bk node and refactor

ansible/playbooks/app/site.yaml

@@ -78,6 +78,14 @@
           tags: ["init", "resolved"]
       tags: ["init", "resolved"]
 
+    - name: Set timesyncd
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "node/set_timesyncd"
+        apply:
+          tags: ["init", "timesyncd"]
+      tags: ["init", "timesyncd"]
+
     - name: Update and upgrade apt
       ansible.builtin.apt:
         upgrade: "dist"
@@ -100,7 +108,7 @@
 
     - name: Set data volume
       ansible.builtin.include_role:
-        name: "app"
+        name: "common"
         tasks_from: "node/set_data_volume"
         apply:
           tags: ["init", "raid"]
@@ -242,6 +250,14 @@
           tags: ["site", "mealie"]
       tags: ["site", "mealie"]
 
+    - name: Set homebox
+      ansible.builtin.include_role:
+        name: "app"
+        tasks_from: "services/set_homebox"
+        apply:
+          tags: ["site", "homebox"]
+      tags: ["site", "homebox"]
+
     - name: Flush handlers right now
       ansible.builtin.meta: "flush_handlers"
 

ansible/playbooks/auth/site.yaml

@@ -78,6 +78,14 @@
           tags: ["init", "resolved"]
       tags: ["init", "resolved"]
 
+    - name: Set timesyncd
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "node/set_timesyncd"
+        apply:
+          tags: ["init", "timesyncd"]
+      tags: ["init", "timesyncd"]
+
     - name: Update and upgrade apt
       ansible.builtin.apt:
         upgrade: "dist"

ansible/playbooks/bk/site.yaml

@@ -0,0 +1,163 @@
+---
+- name: Load secret values
+  hosts: "console"
+  gather_facts: false
+  become: false
+  tasks:
+    - name: Load secret from secrets.yaml
+      ansible.builtin.include_role:
+        name: "console"
+        tasks_from: "node/load_secret_vars"
+        apply:
+          tags: ["always"]
+      tags: ["always"]
+
+- name: Site bk
+  hosts: "bk"
+  gather_facts: false
+  become: false
+  pre_tasks:
+    - name: Set become password
+      ansible.builtin.set_fact:
+        ansible_become_pass: "{{ hostvars['console']['sudo']['password']['bk'] }}"
+      no_log: true
+      tags: ["always"]
+
+  tasks:
+    - name: Set timezone
+      community.general.timezone:
+        name: "{{ timezone }}"
+      become: true
+      tags: ["init", "timezone"]
+
+    - name: Deploy root_ca certificate
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "node/deploy_root_ca"
+        apply:
+          tags: ["init", "root_crt"]
+      tags: ["init", "root_crt"]
+
+    - name: Deploy hosts file
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "node/deploy_hosts"
+        apply:
+          tags: ["init", "hosts"]
+      tags: ["init", "hosts"]
+
+    - name: Create default directory
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "node/create_default_dir"
+        apply:
+          tags: ["init", "default_dir"]
+      tags: ["init", "default_dir"]
+
+    - name: Set ssh host
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "node/set_ssh_host"
+        apply:
+          tags: ["init", "ssh_host"]
+      tags: ["init", "ssh_host"]
+
+    - name: Set networkd
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "node/set_networkd"
+        apply:
+          tags: ["init", "networkd"]
+      tags: ["init", "networkd"]
+
+    - name: Set resolved
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "node/set_resolved"
+        apply:
+          tags: ["init", "resolved"]
+      tags: ["init", "resolved"]
+
+    - name: Set timesyncd
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "node/set_timesyncd"
+        apply:
+          tags: ["init", "timesyncd"]
+      tags: ["init", "timesyncd"]
+
+    - name: Update and upgrade apt
+      ansible.builtin.apt:
+        upgrade: "dist"
+        update_cache: true
+        cache_valid_time: 3600
+      become: true
+      tags: ["init", "site", "upgrade-packages"]
+
+    - name: Install common packages
+      ansible.builtin.apt:
+        name:
+          - "acl"
+          - "curl"
+          - "jq"
+          - "netcat-openbsd"
+          - "dbus-user-session"
+        state: "present"
+      become: true
+      tags: ["init", "site", "install-packages"]
+
+    - name: Set data volume
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "node/set_data_volume"
+        apply:
+          tags: ["init", "raid"]
+      tags: ["init", "raid"]
+
+    - name: Set linger
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "node/set_linger"
+        apply:
+          tags: ["init", "linger"]
+      tags: ["init", "linger"]
+
+    - name: Set nftables
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "node/set_nftables"
+        apply:
+          tags: ["init", "nftables"]
+      tags: ["init", "nftables"]
+
+    - name: Set crowdsec
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "services/set_crowdsec"
+        apply:
+          tags: ["site", "crowdsec"]
+      tags: ["site", "crowdsec"]
+
+    - name: Set kopia
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "services/set_kopia"
+        apply:
+          tags: ["site", "kopia"]
+      tags: ["site", "kopia"]
+
+    - name: Set rclone
+      ansible.builtin.include_role:
+        name: "bk"
+        tasks_from: "services/set_rclone"
+        apply:
+          tags: ["site", "rclone"]
+      tags: ["site", "rclone"]
+
+    - name: Set alloy
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "services/set_alloy"
+        apply:
+          tags: ["site", "alloy"]
+      tags: ["site", "alloy"]

ansible/playbooks/console/create_cert.yaml

@@ -0,0 +1,223 @@
+---
+- name: Load secret values
+  hosts: "console"
+  gather_facts: false
+  become: false
+  tasks:
+    - name: Load secret from secrets.yaml
+      ansible.builtin.include_role:
+        name: "console"
+        tasks_from: "node/load_secret_vars"
+        apply:
+          tags: ["always"]
+      tags: ["always"]
+
+- name: Site console
+  hosts: "console"
+  gather_facts: false
+  become: false
+  tasks:
+    - name: Create root CA
+      tags: ["never", "root"]
+      block:
+        - name: Clean previous CA temporary directory
+          ansible.builtin.file:
+            path: "/run/user/{{ node['uid'] }}/ca"
+            state: "absent"
+          no_log: true
+        - name: Create ca directory
+          ansible.builtin.file:
+            path: "/run/user/{{ node['uid'] }}/ca"
+            owner: "{{ ansible_user }}"
+            group: "{{ node['group'] }}"
+            state: "directory"
+            mode: "0700"
+        - name: Get root CA password
+          ansible.builtin.copy:
+            content: |
+              {{ hostvars['console']['ca']['root']['password'] }}
+            dest: "/run/user/{{ node['uid'] }}/ca/root_ca.password"
+            owner: "{{ ansible_user }}"
+            group: "{{ node['group'] }}"
+            mode: "0400"
+          no_log: true
+        - name: Create root CA
+          ansible.builtin.command: |
+            step certificate create \
+            "{{ domain['internal'] }} Root CA" \
+            /run/user/{{ node['uid'] }}/ca/root_ca.crt \
+            /run/user/{{ node['uid'] }}/ca/root_ca.key \
+            --password-file /run/user/{{ node['uid'] }}/ca/root_ca.password \
+            --profile root-ca \
+            --not-after 87600h
+          changed_when: true
+          no_log: true
+        - name: Update root CA
+          environment:
+            SOPS_AGE_KEY: "{{ hostvars['console']['age_key'] }}"
+          ansible.builtin.shell: |
+            set -euo pipefail
+            jq -Rs . "/run/user/{{ node['uid'] }}/ca/root_ca.crt" \
+            | sops set --value-stdin "{{ hostvars['console']['node']['config_path'] }}/secrets/secrets.yaml" \
+            '["ca"]["root"]["crt"]'
+            jq -Rs . "/run/user/{{ node['uid'] }}/ca/root_ca.key" \
+            | sops set --value-stdin "{{ hostvars['console']['node']['config_path'] }}/secrets/secrets.yaml" \
+            '["ca"]["root"]["key"]'
+          changed_when: true
+          no_log: true
+      always:
+        - name: Clean temporary files
+          ansible.builtin.file:
+            path: "/run/user/{{ node['uid'] }}/ca"
+            state: "absent"
+          no_log: true
+
+    - name: Get root CA and create intermediate CA
+      tags: ["never", "intermediate"]
+      block:
+        - name: Clean previous CA temporary directory
+          ansible.builtin.file:
+            path: "/run/user/{{ node['uid'] }}/ca"
+            state: "absent"
+          no_log: true
+        - name: Create ca certificates directory
+          ansible.builtin.file:
+            path: "/run/user/{{ node['uid'] }}/ca"
+            owner: "{{ ansible_user }}"
+            group: "{{ node['group'] }}"
+            state: "directory"
+            mode: "0700"
+        - name: Get root key and cert and password
+          ansible.builtin.copy:
+            content: |
+              {{ hostvars['console']['ca']['root'][item] }}
+            dest: "/run/user/{{ node['uid'] }}/ca/root_ca.{{ item }}"
+            owner: "{{ ansible_user }}"
+            group: "{{ node['group'] }}"
+            mode: "0400"
+          loop:
+            - "key"
+            - "crt"
+            - "password"
+          no_log: true
+        - name: Get intermediate CA password
+          ansible.builtin.copy:
+            content: |
+              {{ hostvars['console']['ca']['intermediate']['password'] }}
+            dest: "/run/user/{{ node['uid'] }}/ca/intermediate_ca.password"
+            owner: "{{ ansible_user }}"
+            group: "{{ node['group'] }}"
+            mode: "0400"
+          no_log: true
+        - name: Create intermediate CA
+          ansible.builtin.command: |
+            step certificate create \
+            "{{ domain['internal'] }} intermediate CA" \
+            /run/user/{{ node['uid'] }}/ca/intermediate_ca.crt \
+            /run/user/{{ node['uid'] }}/ca/intermediate_ca.key \
+            --password-file /run/user/{{ node['uid'] }}/ca/intermediate_ca.password \
+            --profile intermediate-ca \
+            --ca /run/user/{{ node['uid'] }}/ca/root_ca.crt \
+            --ca-key /run/user/{{ node['uid'] }}/ca/root_ca.key \
+            --ca-password-file /run/user/{{ node['uid'] }}/ca/root_ca.password \
+            --not-after 43800h
+          changed_when: true
+          no_log: true
+        - name: Update intermediate CA
+          environment:
+            SOPS_AGE_KEY: "{{ hostvars['console']['age_key'] }}"
+          ansible.builtin.shell: |
+            set -euo pipefail
+            jq -Rs . "/run/user/{{ node['uid'] }}/ca/intermediate_ca.crt" \
+            | sops set --value-stdin "{{ hostvars['console']['node']['config_path'] }}/secrets/secrets.yaml" \
+            '["ca"]["intermediate"]["crt"]'
+            jq -Rs . "/run/user/{{ node['uid'] }}/ca/intermediate_ca.key" \
+            | sops set --value-stdin "{{ hostvars['console']['node']['config_path'] }}/secrets/secrets.yaml" \
+            '["ca"]["intermediate"]["key"]'
+          changed_when: true
+          no_log: true
+      always:
+        - name: Clean temporary files
+          ansible.builtin.file:
+            path: "/run/user/{{ node['uid'] }}/ca"
+            state: "absent"
+          no_log: true
+
+    - name: Get intermediate CA and create leaf cert
+      tags: ["never", "leaf"]
+      block:
+        - name: Initialize self-cert services list
+          ansible.builtin.set_fact:
+            cert_services: []
+        - name: Set self-cert services list
+          ansible.builtin.set_fact:
+            cert_services: >-
+              {{
+                services
+                | dict2items
+                | selectattr('value.dependency.cert', 'defined')
+                | selectattr('value.dependency.cert', 'equalto', true)
+                | map(attribute='key')
+                | list
+              }}
+        - name: Clean previous leaf temporary directory
+          ansible.builtin.file:
+            path: "/run/user/{{ node['uid'] }}/leaf"
+            state: "absent"
+          no_log: true
+        - name: Create leaf certificates directory
+          ansible.builtin.file:
+            path: "/run/user/{{ node['uid'] }}/leaf"
+            owner: "{{ ansible_user }}"
+            group: "{{ node['group'] }}"
+            state: "directory"
+            mode: "0700"
+        - name: Get intermediate key and cert and password
+          ansible.builtin.copy:
+            content: |
+              {{ hostvars['console']['ca']['intermediate'][item] }}
+            dest: "/run/user/{{ node['uid'] }}/leaf/intermediate_ca.{{ item }}"
+            owner: "{{ ansible_user }}"
+            group: "{{ node['group'] }}"
+            mode: "0400"
+          loop:
+            - "key"
+            - "crt"
+            - "password"
+          no_log: true
+        - name: Create leaf certificates
+          ansible.builtin.command: |
+            step certificate create \
+            "{{ services[item]['domain']['internal'] }}.{{ domain['internal'] }}" \
+            /run/user/{{ node['uid'] }}/leaf/{{ item }}.crt \
+            /run/user/{{ node['uid'] }}/leaf/{{ item }}.key \
+            --profile leaf \
+            --san {{ services[item]['domain']['internal'] }}.{{ domain['internal'] }} \
+            --ca /run/user/{{ node['uid'] }}/leaf/intermediate_ca.crt \
+            --ca-key /run/user/{{ node['uid'] }}/leaf/intermediate_ca.key \
+            --ca-password-file /run/user/{{ node['uid'] }}/leaf/intermediate_ca.password \
+            --not-after 21900h \
+            --insecure --no-password
+          loop: "{{ cert_services }}"
+          changed_when: true
+          no_log: true
+        - name: Update leaf keys and certificates
+          environment:
+            SOPS_AGE_KEY: "{{ hostvars['console']['age_key'] }}"
+          ansible.builtin.shell: |
+            set -euo pipefail
+            jq -Rs . "/run/user/{{ node['uid'] }}/leaf/{{ item }}.crt" \
+            | sops set --value-stdin "{{ hostvars['console']['node']['config_path'] }}/secrets/secrets.yaml" \
+            '["{{ item }}"]["crt"]'
+            jq -Rs . "/run/user/{{ node['uid'] }}/leaf/{{ item }}.key" \
+            | sops set --value-stdin "{{ hostvars['console']['node']['config_path'] }}/secrets/secrets.yaml" \
+            '["{{ item }}"]["key"]'
+          loop: "{{ cert_services }}"
+          changed_when: true
+          no_log: true
+      always:
+        - name: Clean temporary files
+          ansible.builtin.file:
+            path: "/run/user/{{ node['uid'] }}/leaf"
+            state: "absent"
+          no_log: true

ansible/playbooks/console/site.yaml

@@ -108,8 +108,8 @@
       ansible.builtin.get_url:
         url: "https://cdimage.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2"
         dest: "{{ node['data_path'] }}/images/debian-13-generic-amd64.qcow2"
-        owner: "console"
-        group: "svadmins"
+        owner: "{{ ansible_user }}"
+        group: "{{ node['group'] }}"
         mode: "0600"
       tags: ["init", "site", "cloud-init-image"]
 

ansible/playbooks/infra/site.yaml

@@ -78,6 +78,14 @@
           tags: ["init", "resolved"]
       tags: ["init", "resolved"]
 
+    - name: Set timesyncd
+      ansible.builtin.include_role:
+        name: "common"
+        tasks_from: "node/set_timesyncd"
+        apply:
+          tags: ["init", "timesyncd"]
+      tags: ["init", "timesyncd"]
+
     - name: Update and upgrade apt
       ansible.builtin.apt:
         upgrade: "dist"

ansible/playbooks/vmm/create_vm.yaml

@@ -19,6 +19,7 @@
   vars:
     valid_vm_names:
       - "fw"
+      - "bk"
       - "infra"
       - "auth"
       - "app"

ansible/playbooks/vmm/site.yaml

@@ -104,7 +104,7 @@
     - name: Set raid
       ansible.builtin.include_role:
         name: "vmm"
-        tasks_from: "node/set_raid"
+        tasks_from: "node/set_disk"
         apply:
           tags: ["init", "raid"]
       tags: ["init", "raid"]