fix (roles): ssh config to be placed in ~/.shh

Reviewed-on: #6

.gitea/workflows/deploy_new_config.yaml

@@ -16,12 +16,6 @@ jobs:
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
     steps:
-      - name: Trigger the webhook to start pulling the latest version from the repo
-        # LAN IP is used because those hosts are in the same network
-        run: curl "http://192.168.0.38:9000/hooks/pull-latest"
-      
-      - name: Trigger the webhook to update python and ansible modules
-        run: curl "http://192.168.0.38:9000/hooks/run-update-script"
-     
       - name: Trigger the webhook to run the playbook
+        # LAN IP is used because those hosts are in the same network
         run: curl "http://192.168.0.38:9000/hooks/run-maintain-playbook"

README.md

@@ -1,3 +1,20 @@
 # ansible_home
 
-My own home services automation repository
+## How to use it?
+
+It's better to use a virtual environment to avoid incompatibility issues
+
+```bash
+git clone https://git.vmn.su/max/vmn-ansible
+cd vmn-ansible
+python3 -m venv .venv
+source .venv/bin/activate
+pip install -r requirements.txt
+ansible-galaxy collection install -r requirements.yaml
+ansible-galaxy role install -r requirements.yaml
+ansible-playbook playbooks/deploy_and_set_up_lxc_on_proxmox.yaml --vault-pass-file $VAULT_PASS_PATH -i inventory/localhost.yaml --private-key $SSH_KEY
+```
+
+**deploy** playbooks must be used with `inventory/localhost.yaml`, they need access to proxmox host only
+
+There are also a systemd service and timer under `systemd` directory

inventory/group_vars/all/main.yaml

@@ -2,3 +2,4 @@
 
 ansible_become_passwd: "{{ ansible_password }}"
 human_admin_user: max
+proxmox_1_host: 192.168.0.2

inventory/hosts.yaml

@@ -1,17 +1,41 @@
 ---
-physical:
+all:
-  hosts:
+  children:
-    localhost:
+    physical:
-      ansible_become_password: "{{ ansible_become_passwd }}"
+      proxmox_1:
-      ansible_connection: local
+        ansible_host: "{{ proxmox_1_host }}"
-      ansible_python_interpreter: "{{ ansible_playbook_python }}"
+        ansible_become_password: "{{ ansible_become_passwd }}"
-    192.168.0.6:
+        services_to_run: []
-      ansible_become_password: "{{ ansible_become_passwd }}"
+    virtual:
-    192.168.0.8:
+      hosts:
-      ansible_become_password: "{{ ansible_become_passwd }}"
+        localhost:
-    192.168.0.12:
+          ansible_become_password: "{{ ansible_become_passwd }}"
-      ansible_become_password: "{{ ansible_become_passwd }}"
+          ansible_connection: local
-    192.168.0.16:
+          ansible_python_interpreter: "{{ ansible_playbook_python }}"
-      ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run:
-    192.168.0.39:
+            - webhook 
-      ansible_become_password: "{{ ansible_become_passwd }}"
+        nfs-server:
+          ansible_host: 192.168.0.6
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        jellyfin:
+          ansible_host: 192.168.0.8
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        frigate:
+          ansible_host: 192.168.0.12
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        vs-code:
+          ansible_host: 192.168.0.16
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        gitea-server:
+          ansible_host: 192.168.0.39
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        ai-host:
+          ansible_host: 192.168.0.50
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run:
+            - coder_ai

playbooks/deploy_and_set_up_lxc_on_proxmox.yaml

@@ -25,6 +25,10 @@
       prompt: "IP address for the container (in x.x.x.x/x formant)"
       private: false
 
+    - name: lxc_is_privileged
+      prompt: "Unprivileged LXC (true/false)?"
+      private: false
+
   pre_tasks:
     - name: Validate hostname
       ansible.builtin.fail:

playbooks/maintain.yaml

@@ -1,6 +1,6 @@
 ---
 - name: Deploy and set up an LXC container in Proxmox
-  hosts: all
+  hosts: virtual
   remote_user: ansible
   
   vars_files:
@@ -18,3 +18,5 @@
     - ../roles/harden_ssh
     # Update configs - omz, nvim, ranger and so on. Distribute the last version of those configs
     - ../roles/update_configs
+    # Make sure that the services that are supposed to run are running
+    - ../roles/check_services

roles/check_services/tasks/main.yaml

@@ -0,0 +1,7 @@
+---
+
+- name: Make sure required services are running
+  ansible.builtin.service:
+    name: "{{ item }}"
+    state: started
+  loop: "{{ services_to_run }}"

roles/common_healthcheck/tasks/main.yaml

@@ -23,8 +23,8 @@
       become: false
       # We have to use this complicated pipeline because of Alpine and its wierd df implementation
       ansible.builtin.shell: set -o pipefail && df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}'
-      register: free_disk_space_result
+      register: common_healthcheck_space_left_result
-      failed_when: free_disk_space_result.stdout | int > 85
+      failed_when: common_healthcheck_space_left_result.stdout | int > 85
       changed_when: false   # This task does not change the system
 
   rescue:
@@ -41,5 +41,9 @@
         body:
           - "{{ ansible_facts['hostname'] }}: Disk space is low"
       delegate_to: 127.0.0.1
-      failed_when: false
+      failed_when: false    # It's OK if it fails, not critical
       changed_when: false   # This task does not change the system
+
+    - name: Resize rootfs if it's an LXC
+      ansible.builtin.include_tasks: resize_lxc_rootfs.yaml
+      when: ansible_virtualization_type == 'lxc'

roles/common_healthcheck/tasks/resize_lxc_rootfs.yaml

@@ -0,0 +1,24 @@
+---
+- name: Get container info by name
+  delegate_to: localhost
+  become: false
+  community.general.proxmox_vm_info:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: 192.168.0.2
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    name: "{{ inventory_hostname }}"
+    type: lxc
+  register: common_healthcheck_vmid
+
+- name: Resize LXC's rootfs
+  become: true
+  ansible.builtin.command:
+    cmd: pct resize {{ common_healthcheck_vmid.proxmox_vms[0].vmid }} rootfs +5G
+  delegate_to: 192.168.0.2
+  changed_when: true
+  vars:
+    ansible_become_password: "{{ ansible_become_passwd  }}"

roles/deploy_lxc_on_proxmox/tasks/main.yaml

@@ -6,7 +6,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -14,6 +14,7 @@
     password: "{{ lxc_root_password }}"
     hostname: "{{ lxc_hostname }}"
     ostemplate: 'main:vztmpl/debian-13-golden-image.tar.gz'
+    unprivileged: "{{ lxc_is_privileged }}"
     memory: 2048
     cores: 2
     state: present
@@ -33,7 +34,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 

roles/deploy_vm_on_proxmox/tasks/create_vm.yaml

@@ -6,7 +6,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -29,7 +29,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -49,7 +49,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -64,10 +64,9 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
     name: "{{ vm_hostname }}"
     state: started
-

roles/deploy_vm_on_proxmox/tasks/main.yaml

@@ -5,7 +5,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
     

roles/deploy_vm_on_proxmox/tasks/start_vm.yaml

@@ -6,7 +6,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -19,4 +19,3 @@
     timeout: 120
   delegate_to: localhost
   changed_when: false
-

roles/human_admin_user/files/ssh_config

@@ -0,0 +1,15 @@
+# PUT NEW BLOCKS STRICTLY BEFORE ANY MATCH BLOCK
+
+
+# Private keys are NOT distributed via Ansible
+# They must to be copied manually ONLY to those hosts that need access to others
+
+# Most of the home major LAN hosts should be accessible with this key
+Match Host 192.168.0.?
+     User     max
+     IdentityFile       ~/.ssh/max_regular_key
+
+# This virtual network has the same hosts range
+Match Host 10.9.2.?
+     User     max
+     IdentityFile       ~/.ssh/max_regular_key

roles/human_admin_user/tasks/main.yaml

@@ -48,6 +48,15 @@
     group: "{{ human_admin_user }}"
     mode: u=rw,g=r,o-rwx
 
+- name: Configure ssh client, by pushing the config
+  remote_user: ansible
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/ssh_config"
+    dest: "/home/{{ human_admin_user }}/.ssh/config"
+    owner: "{{ human_admin_user }}"
+    group: "{{ human_admin_user }}"
+    mode: u=rw,g=r,o-rwx
+
 
 # WARNING: we've finished with the initial setup, drop ansible key
 # Push regular user key

scripts/run_maintain_playbook.sh

@@ -1,11 +1,11 @@
 #!/bin/bash
 
-LOCK_FILE=/tmp/vmn_ansible_lock_file.lock
+# 1 - Pull the latest code
+git pull origin main
 
-while [ -f "$LOCK_FILE" ]
+# 2 - Update dependencies and modules
-do
+./scripts/update_modules.sh
-  sleep 1s
-done
 
+# 3 - Run the job
 source .venv/bin/activate
 ansible-playbook playbooks/maintain.yaml --vault-pass-file ~/vault_password -i inventory/hosts.yaml --private-key ~/.ssh/ansible_key

scripts/update_modules.sh

@@ -1,18 +1,12 @@
 #!/bin/bash
 
-# Create a lock file to prevent other scripts from running with old modules
-touch /tmp/vmn_ansible_lock_file.lock
-
 source .venv/bin/activate
 
 # Install python packages
 pip install -r requirements.txt
 
 # Install collections from the file
-ansible-galaxy collection install -r requirements.yml -p ./collections/
+ansible-galaxy collection install -r requirements.yaml -p ./collections/
 
 # Install roles
-ansible-galaxy role install -r requirements.yml -p ./roles/
+ansible-galaxy role install -r requirements.yaml -p ./roles/
-
-# Installation is finished, remove the lock
-rm /tmp/vmn_ansible_lock_file.lock