Pyinfra that deploy my AdGuardHome DNS server.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 

137 lines
3.1 KiB

from pyinfra import host
from pyinfra.operations import apt, server, files, systemd
SUDO = True
server.user(
name='Add user benpro',
user='benpro',
groups=['sudo'],
public_keys='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFs7yO0auvwFL8HTLMUq6lET6DMYLhqhd32rqFfZUsjL openpgp:0xA32E99AD',
shell='/bin/bash',
present=True,
)
server.hostname(
name='Set the hostname',
hostname='dns.benpro.fr',
)
apt.update(
name='Update apt repositories',
)
apt.upgrade(
name='Upgrade apt packages',
)
apt.packages(
name='Install ufw',
packages=['ufw'],
update=False,
)
server.shell(
name='Add ufw rules',
commands=['ufw limit 22', 'ufw allow 80', 'ufw allow 443', 'ufw allow 853'],
)
server.shell(
name='Enable ufw',
commands=['yes | ufw enable'],
)
apt.packages(
name='Install certbot',
packages=['certbot'],
update=False,
)
if not host.fact.directory('/etc/letsencrypt/live/dns.benpro.fr'):
server.shell(
name='Add certificate',
commands=['certbot certonly --non-interactive --email certbot@benpro.fr --agree-tos --standalone -d dns.benpro.fr'],
)
server.group(
name='Add group adguard',
group=host.data.app_user,
system=True,
present=True,
)
server.user(
name='Add user adguard',
user=host.data.app_user,
group=host.data.app_user,
home=host.data.app_dir,
ensure_home=True,
system=True,
present=True,
)
for items in ['fullchain.pem', 'privkey.pem']:
server.shell(
name='Make certificate available for Adguard ({})'.format(items),
chdir=host.data.app_dir,
commands=['cp -L /etc/letsencrypt/live/dns.benpro.fr/{} .'.format(items), 'chown adguard: {}'.format(items)]
)
files.download(
name='Download AdGuard',
src='https://static.adguard.com/adguardhome/release/AdGuardHome_linux_amd64.tar.gz',
dest='/home/adguard/AdGuardHome_linux_amd64.tar.gz',
user=host.data.app_user,
group=host.data.app_user,
mode='750',
cache_time=604800,
)
server.shell(
name='Extract Adguard release file',
chdir=host.data.app_dir,
commands=['tar zxf AdGuardHome_linux_amd64.tar.gz','chown -R adguard: AdGuardHome'],
)
server.shell(
name='Setcap on Adguard binary',
chdir=host.data.app_dir,
commands=['setcap \'CAP_NET_BIND_SERVICE=+eip CAP_NET_RAW=+eip\' AdGuardHome/AdGuardHome'],
)
if host.fact.systemd_enabled['AdGuardHome.service'] == False:
server.shell(
name='Install Adguard systemd service file',
chdir=host.data.app_dir,
commands=['AdGuardHome/AdGuardHome -s install'],
)
files.put(
name='Update systemd service file',
src='files/AdGuardHome.service',
dest='/etc/systemd/system/AdGuardHome.service',
mode='644',
)
files.template(
name='Push AdGuardHome config',
src='templates/AdGuardHome.yaml.j2',
dest='/home/adguard/AdGuardHome/AdGuardHome.yaml',
mode='640',
user='adguard',
group='adguard',
)
systemd.daemon_reload(
name='Reload systemd',
user_mode=False,
)
systemd.service(
name='Restart and enable adguard service',
service='AdGuardHome.service',
running=True,
restarted=True,
enabled=True,
)