feat(repo): IaaS baseline

ansible/roles/infra/tasks/services/set_ca_server.yaml

@@ -3,7 +3,7 @@
   ansible.builtin.file:
     path: "{{ node['home_path'] }}/containers/{{ item }}"
     owner: "{{ services['ca']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     state: "directory"
     mode: "0770"
   loop:
@@ -29,7 +29,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ca/config/{{ item }}.j2"
     dest: "{{ node['home_path'] }}/containers/ca/config/{{ item }}"
     owner: "{{ services['ca']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0400"
   loop:
     - "ca.json"
@@ -43,7 +43,7 @@
       {{ item.value }}
     dest: "{{ item.path }}/{{ item.name }}"
     owner: "{{ services['ca']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "{{ item.mode }}"
   loop:
     - name: "{{ root_cert_filename }}"
@@ -67,7 +67,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ca/ca.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/ca.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_ca"
 

ansible/roles/infra/tasks/services/set_grafana.yaml

@@ -3,7 +3,7 @@
   ansible.builtin.file:
     path: "{{ node['home_path'] }}/containers/{{ item }}"
     owner: "{{ services['grafana']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     state: "directory"
     mode: "0770"
   loop:
@@ -11,6 +11,7 @@
     - "grafana/data"
     - "grafana/etc"
     - "grafana/etc/provisioning"
+    - "grafana/etc/provisioning/datasources"
     - "grafana/etc/dashboards"
     - "grafana/ssl"
   become: true
@@ -21,7 +22,7 @@
       {{ hostvars['console']['ca']['root']['crt'] }}
     dest: "{{ node['home_path'] }}/containers/grafana/ssl/{{ root_cert_filename }}"
     owner: "{{ services['grafana']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0400"
   become: true
   notify: "notification_restart_grafana"
@@ -39,16 +40,16 @@
     - name: "LDAP_BIND_PASSWORD"
       value: "{{ hostvars['console']['ldap']['password']['grafana'] }}"
     - name: "GF_ADMIN_PASSWORD"
-      value: "{{ hostvars['console']['grafana']['user']['password'] }}"
+      value: "{{ hostvars['console']['grafana']['admin']['password'] }}"
   notify: "notification_restart_grafana"
   no_log: true
 
-- name: Deploy configruation files
+- name: Deploy configuration files
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/etc/{{ item }}.j2"
     dest: "{{ node['home_path'] }}/containers/grafana/etc/{{ item }}"
     owner: "{{ services['grafana']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0400"
   loop:
     - "grafana.ini"
@@ -62,7 +63,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/etc/provisioning/datasources/datasources.yaml.j2"
     dest: "{{ node['home_path'] }}/containers/grafana/etc/provisioning/datasources/datasources.yaml"
     owner: "{{ services['grafana']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0400"
   become: true
   notify: "notification_restart_grafana"
@@ -72,7 +73,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/grafana.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/grafana.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_grafana"
 

ansible/roles/infra/tasks/services/set_ldap.yaml

@@ -3,7 +3,7 @@
   ansible.builtin.file:
     path: "{{ node['home_path'] }}/containers/{{ item }}"
     owner: "{{ services['ldap']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     state: "directory"
     mode: "0770"
   loop:
@@ -18,7 +18,7 @@
       {{ item.value }}
     dest: "{{ node['home_path'] }}/containers/ldap/ssl/{{ item.name }}"
     owner: "{{ services['ldap']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "{{ item.mode }}"
   loop:
     - name: "{{ root_cert_filename }}"
@@ -33,8 +33,8 @@
       value: "{{ hostvars['console']['ldap']['key'] }}"
       mode: "0400"
   become: true
-  notify: "notification_restart_ldap"
   no_log: true
+  notify: "notification_restart_ldap"
 
 - name: Register secret value to podman secret
   containers.podman.podman_secret:
@@ -51,14 +51,15 @@
       value: "{{ hostvars['console']['ldap']['seed_key'] }}"
     - name: "LLDAP_JWT_SECRET"
       value: "{{ hostvars['console']['ldap']['jwt_secret'] }}"
-  notify: "notification_restart_ldap"
   no_log: true
+  notify: "notification_restart_ldap"
 
 - name: Initiate ldap (When = false, If DB data does not exist in postgresql, activate this block)
 # The reason why this task doesn't use the way to check ".init" file is this tasks can override original database.
 # Absent of ".init" file cannot guarantee DB is empty.
   when: false
   become: true
+  no_log: true
   block:
     - name: Register extra secret value to podman secret
       containers.podman.podman_secret:
@@ -97,7 +98,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ldap/ldap.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/ldap.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_ldap"
 

ansible/roles/infra/tasks/services/set_loki.yaml

@@ -4,7 +4,7 @@
     path: "{{ node['home_path'] }}/containers/{{ item }}"
     state: "directory"
     owner: "{{ services['loki']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "loki"
@@ -18,7 +18,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/loki/etc/loki.yaml.j2"
     dest: "{{ node['home_path'] }}/containers/loki/etc/loki.yaml"
     owner: "{{ services['loki']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0600"
   become: true
   notify: "notification_restart_loki"
@@ -30,7 +30,7 @@
       {{ item.value }}
     dest: "{{ node['home_path'] }}/containers/loki/ssl/{{ item.name }}"
     owner: "{{ services['loki']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "{{ item.mode }}"
   loop:
     - name: "{{ root_cert_filename }}"
@@ -53,7 +53,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/loki/loki.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/loki.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_loki"
 

ansible/roles/infra/tasks/services/set_postgresql.yaml

@@ -3,33 +3,33 @@
   ansible.builtin.set_fact:
     connected_services:
       - "ldap"
-      - "authelia"
       - "grafana"
+      - "authelia"
       - "vaultwarden"
       - "gitea"
       - "immich"
       - "paperless"
-      - "affine"
       - "nextcloud"
       - "sure"
       - "outline"
       - "memos"
+      - "mealie"
 
 - name: Create postgresql directory
   ansible.builtin.file:
-    path: "{{ node['home_path'] }}/containers/{{ item }}"
+    path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ services['postgresql']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
-    - "postgresql"
-    - "postgresql/data"
-    - "postgresql/config"
-    - "postgresql/ssl"
-    - "postgresql/init"
-    - "postgresql/backups"
-    - "postgresql/build"
+    - "data/containers/postgresql/backups"
+    - "containers/postgresql"
+    - "containers/postgresql/data"
+    - "containers/postgresql/config"
+    - "containers/postgresql/ssl"
+    - "containers/postgresql/init"
+    - "containers/postgresql/build"
   become: true
 
 - name: Deploy containerfile for build
@@ -37,7 +37,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/build/postgresql.containerfile.j2"
     dest: "{{ node['home_path'] }}/containers/postgresql/build/Containerfile"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0640"
 
 - name: Build postgresql container image
@@ -57,7 +57,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/config/{{ item }}.j2"
     dest: "{{ node['home_path'] }}/containers/postgresql/config/{{ item }}"
     owner: "{{ services['postgresql']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0600"
   loop:
     - "postgresql.conf"
@@ -72,7 +72,7 @@
       {{ item.value }}
     dest: "{{ node['home_path'] }}/containers/postgresql/ssl/{{ item.name }}"
     owner: "{{ services['postgresql']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "{{ item.mode }}"
   loop:
     - name: "{{ root_cert_filename }}"
@@ -97,24 +97,26 @@
   register: "is_postgresql_init"
 
 - name: Prepare initiating DB
-  when: not is_postgresql_init.stat.exists
+  when:
+    - not is_postgresql_init.stat.exists
+    - (connected_services | default([]) | length) > 0
   become: true
   block:
     # `init/pg_cluster.sql` should be fetched from postgresql's backup directory before running initiating
     - name: Deploy init cluster sql file
       ansible.builtin.copy:
         src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/init/pg_cluster.sql"
-        dest: "{{ node['home_path'] }}/containers/postgresql/init/0_pg_cluster.sql"
+        dest: "{{ node['home_path'] }}/containers/postgresql/init/00_pg_cluster.sql"
         owner: "{{ services['postgresql']['subuid'] }}"
-        group: "svadmins"
+        group: "{{ node['group'] }}"
         mode: "0600"
 
     - name: Deploy restoring data sql files
       ansible.builtin.copy:
         src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/init/pg_{{ item }}.sql"
-        dest: "{{ node['home_path'] }}/containers/postgresql/init/{{ index_num + 1 }}_pg_{{ item }}.sql"
+        dest: "{{ node['home_path'] }}/containers/postgresql/init/{{ '%02d' | format(index_num + 1) }}_pg_{{ item }}.sql"
         owner: "{{ services['postgresql']['subuid'] }}"
-        group: "svadmins"
+        group: "{{ node['group'] }}"
         mode: "0600"
       loop: "{{ connected_services }}"
       loop_control:
@@ -126,14 +128,14 @@
         state: "touch"
         mode: "0644"
         owner: "{{ ansible_user }}"
-        group: "svadmins"
+        group: "{{ node['group'] }}"
 
 - name: Deploy container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/postgresql.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/postgresql.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_postgresql"
 
@@ -142,7 +144,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/services/{{ item }}"
     dest: "{{ node['home_path'] }}/.config/systemd/user/{{ item }}"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   loop:
     - "postgresql-cluster-backup.service"

ansible/roles/infra/tasks/services/set_prometheus.yaml

@@ -4,7 +4,7 @@
     path: "{{ node['home_path'] }}/containers/{{ item }}"
     state: "directory"
     owner: "{{ services['prometheus']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "prometheus"
@@ -18,7 +18,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/prometheus/etc/{{ item }}.j2"
     dest: "{{ node['home_path'] }}/containers/prometheus/etc/{{ item }}"
     owner: "{{ services['prometheus']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0600"
   loop:
     - "prometheus.yaml"
@@ -34,7 +34,7 @@
       {{ item.value }}
     dest: "{{ node['home_path'] }}/containers/prometheus/ssl/{{ item.name }}"
     owner: "{{ services['prometheus']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "{{ item.mode }}"
   loop:
     - name: "{{ root_cert_filename }}"
@@ -57,7 +57,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/prometheus/prometheus.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/prometheus.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_prometheus"
 

ansible/roles/infra/tasks/services/set_x509-exporter.yaml

@@ -4,7 +4,7 @@
     path: "{{ node['home_path'] }}/containers/{{ item }}"
     state: "directory"
     owner: "{{ services['x509-exporter']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "x509-exporter"
@@ -17,7 +17,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/x509-exporter/config/config.yaml"
     dest: "{{ node['home_path'] }}/containers/x509-exporter/config/config.yaml"
     owner: "{{ services['x509-exporter']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0440"
   become: true
   notify: "notification_restart_x509-exporter"
@@ -28,7 +28,7 @@
       {{ item.value }}
     dest: "{{ node['home_path'] }}/containers/x509-exporter/certs/{{ item.name }}"
     owner: "{{ services['x509-exporter']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0440"
   loop:
     - name: "root.crt"
@@ -57,7 +57,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/x509-exporter/x509-exporter.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/x509-exporter.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_x509-exporter"