CI/CD Infrastructure

Ansible playbooks for deploying the LeafScale/SharkOS CI/CD infrastructure.

Services

Authentication

Single sign-on via Google Workspace:

Google Workspace → Forgejo → Woodpecker
                          → Harbor

Login with your Google Workspace account to access all services.

Prerequisites

• Ansible 2.15+ installed locally
• VPS running Ubuntu 24.04
• SSH access to the VPS (root or sudo user)
• Domain with DNS A records pointing to VPS IP:
  • git.sharkos.one
  • ci.sharkos.one
  • registry.leafscale.com

Quick Start

1. Install Ansible Dependencies

# Install required collections
ansible-galaxy install -r requirements.yml

2. Set Up Vault Password

# Create vault password file (add your own secure password)
echo "your-secure-vault-password" > .vault_password
chmod 600 .vault_password

3. Generate Secrets

# Generate secure passwords
openssl rand -hex 32  # For secrets/tokens
openssl rand -base64 24  # For passwords

4. Configure Vault

# Edit the vault file with your secrets
ansible-vault edit inventory/group_vars/all/vault.yml

Fill in all CHANGE_ME values with:

• VPS IP address
• Your SSH public key
• Generated passwords and secrets

5. Deploy

# Full deployment
ansible-playbook playbooks/site.yml

# Deploy specific components
ansible-playbook playbooks/site.yml --tags base
ansible-playbook playbooks/site.yml --tags docker
ansible-playbook playbooks/site.yml --tags forgejo
ansible-playbook playbooks/site.yml --tags woodpecker
ansible-playbook playbooks/site.yml --tags harbor
ansible-playbook playbooks/site.yml --tags caddy

Post-Deployment Setup

1. Forgejo Initial Setup

1. Visit https://git.sharkos.one
2. Complete the initial setup wizard
3. Create admin account

2. Create OAuth App for Woodpecker

1. In Forgejo: Settings → Applications → Create OAuth Application
2. Name: Woodpecker CI
3. Redirect URI: https://ci.sharkos.one/authorize
4. Save Client ID and Secret
5. Update vault.yml with credentials
6. Re-run: ansible-playbook playbooks/site.yml --tags woodpecker

3. Harbor Setup

1. Visit https://registry.leafscale.com
2. Login with admin / (password from vault)
3. Create projects: sharkos, sharkadmin, portal
4. Create robot accounts for CI/CD
5. Update vault.yml with robot credentials

Directory Structure

.
├── ansible.cfg              # Ansible configuration
├── requirements.yml         # Galaxy dependencies
├── inventory/
│   ├── hosts.yml           # Host inventory
│   └── group_vars/
│       └── all/
│           ├── vars.yml    # Non-secret variables
│           └── vault.yml   # Encrypted secrets
├── playbooks/
│   └── site.yml            # Main playbook
└── roles/
    ├── base/               # System setup, firewall, SSH
    ├── docker/             # Docker CE installation
    ├── forgejo/            # Forgejo git server
    ├── woodpecker/         # Woodpecker CI
    ├── harbor/             # Harbor registry
    └── caddy/              # Caddy reverse proxy

Vault Commands

# Encrypt vault file
ansible-vault encrypt inventory/group_vars/all/vault.yml

# Decrypt vault file
ansible-vault decrypt inventory/group_vars/all/vault.yml

# Edit encrypted vault
ansible-vault edit inventory/group_vars/all/vault.yml

# View encrypted vault
ansible-vault view inventory/group_vars/all/vault.yml

# Re-key vault (change password)
ansible-vault rekey inventory/group_vars/all/vault.yml

Maintenance

Backup

Backups are stored in /backups/cicd/ on the VPS.

# Manual backup
ssh deploy@<vps-ip> sudo /opt/cicd/scripts/backup.sh

Update Services

# Pull latest images and restart
ansible-playbook playbooks/site.yml --tags forgejo
ansible-playbook playbooks/site.yml --tags woodpecker
ansible-playbook playbooks/site.yml --tags harbor

Troubleshooting

Check service status

ssh deploy@<vps-ip>

# Forgejo
cd /opt/cicd/forgejo && docker compose ps
docker compose logs forgejo

# Woodpecker
cd /opt/cicd/woodpecker && docker compose ps
docker compose logs woodpecker-server

# Harbor
cd /opt/cicd/harbor && docker compose ps
docker compose logs

# Caddy
cd /opt/cicd/caddy && docker compose ps
docker compose logs caddy

Certificate issues

Caddy automatically obtains Let's Encrypt certificates. Ensure:

1. DNS A records point to the VPS IP
2. Ports 80 and 443 are open
3. Check Caddy logs: docker compose logs caddy