n0mad1k
3542913689
- Smart TLS: skip certbot for IPs/.local/.lan, self-signed with SAN, HSTS max-age=0 for self-signed certs, split LAN vs public messages - Dynamic PHP: versionless meta-packages, runtime detection via php_ver fact - Vaultwarden: fail-fast on armv7l (32-bit ARM not supported upstream) - Module prompts: accept IPs for matrix/cloud/vault/media, hard error on email with IP, all_in_one skips certbot email for LAN - Matrix: skip matrix. prefix strip for IPs, warn about immutable server_name - OS family guards: ansible_os_family == Debian on all apt tasks - SSH key path: expanduser().resolve() on user-provided key paths - Cloudflare Tunnel: post-deploy script (setup-tunnel.sh) using CF API token — no browser auth needed, creates tunnel + credentials + DNS + systemd Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
44 lines
1.0 KiB
YAML
44 lines
1.0 KiB
YAML
---
|
|
# Jellyfin installation from official apt repository
|
|
|
|
- name: Install prerequisites
|
|
apt:
|
|
name:
|
|
- curl
|
|
- gnupg
|
|
- ca-certificates
|
|
- nginx
|
|
- certbot
|
|
- python3-certbot-nginx
|
|
state: present
|
|
update_cache: true
|
|
when: ansible_os_family == "Debian"
|
|
|
|
- name: Add Jellyfin GPG signing key
|
|
ansible.builtin.get_url:
|
|
url: https://repo.jellyfin.org/jellyfin_team.gpg.key
|
|
dest: /usr/share/keyrings/jellyfin-archive-keyring.asc
|
|
mode: "0644"
|
|
|
|
- name: Add Jellyfin apt repository
|
|
apt_repository:
|
|
repo: "deb [signed-by=/usr/share/keyrings/jellyfin-archive-keyring.asc] https://repo.jellyfin.org/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} main"
|
|
state: present
|
|
filename: jellyfin
|
|
|
|
- name: Install Jellyfin
|
|
apt:
|
|
name: jellyfin
|
|
state: present
|
|
update_cache: true
|
|
when: ansible_os_family == "Debian"
|
|
|
|
- name: Allow HTTP/HTTPS through UFW
|
|
ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop:
|
|
- "80"
|
|
- "443"
|