--- - name: Load secret values hosts: "console" gather_facts: false become: false tasks: - name: Load secret from secrets.yaml ansible.builtin.include_role: name: "console" tasks_from: "node/load_secret_vars" apply: tags: ["always"] tags: ["always"] - name: Site app hosts: "app" gather_facts: false become: false pre_tasks: - name: Set become password ansible.builtin.set_fact: ansible_become_pass: "{{ hostvars['console']['sudo']['password']['app'] }}" no_log: true tags: ["always"] tasks: - name: Set timezone community.general.timezone: name: "{{ timezone }}" become: true tags: ["init", "timezone"] - name: Deploy root_ca certificate ansible.builtin.include_role: name: "common" tasks_from: "node/deploy_root_ca" apply: tags: ["init", "root_crt"] tags: ["init", "root_crt"] - name: Deploy hosts file ansible.builtin.include_role: name: "common" tasks_from: "node/deploy_hosts" apply: tags: ["init", "hosts"] tags: ["init", "hosts"] - name: Create default directory ansible.builtin.include_role: name: "common" tasks_from: "node/create_default_dir" apply: tags: ["init", "default_dir"] tags: ["init", "default_dir"] - name: Set ssh host ansible.builtin.include_role: name: "common" tasks_from: "node/set_ssh_host" apply: tags: ["init", "ssh_host"] tags: ["init", "ssh_host"] - name: Set networkd ansible.builtin.include_role: name: "common" tasks_from: "node/set_networkd" apply: tags: ["init", "networkd"] tags: ["init", "networkd"] - name: Set resolved ansible.builtin.include_role: name: "common" tasks_from: "node/set_resolved" apply: tags: ["init", "resolved"] tags: ["init", "resolved"] - name: Set timesyncd ansible.builtin.include_role: name: "common" tasks_from: "node/set_timesyncd" apply: tags: ["init", "timesyncd"] tags: ["init", "timesyncd"] - name: Update and upgrade apt ansible.builtin.apt: upgrade: "dist" update_cache: true cache_valid_time: 3600 become: true tags: ["init", "site", "upgrade-packages"] - name: Install common packages ansible.builtin.apt: name: - "acl" - "curl" - "jq" - "netcat-openbsd" - "dbus-user-session" - "ksmtuned" state: "present" become: true tags: ["init", "site", "install-packages"] - name: Enable ksm.service ansible.builtin.systemd: name: "ksm.service" state: "started" enabled: true become: true tags: ["init", "site", "install-packages"] - name: Disable ksmtuned.service ansible.builtin.systemd: name: "ksmtuned.service" state: "stopped" enabled: false become: true tags: ["init", "site", "install-packages"] - name: Set data volume ansible.builtin.include_role: name: "common" tasks_from: "node/set_data_volume" apply: tags: ["init", "raid"] tags: ["init", "raid"] - name: Set linger ansible.builtin.include_role: name: "common" tasks_from: "node/set_linger" apply: tags: ["init", "linger"] tags: ["init", "linger"] - name: Set nftables ansible.builtin.include_role: name: "common" tasks_from: "node/set_nftables" apply: tags: ["init", "nftables"] tags: ["init", "nftables"] - name: Set alloy ansible.builtin.include_role: name: "common" tasks_from: "services/set_alloy" apply: tags: ["site", "alloy"] tags: ["site", "alloy"] - name: Set crowdsec ansible.builtin.include_role: name: "common" tasks_from: "services/set_crowdsec" apply: tags: ["site", "crowdsec"] tags: ["site", "crowdsec"] - name: Set kopia ansible.builtin.include_role: name: "common" tasks_from: "services/set_kopia" apply: tags: ["site", "kopia"] tags: ["site", "kopia"] - name: Set podman ansible.builtin.include_role: name: "common" tasks_from: "services/set_podman" apply: tags: ["site", "podman"] tags: ["site", "podman"] - name: Set caddy ansible.builtin.include_role: name: "common" tasks_from: "services/set_caddy" apply: tags: ["site", "caddy"] tags: ["site", "caddy"] - name: Set vaultwarden ansible.builtin.include_role: name: "app" tasks_from: "services/set_vaultwarden" apply: tags: ["site", "vaultwarden"] tags: ["site", "vaultwarden"] - name: Set snappymail ansible.builtin.include_role: name: "app" tasks_from: "services/set_snappymail" apply: tags: ["site", "snappymail"] tags: ["site", "snappymail"] - name: Set gitea ansible.builtin.include_role: name: "app" tasks_from: "services/set_gitea" apply: tags: ["site", "gitea"] tags: ["site", "gitea"] - name: Set immich ansible.builtin.include_role: name: "app" tasks_from: "services/set_immich" apply: tags: ["site", "immich"] tags: ["site", "immich"] - name: Set nextcloud ansible.builtin.include_role: name: "app" tasks_from: "services/set_nextcloud" apply: tags: ["site", "nextcloud"] tags: ["site", "nextcloud"] - name: Set collabora ansible.builtin.include_role: name: "app" tasks_from: "services/set_collabora" apply: tags: ["site", "collabora"] tags: ["site", "collabora"] - name: Set sure ansible.builtin.include_role: name: "app" tasks_from: "services/set_sure" apply: tags: ["site", "sure"] tags: ["site", "sure"] - name: Set outline ansible.builtin.include_role: name: "app" tasks_from: "services/set_outline" apply: tags: ["site", "outline"] tags: ["site", "outline"] - name: Set homebox ansible.builtin.include_role: name: "app" tasks_from: "services/set_homebox" apply: tags: ["site", "homebox"] tags: ["site", "homebox"] - name: Set mastodon ansible.builtin.include_role: name: "app" tasks_from: "services/set_mastodon" apply: tags: ["site", "mastodon"] tags: ["site", "mastodon"] - name: Set papra ansible.builtin.include_role: name: "app" tasks_from: "services/set_papra" apply: tags: ["site", "papra"] tags: ["site", "papra"] - name: Set tandoor ansible.builtin.include_role: name: "app" tasks_from: "services/set_tandoor" apply: tags: ["site", "tandoor"] tags: ["site", "tandoor"] - name: Set bookstack ansible.builtin.include_role: name: "app" tasks_from: "services/set_bookstack" apply: tags: ["site", "bookstack"] tags: ["site", "bookstack"] - name: Set linkding ansible.builtin.include_role: name: "app" tasks_from: "services/set_linkding" apply: tags: ["site", "linkding"] tags: ["site", "linkding"] - name: Set homepage ansible.builtin.include_role: name: "app" tasks_from: "services/set_homepage" apply: tags: ["site", "homepage"] tags: ["site", "homepage"] - name: Flush handlers right now ansible.builtin.meta: "flush_handlers" # Only update iGPU firmware - name: Install iGPU Firmware ansible.builtin.apt: name: - "firmware-intel-graphics" - "intel-media-va-driver-non-free" update_cache: true state: "present" become: true notify: - "notification_update_initramfs" - "notification_reboot_app" tags: ["init"] handlers: - name: Update initramfs ansible.builtin.command: update-initramfs -u become: true changed_when: false listen: "notification_update_initramfs" ignore_errors: true # noqa: ignore-errors - name: Reboot app vm ansible.builtin.reboot: reboot_timeout: 300 become: true listen: "notification_reboot_app" ignore_errors: true # noqa: ignore-errors