340 lines
8.7 KiB
YAML
340 lines
8.7 KiB
YAML
---
|
|
- name: Load secret values
|
|
hosts: "console"
|
|
gather_facts: false
|
|
become: false
|
|
tasks:
|
|
- name: Load secret from secrets.yaml
|
|
ansible.builtin.include_role:
|
|
name: "console"
|
|
tasks_from: "node/load_secret_vars"
|
|
apply:
|
|
tags: ["always"]
|
|
tags: ["always"]
|
|
|
|
- name: Site app
|
|
hosts: "app"
|
|
gather_facts: false
|
|
become: false
|
|
pre_tasks:
|
|
- name: Set become password
|
|
ansible.builtin.set_fact:
|
|
ansible_become_pass: "{{ hostvars['console']['sudo']['password']['app'] }}"
|
|
no_log: true
|
|
tags: ["always"]
|
|
|
|
tasks:
|
|
- name: Set timezone
|
|
community.general.timezone:
|
|
name: "{{ timezone }}"
|
|
become: true
|
|
tags: ["init", "timezone"]
|
|
|
|
- name: Deploy root_ca certificate
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "node/deploy_root_ca"
|
|
apply:
|
|
tags: ["init", "root_crt"]
|
|
tags: ["init", "root_crt"]
|
|
|
|
- name: Deploy hosts file
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "node/deploy_hosts"
|
|
apply:
|
|
tags: ["init", "hosts"]
|
|
tags: ["init", "hosts"]
|
|
|
|
- name: Create default directory
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "node/create_default_dir"
|
|
apply:
|
|
tags: ["init", "default_dir"]
|
|
tags: ["init", "default_dir"]
|
|
|
|
- name: Set ssh host
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "node/set_ssh_host"
|
|
apply:
|
|
tags: ["init", "ssh_host"]
|
|
tags: ["init", "ssh_host"]
|
|
|
|
- name: Set networkd
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "node/set_networkd"
|
|
apply:
|
|
tags: ["init", "networkd"]
|
|
tags: ["init", "networkd"]
|
|
|
|
- name: Set resolved
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "node/set_resolved"
|
|
apply:
|
|
tags: ["init", "resolved"]
|
|
tags: ["init", "resolved"]
|
|
|
|
- name: Set timesyncd
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "node/set_timesyncd"
|
|
apply:
|
|
tags: ["init", "timesyncd"]
|
|
tags: ["init", "timesyncd"]
|
|
|
|
- name: Update and upgrade apt
|
|
ansible.builtin.apt:
|
|
upgrade: "dist"
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
become: true
|
|
tags: ["init", "site", "upgrade-packages"]
|
|
|
|
- name: Install common packages
|
|
ansible.builtin.apt:
|
|
name:
|
|
- "acl"
|
|
- "curl"
|
|
- "jq"
|
|
- "netcat-openbsd"
|
|
- "dbus-user-session"
|
|
- "ksmtuned"
|
|
state: "present"
|
|
become: true
|
|
tags: ["init", "site", "install-packages"]
|
|
|
|
- name: Enable ksm.service
|
|
ansible.builtin.systemd:
|
|
name: "ksm.service"
|
|
state: "started"
|
|
enabled: true
|
|
become: true
|
|
tags: ["init", "site", "install-packages"]
|
|
|
|
- name: Disable ksmtuned.service
|
|
ansible.builtin.systemd:
|
|
name: "ksmtuned.service"
|
|
state: "stopped"
|
|
enabled: false
|
|
become: true
|
|
tags: ["init", "site", "install-packages"]
|
|
|
|
- name: Set data volume
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "node/set_data_volume"
|
|
apply:
|
|
tags: ["init", "raid"]
|
|
tags: ["init", "raid"]
|
|
|
|
- name: Set linger
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "node/set_linger"
|
|
apply:
|
|
tags: ["init", "linger"]
|
|
tags: ["init", "linger"]
|
|
|
|
- name: Set nftables
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "node/set_nftables"
|
|
apply:
|
|
tags: ["init", "nftables"]
|
|
tags: ["init", "nftables"]
|
|
|
|
- name: Set alloy
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "services/set_alloy"
|
|
apply:
|
|
tags: ["site", "alloy"]
|
|
tags: ["site", "alloy"]
|
|
|
|
- name: Set crowdsec
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "services/set_crowdsec"
|
|
apply:
|
|
tags: ["site", "crowdsec"]
|
|
tags: ["site", "crowdsec"]
|
|
|
|
- name: Set kopia
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "services/set_kopia"
|
|
apply:
|
|
tags: ["site", "kopia"]
|
|
tags: ["site", "kopia"]
|
|
|
|
- name: Set podman
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "services/set_podman"
|
|
apply:
|
|
tags: ["site", "podman"]
|
|
tags: ["site", "podman"]
|
|
|
|
- name: Set caddy
|
|
ansible.builtin.include_role:
|
|
name: "common"
|
|
tasks_from: "services/set_caddy"
|
|
apply:
|
|
tags: ["site", "caddy"]
|
|
tags: ["site", "caddy"]
|
|
|
|
- name: Set vaultwarden
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_vaultwarden"
|
|
apply:
|
|
tags: ["site", "vaultwarden"]
|
|
tags: ["site", "vaultwarden"]
|
|
|
|
- name: Set snappymail
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_snappymail"
|
|
apply:
|
|
tags: ["site", "snappymail"]
|
|
tags: ["site", "snappymail"]
|
|
|
|
- name: Set gitea
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_gitea"
|
|
apply:
|
|
tags: ["site", "gitea"]
|
|
tags: ["site", "gitea"]
|
|
|
|
- name: Set immich
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_immich"
|
|
apply:
|
|
tags: ["site", "immich"]
|
|
tags: ["site", "immich"]
|
|
|
|
- name: Set nextcloud
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_nextcloud"
|
|
apply:
|
|
tags: ["site", "nextcloud"]
|
|
tags: ["site", "nextcloud"]
|
|
|
|
- name: Set collabora
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_collabora"
|
|
apply:
|
|
tags: ["site", "collabora"]
|
|
tags: ["site", "collabora"]
|
|
|
|
- name: Set sure
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_sure"
|
|
apply:
|
|
tags: ["site", "sure"]
|
|
tags: ["site", "sure"]
|
|
|
|
- name: Set outline
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_outline"
|
|
apply:
|
|
tags: ["site", "outline"]
|
|
tags: ["site", "outline"]
|
|
|
|
- name: Set homebox
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_homebox"
|
|
apply:
|
|
tags: ["site", "homebox"]
|
|
tags: ["site", "homebox"]
|
|
|
|
- name: Set mastodon
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_mastodon"
|
|
apply:
|
|
tags: ["site", "mastodon"]
|
|
tags: ["site", "mastodon"]
|
|
|
|
- name: Set papra
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_papra"
|
|
apply:
|
|
tags: ["site", "papra"]
|
|
tags: ["site", "papra"]
|
|
|
|
- name: Set tandoor
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_tandoor"
|
|
apply:
|
|
tags: ["site", "tandoor"]
|
|
tags: ["site", "tandoor"]
|
|
|
|
- name: Set bookstack
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_bookstack"
|
|
apply:
|
|
tags: ["site", "bookstack"]
|
|
tags: ["site", "bookstack"]
|
|
|
|
- name: Set linkding
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_linkding"
|
|
apply:
|
|
tags: ["site", "linkding"]
|
|
tags: ["site", "linkding"]
|
|
|
|
- name: Set homepage
|
|
ansible.builtin.include_role:
|
|
name: "app"
|
|
tasks_from: "services/set_homepage"
|
|
apply:
|
|
tags: ["site", "homepage"]
|
|
tags: ["site", "homepage"]
|
|
|
|
- name: Flush handlers right now
|
|
ansible.builtin.meta: "flush_handlers"
|
|
|
|
# Only update iGPU firmware
|
|
- name: Install iGPU Firmware
|
|
ansible.builtin.apt:
|
|
name:
|
|
- "firmware-intel-graphics"
|
|
- "intel-media-va-driver-non-free"
|
|
update_cache: true
|
|
state: "present"
|
|
become: true
|
|
notify:
|
|
- "notification_update_initramfs"
|
|
- "notification_reboot_app"
|
|
tags: ["init"]
|
|
handlers:
|
|
- name: Update initramfs
|
|
ansible.builtin.command:
|
|
update-initramfs -u
|
|
become: true
|
|
changed_when: false
|
|
listen: "notification_update_initramfs"
|
|
ignore_errors: true # noqa: ignore-errors
|
|
- name: Reboot app vm
|
|
ansible.builtin.reboot:
|
|
reboot_timeout: 300
|
|
become: true
|
|
listen: "notification_reboot_app"
|
|
ignore_errors: true # noqa: ignore-errors
|