il/ilnmors-homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(memos): release memos

Browse Source 
deployment notes:
- compare to Affine, maybe outline + memos can be substituted for affine
This commit is contained in:
Il Lee
2026-05-16 21:04:53 +09:00
parent 1256122081
commit 9be4276676
12 changed files with 258 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/inventory/group_vars/all.yaml
+8
View File
@@ -159,6 +159,13 @@ services:
http: "3002"
redis: "6384"
subuid: "101000"
memos:
domain:
public: "memos"
internal: "memos.app"
ports:
http: "3004"
subuid: "110000"
version:
packages:
@@ -196,3 +203,4 @@ version:
collabora: "25.04.9.4.1"
sure: "0.7.0-hotfix.2"
outline: "1.7.1"
memos: "0.28.0"
ansible/playbooks/app/site.yaml
+8
View File
@@ -233,6 +233,14 @@
tags: ["site", "outline"]
tags: ["site", "outline"]
- name: Set memos
ansible.builtin.include_role:
name: "app"
tasks_from: "services/set_memos"
apply:
tags: ["site", "memos"]
tags: ["site", "memos"]
- name: Flush handlers right now
ansible.builtin.meta: "flush_handlers"
ansible/roles/app/handlers/main.yaml
+11
View File
@@ -114,3 +114,14 @@
changed_when: false
listen: "notification_restart_outline"
ignore_errors: true # noqa: ignore-errors
- name: Restart memos
ansible.builtin.systemd:
name: "memos.service"
state: "restarted"
enabled: true
scope: "user"
daemon_reload: true
changed_when: false
listen: "notification_restart_memos"
ignore_errors: true # noqa: ignore-errors
ansible/roles/app/tasks/services/set_memos.yaml
+73
View File
@@ -0,0 +1,73 @@
---
- name: Create memos directory
ansible.builtin.file:
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['memos']['subuid'] }}"
group: "svadmins"
mode: "0770"
loop:
- "data/containers/memos"
- "data/containers/memos/data"
- "containers/memos"
- "containers/memos/ssl"
become: true
- name: Deploy root certificate
ansible.builtin.copy:
content: |
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/memos/ssl/{{ root_cert_filename }}"
owner: "{{ services['memos']['subuid'] }}"
group: "svadmins"
mode: "0440"
become: true
notify: "notification_restart_memos"
no_log: true
- name: Register secret value to podman secret
containers.podman.podman_secret:
name: "MEMOS_DSN"
data: "postgresql://memos:{{ hostvars['console']['postgresql']['password']['memos'] | urlencode | replace('/', '%2F') }}\
@{{ services['postgresql']['domain'] }}.{{ domain['internal'] }}/memos_db?sslmode=verify-full&\
sslrootcert=/etc/ssl/memos/{{ root_cert_filename }}"
state: "present"
force: true
notify: "notification_restart_memos"
- name: Deploy memos.container file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/memos/memos.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/memos.container"
owner: "{{ ansible_user }}"
group: "svadmins"
mode: "0644"
notify: "notification_restart_memos"
- name: Enable memos.service
ansible.builtin.systemd:
name: "memos.service"
state: "started"
enabled: true
daemon_reload: true
scope: "user"
- name: Check container archive images
ansible.builtin.stat:
path: "{{ node['home_path'] }}/archives/containers/docker.io_neosmemo_memos_{{ version['containers']['memos'] }}.tar"
register: container_archive_images
- name: Save container archive images
containers.podman.podman_save:
image:
- "docker.io/neosmemo/memos:{{ version['containers']['memos'] }}"
dest: "{{ node['home_path'] }}/archives/containers/docker.io_neosmemo_memos_{{ version['containers']['memos'] }}.tar"
format: "oci-archive"
force: false
when: not container_archive_images.stat.exists
- name: Fetch container archive images
ansible.builtin.fetch:
src: "{{ node['home_path'] }}/archives/containers/docker.io_neosmemo_memos_{{ version['containers']['memos'] }}.tar"
dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
flat: true
ansible/roles/infra/tasks/services/set_postgresql.yaml
+1
View File
@@ -13,6 +13,7 @@
- "nextcloud"
- "sure"
- "outline"
- "memos"
- name: Create postgresql directory
ansible.builtin.file:
config/secrets/secrets.yaml
+11 -2
View File
@@ -121,6 +121,7 @@ postgresql:
nextcloud: ENC[AES256_GCM,data:ROsximNuWYMTZktmLJPx7W1Qol/uT+APgwoCtFO/6ZYYc3KxKvlk344eqEc=,iv:4d+MrfIHjJKAcwhvZ3g4go66uZcieuL7lngKErJd+fg=,tag:QbWOtxeCbiu62GyrE2atXg==,type:str]
sure: ENC[AES256_GCM,data:FULJ2gjJ2gZC3s324itW+CjGRBHIP9RnOqw5TT1UaiUhb7UHAPm1na+LsZk=,iv:c0GnVZkxprJUzPPq3TCQaZvAes9QQuvDXqgVLLaiQIg=,tag:uDxy/Lkd2hNK4AWwMNMslw==,type:str]
outline: ENC[AES256_GCM,data:0eJFCfHgS4olWXHOnUPixs4Dl5PoxJa+2H1mk3YgC4GUv+nX8gTPmzKTMVM=,iv:HGxX7aLODUc2nVLC8YXdet9qphU/wxMapWhk93YmHDM=,tag:6/2uckW/a24LgVFRH6E85Q==,type:str]
memos: ENC[AES256_GCM,data:BaNTnZFZH4oMTnDkgrf2/fMTkO43rc9bSsgnDWrHJ/Z6+MZdMitpIMkrMN4=,iv:JsG3B0YweZYO96MW9NmoSsIG++gFq+jRUsozwJtWl3M=,tag:orLTUiW0inOJdD4YSp4baQ==,type:str]
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
@@ -262,6 +263,14 @@ outline:
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
#ENC[AES256_GCM,data:Fis0K+QOQwUfHItGI5U=,iv:kRmt4WhV6bBwN7Xl2xLrbxnKuLKTBC5nI9ZnQSIgIwo=,tag:whb1oOEX+fry9GS1+RlPrA==,type:comment]
memos:
oidc:
secret: ENC[AES256_GCM,data:+rX8znej0jjXybmUjoI7DkybNkNeg15Py7bav665Uej48I5ZAZbUiKwccNo=,iv:UzcCqXxvweosRL8afhyRBB2ERm1PNs+tuxeDwL7Mcu8=,tag:+gJWSAq2BpSlSw/iwhIbpA==,type:str]
hash: ENC[AES256_GCM,data:D7+37XTpDFRabT5YEh9nfxO1Q9Sdc98jAxPsjkPzj7bthn1H0dlLYZSJ2Fy8Ye4vjIFO+TZ6HWx8N4cSwHTfgls3EYFh1TW0FUnyCY1kYd/+ljfZB9Y6M+i5zb5nEIBHI32Sk7/B20cGnr0SUb3EKU+SmnACgZ0fjKKyUpSzGu75MH8=,iv:3RkTpgy85JPJqu6AEKrw8RY2O+L/CldPuPpN9ln54u8=,tag:Nl0DL5tVenA/fdRNOGyPkA==,type:str]
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
#ENC[AES256_GCM,data:T4Wtn49AAxPd2QUFTR+q,iv:bH5goGWBDqumAat9dUv2OwfCUJUpuVqncTMqMBZUXhI=,tag:G+W6hHA+yftQ+4RJpXrxHg==,type:comment]
switch:
password: ENC[AES256_GCM,data:qu0f9L7A0eFq/UCpaRs=,iv:W8LLOp3MSfd/+EfNEZNf91K8GgI5eUfVPoWTRES2C0Y=,tag:Q5FlAOfwqwJwPvd7k6i+0g==,type:str]
@@ -291,7 +300,7 @@ sops:
UmliaFNxVTBqRkI1QWJpWGpTRWxETW8KEY/8AfU73UOzCGhny1cNnd5dCNv7bHXt
k+uyWPPi+enFkVaceSwMFrA66uaWWrwAj11sXEB7yzvGFPrnAGezjQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-05-16T08:55:23Z"
mac: ENC[AES256_GCM,data:UXueLe3zZcuvUUH9OJGWcwUqzPoIhw+vtTpqZIB2fGOa4KpFCUmOXtRgws+mQVzBRB30xpbfbbwWM/ZIWjVx2EoE4uP09uk8fgtmMD9ZBacHxEzjxksKW78cX4SoOj6tzzhACTkj61RRrXS8Ft1RNZJFZlzeQVodEGt5eoJUq28=,iv:eCsQAiTqqL1w6xQ69u/Yi4iKUXS44sPUOSDuYPp8WFM=,tag:2kEdh4VB0XWhv0KBgD8EGA==,type:str]
lastmodified: "2026-05-16T11:08:23Z"
mac: ENC[AES256_GCM,data:FprpwGfSw+KObEthT41tD8qgawQPpRlHw0ZxcyH74Nzk+47AbkDR3dWUPmZGPTePcQM4WI3e1IzE0ptJA7Hpcsnq/wHdo+uTW8nozYxzDU7JhjG2Xn6CPov2mV3o0SCegiCpfvE4A3bXiBOPapUIIs+ySBUMmyyW6m5ravElxsA=,iv:wt/3nFmVfodxActWBNvli2M2LLQZG8bkuagA/Fc6iuk=,tag:z1QWaMrGN/8kBrmZ8mPJUA==,type:str]
unencrypted_suffix: _unencrypted
version: 3.12.1
config/services/containers/app/memos/memos.container.j2
+34
View File
@@ -0,0 +1,34 @@
[Quadlet]
DefaultDependencies=false
[Unit]
Description=Memos
[Container]
Image=docker.io/neosmemo/memos:{{ version['containers']['memos'] }}
ContainerName=memos
HostName=memos
PublishPort={{ services['memos']['ports']['http'] }}:5230/tcp
# Volumes
Volume=%h/data/containers/memos/data:/var/opt/memos:rw
Volume=%h/containers/memos/ssl:/etc/ssl/memos:ro
# General
Environment="TZ={{ timezone }}"
Environment="MEMOS_MODE=prod"
Environment="MEMOS_PORT=5230"
Environment="MEMOS_INSTANCE_URL=https://{{ services['memos']['domain']['public'] }}.{{ domain['public'] }}"
# Database (PostgreSQL)
Environment="MEMOS_DRIVER=postgres"
Secret=MEMOS_DSN,type=env
[Service]
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
TimeoutStopSec=120
[Install]
WantedBy=default.target
config/services/containers/auth/authelia/config/authelia.yaml.j2
+21
View File
@@ -283,3 +283,24 @@ identity_providers:
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_post'
# https://www.authelia.com/integration/openid-connect/clients/memos/
- client_id: 'memos'
client_name: 'Memos'
client_secret: '{{ hostvars['console']['memos']['oidc']['hash'] }}'
public: false
authorization_policy: 'one_factor'
require_pkce: false
pkce_challenge_method: ''
redirect_uris:
- 'https://{{ services['memos']['domain']['public'] }}.{{ domain['public'] }}/auth/callback'
scopes:
- 'openid'
- 'profile'
- 'email'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_post'
config/services/containers/common/caddy/etc/app/Caddyfile.j2
+6
View File
@@ -83,3 +83,9 @@
header_up Host {http.request.header.X-Forwarded-Host}
}
}
{{ services['memos']['domain']['internal'] }}.{{ domain['internal'] }} {
import private_tls
reverse_proxy host.containers.internal:{{ services['memos']['ports']['http'] }} {
header_up Host {http.request.header.X-Forwarded-Host}
}
}
config/services/containers/common/caddy/etc/auth/Caddyfile.j2
+9
View File
@@ -145,6 +145,15 @@
}
}
}
{{ services['memos']['domain']['public'] }}.{{ domain['public'] }} {
import crowdsec_log
route {
crowdsec
reverse_proxy https://{{services['memos']['domain']['internal'] }}.{{ domain['internal'] }} {
header_up Host {http.reverse_proxy.upstream.host}
}
}
}
# Internal domain
{{ node['name'] }}.{{ domain['internal'] }} {
docs/services/app/memos.md
+74
View File
@@ -0,0 +1,74 @@
# Memos
## Prerequisite
### Create database
- Create the password with `openssl rand -base64 32`
- Save this value in secrets.yaml in `postgresql.password.memos`
- Access infra server to create memos_db with `podman exec -it postgresql psql -U postgres`
```SQL
CREATE USER memos WITH PASSWORD 'postgresql.password.memos';
CREATE DATABASE memos_db;
ALTER DATABASE memos_db OWNER TO memos;
```
### Create oidc secret and hash
- Create the secret with `openssl rand -base64 32`
- access to auth vm
- `podman exec -it authelia sh`
- `authelia crypto hash generate pbkdf2 --password 'memos.oidc.secret'`
- Save this value in secrets.yaml in `memos.oidc.secret` and `memos.oidc.hash`
### Add postgresql dump backup list
- [set_postgresql.yaml](../../../ansible/roles/infra/tasks/services/set_postgresql.yaml)
```yaml
- name: Set connected services list
ansible.builtin.set_fact:
connected_services:
- ...
- "memos"
```
## Configuration
### Access to memos
- https://memos.ilnmors.com
- Create local-admin account
### Set OIDC
- Profile: Settings: Admin: SSO: Create
- Type: OAUTH2
- Template: Custom
- Provider ID: authelia
- Name: Authelia
- Client ID: memos
- Client secret: memos.oidc.secret
- Authorization endpoint: https://authelia.ilnmors.com/api/oidc/authorization
- Token endpoint: https://authelia.ilnmors.com/api/oidc/token
- User endpoint: https://authelia.ilnmors.com/api/oidc/userinfo
- Scopes: openid profile email
- Identifier: preferred_username
- Display Name: given_name
- Email: email
- Create
- Profile: Settings: Basic: My Account: SSO Accounts: Link
- Login with Authelia
- Accept
### Disallow local login and signup
- Profile: Settings: Admin: System
- Disallow password auth: toggle
- Save
### Change user name
- Profile: Settings: Basic: My Account: Edit
docs/specifications/environments.md
+2 -1
View File
@@ -128,7 +128,8 @@
- budget and finance
- [x] outline
- Compare to affine, the whiteboard and canvas functions are not useful enough
- [ ] memos
- [x] memos
- Check outline and memos can be substituded for affine
- WriteFreely or directus + frontend(Astro)
- MediaCMS or PeerTube
- Funkwhale or Navidrome or Jellyfin