miker/Compose-Files
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

migrate

Browse Source
This commit is contained in:
Mike McFetridge
2026-07-20 09:23:17 -04:00
parent c1315882da
commit 72272e4006
3179 changed files with 562960 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+9
View File
@@ -0,0 +1,9 @@
.DS_Store
._*
.AppleDouble
.LSOverride
.Spotlight-V100
.Trashes
config.yaml
/AGENTS.md
AnisiblePlaybooks/.gitignore
+20
View File
@@ -0,0 +1,20 @@
# ---> Actionscript
# Build and Release Folders
bin-debug/
bin-release/
[Oo]bj/
[Bb]in/
# Other files and folders
.settings/
# Executables
*.swf
*.air
*.ipa
*.apk
# Project files, i.e. `.project`, `.actionScriptProperties` and `.flexProperties`
# should NOT be excluded as they contain compiler settings and other important
# information for Eclipse / Flash Builder.
AnisiblePlaybooks/CHeckmk/activate-changes.yaml
+20
View File
@@ -0,0 +1,20 @@
---
- name: "Activate Checkmk changes"
hosts: localhost
gather_facts: false
vars_files:
- secrets.yaml
vars:
server_url: "http://192.168.2.4:5000"
site: "cmk"
tasks:
- name: "Start activation on a specific site"
checkmk.general.activation:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
force_foreign_changes: 'true'
sites:
- "{{ site }}"
AnisiblePlaybooks/CHeckmk/checkmk-install-agent/files/main.yml
+16
View File
@@ -0,0 +1,16 @@
---
- name: Install Checkmk agent on all hosts
hosts: all
become: true
roles:
- checkmk.general.agent
vars:
checkmk_agent_version: "2.4.0p15"
checkmk_agent_server: << checkmk_server >>
checkmk_agent_server_protocol: << checkmk_protocol >>
checkmk_agent_site: << checkmk_site >>
checkmk_agent_auto_activate: << checkmk_auto_activate >>
checkmk_agent_tls: << checkmk_tls >>
checkmk_agent_user: << checkmk_user >>
checkmk_agent_pass: << checkmk_pass >>
checkmk_agent_host_name: << checkmk_host >>
AnisiblePlaybooks/CHeckmk/checkmk-install-agent/template.json
+82
View File
@@ -0,0 +1,82 @@
{
"slug": "checkmk-install-agent",
"kind": "ansible",
"metadata": {
"name": "Install Checkmk Agent",
"description": "Installs and registers the Checkmk monitoring agent on target hosts using the checkmk.general.agent Ansible role.",
"tags": [],
"icon": {
"provider": "selfhst",
"id": "checkmk"
},
"draft": false,
"version": {
"name": "2.4.0",
"source_dep_name": "manual/checkmk-install-agent"
}
},
"variables": [
{
"title": "Checkmk Configuration",
"name": "checkmk",
"items": [
{
"name": "checkmk_server",
"type": "str",
"title": "Checkmk Server",
"required": true
},
{
"name": "checkmk_protocol",
"type": "str",
"title": "Protocol",
"required": true,
"default": "https",
"config": {
"placeholder": "https"
}
},
{
"name": "checkmk_site",
"type": "str",
"title": "Checkmk Site",
"required": true,
"default": "cmk",
"config": {
"placeholder": "cmk"
}
},
{
"name": "checkmk_auto_activate",
"type": "bool",
"title": "Auto Activate Agent",
"required": false
},
{
"name": "checkmk_tls",
"type": "bool",
"title": "TLS",
"required": false
},
{
"name": "checkmk_user",
"type": "str",
"title": "Checkmk Automation User",
"required": true
},
{
"name": "checkmk_pass",
"type": "secret",
"title": "Automation Password",
"required": true
},
{
"name": "checkmk_host",
"type": "str",
"title": "Checkmk Host Name",
"required": true
}
]
}
]
}
AnisiblePlaybooks/CHeckmk/checkmk-manage-host/files/main.yml
+18
View File
@@ -0,0 +1,18 @@
---
- name: Manage Checkmk host
hosts: all
gather_facts: false
tasks:
- name: "Create or update host in Checkmk"
checkmk.general.host:
server_url: "<< checkmk_protocol >>://<< checkmk_server >>"
site: << checkmk_site >>
automation_user: << checkmk_user >>
automation_secret: << checkmk_pass >>
name: << host_name >>
attributes:
ipaddress: << host_ip >>
folder: << host_folder >>
state: "present"
delegate_to: localhost
run_once: true
AnisiblePlaybooks/CHeckmk/checkmk-manage-host/template.json
+94
View File
@@ -0,0 +1,94 @@
{
"slug": "checkmk-manage-host",
"kind": "ansible",
"metadata": {
"name": "Manage Checkmk Host",
"description": "Manages host entries in Checkmk monitoring using the checkmk.general.host Ansible module. Creates or updates host configuration in your Checkmk instance.",
"tags": [],
"icon": {
"provider": "selfhst",
"id": "checkmk"
},
"draft": false,
"version": {
"name": "2.4.0",
"source_dep_name": "manual/checkmk-manage-host"
}
},
"variables": [
{
"title": "Checkmk Configuration",
"name": "checkmk",
"items": [
{
"name": "checkmk_server",
"type": "str",
"title": "Checkmk Server",
"required": true
},
{
"name": "checkmk_protocol",
"type": "str",
"title": "Protocol",
"required": true,
"default": "https",
"config": {
"placeholder": "https"
}
},
{
"name": "checkmk_site",
"type": "str",
"title": "Checkmk Site",
"required": true,
"default": "cmk",
"config": {
"placeholder": "cmk"
}
},
{
"name": "checkmk_user",
"type": "str",
"title": "Checkmk Automation User",
"required": true
},
{
"name": "checkmk_pass",
"type": "secret",
"title": "Automation Password",
"required": true
}
]
},
{
"title": "Host Configuration",
"name": "host",
"items": [
{
"name": "host_name",
"type": "str",
"title": "Host Name",
"required": true,
"description": "Hostname to add to Checkmk"
},
{
"name": "host_ip",
"type": "str",
"title": "Host IP",
"required": true,
"description": "IP address of the host"
},
{
"name": "host_folder",
"type": "str",
"title": "Folder Path",
"required": true,
"default": "/",
"config": {
"placeholder": "/"
}
}
]
}
]
}
AnisiblePlaybooks/CHeckmk/install-agent.yaml
+20
View File
@@ -0,0 +1,20 @@
# to run: ansible-playbook -i ./inventory.ini install-agent.yaml --ask-become-pass
---
- name: "Install Checkmk agent on all hosts"
hosts: all
become: yes
roles:
- checkmk.general.agent
vars:
checkmk_agent_version: "2.3.0p7"
#checkmk_agent_server: "192.168.2.4:5000"
checkmk_agent_server: "checkmk.mikemcfetridge.com"
checkmk_agent_server_protocol: https
checkmk_agent_site: "cmk"
checkmk_agent_auto_activate: true
checkmk_agent_tls: "true" # NOTE: Register Agent to enable TLS
checkmk_agent_user: "{{ automation_user }}"
checkmk_agent_pass: "{{ automation_secret }}"
checkmk_agent_host_name: "{{ ansible_hostname }}" # NOTE: Required to replace FQDN with hostname only
vars_files:
- secrets.yaml
AnisiblePlaybooks/CHeckmk/inventory.ini
+23
View File
@@ -0,0 +1,23 @@
[servers]
192.168.2.1
192.168.2.2
192.168.2.3
192.168.2.4
192.168.2.5
192.168.2.6
192.168.2.7
192.168.2.8
192.168.2.9
192.168.2.10
192.168.2.11
192.168.2.12
192.168.2.13
192.168.2.14
192.168.2.16
192.168.2.17
192.168.2.18
192.168.2.19
192.168.2.20
192.168.2.22
192.168.2.23
192.168.2.24
AnisiblePlaybooks/CHeckmk/inventory.yaml
+21
View File
@@ -0,0 +1,21 @@
[servers]
ansible-server.home.mikemcfetridge.com
arrsserver.home.mikemcfetridge.com
beszel-server.home.mikemcfetridge.com
checkmk.home.mikemcfetridge.com
dockerapps.home.mikemcfetridge.com
gitea-server.home.mikemcfetridge.com
glance-server.home.mikemcfetridge.com
immich-wallabag.home.mikemcfetridge.com
linkwarden.home.mikemcfetridge.com
netbird-1.home.mikemcfetridge.com
netbird-2.home.mikemcfetridge.com
npm-server.home.mikemcfetridge.com
pihole-server.home.mikemcfetridge.com
pve.home.mikemcfetridge.com
pve2.home.mikemcfetridge.com
retrogaming-server.home.mikemcfetridge.com
searxng-server.home.mikemcfetridge.com
technitiumdns-server.home.mikemcfetridge.com
vaultwarden-server.home.mikemcfetridge.com
wireguard-server.home.mikemcfetridge.com
AnisiblePlaybooks/CHeckmk/lookup-rule.yaml
+25
View File
@@ -0,0 +1,25 @@
---
- name: "Manage Checkmk rules"
hosts: localhost
gather_facts: false
vars_files:
- secrets.yaml
vars:
server_url: "http://192.168.2.4:5000"
site: "cmk"
tasks:
- name: Get a rule with a particular rule id
ansible.builtin.debug:
msg: "Rule: {{ extensions | to_nice_yaml }}"
vars:
extensions: "{{
lookup('checkmk.general.rule',
rule_id='checkmk-rule-id',
server_url=server_url,
site=site,
automation_user=automation_user,
automation_secret=automation_secret,
validate_certs=False
)
}}"
AnisiblePlaybooks/CHeckmk/manage-hosts.yaml
+286
View File
@@ -0,0 +1,286 @@
---
- name: "Manage Checkmk hosts"
hosts: localhost
gather_facts: false
vars_files:
- secrets.yaml
vars:
server_url: "http://192.168.2.4:5000"
site: "cmk"
tasks:
- name: "Create host - PVE01"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "pve01"
attributes:
ipaddress: "192.168.2.1"
folder: "/"
state: "present"
- name: "Create host - PVE02"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "pve02"
attributes:
ipaddress: "192.168.2.2"
folder: "/"
state: "present"
- name: "Create host - beszel"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Beszel"
attributes:
ipaddress: "192.168.2.3"
folder: "/"
state: "present"
- name: "Create host - Checkmk"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Checkmk"
attributes:
ipaddress: "192.168.2.4"
folder: "/"
state: "present"
- name: "Create host - komodo"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "komodo"
attributes:
ipaddress: "192.168.2.5"
folder: "/"
state: "present"
- name: "Create host - Datacenter"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Datacenter"
attributes:
ipaddress: "192.168.2.6"
folder: "/"
state: "present"
- name: "Create host - DockerApps"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "DockerApps"
attributes:
ipaddress: "192.168.2.7"
folder: "/"
state: "present"
- name: "Create host - PIHOLE"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "PiHole"
attributes:
ipaddress: "192.168.2.8"
folder: "/"
state: "present"
- name: "Create host - TECHNITIUMDNS"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "TechnitiumDNS"
attributes:
ipaddress: "192.168.2.9"
folder: "/"
state: "present"
- name: "Create host - Wireguard"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Wireguard"
attributes:
ipaddress: "192.168.2.10"
folder: "/"
state: "present"
- name: "Create host - Ansible"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Ansible"
attributes:
ipaddress: "192.168.2.11"
folder: "/"
state: "present"
- name: "Create host - LinkWarden"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "LinkWarden"
attributes:
ipaddress: "192.168.2.12"
folder: "/"
state: "present"
- name: "Create host - Immich"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Immich"
attributes:
ipaddress: "192.168.2.13"
folder: "/"
state: "present"
- name: "Create host - RetroGaming"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "RetroGaming"
attributes:
ipaddress: "192.168.2.14"
folder: "/"
state: "present"
- name: "Create host - MediaServer"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "MediaServer"
attributes:
ipaddress: "192.168.2.16"
folder: "/"
state: "present"
- name: "Create host - NetBird1"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "NetBird1"
attributes:
ipaddress: "192.168.2.17"
folder: "/"
state: "present"
- name: "Create host - NetBird2"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "NetBird2"
attributes:
ipaddress: "192.168.2.18"
folder: "/"
state: "present"
- name: "Create host - VaultWarden"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "VaultWarden"
attributes:
ipaddress: "192.168.2.19"
folder: "/"
state: "present"
- name: "Create host - Glance"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Glance"
attributes:
ipaddress: "192.168.2.20"
folder: "/"
state: "present"
- name: "Create host - NPM"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Npm"
attributes:
ipaddress: "192.168.2.22"
folder: "/"
state: "present"
- name: "Create host - Searxng"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Searxng"
attributes:
ipaddress: "192.168.2.23"
folder: "/"
state: "present"
- name: "Create host - Gitea"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Gitea"
attributes:
ipaddress: "192.168.2.24"
folder: "/"
state: "present"
- name: "Start activation on a specific site"
checkmk.general.activation:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
force_foreign_changes: 'true'
sites:
- "{{ site }}"
AnisiblePlaybooks/CHeckmk/manage-rules.yaml
+71
View File
@@ -0,0 +1,71 @@
---
- name: "Manage Checkmk rules"
hosts: localhost
gather_facts: false
vars_files:
- secrets.yaml
vars:
server_url: "checkmk.home.arpa"
site: "cmk"
tasks:
- name: Create DNS Check Rule
checkmk.general.rule:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
ruleset: "active_checks:dns"
rule:
properties: {
"comment": "Ansible managed",
"description": "DNS DNS Monitoring",
"disabled": false,
}
conditions: {
"host_label_groups": [],
"host_name": {
"match_on": [
"your-dns-container-host"
],
"operator": "one_of"
},
"host_tags": [],
"service_label_groups": []
}
"value_raw": {
"hostname": "hostname-to-query",
"server": "dns-server-ip",
"expected_addresses_list": [
"expected-ip-address"
]
}
location:
folder: "/"
position: "top"
state: "present"
- name: Create NVME Temperature override rule
checkmk.general.rule:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
ruleset: "checkgroup_parameters:temperature"
rule:
conditions:
host_label_groups: []
host_tags: []
service_description:
match_on:
- "DRIVE MODEL NAME*"
operator: "one_of"
service_label_groups: []
location:
folder: "/"
position: "top"
properties:
description: "NVME Temperature override"
disabled: false
value_raw: "{'levels': (60.0, 80.0)}"
state: present
AnisiblePlaybooks/CHeckmk/secrets.yaml
+3
View File
@@ -0,0 +1,3 @@
---
automation_user: "ansible"
automation_secret: "Px40If4VUvvA35"
AnisiblePlaybooks/Create Ansible User and Keys/ansible.cfg
+3
View File
@@ -0,0 +1,3 @@
[defaults]
interpreter_python=auto_silent
host_key_checking=False
AnisiblePlaybooks/Create Ansible User and Keys/ansibleuser.yml
+29
View File
@@ -0,0 +1,29 @@
---
- name: Post install configuration
hosts: all
become: true # Use this if you need sudo privileges
tasks:
- name: Update and Upgrade all packages
apt:
update_cache: yes
upgrade: dist
when: ansible_os_family == "Debian"
- name: create ansible user
user:
name: ansible
shell: '/bin/bash'
- name: Install public keys
authorized_key:
user: ansible
key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINxwwGO69n2Ljbip4h43T4SRgzRu6iaUPWXR/R25rPjr ansible@ubuntu03"
- name: add ansible to sudoers
copy:
src: sudoer_ansible
dest: /etc/sudoers.d/ansible
owner: root
group: root
mode: 0440
AnisiblePlaybooks/Create Ansible User and Keys/files/sudoer_ansible
+1
View File
@@ -0,0 +1 @@
ansible ALL=(ALL) NOPASSWD: ALL
AnisiblePlaybooks/Create Ansible User and Keys/inventory.ini
+19
View File
@@ -0,0 +1,19 @@
[servers]
192.168.2.1
192.168.2.2
192.168.2.3
192.168.2.7
192.168.2.8
192.168.2.9
192.168.2.10
192.168.2.13
192.168.2.14
192.168.2.16
#192.168.2.17
#192.168.2.18
192.168.2.19
192.168.2.20
192.168.2.22
192.168.2.23
192.168.2.24
150.136.35.94
AnisiblePlaybooks/LICENSE
+18
View File
@@ -0,0 +1,18 @@
MIT License
Copyright (c) 2026 miker
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
associated documentation files (the "Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial
portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
AnisiblePlaybooks/Packer Templates/credentials.pkr.hcl
+3
View File
@@ -0,0 +1,3 @@
proxmox_api_url = "https://192.168.0.171:8006/api2/json" # Your Proxmox IP Address
proxmox_api_token_id = "root@pam!packer" # API Token ID
proxmox_api_token_secret = "93a46bd3-91f4-4d68-af0d-26ebc9c41d6e"
AnisiblePlaybooks/Packer Templates/ubuntu-server-focal-docker/files/99-pve.cfg
+1
View File
@@ -0,0 +1 @@
datasource_list: [ConfigDrive, NoCloud]
AnisiblePlaybooks/Packer Templates/ubuntu-server-focal-docker/http/meta-data
+1
View File
@@ -0,0 +1 @@
AnisiblePlaybooks/Packer Templates/ubuntu-server-focal-docker/http/user-data
+33
View File
@@ -0,0 +1,33 @@
#cloud-config
autoinstall:
version: 1
locale: en_US
keyboard:
layout: de
ssh:
install-server: true
allow-pw: true
disable_root: true
ssh_quiet_keygen: true
allow_public_ssh_keys: true
packages:
- qemu-guest-agent
- sudo
storage:
layout:
name: direct
swap:
size: 0
user-data:
package_upgrade: false
timezone: Europe/Berlin
users:
- name: your-user-name
groups: [adm, sudo]
lock-passwd: false
sudo: ALL=(ALL) NOPASSWD:ALL
shell: /bin/bash
# passwd: your-password
# - or -
# ssh_authorized_keys:
# - your-ssh-key
AnisiblePlaybooks/Packer Templates/ubuntu-server-focal-docker/ubuntu-server-focal-docker.pkr.hcl
+148
View File
@@ -0,0 +1,148 @@
# Ubuntu Server Focal Docker
# ---
# Packer Template to create an Ubuntu Server (Focal) with Docker on Proxmox
# Variable Definitions
variable "proxmox_api_url" {
type = string
}
variable "proxmox_api_token_id" {
type = string
}
variable "proxmox_api_token_secret" {
type = string
sensitive = true
}
# Resource Definiation for the VM Template
source "proxmox" "ubuntu-server-focal-docker" {
# Proxmox Connection Settings
proxmox_url = "${var.proxmox_api_url}"
username = "${var.proxmox_api_token_id}"
token = "${var.proxmox_api_token_secret}"
# (Optional) Skip TLS Verification
# insecure_skip_tls_verify = true
# VM General Settings
node = "your-proxmox-node"
vm_id = "100"
vm_name = "ubuntu-server-focal-docker"
template_description = "Ubuntu Server Focal Image with Docker pre-installed"
# VM OS Settings
# (Option 1) Local ISO File
# iso_file = "local:iso/ubuntu-20.04.2-live-server-amd64.iso"
# - or -
# (Option 2) Download ISO
# iso_url = "https://releases.ubuntu.com/20.04/ubuntu-20.04.3-live-server-amd64.iso"
# iso_checksum = "f8e3086f3cea0fb3fefb29937ab5ed9d19e767079633960ccb50e76153effc98"
iso_storage_pool = "local"
unmount_iso = true
# VM System Settings
qemu_agent = true
# VM Hard Disk Settings
scsi_controller = "virtio-scsi-pci"
disks {
disk_size = "20G"
format = "qcow2"
storage_pool = "local-lvm"
storage_pool_type = "lvm"
type = "virtio"
}
# VM CPU Settings
cores = "1"
# VM Memory Settings
memory = "2048"
# VM Network Settings
network_adapters {
model = "virtio"
bridge = "vmbr0"
firewall = "false"
}
# VM Cloud-Init Settings
cloud_init = true
cloud_init_storage_pool = "local-lvm"
# PACKER Boot Commands
boot_command = [
"<esc><wait><esc><wait>",
"<f6><wait><esc><wait>",
"<bs><bs><bs><bs><bs>",
"autoinstall ds=nocloud-net;s=http://{{ .HTTPIP }}:{{ .HTTPPort }}/ ",
"--- <enter>"
]
boot = "c"
boot_wait = "5s"
# PACKER Autoinstall Settings
http_directory = "http"
# (Optional) Bind IP Address and Port
# http_bind_address = "0.0.0.0"
# http_port_min = 8802
# http_port_max = 8802
ssh_username = "your-user-name"
# (Option 1) Add your Password here
# ssh_password = "your-password"
# - or -
# (Option 2) Add your Private SSH KEY file here
# ssh_private_key_file = "~/.ssh/id_rsa"
# Raise the timeout, when installation takes longer
ssh_timeout = "20m"
}
# Build Definition to create the VM Template
build {
name = "ubuntu-server-focal-docker"
sources = ["source.proxmox.ubuntu-server-focal-docker"]
# Provisioning the VM Template for Cloud-Init Integration in Proxmox #1
provisioner "shell" {
inline = [
"while [ ! -f /var/lib/cloud/instance/boot-finished ]; do echo 'Waiting for cloud-init...'; sleep 1; done",
"sudo rm /etc/ssh/ssh_host_*",
"sudo truncate -s 0 /etc/machine-id",
"sudo apt -y autoremove --purge",
"sudo apt -y clean",
"sudo apt -y autoclean",
"sudo cloud-init clean",
"sudo rm -f /etc/cloud/cloud.cfg.d/subiquity-disable-cloudinit-networking.cfg",
"sudo sync"
]
}
# Provisioning the VM Template for Cloud-Init Integration in Proxmox #2
provisioner "file" {
source = "files/99-pve.cfg"
destination = "/tmp/99-pve.cfg"
}
# Provisioning the VM Template for Cloud-Init Integration in Proxmox #3
provisioner "shell" {
inline = [ "sudo cp /tmp/99-pve.cfg /etc/cloud/cloud.cfg.d/99-pve.cfg" ]
}
# Provisioning the VM Template with Docker Installation #4
provisioner "shell" {
inline = [
"sudo apt-get install -y ca-certificates curl gnupg lsb-release",
"curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg",
"echo \"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable\" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null",
"sudo apt-get -y update",
"sudo apt-get install -y docker-ce docker-ce-cli containerd.io"
]
}
}
AnisiblePlaybooks/Packer Templates/ubuntu-server-focal/files/99-pve.cfg
+1
View File
@@ -0,0 +1 @@
datasource_list: [ConfigDrive, NoCloud]
AnisiblePlaybooks/Packer Templates/ubuntu-server-focal/http/meta-data
+1
View File
@@ -0,0 +1 @@
AnisiblePlaybooks/Packer Templates/ubuntu-server-focal/http/user-data
+33
View File
@@ -0,0 +1,33 @@
#cloud-config
autoinstall:
version: 1
locale: en_US
keyboard:
layout: de
ssh:
install-server: true
allow-pw: true
disable_root: true
ssh_quiet_keygen: true
allow_public_ssh_keys: true
packages:
- qemu-guest-agent
- sudo
storage:
layout:
name: direct
swap:
size: 0
user-data:
package_upgrade: false
timezone: Europe/Berlin
users:
- name: your-user-name
groups: [adm, sudo]
lock-passwd: false
sudo: ALL=(ALL) NOPASSWD:ALL
shell: /bin/bash
# passwd: your-password
# - or -
# ssh_authorized_keys:
# - your-ssh-key
AnisiblePlaybooks/Packer Templates/ubuntu-server-focal/ubuntu-server-focal.pkr.hcl
+140
View File
@@ -0,0 +1,140 @@
# Ubuntu Server Focal
# ---
# Packer Template to create an Ubuntu Server (Focal) on Proxmox
# Variable Definitions
variable "proxmox_api_url" {
type = string
}
variable "proxmox_api_token_id" {
type = string
}
variable "proxmox_api_token_secret" {
type = string
sensitive = true
}
# Resource Definiation for the VM Template
source "proxmox" "ubuntu-server-focal" {
# Proxmox Connection Settings
proxmox_url = "${var.proxmox_api_url}"
username = "${var.proxmox_api_token_id}"
token = "${var.proxmox_api_token_secret}"
# (Optional) Skip TLS Verification
# insecure_skip_tls_verify = true
# VM General Settings
node = "your-proxmox-node"
vm_id = "100"
vm_name = "ubuntu-server-focal"
template_description = "Ubuntu Server Focal Image"
# VM OS Settings
# (Option 1) Local ISO File
# iso_file = "local:iso/ubuntu-20.04.2-live-server-amd64.iso"
# - or -
# (Option 2) Download ISO
# iso_url = "https://releases.ubuntu.com/20.04/ubuntu-20.04.3-live-server-amd64.iso"
# iso_checksum = "f8e3086f3cea0fb3fefb29937ab5ed9d19e767079633960ccb50e76153effc98"
iso_storage_pool = "local"
unmount_iso = true
# VM System Settings
qemu_agent = true
# VM Hard Disk Settings
scsi_controller = "virtio-scsi-pci"
disks {
disk_size = "20G"
format = "qcow2"
storage_pool = "local-lvm"
storage_pool_type = "lvm"
type = "virtio"
}
# VM CPU Settings
cores = "1"
# VM Memory Settings
memory = "2048"
# VM Network Settings
network_adapters {
model = "virtio"
bridge = "vmbr0"
firewall = "false"
}
# VM Cloud-Init Settings
cloud_init = true
cloud_init_storage_pool = "local-lvm"
# PACKER Boot Commands
boot_command = [
"<esc><wait><esc><wait>",
"<f6><wait><esc><wait>",
"<bs><bs><bs><bs><bs>",
"autoinstall ds=nocloud-net;s=http://{{ .HTTPIP }}:{{ .HTTPPort }}/ ",
"--- <enter>"
]
boot = "c"
boot_wait = "5s"
# PACKER Autoinstall Settings
http_directory = "http"
# (Optional) Bind IP Address and Port
# http_bind_address = "0.0.0.0"
# http_port_min = 8802
# http_port_max = 8802
ssh_username = "your-user-name"
# (Option 1) Add your Password here
# ssh_password = "your-password"
# - or -
# (Option 2) Add your Private SSH KEY file here
# ssh_private_key_file = "~/.ssh/id_rsa"
# Raise the timeout, when installation takes longer
ssh_timeout = "20m"
}
# Build Definition to create the VM Template
build {
name = "ubuntu-server-focal"
sources = ["source.proxmox.ubuntu-server-focal"]
# Provisioning the VM Template for Cloud-Init Integration in Proxmox #1
provisioner "shell" {
inline = [
"while [ ! -f /var/lib/cloud/instance/boot-finished ]; do echo 'Waiting for cloud-init...'; sleep 1; done",
"sudo rm /etc/ssh/ssh_host_*",
"sudo truncate -s 0 /etc/machine-id",
"sudo apt -y autoremove --purge",
"sudo apt -y clean",
"sudo apt -y autoclean",
"sudo cloud-init clean",
"sudo rm -f /etc/cloud/cloud.cfg.d/subiquity-disable-cloudinit-networking.cfg",
"sudo sync"
]
}
# Provisioning the VM Template for Cloud-Init Integration in Proxmox #2
provisioner "file" {
source = "files/99-pve.cfg"
destination = "/tmp/99-pve.cfg"
}
# Provisioning the VM Template for Cloud-Init Integration in Proxmox #3
provisioner "shell" {
inline = [ "sudo cp /tmp/99-pve.cfg /etc/cloud/cloud.cfg.d/99-pve.cfg" ]
}
# Add additional provisioning scripts here
# ...
}
AnisiblePlaybooks/Packer Templates/ubuntu-server-jammy-docker/files/99-pve.cfg
+1
View File
@@ -0,0 +1 @@
datasource_list: [ConfigDrive, NoCloud]
AnisiblePlaybooks/Packer Templates/ubuntu-server-jammy-docker/http/meta-data
+1
View File
@@ -0,0 +1 @@
AnisiblePlaybooks/Packer Templates/ubuntu-server-jammy-docker/http/user-data
+33
View File
@@ -0,0 +1,33 @@
#cloud-config
autoinstall:
version: 1
locale: en_US
keyboard:
layout: en_US
ssh:
install-server: true
allow-pw: true
disable_root: true
ssh_quiet_keygen: true
allow_public_ssh_keys: true
packages:
- qemu-guest-agent
- sudo
storage:
layout:
name: direct
swap:
size: 0
user-data:
package_upgrade: false
timezone: America/New_York
users:
- name: miker
groups: [adm, sudo]
lock-passwd: false
sudo: ALL=(ALL) NOPASSWD:ALL
shell: /bin/bash
# passwd: your-password
# - or -
ssh_authorized_keys:
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDRiieqmQ9e5CYsh0H3VI4KIchnaHFf0H85m3H4bZQ1xe2QSiqiONtXvQVPhrJ98WJwhvhh5dsN2H9I1xQUH6hinUNolKxZxT0RGHMNx2sT4ncTSeoNhQqkPLOxU2LvOPbtCvMv4WoGQYb5BFqENaKh7pdIW25UgszoBX3wlXSQP8zJwanpvSp6TRzDtABthew+uewCDp3wNnyWz1rdMYVrC7BgJwLVjgkVysyuNA6klL2fsTBVvZZs2uY7Nf8TxwbpmJ+x34nBR6Qt9oJcb4eDgw6f5WWL2wk6a+9wR3XDU41Qsq/Nh9qERPmfyWJKdhlXa/2x8gneBLfGB/nCVAPJxoE7AIeztYbhSU1sSa8Qq+whkS3n/lQVxQrJa/AvyIWd4Mcx2v2/xPYm73ljUDbjp/NKnqrcMToYXv67nXYAleDyPRiYKiVHLqhvVktM8udhsaDyGdLoJostm97EWqSj7ey5HFwLlElzSXHDImorht1Ss+P0B842VEM4yCZ/0mU= miker@my-laptop
AnisiblePlaybooks/Packer Templates/ubuntu-server-jammy-docker/ubuntu-server-jammy-docker.pkr.hcl
+150
View File
@@ -0,0 +1,150 @@
# Ubuntu Server jammy
# ---
# Packer Template to create an Ubuntu Server (jammy) on Proxmox
# Variable Definitions
variable "proxmox_api_url" {
type = string
}
variable "proxmox_api_token_id" {
type = string
}
variable "proxmox_api_token_secret" {
type = string
sensitive = true
}
# Resource Definiation for the VM Template
source "proxmox" "ubuntu-server-jammy" {
# Proxmox Connection Settings
proxmox_url = "${var.proxmox_api_url}"
username = "${var.proxmox_api_token_id}"
token = "${var.proxmox_api_token_secret}"
# (Optional) Skip TLS Verification
insecure_skip_tls_verify = true
# VM General Settings
node = "your-proxmox-node"
vm_id = "200"
vm_name = "ubuntu-server-jammy"
template_description = "Ubuntu Server jammy Image"
# VM OS Settings
# (Option 1) Local ISO File
iso_file = "local:iso/ubuntu-22.04.4-live-server-amd64.iso"
# - or -
# (Option 2) Download ISO
# iso_url = "https://releases.ubuntu.com/22.04/ubuntu-22.04-live-server-amd64.iso"
# iso_checksum = "84aeaf7823c8c61baa0ae862d0a06b03409394800000b3235854a6b38eb4856f"
iso_storage_pool = "local"
unmount_iso = true
# VM System Settings
qemu_agent = true
# VM Hard Disk Settings
scsi_controller = "virtio-scsi-pci"
disks {
disk_size = "20G"
format = "qcow2"
storage_pool = "SDD-Storage"
# storage_pool_type = "lvm"
type = "virtio"
}
# VM CPU Settings
cores = "1"
# VM Memory Settings
memory = "2048"
# VM Network Settings
network_adapters {
model = "virtio"
bridge = "vmbr0"
firewall = "false"
}
# VM Cloud-Init Settings
cloud_init = true
cloud_init_storage_pool = "SDD-Storage"
# PACKER Boot Commands
boot_command = [
"<esc><wait>",
"e<wait>",
"<down><down><down><end>",
"<bs><bs><bs><bs><wait>",
"autoinstall ds=nocloud-net\\;s=http://{{ .HTTPIP }}:{{ .HTTPPort }}/ ---<wait>",
"<f10><wait>"
]
boot = "c"
boot_wait = "5s"
# PACKER Autoinstall Settings
http_directory = "http"
# (Optional) Bind IP Address and Port
http_bind_address = "192.168.0.250"
http_port_min = 8802
http_port_max = 8802
ssh_username = "miker"
# (Option 1) Add your Password here
# ssh_password = "enter in password"
# - or -
# (Option 2) Add your Private SSH KEY file here
ssh_private_key_file = "~/.ssh/id_rsa"
# Raise the timeout, when installation takes longer
ssh_timeout = "20m"
}
# Build Definition to create the VM Template
build {
name = "ubuntu-server-jammy"
sources = ["source.proxmox.ubuntu-server-jammy"]
# Provisioning the VM Template for Cloud-Init Integration in Proxmox #1
provisioner "shell" {
inline = [
"while [ ! -f /var/lib/cloud/instance/boot-finished ]; do echo 'Waiting for cloud-init...'; sleep 1; done",
"sudo rm /etc/ssh/ssh_host_*",
"sudo truncate -s 0 /etc/machine-id",
"sudo apt -y autoremove --purge",
"sudo apt -y clean",
"sudo apt -y autoclean",
"sudo cloud-init clean",
"sudo rm -f /etc/cloud/cloud.cfg.d/subiquity-disable-cloudinit-networking.cfg",
"sudo rm -f /etc/netplan/00-installer-config.yaml",
"sudo sync"
]
}
# Provisioning the VM Template for Cloud-Init Integration in Proxmox #2
provisioner "file" {
source = "/home/miker/Documents/Homelab/Home/Proxmox/ubuntu-server-jammy-docker/files/99-pve.cfg"
destination = "/tmp/99-pve.cfg"
}
# Provisioning the VM Template for Cloud-Init Integration in Proxmox #3
provisioner "shell" {
inline = [ "sudo cp /tmp/99-pve.cfg /etc/cloud/cloud.cfg.d/99-pve.cfg" ]
}
# Provisioning the VM Template with Docker Installation #4
provisioner "shell" {
inline = [
"sudo apt-get install -y ca-certificates curl gnupg lsb-release",
"curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg",
"echo \"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable\" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null",
"sudo apt-get -y update",
"sudo apt-get install -y docker-ce docker-ce-cli containerd.io"
]
}
}
AnisiblePlaybooks/Packer Templates/ubuntu-server-jammy/files/99-pve.cfg
+1
View File
@@ -0,0 +1 @@
datasource_list: [ConfigDrive, NoCloud]
AnisiblePlaybooks/Packer Templates/ubuntu-server-jammy/http/meta-data
+1
View File
@@ -0,0 +1 @@
AnisiblePlaybooks/Packer Templates/ubuntu-server-jammy/http/user-data
+33
View File
@@ -0,0 +1,33 @@
#cloud-config
autoinstall:
version: 1
locale: en_US
keyboard:
layout: de
ssh:
install-server: true
allow-pw: true
disable_root: true
ssh_quiet_keygen: true
allow_public_ssh_keys: true
packages:
- qemu-guest-agent
- sudo
storage:
layout:
name: direct
swap:
size: 0
user-data:
package_upgrade: false
timezone: Europe/Berlin
users:
- name: your-user-name
groups: [adm, sudo]
lock-passwd: false
sudo: ALL=(ALL) NOPASSWD:ALL
shell: /bin/bash
# passwd: your-password
# - or -
# ssh_authorized_keys:
# - your-ssh-key
AnisiblePlaybooks/Packer Templates/ubuntu-server-jammy/ubuntu-server-jammy.pkr.hcl
+142
View File
@@ -0,0 +1,142 @@
# Ubuntu Server jammy
# ---
# Packer Template to create an Ubuntu Server (jammy) on Proxmox
# Variable Definitions
variable "proxmox_api_url" {
type = string
}
variable "proxmox_api_token_id" {
type = string
}
variable "proxmox_api_token_secret" {
type = string
sensitive = true
}
# Resource Definiation for the VM Template
source "proxmox-iso" "ubuntu-server-jammy" {
# Proxmox Connection Settings
proxmox_url = "${var.proxmox_api_url}"
username = "${var.proxmox_api_token_id}"
token = "${var.proxmox_api_token_secret}"
# (Optional) Skip TLS Verification
# insecure_skip_tls_verify = true
# VM General Settings
node = "your-proxmox-node"
vm_id = "100"
vm_name = "ubuntu-server-jammy"
template_description = "Ubuntu Server jammy Image"
# VM OS Settings
# (Option 1) Local ISO File
# iso_file = "local:iso/ubuntu-22.04-live-server-amd64.iso"
# - or -
# (Option 2) Download ISO
# iso_url = "https://releases.ubuntu.com/22.04/ubuntu-22.04-live-server-amd64.iso"
# iso_checksum = "84aeaf7823c8c61baa0ae862d0a06b03409394800000b3235854a6b38eb4856f"
iso_storage_pool = "local"
unmount_iso = true
# VM System Settings
qemu_agent = true
# VM Hard Disk Settings
scsi_controller = "virtio-scsi-pci"
disks {
disk_size = "20G"
format = "qcow2"
storage_pool = "local-lvm"
storage_pool_type = "lvm"
type = "virtio"
}
# VM CPU Settings
cores = "1"
# VM Memory Settings
memory = "2048"
# VM Network Settings
network_adapters {
model = "virtio"
bridge = "vmbr0"
firewall = "false"
}
# VM Cloud-Init Settings
cloud_init = true
cloud_init_storage_pool = "local-lvm"
# PACKER Boot Commands
boot_command = [
"<esc><wait>",
"e<wait>",
"<down><down><down><end>",
"<bs><bs><bs><bs><wait>",
"autoinstall ds=nocloud-net\\;s=http://{{ .HTTPIP }}:{{ .HTTPPort }}/ ---<wait>",
"<f10><wait>"
]
boot = "c"
boot_wait = "5s"
# PACKER Autoinstall Settings
http_directory = "http"
# (Optional) Bind IP Address and Port
# http_bind_address = "0.0.0.0"
# http_port_min = 8802
# http_port_max = 8802
ssh_username = "your-user-name"
# (Option 1) Add your Password here
# ssh_password = "your-password"
# - or -
# (Option 2) Add your Private SSH KEY file here
# ssh_private_key_file = "~/.ssh/id_rsa"
# Raise the timeout, when installation takes longer
ssh_timeout = "20m"
}
# Build Definition to create the VM Template
build {
name = "ubuntu-server-jammy"
sources = ["proxmox-iso.ubuntu-server-jammy"]
# Provisioning the VM Template for Cloud-Init Integration in Proxmox #1
provisioner "shell" {
inline = [
"while [ ! -f /var/lib/cloud/instance/boot-finished ]; do echo 'Waiting for cloud-init...'; sleep 1; done",
"sudo rm /etc/ssh/ssh_host_*",
"sudo truncate -s 0 /etc/machine-id",
"sudo apt -y autoremove --purge",
"sudo apt -y clean",
"sudo apt -y autoclean",
"sudo cloud-init clean",
"sudo rm -f /etc/cloud/cloud.cfg.d/subiquity-disable-cloudinit-networking.cfg",
"sudo rm -f /etc/netplan/00-installer-config.yaml",
"sudo sync"
]
}
# Provisioning the VM Template for Cloud-Init Integration in Proxmox #2
provisioner "file" {
source = "files/99-pve.cfg"
destination = "/tmp/99-pve.cfg"
}
# Provisioning the VM Template for Cloud-Init Integration in Proxmox #3
provisioner "shell" {
inline = [ "sudo cp /tmp/99-pve.cfg /etc/cloud/cloud.cfg.d/99-pve.cfg" ]
}
# Add additional provisioning scripts here
# ...
}
AnisiblePlaybooks/Playbooks/Checkmk/activate-changes.yaml
+20
View File
@@ -0,0 +1,20 @@
---
- name: "Activate Checkmk changes"
hosts: localhost
gather_facts: false
vars_files:
- secrets.yaml
vars:
server_url: "http://192.168.2.4:5000"
site: "cmk"
tasks:
- name: "Start activation on a specific site"
checkmk.general.activation:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
force_foreign_changes: 'true'
sites:
- "{{ site }}"
AnisiblePlaybooks/Playbooks/Checkmk/install-agent.yaml
+20
View File
@@ -0,0 +1,20 @@
# to run: ansible-playbook -i ./inventory.ini install-agent.yaml --ask-become-pass
---
- name: "Install Checkmk agent on all hosts"
hosts: all
become: yes
roles:
- checkmk.general.agent
vars:
checkmk_agent_version: "2.3.0p7"
#checkmk_agent_server: "192.168.2.4:5000"
checkmk_agent_server: "checkmk.mikemcfetridge.com"
checkmk_agent_server_protocol: https
checkmk_agent_site: "cmk"
checkmk_agent_auto_activate: true
checkmk_agent_tls: "true" # NOTE: Register Agent to enable TLS
checkmk_agent_user: "{{ automation_user }}"
checkmk_agent_pass: "{{ automation_secret }}"
checkmk_agent_host_name: "{{ ansible_hostname }}" # NOTE: Required to replace FQDN with hostname only
vars_files:
- secrets.yaml
AnisiblePlaybooks/Playbooks/Checkmk/lookup-rule.yaml
+25
View File
@@ -0,0 +1,25 @@
---
- name: "Manage Checkmk rules"
hosts: localhost
gather_facts: false
vars_files:
- secrets.yaml
vars:
server_url: "http://192.168.2.4:5000"
site: "cmk"
tasks:
- name: Get a rule with a particular rule id
ansible.builtin.debug:
msg: "Rule: {{ extensions | to_nice_yaml }}"
vars:
extensions: "{{
lookup('checkmk.general.rule',
rule_id='checkmk-rule-id',
server_url=server_url,
site=site,
automation_user=automation_user,
automation_secret=automation_secret,
validate_certs=False
)
}}"
AnisiblePlaybooks/Playbooks/Checkmk/manage-hosts.yaml
+286
View File
@@ -0,0 +1,286 @@
---
- name: "Manage Checkmk hosts"
hosts: localhost
gather_facts: false
vars_files:
- secrets.yaml
vars:
server_url: "http://192.168.2.4:5000"
site: "cmk"
tasks:
- name: "Create host - PVE01"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "pve01"
attributes:
ipaddress: "192.168.2.1"
folder: "/"
state: "present"
- name: "Create host - PVE02"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "pve02"
attributes:
ipaddress: "192.168.2.2"
folder: "/"
state: "present"
- name: "Create host - beszel"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Beszel"
attributes:
ipaddress: "192.168.2.3"
folder: "/"
state: "present"
- name: "Create host - Checkmk"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Checkmk"
attributes:
ipaddress: "192.168.2.4"
folder: "/"
state: "present"
- name: "Create host - komodo"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "komodo"
attributes:
ipaddress: "192.168.2.5"
folder: "/"
state: "present"
- name: "Create host - Datacenter"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Datacenter"
attributes:
ipaddress: "192.168.2.6"
folder: "/"
state: "present"
- name: "Create host - DockerApps"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "DockerApps"
attributes:
ipaddress: "192.168.2.7"
folder: "/"
state: "present"
- name: "Create host - PIHOLE"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "PiHole"
attributes:
ipaddress: "192.168.2.8"
folder: "/"
state: "present"
- name: "Create host - TECHNITIUMDNS"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "TechnitiumDNS"
attributes:
ipaddress: "192.168.2.9"
folder: "/"
state: "present"
- name: "Create host - Wireguard"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Wireguard"
attributes:
ipaddress: "192.168.2.10"
folder: "/"
state: "present"
- name: "Create host - Ansible"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Ansible"
attributes:
ipaddress: "192.168.2.11"
folder: "/"
state: "present"
- name: "Create host - LinkWarden"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "LinkWarden"
attributes:
ipaddress: "192.168.2.12"
folder: "/"
state: "present"
- name: "Create host - Immich"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Immich"
attributes:
ipaddress: "192.168.2.13"
folder: "/"
state: "present"
- name: "Create host - RetroGaming"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "RetroGaming"
attributes:
ipaddress: "192.168.2.14"
folder: "/"
state: "present"
- name: "Create host - MediaServer"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "MediaServer"
attributes:
ipaddress: "192.168.2.16"
folder: "/"
state: "present"
- name: "Create host - NetBird1"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "NetBird1"
attributes:
ipaddress: "192.168.2.17"
folder: "/"
state: "present"
- name: "Create host - NetBird2"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "NetBird2"
attributes:
ipaddress: "192.168.2.18"
folder: "/"
state: "present"
- name: "Create host - VaultWarden"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "VaultWarden"
attributes:
ipaddress: "192.168.2.19"
folder: "/"
state: "present"
- name: "Create host - Glance"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Glance"
attributes:
ipaddress: "192.168.2.20"
folder: "/"
state: "present"
- name: "Create host - NPM"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Npm"
attributes:
ipaddress: "192.168.2.22"
folder: "/"
state: "present"
- name: "Create host - Searxng"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Searxng"
attributes:
ipaddress: "192.168.2.23"
folder: "/"
state: "present"
- name: "Create host - Gitea"
checkmk.general.host:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
name: "Gitea"
attributes:
ipaddress: "192.168.2.24"
folder: "/"
state: "present"
- name: "Start activation on a specific site"
checkmk.general.activation:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
force_foreign_changes: 'true'
sites:
- "{{ site }}"
AnisiblePlaybooks/Playbooks/Checkmk/manage-rules.yaml
+71
View File
@@ -0,0 +1,71 @@
---
- name: "Manage Checkmk rules"
hosts: localhost
gather_facts: false
vars_files:
- secrets.yaml
vars:
server_url: "checkmk.home.arpa"
site: "cmk"
tasks:
- name: Create DNS Check Rule
checkmk.general.rule:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
ruleset: "active_checks:dns"
rule:
properties: {
"comment": "Ansible managed",
"description": "DNS DNS Monitoring",
"disabled": false,
}
conditions: {
"host_label_groups": [],
"host_name": {
"match_on": [
"your-dns-container-host"
],
"operator": "one_of"
},
"host_tags": [],
"service_label_groups": []
}
"value_raw": {
"hostname": "hostname-to-query",
"server": "dns-server-ip",
"expected_addresses_list": [
"expected-ip-address"
]
}
location:
folder: "/"
position: "top"
state: "present"
- name: Create NVME Temperature override rule
checkmk.general.rule:
server_url: "{{ server_url }}"
site: "{{ site }}"
automation_user: "{{ automation_user }}"
automation_secret: "{{ automation_secret }}"
ruleset: "checkgroup_parameters:temperature"
rule:
conditions:
host_label_groups: []
host_tags: []
service_description:
match_on:
- "DRIVE MODEL NAME*"
operator: "one_of"
service_label_groups: []
location:
folder: "/"
position: "top"
properties:
description: "NVME Temperature override"
disabled: false
value_raw: "{'levels': (60.0, 80.0)}"
state: present
AnisiblePlaybooks/Playbooks/Checkmk/secrets.yaml
+3
View File
@@ -0,0 +1,3 @@
---
automation_user: "ansible"
automation_secret: "Px40If4VUvvA35"
AnisiblePlaybooks/Playbooks/Docker-Portainer/inventory.yaml
+8
View File
@@ -0,0 +1,8 @@
---
docker:
hosts:
docker01:
ansible_host: 192.168.2.7
ansible_user: 'ubuntu'
ansible_become: true
ansible_become_method: sudo
AnisiblePlaybooks/Playbooks/Docker-Portainer/playbook.yaml
+7
View File
@@ -0,0 +1,7 @@
---
- name: Install Docker on Ubuntu
hosts: all
become: true
roles:
- docker_install
- portainer_deploy
AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/docker_install/handlers/main.yaml
+5
View File
@@ -0,0 +1,5 @@
---
- name: Restart Docker
ansible.builtin.systemd:
name: docker
state: restarted
AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/docker_install/tasks/main.yaml
+41
View File
@@ -0,0 +1,41 @@
---
- name: Ensure apt is using HTTPS
ansible.builtin.apt:
name: "{{ item }}"
state: present
loop:
- apt-transport-https
- ca-certificates
- curl
- software-properties-common
- name: Add Docker GPG key
ansible.builtin.apt_key:
url: "https://download.docker.com/linux/ubuntu/gpg"
state: present
- name: Add Docker repository
ansible.builtin.apt_repository:
repo: "{{ docker_apt_repository }}"
state: present
- name: Install Docker CE
ansible.builtin.apt:
name: docker-ce
state: present
update_cache: true
- name: Configure Docker daemon options
ansible.builtin.template:
src: "templates/docker_daemon.json.j2"
dest: "/etc/docker/daemon.json"
owner: 'root'
group: 'root'
mode: '0755' # Optional file permissions
notify: Restart Docker
- name: Ensure Docker service is enabled and running
ansible.builtin.systemd:
name: docker
enabled: true
state: started
AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/docker_install/templates/docker_daemon.json.j2
+3
View File
@@ -0,0 +1,3 @@
{
"storage-driver": "{{ docker_daemon_options['storage-driver'] }}"
}
AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/docker_install/vars/main.yaml
+5
View File
@@ -0,0 +1,5 @@
---
docker_apt_release_channel: "stable"
docker_apt_repository: "deb [arch=amd64] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
docker_daemon_options:
storage-driver: "overlay2"
AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/portainer_deploy/handlers/main.yaml
+6
View File
@@ -0,0 +1,6 @@
---
- name: Start Portainer
community.docker.docker_compose:
project_src: /home/ubuntu/docker-compose/portainer
state: present
restarted: true
AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/portainer_deploy/tasks/main.yaml
+34
View File
@@ -0,0 +1,34 @@
---
- name: Ensure docker-compose is installed
ansible.builtin.package:
name: docker-compose
state: present
- name: Ensure Docker service is running
ansible.builtin.service:
name: docker
state: started
enabled: true
- name: Setup Portainer directory
ansible.builtin.file:
path: /home/ubuntu/docker-compose/portainer
state: directory
mode: '0755' # Optional file permissions
owner: ubuntu # Optional ownership
group: ubuntu # Optional group ownership
- name: Deploy Portainer using Docker Compose
ansible.builtin.template:
src: "templates/docker_compose.yaml.j2"
dest: "/home/ubuntu/docker-compose/portainer/docker-compose.yaml"
mode: '0755' # Optional file permissions
owner: ubuntu # Optional ownership
group: ubuntu # Optional group ownership
notify:
- Start Portainer
- name: Run Portainer docker-compose up
community.docker.docker_compose:
project_src: /home/ubuntu/docker-compose/portainer
state: present
AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/portainer_deploy/templates/docker_compose.yaml.j2
+13
View File
@@ -0,0 +1,13 @@
version: '3.3'
services:
portainer:
image: portainer/portainer-ce:{{ portainer_version }}
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- portainer_data:/data
ports:
- "9000:9000"
restart: always
volumes:
portainer_data:
AnisiblePlaybooks/Playbooks/Docker-Portainer/roles/portainer_deploy/vars/main.yaml
+2
View File
@@ -0,0 +1,2 @@
---
portainer_version: "latest"
AnisiblePlaybooks/Playbooks/File-Copy/File-Copy-Playbook.yaml
+52
View File
@@ -0,0 +1,52 @@
---
- name: Deploy Docker Container with Docker Compose
hosts: all
become: true
tasks:
- name: Ensure Docker is installed
ansible.builtin.package:
name: docker
state: present
- name: Ensure Docker service is running
ansible.builtin.service:
name: docker
state: started
enabled: true
- name: Create a directory for Docker Compose files
ansible.builtin.file:
path: /home/ubuntu/ansible-docker/docker-compose
state: directory
mode: '0755' # Optional file permissions
owner: ubuntu # Optional ownership
group: ubuntu # Optional group ownership
- name: Create a directory for Nginx website files
ansible.builtin.file:
path: /home/ubuntu/docker/nginx/web
state: directory
mode: '0755' # Optional file permissions
owner: ubuntu # Optional ownership
group: ubuntu # Optional group ownership
- name: Copy docker-compose to remote host
ansible.builtin.copy:
src: /home/ubuntu/nginx/docker-compose.yaml
dest: /home/ubuntu/ansible-docker/docker-compose/docker-compose.yaml
mode: '0755' # Optional file permissions
owner: ubuntu # Optional ownership
group: ubuntu # Optional group ownership
- name: Copy Nginx website folder to remote host # copies a folder - note no file extension
ansible.builtin.copy:
src: /home/ubuntu/nginx/website
dest: /home/ubuntu/docker/nginx/web
mode: '0755' # Optional file permissions
owner: ubuntu # Optional ownership
group: ubuntu # Optional group ownership
- name: Start Docker Compose
community.docker.docker_compose:
project_src: /home/ubuntu/ansible-docker/docker-compose
state: present
AnisiblePlaybooks/Playbooks/File-Copy/File-Copy-Undo-Playbook.yaml
+24
View File
@@ -0,0 +1,24 @@
---
- name: Undo Docker Compose Deployment
hosts: all
become: true
tasks:
- name: Stop Docker Container
community.docker.docker_compose:
project_src: /home/ubuntu/ansible-docker/docker-compose
state: absent
- name: Remove Docker Compose file
ansible.builtin.file:
path: /home/ubuntu/ansible-docker/docker-compose/docker-compose.yml
state: absent
- name: Remove Docker Compose directory
ansible.builtin.file:
path: /home/ubuntu/ansible-docker
state: absent
- name: Remove Website directory
ansible.builtin.file:
path: /home/ubuntu/docker/nginx/web
state: absent
AnisiblePlaybooks/Playbooks/File-Copy/inventory.yaml
+8
View File
@@ -0,0 +1,8 @@
---
docker:
hosts:
docker01:
ansible_host: 192.168.2.7
ansible_user: 'ubuntu'
ansible_become: true
ansible_become_method: sudo
AnisiblePlaybooks/Playbooks/File-Copy/nginx/docker-compose.yaml
+31
View File
@@ -0,0 +1,31 @@
version: "3.9"
services:
web:
image: nginx
container_name: jimsgarage
volumes:
- /home/ubuntu/docker/nginx/templates:/etc/nginx/templates
- /home/ubuntu/docker/nginx/web/website:/usr/share/nginx/html
environment:
- NGINX_HOST=nginx.jimsgarage.co.uk
- NGINX_PORT=80
labels:
- "traefik.enable=true"
- "traefik.http.routers.nginx.entrypoints=http"
- "traefik.http.routers.nginx.rule=Host(`nginx.jimsgarage.co.uk`)"
- "traefik.http.middlewares.nginx-https-redirect.redirectscheme.scheme=https"
- "traefik.http.routers.nginx.middlewares=nginx-https-redirect"
- "traefik.http.routers.nginx-secure.entrypoints=https"
- "traefik.http.routers.nginx-secure.rule=Host(`nginx.jimsgarage.co.uk`)"
- "traefik.http.routers.nginx-secure.tls=true"
- "traefik.http.routers.nginx-secure.service=nginx"
- "traefik.http.services.nginx.loadbalancer.server.port=80"
- "traefik.docker.network=proxy"
networks:
proxy:
security_opt:
- no-new-privileges:true
networks:
proxy:
external: true
AnisiblePlaybooks/Playbooks/File-Copy/nginx/website/Jims-Garage-1.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 148 KiB

AnisiblePlaybooks/Playbooks/File-Copy/nginx/website/index.html
+108
View File
@@ -0,0 +1,108 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Jim's Garage Ansible Demo</title>
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css">
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.16.0/umd/popper.min.js"></script>
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"></script>
<style>
.hero {
background: url(Jims-Garage-1.png) no-repeat center center;
background-size: cover;
height: 400px;
display: flex;
align-items: center;
justify-content: center;
color: white;
text-shadow: 2px 2px 5px rgba(0, 0, 0, 0.7);
}
.features {
margin-top: 50px;
text-align: center;
}
.feature {
padding: 20px;
transition: transform 0.3s ease;
}
.feature:hover {
transform: scale(1.05);
}
.footer {
background-color: #333;
color: white;
text-align: center;
padding: 20px;
position: fixed;
width: 100%;
bottom: 0;
}
</style>
</head>
<body>
<!-- Navigation Bar -->
<nav class="navbar navbar-expand-lg navbar-dark bg-dark">
<a class="navbar-brand" href="#">My Webpage</a>
<button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarNav" aria-controls="navbarNav" aria-expanded="false" aria-label="Toggle navigation">
<span class="navbar-toggler-icon"></span>
</button>
<div class="collapse navbar-collapse" id="navbarNav">
<ul class="navbar-nav ml-auto">
<li class="nav-item">
<a class="nav-link" href="#home">Home</a>
</li>
<li class="nav-item">
<a class="nav-link" href="#features">Features</a>
</li>
<li class="nav-item">
<a class="nav-link" href="#contact">Contact</a>
</li>
</ul>
</div>
</nav>
<!-- Hero Section -->
<div class="hero" id="home">
<h1>Welcome to Jim's Garage Ansible Demo</h1>
</div>
<!-- Features Section -->
<div class="container features" id="features">
<h2>Our Features</h2>
<div class="row">
<div class="col-md-4">
<div class="feature">
<i class="fas fa-cogs fa-3x"></i>
<h4>Feature 1</h4>
<p>Dynamic and interactive elements.</p>
</div>
</div>
<div class="col-md-4">
<div class="feature">
<i class="fas fa-bolt fa-3x"></i>
<h4>Feature 2</h4>
<p>Responsive design and transitions.</p>
</div>
</div>
<div class="col-md-4">
<div class="feature">
<i class="fas fa-heart fa-3x"></i>
<h4>Feature 3</h4>
<p>Engaging user experiences.</p>
</div>
</div>
</div>
</div>
<!-- Footer Section -->
<div class="footer">
<p>© 2024 My Webpage. All rights reserved.</p>
</div>
</body>
</html>
AnisiblePlaybooks/Playbooks/Multi-OS-Update/Update-Playbook.yaml
+57
View File
@@ -0,0 +1,57 @@
---
- name: Update Windows, Arch Linux, and Ubuntu
hosts: all
tasks:
- name: Gather facts
ansible.builtin.setup:
- name: Update Windows
when: ansible_facts['os_family'] == 'Windows'
ansible.windows.win_updates:
category_names:
- SecurityUpdates
- UpdateRollups
- CriticalUpdates
state: installed
register: win_update_result
- name: Check if Windows requires a reboot
when: win_update_result.changed and win_update_result.reboot_required | default(false)
ansible.windows.win_reboot:
reboot_timeout: 600
register: win_reboot_result
- name: Update Arch Linux
when: ansible_facts['os_family'] == 'Arch'
community.general.pacman:
update_cache: true
upgrade: true
register: arch_update_result
- name: Check if Arch Linux requires a reboot
when: ansible_facts['os_family'] == 'Arch' and arch_update_result.changed
ansible.builtin.stat:
path: /run/reboot-required
register: arch_reboot_required
- name: Reboot Arch Linux if required
when: arch_reboot_required.stat.exists | default(false)
ansible.builtin.reboot:
reboot_timeout: 600
- name: Update Ubuntu
when: ansible_facts['os_family'] == 'Debian'
ansible.builtin.apt:
upgrade: dist
update_cache: true
- name: Check if a reboot is required on Ubuntu
when: ansible_facts['os_family'] == 'Debian'
ansible.builtin.stat:
path: /var/run/reboot-required
register: ubuntu_reboot_required
- name: Reboot Ubuntu if required
when: ubuntu_reboot_required.stat.exists | default(false)
ansible.builtin.reboot:
reboot_timeout: 600
AnisiblePlaybooks/Playbooks/Multi-OS-Update/inventory.yaml
+14
View File
@@ -0,0 +1,14 @@
arch:
hosts:
arch01:
ansible_host: 192.168.200.214
ansible_user: 'root'
ansible_python_interpreter: /usr/bin/python3
docker:
hosts:
docker01:
ansible_host: 192.168.2.7
ansible_user: 'ubuntu'
ansible_become: true
ansible_become_method: sudo
AnisiblePlaybooks/Playbooks/NewServerBuild/ansible.cfg
+22
View File
@@ -0,0 +1,22 @@
[defaults]
# some basic default values...
inventory = inventory
sudo_user = root
remote_user = miker
private_key_file = $HOME/.ssh/id_rsa
interpreter_python=auto_silent
# plays will gather facts by default, which contain information about
# the remote system.
#
# smart - gather by default, but don't regather if already gathered
# implicit - gather by default, turn off with gather_facts: False
# explicit - do not gather by default, must say gather_facts: True
gathering = smart
# uncomment this to disable SSH key host checking (fingerprint)
host_key_checking = False
# This stop the warning message in the console for unused commands.
deprecation_warning = False
AnisiblePlaybooks/Playbooks/NewServerBuild/inst-docker-portainer-watchtower.yaml
+125
View File
@@ -0,0 +1,125 @@
---
- name: Install docker
hosts: "{{ my_hosts | d([]) }}"
become: true
tasks:
tasks:
# Install SSH Public Key
- name: Install public keys
ansible.posix.authorized_key:
user: "{{ lookup('env', 'USER') }}"
state: present
key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
- name: Change sudoers file
ansible.builtin.lineinfile:
path: /etc/sudoers
state: present
regexp: '^%sudo'
line: '%sudo ALL=(ALL) NOPASSWD: ALL'
validate: /usr/sbin/visudo -cf %s
# Update the system
- name: Update package index
apt:
update_cache: yes
- name: Upgrade packages
apt:
upgrade: yes
- name: Perform a distro upgrade
ansible.builtin.apt:
upgrade: dist
update_cache: yes
- name: Remove dependencies that are no longer needed
ansible.builtin.apt:
autoremove: yes
purge: true
- name: Update all packages to their latest version
ansible.builtin.apt:
name: "*"
state: latest
- name: Run the equivalent of "apt-get clean" as a separate step
ansible.builtin.apt:
clean: yes
# Install Docker and all its dependencies
- name: Install docker dependencies
ansible.builtin.apt:
name:
- apt-transport-https
- ca-certificates
- curl
- gnupg-agent
- software-properties-common
update_cache: true
- name: Add docker gpg key
ansible.builtin.apt_key:
url: https://download.docker.com/linux/ubuntu/gpg
state: present
keyring: /etc/apt/keyrings/docker.gpg
- name: Add docker repository
ansible.builtin.apt_repository:
filename: docker
repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ansible_lsb.codename | lower }} stable
state: present
- name: Update package index
apt:
update_cache: yes
- name: Install docker engine
ansible.builtin.apt:
name:
- docker-ce
- docker-buildx-plugin
- docker-compose-plugin
update_cache: true
# Install Portainer and its volume
- name: Create new volume
community.docker.docker_volume:
name: portainer-data
- name: Deploy portainer
community.docker.docker_container:
name: portainer
image: "docker.io/portainer/portainer-ce"
ports:
- "9445:9443"
volumes:
- /run/docker.sock:/var/run/docker.sock
- portainer-data:/data
restart_policy: unless-stopped
# Install Watch Tower
tasks:
- name: Ensure Docker is running
systemd:
name: docker
state: started
enabled: yes
- name: Create Watchtower directory for configuration (optional, for persistent configuration)
file:
path: /opt/watchtower
state: directory
mode: '0755'
- name: Run Watchtower container
community.docker.docker_container:
name: watchtower
image: containrrr/watchtower
restart_policy: unless-stopped
volumes:
- /var/run/docker.sock:/var/run/docker.sock # Required for Watchtower to interact with Docker
# - /opt/watchtower/config.json:/config.json # Optional: for persistent configuration
# command: --interval 300 # Optional: specify update interval in seconds
state: started
AnisiblePlaybooks/Playbooks/NewServerBuild/inventory.ini
+1
View File
@@ -0,0 +1 @@
192.168.2.14
AnisiblePlaybooks/Playbooks/NewServerBuild/newbuild-v2.yml
+143
View File
@@ -0,0 +1,143 @@
- hosts: all
gather_facts: yes
become: yes
tasks:
################## SSH and Security Configuration ##################
- name: Set SSH configuration permissions
file:
path: /etc/ssh/sshd_config
owner: root
group: root
mode: '0600'
- name: Backup original SSH configuration file (if not exists)
copy:
src: /etc/ssh/sshd_config
dest: /etc/ssh/sshd_config.bak
owner: root
group: root
mode: '0600'
remote_src: yes
force: no
- name: Remove undesired PermitRootLogin and PasswordAuthentication lines
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^(?!#).*PermitRootLogin.*$|^(?!#).*PasswordAuthentication.*$|^(?!#).*PermitEmptyPasswords.*$'
state: absent
- name: Apply consolidated SSH config settings
lineinfile:
path: /etc/ssh/sshd_config
regexp: "^(#)?{{ item.key }}"
line: "{{ item.key }} {{ item.value }}"
state: present
loop:
- { key: "PermitRootLogin", value: "no" }
- { key: "PasswordAuthentication", value: "no" }
- { key: "PermitEmptyPasswords", value: "no" }
- { key: "AllowUsers", value: "miker" }
- { key: "Protocol", value: "2" }
- { key: "PubkeyAuthentication", value: "yes" }
- { key: "Ciphers", value: "aes256-ctr,aes192-ctr,aes128-ctr" }
- { key: "KexAlgorithms", value: "curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256" }
- { key: "LoginGraceTime", value: "30" }
- { key: "X11Forwarding", value: "no" }
- { key: "AllowTcpForwarding", value: "no" }
- { key: "PermitUserEnvironment", value: "no" }
- name: Restart sshd to apply changes
systemd:
name: sshd
state: restarted
- name: Setup passwordless sudo for sudo group
lineinfile:
path: /etc/sudoers
state: present
regexp: '^%sudo'
line: '%sudo ALL=(ALL) NOPASSWD: ALL'
validate: '/usr/sbin/visudo -cf %s'
################## System Package Management ##################
- name: Update apt cache and upgrade all packages
apt:
update_cache: yes
upgrade: dist
force_apt_get: yes
- name: Enable removal of unused dependencies in unattended-upgrades
lineinfile:
path: /etc/apt/apt.conf.d/50unattended-upgrades
regexp: '^Unattended-Upgrade::Remove-Unused-Dependencies'
line: 'Unattended-Upgrade::Remove-Unused-Dependencies "true";'
state: present
create: yes
- name: Enable auto updates via debconf
debconf:
name: unattended-upgrades
question: unattended-upgrades/enable_auto_updates
vtype: boolean
value: 'true'
- name: Install unattended-upgrades package
apt:
name: unattended-upgrades
state: latest
- name: Run dpkg reconfigure for unattended-upgrades
command:
cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
creates: /etc/apt/apt.conf.d/20auto-upgrades
################## Install and Configure Fail2ban ##################
- name: Install required system packages including fail2ban
apt:
name:
- curl
- wget
- git
- unattended-upgrades
- qemu-guest-agent
- fail2ban
state: latest
update_cache: yes
- name: Setup fail2ban jail.local for sshd
copy:
dest: /etc/fail2ban/jail.d/sshd.local
content: |
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 600
ignoreip = 127.0.0.1/8 ::1
action = iptables-multiport
owner: root
group: root
mode: '0644'
- name: Restart fail2ban service
systemd:
name: fail2ban
state: restarted
################## Kernel Update & Reboot ##################
- name: Check for pending reboot
stat:
path: /var/run/reboot-required
register: reboot_required_file
- name: Reboot if kernel updated
reboot:
msg: "Reboot initiated by Ansible for kernel updates"
connect_timeout: 5
reboot_timeout: 300
pre_reboot_delay: 0
post_reboot_delay: 30
test_command: uptime
when: reboot_required_file.stat.exists
AnisiblePlaybooks/Playbooks/NewServerBuild/newbuild.yml
+246
View File
@@ -0,0 +1,246 @@
- hosts: all
gather_facts: yes
become: yes
tasks:
################## Configure SSH and Security Settings ##################
- name: Ensure the SSH configuration file has the correct permissions
file:
path: /etc/ssh/sshd_config
owner: root
group: root
mode: '0600'
- name: Backup the original SSH configuration file
copy:
src: /etc/ssh/sshd_config
dest: /etc/ssh/sshd_config.bak
owner: root
group: root
mode: '0600'
remote_src: yes
- name: Remove PermitRootLogin prohibit-password
lineinfile:
path: /etc/ssh/sshd_config
regex: "(?i)^(?!#).*PermitRootLogin.*prohibit-password"
state: absent
- name: Remove PasswordAuthentication yes
lineinfile:
path: /etc/ssh/sshd_config
regex: "(?i)^(?!#).*PermitRootLogin.*yes"
state: absent
- name: Remove PermitEmptyPasswords no
lineinfile:
path: /etc/ssh/sshd_config
regex: "(?i)^(?!#).*PermitEmptyPasswords.*no"
state: absent
- name: Configure sshd
lineinfile:
path: /etc/ssh/sshd_config
regex: "^(#)?{{ item.key }}"
line: "{{ item.key }} {{ item.value }}"
state: present
loop:
- { key: "PermitRootLogin", value: "no" }
- { key: "PasswordAuthentication", value: "no" }
- { key: "PermitEmptyPasswords", value: "no" }
- { key: "AllowUsers", value: "miker" }
- name: restart sshd
ansible.builtin.systemd:
name: sshd
state: restarted
- name: Setup passwordless sudo
lineinfile:
path: /etc/sudoers
state: present
regexp: '^%sudo'
line: '%sudo ALL=(ALL) NOPASSWD: ALL'
validate: '/usr/sbin/visudo -cf %s'
#########################################################################
######### NEW CODE ##################
#########################################################################
- hosts: all
gather_facts: yes
become: yes
tasks:
################## SSH Hardening Enhancements ##################
- name: Set SSH to use protocol 2 only
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^Protocol'
line: 'Protocol 2'
state: present
- name: Enable public key authentication
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^PubkeyAuthentication'
line: 'PubkeyAuthentication yes'
state: present
- name: Disable password authentication
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^PasswordAuthentication'
line: 'PasswordAuthentication no'
state: present
- name: Set preferred ciphers
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^Ciphers'
line: 'Ciphers aes256-ctr,aes192-ctr,aes128-ctr'
state: present
- name: Set key exchange algorithms
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^KexAlgorithms'
line: 'KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
state: present
- name: Set LoginGraceTime to 30s
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^LoginGraceTime'
line: 'LoginGraceTime 30'
state: present
- name: Disable X11 forwarding
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^X11Forwarding'
line: 'X11Forwarding no'
state: present
- name: Disable TCP forwarding
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^AllowTcpForwarding'
line: 'AllowTcpForwarding no'
state: present
- name: Disable PermitUserEnvironment
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^PermitUserEnvironment'
line: 'PermitUserEnvironment no'
state: present
- name: Restart sshd to apply config changes
systemd:
name: sshd
state: restarted
################## Fail2ban Configuration ##################
- name: Ensure Fail2ban is installed
apt:
name: fail2ban
state: latest
update_cache: yes
- name: Setup Fail2ban jail.local for SSH
copy:
dest: /etc/fail2ban/jail.d/sshd.local
content: |
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 600
ignoreip = 127.0.0.1/8 ::1 # Add your trusted IPs here
action = iptables-multiport
owner: root
group: root
mode: '0644'
- name: Restart fail2ban to apply new configuration
systemd:
name: fail2ban
state: restarted
#########################################################################
#########################################################################
################## Update and Upgrade System Packages ##################
- name: Update apt repo and cache on all Debian/Ubuntu boxes
apt: update_cache=yes force_apt_get=yes cache_valid_time=3600
- name: Upgrade all packages on servers
apt: upgrade=dist force_apt_get=yes
- name: automatically remove unused dependencies
lineinfile: dest=/etc/apt/apt.conf.d/50unattended-upgrades
regexp="Unattended-Upgrade::Remove-Unused-Dependencies"
line="Unattended-Upgrade::Remove-Unused-Dependencies \"true\";"
state=present
create=yes
- name: echo "unattended-upgrades unattended-upgrades/enable_auto_updates boolean true" | sudo debconf-set-selections - auto install security updates
debconf:
name: unattended-upgrades
question: unattended-upgrades/enable_auto_updates
vtype: boolean
value: 'true'
- name: apt install unattended-upgrades
apt:
name: unattended-upgrades
- name: dpkg-reconfigure -f noninteractive unattended-upgrades
command:
cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
creates: /etc/apt/apt.conf.d/20auto-upgrades
- name: Check if a reboot is needed on all servers
register: reboot_required_file
stat: path=/var/run/reboot-required get_checksum=false
################### Install Required System Packages ##################
- name: Update apt and install required system packages
apt:
pkg:
- curl
- wget
- git
- unattended-upgrades
- qemu-guest-agent
state: latest
update_cache: true
- name: Install fail2ban
apt:
name: fail2ban
state: latest
update_cache: true
- name: set up fail2ban
command: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
creates=/etc/fail2ban/jail.local
################# Reboot if Kernel Updated ##################
- name: Reboot the box if kernel updated
reboot:
msg: "Reboot initiated by Ansible for kernel updates"
connect_timeout: 5
reboot_timeout: 300
pre_reboot_delay: 0
post_reboot_delay: 30
test_command: uptime
when: reboot_required_file.stat.exists
AnisiblePlaybooks/Playbooks/Newbuild/newbuild.yml
+134
View File
@@ -0,0 +1,134 @@
- hosts: all
gather_facts: yes
become: yes
tasks:
################## Configure SSH and Security Settings ##################
- name: Ensure the SSH configuration file has the correct permissions
file:
path: /etc/ssh/sshd_config
owner: root
group: root
mode: '0600'
- name: Backup the original SSH configuration file
copy:
src: /etc/ssh/sshd_config
dest: /etc/ssh/sshd_config.bak
owner: root
group: root
mode: '0600'
- name: Remove PermitRootLogin prohibit-password
lineinfile:
path: /etc/ssh/sshd_config
regex: "(?i)^(?!#).*PermitRootLogin.*prohibit-password"
state: absent
- name: Remove PasswordAuthentication yes
lineinfile:
path: /etc/ssh/sshd_config
regex: "(?i)^(?!#).*PermitRootLogin.*yes"
state: absent
- name: Remove PermitEmptyPasswords no
lineinfile:
path: /etc/ssh/sshd_config
regex: "(?i)^(?!#).*PermitEmptyPasswords.*no"
state: absent
- name: Configure sshd
lineinfile:
path: /etc/ssh/sshd_config
regex: "^(#)?{{ item.key }}"
line: "{{ item.key }} {{ item.value }}"
state: present
loop:
- { key: "PermitRootLogin", value: "no" }
- { key: "PasswordAuthentication", value: "no" }
- { key: "PermitEmptyPasswords", value: "no" }
- { key: "AllowUsers", value: "miker" }
- name: restart sshd
ansible.builtin.systemd:
name: sshd
state: restarted
- name: Setup passwordless sudo
lineinfile:
path: /etc/sudoers
state: present
regexp: '^%sudo'
line: '%sudo ALL=(ALL) NOPASSWD: ALL'
validate: '/usr/sbin/visudo -cf %s'
################## Update and Upgrade System Packages ##################
- name: Update apt repo and cache on all Debian/Ubuntu boxes
apt: update_cache=yes force_apt_get=yes cache_valid_time=3600
- name: Upgrade all packages on servers
apt: upgrade=dist force_apt_get=yes
- name: automatically remove unused dependencies
lineinfile: dest=/etc/apt/apt.conf.d/50unattended-upgrades
regexp="Unattended-Upgrade::Remove-Unused-Dependencies"
line="Unattended-Upgrade::Remove-Unused-Dependencies \"true\";"
state=present
create=yes
- name: echo "unattended-upgrades unattended-upgrades/enable_auto_updates boolean true" | sudo debconf-set-selections - auto install security updates
debconf:
name: unattended-upgrades
question: unattended-upgrades/enable_auto_updates
vtype: boolean
value: 'true'
- name: apt install unattended-upgrades
apt:
name: unattended-upgrades
- name: dpkg-reconfigure -f noninteractive unattended-upgrades
command:
cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
creates: /etc/apt/apt.conf.d/20auto-upgrades
- name: Check if a reboot is needed on all servers
register: reboot_required_file
stat: path=/var/run/reboot-required get_checksum=false
################### Install Required System Packages ##################
- name: Update apt and install required system packages
apt:
pkg:
- curl
- wget
- git
- unattended-upgrades
- qemu-guest-agent
state: latest
update_cache: true
- name: Install fail2ban
apt:
name: fail2ban
state: latest
update_cache: true
- name: set up fail2ban
command: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
creates=/etc/fail2ban/jail.local
################# Reboot if Kernel Updated ##################
- name: Reboot the box if kernel updated
reboot:
msg: "Reboot initiated by Ansible for kernel updates"
connect_timeout: 5
reboot_timeout: 300
pre_reboot_delay: 0
post_reboot_delay: 30
test_command: uptime
when: reboot_required_file.stat.exists
AnisiblePlaybooks/Playbooks/Proxmox/install_qemu_agent.yml
+53
View File
@@ -0,0 +1,53 @@
# To create an Ansible playbook that checks if qemu-guest-agent is installed, and if not, installs it, you can use the ansible.builtin.package module, which can manage packages across various types of package managers.
# Below is a simple playbook that accomplishes this:
#_________________________________________________________________________________________
---
- name: Check and Install qemu-guest-agent
hosts: all
become: yes # Use this if you need elevated privileges to install packages
tasks:
- name: Check if qemu-guest-agent is installed
ansible.builtin.package_facts:
- name: update apt cache
command: apt update
- name: upgrade all packages
command: apt upgrade -y
- name: Install qemu-guest-agent if not installed
ansible.builtin.package:
name: qemu-guest-agent
state: present
when: "'qemu-guest-agent' not in ansible_facts.packages"
- name: Start guest qemu-guest-agent
ansible.builtin.service:
name: qemu-guest-agent
state: started
enabled: true
#___________________________________________________________________________________________
# Explanation:
#
# hosts: all - This playbook will run on all hosts in your inventory.
# become: yes - This allows the tasks to run with elevated privileges (root), which is often required for installing packages.
# package_facts - This module gathers facts about installed packages on the target machine and stores them in ansible_facts.
# package - This module installs the specified package. The state: present ensures the package is installed.
# when condition - The when clause checks if qemu-guest-agent is present in the ansible_facts.packages. If it’s not installed, the package will be installed.
# Usage
# Save the above YAML content to a file, for instance, install_qemu_guest_agent.yml.
# Run the playbook using the following command:
# COMMAND TO RUN: ansible-playbook -i your_inventory_file install_qemu_guest_agent.yml
# Replace your_inventory_file with the path to your Ansible inventory file that defines your target hosts.
# This playbook should effectively install the qemu-guest-agent on any host where it is not already installed.
AnisiblePlaybooks/Playbooks/Proxmox/post_install_with_docker.yml
+55
View File
@@ -0,0 +1,55 @@
---
- name: Post install configuration with docker
hosts: all
become: true # Use this if you need sudo privileges
tasks:
- name: Update and Upgrade all packages
apt:
update_cache: yes
upgrade: dist
when: ansible_os_family == "Debian"
- name: Install PIP
apt:
name: python3-pip
state: present
when: ansible_os_family == "Debian"
- name: Install qemu-guest-agent
apt:
name: qemu-guest-agent
state: present
when: ansible_os_family == "Debian"
- name: Install docker dependencies
ansible.builtin.apt:
name:
- apt-transport-https
- ca-certificates
- curl
- gnupg-agent
- software-properties-common
update_cache: true
- name: Add docker gpg key
ansible.builtin.apt_key:
url: https://download.docker.com/linux/ubuntu/gpg
state: present
keyring: /etc/apt/keyrings/docker.gpg
- name: Add docker repository
ansible.builtin.apt_repository:
filename: docker
repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ansible_lsb.codename | lower }} stable
state: present
- name: Install docker engine
ansible.builtin.apt:
name:
- docker-ce
- docker-ce-cli
- containerd.io
- docker-buildx-plugin
- docker-compose-plugin
update_cache: true
AnisiblePlaybooks/Playbooks/RKE2/collections/requirements.yaml
+6
View File
@@ -0,0 +1,6 @@
---
collections:
- name: ansible.utils
- name: community.general
- name: ansible.posix
- name: kubernetes.core
AnisiblePlaybooks/Playbooks/RKE2/inventory/group_vars/all.yaml
+18
View File
@@ -0,0 +1,18 @@
os: "linux"
arch: "amd64"
kube_vip_version: "v0.8.0"
vip_interface: eth0
vip: 192.168.3.50
metallb_version: v0.13.12
lb_range: 192.168.3.80-192.168.3.90
lb_pool_name: first-pool
rke2_version: "v1.29.4+rke2r1"
rke2_install_dir: "/usr/local/bin"
rke2_binary_url: "https://github.com/rancher/rke2/releases/download/{{ rke2_version }}/rke2.linux-amd64"
ansible_user: ubuntu
ansible_become: true
ansible_become_method: sudo
AnisiblePlaybooks/Playbooks/RKE2/inventory/hosts.ini
+11
View File
@@ -0,0 +1,11 @@
# Make sure Ansible host has access to these devices
# Good idea to snapshot all machines and deploy uing cloud-init
[servers]
server1 ansible_host=192.168.3.21
server2 ansible_host=192.168.3.22
server3 ansible_host=192.168.3.23
[agents]
agent1 ansible_host=192.168.3.24
agent2 ansible_host=192.168.3.25
AnisiblePlaybooks/Playbooks/RKE2/roles/add-agent/tasks/main.yaml
+17
View File
@@ -0,0 +1,17 @@
# Copy agent config to all agents - we need to change agent2 & 3 later with the token
- name: Deploy RKE2 Agent Configuration
ansible.builtin.template:
src: templates/rke2-agent-config.j2
dest: /etc/rancher/rke2/config.yaml
owner: root
group: root
mode: '0644'
when: inventory_hostname in groups['agents']
# Check agents have restarted to pick up config
- name: Ensure RKE2 agents are enabled and running
ansible.builtin.systemd:
name: rke2-agent
enabled: true
state: restarted
daemon_reload: true
AnisiblePlaybooks/Playbooks/RKE2/roles/add-agent/templates/rke2-agent-config.j2
+5
View File
@@ -0,0 +1,5 @@
write-kubeconfig-mode: "0644"
token: {{ hostvars['server1']['token'] }}
server: https://{{ hostvars['server1']['ansible_host'] }}:9345
node-label:
- "agent=true"
AnisiblePlaybooks/Playbooks/RKE2/roles/add-server/tasks/main.yaml
+53
View File
@@ -0,0 +1,53 @@
# Copy server config with token to all servers except server 1 (this has token)
- name: Deploy RKE2 server Configuration
ansible.builtin.template:
src: templates/rke2-server-config.j2
dest: /etc/rancher/rke2/config.yaml
owner: root
group: root
mode: '0644'
when: inventory_hostname != groups['servers'][0]
# Keep checking the cluster API until it's functioning (deployed)
- name: Wait for cluster API to be ready (can take 5-10 mins depending on internet/hardware)
ansible.builtin.command:
cmd: "kubectl get nodes"
register: kubectl_output
until: "'connection refused' not in kubectl_output.stderr"
retries: 120
delay: 10
changed_when: true
become_user: "{{ ansible_user }}"
when: inventory_hostname == groups['servers'][0]
# Use kubectl to deploy yaml. Perhaps this can be added to the manifest folder initially
- name: Apply kube vip configuration file
ansible.builtin.command:
cmd: kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml apply -f https://kube-vip.io/manifests/rbac.yaml
changed_when: true
when: inventory_hostname == groups['servers'][0]
# Apply the kube-vip configration. Perhaps this can be added to the manifest folder initially
- name: Apply kube vip configuration file
ansible.builtin.command:
cmd: kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml apply -f https://raw.githubusercontent.com/kube-vip/kube-vip-cloud-provider/main/manifest/kube-vip-cloud-controller.yaml
changed_when: true
when: inventory_hostname == groups['servers'][0]
# Check that additional servers are restarted
- name: Ensure additional RKE2 servers are enabled and running
ansible.builtin.systemd:
name: rke2-server
enabled: true
state: restarted
daemon_reload: true
when: inventory_hostname != groups['servers'][0]
# enable additional servers
- name: Ensure RKE2 server is enabled and running
ansible.builtin.systemd:
name: rke2-server
enabled: true
state: restarted
daemon_reload: true
when: inventory_hostname != groups['servers'][0]
AnisiblePlaybooks/Playbooks/RKE2/roles/add-server/templates/rke2-server-config.j2
+10
View File
@@ -0,0 +1,10 @@
write-kubeconfig-mode: "0644"
token: {{ hostvars['server1']['token'] }}
server: https://{{ hostvars['server1']['ansible_host'] }}:9345
tls-san:
- {{ vip }}
- {{ hostvars['server1']['ansible_host'] }}
- {{ hostvars['server2']['ansible_host'] }}
- {{ hostvars['server3']['ansible_host'] }}
node-label:
- server=true
AnisiblePlaybooks/Playbooks/RKE2/roles/apply-manifests/tasks/main.yaml
+60
View File
@@ -0,0 +1,60 @@
# Wait for Server 1 to be ready before continuing with metallb deployment
- name: Wait for k8s nodes with node label 'server=true' to be ready, otherwise we cannot start metallb deployment
ansible.builtin.command:
cmd: "kubectl wait --for=condition=Ready nodes --selector server=true --timeout=600s"
register: nodes_ready
retries: 120
delay: 10
changed_when: true
become_user: "{{ ansible_user }}"
when: inventory_hostname == groups['servers'][0]
# Create namespace so that we can deploy metallb
- name: Apply metallb namespace
ansible.builtin.command:
cmd: kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.12.1/manifests/namespace.yaml
become_user: "{{ ansible_user }}"
changed_when: true
when: inventory_hostname == groups['servers'][0]
# Apply metallb manifest
- name: Apply metallb manifest
ansible.builtin.command:
cmd: kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/{{ metallb_version }}/config/manifests/metallb-native.yaml
become_user: "{{ ansible_user }}"
changed_when: true
when: inventory_hostname == groups['servers'][0]
# Wait for metallb deployment pods to be alive before deploying metallb manifests
- name: Wait for metallb pods to be ready, otherwise we cannot start metallb deployment
ansible.builtin.command:
cmd: "kubectl wait --namespace metallb-system --for=condition=ready pod --selector=component=controller --timeout=1800s"
changed_when: true
become_user: "{{ ansible_user }}"
when: inventory_hostname == groups['servers'][0]
# Apply L2 Advertisement for metallb
- name: Apply metallb L2 Advertisement
ansible.builtin.command:
cmd: kubectl apply -f https://raw.githubusercontent.com/JamesTurland/JimsGarage/main/Kubernetes/RKE2/l2Advertisement.yaml
become_user: "{{ ansible_user }}"
changed_when: true
when: inventory_hostname == groups['servers'][0]
# Deploy metal IP Pool to Server 1
- name: Copy metallb IPPool to server 1
ansible.builtin.template:
src: templates/metallb-ippool.j2
dest: /home/{{ ansible_user }}/ippool.yaml
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
mode: '0755'
when: inventory_hostname == groups['servers'][0]
# don't think this will work as nodes are no execute, might need agents first
- name: Apply metallb ipppool
ansible.builtin.command:
cmd: kubectl apply -f /home/{{ ansible_user }}/ippool.yaml
become_user: "{{ ansible_user }}"
changed_when: true
when: inventory_hostname == groups['servers'][0]
AnisiblePlaybooks/Playbooks/RKE2/roles/apply-manifests/templates/metallb-ippool.j2
+8
View File
@@ -0,0 +1,8 @@
apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
name: {{ lb_pool_name }}
namespace: metallb-system
spec:
addresses:
- {{ lb_range }}
AnisiblePlaybooks/Playbooks/RKE2/roles/kube-vip/tasks/main.yaml
+17
View File
@@ -0,0 +1,17 @@
# Create directory to deploy kube-vip manifest
- name: Create directory for Kube VIP Manifest
ansible.builtin.file:
path: "/var/lib/rancher/rke2/server/manifests"
state: directory
mode: '0644'
when: inventory_hostname in groups['servers']
# Copy kube-vip to server 1 manifest folder for auto deployment at bootstrap
- name: Deploy Kube VIP Configuration
ansible.builtin.template:
src: templates/kube-vip-config.j2
dest: /var/lib/rancher/rke2/server/manifests/kube-vip.yaml
owner: root
group: root
mode: '0644'
when: inventory_hostname == groups['servers'][0]
AnisiblePlaybooks/Playbooks/RKE2/roles/kube-vip/templates/kube-vip-config.j2
+88
View File
@@ -0,0 +1,88 @@
apiVersion: apps/v1
kind: DaemonSet
metadata:
creationTimestamp: null
labels:
app.kubernetes.io/name: kube-vip-ds
app.kubernetes.io/version: {{ kube_vip_version }}
name: kube-vip-ds
namespace: kube-system
spec:
selector:
matchLabels:
app.kubernetes.io/name: kube-vip-ds
template:
metadata:
creationTimestamp: null
labels:
app.kubernetes.io/name: kube-vip-ds
app.kubernetes.io/version: {{ kube_vip_version }}
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/master
operator: Exists
- matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: Exists
containers:
- args:
- manager
env:
- name: vip_arp
value: "true"
- name: port
value: "6443"
- name: vip_interface
value: {{ vip_interface }}
- name: vip_cidr
value: "32"
- name: cp_enable
value: "true"
- name: cp_namespace
value: kube-system
- name: vip_ddns
value: "false"
- name: svc_enable
value: "false"
- name: svc_leasename
value: plndr-svcs-lock
- name: vip_leaderelection
value: "true"
- name: vip_leasename
value: plndr-cp-lock
- name: vip_leaseduration
value: "5"
- name: vip_renewdeadline
value: "3"
- name: vip_retryperiod
value: "1"
- name: address
value: {{ vip }}
- name: prometheus_server
value: :2112
image: ghcr.io/kube-vip/kube-vip:{{ kube_vip_version }}
imagePullPolicy: Always
name: kube-vip
resources: {}
securityContext:
capabilities:
add:
- NET_ADMIN
- NET_RAW
hostNetwork: true
serviceAccountName: kube-vip
tolerations:
- effect: NoSchedule
operator: Exists
- effect: NoExecute
operator: Exists
updateStrategy: {}
status:
currentNumberScheduled: 0
desiredNumberScheduled: 0
numberMisscheduled: 0
numberReady: 0
AnisiblePlaybooks/Playbooks/RKE2/roles/prepare-nodes/tasks/main.yaml
+15
View File
@@ -0,0 +1,15 @@
- name: Enable IPv4 forwarding
ansible.posix.sysctl:
name: net.ipv4.ip_forward
value: "1"
state: present
reload: true
tags: sysctl
- name: Enable IPv6 forwarding
ansible.posix.sysctl:
name: net.ipv6.conf.all.forwarding
value: "1"
state: present
reload: true
tags: sysctl
AnisiblePlaybooks/Playbooks/RKE2/roles/rke2-download/tasks/main.yaml
+20
View File
@@ -0,0 +1,20 @@
# Create a directory to download RKE2 binary to
- name: Create directory for RKE2 binary
ansible.builtin.file:
path: "{{ rke2_install_dir }}"
state: directory
mode: '0755'
# Download the RKE2 binary
- name: Download RKE2 binary
ansible.builtin.get_url:
url: "{{ rke2_binary_url }}"
dest: "{{ rke2_install_dir }}/rke2"
mode: '0755'
# Set permissions on the RKE2 binary
- name: Set executable permissions on the RKE2 binary
ansible.builtin.file:
path: "{{ rke2_install_dir }}/rke2"
mode: '0755'
state: file
AnisiblePlaybooks/Playbooks/RKE2/roles/rke2-download/vars/main.yaml
View File
AnisiblePlaybooks/Playbooks/RKE2/roles/rke2-prepare/tasks/main.yaml
+134
View File
@@ -0,0 +1,134 @@
- name: Create directory for RKE2 config
ansible.builtin.file:
path: "/etc/rancher/rke2"
state: directory
mode: '0644'
- name: Create directory for RKE2 token
ansible.builtin.file:
path: "/var/lib/rancher/rke2/server"
state: directory
mode: '0644'
# Copy server config to server 1 for bootstrap - we need to change server2 & 3 later with the token
- name: Deploy RKE2 server Configuration
ansible.builtin.template:
src: templates/rke2-server-config.j2
dest: /etc/rancher/rke2/config.yaml
owner: root
group: root
mode: '0644'
when: inventory_hostname in groups['servers']
- name: Create systemd service file for RKE2 server
ansible.builtin.template:
src: templates/rke2-server.service.j2
dest: /etc/systemd/system/rke2-server.service
owner: root
group: root
mode: '0644'
when: inventory_hostname in groups['servers']
- name: Create systemd service file for RKE2 agent
ansible.builtin.template:
src: templates/rke2-agent.service.j2
dest: /etc/systemd/system/rke2-agent.service
owner: root
group: root
mode: '0644'
when: inventory_hostname in groups['agents']
# we enable the first server to generate tokens etc, copy this afterwards to other servers
- name: Ensure RKE2 server is enabled and running
ansible.builtin.systemd:
name: rke2-server
enabled: true
state: restarted
daemon_reload: true
when: inventory_hostname in groups['servers'][0]
# wait for node token to be availale so that we can copy it, we need this to join other nodes
- name: Wait for node-token
ansible.builtin.wait_for:
path: /var/lib/rancher/rke2/server/node-token
when: inventory_hostname == groups['servers'][0]
# wait for kubectl to be downloaded, part of the rke2 installation
- name: Wait for kubectl
ansible.builtin.wait_for:
path: /var/lib/rancher/rke2/bin/kubectl
when: inventory_hostname == groups['servers'][0]
# copy kubectl to usr bin so that all users can run kubectl commands
- name: Copy kubectl to user bin
ansible.builtin.copy:
src: /var/lib/rancher/rke2/bin/kubectl
dest: /usr/local/bin/kubectl
mode: '0755'
remote_src: true
become: true
when: inventory_hostname == groups['servers'][0]
# wait for the kubectl copy to complete
- name: Wait for kubectl
ansible.builtin.wait_for:
path: /usr/local/bin/kubectl
when: inventory_hostname == groups['servers'][0]
# modify token access
- name: Register node-token file access mode
ansible.builtin.stat:
path: /var/lib/rancher/rke2/server
register: p
- name: Change file access for node-token
ansible.builtin.file:
path: /var/lib/rancher/rke2/server
mode: "g+rx,o+rx"
when: inventory_hostname == groups['servers'][0]
# Save token as variable
- name: Fetch the token from the first server node
ansible.builtin.slurp:
src: /var/lib/rancher/rke2/server/token
register: rke2_token
when: inventory_hostname == groups['servers'][0]
run_once: true
# convert token to fact
- name: Save Master node-token for later
ansible.builtin.set_fact:
token: "{{ rke2_token.content | b64decode | regex_replace('\n', '') }}"
# revert token file access
- name: Restore node-token file access
ansible.builtin.file:
path: /var/lib/rancher/rke2/server
mode: "{{ p.stat.mode }}"
when: inventory_hostname == groups['servers'][0]
# check .kube folder exists so that we can use kubectl (config resides here)
- name: Ensure .kube directory exists in user's home
ansible.builtin.file:
path: "/home/{{ ansible_user }}/.kube"
state: directory
mode: '0755'
become: true
# copy kubectl config file to .kube folder
- name: Copy config file to user home directory
ansible.builtin.copy:
src: /etc/rancher/rke2/rke2.yaml
dest: "/home/{{ ansible_user }}/.kube/config"
remote_src: true
owner: "{{ ansible_user }}"
mode: "u=rw,g=,o="
when: inventory_hostname == groups['servers'][0]
# change IP from local to server 1 IP
- name: Replace IP address with server1
ansible.builtin.replace:
path: /home/{{ ansible_user }}/.kube/config
regexp: '127.0.0.1'
replace: "{{ hostvars['server1']['ansible_host'] }}"
when: inventory_hostname == groups['servers'][0]
AnisiblePlaybooks/Playbooks/RKE2/roles/rke2-prepare/templates/rke2-agent.service.j2
+13
View File
@@ -0,0 +1,13 @@
# rke2-agent.service.j2
[Unit]
Description=RKE2 Agent
After=network.target
[Service]
ExecStart=/usr/local/bin/rke2 agent
KillMode=process
Restart=on-failure
RestartSec=5s
[Install]
WantedBy=multi-user.target
AnisiblePlaybooks/Playbooks/RKE2/roles/rke2-prepare/templates/rke2-server-config.j2
+10
View File
@@ -0,0 +1,10 @@
write-kubeconfig-mode: "0644"
tls-san:
- {{ vip }}
- {{ hostvars['server1']['ansible_host'] }}
- {{ hostvars['server2']['ansible_host'] }}
- {{ hostvars['server3']['ansible_host'] }}
node-label:
- server=true
disable:
- rke2-ingress-nginx
AnisiblePlaybooks/Playbooks/RKE2/roles/rke2-prepare/templates/rke2-server.service.j2
+13
View File
@@ -0,0 +1,13 @@
# rke2-server.service.j2
[Unit]
Description=RKE2 server
After=network.target
[Service]
ExecStart=/usr/local/bin/rke2 server
KillMode=process
Restart=on-failure
RestartSec=5s
[Install]
WantedBy=multi-user.target
AnisiblePlaybooks/Playbooks/RKE2/roles/rke2-prepare/vars/main.yaml
View File
AnisiblePlaybooks/Playbooks/RKE2/site.yaml
+61
View File
@@ -0,0 +1,61 @@
# Hello, thanks for using my playbook, hopefully you can help to improve it.
# Things that need adding: (there are many more)
# 1) Support different OS & architectures
# 2) Support multiple CNIs
# 3) Improve the wait logic
# 4) Use kubernetes Ansible plugins more sensibly
# 5) Optimise flow logic
# 6) Clean up
###############################################################
# MAKE SURE YOU CHANGE group_vars/all.yaml VARIABLES!!!!!!!!!!!
###############################################################
# bootstraps first server and copies configs for others/agents
- name: Prepare all nodes
hosts: servers,agents
gather_facts: true # enables us to gather lots of useful variables: https://docs.ansible.com/ansible/latest/collections/ansible/builtin/setup_module.html
roles:
- prepare-nodes
# creates directories for download and then downloads RKE2 and changes permissions
- name: Download RKE2
hosts: servers,agents
gather_facts: true
roles:
- rke2-download
# Creates RKE2 bootstrap manifests folder and copies kube-vip template over (configured with variables)
- name: Deploy Kube VIP
hosts: servers
gather_facts: true
roles:
- kube-vip
# bootstraps the first server, copies configs to nodes, saves token to use later
- name: Prepare RKE2 on Servers and Agents
hosts: servers,agents
gather_facts: true
roles:
- rke2-prepare
# Adds additional servers using the token from the previous task
- name: Add additional RKE2 Servers
hosts: servers
gather_facts: true
roles:
- add-server
# Adds agents to the cluster
- name: Add additional RKE2 Agents
hosts: agents
gather_facts: true
roles:
- add-agent
# Finish kube-vip, add metallb
- name: Apply manifests after cluster is created
hosts: servers
gather_facts: true
roles:
- apply-manifests
AnisiblePlaybooks/Playbooks/Secrets-Variables/File-Copy-Playbook.yaml
+67
View File
@@ -0,0 +1,67 @@
---
- name: Deploy Docker Container with Docker Compose
hosts: all
become: true
tasks:
- name: Include variables file
ansible.builtin.include_vars: myvars.yaml
- name: Ensure Docker is installed
ansible.builtin.package:
name: docker
state: present
- name: Ensure Docker service is running
ansible.builtin.service:
name: docker
state: started
enabled: true
- name: Create a directory for Docker Compose files
ansible.builtin.file:
path: /home/ubuntu/ansible-docker/docker-compose
state: directory
mode: '0755' # Optional file permissions
owner: ubuntu # Optional ownership
group: ubuntu # Optional group ownership
- name: Create a directory for Nginx website files
ansible.builtin.file:
path: /home/ubuntu/docker/nginx/web
state: directory
mode: '0755' # Optional file permissions
owner: ubuntu # Optional ownership
group: ubuntu # Optional group ownership
- name: Copy docker-compose to remote host
ansible.builtin.copy:
src: /home/ubuntu/nginx/docker-compose.yaml
dest: /home/ubuntu/ansible-docker/docker-compose/docker-compose.yaml
mode: '0755' # Optional file permissions
owner: ubuntu # Optional ownership
group: ubuntu # Optional group ownership
- name: Copy Nginx website folder to remote host # copies a folder - note no file extension
ansible.builtin.copy:
src: /home/ubuntu/nginx/website
dest: /home/ubuntu/docker/nginx/web
mode: '0755' # Optional file permissions
owner: ubuntu # Optional ownership
group: ubuntu # Optional group ownership
- name: Replace old name with new name (requires Ansible >= 2.4)
ansible.builtin.replace:
path: /home/ubuntu/docker/nginx/web/website/index.html
regexp: "Jim's Garage"
replace: "{{ website_name }}"
- name: Access and print secret
ansible.builtin.replace:
path: /home/ubuntu/docker/nginx/web/website/index.html
regexp: "Our Features"
replace: "{{ api_key }}"
- name: Start Docker Compose
community.docker.docker_compose:
project_src: /home/ubuntu/ansible-docker/docker-compose
state: present
AnisiblePlaybooks/Playbooks/Secrets-Variables/password
+1
View File
@@ -0,0 +1 @@
password
AnisiblePlaybooks/Playbooks/Secrets-Variables/secrets_file.enc
+1
View File
@@ -0,0 +1 @@
api_key: SuperSecretPassword
AnisiblePlaybooks/Playbooks/Update/full-update-upgrade.yml
+42
View File
@@ -0,0 +1,42 @@
---
- name: Update, Upgrade, Autoremove, and Autoclean
hosts: all
become: true
tasks:
- name: Update package index
apt:
update_cache: yes
- name: Upgrade packages
apt:
upgrade: yes
- name: Perform a distro upgrade
ansible.builtin.apt:
upgrade: dist
update_cache: yes
- name: Remove dependencies that are no longer needed
ansible.builtin.apt:
autoremove: yes
purge: true
- name: Update all packages to their latest version
ansible.builtin.apt:
name: "*"
state: latest
- name: Run the equivalent of "apt-get clean" as a separate step
ansible.builtin.apt:
clean: yes
- name: Check if a reboot is required
ansible.builtin.stat:
path: /var/run/reboot-required
get_checksum: no
register: reboot_required_file
- name: Reboot the server (if necessary)
ansible.builtin.reboot:
when: reboot_required_file.stat.exists == true
AnisiblePlaybooks/Playbooks/fail2ban/config-f2b-protect-sshd.yaml
+25
View File
@@ -0,0 +1,25 @@
---
- name: Install fail2ban and configure sshd
hosts: "{{ my_hosts | d([]) }}"
become: true
tasks:
- name: Install fail2ban
ansible.builtin.apt:
name:
- fail2ban
update_cache: true
- name: Copy fail2ban config file
ansible.builtin.copy:
src: configfiles/debian-sshd-default.conf
dest: /etc/fail2ban/jail.d/debian-sshd-default.conf
mode: '0644'
owner: root
group: root
- name: Restart fail2ban
ansible.builtin.systemd_service:
state: restarted
daemon_reload: true
name: fail2ban
AnisiblePlaybooks/Playbooks/fail2ban/configfiles/debian-sshd-default.conf
+3
View File
@@ -0,0 +1,3 @@
[sshd]
enabled = true
bantime = 3600
AnisiblePlaybooks/Playbooks/installation/inst-core.yaml
+12
View File
@@ -0,0 +1,12 @@
---
- name: Install core packages
hosts: "{{ my_hosts | d([]) }}"
become: true
tasks:
- name: Install core packages
ansible.builtin.apt:
name:
- prometheus-node-exporter
- nfs-common
update_cache: true
AnisiblePlaybooks/Playbooks/installation/inst-zsh.yaml
+12
View File
@@ -0,0 +1,12 @@
---
- name: Install zsh
hosts: "{{ my_hosts | d([]) }}"
become: true
tasks:
- name: Install zsh
ansible.builtin.apt:
name: zsh
state: present
update_cache: true
become: true
AnisiblePlaybooks/Playbooks/inventory-proxmox.ini
+2
View File
@@ -0,0 +1,2 @@
192.168.2.1
192.168.2.2
AnisiblePlaybooks/Playbooks/inventory.ini
+14
View File
@@ -0,0 +1,14 @@
# 192.168.2.5 - This is the AWS server
192.168.2.6
192.168.2.7
192.168.2.9
192.168.2.10
192.168.2.11
192.168.2.12
192.168.2.13
192.168.2.16
192.168.2.19
192.168.2.21
192.168.2.22
216.144.227.142
129.213.86.62
AnisiblePlaybooks/Playbooks/inventory.yaml
+81
View File
@@ -0,0 +1,81 @@
---
Homelab:
hosts:
awx:
ansible_host: 192.168.2.5
ansible_user: 'miker'
ansible_become: true
ansible_become_method: sudo
mygitea:
ansible_host: 192.168.2.6
ansible_user: 'miker'
ansible_become: true
ansible_become_method: sudo
dockerapps:
ansible_host: 192.168.2.7
ansible_user: 'miker'
ansible_become: true
ansible_become_method: sudo
techdns:
ansible_host: 192.168.2.9
ansible_user: 'miker'
ansible_become: true
ansible_become_method: sudo
wireguard:
ansible_host: 192.168.2.10
ansible_user: 'miker'
ansible_become: true
ansible_become_method: sudo
semaphore:
ansible_host: 192.168.2.11
ansible_user: 'miker'
ansible_become: true
ansible_become_method: sudo
linwarden:
ansible_host: 192.168.2.12
ansible_user: 'miker'
ansible_become: true
ansible_become_method: sudo
immich:
ansible_host: 192.168.2.13
ansible_user: 'miker'
ansible_become: true
ansible_become_method: sudo
media:
ansible_host: 192.168.2.16
ansible_user: 'miker'
ansible_become: true
ansible_become_method: sudo
vault:
ansible_host: 192.168.2.19
ansible_user: 'miker'
ansible_become: true
ansible_become_method: sudo
npm:
ansible_host: 192.168.2.22
ansible_user: 'miker'
ansible_become: true
ansible_become_method: sudo
rackserver2:
ansible_host: 216.144.227.142
ansible_user: 'miker'
ansible_become: true
ansible_become_method: sudo
oracle:
ansible_host: 129.213.86.62
ansible_user: 'miker'
ansible_become: true
ansible_become_method: sudo
AnisiblePlaybooks/Playbooks/laptop/desktopapps.yaml
+19
View File
@@ -0,0 +1,19 @@
- name: Install desktop applications
hosts: "ip.address for desktop"
become: true
tasks:
- name: Install Desktop Applications
ansible.builtin.apt:
name:
- curl
- wireguard-tools
- wireguard
- qbittorrent
- terminator
- filezilla
- git-all
- codium
- stacer
- tor
update_cache: true

Some files were not shown because too many files have changed in this diff Show More