From fa609ac33453cf4ca6efd72d7ea41fe3d9f79d9d Mon Sep 17 00:00:00 2001
From: Vladislav Ponomarev <farazeus@gmail.com>
Date: Mon, 18 Dec 2023 18:07:51 +0700
Subject: [PATCH] Add Hemmelig

---
 README.md                                | 42 ++++++++++++------------
 group_vars/all.yml                       |  3 ++
 inventories/sample/group_vars/sample.yml |  3 ++
 provisioning.yml                         |  5 +++
 roles/hemmelig/defaults/main.yml         | 10 ++++++
 roles/hemmelig/tasks/main.yml            | 31 +++++++++++++++++
 6 files changed, 73 insertions(+), 21 deletions(-)
 create mode 100644 roles/hemmelig/defaults/main.yml
 create mode 100644 roles/hemmelig/tasks/main.yml

diff --git a/README.md b/README.md
index eb35452..edf6838 100644
--- a/README.md
+++ b/README.md
@@ -98,27 +98,27 @@ Host mayurifag-prod
 
 ## Applications List
 
-| Name                | Docker | Default endpoint                              | App. Port     |
-| ------------------- | ------ | --------------------------------------------- | ------------- |
-| Blocky              | ✅     | -                                             | -             |
-| Doku                | ✅     | <http://doku.mayurifag.local>                 | 9090          |
-| Dozzle              | ✅     | <http://dozzle.mayurifag.local>               | 8080          |
-| Filerun             | ✅     | <http://filerun.mayurifag.local>              | 80 [+3306 db] |
-| Glances             | ✅     | <http://glances.mayurifag.local>              | 61208/61209   |
-| Go-socks5-proxy     | ✅     | <socks5://mayurifag.local:7777> (+auth)       | 1080          |
-| Homer               | ✅     | <http://homer.mayurifag.local>                | 8080          |
-| Lazydocker          | -      | -                                             | -             |
-| mayurifag.github.io | ✅     | <http://mayurifag.local>                      | 8005          |
-| Navidrome           | ✅     | <http://mus.mayurifag.local>                  | 80            |
-| Netdata             | ✅     | <http://netdata.mayurifag.local>              | 19999         |
-| Nextcloud           | ✅     | <http://nextcloud.mayurifag.local>            | 80            |
-| Portainer           | ✅     | <http://portainer.mayurifag.local>            | 9000          |
-| Shadowsocks-rust    | ✅     | <https://ss.mayurifag.local/xray> (uses TLS)  | 1080          |
-| Traefik Dashboard   | ✅     | <http://traefik.mayurifag.local/dashboard/#/> | 8080 (?)      |
-| Wallabag            | ✅     | <http://wallabag.mayurifag.local>             | 80            |
-| Watchtower          | ✅     | -                                             | -             |
-| Wireguard-Easy      | ✅     | <http://wg.mayurifag.local>                   | 58172         |
-| Whattocommit        | ✅     | <http://commit.mayurifag.local>               | 8080          |
+| Name                | Default endpoint                              | App. Port     |
+| ------------------- | --------------------------------------------- | ------------- |
+| Blocky              | -                                             | -             |
+| Doku                | <http://doku.mayurifag.local>                 | 9090          |
+| Dozzle              | <http://dozzle.mayurifag.local>               | 8080          |
+| Filerun             | <http://filerun.mayurifag.local>              | 80 [+3306 db] |
+| Glances             | <http://glances.mayurifag.local>              | 61208/61209   |
+| Go-socks5-proxy     | <socks5://mayurifag.local:7777> (+auth)       | 1080          |
+| Homer               | <http://homer.mayurifag.local>                | 8080          |
+| Hemmelig            | <http://secret.mayurifag.local>               | 3000          |
+| mayurifag.github.io | <http://mayurifag.local>                      | 8005          |
+| Navidrome           | <http://mus.mayurifag.local>                  | 80            |
+| Netdata             | <http://netdata.mayurifag.local>              | 19999         |
+| Nextcloud           | <http://nextcloud.mayurifag.local>            | 80            |
+| Portainer           | <http://portainer.mayurifag.local>            | 9000          |
+| Shadowsocks-rust    | <https://ss.mayurifag.local/xray> (uses TLS)  | 1080          |
+| Traefik Dashboard   | <http://traefik.mayurifag.local/dashboard/#/> | 8080 (?)      |
+| Wallabag            | <http://wallabag.mayurifag.local>             | 80            |
+| Watchtower          | -                                             | -             |
+| Wireguard-Easy      | <http://wg.mayurifag.local>                   | 58172         |
+| Whattocommit        | <http://commit.mayurifag.local>               | 8080          |
 
 ## TODO
 
diff --git a/group_vars/all.yml b/group_vars/all.yml
index db4cf43..e227561 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -108,3 +108,6 @@ wallabag_subdomain: "wallabag"
 shadowsocks_enabled: true
 shadowsocks_subdomain: "ss"
 shadowsocks_password: "change_this"
+
+hemmelig_enabled: true
+hemmelig_subdomain: "secret"
diff --git a/inventories/sample/group_vars/sample.yml b/inventories/sample/group_vars/sample.yml
index a13bd3c..76c8192 100644
--- a/inventories/sample/group_vars/sample.yml
+++ b/inventories/sample/group_vars/sample.yml
@@ -104,3 +104,6 @@ wallabag_subdomain: "wallabag"
 shadowsocks_enabled: true
 shadowsocks_subdomain: "ss"
 shadowsocks_password: "change_this"
+
+hemmelig_enabled: true
+hemmelig_subdomain: "secret"
diff --git a/provisioning.yml b/provisioning.yml
index 09babf9..3889925 100644
--- a/provisioning.yml
+++ b/provisioning.yml
@@ -133,6 +133,11 @@
         - filerun
       when: (filerun_enabled | default(False))
 
+    - role: hemmelig
+      tags:
+        - hemmelig
+      when: (hemmelig_enabled | default(False))
+
     - role: navidrome
       tags:
         - navidrome
diff --git a/roles/hemmelig/defaults/main.yml b/roles/hemmelig/defaults/main.yml
new file mode 100644
index 0000000..d0a552b
--- /dev/null
+++ b/roles/hemmelig/defaults/main.yml
@@ -0,0 +1,10 @@
+---
+hemmelig_enabled: true
+
+hemmelig_docker_image: hemmeligapp/hemmelig:v5.15.3
+hemmelig_available_externally: "true"
+hemmelig_subdomain: secret
+
+hemmelig_memory: 1g
+
+hemmelig_data_directory: "{{ docker_home }}/hemmelig"
diff --git a/roles/hemmelig/tasks/main.yml b/roles/hemmelig/tasks/main.yml
new file mode 100644
index 0000000..b1375fb
--- /dev/null
+++ b/roles/hemmelig/tasks/main.yml
@@ -0,0 +1,31 @@
+---
+- name: Delete Hemmelig directory
+  file:
+    path: "{{ hemmelig_data_directory }}"
+    state: absent
+
+- name: Create Hemmelig Directories
+  file:
+    path: "{{ item }}"
+    state: directory
+    owner: 1000
+    group: 1000
+  with_items:
+    - "{{ hemmelig_data_directory }}/files"
+    - "{{ hemmelig_data_directory }}/database"
+
+- name: Create Hemmelig container
+  docker_container:
+    name: hemmelig
+    image: "{{ hemmelig_docker_image }}"
+    pull: true
+    volumes:
+      - "{{ hemmelig_data_directory }}/files:/var/tmp/hemmelig/upload/files"
+      - "{{ hemmelig_data_directory }}/database:/home/node/hemmelig/database/"
+    restart_policy: unless-stopped
+    memory: "{{ hemmelig_memory }}"
+    labels:
+      traefik.enable: "{{ hemmelig_available_externally }}"
+      traefik.http.routers.hemmelig.rule: "Host(`{{ hemmelig_subdomain }}.{{ server_hostname }}`)"
+      traefik.http.services.hemmelig.loadbalancer.server.port: "3000"
+      traefik.http.routers.hemmelig.middlewares: "my-headers@file"