Merge pull request 'Testing' (#2) from testing into main

Reviewed-on: max/ansible_home#2
2026-07-24 12:26:11 +00:00
parent 7748235e2b 6d352d59be
commit ba366a55a2
30 changed files with 714 additions and 81 deletions
@@ -1,3 +1,6 @@
 # ---> Ansible
 *.retry
-inventory/group_vars/secret/
+inventory/group_vars/secret/
 # Ignore python venv
 .venv
@@ -1,3 +1,3 @@
 ---
-ansible_become_passwd: "{{ ansible_password }}"
+ansible_become_passwd: "{{ ansible_password }}"
@@ -4,4 +4,12 @@ ansible_become_password: p@a$$word
 # SSH key for Ansible user
 ansible_ssh_key: $$h_key
 # Password for the default unprivileged user
-user_password: p@a$$word
+user_password: p@a$$word
 # ntfy topic
 ntfy_topic: https://x.y.z/topic
 # ntfy topic token
 ntfy_topic_token: t0ken
 # Home Assistant Webhook token
 ha_webhook_token: h@_t0ken
 # Proxmox API token secret
 proxmox_token_secret: t0ken_$ecret
@@ -1,21 +1,35 @@
 $ANSIBLE_VAULT;1.1;AES256
-37386438323934313261326132383539643062353335333661326131643032316239326161373930
+37396233623362356239383039306566316433613761383032386566643964326638663830343837
-3264633766303937353938343565326562626535343830370a303632386666613033323132616561
+3031613035666339666634393439386463373734336130320a646331343036626234316131313265
-33353565616333346663396535613738343439323535663932633134663139623032353764633333
+36666134646236333162316237326362333430616235633130633364666261343133306637623165
-6533366164393164300a303963343863323133303565323635313030396532336237313837633231
+6565633434353035390a323665636234616230373430663030666564363434623930656264343231
-35653733306565386665333739323433646238343961396234666232666238363264333639346265
+39623465326661393832633661393437396535363434646261323737303163623230366161366163
-31323037356665366138663365653666623066393661353035636239656136323466633461323765
+35373561636233313764366631373261316635386463353464306437323461613033313836383238
-34323836623766643562363035313465343863633534646466376437633761373665636233646532
+36316133343737373666386534663939636234363831633738383738386433663533306465333230
-39616362353930376464626136336133333639636638623138313065383934666237383738396334
+64633161396538316535346333343937306431386364363736656131613939336438663364323262
-34323930306536663131333639373764393135653161663431373563323837313964333736643238
+34636633366464306231373739343764333935623434633331316463323961363364393865383732
-61353861656431396366616534633935636332323665336536353337646133653333663436623633
+31393834626561643235393035666263646334613837666436333632393665346638623965346461
-34616333393666356632656238333935636562366237393162653864306462316231376666653932
+35343966633631386330653834623234626537353739323938323339663836616139633832303465
-32373336373231306134343337373736656638343439373564343464653030623034333734656462
+66356564636233663230633732333363343732396264653339396562353734643561643536616237
-63633634396631333233323939663763313163373863326634306663656638373239306634643337
+34366536623535313533623634653632316538326137363034653030346337646264653765316662
-32343262393761643237653538376163633066376538616537653139376637663339646234383535
+30613430636433303661353266666635333362613964383337643130316563633438653631373665
-62396663396161396130303135396330303530333533363533366330303831326661653138333336
+37393465343561333966303137373636613937383261616365613463393263303863333134653630
-37386436373337613064343138373433393435653066303364326461303565336539396362373135
+66386165303135343662346335653537366230316332666439326639613063383931313839376237
-31663538383030326566303166353934626639653432356562613938646364666337383835353234
+64626362386666613362616666373565336666623837323064386262393135343834323161366163
-62383838346339653766393233383563356363383039303862393564353464343534373666376434
+63393765653964633861663765343735626462303064383063643563393332653738343633313466
-33323136613337366566393535633730643064353664393436363830333561643265623163386165
+61613264303139623530393765636162373136363837626134653930376230343463623433643063
-62323337363238643166
+62393337623566616431306632333337616263633031613437643334363162623331653535396233
 63323939633563373137346537363834306261613738333636303762353639366136373734346632
 39333135616335343561626133386539333833366339613463626637326337333430376430393538
 33373234353064326435376432383139623561646361303063386531373164353335323265616566
 61643765313264626232366161313232323437306333316161663433643534363063393864666563
 35353966396164633534386663616233383236663466356465306361613039353366343630343063
 61643131343731366237313666626366656639663136393834376531323136653064383533383436
 31313038303766633339323465316236356536623362656432346233306434643236373831613339
 65663031326630303665306265623937623965633333363736373237333732306566386138396633
 36386461633762326466383436623263303935643133383365333664663665396134383730373030
 62663264363438336638663161366637663232383032633762373232396366633631666265323934
 62366536336435306539393662623962656335356439376466396539653263653033313964363364
 30303238646338396663323262653562353332346136323862616165663066373163313132396633
 31346438616130396332613736613635306530626663623634636434643137343262663635613061
 3762346665393865336666386163616430633731326237623733
@@ -1,5 +1,5 @@
 ---
 physical:
  hosts:
-    192.168.0.5:
+    192.168.0.45:
-      ansible_become_password: "{{ ansible_become_passwd }}"
+      ansible_become_password: "{{ ansible_become_passwd }}"
@@ -1,17 +1,17 @@
 ---
 - name: Deplot simple test LXC on Proxmox VE
  hosts: localhost
  gather_facts: false
  roles:
    - ../roles/basic_proxmox_lxc
 - name: Basic Proxmox guest deployment
  hosts: all
  remote_user: root
  roles:
-    - ../roles/0_basic_postinstall
+    - ../roles/basic_postinstall
  vars_files:
    ../inventory/group_vars/all/secrets.yaml
  vars:
    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
-    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
+    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
  handlers:
    - name: restart sshd
      service:
        name: sshd
        state: restarted
@@ -0,0 +1,28 @@
 ---
 - name: Deploy a virtual machine from a cloud init image
  hosts: localhost
  gather_facts: false
  roles:
    - ../roles/basic_proxmox_vm
 - name: Basic Proxmox guest deployment
  hosts: all
  remote_user: ansible
  roles:
    - ../roles/basic_postinstall
  vars_files:
    ../inventory/group_vars/all/secrets.yaml
  vars:
    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
  handlers:
    - name: restart ssh-server
      service:
        name: ssh
        state: restarted
    - name: restart sshd-server
      service:
        name: sshd
        state: restarted
@@ -0,0 +1,12 @@
 ---
 - name: Physical machines maintanance play
  hosts: all
  remote_user: ansible
  roles:
    - ../roles/common_healthcheck
  vars_files:
    ../inventory/group_vars/all/secrets.yaml
  vars:
    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
    ha_addr: https://ha.lan
@@ -0,0 +1,30 @@
 ansible-compat==26.6.0
 ansible-core==2.21.1
 ansible-lint==26.6.0
 attrs==26.1.0
 black==26.5.1
 bracex==3.0
 cffi==2.1.0
 click==8.4.2
 cryptography==49.0.0
 distro==1.9.0
 filelock==3.29.7
 Jinja2==3.1.6
 jsonschema==4.26.0
 jsonschema-specifications==2025.9.1
 MarkupSafe==3.0.3
 mypy_extensions==1.1.0
 packaging==26.2
 pathspec==1.1.1
 platformdirs==4.10.0
 pycparser==3.0
 pytokens==0.4.1
 PyYAML==6.0.3
 referencing==0.37.0
 resolvelib==1.2.1
 rpds-py==2026.6.3
 ruamel.yaml==0.19.1
 ruamel.yaml.clib==0.2.15
 subprocess-tee==0.4.2
 wcmatch==11.0
 yamllint==1.38.0
@@ -1,15 +0,0 @@
 ---
 - name: Configure ssh-server daemon
  copy:
    src: ../files/hardened_sshd.conf
    dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
    mode: u=rw,g=r,o=r
  notify: restart sshd
 - name: Configure ssh client
  copy:
    src: ../files/hardened_ssh.conf
    dest: /etc/ssh/ssh_config.d/hardened_ssh.conf
    mode: u=rw,g=r,o=r
@@ -1,6 +0,0 @@
 ---
 - name: Create and set up Ansible user and environment
  ansible.builtin.include_tasks: prepare_ansible_user.yaml
 - name: Improve SSH configuration
  ansible.builtin.include_tasks: harden_ssh.yaml
@@ -0,0 +1,16 @@
 set number
 set tabstop=2
 " Disable compatibility with vi which can cause unexpected issues.
 set nocompatible
 " Enable type file detection. Vim will be able to try to detect the type of file in use.
 filetype on
 " Enable plugins and load plugin for the detected file type.
 filetype plugin on
 " Load an indent file for the detected file type.
 filetype indent on
 " Turn syntax highlighting on.
 syntax on
@@ -0,0 +1,105 @@
 export PATH=$HOME/bin:$HOME/.local/bin:/usr/local/bin:/home/max/soft/gnu_linux:$PATH
 # Path to your Oh My Zsh installation.
 export ZSH="$HOME/.oh-my-zsh"
 export GTK_THEME=Adwaita-dark
 # Set name of the theme to load --- if set to "random", it will
 # load a random theme each time Oh My Zsh is loaded, in which case,
 # to know which specific one was loaded, run: echo $RANDOM_THEME
 # See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
 ZSH_THEME="gnzh"
 # Set list of themes to pick from when loading at random
 # Setting this variable when ZSH_THEME=random will cause zsh to load
 # a theme from this variable instead of looking in $ZSH/themes/
 # If set to an empty array, this variable will have no effect.
 # ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" )
 # Uncomment the following line to use case-sensitive completion.
 # CASE_SENSITIVE="true"
 # Uncomment the following line to use hyphen-insensitive completion.
 # Case-sensitive completion must be off. _ and - will be interchangeable.
 # HYPHEN_INSENSITIVE="true"
 # Uncomment one of the following lines to change the auto-update behavior
 # zstyle ':omz:update' mode disabled  # disable automatic updates
 # zstyle ':omz:update' mode auto      # update automatically without asking
 # zstyle ':omz:update' mode reminder  # just remind me to update when it's time
 # Uncomment the following line to change how often to auto-update (in days).
 # zstyle ':omz:update' frequency 13
 # Uncomment the following line if pasting URLs and other text is messed up.
 # DISABLE_MAGIC_FUNCTIONS="true"
 # Uncomment the following line to disable colors in ls.
 # DISABLE_LS_COLORS="true"
 # Uncomment the following line to disable auto-setting terminal title.
 # DISABLE_AUTO_TITLE="true"
 # Uncomment the following line to enable command auto-correction.
 # ENABLE_CORRECTION="true"
 # Uncomment the following line to display red dots whilst waiting for completion.
 # You can also set it to another string to have that shown instead of the default red dots.
 # e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f"
 # Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765)
 # COMPLETION_WAITING_DOTS="true"
 # Uncomment the following line if you want to disable marking untracked files
 # under VCS as dirty. This makes repository status check for large repositories
 # much, much faster.
 # DISABLE_UNTRACKED_FILES_DIRTY="true"
 # Uncomment the following line if you want to change the command execution time
 # stamp shown in the history command output.
 # You can set one of the optional three formats:
 # "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd"
 # or set a custom format using the strftime function format specifications,
 # see 'man strftime' for details.
 # HIST_STAMPS="mm/dd/yyyy"
 # Would you like to use another custom folder than $ZSH/custom?
 # ZSH_CUSTOM=/path/to/new-custom-folder
 # Which plugins would you like to load?
 # Standard plugins can be found in $ZSH/plugins/
 # Custom plugins may be added to $ZSH_CUSTOM/plugins/
 # Example format: plugins=(rails git textmate ruby lighthouse)
 # Add wisely, as too many plugins slow down shell startup.
 #plugins=(git)
 source $ZSH/oh-my-zsh.sh
 # User configuration
 # export MANPATH="/usr/local/man:$MANPATH"
 # You may need to manually set your language environment
 # export LANG=en_US.UTF-8
 # Preferred editor for local and remote sessions
 # if [[ -n $SSH_CONNECTION ]]; then
 #   export EDITOR='vim'
 # else
 #   export EDITOR='nvim'
 # fi
 # Compilation flags
 # export ARCHFLAGS="-arch $(uname -m)"
 # Set personal aliases, overriding those provided by Oh My Zsh libs,
 # plugins, and themes. Aliases can be placed here, though Oh My Zsh
 # users are encouraged to define aliases within a top-level file in
 # the $ZSH_CUSTOM folder, with .zsh extension. Examples:
 # - $ZSH_CUSTOM/aliases.zsh
 # - $ZSH_CUSTOM/macos.zsh
 # For a full list of active aliases, run `alias`.
 #
 # Example aliases
 # alias zshconfig="mate ~/.zshrc"
 # alias ohmyzsh="mate ~/.oh-my-zsh"
@@ -1,23 +1,29 @@
-# Disable root login entirely
+PubkeyAuthentication yes
-PermitRootLogin no
+AuthorizedKeysFile	.ssh/authorized_keys
-
+PasswordAuthentication no
 KbdInteractiveAuthentication no
 UsePAM no
 # Disable password authentication — keys only
 PasswordAuthentication no
 ChallengeResponseAuthentication no
-UsePAM no
+
 AllowGroups sshusers
 PrintMotd no
 AcceptEnv LANG LC_*
 ClientAliveCountMax 0
 ClientAliveInterval 300
 Port 22
 # Disable root login entirely
 PermitRootLogin no
 # Limit authentication attempts
 MaxAuthTries 3
-MaxSessions 2
+MaxSessions 3
 # Allow only your specific user
 AllowUsers deploy
 # Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup)
 KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
-MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
 # Connection timeout
 ClientAliveInterval 300
 ClientAliveCountMax 2
@@ -0,0 +1,15 @@
 #!/bin/sh
 FILE=/home/$USER/.oh-my-zsh/oh-my-zsh.sh
 if [ -f "$FILE" ]; then
    echo "$FILE exists and we not installing ohmyzsh"
    exit 0
 else 
    echo "$FILE does not exist and we install ohmyzsh"
 		cd /home/max
    wget https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh
 		chmod +x /home/max/install.sh
 		timeout -s 15 -k 30s 20s /home/max/install.sh --unattendend --keep-zshrc || exit 0
    exit 0
 fi
@@ -0,0 +1,66 @@
 ---
 - name: Create a new user with a password, set shell
  remote_user: ansible
  ansible.builtin.user:
    name: max
    groups: sshusers,sudo
    password: "{{ user_passwd_hash }}"
    shell: /bin/zsh
 - name: Set authorized key taken from file
  remote_user: ansible
  ansible.posix.authorized_key:
    user: max
    state: present
    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
 - name: Copy omz installation wrapper script to the target machine
  remote_user: ansible
  ansible.builtin.copy:
    src: "{{ role_path }}/files/install_omz.sh"
    dest: /home/max/install_omz.sh
    owner: max
    group: max
    mode: u=rwx,g=r,o-rwx
 # WARNING: UNPRIVILEGED USER (not ansible) COMMANDS
 - name: Install oh my zsh
  remote_user: max
  become: false
  ansible.builtin.command: /home/max/install_omz.sh
  changed_when: true
 - name: Configure oh my zsh, by pushing the config file
  remote_user: ansible
  ansible.builtin.copy:
    src: "{{ role_path }}/files/.zshrc"
    dest: /home/max/.zshrc
    owner: max
    group: max
    mode: u=rw,g=r,o-rwx
 - name: Configure vim, by pushing the config
  remote_user: ansible
  ansible.builtin.copy:
    src: "{{ role_path }}/files/.vimrc"
    dest: /home/max/.vimrc
    owner: max
    group: max
    mode: u=rw,g=r,o-rwx
 # WARNING: we've finished with the initial setup, drop ansible key
 # Push regular user key
 - name: Set authorized key taken from file
  remote_user: ansible
  ansible.posix.authorized_key:
    user: max
    state: absent
    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
 - name: Set authorized key taken from file
  remote_user: ansible
  ansible.posix.authorized_key:
    user: max
    state: present
    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/max_regular_key.pub') }}"
@@ -0,0 +1,36 @@
 ---
 - name: Configure ssh-server daemon
  ansible.builtin.copy:
    src: "{{ role_path }}/files/hardened_sshd.conf"
    dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
    mode: u=rw,g=r,o=r
  when: ansible_facts['distribution'] == 'Ubuntu'
 - name: Configure ssh-server daemon
  ansible.builtin.copy:
    src: "{{ role_path }}/files/hardened_sshd.conf"
    dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
    mode: u=rw,g=r,o=r
  when: ansible_facts['distribution'] == 'Debian'
 - name: Configure ssh client
  remote_user: ansible
  ansible.builtin.copy:
    src: "{{ role_path }}/files/hardened_ssh.conf"
    dest: /etc/ssh/ssh_config.d/hardened_ssh.conf
    mode: u=rw,g=r,o=r
 - name: Restart ssh-server Debian
  remote_user: ansible
  ansible.builtin.service:
    name: sshd
    state: restarted
  when: ansible_facts['distribution'] == 'Debian'
 - name: Restart ssh-server Ubuntu
  remote_user: ansible
  ansible.builtin.service:
    name: ssh
    state: restarted
  when: ansible_facts['distribution'] == 'Ubuntu'
@@ -0,0 +1,42 @@
 ---
 - name: Installing basic utils for comfort work (apt-based system)
  when: (ansible_facts['distribution'] == "Debian") or
        (ansible_facts['distribution'] == "Ubuntu")
  ansible.builtin.apt:
    name:
      - vim
      - ranger
      - zsh
      - rsync
      - git
      - curl
      - kitty
      - unattended-upgrades
      - ssh
      - openssh-server
    update-cache: true # Run apt update before installation
  become: true
  remote_user: ansible
 - name: Install qemu-guest-agent on VM
  when:
    - ansible_facts['os_family'] == "Debian"
    - ansible_facts['virtualization_type'] == "kvm"
  ansible.builtin.apt:
    name: qemu-guest-agent
    state: present
    update-cache: true # Run apt update before installation
  become: true
  remote_user: ansible
  tags:
    - kvm-guests
    - packages
 # The same commands for Alpine
 - name: Update and install packages on Alpine
  when: (ansible_facts['distribution'] == "Alpine")
  community.general.apk:
    name: vim ranger zsh rsync git curl kitty openssh
    update_cache: true
  remote_user: ansible
@@ -0,0 +1,18 @@
 ---
 - name: Create and set up Ansible user and environment
  ansible.builtin.include_tasks: prepare_ansible_user.yaml
 - name: Improve SSH configuration
  ansible.builtin.include_tasks: harden_ssh.yaml
 - name: Install basic utils
  ansible.builtin.include_tasks: install_basic_utils.yaml
 - name: Remove unnecessary packages
  ansible.builtin.include_tasks: remove_packages.yaml
 - name: Create and set up a new user
  ansible.builtin.include_tasks: create_new_user.yaml
 - name: Set locale and time
  ansible.builtin.include_tasks: set_locale_and_time.yaml
@@ -1,20 +1,20 @@
 ---
 ## Installing packages
 - name: Install sudo on apt systems
-  when: (ansible_facts['distribution'] == "Debian") or 
+  when: (ansible_facts['distribution'] == "Debian") or
        (ansible_facts['distribution'] == "Ubuntu")
-  apt:
+  ansible.builtin.apt:
    name:
      - sudo
-    update-cache: yes
+    update-cache: true
- name: Update Alpine packages
+# The same commands for Alpine
 - name: Update and install packages on Alpine
  when: (ansible_facts['distribution'] == "Alpine")
-  command: /sbin/apk update
+  community.general.apk:
-
+    name: sudo
- name: Install sudo package on Alpine
+    update_cache: true
-  when: (ansible_facts['distribution'] == "Alpine")
+  remote_user: ansible
  command: /sbin/apk add sudo
 ## Creating and setting up the ansible user
@@ -26,16 +26,16 @@
 ## Add the user to sshusers (for ssh access) and sudo (gain root access)
 - name: Create a new user with a password for Ansible
-  user: 
+  ansible.builtin.user:
    name: ansible
    password: "{{ ansible_user_passwd_hash }}"
    groups: sshusers,sudo
-    append: yes
+    append: true
-## Since password authentication in SSH will be disabled, we need to add an authorized key 
+## Since password authentication in SSH will be disabled, we need to add an authorized key
 - name: Set authorized key taken from file
  ansible.posix.authorized_key:
    user: ansible
    state: present
-    key: "{{ ansible_ssh_key }}"
+    key: "{{ ansible_ssh_key }}"
@@ -0,0 +1,31 @@
 ---
 # Remove multiple packages at once
 - name: Remove unnecessary packages
  remote_user: ansible
  when: (ansible_facts['distribution'] == "Debian") or
        (ansible_facts['distribution'] == "Ubuntu")
  ansible.builtin.apt:
    name:
      - nano
    state: absent
  become: true
 # Clean up all orphaned packages
 - name: Remove all orphaned dependencies
  remote_user: ansible
  when: (ansible_facts['distribution'] == "Debian") or
        (ansible_facts['distribution'] == "Ubuntu")
  ansible.builtin.apt:
    autoremove: true
    purge: true
 - name: Install sudo package on Alpine
  remote_user: ansible
  when: (ansible_facts['distribution'] == "Alpine")
  community.general.apk:
    name:
      - nano
    state: absent
  become: true
@@ -0,0 +1,19 @@
 ---
 - name: Generate locales
  community.general.locale_gen:
    name:
      - en_US.UTF-8
      - ru_RU.UTF-8
    state: present
 - name: Set locale
  ansible.builtin.copy:
    dest: /etc/locale.conf
    mode: '0644'
    content: |
      LANG=en_US.UTF-8
      LC_ALL=en_US.UTF-8
 - name: Set time
  community.general.timezone:
    name: Europe/Samara
@@ -0,0 +1,47 @@
 ---
 - name: Create new container with minimal options defining network interface with static ip
  become: false
  community.proxmox.proxmox:
    validate_certs: false
    node: proxmox-server
    api_user: root@pam
    api_host: 192.168.0.2
    api_token_id: ansible
    api_token_secret: "{{ proxmox_token_secret }}"
    cmode: "shell"
    vmid: 1040
    password: ansible-test
    hostname: "ansible-test"
    # ostemplate: 'main:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst'
    ostemplate: 'main:vztmpl/debian-13-golden-image.tar.gz'
    memory: 2048
    cores: 5
    state: present
    disk_volume:
      size: 2 # 2GB rootfs
      storage: local
    pubkey: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
    netif:
      net0: "name=eth0,gw=192.168.0.1,ip=192.168.0.40/24,bridge=vmbr0"
 - name: Make sure the container has started
  become: false
  community.proxmox.proxmox:
    validate_certs: false
    node: proxmox-server
    api_user: root@pam
    api_host: 192.168.0.2
    api_token_id: ansible
    api_token_secret: "{{ proxmox_token_secret }}"
    vmid: 1040
    state: started
 - name: Sleep for a minute to ensure that ssh is ready
  become: false
  ansible.builtin.wait_for:
    timeout: 60
  delegate_to: localhost
  changed_when: false
@@ -0,0 +1,53 @@
 ---
 - name: Create a new VM with minimal options
  become: false
  community.proxmox.proxmox_kvm:
    validate_certs: false
    node: proxmox-server
    api_user: root@pam
    api_host: 192.168.0.2
    api_token_id: ansible
    api_token_secret: "{{ proxmox_token_secret }}"
    clone: debian-13-cloud-init-template
    newid: 1041
    name: ansible-ci-test
    storage: main
    format: qcow2
    full: true
    timeout: 500
 - name: Tweak the hardware settings
  become: false
  community.proxmox.proxmox_kvm:
    validate_certs: false
    node: proxmox-server
    api_user: root@pam
    api_host: 192.168.0.2
    api_token_id: ansible
    api_token_secret: "{{ proxmox_token_secret }}"
    vmid: 1041
    cores: 4
    memory: 4096 # Minimal value for debian based OS for smooth workflow
    update: true
 - name: Make sure the VM has started
  become: false
  community.proxmox.proxmox_kvm:
    validate_certs: false
    node: proxmox-server
    api_user: root@pam
    api_host: 192.168.0.2
    api_token_id: ansible
    api_token_secret: "{{ proxmox_token_secret }}"
    vmid: 1041
    state: started
 - name: Sleep for 3 minutes to ensure that cloud-init's done its thing
  become: false
  ansible.builtin.wait_for:
    timeout: 180
  delegate_to: localhost
  changed_when: false
@@ -0,0 +1,31 @@
 -----BEGIN CERTIFICATE-----
 MIIFRTCCAy2gAwIBAgIUEYfbZs1nFB1sEyTb/W2AcKn9whwwDQYJKoZIhvcNAQEL
 BQAwMTEQMA4GA1UEAwwHaG9tZS5jYTELMAkGA1UEBhMCUlUxEDAOBgNVBAcMB25v
 d2hlcmUwIBcNMjYwMjAzMTg0NTA3WhgPMjA1MzA2MjAxODQ1MDdaMDExEDAOBgNV
 BAMMB2hvbWUuY2ExCzAJBgNVBAYTAlJVMRAwDgYDVQQHDAdub3doZXJlMIICIjAN
 BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAhZJPmln1+iZ5b35U1KBPxGdfd2ra
 V55vzjBA+9EeVJ7SgHqwvE6T7uXc/ZOpum/TiGAeU1bBtqilCwxXLLiL4Mkn6p1m
 /ePosqE4lb7vMaZmAwxTcjmvekqnrcme+V1DSY5PtQljp+YBn/npOCHWe3WHNppc
 3dUW6Y06hWk26C5xq4xdcIbs5LohMcJmMYI1kcaJPtys7RyW13Wy5dH8wF4Efdco
 J4CU0yWBhF0Ys56YPbkWu1u2DqrFRiJr53LfJ90P88R4sSeBtLZVvEzWj+kWZEfJ
 Oke7B1jXVJ40yBJ+brGQoFsD9o2x9JyNXHOUVcx1XH3a+NUFVKMJRCYPa5uaxq9h
 B2gCBD4rBlOADchwSdNk1oGmtDg8xs3fcLxUqsO2jVA2T7w9iP4arvzqHuIWwVss
 WdtcyQ/x8tjVC6cp8I8WH5CV8iWptH9exGnKbVjAWEkL6xbT7f09WDAheaXY1b59
 Opuw9KAGIvqj4NCPpdd7zwDivNFJWYfz7SkEiM9I6NMDP9BoYBVMIyxJR83NOgl0
 0gUPoEFT81k5w8k4S7kqa7YdMj3PLxGowIQb9xoQuXyAFtPhbXbHn/igKx62H/Lq
 IOBvm55+GOaSnWAlVoze6rE+qCRWr6fS4bTcGEDb8INHPriwxX+YehqxLdqcGRLG
 n8fd6ldOvS/BfXkCAwEAAaNTMFEwHQYDVR0OBBYEFBehubXS/4xlJz1AA6iVi2HA
 HPfFMB8GA1UdIwQYMBaAFBehubXS/4xlJz1AA6iVi2HAHPfFMA8GA1UdEwEB/wQF
 MAMBAf8wDQYJKoZIhvcNAQELBQADggIBACH/M9xbPuKmluznwtwofLod+4w5nTtU
 bFpGmqSRNRjnL4j0aL+Gr/lcD2tGQXf01dOVdSbBjmBmW1p/2trVdVPxTLTaIhCw
 Q8QuVmQJUkwnG1uv7W9Of9akJ4TadPKc5GfzYJJ+e71Z8sFXxFqfr0nF1fPdpPp8
 xkKsIwZopcjqLEzJydGOcHUbDWvR2fkG01DjgSevP34ZJQBm/bSAwlSs6b1119jw
 ofQD462YLtXfavSz/MzRNNgCZlEAGVNt42CDOES6aZvOIt1pCKo8hIhptKgU4GpQ
 vTE0kdekJWTUNQzbfWSF42FwllxVa4LJYXzmW7Jf30Q5xCZICH1Ofdk3qLK/B7tf
 Fo/bNP3aLU4qBWShmCzYAyW4LPKL6AfODL5X45nESQDoAlfcdfeSXrbdG7P0NAcN
 g4nROb5NNy/CgLNq2zDnq/JKdW3xvvNKT2FsNvOf3+9a99gB/L2dt8nX5SSLiWlN
 50ynzOK21Z/YHCXutLiK2ugQf9dqj2rw7/C9oktoyvqwoVILhcsA0mhpN4343zI4
 PK2/zIjd0nZWaZLpJCj0yREnhhqgV3Par9d5biRfgFUuIoBnXIh4fr75xdkxqECX
 pKu2rt3D0YGkPsP5lausvPbUy4nYcT1UkMwtdi0JZLNx04m22ZTzXpATo96LoWob
 9eRPR6uW/Kmp
 -----END CERTIFICATE-----
@@ -0,0 +1,44 @@
 ---
 - name: Internet connection test block
  block:
    - name: Test reachability to ya.ru
      become: true # Usually it's not necessary, but sometimes there are some wierd issues with ping, especially on Alpine
      ansible.builtin.shell: ping -c 5 ya.ru > /dev/null
      changed_when: false   # This task does not change the system
  rescue:
    # This won't work for now. CA certificate reissuing is required!
    - name: Create a test file
      become: false
      ansible.builtin.uri:
        url: "{{ ha_addr }}/api/webhook/{{ ha_webhook_token }}"
        ca_path: ../files/ca.pem
      delegate_to: 127.0.0.1
      # TODO: REMOVE THIS AFTER REISSUING CA CERTIFICATE!
      failed_when: false
 - name: Disk free space test block
  block:
    - name: Test free disk space in root
      become: false
      ansible.builtin.shell: set -o pipefail && df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}'
      register: common_healthcheck_result
      failed_when: common_healthcheck_result.stdout | int > 85
      changed_when: false   # This task does not change the system
  rescue:
    - name: Notify with ntfy
      become: false
      ansible.builtin.uri:
        url: "{{ ntfy_topic }}"
        method: POST
        body_format: json
        status_code: [200, 202]
        return_content: true
        headers:
          Authorization: "Bearer {{ ntfy_topic_token }}"
        body:
          - "{{ ansible_facts['hostname'] }}: Disk space is low"
      delegate_to: 127.0.0.1
      failed_when: false
      changed_when: false   # This task does not change the system
@@ -1,4 +1,4 @@
 #!/bin/sh
-ansible-playbook -i inventory/hosts.yaml playbooks/deploy.yaml \
+ansible-playbook -i inventory/hosts.yaml $1 \
    --private-key inventory/group_vars/secret/ansible_key \
    --vault-password-file inventory/group_vars/secret/.vault_pass
@@ -0,0 +1,19 @@
 [Unit]
 Description=Run Ansible playbook for daily maintenance
 After=network-online.target
 Wants=network-online.target
 [Service]
 Type=oneshot
 # CAHNGE TO MATCH YOUR REQUIREMENTS
 User=max
 Group=max
 WorkingDirectory=/home/max/projects/ansible_home
 ExecStart=/home/max/projects/ansible_home/run_playbook.sh /home/max/projects/ansible_home/playbooks/maintain.yaml 
 StandardOutput=journal
 StandardError=journal
 # Optional: prevent runaway if the playbook hangs
 TimeoutStopSec=3600
 [Install]
 WantedBy=multi-user.target
@@ -0,0 +1,11 @@
 [Unit]
 Description=Timer for Ansible maintenance playbook, runs every 10 minutes
 Requires=ansible-maintenance.service
 [Timer]
 OnUnitActiveSec=10min
 Persistent=true
 Unit=ansible-maintenance.service
 [Install]
 WantedBy=timers.target
`@@ -1,3 +1,3 @@`
	`---`	`---`

	`ansible_become_passwd: "{{ ansible_password }}"`	`ansible_become_passwd: "{{ ansible_password }}"`