Added documentation and examples for multitenancy setups.

README.md

@@ -26,6 +26,8 @@ The main goals of this project are:
 - [Collabora Online Development Edition](https://www.collaboraoffice.com/code/) (integrates with Nextcloud)
 - [Cryptpad](https://cryptpad.fr/)
 
+For hosting several isolated instances of these services on the same server, see the section on [multitenancy](#multitenancy).
+
 ### WIP
 
 - [BigBlueButton](https://bigbluebutton.org/)
@@ -157,6 +159,21 @@ Restic assumes untrusted environments, hence backups are always encrypted using
 
 The `common` role comes with a [firewall](https://galaxy.ansible.com/geerlingguy/firewall) based on iptables. If you don't allow SSH (usually port 22) then you might lock yourself out. Have a look at `group_vars/vagrant.yml` for an example config. Add the corresponding [firewall parameters](https://galaxy.ansible.com/geerlingguy/firewall) to your `host_vars` and adapt them according to your needs.
 
+## Multitenancy
+
+The roles used to provide the above services support multitenancy setups by offering the possibility to specify the installation path and further variables for proper routing of requests to the individual instances. 
+Note that in this setup, Traefik serves as the central entry point (and is not running multiple times!) and routes the request by the domain they were issued from.
+
+An example how to structure variables related to the individual instances and how to write an according inventory can be found under [examples/multitenancy](examples/multitenancy).
+The main idea is to define **multiple hosts targeting the same machine** and providing a different set of service variables for each. 
+
+Most importantly, to configure multiple instances for the same service, a unique `<service>_install_path` and `<service>_multitenant_label` need to be specified identifying the instance towards Traefik.
+Also, exposed ports **must** differ per instance as docker maps container port to the host's network (even if the containers reside in a user-defined network).
+
+In the examples you'll find additional `group_vars` that can be used to ease up setting up individual install paths by introducting `tenant_name`s and deploying services into a unified directory structure depending on that.
+For each individual host, all variables will be concatenated so that they are available in the service roles.
+
+
 ## Alternatives
 
 - [HomelabOS](https://gitlab.com/NickBusey/HomelabOS)

examples/multitenancy/group_vars/all.yml

@@ -0,0 +1,8 @@
+# Deployment users and paths
+default_user: '{{ ansible_user }}'
+default_install_path: "/home/{{ default_user }}"
+default_services_path: "{{ default_install_path }}/services"
+
+# Defaults for multitenant setups
+tenant_name: ''
+tenant_install_path: "{{ default_services_path }}{{ '/' + tenant_name if (tenant_name) else '' }}"

examples/multitenancy/host_vars/server1/firewall.yml

@@ -0,0 +1,16 @@
+# Firewall
+firewall_disable_ufw: true
+firewall_flush_rules_and_chains: true
+firewall_additional_rules:
+  - "iptables --policy INPUT DENY"
+firewall_allowed_tcp_ports:
+  - "22"
+  - "80"
+  - "443"
+  # Jitsi
+  - "4443" # tenant_a
+  - "4543" # tenant_b
+firewall_allowed_udp_ports:
+  # Jitsi
+  - "10000" # tenant_a
+  - "11000" # tenant_b

examples/multitenancy/host_vars/server1/server1.yml

@@ -0,0 +1,6 @@
+# General settings
+ansible_user: deploy
+update_hostname: yes
+hostname: "multitenant-server1"
+users: []
+sudoers: []

examples/multitenancy/host_vars/server1/traefik.yml

@@ -0,0 +1,8 @@
+# Traefik proxy
+traefik_letsencrypt_email: max@example.com
+traefik_install_user: "{{ default_user }}"
+traefik_expose_internally: True
+traefik_expose_externally: False
+traefik_enable_acme: True
+traefik_use_acme_staging: False
+traefik_dns_challenge_provider: False

examples/multitenancy/host_vars/server1_tenant_a/jitsi_docker.yml

@@ -0,0 +1,26 @@
+jitsi_install_user: "{{ default_user }}"
+jitsi_install_path: "{{ tenant_install_path }}"
+jitsi_multitenant_label: "tenant_a"
+jitsi_docker_image_tag: 'latest'
+jitsi_public_url: https://tenant-a.example.com
+jitsi_docker_host_address: "{{ ansible_host }}"
+jitsi_exposed_http_port: 8010
+jitsi_exposed_https_port: 8453
+jitsi_bridge_udp_port: 11000
+jitsi_bridge_tcp_port: 4543
+jitsi_timezone: Europe/Amsterdam
+jitsi_enable_letsencrypt: False
+jitsi_virtual_host: tenant-a.example.com
+jitsi_jvb_stun_servers: meet-jit-si-turnrelay.jitsi.net:443
+# Passwords
+jitsi_jibri_recorder_password: secret1-CHANGE-ME
+jitsi_jibri_recorder_user: recorder
+jitsi_jibri_xmpp_password: secret2-CHANGE-ME
+jitsi_jibri_xmpp_user: jibri
+jitsi_jicofo_auth_password: secret3-CHANGE-ME
+jitsi_jicofo_auth_user: focus
+jitsi_jicofo_component_secret: secret4-CHANGE-ME
+jitsi_jigasi_xmpp_password: secret5-CHANGE-ME
+jitsi_jigasi_xmpp_user: jigasi
+jitsi_jvb_auth_user: jvb
+jitsi_jvb_auth_password: secret6-CHANGE-ME

examples/multitenancy/host_vars/server1_tenant_a/server1_tenant_a.yml

@@ -0,0 +1,3 @@
+ansible_user: deploy
+# Multitenant setup for tenant_a
+tenant_name: "tenant_a"

examples/multitenancy/host_vars/server1_tenant_b/jitsi_docker.yml

@@ -0,0 +1,26 @@
+jitsi_install_user: "{{ default_user }}"
+jitsi_install_path: "{{ tenant_install_path }}"
+jitsi_multitenant_label: "tenant_b"
+jitsi_docker_image_tag: 'latest'
+jitsi_public_url: https://tenant-b.example.com
+jitsi_docker_host_address: "{{ ansible_host }}"
+jitsi_exposed_http_port: 8010
+jitsi_exposed_https_port: 8453
+jitsi_bridge_udp_port: 11000
+jitsi_bridge_tcp_port: 4543
+jitsi_timezone: Europe/Amsterdam
+jitsi_enable_letsencrypt: False
+jitsi_virtual_host: tenant-b.example.com
+jitsi_jvb_stun_servers: meet-jit-si-turnrelay.jitsi.net:443
+# Passwords
+jitsi_jibri_recorder_password: secret1-CHANGE-ME
+jitsi_jibri_recorder_user: recorder
+jitsi_jibri_xmpp_password: secret2-CHANGE-ME
+jitsi_jibri_xmpp_user: jibri
+jitsi_jicofo_auth_password: secret3-CHANGE-ME
+jitsi_jicofo_auth_user: focus
+jitsi_jicofo_component_secret: secret4-CHANGE-ME
+jitsi_jigasi_xmpp_password: secret5-CHANGE-ME
+jitsi_jigasi_xmpp_user: jigasi
+jitsi_jvb_auth_user: jvb
+jitsi_jvb_auth_password: secret6-CHANGE-ME

examples/multitenancy/host_vars/server1_tenant_b/server1_tenant_b.yml

@@ -0,0 +1,3 @@
+ansible_user: deploy
+# Multitenant setup for tenant_b
+tenant_name: "tenant_b"

examples/multitenancy/inventory.ini.sample

@@ -0,0 +1,35 @@
+[server1_hosts]
+# Main host
+server1
+# Tenants
+server1_tenant_a
+server1_tenant_b
+
+[server1_hosts:vars]
+ansible_host=1.2.3.4
+ansible_ssh_host=1.2.3.4
+
+[common]
+server1
+
+[docker]
+server1
+
+[traefik]
+server1 # Must only be running on the main host
+
+[nextcloud]
+tenant_a
+
+[jitsi_docker]
+tenant_a
+tenant_b # Tenant B might only use Jitsi service
+
+[collabora]
+tenant_a
+
+[onlyoffice]
+tenant_a
+
+[cryptpad]
+tenant_a