feat(valkey): added new basic valkey role

ansible_collections/nullified/infrastructure/roles/valkey/templates/systemd/valkey.service.j2

@@ -0,0 +1,58 @@
+[Unit]
+Description=Valey service
+Documentation=https://github.com/valkey-io/valkey-doc
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+User={{ valkey_user }}
+Group={{ valkey_group }}
+Type=notify
+UMask=0077
+ExecStart={{ valkey_binary_filepath }} {{ valkey_config_dir }}/valkey.conf
+Restart=on-failure
+RestartSec=3
+TimeoutStartSec=infinity
+TimeoutStopSec=infinity
+WorkingDirectory=~
+LimitNOFILE=10032
+
+# Security Hardening
+PrivateTmp=true
+CapabilityBoundingSet=CAP_SYS_RESOURCE
+{% if systemd_version | int >= 187 %}
+NoNewPrivileges=true
+SystemCallFilter=@system-service
+{% endif %}
+{%+ if systemd_version | int >= 209 %}SystemCallArchitectures=native{%- endif +%}
+{% if systemd_version | int >= 214 %}
+ProtectHome=true
+ProtectSystem=true
+{% endif %}
+{% if systemd_version | int >= 231 %}
+ReadOnlyPaths=/
+ReadWritePaths={{ valkey_config_dir }} {{ valkey_install_dir }}
+RestrictRealtime=true
+{% endif %}
+{% if systemd_version | int >= 232 %}
+ProtectControlGroups=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+RemoveIPC=true
+{% endif %}
+{% if systemd_version | int >= 233 %}
+MountAPIVFS=true
+RestrictNamespaces=ipc net mnt pid
+{% endif %}
+{%+ if systemd_version | int >= 235 %}LockPersonality=true{%- endif +%}
+{% if systemd_version | int >= 242 %}
+ProtectHostname=true
+RestrictSUIDSGID=true
+{% endif %}
+{%+ if systemd_version | int >= 243 %}OOMScoreAdjust=-900{%- endif +%}
+{%+ if systemd_version | int >= 244 %}ProtectKernelLogs=true{%- endif +%}
+{%+ if systemd_version | int >= 245 %}ProtectClock=true{%- endif +%}
+{%+ if systemd_version | int >= 247 %}ProtectProc=invisible{%- endif +%}
+
+[Install]
+WantedBy=multi-user.target

ansible_collections/nullified/infrastructure/roles/valkey/templates/valkey.conf.j2

@@ -0,0 +1,72 @@
+daemonize no
+supervised systemd
+bind "{{ valkey_server_bind_addresses | default(['127.0.0.1', '-::1'], True) | join(' ') }}"
+protected-mode yes
+enable-protected-configs {{ valkey_enable_protected_configs | default('no', True) }}
+enable-debug-command {{ valkey_enable_debug_command | default('no', True) }}
+enable-module-command {{ valkey_enable_module_command | default('no', True) }}
+# default for port is 0 because we enable TLS
+port {{ valkey_server_port | default(0 if valkey_use_tls else 6379, True) }}
+{% if valkey_use_tls is truthy %}tls-port {{ valkey_server_tls_port | default(6379, True) }}{% endif +%}
+tcp-backlog {{ valkey_server_tcp_backlog | default(511, True) }}
+{% if valkey_enable_unixsocket is truthy %}
+unixsocket {{ valkey_server_unixsocket | default('/run/valkey.sock', True) }}
+unixsocketgroup {{ valkey_server_unixsocketgroup | default('wheel', True) }}
+unixsocketperm {{ valkey_server_unixsocketperm | default(700, True) }}
+{% endif %}
+timeout {{ valkey_server_timeout | default(0, True) }}
+tcp-keepalive {{ valkey_server_tcp_keepalive | default(300, True) }}
+{% if valkey_use_tls is truthy %}
+tls-cert-file "{{ valkey_tls_certfile | default(valkey_config_dir ~ '/valkey.crt', True) | quote }}"
+tls-key-file "{{ valkey_tls_keyfile | default(valkey_config_dir ~ '/valkey.key', True) | quote }}"
+{% if valkey_tls_keyfile_pass is truthy %}tls-key-file-pass "{{ valkey_tls_keyfile_pass | quote }}"{% endif %}
+{% endif %}
+tls-ca-cert-dir "/etc/ssl/certs"
+tls-auth-clients optional
+tls-replication yes
+tls-cluster yes
+tls-protocols "TLSv1.2 TLSv1.3"
+tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256
+tls-prefer-server-ciphers yes
+tls-session-cache-size 5000
+tls-session-cache-timeout 60
+loglevel {{ valkey_server_loglevel | default('notice', True) }}
+log-format {{ valkey_server_log_format | default('logfmt', True) }}
+log-timestamp-format {{ valkey_server_log_timestamp_format | default('iso8601', True) }}
+syslog-enabled yes
+syslog-ident valkey
+databases {{ valkey_server_databases | default(16, True) }}
+always-show-logo no
+hide-user-data-from-log yes
+set-proc-title no
+locale-collate {{ valkey_server_locale_collate | default('', True) | quote }}
+stop-writes-on-bgsave-error yes
+rdbcompression yes
+rdbchecksum yes
+rdb-version-check strict
+sanitize-dump-payload {{ valkey_server_sanitize_dump_payload | default('clients', True) | quote }}
+dir ./
+maxclients {{ valkey_server_maxclients | default(10000, True) }}
+{% if valkey_server_maxmemory is truthy %}maxmemory {{ valkey_server_maxmemory }}{% endif %}
+maxmemory-policy {{ valkey_server_maxmemory_policy | default('allkeys-lfu', True) }}
+maxmemory-samples {{ valkey_server_maxmemory_samples | default(5, True) }}
+active-expire-effort {{ valkey_server_active_expire_effort | default(1, True) }}
+lazyfree-lazy-eviction yes
+lazyfree-lazy-expire yes
+lazyfree-lazy-server-del yes
+replica-lazy-flush yes
+lazyfree-lazy-user-del yes
+lazyfree-lazy-user-flush yes
+disable-thp yes
+shutdown-on-sigint default
+shutdown-on-sigterm default
+lua-time-limit {{ valkey_server_lua_time_limit | default(5000, True) }}
+busy-reply-threshold {{ valkey_server_busy_reply_threshold | default(5000, True) }}
+commandlog-execution-slower-than 10000
+commandlog-slow-execution-max-len 128
+commandlog-request-larger-than 1048576
+commandlog-large-request-max-len 128
+commandlog-reply-larger-than 1048576
+commandlog-large-reply-max-len 128
+
+include {{ valkey_config_dir }}/conf.d/*.conf