"pushed_at":"2026-01-20T10:18:24.000Z","size":8441,"stargazers_count":20,"open_issues_count":3,"forks_count":3,"subscribers_count":11,"default_branch":"main","last_synced_at":"2026-01-20T19:40:59.651Z","etag":null,"topics":["fragdenstaat"],"latest_commit_sha":null,"homepage":"https://fragdenstaat.de","language":"Perl","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/okfde.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2017-07-15T17:51:36.000Z","updated_at":"2026-01-20T10:18:28.000Z","dependencies_parsed_at":"2023-09-27T14:41:05.461Z","dependency_job_id":"d571fba1-5e88-42b5-922a-bcb1770d5cfc","html_url":"https://github.com/okfde/fragdenstaat.de-ansible","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/okfde/fragdenstaat.de-ansible","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/okfde%2Ffragdenstaat.de-ansible","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/okfde%2Ffragdenstaat.de-ansible/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/okfde%2Ffragdenstaat.de-ansible/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/okfde%2Ffragdenstaat.de-ansible/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/okfde","download_url":"https://codeload.github.com/okfde/fragdenstaat.de-ansible/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/okfde%2Ffragdenstaat.de-ansible/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28923730,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-30T22:32:35.345Z","status":"ssl_error","status_checked_at":"2026-01-30T22:32:31.927Z","response_time":66,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["fragdenstaat"],"created_at":"2024-08-07T18:02:08.207Z","updated_at":"2026-01-30T23:45:59.614Z","avatar_url":"https://github.com/okfde.png","language":"Perl","funding_links":[],"categories":["others","Perl"],"sub_categories":[],"readme":"# Ansible FragDenStaat.de\n\nBased on [ansible-django-stack](https://github.com/jcalazan/ansible-django-stack).\n\nAnsible to deploy FragDenStaat.de - a Django app with Postgres database, ElasticSearch search engine, Celery+RabbitMQ background queue, Redis server and a full email server with postfix and dovecot on Ubuntu 22.04.\n\n\n## Install this repo\n\n```bash\npython -m venv ansible-env\nsource ansible-env/bin/activate\npip install -r requirements.txt\n```\n\n## Configure your SSH user\n\nCopy `local_vars/local_config.yml.example` to `local_vars/local_config.yml` and set your SSH username.\n\n## Deploy FragDenStaat.de\n\nRun this to deploy FragDenStaat.de\n\n    ansible-playbook playbooks/fragdenstaat.de.yml -v\n\nThere are tags available:\n\n- `deploy-web` – updates app and reloads app server\n- `deploy-backend` – like `deploy-web` but also restarts workers\n- `deploy-frontend` - rebuilds frontend and reloads app server\n- `nginx` – rebuilds nginx config and reload nginx\n\nUse like this:\n\n```\nansible-playbook playbooks/fragdenstaat.de.yml -v -t deploy-web -t deploy-frontend\n```\n\n## Secrets management\n\nSecrets are managed with `ansible-vault`.\n\nEdit production secrets:\n\n```\nansible-vault edit group_vars/all/secrets.yml\n```\n\n## Add VPN clients\n\nMake sure vpn server is setup.\n\nSetup VPN server:\n```\nansible-playbook -v playbooks/vpnserver.yml\n```\n\nStore public key in host variables file in `host_vars/` under the key `host_data.wg_publickey`\n\nRun this script to add a client:\n\n```\nansible-playbook -v playbooks/extra/vpn_add_client.yml\n```\n\nThe playbook will ask for the client name and a (python) list of allowed endpoints. The endpoint names must match the server names in the `inventory`. If no endpoints are given, access will be granted to all of them.\n\nAfter it's done, a client configuration file is in your local directory and the public key has been recorded in encrypted form `env_vars/vpnclients.yml`.\nYou should commit `env_vars/vpnclients.yml`.\n\nUpdate the peers on the server:\n\n```\nansible-playbook -v playbooks/vpnserver.yml\n```\n\n\n## Current FragDenStaat.de architecture\n\n```mermaid\nflowchart TB\n    subgraph brooke\n        brookessh[[SSH access]]\n        appserver[Gunicorn/Uvicorn]\n        brookenginx[nginx frontend server]\n        appworker[Celery Worker]\n        wireguard[Wireguard VPN]\n        db[Postgres Database]\n        postfix[\"Postfix (SMTP)\"]\n        dovecot[\"Dovecot (IMAP)\"]\n        redis[Redis Broker]\n        memcached[memcached Cache]\n        rabbitmq[RabbitMQ Queue]\n        brookessd[(SSD storage)]\n    end\n    subgraph brooke\n        brookenginx--\u003eappserver\n        brookenginx--\u003ebrookessd\n        appserver--\u003edb\n        nfsmount-- media files --\u003enfs\n        appserver--\u003enfsmount\n        appserver--\u003erabbitmq\n        appserver--\u003ememcached\n        appserver-- mail download --\u003edovecot\n        appserver-- Websocket Channel Layer Group --\u003eredis\n        rabbitmq\u003c--\u003eappworker\n        postfix-- check deliverability --\u003edb\n        db--\u003ebrookessd\n        postfix--\u003ebrookessd\n        dovecot--\u003ebrookessd\n\n        appworker--\u003edb\n        appworker--\u003enfsmount\n        appworker-- fetch mail --\u003edovecot\n        appworker-- Mail Log reading --\u003ebrookessd\n\n        wireguard--\u003ebrookenginx\n\n        brooke-cronbackup[Cron Backup Task]\n        brookessd-- mail storage --\u003e brooke-cronbackup\n        brookessd-- database dumps --\u003e brooke-cronbackup\n        nfsmount\n\n        brooke-graylog-sidecar[[graylog sidecar]]\n        brooke-prometheus-exporter[[prometheus exporter]]\n    end\n\n    subgraph schoch\n        schochssh[[SSH access]]\n        schochnginx[nginx frontend server]\n        schochnginx--authenticating access --\u003e appserver\n        schochnginx--\u003eschochhdd[(HDD storage)]\n        nfs\u003c--\u003eschochhdd[(HDD storage)]--\u003eschoch-cronbackup[Cron Backup Task]\n        schoch-graylog-sidecar[[graylog sidecar]]\n        schoch-prometheus-exporter[[prometheus exporter]]\n    end\n\n    subgraph schaar\n        schaarssh[[SSH access]]\n        fdsbot[Slack fdsbot]\n        schaarnginx\n        db--\u003edbreplica[Postgres Database Replica]\n        schaar-graylog-sidecar[[graylog sidecar]]\n        schaar-prometheus-exporter[[prometheus exporter]]\n        docker--\u003eschaar-cronbackup[Cron Backup Task]\n    end\n    subgraph schaar\n        schaarnginx[nginx frontend server]\n        subgraph docker\n            schaarnginx--\u003eweblate\n            schaarnginx--\u003efds-forum\n            schaarnginx--\u003efds-ogimage\n            schaarnginx--\u003emetabase\n        end\n        metabase-- reporting schema views --\u003edb\n    end\n\n    subgraph fds-es1\n        fdses01ssh[[SSH access]]\n        elasticsearch[Elasticsearch server]\u003c--\u003eappworker\n        elasticsearch--\u003efdses01ssd[(SSD storage)]\n        fds-es1-graylog-sidecar[[graylog sidecar]]\n        fds-es1-prometheus-exporter[[prometheus exporter]]\n    end\n\n    subgraph internet\n        slack([Slack])==\u003efdsbot--\u003ebrookessh\n        user([User])== media.frag-den-staat.de ==\u003eschochnginx\n        user== fragdenstaat.de / static.frag-den-staat.de ==\u003ebrookenginx\n        user== ogimage.frag-den-staat.de ==\u003eschaarnginx\n        mailuser([Email])==\u003epostfix\n        fdsstaff([FDS staff])==\u003edovecot\n        fdsstaff==\u003eschaarnginx\n        fdsstaff==\u003ewireguard\n    end\n\n    subgraph backupstorage\n        backup[(backup storage)]\n        brooke-cronbackup--\u003ebackup\n        schoch-cronbackup--\u003ebackup\n        schaar-cronbackup--\u003ebackup\n    end\n\n    subgraph fds-tst\n        fdsstaff==\u003efds-tstwireguard[Wireguard VPN]--\u003efds-tstnginx[nginx reverse proxy]\n        fdsstaff==\u003efds-tstmail[SMTP proxy]\n    end\n    subgraph fds-tst\n        subgraph fds-tstvm[VMs]\n            fds-tstmail--\u003ebrooke-tst\n            fds-tstnginx--\u003ebrooke-tst\n            fds-tstnginx--\u003eschaar-tst\n            fds-tstnginx--\u003eschoch-tst\n            fds-tstnginx--\u003efds-es01-tst\n        end\n    end\n\n    subgraph fds-mon\n        fdsstaff==\u003efds-monwireguard--\u003efds-monnginx\n        fds-monwireguard[Wireguard VPN]\n        fds-monnginx[Nginx reverse proxy]\n    end\n    subgraph fds-mon\n        subgraph fds-mondocker[docker]\n            fds-monnginx--\u003esentry\n            fds-monnginx--\u003egrafana\n            fds-monnginx--\u003egraylog\n            fds-monnginx--\u003eprometheus\n        end\n    end\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fokfde%2Ffragdenstaat.de-ansible","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fokfde%2Ffragdenstaat.de-ansible","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fokfde%2Ffragdenstaat.de-ansible/lists"}