migrate

AnisiblePlaybooks/Playbooks/Checkmk/activate-changes.yaml

@@ -0,0 +1,20 @@
+---
+- name: "Activate Checkmk changes"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - secrets.yaml
+  vars:
+    server_url: "http://192.168.2.4:5000"
+    site: "cmk"
+
+  tasks:
+    - name: "Start activation on a specific site"
+      checkmk.general.activation:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        force_foreign_changes: 'true'
+        sites:
+          - "{{ site }}"

AnisiblePlaybooks/Playbooks/Checkmk/install-agent.yaml

@@ -0,0 +1,20 @@
+# to run: ansible-playbook -i ./inventory.ini  install-agent.yaml --ask-become-pass
+---
+- name: "Install Checkmk agent on all hosts"
+  hosts: all
+  become: yes
+  roles:
+    - checkmk.general.agent
+  vars:
+    checkmk_agent_version: "2.3.0p7"
+    #checkmk_agent_server: "192.168.2.4:5000"
+    checkmk_agent_server: "checkmk.mikemcfetridge.com"
+    checkmk_agent_server_protocol: https
+    checkmk_agent_site: "cmk"
+    checkmk_agent_auto_activate: true
+    checkmk_agent_tls: "true"  # NOTE: Register Agent to enable TLS
+    checkmk_agent_user: "{{ automation_user }}"
+    checkmk_agent_pass: "{{ automation_secret }}"
+    checkmk_agent_host_name: "{{ ansible_hostname }}"  # NOTE: Required to replace FQDN with hostname only
+  vars_files:
+    - secrets.yaml

AnisiblePlaybooks/Playbooks/Checkmk/lookup-rule.yaml

@@ -0,0 +1,25 @@
+---
+- name: "Manage Checkmk rules"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - secrets.yaml
+  vars:
+    server_url: "http://192.168.2.4:5000"
+    site: "cmk"
+
+  tasks:
+    - name: Get a rule with a particular rule id
+      ansible.builtin.debug:
+        msg: "Rule: {{ extensions | to_nice_yaml }}"
+      vars:
+        extensions: "{{
+          lookup('checkmk.general.rule',
+            rule_id='checkmk-rule-id',
+            server_url=server_url,
+            site=site,
+            automation_user=automation_user,
+            automation_secret=automation_secret,
+            validate_certs=False
+            )
+          }}"

AnisiblePlaybooks/Playbooks/Checkmk/manage-hosts.yaml

@@ -0,0 +1,286 @@
+---
+- name: "Manage Checkmk hosts"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - secrets.yaml
+  vars:
+    server_url: "http://192.168.2.4:5000"
+    site: "cmk"
+
+  tasks:
+
+    - name: "Create host - PVE01"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "pve01"
+        attributes:
+          ipaddress: "192.168.2.1"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - PVE02"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "pve02"
+        attributes:
+          ipaddress: "192.168.2.2"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - beszel"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "Beszel"
+        attributes:
+          ipaddress: "192.168.2.3"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - Checkmk"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "Checkmk"
+        attributes:
+          ipaddress: "192.168.2.4"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - komodo"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "komodo"
+        attributes:
+          ipaddress: "192.168.2.5"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - Datacenter"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "Datacenter"
+        attributes:
+          ipaddress: "192.168.2.6"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - DockerApps"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "DockerApps"
+        attributes:
+          ipaddress: "192.168.2.7"
+        folder: "/"
+        state: "present"
+
+
+    - name: "Create host - PIHOLE"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "PiHole"
+        attributes:
+          ipaddress: "192.168.2.8"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - TECHNITIUMDNS"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "TechnitiumDNS"
+        attributes:
+          ipaddress: "192.168.2.9"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - Wireguard"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "Wireguard"
+        attributes:
+          ipaddress: "192.168.2.10"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - Ansible"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "Ansible"
+        attributes:
+          ipaddress: "192.168.2.11"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - LinkWarden"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "LinkWarden"
+        attributes:
+          ipaddress: "192.168.2.12"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - Immich"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "Immich"
+        attributes:
+          ipaddress: "192.168.2.13"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - RetroGaming"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "RetroGaming"
+        attributes:
+          ipaddress: "192.168.2.14"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - MediaServer"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "MediaServer"
+        attributes:
+          ipaddress: "192.168.2.16"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - NetBird1"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "NetBird1"
+        attributes:
+          ipaddress: "192.168.2.17"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - NetBird2"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "NetBird2"
+        attributes:
+          ipaddress: "192.168.2.18"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - VaultWarden"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "VaultWarden"
+        attributes:
+          ipaddress: "192.168.2.19"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - Glance"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "Glance"
+        attributes:
+          ipaddress: "192.168.2.20"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - NPM"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "Npm"
+        attributes:
+          ipaddress: "192.168.2.22"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - Searxng"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "Searxng"
+        attributes:
+          ipaddress: "192.168.2.23"
+        folder: "/"
+        state: "present"
+
+    - name: "Create host - Gitea"
+      checkmk.general.host:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        name: "Gitea"
+        attributes:
+          ipaddress: "192.168.2.24"
+        folder: "/"
+        state: "present"
+
+    - name: "Start activation on a specific site"
+      checkmk.general.activation:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        force_foreign_changes: 'true'
+        sites:
+          - "{{ site }}"

AnisiblePlaybooks/Playbooks/Checkmk/manage-rules.yaml

@@ -0,0 +1,71 @@
+---
+- name: "Manage Checkmk rules"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - secrets.yaml
+  vars:
+    server_url: "checkmk.home.arpa"
+    site: "cmk"
+
+  tasks:
+    - name: Create DNS Check Rule
+      checkmk.general.rule:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        ruleset: "active_checks:dns"
+        rule:
+          properties: {
+            "comment": "Ansible managed",
+            "description": "DNS DNS Monitoring",
+            "disabled": false,
+          }
+          conditions: {
+            "host_label_groups": [],
+            "host_name": {
+              "match_on": [
+                "your-dns-container-host"
+              ],
+              "operator": "one_of"
+            },
+            "host_tags": [],
+            "service_label_groups": []
+          }
+          "value_raw": {
+            "hostname": "hostname-to-query",
+            "server": "dns-server-ip",
+            "expected_addresses_list": [
+              "expected-ip-address"
+            ]
+          }
+          location:
+            folder: "/"
+            position: "top"
+        state: "present"
+
+    - name: Create NVME Temperature override rule
+      checkmk.general.rule:
+        server_url: "{{ server_url }}"
+        site: "{{ site }}"
+        automation_user: "{{ automation_user }}"
+        automation_secret: "{{ automation_secret }}"
+        ruleset: "checkgroup_parameters:temperature"
+        rule:
+          conditions:
+            host_label_groups: []
+            host_tags: []
+            service_description:
+              match_on:
+                - "DRIVE MODEL NAME*"
+              operator: "one_of"
+            service_label_groups: []
+          location:
+            folder: "/"
+            position: "top"
+          properties:
+            description: "NVME Temperature override"
+            disabled: false
+          value_raw: "{'levels': (60.0, 80.0)}"
+        state: present

AnisiblePlaybooks/Playbooks/Checkmk/secrets.yaml

@@ -0,0 +1,3 @@
+---
+automation_user: "ansible"
+automation_secret: "Px40If4VUvvA35"

AnisiblePlaybooks/Playbooks/Docker-Portainer/inventory.yaml

@@ -0,0 +1,8 @@
+---
+docker:
+  hosts:
+    docker01:
+      ansible_host: 192.168.2.7
+      ansible_user: 'ubuntu'
+      ansible_become: true
+      ansible_become_method: sudo

AnisiblePlaybooks/Playbooks/Docker-Portainer/playbook.yaml

@@ -0,0 +1,7 @@
+---
+- name: Install Docker on Ubuntu
+  hosts: all
+  become: true
+  roles:
+    - docker_install
+    - portainer_deploy

AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/docker_install/handlers/main.yaml

@@ -0,0 +1,5 @@
+---
+- name: Restart Docker
+  ansible.builtin.systemd:
+    name: docker
+    state: restarted

AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/docker_install/tasks/main.yaml

@@ -0,0 +1,41 @@
+---
+- name: Ensure apt is using HTTPS
+  ansible.builtin.apt:
+    name: "{{ item }}"
+    state: present
+  loop:
+    - apt-transport-https
+    - ca-certificates
+    - curl
+    - software-properties-common
+
+- name: Add Docker GPG key
+  ansible.builtin.apt_key:
+    url: "https://download.docker.com/linux/ubuntu/gpg"
+    state: present
+
+- name: Add Docker repository
+  ansible.builtin.apt_repository:
+    repo: "{{ docker_apt_repository }}"
+    state: present
+
+- name: Install Docker CE
+  ansible.builtin.apt:
+    name: docker-ce
+    state: present
+    update_cache: true
+
+- name: Configure Docker daemon options
+  ansible.builtin.template:
+    src: "templates/docker_daemon.json.j2"
+    dest: "/etc/docker/daemon.json"
+    owner: 'root'
+    group: 'root'
+    mode: '0755'  # Optional file permissions
+  notify: Restart Docker
+
+- name: Ensure Docker service is enabled and running
+  ansible.builtin.systemd:
+    name: docker
+    enabled: true
+    state: started

AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/docker_install/templates/docker_daemon.json.j2

@@ -0,0 +1,3 @@
+{
+    "storage-driver": "{{ docker_daemon_options['storage-driver'] }}"
+}

AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/docker_install/vars/main.yaml

@@ -0,0 +1,5 @@
+---
+docker_apt_release_channel: "stable"
+docker_apt_repository: "deb [arch=amd64] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
+docker_daemon_options:
+  storage-driver: "overlay2"

AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/portainer_deploy/handlers/main.yaml

@@ -0,0 +1,6 @@
+---
+- name: Start Portainer
+  community.docker.docker_compose:
+    project_src: /home/ubuntu/docker-compose/portainer
+    state: present
+    restarted: true

AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/portainer_deploy/tasks/main.yaml

@@ -0,0 +1,34 @@
+---
+- name: Ensure docker-compose is installed
+  ansible.builtin.package:
+    name: docker-compose
+    state: present
+
+- name: Ensure Docker service is running
+  ansible.builtin.service:
+    name: docker
+    state: started
+    enabled: true
+
+- name: Setup Portainer directory
+  ansible.builtin.file:
+    path: /home/ubuntu/docker-compose/portainer
+    state: directory
+    mode: '0755'  # Optional file permissions
+    owner: ubuntu  # Optional ownership
+    group: ubuntu  # Optional group ownership
+
+- name: Deploy Portainer using Docker Compose
+  ansible.builtin.template:
+    src: "templates/docker_compose.yaml.j2"
+    dest: "/home/ubuntu/docker-compose/portainer/docker-compose.yaml"
+    mode: '0755'  # Optional file permissions
+    owner: ubuntu  # Optional ownership
+    group: ubuntu  # Optional group ownership
+  notify:
+    - Start Portainer
+
+- name: Run Portainer docker-compose up
+  community.docker.docker_compose:
+    project_src: /home/ubuntu/docker-compose/portainer
+    state: present

AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/portainer_deploy/templates/docker_compose.yaml.j2

@@ -0,0 +1,13 @@
+version: '3.3'
+services:
+  portainer:
+    image: portainer/portainer-ce:{{ portainer_version }}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - portainer_data:/data
+    ports:
+      - "9000:9000"
+    restart: always
+
+volumes:
+  portainer_data:

AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/portainer_deploy/vars/main.yaml

@@ -0,0 +1,2 @@
+---
+portainer_version: "latest"

AnisiblePlaybooks/Playbooks/File-Copy/File-Copy-Playbook.yaml

@@ -0,0 +1,52 @@
+---
+- name: Deploy Docker Container with Docker Compose
+  hosts: all
+  become: true
+  tasks:
+    - name: Ensure Docker is installed
+      ansible.builtin.package:
+        name: docker
+        state: present
+
+    - name: Ensure Docker service is running
+      ansible.builtin.service:
+        name: docker
+        state: started
+        enabled: true
+
+    - name: Create a directory for Docker Compose files
+      ansible.builtin.file:
+        path: /home/ubuntu/ansible-docker/docker-compose
+        state: directory
+        mode: '0755'  # Optional file permissions
+        owner: ubuntu  # Optional ownership
+        group: ubuntu  # Optional group ownership
+
+    - name: Create a directory for Nginx website files
+      ansible.builtin.file:
+        path: /home/ubuntu/docker/nginx/web
+        state: directory
+        mode: '0755'  # Optional file permissions
+        owner: ubuntu  # Optional ownership
+        group: ubuntu  # Optional group ownership
+
+    - name: Copy docker-compose to remote host
+      ansible.builtin.copy:
+        src: /home/ubuntu/nginx/docker-compose.yaml
+        dest: /home/ubuntu/ansible-docker/docker-compose/docker-compose.yaml
+        mode: '0755'  # Optional file permissions
+        owner: ubuntu  # Optional ownership
+        group: ubuntu  # Optional group ownership
+
+    - name: Copy Nginx website folder to remote host # copies a folder - note no file extension
+      ansible.builtin.copy:
+        src: /home/ubuntu/nginx/website
+        dest: /home/ubuntu/docker/nginx/web
+        mode: '0755'  # Optional file permissions
+        owner: ubuntu  # Optional ownership
+        group: ubuntu  # Optional group ownership
+
+    - name: Start Docker Compose
+      community.docker.docker_compose:
+        project_src: /home/ubuntu/ansible-docker/docker-compose
+        state: present

AnisiblePlaybooks/Playbooks/File-Copy/File-Copy-Undo-Playbook.yaml

@@ -0,0 +1,24 @@
+---
+- name: Undo Docker Compose Deployment
+  hosts: all
+  become: true
+  tasks:
+    - name: Stop Docker Container
+      community.docker.docker_compose:
+        project_src: /home/ubuntu/ansible-docker/docker-compose
+        state: absent
+
+    - name: Remove Docker Compose file
+      ansible.builtin.file:
+        path: /home/ubuntu/ansible-docker/docker-compose/docker-compose.yml
+        state: absent
+
+    - name: Remove Docker Compose directory
+      ansible.builtin.file:
+        path: /home/ubuntu/ansible-docker
+        state: absent
+
+    - name: Remove Website directory
+      ansible.builtin.file:
+        path: /home/ubuntu/docker/nginx/web
+        state: absent

AnisiblePlaybooks/Playbooks/File-Copy/inventory.yaml

@@ -0,0 +1,8 @@
+---
+docker:
+  hosts:
+    docker01:
+      ansible_host: 192.168.2.7
+      ansible_user: 'ubuntu'
+      ansible_become: true
+      ansible_become_method: sudo

AnisiblePlaybooks/Playbooks/File-Copy/nginx/docker-compose.yaml

@@ -0,0 +1,31 @@
+version: "3.9"
+services:
+  web:
+    image: nginx
+    container_name: jimsgarage
+    volumes:
+     - /home/ubuntu/docker/nginx/templates:/etc/nginx/templates
+     - /home/ubuntu/docker/nginx/web/website:/usr/share/nginx/html
+    environment:
+     - NGINX_HOST=nginx.jimsgarage.co.uk
+     - NGINX_PORT=80
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.nginx.entrypoints=http"
+      - "traefik.http.routers.nginx.rule=Host(`nginx.jimsgarage.co.uk`)"
+      - "traefik.http.middlewares.nginx-https-redirect.redirectscheme.scheme=https"
+      - "traefik.http.routers.nginx.middlewares=nginx-https-redirect"
+      - "traefik.http.routers.nginx-secure.entrypoints=https"
+      - "traefik.http.routers.nginx-secure.rule=Host(`nginx.jimsgarage.co.uk`)"
+      - "traefik.http.routers.nginx-secure.tls=true"
+      - "traefik.http.routers.nginx-secure.service=nginx"
+      - "traefik.http.services.nginx.loadbalancer.server.port=80"
+      - "traefik.docker.network=proxy"
+    networks:
+      proxy:
+    security_opt:
+      - no-new-privileges:true
+
+networks:
+  proxy:
+    external: true

AnisiblePlaybooks/Playbooks/File-Copy/nginx/website/index.html

@@ -0,0 +1,108 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>Jim's Garage Ansible Demo</title>
+  <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
+  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css">
+  <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script>
+  <script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.16.0/umd/popper.min.js"></script>
+  <script src="https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"></script>
+  <style>
+    .hero {
+      background: url(Jims-Garage-1.png) no-repeat center center;
+      background-size: cover;
+      height: 400px;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      color: white;
+      text-shadow: 2px 2px 5px rgba(0, 0, 0, 0.7);
+    }
+    
+    .features {
+      margin-top: 50px;
+      text-align: center;
+    }
+    
+    .feature {
+      padding: 20px;
+      transition: transform 0.3s ease;
+    }
+    
+    .feature:hover {
+      transform: scale(1.05);
+    }
+    
+    .footer {
+      background-color: #333;
+      color: white;
+      text-align: center;
+      padding: 20px;
+      position: fixed;
+      width: 100%;
+      bottom: 0;
+    }
+  </style>
+</head>
+<body>
+  <!-- Navigation Bar -->
+  <nav class="navbar navbar-expand-lg navbar-dark bg-dark">
+    <a class="navbar-brand" href="#">My Webpage</a>
+    <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarNav" aria-controls="navbarNav" aria-expanded="false" aria-label="Toggle navigation">
+      <span class="navbar-toggler-icon"></span>
+    </button>
+    <div class="collapse navbar-collapse" id="navbarNav">
+      <ul class="navbar-nav ml-auto">
+        <li class="nav-item">
+          <a class="nav-link" href="#home">Home</a>
+        </li>
+        <li class="nav-item">
+          <a class="nav-link" href="#features">Features</a>
+        </li>
+        <li class="nav-item">
+          <a class="nav-link" href="#contact">Contact</a>
+        </li>
+      </ul>
+    </div>
+  </nav>
+
+  <!-- Hero Section -->
+  <div class="hero" id="home">
+    <h1>Welcome to Jim's Garage Ansible Demo</h1>
+  </div>
+
+  <!-- Features Section -->
+  <div class="container features" id="features">
+    <h2>Our Features</h2>
+    <div class="row">
+      <div class="col-md-4">
+        <div class="feature">
+          <i class="fas fa-cogs fa-3x"></i>
+          <h4>Feature 1</h4>
+          <p>Dynamic and interactive elements.</p>
+        </div>
+      </div>
+      <div class="col-md-4">
+        <div class="feature">
+          <i class="fas fa-bolt fa-3x"></i>
+          <h4>Feature 2</h4>
+          <p>Responsive design and transitions.</p>
+        </div>
+      </div>
+      <div class="col-md-4">
+        <div class="feature">
+          <i class="fas fa-heart fa-3x"></i>
+          <h4>Feature 3</h4>
+          <p>Engaging user experiences.</p>
+        </div>
+      </div>
+    </div>
+  </div>
+
+  <!-- Footer Section -->
+  <div class="footer">
+    <p>© 2024 My Webpage. All rights reserved.</p>
+  </div>
+</body>
+</html>

AnisiblePlaybooks/Playbooks/Multi-OS-Update/Update-Playbook.yaml

@@ -0,0 +1,57 @@
+---
+- name: Update Windows, Arch Linux, and Ubuntu
+  hosts: all
+  tasks:
+    - name: Gather facts
+      ansible.builtin.setup:
+
+    - name: Update Windows
+      when: ansible_facts['os_family'] == 'Windows'
+      ansible.windows.win_updates:
+        category_names:
+          - SecurityUpdates
+          - UpdateRollups
+          - CriticalUpdates
+        state: installed
+      register: win_update_result
+
+    - name: Check if Windows requires a reboot
+      when: win_update_result.changed and win_update_result.reboot_required | default(false)
+      ansible.windows.win_reboot:
+        reboot_timeout: 600
+      register: win_reboot_result
+
+    - name: Update Arch Linux
+      when: ansible_facts['os_family'] == 'Arch'
+      community.general.pacman:
+        update_cache: true
+        upgrade: true
+      register: arch_update_result
+
+    - name: Check if Arch Linux requires a reboot
+      when: ansible_facts['os_family'] == 'Arch' and arch_update_result.changed
+      ansible.builtin.stat:
+        path: /run/reboot-required
+      register: arch_reboot_required
+
+    - name: Reboot Arch Linux if required
+      when: arch_reboot_required.stat.exists | default(false)
+      ansible.builtin.reboot:
+        reboot_timeout: 600
+
+    - name: Update Ubuntu
+      when: ansible_facts['os_family'] == 'Debian'
+      ansible.builtin.apt:
+        upgrade: dist
+        update_cache: true
+
+    - name: Check if a reboot is required on Ubuntu
+      when: ansible_facts['os_family'] == 'Debian'
+      ansible.builtin.stat:
+        path: /var/run/reboot-required
+      register: ubuntu_reboot_required
+
+    - name: Reboot Ubuntu if required
+      when: ubuntu_reboot_required.stat.exists | default(false)
+      ansible.builtin.reboot:
+        reboot_timeout: 600

AnisiblePlaybooks/Playbooks/Multi-OS-Update/inventory.yaml

@@ -0,0 +1,14 @@
+arch:
+  hosts:
+    arch01:
+      ansible_host: 192.168.200.214
+      ansible_user: 'root'
+      ansible_python_interpreter: /usr/bin/python3
+
+docker:
+  hosts:
+    docker01:
+      ansible_host: 192.168.2.7
+      ansible_user: 'ubuntu'
+      ansible_become: true
+      ansible_become_method: sudo

AnisiblePlaybooks/Playbooks/NewServerBuild/ansible.cfg

@@ -0,0 +1,22 @@
+[defaults]
+
+# some basic default values...
+inventory      = inventory
+sudo_user      = root
+remote_user    = miker
+private_key_file = $HOME/.ssh/id_rsa
+interpreter_python=auto_silent
+
+# plays will gather facts by default, which contain information about
+# the remote system.
+#
+# smart - gather by default, but don't regather if already gathered
+# implicit - gather by default, turn off with gather_facts: False
+# explicit - do not gather by default, must say gather_facts: True
+gathering = smart
+
+# uncomment this to disable SSH key host checking (fingerprint)
+host_key_checking = False
+
+# This stop the warning message in the console for unused commands. 
+deprecation_warning = False

AnisiblePlaybooks/Playbooks/NewServerBuild/inst-docker-portainer-watchtower.yaml

@@ -0,0 +1,125 @@
+---
+- name: Install docker
+  hosts: "{{ my_hosts | d([]) }}"
+  become: true
+
+  tasks:
+    tasks:
+# Install SSH Public Key
+    - name: Install public keys
+      ansible.posix.authorized_key:
+        user: "{{ lookup('env', 'USER') }}"
+        state: present
+        key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
+
+    - name: Change sudoers file
+      ansible.builtin.lineinfile:
+        path: /etc/sudoers
+        state: present
+        regexp: '^%sudo'
+        line: '%sudo ALL=(ALL) NOPASSWD: ALL'
+        validate: /usr/sbin/visudo -cf %s
+
+# Update the system
+    - name: Update package index
+      apt:
+        update_cache: yes
+
+    - name: Upgrade packages
+      apt:
+        upgrade: yes
+
+    - name: Perform a distro upgrade
+      ansible.builtin.apt:
+        upgrade: dist
+        update_cache: yes
+
+    - name: Remove dependencies that are no longer needed
+      ansible.builtin.apt:
+        autoremove: yes
+        purge: true
+
+    - name: Update all packages to their latest version
+      ansible.builtin.apt:
+        name: "*"
+        state: latest
+
+    - name: Run the equivalent of "apt-get clean" as a separate step
+      ansible.builtin.apt:
+        clean: yes
+      
+  # Install Docker and all its dependencies
+    - name: Install docker dependencies
+      ansible.builtin.apt:
+        name:
+          - apt-transport-https
+          - ca-certificates
+          - curl
+          - gnupg-agent
+          - software-properties-common
+        update_cache: true
+
+    - name: Add docker gpg key
+      ansible.builtin.apt_key:
+        url: https://download.docker.com/linux/ubuntu/gpg
+        state: present
+        keyring: /etc/apt/keyrings/docker.gpg
+
+    - name: Add docker repository
+      ansible.builtin.apt_repository:
+        filename: docker
+        repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ansible_lsb.codename | lower }} stable
+        state: present
+
+    - name: Update package index
+      apt:
+        update_cache: yes
+
+    - name: Install docker engine
+      ansible.builtin.apt:
+        name:
+          - docker-ce
+          - docker-buildx-plugin
+          - docker-compose-plugin
+        update_cache: true
+
+# Install Portainer and its volume
+    - name: Create new volume
+      community.docker.docker_volume:
+        name: portainer-data
+
+    - name: Deploy portainer
+      community.docker.docker_container:
+        name: portainer
+        image: "docker.io/portainer/portainer-ce"
+        ports:
+          - "9445:9443"
+        volumes:
+          - /run/docker.sock:/var/run/docker.sock
+          - portainer-data:/data
+        restart_policy: unless-stopped
+
+# Install Watch Tower
+  tasks:
+    - name: Ensure Docker is running
+      systemd:
+        name: docker
+        state: started
+        enabled: yes
+
+    - name: Create Watchtower directory for configuration (optional, for persistent configuration)
+      file:
+        path: /opt/watchtower
+        state: directory
+        mode: '0755'
+
+    - name: Run Watchtower container
+      community.docker.docker_container:
+        name: watchtower
+        image: containrrr/watchtower
+        restart_policy: unless-stopped
+        volumes:
+          - /var/run/docker.sock:/var/run/docker.sock # Required for Watchtower to interact with Docker
+          # - /opt/watchtower/config.json:/config.json # Optional: for persistent configuration
+        # command: --interval 300 # Optional: specify update interval in seconds
+        state: started

AnisiblePlaybooks/Playbooks/NewServerBuild/inventory.ini

@@ -0,0 +1 @@
+192.168.2.14

AnisiblePlaybooks/Playbooks/NewServerBuild/newbuild-v2.yml

@@ -0,0 +1,143 @@
+- hosts: all
+  gather_facts: yes
+  become: yes
+  tasks:
+    ################## SSH and Security Configuration ##################
+    - name: Set SSH configuration permissions
+      file:
+        path: /etc/ssh/sshd_config
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Backup original SSH configuration file (if not exists)
+      copy:
+        src: /etc/ssh/sshd_config
+        dest: /etc/ssh/sshd_config.bak
+        owner: root
+        group: root
+        mode: '0600'
+        remote_src: yes
+        force: no
+
+    - name: Remove undesired PermitRootLogin and PasswordAuthentication lines
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^(?!#).*PermitRootLogin.*$|^(?!#).*PasswordAuthentication.*$|^(?!#).*PermitEmptyPasswords.*$'
+        state: absent
+
+    - name: Apply consolidated SSH config settings
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^(#)?{{ item.key }}"
+        line: "{{ item.key }} {{ item.value }}"
+        state: present
+      loop:
+        - { key: "PermitRootLogin", value: "no" }
+        - { key: "PasswordAuthentication", value: "no" }
+        - { key: "PermitEmptyPasswords", value: "no" }
+        - { key: "AllowUsers", value: "miker" }
+        - { key: "Protocol", value: "2" }
+        - { key: "PubkeyAuthentication", value: "yes" }
+        - { key: "Ciphers", value: "aes256-ctr,aes192-ctr,aes128-ctr" }
+        - { key: "KexAlgorithms", value: "curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256" }
+        - { key: "LoginGraceTime", value: "30" }
+        - { key: "X11Forwarding", value: "no" }
+        - { key: "AllowTcpForwarding", value: "no" }
+        - { key: "PermitUserEnvironment", value: "no" }
+
+    - name: Restart sshd to apply changes
+      systemd:
+        name: sshd
+        state: restarted
+
+    - name: Setup passwordless sudo for sudo group
+      lineinfile:
+        path: /etc/sudoers
+        state: present
+        regexp: '^%sudo'
+        line: '%sudo ALL=(ALL) NOPASSWD: ALL'
+        validate: '/usr/sbin/visudo -cf %s'
+
+    ################## System Package Management ##################
+    - name: Update apt cache and upgrade all packages
+      apt:
+        update_cache: yes
+        upgrade: dist
+        force_apt_get: yes
+
+    - name: Enable removal of unused dependencies in unattended-upgrades
+      lineinfile:
+        path: /etc/apt/apt.conf.d/50unattended-upgrades
+        regexp: '^Unattended-Upgrade::Remove-Unused-Dependencies'
+        line: 'Unattended-Upgrade::Remove-Unused-Dependencies "true";'
+        state: present
+        create: yes
+
+    - name: Enable auto updates via debconf
+      debconf:
+        name: unattended-upgrades
+        question: unattended-upgrades/enable_auto_updates
+        vtype: boolean
+        value: 'true'
+
+    - name: Install unattended-upgrades package
+      apt:
+        name: unattended-upgrades
+        state: latest
+
+    - name: Run dpkg reconfigure for unattended-upgrades
+      command:
+        cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
+        creates: /etc/apt/apt.conf.d/20auto-upgrades
+
+    ################## Install and Configure Fail2ban ##################
+    - name: Install required system packages including fail2ban
+      apt:
+        name:
+          - curl
+          - wget
+          - git
+          - unattended-upgrades
+          - qemu-guest-agent
+          - fail2ban
+        state: latest
+        update_cache: yes
+
+    - name: Setup fail2ban jail.local for sshd
+      copy:
+        dest: /etc/fail2ban/jail.d/sshd.local
+        content: |
+          [sshd]
+          enabled = true
+          port = ssh
+          filter = sshd
+          logpath = /var/log/auth.log
+          maxretry = 3
+          bantime = 600
+          ignoreip = 127.0.0.1/8 ::1
+          action = iptables-multiport
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Restart fail2ban service
+      systemd:
+        name: fail2ban
+        state: restarted
+
+    ################## Kernel Update & Reboot ##################
+    - name: Check for pending reboot
+      stat:
+        path: /var/run/reboot-required
+      register: reboot_required_file
+
+    - name: Reboot if kernel updated
+      reboot:
+        msg: "Reboot initiated by Ansible for kernel updates"
+        connect_timeout: 5
+        reboot_timeout: 300
+        pre_reboot_delay: 0
+        post_reboot_delay: 30
+        test_command: uptime
+      when: reboot_required_file.stat.exists

AnisiblePlaybooks/Playbooks/NewServerBuild/newbuild.yml

@@ -0,0 +1,246 @@
+- hosts: all
+  gather_facts: yes
+  become: yes
+  tasks:
+
+################## Configure SSH and Security Settings ##################
+
+    - name: Ensure the SSH configuration file has the correct permissions
+      file:
+        path: /etc/ssh/sshd_config
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Backup the original SSH configuration file
+      copy:
+        src: /etc/ssh/sshd_config
+        dest: /etc/ssh/sshd_config.bak
+        owner: root
+        group: root
+        mode: '0600'
+        remote_src: yes
+
+    - name: Remove PermitRootLogin prohibit-password
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regex: "(?i)^(?!#).*PermitRootLogin.*prohibit-password"
+        state: absent
+
+    - name: Remove PasswordAuthentication yes
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regex: "(?i)^(?!#).*PermitRootLogin.*yes"
+        state: absent
+
+    - name: Remove PermitEmptyPasswords no
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regex: "(?i)^(?!#).*PermitEmptyPasswords.*no"
+        state: absent
+
+    - name: Configure sshd
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regex: "^(#)?{{ item.key }}"
+        line: "{{ item.key }} {{ item.value }}"
+        state: present
+      loop:
+        - { key: "PermitRootLogin", value: "no" }
+        - { key: "PasswordAuthentication", value: "no" }
+        - { key: "PermitEmptyPasswords", value: "no" }
+        - { key: "AllowUsers", value: "miker" }
+
+    - name: restart sshd
+      ansible.builtin.systemd:
+        name: sshd
+        state: restarted
+
+    - name: Setup passwordless sudo
+      lineinfile:
+        path: /etc/sudoers
+        state: present
+        regexp: '^%sudo'
+        line: '%sudo ALL=(ALL) NOPASSWD: ALL'
+        validate: '/usr/sbin/visudo -cf %s' 
+
+#########################################################################
+######### NEW CODE ##################
+#########################################################################
+
+- hosts: all
+  gather_facts: yes
+  become: yes
+  tasks:
+    ################## SSH Hardening Enhancements ##################
+    - name: Set SSH to use protocol 2 only
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^Protocol'
+        line: 'Protocol 2'
+        state: present
+
+    - name: Enable public key authentication
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^PubkeyAuthentication'
+        line: 'PubkeyAuthentication yes'
+        state: present
+
+    - name: Disable password authentication
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^PasswordAuthentication'
+        line: 'PasswordAuthentication no'
+        state: present
+
+    - name: Set preferred ciphers
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^Ciphers'
+        line: 'Ciphers aes256-ctr,aes192-ctr,aes128-ctr'
+        state: present
+
+    - name: Set key exchange algorithms
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^KexAlgorithms'
+        line: 'KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
+        state: present
+
+    - name: Set LoginGraceTime to 30s
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^LoginGraceTime'
+        line: 'LoginGraceTime 30'
+        state: present
+
+    - name: Disable X11 forwarding
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^X11Forwarding'
+        line: 'X11Forwarding no'
+        state: present
+
+    - name: Disable TCP forwarding
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^AllowTcpForwarding'
+        line: 'AllowTcpForwarding no'
+        state: present
+
+    - name: Disable PermitUserEnvironment
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^PermitUserEnvironment'
+        line: 'PermitUserEnvironment no'
+        state: present
+
+    - name: Restart sshd to apply config changes
+      systemd:
+        name: sshd
+        state: restarted
+
+    ################## Fail2ban Configuration ##################
+    - name: Ensure Fail2ban is installed
+      apt:
+        name: fail2ban
+        state: latest
+        update_cache: yes
+
+    - name: Setup Fail2ban jail.local for SSH
+      copy:
+        dest: /etc/fail2ban/jail.d/sshd.local
+        content: |
+          [sshd]
+          enabled = true
+          port = ssh
+          filter = sshd
+          logpath = /var/log/auth.log
+          maxretry = 3
+          bantime = 600
+          ignoreip = 127.0.0.1/8 ::1 # Add your trusted IPs here
+          action = iptables-multiport
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Restart fail2ban to apply new configuration
+      systemd:
+        name: fail2ban
+        state: restarted
+
+
+#########################################################################
+#########################################################################
+
+################## Update and Upgrade System Packages ##################
+
+    - name: Update apt repo and cache on all Debian/Ubuntu boxes
+      apt: update_cache=yes force_apt_get=yes cache_valid_time=3600
+
+    - name: Upgrade all packages on servers
+      apt: upgrade=dist force_apt_get=yes
+
+    - name: automatically remove unused dependencies
+      lineinfile: dest=/etc/apt/apt.conf.d/50unattended-upgrades
+                  regexp="Unattended-Upgrade::Remove-Unused-Dependencies"
+                  line="Unattended-Upgrade::Remove-Unused-Dependencies \"true\";"
+                  state=present
+                  create=yes
+
+    - name: echo "unattended-upgrades unattended-upgrades/enable_auto_updates boolean true" | sudo debconf-set-selections  - auto install security updates
+      debconf: 
+        name: unattended-upgrades 
+        question: unattended-upgrades/enable_auto_updates 
+        vtype: boolean 
+        value: 'true'
+
+    - name: apt install unattended-upgrades
+      apt: 
+        name: unattended-upgrades
+     
+    - name: dpkg-reconfigure -f noninteractive unattended-upgrades
+      command:
+        cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
+        creates: /etc/apt/apt.conf.d/20auto-upgrades
+
+    - name: Check if a reboot is needed on all servers
+      register: reboot_required_file
+      stat: path=/var/run/reboot-required get_checksum=false
+
+################### Install Required System Packages ##################
+
+    - name: Update apt and install required system packages
+      apt:
+        pkg:
+          - curl
+          - wget
+          - git
+          - unattended-upgrades
+          - qemu-guest-agent
+        state: latest
+        update_cache: true
+
+    - name: Install fail2ban
+      apt:
+        name: fail2ban
+        state: latest
+        update_cache: true
+
+    - name: set up fail2ban
+      command: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
+               creates=/etc/fail2ban/jail.local
+
+
+  ################# Reboot if Kernel Updated ##################
+  
+    - name: Reboot the box if kernel updated
+      reboot:
+        msg: "Reboot initiated by Ansible for kernel updates"
+        connect_timeout: 5
+        reboot_timeout: 300
+        pre_reboot_delay: 0
+        post_reboot_delay: 30
+        test_command: uptime
+      when: reboot_required_file.stat.exists

AnisiblePlaybooks/Playbooks/Newbuild/newbuild.yml

@@ -0,0 +1,134 @@
+- hosts: all
+  gather_facts: yes
+  become: yes
+  tasks:
+
+################## Configure SSH and Security Settings ##################
+
+    - name: Ensure the SSH configuration file has the correct permissions
+      file:
+        path: /etc/ssh/sshd_config
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Backup the original SSH configuration file
+      copy:
+        src: /etc/ssh/sshd_config
+        dest: /etc/ssh/sshd_config.bak
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Remove PermitRootLogin prohibit-password
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regex: "(?i)^(?!#).*PermitRootLogin.*prohibit-password"
+        state: absent
+
+    - name: Remove PasswordAuthentication yes
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regex: "(?i)^(?!#).*PermitRootLogin.*yes"
+        state: absent
+
+    - name: Remove PermitEmptyPasswords no
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regex: "(?i)^(?!#).*PermitEmptyPasswords.*no"
+        state: absent
+
+    - name: Configure sshd
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regex: "^(#)?{{ item.key }}"
+        line: "{{ item.key }} {{ item.value }}"
+        state: present
+      loop:
+        - { key: "PermitRootLogin", value: "no" }
+        - { key: "PasswordAuthentication", value: "no" }
+        - { key: "PermitEmptyPasswords", value: "no" }
+        - { key: "AllowUsers", value: "miker" }
+
+    - name: restart sshd
+      ansible.builtin.systemd:
+        name: sshd
+        state: restarted
+
+    - name: Setup passwordless sudo
+      lineinfile:
+        path: /etc/sudoers
+        state: present
+        regexp: '^%sudo'
+        line: '%sudo ALL=(ALL) NOPASSWD: ALL'
+        validate: '/usr/sbin/visudo -cf %s' 
+
+################## Update and Upgrade System Packages ##################
+
+    - name: Update apt repo and cache on all Debian/Ubuntu boxes
+      apt: update_cache=yes force_apt_get=yes cache_valid_time=3600
+
+    - name: Upgrade all packages on servers
+      apt: upgrade=dist force_apt_get=yes
+
+    - name: automatically remove unused dependencies
+      lineinfile: dest=/etc/apt/apt.conf.d/50unattended-upgrades
+                  regexp="Unattended-Upgrade::Remove-Unused-Dependencies"
+                  line="Unattended-Upgrade::Remove-Unused-Dependencies \"true\";"
+                  state=present
+                  create=yes
+
+    - name: echo "unattended-upgrades unattended-upgrades/enable_auto_updates boolean true" | sudo debconf-set-selections  - auto install security updates
+      debconf: 
+        name: unattended-upgrades 
+        question: unattended-upgrades/enable_auto_updates 
+        vtype: boolean 
+        value: 'true'
+
+    - name: apt install unattended-upgrades
+      apt: 
+        name: unattended-upgrades
+     
+    - name: dpkg-reconfigure -f noninteractive unattended-upgrades
+      command:
+        cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
+        creates: /etc/apt/apt.conf.d/20auto-upgrades
+
+    - name: Check if a reboot is needed on all servers
+      register: reboot_required_file
+      stat: path=/var/run/reboot-required get_checksum=false
+
+################### Install Required System Packages ##################
+
+    - name: Update apt and install required system packages
+      apt:
+        pkg:
+          - curl
+          - wget
+          - git
+          - unattended-upgrades
+          - qemu-guest-agent
+        state: latest
+        update_cache: true
+
+    - name: Install fail2ban
+      apt:
+        name: fail2ban
+        state: latest
+        update_cache: true
+
+    - name: set up fail2ban
+      command: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
+               creates=/etc/fail2ban/jail.local
+  
+  ################# Reboot if Kernel Updated ##################
+  
+    - name: Reboot the box if kernel updated
+      reboot:
+        msg: "Reboot initiated by Ansible for kernel updates"
+        connect_timeout: 5
+        reboot_timeout: 300
+        pre_reboot_delay: 0
+        post_reboot_delay: 30
+        test_command: uptime
+      when: reboot_required_file.stat.exists

AnisiblePlaybooks/Playbooks/Proxmox/install_qemu_agent.yml

@@ -0,0 +1,53 @@
+# To create an Ansible playbook that checks if qemu-guest-agent is installed, and if not, installs it, you can use the ansible.builtin.package module, which can manage packages across various types of package managers.
+
+# Below is a simple playbook that accomplishes this:
+
+#_________________________________________________________________________________________
+---
+- name: Check and Install qemu-guest-agent
+  hosts: all
+  become: yes # Use this if you need elevated privileges to install packages
+  tasks:
+  - name: Check if qemu-guest-agent is installed
+    ansible.builtin.package_facts:
+
+
+  - name: update apt cache
+    command: apt update
+
+  - name: upgrade all packages
+    command: apt upgrade -y
+
+  - name: Install qemu-guest-agent if not installed
+    ansible.builtin.package:
+      name: qemu-guest-agent
+      state: present
+    when: "'qemu-guest-agent' not in ansible_facts.packages"
+
+  - name: Start guest qemu-guest-agent
+    ansible.builtin.service:
+      name: qemu-guest-agent
+      state: started
+      enabled: true
+
+#___________________________________________________________________________________________
+
+# Explanation:
+#
+#    hosts: all - This playbook will run on all hosts in your inventory.
+#    become: yes - This allows the tasks to run with elevated privileges (root), which is often required for installing packages.
+#    package_facts - This module gathers facts about installed packages on the target machine and stores them in ansible_facts.
+#    package - This module installs the specified package. The state: present ensures the package is installed.
+#    when condition - The when clause checks if qemu-guest-agent is present in the ansible_facts.packages. If it’s not installed, the package will be installed.
+
+# Usage
+
+#    Save the above YAML content to a file, for instance, install_qemu_guest_agent.yml.
+
+#    Run the playbook using the following command:
+
+#                 COMMAND TO RUN:  ansible-playbook -i your_inventory_file install_qemu_guest_agent.yml
+
+# Replace your_inventory_file with the path to your Ansible inventory file that defines your target hosts.
+
+# This playbook should effectively install the qemu-guest-agent on any host where it is not already installed.

AnisiblePlaybooks/Playbooks/Proxmox/post_install_with_docker.yml

@@ -0,0 +1,55 @@
+---
+- name: Post install configuration with docker
+  hosts: all
+  become: true   # Use this if you need sudo privileges
+  tasks:
+    - name: Update and Upgrade all packages
+      apt:
+        update_cache: yes
+        upgrade: dist
+      when: ansible_os_family == "Debian"
+
+    - name: Install PIP
+      apt:
+        name: python3-pip
+        state: present
+      when: ansible_os_family == "Debian"
+
+    - name: Install qemu-guest-agent
+      apt:
+        name: qemu-guest-agent
+        state: present
+      when: ansible_os_family == "Debian"
+
+    - name: Install docker dependencies
+      ansible.builtin.apt:
+        name:
+          - apt-transport-https
+          - ca-certificates
+          - curl
+          - gnupg-agent
+          - software-properties-common
+        update_cache: true
+
+    - name: Add docker gpg key
+      ansible.builtin.apt_key:
+        url: https://download.docker.com/linux/ubuntu/gpg
+        state: present
+        keyring: /etc/apt/keyrings/docker.gpg
+
+    - name: Add docker repository
+      ansible.builtin.apt_repository:
+        filename: docker
+        repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ansible_lsb.codename | lower }} stable
+        state: present
+
+    - name: Install docker engine
+      ansible.builtin.apt:
+        name:
+          - docker-ce
+          - docker-ce-cli
+          - containerd.io
+          - docker-buildx-plugin
+          - docker-compose-plugin
+        update_cache: true
+

AnisiblePlaybooks/Playbooks/RKE2/collections/requirements.yaml

@@ -0,0 +1,6 @@
+---
+collections:
+  - name: ansible.utils
+  - name: community.general
+  - name: ansible.posix
+  - name: kubernetes.core

AnisiblePlaybooks/Playbooks/RKE2/inventory/group_vars/all.yaml

@@ -0,0 +1,18 @@
+os: "linux"
+arch: "amd64"
+
+kube_vip_version: "v0.8.0"
+vip_interface: eth0
+vip: 192.168.3.50
+
+metallb_version: v0.13.12
+lb_range: 192.168.3.80-192.168.3.90
+lb_pool_name: first-pool
+
+rke2_version: "v1.29.4+rke2r1"
+rke2_install_dir: "/usr/local/bin"
+rke2_binary_url: "https://github.com/rancher/rke2/releases/download/{{ rke2_version }}/rke2.linux-amd64"
+
+ansible_user: ubuntu
+ansible_become: true
+ansible_become_method: sudo

AnisiblePlaybooks/Playbooks/RKE2/inventory/hosts.ini

@@ -0,0 +1,11 @@
+# Make sure Ansible host has access to these devices
+# Good idea to snapshot all machines and deploy uing cloud-init
+
+[servers]
+server1 ansible_host=192.168.3.21
+server2 ansible_host=192.168.3.22
+server3 ansible_host=192.168.3.23
+
+[agents]
+agent1 ansible_host=192.168.3.24
+agent2 ansible_host=192.168.3.25

AnisiblePlaybooks/Playbooks/RKE2/roles/add-agent/tasks/main.yaml

@@ -0,0 +1,17 @@
+# Copy agent config to all agents - we need to change agent2 & 3 later with the token
+- name: Deploy RKE2 Agent Configuration
+  ansible.builtin.template:
+    src: templates/rke2-agent-config.j2
+    dest: /etc/rancher/rke2/config.yaml
+    owner: root
+    group: root
+    mode: '0644'
+  when: inventory_hostname in groups['agents']
+
+# Check agents have restarted to pick up config
+- name: Ensure RKE2 agents are enabled and running
+  ansible.builtin.systemd:
+    name: rke2-agent
+    enabled: true
+    state: restarted
+    daemon_reload: true

AnisiblePlaybooks/Playbooks/RKE2/roles/add-agent/templates/rke2-agent-config.j2

@@ -0,0 +1,5 @@
+write-kubeconfig-mode: "0644"
+token: {{ hostvars['server1']['token'] }}
+server: https://{{ hostvars['server1']['ansible_host'] }}:9345
+node-label:
+  - "agent=true"

AnisiblePlaybooks/Playbooks/RKE2/roles/add-server/tasks/main.yaml

@@ -0,0 +1,53 @@
+# Copy server config with token to all servers except server 1 (this has token)
+- name: Deploy RKE2 server Configuration
+  ansible.builtin.template:
+    src: templates/rke2-server-config.j2
+    dest: /etc/rancher/rke2/config.yaml
+    owner: root
+    group: root
+    mode: '0644'
+  when: inventory_hostname != groups['servers'][0]
+
+# Keep checking the cluster API until it's functioning (deployed)
+- name: Wait for cluster API to be ready (can take 5-10 mins depending on internet/hardware)
+  ansible.builtin.command:
+    cmd: "kubectl get nodes"
+  register: kubectl_output
+  until: "'connection refused' not in kubectl_output.stderr"
+  retries: 120
+  delay: 10
+  changed_when: true
+  become_user: "{{ ansible_user }}"
+  when: inventory_hostname == groups['servers'][0]
+
+# Use kubectl to deploy yaml. Perhaps this can be added to the manifest folder initially
+- name: Apply kube vip configuration file
+  ansible.builtin.command:
+    cmd: kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml apply -f https://kube-vip.io/manifests/rbac.yaml
+  changed_when: true
+  when: inventory_hostname == groups['servers'][0]
+
+# Apply the kube-vip configration. Perhaps this can be added to the manifest folder initially
+- name: Apply kube vip configuration file
+  ansible.builtin.command:
+    cmd: kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml apply -f https://raw.githubusercontent.com/kube-vip/kube-vip-cloud-provider/main/manifest/kube-vip-cloud-controller.yaml
+  changed_when: true
+  when: inventory_hostname == groups['servers'][0]
+
+# Check that additional servers are restarted
+- name: Ensure additional RKE2 servers are enabled and running
+  ansible.builtin.systemd:
+    name: rke2-server
+    enabled: true
+    state: restarted
+    daemon_reload: true
+  when: inventory_hostname != groups['servers'][0]
+
+# enable additional servers
+- name: Ensure RKE2 server is enabled and running
+  ansible.builtin.systemd:
+    name: rke2-server
+    enabled: true
+    state: restarted
+    daemon_reload: true
+  when: inventory_hostname != groups['servers'][0]

AnisiblePlaybooks/Playbooks/RKE2/roles/add-server/templates/rke2-server-config.j2

@@ -0,0 +1,10 @@
+write-kubeconfig-mode: "0644"
+token: {{ hostvars['server1']['token'] }}
+server: https://{{ hostvars['server1']['ansible_host'] }}:9345
+tls-san:
+  - {{ vip }}
+  - {{ hostvars['server1']['ansible_host'] }}
+  - {{ hostvars['server2']['ansible_host'] }}
+  - {{ hostvars['server3']['ansible_host'] }}
+node-label:
+  - server=true

AnisiblePlaybooks/Playbooks/RKE2/roles/apply-manifests/tasks/main.yaml

@@ -0,0 +1,60 @@
+# Wait for Server 1 to be ready before continuing with metallb deployment
+- name: Wait for k8s nodes with node label 'server=true' to be ready, otherwise we cannot start metallb deployment
+  ansible.builtin.command:
+    cmd: "kubectl wait --for=condition=Ready nodes --selector server=true --timeout=600s"
+  register: nodes_ready
+  retries: 120
+  delay: 10
+  changed_when: true
+  become_user: "{{ ansible_user }}"
+  when: inventory_hostname == groups['servers'][0]
+
+# Create namespace so that we can deploy metallb
+- name: Apply metallb namespace
+  ansible.builtin.command:
+    cmd: kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.12.1/manifests/namespace.yaml
+  become_user: "{{ ansible_user }}"
+  changed_when: true
+  when: inventory_hostname == groups['servers'][0]
+
+# Apply metallb manifest
+- name: Apply metallb manifest
+  ansible.builtin.command:
+    cmd: kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/{{ metallb_version }}/config/manifests/metallb-native.yaml
+  become_user: "{{ ansible_user }}"
+  changed_when: true
+  when: inventory_hostname == groups['servers'][0]
+
+# Wait for metallb deployment pods to be alive before deploying metallb manifests
+- name: Wait for metallb pods to be ready, otherwise we cannot start metallb deployment
+  ansible.builtin.command:
+    cmd: "kubectl wait --namespace metallb-system --for=condition=ready pod --selector=component=controller --timeout=1800s"
+  changed_when: true
+  become_user: "{{ ansible_user }}"
+  when: inventory_hostname == groups['servers'][0]
+
+# Apply L2 Advertisement for metallb
+- name: Apply metallb L2 Advertisement
+  ansible.builtin.command:
+    cmd: kubectl apply -f https://raw.githubusercontent.com/JamesTurland/JimsGarage/main/Kubernetes/RKE2/l2Advertisement.yaml
+  become_user: "{{ ansible_user }}"
+  changed_when: true
+  when: inventory_hostname == groups['servers'][0]
+
+# Deploy metal IP Pool to Server 1
+- name: Copy metallb IPPool to server 1
+  ansible.builtin.template:
+    src: templates/metallb-ippool.j2
+    dest: /home/{{ ansible_user }}/ippool.yaml
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: '0755'
+  when: inventory_hostname == groups['servers'][0]
+
+# don't think this will work as nodes are no execute, might need agents first
+- name: Apply metallb ipppool
+  ansible.builtin.command:
+    cmd: kubectl apply -f /home/{{ ansible_user }}/ippool.yaml
+  become_user: "{{ ansible_user }}"
+  changed_when: true
+  when: inventory_hostname == groups['servers'][0]

AnisiblePlaybooks/Playbooks/RKE2/roles/apply-manifests/templates/metallb-ippool.j2

@@ -0,0 +1,8 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: {{ lb_pool_name }}
+  namespace: metallb-system
+spec:
+  addresses:
+  - {{ lb_range }}

AnisiblePlaybooks/Playbooks/RKE2/roles/kube-vip/tasks/main.yaml

@@ -0,0 +1,17 @@
+# Create directory to deploy kube-vip manifest
+- name: Create directory for Kube VIP Manifest
+  ansible.builtin.file:
+    path: "/var/lib/rancher/rke2/server/manifests"
+    state: directory
+    mode: '0644'
+  when: inventory_hostname in groups['servers']
+
+# Copy kube-vip to server 1 manifest folder for auto deployment at bootstrap
+- name: Deploy Kube VIP Configuration
+  ansible.builtin.template:
+    src: templates/kube-vip-config.j2
+    dest: /var/lib/rancher/rke2/server/manifests/kube-vip.yaml
+    owner: root
+    group: root
+    mode: '0644'
+  when: inventory_hostname == groups['servers'][0]

AnisiblePlaybooks/Playbooks/RKE2/roles/kube-vip/templates/kube-vip-config.j2

@@ -0,0 +1,88 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/name: kube-vip-ds
+    app.kubernetes.io/version: {{ kube_vip_version }}
+  name: kube-vip-ds
+  namespace: kube-system
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kube-vip-ds
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/name: kube-vip-ds
+        app.kubernetes.io/version: {{ kube_vip_version }}
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: node-role.kubernetes.io/master
+                operator: Exists
+            - matchExpressions:
+              - key: node-role.kubernetes.io/control-plane
+                operator: Exists
+      containers:
+      - args:
+        - manager
+        env:
+        - name: vip_arp
+          value: "true"
+        - name: port
+          value: "6443"
+        - name: vip_interface
+          value: {{ vip_interface }}
+        - name: vip_cidr
+          value: "32"
+        - name: cp_enable
+          value: "true"
+        - name: cp_namespace
+          value: kube-system
+        - name: vip_ddns
+          value: "false"
+        - name: svc_enable
+          value: "false"
+        - name: svc_leasename
+          value: plndr-svcs-lock
+        - name: vip_leaderelection
+          value: "true"
+        - name: vip_leasename
+          value: plndr-cp-lock
+        - name: vip_leaseduration
+          value: "5"
+        - name: vip_renewdeadline
+          value: "3"
+        - name: vip_retryperiod
+          value: "1"
+        - name: address
+          value: {{ vip }}
+        - name: prometheus_server
+          value: :2112
+        image: ghcr.io/kube-vip/kube-vip:{{ kube_vip_version }}
+        imagePullPolicy: Always
+        name: kube-vip
+        resources: {}
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+            - NET_RAW
+      hostNetwork: true
+      serviceAccountName: kube-vip
+      tolerations:
+      - effect: NoSchedule
+        operator: Exists
+      - effect: NoExecute
+        operator: Exists
+  updateStrategy: {}
+status:
+  currentNumberScheduled: 0
+  desiredNumberScheduled: 0
+  numberMisscheduled: 0
+  numberReady: 0

AnisiblePlaybooks/Playbooks/RKE2/roles/prepare-nodes/tasks/main.yaml

@@ -0,0 +1,15 @@
+- name: Enable IPv4 forwarding
+  ansible.posix.sysctl:
+    name: net.ipv4.ip_forward
+    value: "1"
+    state: present
+    reload: true
+  tags: sysctl
+
+- name: Enable IPv6 forwarding
+  ansible.posix.sysctl:
+    name: net.ipv6.conf.all.forwarding
+    value: "1"
+    state: present
+    reload: true
+  tags: sysctl

AnisiblePlaybooks/Playbooks/RKE2/roles/rke2-download/tasks/main.yaml

@@ -0,0 +1,20 @@
+# Create a directory to download RKE2 binary to
+- name: Create directory for RKE2 binary
+  ansible.builtin.file:
+    path: "{{ rke2_install_dir }}"
+    state: directory
+    mode: '0755'
+
+# Download the RKE2 binary
+- name: Download RKE2 binary
+  ansible.builtin.get_url:
+    url: "{{ rke2_binary_url }}"
+    dest: "{{ rke2_install_dir }}/rke2"
+    mode: '0755'
+
+# Set permissions on the RKE2 binary
+- name: Set executable permissions on the RKE2 binary
+  ansible.builtin.file:
+    path: "{{ rke2_install_dir }}/rke2"
+    mode: '0755'
+    state: file

AnisiblePlaybooks/Playbooks/RKE2/roles/rke2-prepare/tasks/main.yaml

@@ -0,0 +1,134 @@
+- name: Create directory for RKE2 config
+  ansible.builtin.file:
+    path: "/etc/rancher/rke2"
+    state: directory
+    mode: '0644'
+
+- name: Create directory for RKE2 token
+  ansible.builtin.file:
+    path: "/var/lib/rancher/rke2/server"
+    state: directory
+    mode: '0644'
+
+# Copy server config to server 1 for bootstrap - we need to change server2 & 3 later with the token
+- name: Deploy RKE2 server Configuration
+  ansible.builtin.template:
+    src: templates/rke2-server-config.j2
+    dest: /etc/rancher/rke2/config.yaml
+    owner: root
+    group: root
+    mode: '0644'
+  when: inventory_hostname in groups['servers']
+
+- name: Create systemd service file for RKE2 server
+  ansible.builtin.template:
+    src: templates/rke2-server.service.j2
+    dest: /etc/systemd/system/rke2-server.service
+    owner: root
+    group: root
+    mode: '0644'
+  when: inventory_hostname in groups['servers']
+
+- name: Create systemd service file for RKE2 agent
+  ansible.builtin.template:
+    src: templates/rke2-agent.service.j2
+    dest: /etc/systemd/system/rke2-agent.service
+    owner: root
+    group: root
+    mode: '0644'
+  when: inventory_hostname in groups['agents']
+
+# we enable the first server to generate tokens etc, copy this afterwards to other servers
+- name: Ensure RKE2 server is enabled and running
+  ansible.builtin.systemd:
+    name: rke2-server
+    enabled: true
+    state: restarted
+    daemon_reload: true
+  when: inventory_hostname in groups['servers'][0]
+
+# wait for node token to be availale so that we can copy it, we need this to join other nodes
+- name: Wait for node-token
+  ansible.builtin.wait_for:
+    path: /var/lib/rancher/rke2/server/node-token
+  when: inventory_hostname == groups['servers'][0]
+
+# wait for kubectl to be downloaded, part of the rke2 installation
+- name: Wait for kubectl
+  ansible.builtin.wait_for:
+    path: /var/lib/rancher/rke2/bin/kubectl
+  when: inventory_hostname == groups['servers'][0]
+
+# copy kubectl to usr bin so that all users can run kubectl commands
+- name: Copy kubectl to user bin
+  ansible.builtin.copy:
+    src: /var/lib/rancher/rke2/bin/kubectl
+    dest: /usr/local/bin/kubectl
+    mode: '0755'
+    remote_src: true
+  become: true
+  when: inventory_hostname == groups['servers'][0]
+
+# wait for the kubectl copy to complete
+- name: Wait for kubectl
+  ansible.builtin.wait_for:
+    path: /usr/local/bin/kubectl
+  when: inventory_hostname == groups['servers'][0]
+
+# modify token access
+- name: Register node-token file access mode
+  ansible.builtin.stat:
+    path: /var/lib/rancher/rke2/server
+  register: p
+
+- name: Change file access for node-token
+  ansible.builtin.file:
+    path: /var/lib/rancher/rke2/server
+    mode: "g+rx,o+rx"
+  when: inventory_hostname == groups['servers'][0]
+
+# Save token as variable
+- name: Fetch the token from the first server node
+  ansible.builtin.slurp:
+    src: /var/lib/rancher/rke2/server/token
+  register: rke2_token
+  when: inventory_hostname == groups['servers'][0]
+  run_once: true
+
+# convert token to fact
+- name: Save Master node-token for later
+  ansible.builtin.set_fact:
+    token: "{{ rke2_token.content | b64decode | regex_replace('\n', '') }}"
+
+# revert token file access
+- name: Restore node-token file access
+  ansible.builtin.file:
+    path: /var/lib/rancher/rke2/server
+    mode: "{{ p.stat.mode }}"
+  when: inventory_hostname == groups['servers'][0]
+
+# check .kube folder exists so that we can use kubectl (config resides here)
+- name: Ensure .kube directory exists in user's home
+  ansible.builtin.file:
+    path: "/home/{{ ansible_user }}/.kube"
+    state: directory
+    mode: '0755'
+  become: true
+
+# copy kubectl config file to .kube folder
+- name: Copy config file to user home directory
+  ansible.builtin.copy:
+    src: /etc/rancher/rke2/rke2.yaml
+    dest: "/home/{{ ansible_user }}/.kube/config"
+    remote_src: true
+    owner: "{{ ansible_user }}"
+    mode: "u=rw,g=,o="
+  when: inventory_hostname == groups['servers'][0]
+
+# change IP from local to server 1 IP
+- name: Replace IP address with server1
+  ansible.builtin.replace:
+    path: /home/{{ ansible_user }}/.kube/config
+    regexp: '127.0.0.1'
+    replace: "{{ hostvars['server1']['ansible_host'] }}"
+  when: inventory_hostname == groups['servers'][0]

AnisiblePlaybooks/Playbooks/RKE2/roles/rke2-prepare/templates/rke2-agent.service.j2

@@ -0,0 +1,13 @@
+# rke2-agent.service.j2
+[Unit]
+Description=RKE2 Agent
+After=network.target
+
+[Service]
+ExecStart=/usr/local/bin/rke2 agent
+KillMode=process
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target

AnisiblePlaybooks/Playbooks/RKE2/roles/rke2-prepare/templates/rke2-server-config.j2

@@ -0,0 +1,10 @@
+write-kubeconfig-mode: "0644"
+tls-san:
+  - {{ vip }}
+  - {{ hostvars['server1']['ansible_host'] }}
+  - {{ hostvars['server2']['ansible_host'] }}
+  - {{ hostvars['server3']['ansible_host'] }}
+node-label:
+  - server=true
+disable:
+  - rke2-ingress-nginx

AnisiblePlaybooks/Playbooks/RKE2/roles/rke2-prepare/templates/rke2-server.service.j2

@@ -0,0 +1,13 @@
+# rke2-server.service.j2
+[Unit]
+Description=RKE2 server
+After=network.target
+
+[Service]
+ExecStart=/usr/local/bin/rke2 server
+KillMode=process
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target

AnisiblePlaybooks/Playbooks/RKE2/site.yaml

@@ -0,0 +1,61 @@
+# Hello, thanks for using my playbook, hopefully you can help to improve it.
+# Things that need adding: (there are many more)
+# 1) Support different OS & architectures
+# 2) Support multiple CNIs
+# 3) Improve the wait logic
+# 4) Use kubernetes Ansible plugins more sensibly
+# 5) Optimise flow logic
+# 6) Clean up
+
+###############################################################
+# MAKE SURE YOU CHANGE group_vars/all.yaml VARIABLES!!!!!!!!!!!
+###############################################################
+
+# bootstraps first server and copies configs for others/agents
+- name: Prepare all nodes
+  hosts: servers,agents
+  gather_facts: true # enables us to gather lots of useful variables: https://docs.ansible.com/ansible/latest/collections/ansible/builtin/setup_module.html
+  roles:
+    - prepare-nodes
+
+# creates directories for download and then downloads RKE2 and changes permissions
+- name: Download RKE2
+  hosts: servers,agents
+  gather_facts: true
+  roles:
+    - rke2-download
+
+# Creates RKE2 bootstrap manifests folder and copies kube-vip template over (configured with variables)
+- name: Deploy Kube VIP
+  hosts: servers
+  gather_facts: true
+  roles:
+    - kube-vip
+
+# bootstraps the first server, copies configs to nodes, saves token to use later
+- name: Prepare RKE2 on Servers and Agents
+  hosts: servers,agents
+  gather_facts: true
+  roles:
+    - rke2-prepare
+
+# Adds additional servers using the token from the previous task
+- name: Add additional RKE2 Servers
+  hosts: servers
+  gather_facts: true
+  roles:
+    - add-server
+
+# Adds agents to the cluster
+- name: Add additional RKE2 Agents
+  hosts: agents
+  gather_facts: true
+  roles:
+    - add-agent
+
+# Finish kube-vip, add metallb
+- name: Apply manifests after cluster is created
+  hosts: servers
+  gather_facts: true
+  roles:
+    - apply-manifests

AnisiblePlaybooks/Playbooks/Secrets-Variables/File-Copy-Playbook.yaml

@@ -0,0 +1,67 @@
+---
+- name: Deploy Docker Container with Docker Compose
+  hosts: all
+  become: true
+  tasks:
+    - name: Include variables file
+      ansible.builtin.include_vars: myvars.yaml
+
+    - name: Ensure Docker is installed
+      ansible.builtin.package:
+        name: docker
+        state: present
+
+    - name: Ensure Docker service is running
+      ansible.builtin.service:
+        name: docker
+        state: started
+        enabled: true
+
+    - name: Create a directory for Docker Compose files
+      ansible.builtin.file:
+        path: /home/ubuntu/ansible-docker/docker-compose
+        state: directory
+        mode: '0755'  # Optional file permissions
+        owner: ubuntu  # Optional ownership
+        group: ubuntu  # Optional group ownership
+
+    - name: Create a directory for Nginx website files
+      ansible.builtin.file:
+        path: /home/ubuntu/docker/nginx/web
+        state: directory
+        mode: '0755'  # Optional file permissions
+        owner: ubuntu  # Optional ownership
+        group: ubuntu  # Optional group ownership
+
+    - name: Copy docker-compose to remote host
+      ansible.builtin.copy:
+        src: /home/ubuntu/nginx/docker-compose.yaml
+        dest: /home/ubuntu/ansible-docker/docker-compose/docker-compose.yaml
+        mode: '0755'  # Optional file permissions
+        owner: ubuntu  # Optional ownership
+        group: ubuntu  # Optional group ownership
+
+    - name: Copy Nginx website folder to remote host # copies a folder - note no file extension
+      ansible.builtin.copy:
+        src: /home/ubuntu/nginx/website
+        dest: /home/ubuntu/docker/nginx/web
+        mode: '0755'  # Optional file permissions
+        owner: ubuntu  # Optional ownership
+        group: ubuntu  # Optional group ownership
+
+    - name: Replace old name with new name (requires Ansible >= 2.4)
+      ansible.builtin.replace:
+        path: /home/ubuntu/docker/nginx/web/website/index.html
+        regexp: "Jim's Garage"
+        replace: "{{ website_name }}"
+
+    - name: Access and print secret
+      ansible.builtin.replace:
+        path: /home/ubuntu/docker/nginx/web/website/index.html
+        regexp: "Our Features"
+        replace: "{{ api_key }}"
+
+    - name: Start Docker Compose
+      community.docker.docker_compose:
+        project_src: /home/ubuntu/ansible-docker/docker-compose
+        state: present

AnisiblePlaybooks/Playbooks/Secrets-Variables/password

@@ -0,0 +1 @@
+password

AnisiblePlaybooks/Playbooks/Secrets-Variables/secrets_file.enc

@@ -0,0 +1 @@
+api_key: SuperSecretPassword

AnisiblePlaybooks/Playbooks/Update/full-update-upgrade.yml

@@ -0,0 +1,42 @@
+---
+- name: Update, Upgrade, Autoremove, and Autoclean
+  hosts: all
+  become: true
+
+  tasks:
+  - name: Update package index
+    apt:
+      update_cache: yes
+
+  - name: Upgrade packages
+    apt:
+      upgrade: yes
+
+  - name: Perform a distro upgrade
+    ansible.builtin.apt:
+      upgrade: dist
+      update_cache: yes
+
+  - name: Remove dependencies that are no longer needed
+    ansible.builtin.apt:
+      autoremove: yes
+      purge: true
+
+  - name: Update all packages to their latest version
+    ansible.builtin.apt:
+      name: "*"
+      state: latest
+
+  - name: Run the equivalent of "apt-get clean" as a separate step
+    ansible.builtin.apt:
+      clean: yes
+
+  - name: Check if a reboot is required
+    ansible.builtin.stat:
+      path: /var/run/reboot-required
+      get_checksum: no
+    register: reboot_required_file
+
+  - name: Reboot the server (if necessary)
+    ansible.builtin.reboot:
+    when: reboot_required_file.stat.exists == true

AnisiblePlaybooks/Playbooks/fail2ban/config-f2b-protect-sshd.yaml

@@ -0,0 +1,25 @@
+---
+- name: Install fail2ban and configure sshd
+  hosts: "{{ my_hosts | d([]) }}"
+  become: true
+
+  tasks:
+    - name: Install fail2ban
+      ansible.builtin.apt:
+        name:
+          - fail2ban
+        update_cache: true
+
+    - name: Copy fail2ban config file
+      ansible.builtin.copy:
+        src: configfiles/debian-sshd-default.conf
+        dest: /etc/fail2ban/jail.d/debian-sshd-default.conf
+        mode: '0644'
+        owner: root
+        group: root
+
+    - name: Restart fail2ban
+      ansible.builtin.systemd_service:
+        state: restarted
+        daemon_reload: true
+        name: fail2ban

AnisiblePlaybooks/Playbooks/fail2ban/configfiles/debian-sshd-default.conf

@@ -0,0 +1,3 @@
+[sshd]
+enabled = true
+bantime = 3600

AnisiblePlaybooks/Playbooks/installation/inst-core.yaml

@@ -0,0 +1,12 @@
+---
+- name: Install core packages
+  hosts: "{{ my_hosts | d([]) }}"
+  become: true
+
+  tasks:
+    - name: Install core packages
+      ansible.builtin.apt:
+        name:
+          - prometheus-node-exporter
+          - nfs-common
+        update_cache: true

AnisiblePlaybooks/Playbooks/installation/inst-zsh.yaml

@@ -0,0 +1,12 @@
+---
+- name: Install zsh
+  hosts: "{{ my_hosts | d([]) }}"
+  become: true
+
+  tasks:
+    - name: Install zsh
+      ansible.builtin.apt:
+        name: zsh
+        state: present
+        update_cache: true
+      become: true

AnisiblePlaybooks/Playbooks/inventory-proxmox.ini

@@ -0,0 +1,2 @@
+192.168.2.1
+192.168.2.2

AnisiblePlaybooks/Playbooks/inventory.ini

@@ -0,0 +1,14 @@
+# 192.168.2.5 - This is the AWS server
+192.168.2.6
+192.168.2.7
+192.168.2.9
+192.168.2.10
+192.168.2.11
+192.168.2.12
+192.168.2.13
+192.168.2.16
+192.168.2.19
+192.168.2.21
+192.168.2.22
+216.144.227.142
+129.213.86.62

AnisiblePlaybooks/Playbooks/inventory.yaml

@@ -0,0 +1,81 @@
+---
+Homelab:
+  hosts:
+    awx:
+    ansible_host: 192.168.2.5
+    ansible_user: 'miker'
+    ansible_become: true
+    ansible_become_method: sudo
+
+    mygitea:
+    ansible_host: 192.168.2.6
+    ansible_user: 'miker'
+    ansible_become: true
+    ansible_become_method: sudo
+
+    dockerapps:
+    ansible_host: 192.168.2.7
+    ansible_user: 'miker'
+    ansible_become: true
+    ansible_become_method: sudo
+
+    techdns:
+    ansible_host: 192.168.2.9
+    ansible_user: 'miker'
+    ansible_become: true
+    ansible_become_method: sudo
+
+    wireguard:
+    ansible_host: 192.168.2.10
+    ansible_user: 'miker'
+    ansible_become: true
+    ansible_become_method: sudo
+
+    semaphore:
+    ansible_host: 192.168.2.11
+    ansible_user: 'miker'
+    ansible_become: true
+    ansible_become_method: sudo
+
+    linwarden:
+    ansible_host: 192.168.2.12
+    ansible_user: 'miker'
+    ansible_become: true
+    ansible_become_method: sudo
+
+    immich:
+    ansible_host: 192.168.2.13
+    ansible_user: 'miker'
+    ansible_become: true
+    ansible_become_method: sudo
+
+    media:
+    ansible_host: 192.168.2.16
+    ansible_user: 'miker'
+    ansible_become: true
+    ansible_become_method: sudo
+
+    vault:
+    ansible_host: 192.168.2.19
+    ansible_user: 'miker'
+    ansible_become: true
+    ansible_become_method: sudo
+
+    npm:
+    ansible_host: 192.168.2.22
+    ansible_user: 'miker'
+    ansible_become: true
+    ansible_become_method: sudo
+
+    rackserver2:
+    ansible_host: 216.144.227.142
+    ansible_user: 'miker'
+    ansible_become: true
+    ansible_become_method: sudo
+
+    oracle:
+    ansible_host: 129.213.86.62
+    ansible_user: 'miker'
+    ansible_become: true
+    ansible_become_method: sudo
+

AnisiblePlaybooks/Playbooks/laptop/desktopapps.yaml

@@ -0,0 +1,19 @@
+- name: Install desktop applications
+  hosts: "ip.address for desktop"
+  become: true
+
+  tasks:
+    - name: Install Desktop Applications
+      ansible.builtin.apt:
+        name:
+          - curl
+          - wireguard-tools
+          - wireguard
+          - qbittorrent
+          - terminator
+          - filezilla
+          - git-all
+          - codium
+          - stacer
+          - tor
+        update_cache: true

AnisiblePlaybooks/Playbooks/laptop/laptop.yml

@@ -0,0 +1,93 @@
+---
+- hosts: localhost
+  connection: local
+  become: true
+  tasks:
+
+# updates keyring to installs packages
+
+  - name: Update apt package index
+    ansible.builtin.apt:
+      update_cache: true
+
+  - name: Install prerequisites
+    ansible.builtin.apt:
+      name:
+        - software-properties-common
+        - apt-transport-https
+      state: present
+ - name: Add Mozilla gpg key
+    ansible.builtin.apt_key:
+      url: https://packages.mozilla.org/apt/repo-signing-key.gpg
+      state: present
+  - name: Add Mozilla repository
+    apt_repository:
+      repo: deb [arch=amd64] https://packages.mozilla.org/apt mozilla main
+
+  - name: Add VSCode gpg key
+    ansible.builtin.apt_key:
+      url: https://packages.microsoft.com/keys/microsoft.asc
+      state: present
+  - name: Add VSCode repository
+    apt_repository:
+      repo: deb [arch=amd64] https://packages.microsoft.com/repos/vscode stable main
+
+  - name: Add Github gpg key
+    ansible.builtin.apt_key:
+      url: https://cli.github.com/packages/githubcli-archive-keyring.gpg
+      state: present
+  - name: Add Github repository
+    apt_repository:
+      repo: deb [arch=amd64] https://cli.github.com/packages stable main
+
+# Need to find the latest version and replace 1.5.12 with it. However, this is not upgradable.
+# Use only if needed. 
+
+ - name: Install Obsidian
+    ansible.builtin.apt:
+      deb: "https://github.com/obsidianmd/obsidian-releases/releases/download/v1.5.12/obsidian_1.5.12_amd64.deb"
+
+# curl’s the GitHub API for the latest release of the Obsidian official repo, parses the JSON to pick the url 
+# of the .deb package from a list of other package types, then downloads and installs the file from that url.
+ 
+  - name: Get Obsidian Releases
+    ansible.builtin.uri:
+      url: https://api.github.com/repos/obsidianmd/obsidian-releases/releases/latest
+      return_content: true
+    register: json_response
+
+  - name: Install Obsidian
+    ansible.builtin.apt:
+      deb: "{{ item.browser_download_url }}"
+    loop_control:
+      label: "{{ item.browser_download_url }}"
+    loop: "{{ json_response.json.assets }}"
+    when: item.browser_download_url is search("amd64.deb")
+    register: download_url
+
+# Install packages using apt 
+
+  - name: Install apt packages
+    ansible.builtin.apt:
+      state: present
+      update_cache: true
+      name:
+      - htop
+      - tree
+      - neofetch
+      - code
+      - firefox
+      - gh
+      - curl
+      - wireguard-tools
+      - wireguard
+      - qbittorrent
+      - terminator
+      - filezilla
+      - git-all
+      - stacer
+      - tor
+      - wget
+      - python3-pip
+      - ansible
+      - geany

AnisiblePlaybooks/Playbooks/maintenance/maint-diskspace.yaml

@@ -0,0 +1,25 @@
+---
+- name: Check disk space
+  hosts: "{{ my_hosts | d([]) }}"
+
+  tasks:
+    - name: Check disk space available
+      ansible.builtin.shell:
+        cmd: |
+          set -euo pipefail
+          df -Ph / | awk 'NR==2 {print $5}'
+        executable: /bin/bash
+      changed_when: false
+      check_mode: false
+      register: disk_usage
+
+    # - name: Send discord message when disk space is over 80%
+    #   uri:
+    #     url: "your-webhook"
+    #     method: POST
+    #     body_format: json
+    #     body: '{"content": "Disk space on {{ inventory_hostname }} is above 80%!"}'
+    #     headers:
+    #       Content-Type: application/json
+    #     status_code: 204
+    #   when: disk_usage.stdout[:-1]|int > 80

AnisiblePlaybooks/Playbooks/maintenance/maint-docker-clean.yaml

@@ -0,0 +1,14 @@
+---
+- name: Clean docker
+  hosts: "{{ my_hosts | d([]) }}"
+
+  tasks:
+    - name: Prune non-dangling images
+      community.docker.docker_prune:
+        containers: false
+        images: true
+        images_filters:
+          dangling: false
+        networks: false
+        volumes: false
+        builder_cache: false

AnisiblePlaybooks/Playbooks/maintenance/maint-reboot-required.yaml

@@ -0,0 +1,16 @@
+---
+- name: Check if system reboot is required
+  hosts: "{{ my_hosts | d([]) }}"
+  become: true
+
+  tasks:
+    - name: Check if system reboot is required
+      become: true
+      ansible.builtin.stat:
+        path: /var/run/reboot-required
+      register: reboot_required
+
+    - name: Report if reboot is required
+      ansible.builtin.debug:
+        msg: "Reboot is required"
+      when: reboot_required.stat.exists

AnisiblePlaybooks/Playbooks/maintenance/maint-reboot.yaml

@@ -0,0 +1,9 @@
+---
+- name: Reboot machine
+  hosts: "{{ my_hosts | d([]) }}"
+  become: true
+
+  tasks:
+    - name: Reboot machine
+      ansible.builtin.reboot:
+        reboot_timeout: 3600

AnisiblePlaybooks/Playbooks/qemuagent/inventory.ini

@@ -0,0 +1,19 @@
+[homelab]
+192.168.2.1
+192.168.2.2
+192.168.2.3
+192.168.2.7
+192.168.2.8
+192.168.2.9
+192.168.2.10
+192.168.2.13
+192.168.2.14
+192.168.2.16
+#192.168.2.17
+#192.168.2.18
+192.168.2.19
+192.168.2.20
+192.168.2.22
+192.168.2.23
+192.168.2.24
+150.136.35.94

AnisiblePlaybooks/Playbooks/qemuagent/qemuagentinstall.yml

@@ -0,0 +1,38 @@
+---
+- name: Install QEMU Guest Agent
+  hosts: all
+  become: yes
+  tasks:
+    - name: Update package cache
+      apt:
+        update_cache: yes
+      when: ansible_os_family == "Debian"
+
+    - name: Install QEMU Guest Agent on Debian/Ubuntu
+      apt:
+        name: qemu-guest-agent
+        state: present
+      when: ansible_os_family == "Debian"
+
+    - name: Enable and start QEMU Guest Agent service
+      systemd:
+        name: qemu-guest-agent
+        enabled: yes
+        state: started
+
+    - name: Ensure QEMU Guest Agent is running
+      service:
+        name: qemu-guest-agent
+        state: started
+
+
+# This playbook will:
+#
+#    Update the package cache on Debian-based systems.
+#    Install the QEMU Guest Agent on Debian/Ubuntu systems.
+#    Enable and start the QEMU Guest Agent service.
+#    Ensure the QEMU Guest Agent is running.
+#
+# You can save this as a YAML file (e.g., install_qemu_guest_agent.yml) and run it using the command:
+
+# Command: ansible-playbook -i inventory.ini qemuagentinstall.yml -K        #-K is for BECOME sudo password

AnisiblePlaybooks/Playbooks/requirements.yml

@@ -0,0 +1,4 @@
+---
+# Empty requirements file to stop Semaphore warnings
+roles: []
+collections: []

AnisiblePlaybooks/Playbooks/ssh/Create Ansible User and Keys/ansible.cfg

@@ -0,0 +1,3 @@
+[defaults]
+interpreter_python=auto_silent
+host_key_checking=False

AnisiblePlaybooks/Playbooks/ssh/Create Ansible User and Keys/ansibleuser.yml

@@ -0,0 +1,29 @@
+---
+- name: Post install configuration
+  hosts: all
+  become: true   # Use this if you need sudo privileges
+  tasks:
+
+    - name: Update and Upgrade all packages
+      apt:
+        update_cache: yes
+        upgrade: dist
+      when: ansible_os_family == "Debian"
+
+    - name: create ansible user
+      user:
+        name: ansible
+        shell: '/bin/bash'
+
+    - name: Install public keys
+      authorized_key:
+        user: ansible
+        key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINxwwGO69n2Ljbip4h43T4SRgzRu6iaUPWXR/R25rPjr ansible@ubuntu03"
+
+    - name: add ansible to sudoers
+      copy:
+        src: sudoer_ansible
+        dest: /etc/sudoers.d/ansible
+        owner: root
+        group: root
+        mode: 0440

AnisiblePlaybooks/Playbooks/ssh/Create Ansible User and Keys/files/sudoer_ansible

@@ -0,0 +1 @@
+ansible ALL=(ALL) NOPASSWD: ALL

AnisiblePlaybooks/Playbooks/ssh/Create Ansible User and Keys/inventory.ini

@@ -0,0 +1,19 @@
+[servers]
+192.168.2.1
+192.168.2.2
+192.168.2.3
+192.168.2.7
+192.168.2.8
+192.168.2.9
+192.168.2.10
+192.168.2.13
+192.168.2.14
+192.168.2.16
+#192.168.2.17
+#192.168.2.18
+192.168.2.19
+192.168.2.20
+192.168.2.22
+192.168.2.23
+192.168.2.24
+150.136.35.94

AnisiblePlaybooks/Playbooks/ssh/config-add-sshkey.yaml

@@ -0,0 +1,19 @@
+---
+- name: Add ssh key
+  hosts: "{{ my_hosts | d([]) }}"
+  become: true
+
+  tasks:
+    - name: Install public keys
+      ansible.posix.authorized_key:
+        user: "{{ lookup('env', 'USER') }}"
+        state: present
+        key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
+
+    - name: Change sudoers file
+      ansible.builtin.lineinfile:
+        path: /etc/sudoers
+        state: present
+        regexp: '^%sudo'
+        line: '%sudo ALL=(ALL) NOPASSWD: ALL'
+        validate: /usr/sbin/visudo -cf %s