fix (roles): ssh config to be placed in ~/.shh

Reviewed-on: #6

README.md

@@ -1,3 +1,20 @@
 # ansible_home
 
-My own home services automation repository
+## How to use it?
+
+It's better to use a virtual environment to avoid incompatibility issues
+
+```bash
+git clone https://git.vmn.su/max/vmn-ansible
+cd vmn-ansible
+python3 -m venv .venv
+source .venv/bin/activate
+pip install -r requirements.txt
+ansible-galaxy collection install -r requirements.yaml
+ansible-galaxy role install -r requirements.yaml
+ansible-playbook playbooks/deploy_and_set_up_lxc_on_proxmox.yaml --vault-pass-file $VAULT_PASS_PATH -i inventory/localhost.yaml --private-key $SSH_KEY
+```
+
+**deploy** playbooks must be used with `inventory/localhost.yaml`, they need access to proxmox host only
+
+There are also a systemd service and timer under `systemd` directory

inventory/group_vars/all/main.yaml

@@ -2,3 +2,4 @@
 
 ansible_become_passwd: "{{ ansible_password }}"
 human_admin_user: max
+proxmox_1_host: 192.168.0.2

inventory/hosts.yaml

@@ -1,34 +1,41 @@
 ---
-physical:
+all:
-  hosts:
+  children:
-    localhost:
+    physical:
-      ansible_become_password: "{{ ansible_become_passwd }}"
+      proxmox_1:
-      ansible_connection: local
+        ansible_host: "{{ proxmox_1_host }}"
-      ansible_python_interpreter: "{{ ansible_playbook_python }}"
+        ansible_become_password: "{{ ansible_become_passwd }}"
-      services_to_run: []
+        services_to_run: []
-    nfs-server:
+    virtual:
-      ansible_host: 192.168.0.6
+      hosts:
-      ansible_become_password: "{{ ansible_become_passwd }}"
+        localhost:
-      services_to_run: []
+          ansible_become_password: "{{ ansible_become_passwd }}"
-    jellyfin:
+          ansible_connection: local
-      ansible_host: 192.168.0.8
+          ansible_python_interpreter: "{{ ansible_playbook_python }}"
-      ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run:
-      services_to_run: []
+            - webhook 
-    frigate:
+        nfs-server:
-      ansible_host: 192.168.0.12
+          ansible_host: 192.168.0.6
-      ansible_become_password: "{{ ansible_become_passwd }}"
+          ansible_become_password: "{{ ansible_become_passwd }}"
-      services_to_run: []
+          services_to_run: []
-    vs-code:
+        jellyfin:
-      ansible_host: 192.168.0.16
+          ansible_host: 192.168.0.8
-      ansible_become_password: "{{ ansible_become_passwd }}"
+          ansible_become_password: "{{ ansible_become_passwd }}"
-      services_to_run: []
+          services_to_run: []
-    gitea-server:
+        frigate:
-      ansible_host: 192.168.0.39
+          ansible_host: 192.168.0.12
-      ansible_become_password: "{{ ansible_become_passwd }}"
+          ansible_become_password: "{{ ansible_become_passwd }}"
-      services_to_run: []
+          services_to_run: []
-    ai-host:
+        vs-code:
-      ansible_host: 192.168.0.50
+          ansible_host: 192.168.0.16
-      ansible_become_password: "{{ ansible_become_passwd }}"
+          ansible_become_password: "{{ ansible_become_passwd }}"
-      services_to_run:
+          services_to_run: []
-        - coder_ai
+        gitea-server:
-      
+          ansible_host: 192.168.0.39
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        ai-host:
+          ansible_host: 192.168.0.50
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run:
+            - coder_ai

playbooks/maintain.yaml

@@ -1,6 +1,6 @@
 ---
 - name: Deploy and set up an LXC container in Proxmox
-  hosts: all
+  hosts: virtual
   remote_user: ansible
   
   vars_files:

roles/common_healthcheck/tasks/main.yaml

@@ -23,8 +23,8 @@
       become: false
       # We have to use this complicated pipeline because of Alpine and its wierd df implementation
       ansible.builtin.shell: set -o pipefail && df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}'
-      register: free_disk_space_result
+      register: common_healthcheck_space_left_result
-      failed_when: free_disk_space_result.stdout | int > 85
+      failed_when: common_healthcheck_space_left_result.stdout | int > 85
       changed_when: false   # This task does not change the system
 
   rescue:
@@ -41,5 +41,9 @@
         body:
           - "{{ ansible_facts['hostname'] }}: Disk space is low"
       delegate_to: 127.0.0.1
-      failed_when: false
+      failed_when: false    # It's OK if it fails, not critical
       changed_when: false   # This task does not change the system
+
+    - name: Resize rootfs if it's an LXC
+      ansible.builtin.include_tasks: resize_lxc_rootfs.yaml
+      when: ansible_virtualization_type == 'lxc'

roles/common_healthcheck/tasks/resize_lxc_rootfs.yaml

@@ -0,0 +1,24 @@
+---
+- name: Get container info by name
+  delegate_to: localhost
+  become: false
+  community.general.proxmox_vm_info:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: 192.168.0.2
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    name: "{{ inventory_hostname }}"
+    type: lxc
+  register: common_healthcheck_vmid
+
+- name: Resize LXC's rootfs
+  become: true
+  ansible.builtin.command:
+    cmd: pct resize {{ common_healthcheck_vmid.proxmox_vms[0].vmid }} rootfs +5G
+  delegate_to: 192.168.0.2
+  changed_when: true
+  vars:
+    ansible_become_password: "{{ ansible_become_passwd  }}"

roles/deploy_lxc_on_proxmox/tasks/main.yaml

@@ -6,7 +6,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -34,7 +34,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 

roles/deploy_vm_on_proxmox/tasks/create_vm.yaml

@@ -6,7 +6,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -29,7 +29,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -49,7 +49,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -64,10 +64,9 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
     name: "{{ vm_hostname }}"
     state: started
-

roles/deploy_vm_on_proxmox/tasks/main.yaml

@@ -5,7 +5,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
     

roles/deploy_vm_on_proxmox/tasks/start_vm.yaml

@@ -6,7 +6,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -19,4 +19,3 @@
     timeout: 120
   delegate_to: localhost
   changed_when: false
-

roles/human_admin_user/files/ssh_config

@@ -0,0 +1,15 @@
+# PUT NEW BLOCKS STRICTLY BEFORE ANY MATCH BLOCK
+
+
+# Private keys are NOT distributed via Ansible
+# They must to be copied manually ONLY to those hosts that need access to others
+
+# Most of the home major LAN hosts should be accessible with this key
+Match Host 192.168.0.?
+     User     max
+     IdentityFile       ~/.ssh/max_regular_key
+
+# This virtual network has the same hosts range
+Match Host 10.9.2.?
+     User     max
+     IdentityFile       ~/.ssh/max_regular_key

roles/human_admin_user/tasks/main.yaml

@@ -48,6 +48,15 @@
     group: "{{ human_admin_user }}"
     mode: u=rw,g=r,o-rwx
 
+- name: Configure ssh client, by pushing the config
+  remote_user: ansible
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/ssh_config"
+    dest: "/home/{{ human_admin_user }}/.ssh/config"
+    owner: "{{ human_admin_user }}"
+    group: "{{ human_admin_user }}"
+    mode: u=rw,g=r,o-rwx
+
 
 # WARNING: we've finished with the initial setup, drop ansible key
 # Push regular user key