Archive Legacy Setup And Add Ansible Control Plane
This commit is contained in:
Dmitry
@@ -0,0 +1,174 @@
|
||||
- name: Create Vaultwarden LXC on mini-pc
|
||||
hosts: mini-pc
|
||||
gather_facts: false
|
||||
vars:
|
||||
vaultwarden_vmid: 140
|
||||
vaultwarden_hostname: vaultwarden
|
||||
vaultwarden_ip: 192.168.1.24/24
|
||||
vaultwarden_gateway: 192.168.1.1
|
||||
vaultwarden_bridge: vmbr0
|
||||
vaultwarden_rootfs: local-lvm:16
|
||||
vaultwarden_ostemplate: local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst
|
||||
vaultwarden_pubkey_file: ~/.ssh/id_ed25519_homelab.pub
|
||||
handlers:
|
||||
- name: restart vaultwarden lxc
|
||||
ansible.builtin.shell: "pct stop {{ vaultwarden_vmid }} || true; pct start {{ vaultwarden_vmid }}"
|
||||
changed_when: true
|
||||
tasks:
|
||||
- name: Check if Vaultwarden LXC exists
|
||||
ansible.builtin.command: "pct config {{ vaultwarden_vmid }}"
|
||||
register: vaultwarden_pct_config
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
- name: Install Vaultwarden LXC SSH public key on PVE host
|
||||
ansible.builtin.copy:
|
||||
dest: /tmp/vaultwarden-lxc.pub
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
content: "{{ lookup('file', vaultwarden_pubkey_file) }}\n"
|
||||
when: vaultwarden_pct_config.rc != 0
|
||||
|
||||
- name: Create Vaultwarden LXC
|
||||
ansible.builtin.command: >-
|
||||
pct create {{ vaultwarden_vmid }} {{ vaultwarden_ostemplate }}
|
||||
--hostname {{ vaultwarden_hostname }}
|
||||
--rootfs {{ vaultwarden_rootfs }}
|
||||
--cores 2
|
||||
--memory 1024
|
||||
--swap 512
|
||||
--net0 name=eth0,bridge={{ vaultwarden_bridge }},gw={{ vaultwarden_gateway }},ip={{ vaultwarden_ip }},firewall=1
|
||||
--nameserver 1.1.1.1
|
||||
--unprivileged 1
|
||||
--features nesting=1,keyctl=1
|
||||
--onboot 1
|
||||
--startup order=40
|
||||
--cmode shell
|
||||
--ssh-public-keys /tmp/vaultwarden-lxc.pub
|
||||
when: vaultwarden_pct_config.rc != 0
|
||||
|
||||
- name: Start Vaultwarden LXC
|
||||
ansible.builtin.command: "pct start {{ vaultwarden_vmid }}"
|
||||
register: vaultwarden_pct_start
|
||||
changed_when: vaultwarden_pct_start.rc == 0
|
||||
failed_when: vaultwarden_pct_start.rc not in [0, 255]
|
||||
|
||||
- name: Allow FUSE device in Vaultwarden LXC config
|
||||
ansible.builtin.lineinfile:
|
||||
path: "/etc/pve/lxc/{{ vaultwarden_vmid }}.conf"
|
||||
line: "lxc.cgroup2.devices.allow: c 10:229 rwm"
|
||||
state: present
|
||||
notify: restart vaultwarden lxc
|
||||
|
||||
- name: Bind mount FUSE device in Vaultwarden LXC config
|
||||
ansible.builtin.lineinfile:
|
||||
path: "/etc/pve/lxc/{{ vaultwarden_vmid }}.conf"
|
||||
line: "lxc.mount.entry: /dev/fuse dev/fuse none bind,create=file"
|
||||
state: present
|
||||
notify: restart vaultwarden lxc
|
||||
|
||||
- name: Apply pending LXC config changes
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
||||
- name: Wait for Vaultwarden SSH through ru-vps
|
||||
ansible.builtin.wait_for_connection:
|
||||
timeout: 120
|
||||
delegate_to: vaultwarden
|
||||
vars:
|
||||
ansible_become: false
|
||||
|
||||
- name: Configure Docker and Vaultwarden inside LXC
|
||||
hosts: vaultwarden
|
||||
gather_facts: true
|
||||
vars:
|
||||
ansible_become: false
|
||||
vaultwarden_data_dir: /opt/vaultwarden/data
|
||||
vaultwarden_image: vaultwarden/server:latest
|
||||
vaultwarden_container_name: vaultwarden
|
||||
vaultwarden_http_port: 80
|
||||
tasks:
|
||||
- name: Install Docker packages
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- docker.io
|
||||
- fuse-overlayfs
|
||||
- sqlite3
|
||||
- ca-certificates
|
||||
- curl
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Ensure Docker config directory exists
|
||||
ansible.builtin.file:
|
||||
path: /etc/docker
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
|
||||
- name: Configure Docker storage driver for unprivileged LXC
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/docker/daemon.json
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
{
|
||||
"storage-driver": "fuse-overlayfs"
|
||||
}
|
||||
register: docker_daemon_config
|
||||
|
||||
- name: Ensure Docker service is enabled and running
|
||||
ansible.builtin.systemd:
|
||||
name: docker
|
||||
state: "{{ 'restarted' if docker_daemon_config.changed else 'started' }}"
|
||||
enabled: true
|
||||
|
||||
- name: Ensure Vaultwarden data directory exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ vaultwarden_data_dir }}"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0750"
|
||||
|
||||
- name: Install Vaultwarden systemd unit
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/system/vaultwarden.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Vaultwarden container
|
||||
After=docker.service
|
||||
Requires=docker.service
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
ExecStartPre=-/usr/bin/docker rm -f {{ vaultwarden_container_name }}
|
||||
ExecStart=/usr/bin/docker run --rm \
|
||||
--name {{ vaultwarden_container_name }} \
|
||||
--pull always \
|
||||
-p {{ vaultwarden_http_port }}:80 \
|
||||
-v {{ vaultwarden_data_dir }}:/data \
|
||||
-e WEBSOCKET_ENABLED=true \
|
||||
{{ vaultwarden_image }}
|
||||
ExecStop=/usr/bin/docker stop {{ vaultwarden_container_name }}
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
register: vaultwarden_unit
|
||||
|
||||
- name: Reload systemd when Vaultwarden unit changes
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
when: vaultwarden_unit.changed
|
||||
|
||||
- name: Enable and start Vaultwarden
|
||||
ansible.builtin.systemd:
|
||||
name: vaultwarden
|
||||
state: started
|
||||
enabled: true
|
||||
Reference in New Issue
Block a user