1.0.0 Release IaaS

ansible/roles/infra/handlers/main.yaml

@@ -0,0 +1,85 @@
+- name: Restart ca
+  ansible.builtin.systemd:
+    name: "ca.service"
+    state: "restarted"
+    enabled: "true"
+    daemon_reload: true
+    scope: "user"
+  changed_when: false
+  listen: "notification_restart_ca"
+  ignore_errors: true # noqa: ignore-errors
+
+- name: Reload postgresql
+  ansible.builtin.command:
+    /usr/bin/podman exec -u postgres postgresql sh -c "pg_ctl reload"
+  when: not (is_postgresql_init_run | default(false))
+  changed_when: false
+  listen: "notification_reload_postgresql"
+  ignore_errors: true # noqa: ignore-errors
+
+- name: Restart postgresql
+  ansible.builtin.systemd:
+    name: "postgresql.service"
+    state: "restarted"
+    enabled: true
+    daemon_reload: true
+    scope: "user"
+  when: not (is_postgresql_init_run | default(false))
+  changed_when: false
+  listen: "notification_restart_postgresql"
+  ignore_errors: true # noqa: ignore-errors
+
+- name: Restart ldap
+  ansible.builtin.systemd:
+    name: "ldap.service"
+    state: "restarted"
+    enabled: true
+    daemon_reload: true
+    scope: "user"
+  changed_when: false
+  listen: "notification_restart_ldap"
+  ignore_errors: true # noqa: ignore-errors
+
+- name: Restart prometheus
+  ansible.builtin.systemd:
+    name: "prometheus.service"
+    state: "restarted"
+    enabled: true
+    daemon_reload: true
+    scope: "user"
+  changed_when: false
+  listen: "notification_restart_prometheus"
+  ignore_errors: true # noqa: ignore-errors
+
+- name: Restart loki
+  ansible.builtin.systemd:
+    name: "loki.service"
+    state: "restarted"
+    enabled: true
+    daemon_reload: true
+    scope: "user"
+  changed_when: false
+  listen: "notification_restart_loki"
+  ignore_errors: true # noqa: ignore-errors
+
+- name: Restart grafana
+  ansible.builtin.systemd:
+    name: "grafana.service"
+    state: "restarted"
+    enabled: true
+    daemon_reload: true
+    scope: "user"
+  changed_when: false
+  listen: "notification_restart_grafana"
+  ignore_errors: true # noqa: ignore-errors
+
+- name: Enable x509-exporter.service
+  ansible.builtin.systemd:
+    name: "x509-exporter.service"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"
+  changed_when: false
+  listen: "notification_restart_x509-exporter"
+  ignore_errors: true # noqa: ignore-errors

ansible/roles/infra/tasks/services/set_ca_server.yaml

@@ -0,0 +1,84 @@
+---
+- name: Set ca container subuid
+  ansible.builtin.set_fact:
+    ca_subuid: "100999"
+
+- name: Create ca directory
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/containers/{{ item }}"
+    owner: "{{ ca_subuid }}"
+    group: "svadmins"
+    state: "directory"
+    mode: "0770"
+  loop:
+    - "ca"
+    - "ca/certs"
+    - "ca/secrets"
+    - "ca/config"
+    - "ca/db"
+    - "ca/templates"
+  become: true
+
+- name: Register secret value to podman secret
+  containers.podman.podman_secret:
+    name: "STEP_CA_PASSWORD"
+    data: "{{ hostvars['console']['ca']['intermediate']['password'] }}"
+    state: "present"
+    force: true
+  notify: "notification_restart_ca"
+  no_log: true
+
+- name: Deploy ca config files
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ca/config/{{ item }}.j2"
+    dest: "{{ node['home_path'] }}/containers/ca/config/{{ item }}"
+    owner: "{{ ca_subuid }}"
+    group: "svadmins"
+    mode: "0400"
+  loop:
+    - "ca.json"
+    - "defaults.json"
+  become: true
+  notify: "notification_restart_ca"
+
+- name: Deploy ca certificate and key
+  ansible.builtin.copy:
+    content: |
+      {{ item.value }}
+    dest: "{{ item.path }}/{{ item.name }}"
+    owner: "{{ ca_subuid }}"
+    group: "svadmins"
+    mode: "{{ item.mode }}"
+  loop:
+    - name: "ilnmors_root_ca.crt"
+      value: "{{ hostvars['console']['ca']['root']['crt'] }}"
+      path: "{{ node['home_path'] }}/containers/ca/certs"
+      mode: "0440"
+    - name: "ilnmors_intermediate_ca.crt"
+      value: "{{ hostvars['console']['ca']['intermediate']['crt'] }}"
+      path: "{{ node['home_path'] }}/containers/ca/certs"
+      mode: "0440"
+    - name: "ilnmors_intermediate_ca.key"
+      value: "{{ hostvars['console']['ca']['intermediate']['key'] }}"
+      path: "{{ node['home_path'] }}/containers/ca/secrets"
+      mode: "0400"
+  become: true
+  notify: "notification_restart_ca"
+  no_log: true
+
+- name: Deploy container file
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ca/ca.container.j2"
+    dest: "{{ node['home_path'] }}/.config/containers/systemd/ca.container"
+    owner: "{{ ansible_user }}"
+    group: "svadmins"
+    mode: "0644"
+  notify: "notification_restart_ca"
+
+- name: Enable ca
+  ansible.builtin.systemd:
+    name: "ca.service"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"

ansible/roles/infra/tasks/services/set_grafana.yaml

@@ -0,0 +1,89 @@
+---
+- name: Set grafana container subuid
+  ansible.builtin.set_fact:
+    grafana_subuid: "100471"
+
+- name: Create grafana directory
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/containers/{{ item }}"
+    owner: "{{ grafana_subuid }}"
+    group: "svadmins"
+    state: "directory"
+    mode: "0770"
+  loop:
+    - "grafana"
+    - "grafana/data"
+    - "grafana/etc"
+    - "grafana/etc/provisioning"
+    - "grafana/etc/dashboards"
+    - "grafana/ssl"
+  become: true
+
+- name: Deploy root certificate and key
+  ansible.builtin.copy:
+    content: |
+      {{ hostvars['console']['ca']['root']['crt'] }}
+    dest: "{{ node['home_path'] }}/containers/grafana/ssl/ilnmors_root_ca.crt"
+    owner: "{{ grafana_subuid }}"
+    group: "svadmins"
+    mode: "0400"
+  become: true
+  notify: "notification_restart_grafana"
+  no_log: true
+
+- name: Register secret value to podman secret
+  containers.podman.podman_secret:
+    name: "{{ item.name }}"
+    data: "{{ item.value }}"
+    state: "present"
+    force: true
+  loop:
+    - name: "GF_DB_PASSWORD"
+      value: "{{ hostvars['console']['postgresql']['password']['grafana'] }}"
+    - name: "LDAP_BIND_PASSWORD"
+      value: "{{ hostvars['console']['ldap']['password']['grafana'] }}"
+    - name: "GF_ADMIN_PASSWORD"
+      value: "{{ hostvars['console']['grafana']['user']['password'] }}"
+  notify: "notification_restart_grafana"
+  no_log: true
+
+- name: Deploy configruation files
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/etc/{{ item }}.j2"
+    dest: "{{ node['home_path'] }}/containers/grafana/etc/{{ item }}"
+    owner: "{{ grafana_subuid }}"
+    group: "svadmins"
+    mode: "0400"
+  loop:
+    - "grafana.ini"
+    - "ldap.toml"
+  become: true
+  notify: "notification_restart_grafana"
+  no_log: true
+
+- name: Deploy provisioing and dashboard files
+  ansible.builtin.copy:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/etc/provisioning/"
+    dest: "{{ node['home_path'] }}/containers/grafana/etc/provisioning/"
+    owner: "{{ grafana_subuid }}"
+    group: "svadmins"
+    mode: "0400"
+  become: true
+  notify: "notification_restart_grafana"
+
+- name: Deploy container file
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/grafana.container.j2"
+    dest: "{{ node['home_path'] }}/.config/containers/systemd/grafana.container"
+    owner: "{{ ansible_user }}"
+    group: "svadmins"
+    mode: "0644"
+  notify: "notification_restart_grafana"
+
+- name: Enable grafana
+  ansible.builtin.systemd:
+    name: "grafana.service"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"

ansible/roles/infra/tasks/services/set_ldap.yaml

@@ -0,0 +1,112 @@
+---
+- name: Set ldap container subuid
+  ansible.builtin.set_fact:
+    ldap_subuid: "100999"
+
+- name: Create ldap directory
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/containers/{{ item }}"
+    owner: "{{ ldap_subuid }}"
+    group: "svadmins"
+    state: "directory"
+    mode: "0770"
+  loop:
+    - "ldap"
+    - "ldap/data"
+    - "ldap/ssl"
+  become: true
+
+- name: Deploy ldap certificate and key
+  ansible.builtin.copy:
+    content: |
+      {{ item.value }}
+    dest: "{{ node['home_path'] }}/containers/ldap/ssl/{{ item.name }}"
+    owner: "{{ ldap_subuid }}"
+    group: "svadmins"
+    mode: "{{ item.mode }}"
+  loop:
+    - name: "ilnmors_root_ca.crt"
+      value: "{{ hostvars['console']['ca']['root']['crt'] }}"
+      mode: "0440"
+    - name: "ldap.crt"
+      value: |
+        {{ hostvars['console']['ldap']['crt'] | trim }}
+        {{ hostvars['console']['ca']['intermediate']['crt'] }}
+      mode: "0440"
+    - name: "ldap.key"
+      value: "{{ hostvars['console']['ldap']['key'] }}"
+      mode: "0400"
+  become: true
+  notify: "notification_restart_ldap"
+  no_log: true
+
+- name: Register secret value to podman secret
+  containers.podman.podman_secret:
+    name: "{{ item.name }}"
+    data: "{{ item.value }}"
+    state: "present"
+    force: true
+  loop:
+    # urlencode doesn't fix `/` as `%2F`. It needs replace
+    - name: "LLDAP_DATABASE_URL"
+      value: "postgres://ldap:{{ hostvars['console']['postgresql']['password']['ldap'] | urlencode | replace('/', '%2F') }}\
+        @{{ infra_uri['postgresql']['domain'] }}/ldap_db?sslmode=verify-full&sslrootcert=/etc/ssl/ldap/ilnmors_root_ca.crt"
+    - name: "LLDAP_KEY_SEED"
+      value: "{{ hostvars['console']['ldap']['seed_key'] }}"
+    - name: "LLDAP_JWT_SECRET"
+      value: "{{ hostvars['console']['ldap']['jwt_secret'] }}"
+  notify: "notification_restart_ldap"
+  no_log: true
+
+- name: Initiate ldap (When = false, If DB data does not exist in postgresql, activate this block)
+  when: false
+  become: true
+  block:
+    - name: Register extra secret value to podman secret
+      containers.podman.podman_secret:
+        name: "LLDAP_LDAP_USER_PASSWORD"
+        data: "{{ hostvars['console']['ldap']['password']['user'] }}"
+        state: "present"
+        force: true
+    # You must check the image version first (following container file on data/config/containers/infra/ldap/ldap.container)
+
+    - name: Initiate ldap
+      containers.podman.podman_container:
+        name: "init_LLDAP"
+        image: "docker.io/lldap/lldap:{{ version['containers']['ldap'] }}"
+        rm: true
+        detach: false
+        env:
+          TZ: "Asia/Seoul"
+          LLDAP_LDAP_BASE_DN: "dc=ilnmors,dc=internal"
+        secrets:
+          - "LLDAP_DATABASE_URL,type=env"
+          - "LLDAP_KEY_SEED,type=env"
+          - "LLDAP_JWT_SECRET,type=env"
+          - "LLDAP_LDAP_USER_PASSWORD,type=env"
+        volumes:
+          - "{{ node['home_path'] }}/containers/ldap/data:/data:rw"
+          - "{{ node['home_path'] }}/containers/ldap/ssl:/etc/ssl/ldap:ro"
+
+  always:
+    - name: Clean extra secret value from podman secret
+      containers.podman.podman_secret:
+        name: "LLDAP_LDAP_USER_PASSWORD"
+        state: "absent"
+
+- name: Deploy container file
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ldap/ldap.container.j2"
+    dest: "{{ node['home_path'] }}/.config/containers/systemd/ldap.container"
+    owner: "{{ ansible_user }}"
+    group: "svadmins"
+    mode: "0644"
+  notify: "notification_restart_ldap"
+
+- name: Enable ldap
+  ansible.builtin.systemd:
+    name: "ldap.service"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"

ansible/roles/infra/tasks/services/set_loki.yaml

@@ -0,0 +1,70 @@
+---
+- name: Set loki container subuid
+  ansible.builtin.set_fact:
+    loki_subuid: "110000" # 10001
+
+- name: Create loki directory
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/containers/{{ item }}"
+    state: "directory"
+    owner: "{{ loki_subuid }}"
+    group: "svadmins"
+    mode: "0770"
+  loop:
+    - "loki"
+    - "loki/etc"
+    - "loki/data"
+    - "loki/ssl"
+  become: true
+
+- name: Deploy loki configuration file
+  ansible.builtin.copy:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/loki/etc/loki.yaml"
+    dest: "{{ node['home_path'] }}/containers/loki/etc/loki.yaml"
+    owner: "{{ loki_subuid }}"
+    group: "svadmins"
+    mode: "0600"
+  become: true
+  notify: "notification_restart_loki"
+  no_log: true
+
+- name: Deploy loki certificate and key
+  ansible.builtin.copy:
+    content: |
+      {{ item.value }}
+    dest: "{{ node['home_path'] }}/containers/loki/ssl/{{ item.name }}"
+    owner: "{{ loki_subuid }}"
+    group: "svadmins"
+    mode: "{{ item.mode }}"
+  loop:
+    - name: "ilnmors_root_ca.crt"
+      value: "{{ hostvars['console']['ca']['root']['crt'] }}"
+      mode: "0440"
+    - name: "loki.crt"
+      value: |
+        {{ hostvars['console']['loki']['crt'] | trim }}
+        {{ hostvars['console']['ca']['intermediate']['crt'] }}
+      mode: "0440"
+    - name: "loki.key"
+      value: "{{ hostvars['console']['loki']['key'] }}"
+      mode: "0400"
+  become: true
+  notify: "notification_restart_loki"
+  no_log: true
+
+- name: Deploy container file
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/loki/loki.container.j2"
+    dest: "{{ node['home_path'] }}/.config/containers/systemd/loki.container"
+    owner: "{{ ansible_user }}"
+    group: "svadmins"
+    mode: "0644"
+  notify: "notification_restart_loki"
+
+- name: Enable loki
+  ansible.builtin.systemd:
+    name: "loki.service"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"

ansible/roles/infra/tasks/services/set_postgresql.yaml

@@ -0,0 +1,169 @@
+---
+- name: Set postgresql container subuid
+  ansible.builtin.set_fact:
+    postgresql_subuid: "100998"
+
+- name: Set connected services list
+  ansible.builtin.set_fact:
+    # telegraf has no database
+    connected_services:
+      - "ldap"
+      - "authelia"
+      - "grafana"
+
+- name: Create postgresql directory
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/containers/{{ item }}"
+    state: "directory"
+    owner: "{{ postgresql_subuid }}"
+    group: "svadmins"
+    mode: "0770"
+  loop:
+    - "postgresql"
+    - "postgresql/data"
+    - "postgresql/config"
+    - "postgresql/ssl"
+    - "postgresql/init"
+    - "postgresql/backups"
+    - "postgresql/build"
+  become: true
+
+- name: Deploy containerfile for build
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/build/postgresql.containerfile.j2"
+    dest: "{{ node['home_path'] }}/containers/postgresql/build/Containerfile"
+    owner: "{{ ansible_user }}"
+    group: "svadmins"
+    mode: "0640"
+
+- name: Build postgresql container image
+  containers.podman.podman_image:
+    name: "ilnmors.internal/{{ node['name'] }}/postgres"
+    # check tags from container file
+    tag: "pg{{ version['containers']['postgresql'] }}-vectorchord{{ version['containers']['vectorchord'] }}"
+    state: "build"
+    path: "{{ node['home_path'] }}/containers/postgresql/build"
+
+- name: Prune postgresql dangling images
+  containers.podman.podman_prune:
+    image: true
+
+- name: Deploy postgresql configuration files
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/config/{{ item }}.j2"
+    dest: "{{ node['home_path'] }}/containers/postgresql/config/{{ item }}"
+    owner: "{{ postgresql_subuid }}"
+    group: "svadmins"
+    mode: "0600"
+  loop:
+    - "postgresql.conf"
+    - "pg_hba.conf"
+  become: true
+  notify: "notification_reload_postgresql"
+  no_log: true
+
+- name: Deploy postgresql certificate and key
+  ansible.builtin.copy:
+    content: |
+      {{ item.value }}
+    dest: "{{ node['home_path'] }}/containers/postgresql/ssl/{{ item.name }}"
+    owner: "{{ postgresql_subuid }}"
+    group: "svadmins"
+    mode: "{{ item.mode }}"
+  loop:
+    - name: "ilnmors_root_ca.crt"
+      value: "{{ hostvars['console']['ca']['root']['crt'] }}"
+      mode: "0440"
+    - name: "postgresql.crt"
+      value: |
+        {{ hostvars['console']['postgresql']['crt'] | trim }}
+        {{ hostvars['console']['ca']['intermediate']['crt'] }}
+      mode: "0440"
+    - name: "postgresql.key"
+      value: "{{ hostvars['console']['postgresql']['key'] }}"
+      mode: "0400"
+  become: true
+  notify: "notification_reload_postgresql"
+  no_log: true
+
+- name: Check data directory empty
+  ansible.builtin.find:
+    paths: "{{ node['home_path'] }}/containers/postgresql/data/"
+    hidden: true
+    file_type: "any"
+  become: true
+  register: "is_data_dir_empty"
+
+- name: Prepare initiating DB
+  when: is_data_dir_empty.matched == 0
+  become: true
+  block:
+    # `init/pg_cluster.sql` should be fetched from postgresql's backup directory before running initiating
+    - name: Deploy init cluster sql file
+      ansible.builtin.copy:
+        src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/init/pg_cluster.sql"
+        dest: "{{ node['home_path'] }}/containers/postgresql/init/0_pg_cluster.sql"
+        owner: "{{ postgresql_subuid }}"
+        group: "svadmins"
+        mode: "0600"
+
+    - name: Deploy resoring data sql files
+      ansible.builtin.copy:
+        src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/init/pg_{{ item }}.sql"
+        dest: "{{ node['home_path'] }}/containers/postgresql/init/{{ index_num + 1 }}_pg_{{ item }}.sql"
+        owner: "{{ postgresql_subuid }}"
+        group: "svadmins"
+        mode: "0600"
+      loop: "{{ connected_services }}"
+      loop_control:
+        index_var: index_num
+    - name: Set is_postgresql_init_run
+      ansible.builtin.set_fact:
+        is_postgresql_init_run: true
+
+- name: Deploy container file
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/postgresql.container.j2"
+    dest: "{{ node['home_path'] }}/.config/containers/systemd/postgresql.container"
+    owner: "{{ ansible_user }}"
+    group: "svadmins"
+    mode: "0644"
+  notify: "notification_restart_postgresql"
+
+- name: Deploy backup service files
+  ansible.builtin.copy:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/services/{{ item }}"
+    dest: "{{ node['home_path'] }}/.config/systemd/user/{{ item }}"
+    owner: "{{ ansible_user }}"
+    group: "svadmins"
+    mode: "0644"
+  loop:
+    - "postgresql-cluster-backup.service"
+    - "postgresql-cluster-backup.timer"
+    - "postgresql-data-backup@.service"
+    - "postgresql-data-backup@.timer"
+
+- name: Enable postgresql
+  ansible.builtin.systemd:
+    name: "postgresql.service"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"
+
+- name: Enable cluster backup timer
+  ansible.builtin.systemd:
+    name: "postgresql-cluster-backup.timer"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"
+
+- name: Enable data backup timer
+  ansible.builtin.systemd:
+    name: "postgresql-data-backup@{{ item }}.timer"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"
+  loop: "{{ connected_services }}"

ansible/roles/infra/tasks/services/set_prometheus.yaml

@@ -0,0 +1,74 @@
+---
+- name: Set prometheus container subuid
+  ansible.builtin.set_fact:
+    prometheus_subuid: "165533" # nobody - 65534
+
+- name: Create prometheus directory
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/containers/{{ item }}"
+    state: "directory"
+    owner: "{{ prometheus_subuid }}"
+    group: "svadmins"
+    mode: "0770"
+  loop:
+    - "prometheus"
+    - "prometheus/etc"
+    - "prometheus/data"
+    - "prometheus/ssl"
+  become: true
+
+- name: Deploy prometheus configuration file
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/prometheus/etc/{{ item }}.j2"
+    dest: "{{ node['home_path'] }}/containers/prometheus/etc/{{ item }}"
+    owner: "{{ prometheus_subuid }}"
+    group: "svadmins"
+    mode: "0600"
+  loop:
+    - "prometheus.yaml"
+    - "rules.yaml"
+    - "web-config.yaml"
+  become: true
+  notify: "notification_restart_prometheus"
+  no_log: true
+
+- name: Deploy prometheus certificate and key
+  ansible.builtin.copy:
+    content: |
+      {{ item.value }}
+    dest: "{{ node['home_path'] }}/containers/prometheus/ssl/{{ item.name }}"
+    owner: "{{ prometheus_subuid }}"
+    group: "svadmins"
+    mode: "{{ item.mode }}"
+  loop:
+    - name: "ilnmors_root_ca.crt"
+      value: "{{ hostvars['console']['ca']['root']['crt'] }}"
+      mode: "0440"
+    - name: "prometheus.crt"
+      value: |
+        {{ hostvars['console']['prometheus']['crt'] | trim }}
+        {{ hostvars['console']['ca']['intermediate']['crt'] }}
+      mode: "0440"
+    - name: "prometheus.key"
+      value: "{{ hostvars['console']['prometheus']['key'] }}"
+      mode: "0400"
+  become: true
+  notify: "notification_restart_prometheus"
+  no_log: true
+
+- name: Deploy container file
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/prometheus/prometheus.container.j2"
+    dest: "{{ node['home_path'] }}/.config/containers/systemd/prometheus.container"
+    owner: "{{ ansible_user }}"
+    group: "svadmins"
+    mode: "0644"
+  notify: "notification_restart_prometheus"
+
+- name: Enable prometheus
+  ansible.builtin.systemd:
+    name: "prometheus.service"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"

ansible/roles/infra/tasks/services/set_x509-exporter.yaml

@@ -0,0 +1,63 @@
+---
+- name: Set x509-exporter container subuid
+  ansible.builtin.set_fact:
+    x509_exporter_subuid: "165533" # nobody - 65534
+
+- name: Create x509-exporter directory
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/containers/{{ item }}"
+    state: "directory"
+    owner: "{{ x509_exporter_subuid }}"
+    group: "svadmins"
+    mode: "0770"
+  loop:
+    - "x509-exporter"
+    - "x509-exporter/certs"
+  become: true
+
+- name: Deploy certificates
+  ansible.builtin.copy:
+    content: |
+      {{ item.value }}
+    dest: "{{ node['home_path'] }}/containers/x509-exporter/certs/{{ item.name }}"
+    owner: "{{ x509_exporter_subuid }}"
+    group: "svadmins"
+    mode: "0440"
+  loop:
+    - name: "root.crt"
+      value: "{{ hostvars['console']['ca']['root']['crt'] }}"
+    - name: "intermediate.crt"
+      value: "{{ hostvars['console']['ca']['intermediate']['crt'] }}"
+    - name: "crowdsec.crt"
+      value: "{{ hostvars['console']['crowdsec']['crt'] }}"
+    - name: "blocky.crt"
+      value: "{{ hostvars['console']['blocky']['crt'] }}"
+    - name: "postgresql.crt"
+      value: "{{ hostvars['console']['postgresql']['crt'] }}"
+    - name: "ldap.crt"
+      value: "{{ hostvars['console']['ldap']['crt'] }}"
+    - name: "prometheus.crt"
+      value: "{{ hostvars['console']['prometheus']['crt'] }}"
+    - name: "loki.crt"
+      value: "{{ hostvars['console']['loki']['crt'] }}"
+    - name: "dsm.crt"
+      value: "{{ hostvars['console']['dsm']['crt'] }}"
+  become: true
+  no_log: true
+
+- name: Deploy container file
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/x509-exporter/x509-exporter.container.j2"
+    dest: "{{ node['home_path'] }}/.config/containers/systemd/x509-exporter.container"
+    owner: "{{ ansible_user }}"
+    group: "svadmins"
+    mode: "0644"
+  notify: "notification_restart_x509-exporter"
+
+- name: Enable x509-exporter.service
+  ansible.builtin.systemd:
+    name: "x509-exporter.service"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"