Michael Schiemer
36ef2a1e2c
Some checks failed
🚀 Build & Deploy Image / Determine Build Necessity (push) Failing after 10m14s
🚀 Build & Deploy Image / Build Runtime Base Image (push) Has been skipped
🚀 Build & Deploy Image / Build Docker Image (push) Has been skipped
🚀 Build & Deploy Image / Run Tests & Quality Checks (push) Has been skipped
🚀 Build & Deploy Image / Auto-deploy to Staging (push) Has been skipped
🚀 Build & Deploy Image / Auto-deploy to Production (push) Has been skipped
Security Vulnerability Scan / Check for Dependency Changes (push) Failing after 11m25s
Security Vulnerability Scan / Composer Security Audit (push) Has been cancelled
- Remove middleware reference from Gitea Traefik labels (caused routing issues) - Optimize Gitea connection pool settings (MAX_IDLE_CONNS=30, authentication_timeout=180s) - Add explicit service reference in Traefik labels - Fix intermittent 504 timeouts by improving PostgreSQL connection handling Fixes Gitea unreachability via git.michaelschiemer.de
139 lines
6.6 KiB
YAML
139 lines
6.6 KiB
YAML
---
|
|
# Fix Traefik ACME JSON Permissions
|
|
# Prüft und korrigiert Berechtigungen für acme.json Datei
|
|
- name: Fix Traefik ACME JSON Permissions
|
|
hosts: production
|
|
gather_facts: yes
|
|
become: no
|
|
|
|
tasks:
|
|
- name: Check if Traefik stack directory exists
|
|
ansible.builtin.stat:
|
|
path: "{{ traefik_stack_path | default('/home/deploy/deployment/stacks/traefik') }}"
|
|
register: traefik_stack_exists
|
|
|
|
- name: Fail if Traefik stack directory does not exist
|
|
ansible.builtin.fail:
|
|
msg: "Traefik stack directory not found at {{ traefik_stack_path | default('/home/deploy/deployment/stacks/traefik') }}"
|
|
when: not traefik_stack_exists.stat.exists
|
|
|
|
- name: Check if acme.json exists
|
|
ansible.builtin.stat:
|
|
path: "{{ traefik_stack_path | default('/home/deploy/deployment/stacks/traefik') }}/acme.json"
|
|
register: acme_json_exists
|
|
|
|
- name: Create acme.json if it doesn't exist
|
|
ansible.builtin.file:
|
|
path: "{{ traefik_stack_path | default('/home/deploy/deployment/stacks/traefik') }}/acme.json"
|
|
state: file
|
|
mode: '0600'
|
|
owner: "{{ ansible_user | default('deploy') }}"
|
|
group: "{{ ansible_user | default('deploy') }}"
|
|
when: not acme_json_exists.stat.exists
|
|
|
|
- name: Get current acme.json permissions
|
|
ansible.builtin.stat:
|
|
path: "{{ traefik_stack_path | default('/home/deploy/deployment/stacks/traefik') }}/acme.json"
|
|
register: acme_json_stat
|
|
|
|
- name: Display current acme.json permissions
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
================================================================================
|
|
Aktuelle acme.json Berechtigungen:
|
|
================================================================================
|
|
Path: {{ acme_json_stat.stat.path }}
|
|
Owner: {{ acme_json_stat.stat.pw_name }} (UID: {{ acme_json_stat.stat.uid }})
|
|
Group: {{ acme_json_stat.stat.gr_name }} (GID: {{ acme_json_stat.stat.gid }})
|
|
Mode: {{ acme_json_stat.stat.mode | string | regex_replace('^0o?', '') }}
|
|
Size: {{ acme_json_stat.stat.size }} bytes
|
|
================================================================================
|
|
|
|
- name: Fix acme.json permissions (chmod 600)
|
|
ansible.builtin.file:
|
|
path: "{{ traefik_stack_path | default('/home/deploy/deployment/stacks/traefik') }}/acme.json"
|
|
mode: '0600'
|
|
owner: "{{ ansible_user | default('deploy') }}"
|
|
group: "{{ ansible_user | default('deploy') }}"
|
|
register: acme_json_permissions_fixed
|
|
|
|
- name: Verify acme.json permissions after fix
|
|
ansible.builtin.stat:
|
|
path: "{{ traefik_stack_path | default('/home/deploy/deployment/stacks/traefik') }}/acme.json"
|
|
register: acme_json_stat_after
|
|
|
|
- name: Display fixed acme.json permissions
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
================================================================================
|
|
Korrigierte acme.json Berechtigungen:
|
|
================================================================================
|
|
Path: {{ acme_json_stat_after.stat.path }}
|
|
Owner: {{ acme_json_stat_after.stat.pw_name }} (UID: {{ acme_json_stat_after.stat.uid }})
|
|
Group: {{ acme_json_stat_after.stat.gr_name }} (GID: {{ acme_json_stat_after.stat.gid }})
|
|
Mode: {{ acme_json_stat_after.stat.mode | string | regex_replace('^0o?', '') }}
|
|
Size: {{ acme_json_stat_after.stat.size }} bytes
|
|
================================================================================
|
|
✅ acme.json hat jetzt chmod 600 (nur Owner kann lesen/schreiben)
|
|
================================================================================
|
|
|
|
- name: Check Traefik container can write to acme.json
|
|
ansible.builtin.shell: |
|
|
cd {{ traefik_stack_path | default('/home/deploy/deployment/stacks/traefik') }}
|
|
docker compose exec -T traefik sh -c "test -w /acme.json && echo 'WRITABLE' || echo 'NOT_WRITABLE'" 2>&1 || echo "CONTAINER_CHECK_FAILED"
|
|
register: acme_json_writable_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Display acme.json writable check
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
================================================================================
|
|
Traefik Container Schreibzugriff auf acme.json:
|
|
================================================================================
|
|
{% if 'WRITABLE' in acme_json_writable_check.stdout %}
|
|
✅ Traefik Container kann auf acme.json schreiben
|
|
{% elif 'NOT_WRITABLE' in acme_json_writable_check.stdout %}
|
|
⚠️ Traefik Container kann NICHT auf acme.json schreiben
|
|
{% else %}
|
|
⚠️ Konnte Container-Zugriff nicht prüfen: {{ acme_json_writable_check.stdout }}
|
|
{% endif %}
|
|
================================================================================
|
|
|
|
- name: Check Docker volume mount for acme.json
|
|
ansible.builtin.shell: |
|
|
docker inspect traefik --format '{{ '{{' }}json .Mounts{{ '}}' }}' 2>/dev/null | jq '.[] | select(.Destination=="/acme.json")' || echo "Could not check volume mount"
|
|
register: acme_json_mount
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Display acme.json volume mount
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
================================================================================
|
|
Docker Volume Mount für acme.json:
|
|
================================================================================
|
|
{{ acme_json_mount.stdout }}
|
|
================================================================================
|
|
|
|
- name: Summary
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
================================================================================
|
|
ZUSAMMENFASSUNG - acme.json Berechtigungen:
|
|
================================================================================
|
|
|
|
✅ acme.json Berechtigungen auf chmod 600 gesetzt
|
|
✅ Owner/Group auf {{ ansible_user | default('deploy') }} gesetzt
|
|
|
|
Wichtig:
|
|
- acme.json muss beschreibbar sein für Traefik Container
|
|
- Port 80/443 müssen vom Host auf Traefik zeigen
|
|
- Traefik muss stabil laufen (keine häufigen Restarts)
|
|
|
|
Nächste Schritte:
|
|
- Stelle sicher, dass Traefik stabil läuft
|
|
- Warte 5-10 Minuten auf ACME-Challenge-Abschluss
|
|
- Prüfe Traefik-Logs auf ACME-Fehler
|
|
================================================================================
|