Refactor and enhance Ansible configurations for dev-02 and nginx proxy setup

- Updated host_vars for dev-02 to include login history settings and modified code server authentication.
- Adjusted opencode server configurations and reduced resource allocation.
- Introduced a new playbook for configuring nginx reverse proxy with TLS and OAuth2.
- Enhanced linux_dev_station role defaults and tasks, including package updates and service configurations.
- Removed unnecessary credential assertions in linux_dev_station tasks.
- Created nginx_proxy role with tasks for certbot, nginx installation, and oauth2-proxy setup.
- Added templates for nginx and oauth2-proxy configurations.
- Updated terraform configuration to reflect new DNS records for ide and agent services.
- Documented changes and configurations in linux_dev_station.md for clarity and future reference.

ansible/roles/linux_dev_station/defaults/main.yml

@@ -27,7 +27,9 @@ linux_dev_station_dnf_packages:
   - fzf
   - sqlite3
   - opentofu
-  - kubectl
+  - kubernetes1.36-client
+  - ansible
+  - python3-ansible-lint
 
 linux_dev_station_tool_packages:
   - name: uv
@@ -46,7 +48,10 @@ linux_dev_station_tool_packages:
     version: "1.1.2"
     sha256: ""
 
-linux_dev_station_code_server_host: "0.0.0.0"
+linux_dev_station_code_server_bind_to_localhost: false
+
+linux_dev_station_code_server_host: >-
+  {{ (linux_dev_station_code_server_bind_to_localhost | bool) | ternary('127.0.0.1', '0.0.0.0') }}
 linux_dev_station_code_server_port: 3000
 linux_dev_station_code_server_auth: "password"
 linux_dev_station_code_server_password: "{{ lookup('env', 'CODE_SERVER_PASSWORD', default='') }}"
@@ -82,7 +87,6 @@ linux_dev_station_oh_my_zsh_plugins:
   - kubectl
   - microk8s
   - docker
-  - docker-compose
   - ansible
   - aws
   - golang
@@ -100,7 +104,10 @@ linux_dev_station_ssh_key_comment: "dev-02"
 
 linux_dev_station_code_server_systemd_enabled: true
 linux_dev_station_opencode_systemd_enabled: true
-linux_dev_station_opencode_server_host: "0.0.0.0"
+linux_dev_station_opencode_bind_to_localhost: false
+
+linux_dev_station_opencode_server_host: >-
+  {{ (linux_dev_station_opencode_bind_to_localhost | bool) | ternary('127.0.0.1', '0.0.0.0') }}
 linux_dev_station_opencode_server_port: 4096
 linux_dev_station_opencode_server_username: "{{ lookup('env', 'OPENCODE_SERVER_USERNAME', default='') }}"
 linux_dev_station_opencode_server_password: "{{ lookup('env', 'OPENCODE_SERVER_PASSWORD', default='') }}"

ansible/roles/linux_dev_station/tasks/main.yml

@@ -5,28 +5,6 @@
       - ansible_facts['distribution'] == "Fedora"
     fail_msg: "Role linux_dev_station supports Fedora hosts only"
 
-- name: Ensure OpenCode server credentials are provided
-  ansible.builtin.assert:
-    that:
-      - linux_dev_station_opencode_server_username | length > 0
-      - linux_dev_station_opencode_server_password | length > 0
-    fail_msg: >-
-      Set OPENCODE_SERVER_USERNAME and OPENCODE_SERVER_PASSWORD
-      in environment (recommended via sectool)
-      before running the playbook.
-  when: linux_dev_station_opencode_systemd_enabled | bool
-
-- name: Ensure code-server password is provided
-  ansible.builtin.assert:
-    that:
-      - linux_dev_station_code_server_password | length > 0
-    fail_msg: >-
-      Set CODE_SERVER_PASSWORD in environment
-      (recommended via sectool) before running the playbook.
-  when:
-    - linux_dev_station_code_server_systemd_enabled | bool
-    - linux_dev_station_code_server_auth == "password"
-
 - name: Install dnf packages
   become: true
   ansible.builtin.dnf:

ansible/roles/linux_dev_station/templates/code-server.service.j2

@@ -16,7 +16,6 @@ StandardError=append:{{ linux_dev_station_logs_dir }}/code-server.err.log
 Environment="HOME={{ linux_dev_station_service_home }}"
 Environment="PATH={{ linux_dev_station_path }}"
 Environment="TMPDIR={{ linux_dev_station_service_home }}/.cache/tmp"
-Environment="PASSWORD={{ linux_dev_station_code_server_password }}"
 {% if linux_dev_station_ssh_agent_enabled | bool %}
 Environment="SSH_AUTH_SOCK={{ linux_dev_station_ssh_agent_socket }}"
 {% endif %}

ansible/roles/linux_dev_station/templates/opencode.service.j2

@@ -16,8 +16,6 @@ StandardError=append:{{ linux_dev_station_logs_dir }}/opencode.err.log
 Environment="HOME={{ linux_dev_station_service_home }}"
 Environment="PATH={{ linux_dev_station_path }}"
 Environment="TMPDIR={{ linux_dev_station_service_home }}/.cache/tmp"
-Environment="OPENCODE_SERVER_USERNAME={{ linux_dev_station_opencode_server_username }}"
-Environment="OPENCODE_SERVER_PASSWORD={{ linux_dev_station_opencode_server_password }}"
 {% for env_key, env_value in linux_dev_station_opencode_extra_environment.items() %}
 Environment="{{ env_key }}={{ env_value }}"
 {% endfor %}