il/ilnmors-homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(repo): IaaS baseline

Browse Source
This commit is contained in:
il
2026-06-17 13:17:24 +09:00
parent a6bba986a5
commit 927b5b4934
250 changed files with 1074 additions and 28750 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/roles/app/handlers/main.yaml
+11 -12
View File
@@ -54,18 +54,6 @@
listen: "notification_restart_paperless"
ignore_errors: true # noqa: ignore-errors
- name: Restart affine
ansible.builtin.systemd:
name: "affine.service"
state: "restarted"
enabled: true
daemon_reload: true
scope: "user"
when: is_affine_init.stat.exists
changed_when: false
listen: "notification_restart_affine"
ignore_errors: true # noqa: ignore-errors
- name: Restart nextcloud
ansible.builtin.systemd:
name: "nextcloud.service"
@@ -125,3 +113,14 @@
changed_when: false
listen: "notification_restart_memos"
ignore_errors: true # noqa: ignore-errors
- name: Restart mealie
ansible.builtin.systemd:
name: "mealie.service"
state: "restarted"
enabled: true
scope: "user"
daemon_reload: true
changed_when: false
listen: "notification_restart_mealie"
ignore_errors: true # noqa: ignore-errors
ansible/roles/app/tasks/node/set_data_volume.yaml
+41
View File
@@ -0,0 +1,41 @@
---
- name: Check app data volume filesystem already exists
ansible.builtin.command:
cmd: "blkid /dev/{{ vm['data_storage']['name'] }}"
register: is_app_data
changed_when: false
failed_when: false
become: true
- name: Create ext4 filesystem on app data raw
ansible.builtin.command:
cmd: "mkfs.ext4 -F /dev/{{ vm['data_storage']['name'] }}"
when: is_app_data.rc != 0
changed_when: true
become: true
- name: Set data volume path
ansible.builtin.file:
path: "{{ node['home_path'] }}/data"
state: "directory"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0770"
- name: Mount app data volume
ansible.posix.mount:
path: "{{ node['home_path'] }}/data"
src: "/dev/{{ vm['data_storage']['name'] }}"
opts: "noatime"
state: "mounted"
fstype: "ext4"
become: true
- name: Set app data volume path permissions
ansible.builtin.file:
path: "{{ node['home_path'] }}/data"
state: "directory"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0770"
become: true
ansible/roles/app/tasks/services/set_affine.yaml
-198
View File
@@ -1,198 +0,0 @@
---
- name: Set manticore service name
ansible.builtin.set_fact:
manticore_service: "affine"
- name: Create manticore directory
ansible.builtin.file:
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['manticore']['subuid'] }}"
group: "svadmins"
mode: "0770"
loop:
- "data/containers/manticore"
- "data/containers/manticore/{{ manticore_service }}"
become: true
- name: Deploy manticore.container file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/manticore/manticore.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/manticore_{{ manticore_service }}.container"
owner: "{{ ansible_user }}"
group: "svadmins"
mode: "0644"
register: "is_manticore_containerfile"
- name: Enable (Restart) manticore.service
ansible.builtin.systemd:
name: "manticore_{{ manticore_service }}.service"
state: "restarted"
enabled: true
daemon_reload: true
scope: "user"
when: is_manticore_containerfile.changed # noqa: no-handler
- name: Set redis service name
ansible.builtin.set_fact:
redis_service: "affine"
- name: Create redis_affine directory
ansible.builtin.file:
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['redis']['subuid'] }}"
group: "svadmins"
mode: "0770"
loop:
- "containers/redis"
- "containers/redis/{{ redis_service }}"
- "containers/redis/{{ redis_service }}/data"
become: true
- name: Deploy redis config file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
owner: "{{ ansible_user }}"
group: "svadmins"
mode: "0644"
register: "is_redis_conf"
- name: Deploy redis container file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
owner: "{{ ansible_user }}"
group: "svadmins"
mode: "0644"
register: "is_redis_containerfile"
- name: Enable (Restart) redis service
ansible.builtin.systemd:
name: "redis_{{ redis_service }}.service"
state: "restarted"
enabled: true
daemon_reload: true
scope: "user"
when: is_redis_conf.changed or is_redis_containerfile.changed # noqa: no-handler
- name: Create affine directory
ansible.builtin.file:
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ ansible_user }}"
group: "svadmins"
mode: "0770"
loop:
- "data/containers/affine"
- "containers/affine"
- "containers/affine/ssl"
- "containers/affine/config"
- name: Deploy root certificate
ansible.builtin.copy:
content: |
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/affine/ssl/{{ root_cert_filename }}"
owner: "{{ ansible_user }}"
group: "svadmins"
mode: "0440"
notify: "notification_restart_affine"
no_log: true
- name: Register secret value to podman secret
containers.podman.podman_secret:
name: "{{ item.name }}"
data: "{{ item.value }}"
state: "present"
force: true
loop:
- name: "AFFINE_PRIVATE_KEY"
value: "{{ hostvars['console']['affine']['secret_key'] }}"
- name: "AFFINE_DATABASE_URL"
value: "postgresql://affine:{{ hostvars['console']['postgresql']['password']['affine'] | urlencode | replace('/', '%2F') }}\
@{{ services['postgresql']['domain'] }}.{{ domain['internal'] }}/affine_db?sslmode=verify-full&\
sslrootcert=/etc/ssl/affine/{{ root_cert_filename }}"
notify: "notification_restart_affine"
no_log: true
- name: Check data directory empty
ansible.builtin.stat:
path: "{{ node['home_path'] }}/data/containers/affine/.init"
register: "is_affine_init"
- name: Initialize affine
when: not is_affine_init.stat.exists
block:
- name: Execute init command (Including pulling image)
containers.podman.podman_container:
name: "affine_init"
image: "ghcr.io/toeverything/affine:{{ version['containers']['affine'] }}"
command: ['sh', '-c', 'node ./scripts/self-host-predeploy.js']
state: "started"
rm: true
detach: false
secrets:
- "AFFINE_DATABASE_URL,type=env,target=DATABASE_URL"
no_log: true
- name: Create .init file
ansible.builtin.file:
path: "{{ node['home_path'] }}/data/containers/affine/.init"
state: "touch"
mode: "0644"
owner: "{{ ansible_user }}"
group: "svadmins"
- name: Deploy affine.container file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/affine/affine.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/affine.container"
owner: "{{ ansible_user }}"
group: "svadmins"
mode: "0644"
notify: "notification_restart_affine"
- name: Enable affine.service
ansible.builtin.systemd:
name: "affine.service"
state: "started"
enabled: true
daemon_reload: true
scope: "user"
- name: Check container archive images
ansible.builtin.stat:
path: "{{ node['home_path'] }}/archives/containers/{{ item.file }}.tar"
loop:
- image: "docker.io/manticoresearch/manticore:{{ version['containers']['manticore'] }}"
file: "docker.io_manticoresearch_manticore_{{ version['containers']['manticore'] }}"
- image: "docker.io/library/redis:{{ version['containers']['redis'] }}"
file: "docker.io_library_redis_{{ version['containers']['redis'] }}"
- image: "ghcr.io/toeverything/affine:{{ version['containers']['affine'] }}"
file: "ghcr.io_toeverything_affine_{{ version['containers']['affine'] }}"
loop_control:
label: "{{ item.file }}"
register: container_archive_images
- name: Save container archive images
containers.podman.podman_save:
image:
- "{{ item.item.image }}"
dest: "{{ node['home_path'] }}/archives/containers/{{ item.item.file }}.tar"
format: "oci-archive"
force: false
loop: "{{ container_archive_images.results }}"
loop_control:
label: "{{ item.item.file }}"
when: not item.stat.exists
- name: Fetch container archive images
ansible.builtin.fetch:
src: "{{ node['home_path'] }}/archives/containers/{{ item.item.file }}.tar"
dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
flat: true
loop: "{{ container_archive_images.results }}"
loop_control:
label: "{{ item.item.file }}"
ansible/roles/app/tasks/services/set_collabora.yaml
+1 -1
View File
@@ -4,7 +4,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/collabora/collabora.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/collabora.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_collabora"
ansible/roles/app/tasks/services/set_gitea.yaml
+3 -3
View File
@@ -4,7 +4,7 @@
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['gitea']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "data/containers/gitea"
@@ -18,7 +18,7 @@
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/gitea/ssl/{{ root_cert_filename }}"
owner: "{{ services['gitea']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0440"
become: true
notify: "notification_restart_gitea"
@@ -38,7 +38,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/gitea/gitea.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/gitea.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_gitea"
ansible/roles/app/tasks/services/set_immich.yaml
+7 -7
View File
@@ -8,7 +8,7 @@
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['redis']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "containers/redis"
@@ -21,7 +21,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
register: "is_redis_conf"
@@ -30,7 +30,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
register: "is_redis_containerfile"
@@ -56,7 +56,7 @@
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "data/containers/immich"
@@ -71,7 +71,7 @@
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/immich/ssl/{{ root_cert_filename }}"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0440"
notify: "notification_restart_immich"
no_log: true
@@ -90,7 +90,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/immich/immich.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/immich.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_immich"
@@ -99,7 +99,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/immich/immich-ml.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/immich-ml.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_immich-ml"
ansible/roles/app/tasks/services/set_mealie.yaml
+77
View File
@@ -0,0 +1,77 @@
---
- name: Create mealie directory
ansible.builtin.file:
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['mealie']['subuid'] }}"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "data/containers/mealie"
- "data/containers/mealie/data"
- "containers/mealie"
- "containers/mealie/ssl"
become: true
- name: Deploy root certificate
ansible.builtin.copy:
content: |
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/mealie/ssl/{{ root_cert_filename }}"
owner: "{{ services['mealie']['subuid'] }}"
group: "{{ node['group'] }}"
mode: "0440"
become: true
notify: "notification_restart_mealie"
no_log: true
- name: Register secret value to podman secret
containers.podman.podman_secret:
name: "{{ item.name }}"
data: "{{ item.value }}"
state: "present"
force: true
loop:
- name: "MEALIE_POSTGRES_PASSWORD"
value: "{{ hostvars['console']['postgresql']['password']['mealie'] }}"
- name: "MEALIE_OIDC_CLIENT_SECRET"
value: "{{ hostvars['console']['mealie']['oidc']['secret'] }}"
notify: "notification_restart_mealie"
no_log: true
- name: Deploy mealie.container file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/mealie/mealie.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/mealie.container"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_mealie"
- name: Enable mealie.service
ansible.builtin.systemd:
name: "mealie.service"
state: "started"
enabled: true
daemon_reload: true
scope: "user"
- name: Check container archive images
ansible.builtin.stat:
path: "{{ node['home_path'] }}/archives/containers/ghcr.io_mealie-recipes_mealie_{{ version['containers']['mealie'] }}.tar"
register: container_archive_images
- name: Save container archive images
containers.podman.podman_save:
image:
- "ghcr.io/mealie-recipes/mealie:{{ version['containers']['mealie'] }}"
dest: "{{ node['home_path'] }}/archives/containers/ghcr.io_mealie-recipes_mealie_{{ version['containers']['mealie'] }}.tar"
format: "oci-archive"
force: false
when: not container_archive_images.stat.exists
- name: Fetch container archive images
ansible.builtin.fetch:
src: "{{ node['home_path'] }}/archives/containers/ghcr.io_mealie-recipes_mealie_{{ version['containers']['mealie'] }}.tar"
dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
flat: true
ansible/roles/app/tasks/services/set_memos.yaml
+4 -3
View File
@@ -4,7 +4,7 @@
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['memos']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "data/containers/memos"
@@ -19,7 +19,7 @@
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/memos/ssl/{{ root_cert_filename }}"
owner: "{{ services['memos']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0440"
become: true
notify: "notification_restart_memos"
@@ -33,6 +33,7 @@
sslrootcert=/etc/ssl/memos/{{ root_cert_filename }}"
state: "present"
force: true
no_log: true
notify: "notification_restart_memos"
- name: Deploy memos.container file
@@ -40,7 +41,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/memos/memos.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/memos.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_memos"
ansible/roles/app/tasks/services/set_nextcloud.yaml
+12 -12
View File
@@ -8,7 +8,7 @@
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['redis']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "containers/redis"
@@ -21,7 +21,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
register: "is_redis_conf"
@@ -30,7 +30,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
register: "is_redis_containerfile"
@@ -48,7 +48,7 @@
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['nextcloud']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "data/containers/nextcloud"
@@ -69,7 +69,7 @@
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/nextcloud/ssl/{{ root_cert_filename }}"
owner: "{{ services['nextcloud']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0440"
become: true
notify: "notification_restart_nextcloud"
@@ -88,8 +88,8 @@
detach: false
env:
NEXTCLOUD_UPDATE: "1"
NEXTCLOUD_ADMIN_USER: "admin-local"
NEXTCLOUD_ADMIN_PASSWORD: "{{ hostvars['console']['nextcloud']['admin-local']['password'] }}"
NEXTCLOUD_ADMIN_USER: "{{ hostvars['console']['nextcloud']['admin']['id'] }}"
NEXTCLOUD_ADMIN_PASSWORD: "{{ hostvars['console']['nextcloud']['admin']['password'] }}"
POSTGRES_HOST: "{{ services['postgresql']['domain'] }}.{{ domain['internal'] }}:{{ services['postgresql']['ports']['tcp'] }}"
POSTGRES_DB: "nextcloud_db"
POSTGRES_USER: "nextcloud"
@@ -110,14 +110,14 @@
state: "touch"
mode: "0644"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
- name: Deploy config files
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/nextcloud/config/{{ item }}.j2"
dest: "{{ node['home_path'] }}/data/containers/nextcloud/html/config/{{ item }}"
owner: "{{ services['nextcloud']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0640"
loop:
- "background.config.php"
@@ -132,7 +132,7 @@
ansible.builtin.copy:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/nextcloud/ini/{{ item }}"
dest: "{{ node['home_path'] }}/containers/nextcloud/ini/{{ item }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
loop:
- "opcache.ini"
@@ -144,7 +144,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/nextcloud/nextcloud.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/nextcloud.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_nextcloud"
@@ -153,7 +153,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/nextcloud/systemd/{{ item }}"
dest: "{{ node['home_path'] }}/.config/systemd/user/{{ item }}"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
loop:
- "nextcloud-cron.service"
ansible/roles/app/tasks/services/set_outline.yaml
+7 -7
View File
@@ -8,7 +8,7 @@
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['redis']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "containers/redis"
@@ -21,7 +21,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
register: "is_redis_conf"
@@ -30,7 +30,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
register: "is_redis_containerfile"
@@ -48,7 +48,7 @@
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['outline']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "data/containers/outline"
@@ -68,7 +68,7 @@
state: "touch"
mode: "0644"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
when: not is_outline_init.stat.exists
- name: Deploy root certificate
@@ -77,7 +77,7 @@
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/outline/ssl/{{ root_cert_filename }}"
owner: "{{ services['outline']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0440"
become: true
notify: "notification_restart_outline"
@@ -106,7 +106,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/outline/outline.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/outline.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_outline"
ansible/roles/app/tasks/services/set_paperless.yaml
+7 -7
View File
@@ -8,7 +8,7 @@
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['redis']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "containers/redis"
@@ -21,7 +21,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
register: "is_redis_conf"
@@ -30,7 +30,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
register: "is_redis_containerfile"
@@ -48,7 +48,7 @@
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['paperless']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "data/containers/paperless"
@@ -65,7 +65,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/paperless/build/paperless.containerfile.j2"
dest: "{{ node['home_path'] }}/containers/paperless/build/Containerfile"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0640"
- name: Deploy root certificate
@@ -74,7 +74,7 @@
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/paperless/ssl/{{ root_cert_filename }}"
owner: "{{ services['paperless']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0440"
become: true
notify: "notification_restart_paperless"
@@ -131,7 +131,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/paperless/paperless.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/paperless.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_paperless"
ansible/roles/app/tasks/services/set_sure.yaml
+6 -6
View File
@@ -8,7 +8,7 @@
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['redis']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "containers/redis"
@@ -21,7 +21,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
register: "is_redis_conf"
@@ -30,7 +30,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
register: "is_redis_containerfile"
@@ -48,7 +48,7 @@
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['sure']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "data/containers/sure"
@@ -64,7 +64,7 @@
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/sure/ssl/{{ root_cert_filename }}"
owner: "{{ services['sure']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0440"
become: true
notify: "notification_restart_sure"
@@ -91,7 +91,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/sure/{{ item }}.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/{{ item }}"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
loop:
- "sure-web.container"
ansible/roles/app/tasks/services/set_vaultwarden.yaml
+3 -3
View File
@@ -4,7 +4,7 @@
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "data/containers/vaultwarden"
@@ -17,7 +17,7 @@
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/vaultwarden/ssl/{{ root_cert_filename }}"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0440"
become: true
notify: "notification_restart_vaultwarden"
@@ -44,7 +44,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/vaultwarden/vaultwarden.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/vaultwarden.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_vaultwarden"
ansible/roles/auth/tasks/services/set_authelia.yaml
+4 -4
View File
@@ -4,7 +4,7 @@
path: "{{ node['home_path'] }}/containers/{{ item }}"
state: "directory"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "authelia"
@@ -17,7 +17,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/auth/authelia/config/authelia.yaml.j2"
dest: "{{ node['home_path'] }}/containers/authelia/config/authelia.yaml"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0600"
become: true
notify: "notification_restart_authelia"
@@ -29,7 +29,7 @@
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/authelia/certs/{{ root_cert_filename }}"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0440"
become: true
no_log: true
@@ -65,7 +65,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/auth/authelia/authelia.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/authelia.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_authelia"
ansible/roles/common/tasks/node/create_default_dir.yaml
+11 -2
View File
@@ -22,7 +22,7 @@
path: "{{ node['home_path'] }}/.config/systemd/user"
state: "directory"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0700"
- name: Create quadlet directory
@@ -30,5 +30,14 @@
path: "{{ node['home_path'] }}/.config/containers/systemd"
state: "directory"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0700"
- name: Set data volume path
ansible.builtin.file:
path: "{{ node['home_path'] }}/data"
state: "directory"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0770"
when: node['name'] in ["infra", "app"]
ansible/roles/common/tasks/node/set_networkd.yaml
+1 -1
View File
@@ -11,7 +11,7 @@
- name: Deploy networkd files
ansible.builtin.template:
src: "{{ item }}"
dest: "/etc/systemd/network/{{ item | basename }}"
dest: "/etc/systemd/network/{{ item | basename | replace('.j2', '') }}"
owner: "root"
group: "systemd-network"
mode: "0640"
ansible/roles/common/tasks/services/set_alloy.yaml
+14 -1
View File
@@ -1,5 +1,5 @@
---
- name: Gather system facts (hardware)
- name: Gather ystem facts (hardware)
ansible.builtin.setup:
gather_subset:
- hardware
@@ -67,6 +67,19 @@
become: true
notify: "notification_restart_alloy"
- name: Set ACL for data directory
ansible.posix.acl:
path: "{{ item }}"
entity: "alloy"
etype: "user"
permissions: "x"
state: "present"
loop:
- "{{ node['home_path'] }}"
- "{{ node['home_path'] }}/data"
become: true
when: node['name'] == "app"
- name: Enable alloy service
ansible.builtin.systemd:
name: "alloy.service"
ansible/roles/common/tasks/services/set_caddy.yaml
+6 -6
View File
@@ -4,7 +4,7 @@
ansible.builtin.file:
path: "{{ node['home_path'] }}/containers/{{ item }}"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
state: "directory"
mode: "0770"
loop:
@@ -18,7 +18,7 @@
ansible.builtin.file:
path: /var/log/caddy
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
state: "directory"
mode: "0755"
become: true
@@ -48,7 +48,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/common/caddy/build/caddy.containerfile.j2"
dest: "{{ node['home_path'] }}/containers/caddy/build/Containerfile"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0640"
- name: Deploy root crt for build
@@ -56,7 +56,7 @@
content: "{{ hostvars['console']['ca']['root']['crt'] }}"
dest: "{{ node['home_path'] }}/containers/caddy/build/{{ root_cert_filename }}"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0640"
no_log: true
@@ -77,7 +77,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/common/caddy/etc/{{ node['name'] }}/Caddyfile.j2"
dest: "{{ node['home_path'] }}/containers/caddy/etc/Caddyfile"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0600"
notify: "notification_restart_caddy"
@@ -86,7 +86,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/common/caddy/caddy.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/caddy.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_caddy"
ansible/roles/common/tasks/services/set_crowdsec.yaml
-4
View File
@@ -315,7 +315,3 @@
enabled: true
daemon_reload: true
become: true
# cscli bouncers list
# cscli machines list
# cscli metrics
ansible/roles/common/tasks/services/set_kopia.yaml
+2 -2
View File
@@ -14,7 +14,7 @@
kopia_{{ version['packages']['kopia'] }}_linux_{{ item }}.deb"
dest: "{{ node['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-{{ item }}.deb"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0600"
loop:
- "amd64"
@@ -36,7 +36,7 @@
- name: Connect console kopia server
environment:
KOPIA_PASSWORD: "{{ hostvars['console']['kopia']['user']['console'] }}"
KOPIA_PASSWORD: "{{ hostvars['console']['kopia']['users']['console'] }}"
ansible.builtin.shell: |
/usr/bin/kopia repository connect server \
--url=https://{{ services['kopia']['domain'] }}.{{ domain['internal'] }}:{{ services['kopia']['ports']['https'] }} \
ansible/roles/common/tasks/services/set_podman.yaml
+3 -3
View File
@@ -11,7 +11,7 @@
ansible.builtin.file:
path: "{{ node['home_path'] }}/containers"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
state: "directory"
mode: "0700"
@@ -19,7 +19,7 @@
ansible.builtin.file:
path: "{{ node['home_path'] }}/data/containers"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
state: "directory"
mode: "0770"
when: node['name'] == "app"
@@ -28,7 +28,7 @@
ansible.builtin.file:
path: "{{ item }}"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
state: "directory"
mode: "0700"
loop:
ansible/roles/console/tasks/node/create_vmm_init.yaml
+90
View File
@@ -0,0 +1,90 @@
---
- name: Create vmm_init directory
ansible.builtin.file:
path: "{{ node['data_path'] }}/{{ item }}"
state: "directory"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0750"
loop:
- "vmm_init"
- "vmm_init/grub.d"
- "vmm_init/modprobe.d"
- "vmm_init/networkd"
- "vmm_init/ssh"
- "vmm_init/ssh/sshd_config.d"
- "vmm_init/sysctl.d"
- name: Create nftables.conf
ansible.builtin.template:
src: "{{ node['config_path'] }}/node/vmm/nftables.conf.j2"
dest: "{{ node['data_path'] }}/vmm_init/nftables.conf"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0640"
- name: Create grub.d iommu config
ansible.builtin.copy:
content: |
GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=on iommu=pt"
dest: "{{ node['data_path'] }}/vmm_init/grub.d/iommu.cfg"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0640"
- name: Create modprobe.d vfio config
ansible.builtin.copy:
content: |
options vfio-pci ids={{ hostvars['vmm']['hardware']['igpu']['id'] }}
softdep i915 pre: vfio-pci
# softdep ahci pre: vfio-pci # sata controller
dest: "{{ node['data_path'] }}/vmm_init/modprobe.d/vfio.conf"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0640"
- name: Create networkd network config
ansible.builtin.template:
src: "{{ item }}"
dest: "{{ node['data_path'] }}/vmm_init/networkd/{{ item | basename | replace('.j2', '') }}"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0640"
loop: "{{ query('fileglob', hostvars['console']['node']['config_path'] + '/node/vmm/networkd/*') | sort }}"
- name: Create ssh CA
ansible.builtin.copy:
content: |
{{ hostvars['console']['ssh']['ca']['pub'] }}
dest: "{{ node['data_path'] }}/vmm_init/ssh/local_ssh_ca.pub"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0640"
- name: Create ssh config
ansible.builtin.copy:
content: "{{ item.value }}"
dest: "{{ node['data_path'] }}/vmm_init/ssh/sshd_config.d/{{ item.name }}"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0640"
loop:
- name: "prohibit_root.conf"
value: |
PermitRootLogin no
- name: "ssh_ca.conf"
value: |
TrustedUserCAKeys /etc/ssh/local_ssh_ca.pub
loop_control:
label: "{{ item.name }}"
- name: Create sysctl.d bridge config
ansible.builtin.copy:
content: |
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0
dest: "{{ node['data_path'] }}/vmm_init/sysctl.d/bridge.conf"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0640"
ansible/roles/console/tasks/node/load_secret_vars.yaml
+1 -1
View File
@@ -22,7 +22,7 @@
run_once: true
no_log: true
- name: Load decrypted secret vaules in console
- name: Load decrypted secret values in console
ansible.builtin.set_fact:
"{{ item.key }}": "{{ item.value }}"
loop: "{{ decrypted_secrets.stdout | from_yaml | dict2items }}"
ansible/roles/console/tasks/node/set_ssh_client.yaml
+4 -4
View File
@@ -66,8 +66,8 @@
content: |
{{ hostvars['console']['ssh']['ca']['key'] }}
dest: "/run/user/{{ node['uid'] }}/local_ssh_ca_private_key"
owner: "console"
group: "svadmins"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0400"
no_log: true
- name: Sign on ssh console key (pub file)
@@ -91,7 +91,7 @@
path: "{{ node['home_path'] }}/.ssh"
state: "directory"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0700"
- name: Create ssh config file
@@ -105,5 +105,5 @@
{% endfor %}
dest: "{{ node['home_path'] }}/.ssh/config"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0600"
ansible/roles/console/tasks/services/set_cli_tools.yaml
+2 -2
View File
@@ -31,7 +31,7 @@
sops_{{ version['packages']['sops'] }}_{{ item }}.deb"
dest: "{{ node['data_path'] }}/bin/sops-{{ version['packages']['sops'] }}-{{ item }}.deb"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0600"
loop:
- "amd64"
@@ -43,7 +43,7 @@
step-cli_{{ version['packages']['step'] }}-1_{{ item }}.deb"
dest: "{{ node['data_path'] }}/bin/step-{{ version['packages']['step'] }}-{{ item }}.deb"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0600"
loop:
- "amd64"
ansible/roles/fw/handlers/main.yaml
+1 -1
View File
@@ -44,7 +44,7 @@
ansible.builtin.systemd:
name: "blocky.service"
state: "restarted"
enabled: "true"
enabled: true
daemon_reload: true
become: true
changed_when: false
ansible/roles/fw/tasks/services/set_bind.yaml
+1 -1
View File
@@ -25,7 +25,7 @@
become: true
when: is_bind_installed.rc != 0
- name: Deploy acem.key
- name: Deploy acme.key
ansible.builtin.copy:
content: "{{ hostvars['console']['bind']['acme_key'] }}"
dest: "/etc/bind/acme.key"
ansible/roles/fw/tasks/services/set_ddns.yaml
+3 -3
View File
@@ -6,7 +6,7 @@
API_KEY={{ hostvars['console']['ddns']['api_key'] }}
dest: "/etc/secrets/{{ node['uid'] }}/ddns.env"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0400"
become: true
no_log: true
@@ -16,7 +16,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/ddns/ddns.sh"
dest: "/usr/local/bin"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0711"
become: true
@@ -25,7 +25,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/ddns/{{ item }}.j2"
dest: "{{ node['home_path'] }}/.config/systemd/user/{{ item }}"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0600"
validate: "/usr/bin/systemd-analyze verify %s"
loop:
ansible/roles/fw/tasks/services/set_kea.yaml
+2 -2
View File
@@ -26,7 +26,7 @@
become: true
notify: "notification_restart_kea4"
- name: Create kea-dhcp-server.service.d
- name: Create kea-dhcp4-server.service.d
ansible.builtin.file:
path: "/etc/systemd/system/kea-dhcp4-server.service.d"
state: "directory"
@@ -35,7 +35,7 @@
mode: "0755"
become: true
- name: Set kea-dhcp-server.service.d/override.conf
- name: Set kea-dhcp4-server.service.d/override.conf
ansible.builtin.copy:
dest: "/etc/systemd/system/kea-dhcp4-server.service.d/override.conf"
content: |
ansible/roles/infra/handlers/main.yaml
+1 -1
View File
@@ -2,7 +2,7 @@
ansible.builtin.systemd:
name: "ca.service"
state: "restarted"
enabled: "true"
enabled: true
daemon_reload: true
scope: "user"
changed_when: false
ansible/roles/infra/tasks/services/set_ca_server.yaml
+4 -4
View File
@@ -3,7 +3,7 @@
ansible.builtin.file:
path: "{{ node['home_path'] }}/containers/{{ item }}"
owner: "{{ services['ca']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
state: "directory"
mode: "0770"
loop:
@@ -29,7 +29,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ca/config/{{ item }}.j2"
dest: "{{ node['home_path'] }}/containers/ca/config/{{ item }}"
owner: "{{ services['ca']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0400"
loop:
- "ca.json"
@@ -43,7 +43,7 @@
{{ item.value }}
dest: "{{ item.path }}/{{ item.name }}"
owner: "{{ services['ca']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "{{ item.mode }}"
loop:
- name: "{{ root_cert_filename }}"
@@ -67,7 +67,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ca/ca.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/ca.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_ca"
ansible/roles/infra/tasks/services/set_grafana.yaml
+8 -7
View File
@@ -3,7 +3,7 @@
ansible.builtin.file:
path: "{{ node['home_path'] }}/containers/{{ item }}"
owner: "{{ services['grafana']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
state: "directory"
mode: "0770"
loop:
@@ -11,6 +11,7 @@
- "grafana/data"
- "grafana/etc"
- "grafana/etc/provisioning"
- "grafana/etc/provisioning/datasources"
- "grafana/etc/dashboards"
- "grafana/ssl"
become: true
@@ -21,7 +22,7 @@
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/grafana/ssl/{{ root_cert_filename }}"
owner: "{{ services['grafana']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0400"
become: true
notify: "notification_restart_grafana"
@@ -39,16 +40,16 @@
- name: "LDAP_BIND_PASSWORD"
value: "{{ hostvars['console']['ldap']['password']['grafana'] }}"
- name: "GF_ADMIN_PASSWORD"
value: "{{ hostvars['console']['grafana']['user']['password'] }}"
value: "{{ hostvars['console']['grafana']['admin']['password'] }}"
notify: "notification_restart_grafana"
no_log: true
- name: Deploy configruation files
- name: Deploy configuration files
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/etc/{{ item }}.j2"
dest: "{{ node['home_path'] }}/containers/grafana/etc/{{ item }}"
owner: "{{ services['grafana']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0400"
loop:
- "grafana.ini"
@@ -62,7 +63,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/etc/provisioning/datasources/datasources.yaml.j2"
dest: "{{ node['home_path'] }}/containers/grafana/etc/provisioning/datasources/datasources.yaml"
owner: "{{ services['grafana']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0400"
become: true
notify: "notification_restart_grafana"
@@ -72,7 +73,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/grafana.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/grafana.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_grafana"
ansible/roles/infra/tasks/services/set_ldap.yaml
+6 -5
View File
@@ -3,7 +3,7 @@
ansible.builtin.file:
path: "{{ node['home_path'] }}/containers/{{ item }}"
owner: "{{ services['ldap']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
state: "directory"
mode: "0770"
loop:
@@ -18,7 +18,7 @@
{{ item.value }}
dest: "{{ node['home_path'] }}/containers/ldap/ssl/{{ item.name }}"
owner: "{{ services['ldap']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "{{ item.mode }}"
loop:
- name: "{{ root_cert_filename }}"
@@ -33,8 +33,8 @@
value: "{{ hostvars['console']['ldap']['key'] }}"
mode: "0400"
become: true
notify: "notification_restart_ldap"
no_log: true
notify: "notification_restart_ldap"
- name: Register secret value to podman secret
containers.podman.podman_secret:
@@ -51,14 +51,15 @@
value: "{{ hostvars['console']['ldap']['seed_key'] }}"
- name: "LLDAP_JWT_SECRET"
value: "{{ hostvars['console']['ldap']['jwt_secret'] }}"
notify: "notification_restart_ldap"
no_log: true
notify: "notification_restart_ldap"
- name: Initiate ldap (When = false, If DB data does not exist in postgresql, activate this block)
# The reason why this task doesn't use the way to check ".init" file is this tasks can override original database.
# Absent of ".init" file cannot guarantee DB is empty.
when: false
become: true
no_log: true
block:
- name: Register extra secret value to podman secret
containers.podman.podman_secret:
@@ -97,7 +98,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ldap/ldap.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/ldap.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_ldap"
ansible/roles/infra/tasks/services/set_loki.yaml
+4 -4
View File
@@ -4,7 +4,7 @@
path: "{{ node['home_path'] }}/containers/{{ item }}"
state: "directory"
owner: "{{ services['loki']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "loki"
@@ -18,7 +18,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/loki/etc/loki.yaml.j2"
dest: "{{ node['home_path'] }}/containers/loki/etc/loki.yaml"
owner: "{{ services['loki']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0600"
become: true
notify: "notification_restart_loki"
@@ -30,7 +30,7 @@
{{ item.value }}
dest: "{{ node['home_path'] }}/containers/loki/ssl/{{ item.name }}"
owner: "{{ services['loki']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "{{ item.mode }}"
loop:
- name: "{{ root_cert_filename }}"
@@ -53,7 +53,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/loki/loki.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/loki.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_loki"
ansible/roles/infra/tasks/services/set_postgresql.yaml
+24 -22
View File
@@ -3,33 +3,33 @@
ansible.builtin.set_fact:
connected_services:
- "ldap"
- "authelia"
- "grafana"
- "authelia"
- "vaultwarden"
- "gitea"
- "immich"
- "paperless"
- "affine"
- "nextcloud"
- "sure"
- "outline"
- "memos"
- "mealie"
- name: Create postgresql directory
ansible.builtin.file:
path: "{{ node['home_path'] }}/containers/{{ item }}"
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['postgresql']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "postgresql"
- "postgresql/data"
- "postgresql/config"
- "postgresql/ssl"
- "postgresql/init"
- "postgresql/backups"
- "postgresql/build"
- "data/containers/postgresql/backups"
- "containers/postgresql"
- "containers/postgresql/data"
- "containers/postgresql/config"
- "containers/postgresql/ssl"
- "containers/postgresql/init"
- "containers/postgresql/build"
become: true
- name: Deploy containerfile for build
@@ -37,7 +37,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/build/postgresql.containerfile.j2"
dest: "{{ node['home_path'] }}/containers/postgresql/build/Containerfile"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0640"
- name: Build postgresql container image
@@ -57,7 +57,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/config/{{ item }}.j2"
dest: "{{ node['home_path'] }}/containers/postgresql/config/{{ item }}"
owner: "{{ services['postgresql']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0600"
loop:
- "postgresql.conf"
@@ -72,7 +72,7 @@
{{ item.value }}
dest: "{{ node['home_path'] }}/containers/postgresql/ssl/{{ item.name }}"
owner: "{{ services['postgresql']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "{{ item.mode }}"
loop:
- name: "{{ root_cert_filename }}"
@@ -97,24 +97,26 @@
register: "is_postgresql_init"
- name: Prepare initiating DB
when: not is_postgresql_init.stat.exists
when:
- not is_postgresql_init.stat.exists
- (connected_services | default([]) | length) > 0
become: true
block:
# `init/pg_cluster.sql` should be fetched from postgresql's backup directory before running initiating
- name: Deploy init cluster sql file
ansible.builtin.copy:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/init/pg_cluster.sql"
dest: "{{ node['home_path'] }}/containers/postgresql/init/0_pg_cluster.sql"
dest: "{{ node['home_path'] }}/containers/postgresql/init/00_pg_cluster.sql"
owner: "{{ services['postgresql']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0600"
- name: Deploy restoring data sql files
ansible.builtin.copy:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/init/pg_{{ item }}.sql"
dest: "{{ node['home_path'] }}/containers/postgresql/init/{{ index_num + 1 }}_pg_{{ item }}.sql"
dest: "{{ node['home_path'] }}/containers/postgresql/init/{{ '%02d' | format(index_num + 1) }}_pg_{{ item }}.sql"
owner: "{{ services['postgresql']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0600"
loop: "{{ connected_services }}"
loop_control:
@@ -126,14 +128,14 @@
state: "touch"
mode: "0644"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
- name: Deploy container file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/postgresql.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/postgresql.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_postgresql"
@@ -142,7 +144,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/services/{{ item }}"
dest: "{{ node['home_path'] }}/.config/systemd/user/{{ item }}"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
loop:
- "postgresql-cluster-backup.service"
ansible/roles/infra/tasks/services/set_prometheus.yaml
+4 -4
View File
@@ -4,7 +4,7 @@
path: "{{ node['home_path'] }}/containers/{{ item }}"
state: "directory"
owner: "{{ services['prometheus']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "prometheus"
@@ -18,7 +18,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/prometheus/etc/{{ item }}.j2"
dest: "{{ node['home_path'] }}/containers/prometheus/etc/{{ item }}"
owner: "{{ services['prometheus']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0600"
loop:
- "prometheus.yaml"
@@ -34,7 +34,7 @@
{{ item.value }}
dest: "{{ node['home_path'] }}/containers/prometheus/ssl/{{ item.name }}"
owner: "{{ services['prometheus']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "{{ item.mode }}"
loop:
- name: "{{ root_cert_filename }}"
@@ -57,7 +57,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/prometheus/prometheus.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/prometheus.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_prometheus"
ansible/roles/infra/tasks/services/set_x509-exporter.yaml
+4 -4
View File
@@ -4,7 +4,7 @@
path: "{{ node['home_path'] }}/containers/{{ item }}"
state: "directory"
owner: "{{ services['x509-exporter']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "x509-exporter"
@@ -17,7 +17,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/x509-exporter/config/config.yaml"
dest: "{{ node['home_path'] }}/containers/x509-exporter/config/config.yaml"
owner: "{{ services['x509-exporter']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0440"
become: true
notify: "notification_restart_x509-exporter"
@@ -28,7 +28,7 @@
{{ item.value }}
dest: "{{ node['home_path'] }}/containers/x509-exporter/certs/{{ item.name }}"
owner: "{{ services['x509-exporter']['subuid'] }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0440"
loop:
- name: "root.crt"
@@ -57,7 +57,7 @@
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/x509-exporter/x509-exporter.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/x509-exporter.container"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_x509-exporter"
ansible/roles/vmm/tasks/node/set_libvirt.yaml
+6 -2
View File
@@ -9,15 +9,16 @@
- name: Check libvirt directory
ansible.builtin.stat:
path: "/var/lib/libvirt/{{ item }}"
path: "{{ node['libvirt_path'] }}/{{ item }}"
loop:
- "images"
- "seeds"
- "data"
register: "is_libvirt_dir"
- name: Create libvirt directory
ansible.builtin.file:
path: "/var/lib/libvirt/{{ item.item }}"
path: "{{ node['libvirt_path'] }}/{{ item.item }}"
state: "directory"
owner: "root"
group: "root"
@@ -72,6 +73,7 @@
loop:
- "images-pool"
- "seeds-pool"
- "data-pool"
- name: Start virtual storage pool
community.libvirt.virt_pool:
@@ -81,6 +83,7 @@
loop:
- "images-pool"
- "seeds-pool"
- "data-pool"
- name: Autostart virtual storage pool
community.libvirt.virt_pool:
@@ -90,3 +93,4 @@
loop:
- "images-pool"
- "seeds-pool"
- "data-pool"
ansible/roles/app/tasks/node/set_raid.yaml → ansible/roles/vmm/tasks/node/set_raid.yaml
+32 -22
View File
@@ -18,16 +18,17 @@
- name: Set hard disk path
ansible.builtin.shell: |
set -o pipefail
ls -1 /dev/disk/by-path/*{{ vm['pass_through']['sata_controller']['address'] }}* | \
grep -v '\.0$' | \
ls -1 /dev/disk/by-id/ata-* | \
grep -F -e "{{ hardware['hdd']['data'].values() | join('" -e "') }}" | \
grep -vE -- '-part[0-9]+$' | \
sort
changed_when: false
register: "hdd_path_list"
- name: Check app_hdd filesystem already exists
- name: Check vmm_hdd filesystem already exists
ansible.builtin.command: |
blkid -L {{ storage['btrfs']['label'] }}
register: is_app_data
blkid -L {{ hardware['btrfs']['label'] }}
register: is_vmm_data
changed_when: false
failed_when: false
become: true
@@ -40,38 +41,47 @@
- name: Set btrfs raid10 volume
ansible.builtin.shell: |
mkfs.btrfs -f \
-L {{ storage['btrfs']['label'] }} \
-d {{ storage['btrfs']['level'] }} \
-m {{ storage['btrfs']['level'] }} \
-L {{ hardware['btrfs']['label'] }} \
-d {{ hardware['btrfs']['level'] }} \
-m {{ hardware['btrfs']['level'] }} \
{{ hdd_path_list.stdout_lines | join(' ') }}
become: true
when:
- is_app_data.rc != 0
- is_vmm_data.rc != 0
- (hdd_path_list.stdout_lines | length) >= 4
changed_when: is_mkfs.rc == 0
register: "is_mkfs"
- name: Mount btrfs raid10 volume
ansible.posix.mount:
path: "{{ storage['btrfs']['mount_point'] }}"
src: "LABEL={{ storage['btrfs']['label'] }}"
state: "mounted"
fstype: "btrfs"
opts: "defaults,noatime,compress=zstd:3,autodefrag,degraded,nofail"
- name: Create mount volume
ansible.builtin.file:
path: "{{ hardware['btrfs']['mount_point'] }}"
state: "directory"
owner: "root"
group: "root"
mode: "0711"
become: true
- name: Set hard disk path permissions
- name: Mount btrfs raid10 volume
ansible.posix.mount:
path: "{{ hardware['btrfs']['mount_point'] }}"
src: "LABEL={{ hardware['btrfs']['label'] }}"
state: "mounted"
fstype: "btrfs"
opts: "defaults,noatime,nodatacow,degraded,nofail"
become: true
- name: Set mounted btrfs volume permissions
ansible.builtin.file:
path: "{{ storage['btrfs']['mount_point'] }}"
path: "{{ hardware['btrfs']['mount_point'] }}"
state: "directory"
owner: "{{ ansible_user }}"
group: "svadmins"
mode: "0770"
owner: "root"
group: "root"
mode: "0711"
become: true
- name: Deploy btrfs scrub service and timer
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/app/btrfs/{{ item }}.j2"
src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/vmm/btrfs/{{ item }}.j2"
dest: "/etc/systemd/system/{{ item }}"
owner: "root"
group: "root"
ansible/roles/vmm/tasks/vm/create_seed.yaml
+9 -9
View File
@@ -1,13 +1,13 @@
---
# This task is located in vmm roles because of its attributes,
# but all process should be run in "console".
# At the playbook, `delegate_to: "console"` option is applyed by `apply:`.
# At the playbook, `delegate_to: "console"` option is applied by `apply:`.
- name: Create images directory
ansible.builtin.file:
path: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}"
state: "directory"
owner: "console"
group: "svadmins"
owner: "{{ hostvars['console']['node']['name'] }}"
group: "{{ hostvars['console']['node']['group'] }}"
mode: "0700"
- name: Create temp meta-data
@@ -16,8 +16,8 @@
instance-id: vm-{{ target_vm }}
local-hostname: {{ target_vm }}
dest: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}/meta-data"
owner: "console"
group: "svadmins"
owner: "{{ hostvars['console']['node']['name'] }}"
group: "{{ hostvars['console']['node']['group'] }}"
mode: "0600"
register: "vm_meta_data"
no_log: true
@@ -26,8 +26,8 @@
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/vmm/libvirt/seeds/user-data.j2"
dest: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}/user-data"
owner: "console"
group: "svadmins"
owner: "{{ hostvars['console']['node']['name'] }}"
group: "{{ hostvars['console']['node']['group'] }}"
mode: "0600"
register: "vm_user_data"
no_log: true
@@ -37,8 +37,8 @@
content: |
network: {config: disabled}
dest: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}/network-config"
owner: "console"
group: "svadmins"
owner: "{{ hostvars['console']['node']['name'] }}"
group: "{{ hostvars['console']['node']['group'] }}"
mode: "0600"
register: "vm_network_config"
no_log: true
ansible/roles/vmm/tasks/vm/deploy_vm_init.yaml
+29 -10
View File
@@ -1,16 +1,16 @@
---
- name: Check vm cloud-init
ansible.builtin.stat:
path: "/var/lib/libvirt/images/debian-13.qcow2"
path: "{{ node['libvirt_path'] }}/images/debian-13.qcow2"
become: true
register: is_cloud_init_file
- name: Deploy vm cloud-init
ansible.builtin.copy:
src: "{{ hostvars['console']['node']['data_path'] }}/images/debian-13-generic-amd64.qcow2"
dest: "/var/lib/libvirt/images/debian-13.qcow2"
dest: "{{ node['libvirt_path'] }}/images/debian-13.qcow2"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
force: false
become: true
@@ -18,10 +18,10 @@
- name: Remote copy vm cloud-init file
ansible.builtin.copy:
src: "/var/lib/libvirt/images/debian-13.qcow2"
dest: "/var/lib/libvirt/images/{{ target_vm }}.qcow2"
src: "{{ node['libvirt_path'] }}/images/debian-13.qcow2"
dest: "{{ node['libvirt_path'] }}/images/{{ target_vm }}.qcow2"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
remote_src: true
force: false
@@ -29,7 +29,7 @@
- name: Check deployed cloud-init file info
ansible.builtin.command:
cmd: "qemu-img info /var/lib/libvirt/images/{{ target_vm }}.qcow2 --output json"
cmd: "qemu-img info {{ node['libvirt_path'] }}/images/{{ target_vm }}.qcow2 --output json"
changed_when: false
failed_when:
- deployed_cloudfile_info.rc != 0
@@ -38,18 +38,37 @@
- name: Resize deployed cloud-init file
ansible.builtin.command:
cmd: "qemu-img resize /var/lib/libvirt/images/{{ target_vm }}.qcow2 {{ hostvars[target_vm]['vm']['storage'] }}G"
cmd: "qemu-img resize {{ node['libvirt_path'] }}/images/{{ target_vm }}.qcow2 {{ hostvars[target_vm]['vm']['storage'] }}G"
when:
- deployed_cloudfile_info.rc == 0
- (deployed_cloudfile_info.stdout | from_json)['virtual-size'] < (hostvars[target_vm]['vm']['storage'] | int * 1024 * 1024 * 1024)
changed_when: true
- name: Check app data raw image
ansible.builtin.stat:
path: "{{ hardware['btrfs']['mount_point'] }}/{{ target_vm }}.raw"
get_checksum: false
get_mime: false
get_attributes: false
when: target_vm == "app"
register: "is_app_data"
- name: Create app data raw image
ansible.builtin.command:
# 3.5T
cmd: "qemu-img create -f raw {{ hardware['btrfs']['mount_point'] }}/{{ target_vm }}.raw {{ hostvars[target_vm]['vm']['data_storage']['size'] }}T"
become: true
when:
- target_vm == "app"
- not is_app_data.stat.exists
changed_when: true
- name: Deploy vm seed.iso
ansible.builtin.copy:
src: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}/seed.iso"
dest: "/var/lib/libvirt/seeds/{{ target_vm }}_seed.iso"
dest: "{{ node['libvirt_path'] }}/seeds/{{ target_vm }}_seed.iso"
owner: "{{ ansible_user }}"
group: "svadmins"
group: "{{ node['group'] }}"
mode: "0644"
become: true
when: deployed_cloudfile_info.rc == 0