Capture current Ansible control plane state
Commit the accumulated infrastructure work that was living only in the working tree: monitoring stack, emergency access/bot, gyro allocator, grimmory, adguard, backup audit and the OpenCode agent definitions. Also ignore Python bytecode, local archives and Nix/direnv artifacts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71
This commit is contained in:
Dmitry
@@ -0,0 +1,431 @@
|
||||
---
|
||||
- name: Guard Grimmory VMID before API updates
|
||||
hosts: cloud-pc
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Read existing VMID 149 configuration
|
||||
ansible.builtin.command: pct config 149
|
||||
register: grimmory_existing_vmid
|
||||
check_mode: false
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
- name: Refuse to modify a foreign VMID 149
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- grimmory_existing_vmid.rc != 0 or grimmory_existing_hostname == 'grimmory'
|
||||
fail_msg: VMID 149 already exists and is not the Grimmory container.
|
||||
vars:
|
||||
grimmory_existing_hostname: >-
|
||||
{{ grimmory_existing_vmid.stdout_lines
|
||||
| select('match', '^hostname: ')
|
||||
| map('regex_replace', '^hostname: ', '')
|
||||
| first
|
||||
| default('') }}
|
||||
|
||||
- name: Create Grimmory LXC on cloud-pc
|
||||
hosts: localhost
|
||||
connection: local
|
||||
become: false
|
||||
gather_facts: false
|
||||
vars:
|
||||
ansible_become: false
|
||||
ansible_python_interpreter: "{{ ansible_playbook_python }}"
|
||||
pve_lxc_vmid: 149
|
||||
pve_lxc_node: cloud-pc
|
||||
pve_lxc_hostname: grimmory
|
||||
pve_lxc_ip: 192.168.1.34/24
|
||||
pve_lxc_gateway: 192.168.1.1
|
||||
pve_lxc_disk: data:64
|
||||
pve_lxc_cores: 2
|
||||
pve_lxc_memory: 4096
|
||||
pve_lxc_swap: 1024
|
||||
pve_lxc_startup: order=100
|
||||
pve_lxc_unprivileged: true
|
||||
pve_lxc_update: false
|
||||
pve_lxc_features:
|
||||
- nesting=1
|
||||
pve_lxc_ostemplate: local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst
|
||||
roles:
|
||||
- role: pve_lxc
|
||||
|
||||
- name: Configure Grimmory LXC devices
|
||||
hosts: cloud-pc
|
||||
gather_facts: false
|
||||
vars:
|
||||
grimmory_vmid: 149
|
||||
handlers:
|
||||
- name: restart Grimmory LXC
|
||||
ansible.builtin.command: "pct reboot {{ grimmory_vmid }}"
|
||||
changed_when: true
|
||||
tasks:
|
||||
- name: Read Grimmory LXC configuration
|
||||
ansible.builtin.command: "pct config {{ grimmory_vmid }}"
|
||||
register: grimmory_lxc_config
|
||||
changed_when: false
|
||||
|
||||
- name: Require expected Grimmory LXC properties
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- "'unprivileged: 1' in grimmory_lxc_config.stdout"
|
||||
- "'rootfs: data:' in grimmory_lxc_config.stdout"
|
||||
- "'onboot: 1' in grimmory_lxc_config.stdout"
|
||||
|
||||
- name: Configure Grimmory LXC network
|
||||
ansible.builtin.command: >-
|
||||
pct set {{ grimmory_vmid }}
|
||||
--net0 name=eth0,bridge=vmbr0,firewall=1,gw=192.168.1.1,ip=192.168.1.34/24
|
||||
vars:
|
||||
grimmory_net0: >-
|
||||
{{ grimmory_lxc_config.stdout_lines
|
||||
| select('match', '^net0: ')
|
||||
| first
|
||||
| default('') }}
|
||||
when: >-
|
||||
'name=eth0' not in grimmory_net0 or
|
||||
'bridge=vmbr0' not in grimmory_net0 or
|
||||
'firewall=1' not in grimmory_net0 or
|
||||
'gw=192.168.1.1' not in grimmory_net0 or
|
||||
'ip=192.168.1.34/24' not in grimmory_net0
|
||||
notify: restart Grimmory LXC
|
||||
|
||||
- name: Enable keyctl for Docker in Grimmory LXC
|
||||
ansible.builtin.command: "pct set {{ grimmory_vmid }} --features nesting=1,keyctl=1"
|
||||
when: "'nesting=1' not in grimmory_lxc_config.stdout or 'keyctl=1' not in grimmory_lxc_config.stdout"
|
||||
notify: restart Grimmory LXC
|
||||
|
||||
- name: Allow FUSE device in Grimmory LXC config
|
||||
ansible.builtin.lineinfile:
|
||||
path: "/etc/pve/lxc/{{ grimmory_vmid }}.conf"
|
||||
line: "lxc.cgroup2.devices.allow: c 10:229 rwm"
|
||||
state: present
|
||||
notify: restart Grimmory LXC
|
||||
|
||||
- name: Bind mount FUSE device in Grimmory LXC config
|
||||
ansible.builtin.lineinfile:
|
||||
path: "/etc/pve/lxc/{{ grimmory_vmid }}.conf"
|
||||
line: "lxc.mount.entry: /dev/fuse dev/fuse none bind,create=file"
|
||||
state: present
|
||||
notify: restart Grimmory LXC
|
||||
|
||||
- name: Apply pending Grimmory LXC configuration
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
||||
- name: Wait for Grimmory SSH through ru-vps
|
||||
ansible.builtin.wait_for_connection:
|
||||
timeout: 180
|
||||
delegate_to: grimmory
|
||||
vars:
|
||||
ansible_become: false
|
||||
|
||||
- name: Configure Grimmory runtime
|
||||
hosts: grimmory
|
||||
gather_facts: true
|
||||
vars:
|
||||
ansible_become: false
|
||||
grimmory_root: /opt/grimmory
|
||||
grimmory_image: grimmory/grimmory:v3.2.4@sha256:dfa7afdfcf25d649fd664497a62385dd00cd9678c37546e182c172e41c8e80cb
|
||||
grimmory_mariadb_image: lscr.io/linuxserver/mariadb:11.4.8@sha256:91de7f701bc7fc3a424b81beafca7a7c6c4c5b7c8be6afd2ae148698695c0b0c
|
||||
tasks:
|
||||
- name: Install Grimmory runtime packages
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- ca-certificates
|
||||
- curl
|
||||
- docker-compose
|
||||
- docker.io
|
||||
- fuse-overlayfs
|
||||
- mariadb-client
|
||||
- openssl
|
||||
- prometheus-node-exporter
|
||||
- ufw
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Verify FUSE device exists
|
||||
ansible.builtin.stat:
|
||||
path: /dev/fuse
|
||||
register: grimmory_fuse
|
||||
|
||||
- name: Require FUSE device
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- grimmory_fuse.stat.exists
|
||||
- grimmory_fuse.stat.ischr
|
||||
|
||||
- name: Configure Docker storage driver for unprivileged LXC
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/docker/daemon.json
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
{
|
||||
"storage-driver": "fuse-overlayfs"
|
||||
}
|
||||
register: grimmory_docker_config
|
||||
|
||||
- name: Enable Docker service
|
||||
ansible.builtin.systemd:
|
||||
name: docker
|
||||
enabled: true
|
||||
state: "{{ 'restarted' if grimmory_docker_config.changed else 'started' }}"
|
||||
|
||||
- name: Allow SSH from the HomeLab LAN
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "22"
|
||||
proto: tcp
|
||||
src: "{{ homelab_lan_cidr }}"
|
||||
|
||||
- name: Allow SSH from the OpenVPN network
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "22"
|
||||
proto: tcp
|
||||
src: "{{ openvpn_network_cidr }}"
|
||||
|
||||
- name: Allow Grimmory from the HomeLab LAN
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "6060"
|
||||
proto: tcp
|
||||
src: "{{ homelab_lan_cidr }}"
|
||||
|
||||
- name: Allow Grimmory from the OpenVPN network
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "6060"
|
||||
proto: tcp
|
||||
src: "{{ openvpn_network_cidr }}"
|
||||
|
||||
- name: Allow Node Exporter from the monitoring LXC
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "9100"
|
||||
proto: tcp
|
||||
src: 192.168.1.30
|
||||
|
||||
- name: Enable restrictive Grimmory firewall
|
||||
community.general.ufw:
|
||||
state: enabled
|
||||
policy: deny
|
||||
direction: incoming
|
||||
|
||||
- name: Create Grimmory directories
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path }}"
|
||||
state: directory
|
||||
owner: "{{ item.owner }}"
|
||||
group: "{{ item.group }}"
|
||||
mode: "{{ item.mode }}"
|
||||
loop:
|
||||
- { path: "{{ grimmory_root }}", owner: root, group: root, mode: "0750" }
|
||||
- { path: "{{ grimmory_root }}/data", owner: "1000", group: "1000", mode: "0750" }
|
||||
- { path: "{{ grimmory_root }}/books", owner: "1000", group: "1000", mode: "0750" }
|
||||
- { path: "{{ grimmory_root }}/bookdrop", owner: "1000", group: "1000", mode: "0750" }
|
||||
- { path: "{{ grimmory_root }}/mariadb", owner: "1000", group: "1000", mode: "0750" }
|
||||
- { path: "{{ grimmory_root }}/backup-staging", owner: root, group: root, mode: "0700" }
|
||||
|
||||
- name: Generate Grimmory secrets once
|
||||
ansible.builtin.shell: |
|
||||
set -eu
|
||||
umask 077
|
||||
if [ -e {{ grimmory_root }}/.env ]; then
|
||||
exit 0
|
||||
fi
|
||||
db_password=$(openssl rand -hex 32)
|
||||
root_password=$(openssl rand -hex 32)
|
||||
cat > {{ grimmory_root }}/.env <<EOF
|
||||
TZ=Europe/Moscow
|
||||
APP_USER_ID=1000
|
||||
APP_GROUP_ID=1000
|
||||
DB_USER_ID=1000
|
||||
DB_GROUP_ID=1000
|
||||
DB_PASSWORD=$db_password
|
||||
MYSQL_ROOT_PASSWORD=$root_password
|
||||
EOF
|
||||
printf created
|
||||
args:
|
||||
executable: /bin/sh
|
||||
register: grimmory_secrets
|
||||
changed_when: grimmory_secrets.stdout == 'created'
|
||||
no_log: true
|
||||
|
||||
- name: Enforce Grimmory secret file permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ grimmory_root }}/.env"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
|
||||
- name: Install Grimmory environment example
|
||||
ansible.builtin.copy:
|
||||
dest: "{{ grimmory_root }}/.env.example"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
TZ=Europe/Moscow
|
||||
APP_USER_ID=1000
|
||||
APP_GROUP_ID=1000
|
||||
DB_USER_ID=1000
|
||||
DB_GROUP_ID=1000
|
||||
DB_PASSWORD=replace-with-random-password
|
||||
MYSQL_ROOT_PASSWORD=replace-with-separate-random-password
|
||||
|
||||
- name: Install Grimmory Compose configuration
|
||||
ansible.builtin.copy:
|
||||
dest: "{{ grimmory_root }}/compose.yml"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
services:
|
||||
grimmory:
|
||||
image: {{ grimmory_image }}
|
||||
container_name: grimmory
|
||||
environment:
|
||||
USER_ID: "${APP_USER_ID}"
|
||||
GROUP_ID: "${APP_GROUP_ID}"
|
||||
TZ: "${TZ}"
|
||||
DATABASE_URL: jdbc:mariadb://mariadb:3306/grimmory
|
||||
DATABASE_USERNAME: grimmory
|
||||
DATABASE_PASSWORD: "${DB_PASSWORD}"
|
||||
DISK_TYPE: LOCAL
|
||||
ALLOWED_ORIGINS: https://books.ada-dev.ru
|
||||
depends_on:
|
||||
mariadb:
|
||||
condition: service_healthy
|
||||
ports:
|
||||
- "192.168.1.34:6060:6060"
|
||||
volumes:
|
||||
- ./data:/app/data
|
||||
- ./books:/books
|
||||
- ./bookdrop:/bookdrop
|
||||
restart: unless-stopped
|
||||
|
||||
mariadb:
|
||||
image: {{ grimmory_mariadb_image }}
|
||||
container_name: grimmory-mariadb
|
||||
environment:
|
||||
PUID: "${DB_USER_ID}"
|
||||
PGID: "${DB_GROUP_ID}"
|
||||
TZ: "${TZ}"
|
||||
MYSQL_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD}"
|
||||
MYSQL_DATABASE: grimmory
|
||||
MYSQL_USER: grimmory
|
||||
MYSQL_PASSWORD: "${DB_PASSWORD}"
|
||||
volumes:
|
||||
- ./mariadb:/config
|
||||
healthcheck:
|
||||
test: ["CMD", "mariadb-admin", "ping", "-h", "localhost"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 20
|
||||
restart: unless-stopped
|
||||
register: grimmory_compose
|
||||
|
||||
- name: Install Docker firewall script
|
||||
ansible.builtin.copy:
|
||||
dest: /usr/local/sbin/grimmory-docker-firewall
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
content: |
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
iptables -N GRIMMORY-FILTER 2>/dev/null || true
|
||||
iptables -F GRIMMORY-FILTER
|
||||
iptables -A GRIMMORY-FILTER -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
iptables -A GRIMMORY-FILTER -s {{ homelab_lan_cidr }} -p tcp -m conntrack --ctorigdst 192.168.1.34 --ctorigdstport 6060 -j ACCEPT
|
||||
iptables -A GRIMMORY-FILTER -s {{ openvpn_network_cidr }} -p tcp -m conntrack --ctorigdst 192.168.1.34 --ctorigdstport 6060 -j ACCEPT
|
||||
iptables -A GRIMMORY-FILTER -p tcp -m conntrack --ctorigdst 192.168.1.34 --ctorigdstport 6060 -j DROP
|
||||
iptables -A GRIMMORY-FILTER -j RETURN
|
||||
iptables -C DOCKER-USER -j GRIMMORY-FILTER 2>/dev/null || iptables -I DOCKER-USER 1 -j GRIMMORY-FILTER
|
||||
register: grimmory_firewall_script
|
||||
|
||||
- name: Install Docker firewall service
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/system/grimmory-docker-firewall.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Restrict Grimmory Docker published port
|
||||
After=docker.service
|
||||
Requires=docker.service
|
||||
Before=grimmory.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/local/sbin/grimmory-docker-firewall
|
||||
RemainAfterExit=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
register: grimmory_firewall_unit
|
||||
|
||||
- name: Install Grimmory systemd unit
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/system/grimmory.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Grimmory Compose stack
|
||||
Wants=network-online.target
|
||||
After=network-online.target docker.service grimmory-docker-firewall.service
|
||||
Requires=docker.service grimmory-docker-firewall.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
WorkingDirectory={{ grimmory_root }}
|
||||
ExecStart=/usr/bin/docker compose -f {{ grimmory_root }}/compose.yml up -d --remove-orphans
|
||||
ExecStop=/usr/bin/docker compose -f {{ grimmory_root }}/compose.yml down
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
register: grimmory_unit
|
||||
|
||||
- name: Reload systemd for Grimmory units
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
when: grimmory_firewall_unit.changed or grimmory_unit.changed
|
||||
|
||||
- name: Enable and apply Docker firewall
|
||||
ansible.builtin.systemd:
|
||||
name: grimmory-docker-firewall
|
||||
enabled: true
|
||||
state: "{{ 'restarted' if grimmory_firewall_script.changed or grimmory_firewall_unit.changed else 'started' }}"
|
||||
|
||||
- name: Validate Grimmory Compose configuration
|
||||
ansible.builtin.command: docker compose -f {{ grimmory_root }}/compose.yml config --quiet
|
||||
args:
|
||||
chdir: "{{ grimmory_root }}"
|
||||
changed_when: false
|
||||
no_log: true
|
||||
|
||||
- name: Enable and start Grimmory
|
||||
ansible.builtin.systemd:
|
||||
name: grimmory
|
||||
enabled: true
|
||||
state: "{{ 'restarted' if grimmory_compose.changed or grimmory_unit.changed else 'started' }}"
|
||||
|
||||
- name: Wait for Grimmory health endpoint
|
||||
ansible.builtin.uri:
|
||||
url: http://192.168.1.34:6060/api/v1/healthcheck
|
||||
status_code: 200
|
||||
register: grimmory_health
|
||||
retries: 120
|
||||
delay: 5
|
||||
until: grimmory_health.status == 200
|
||||
|
||||
- name: Verify Docker storage driver
|
||||
ansible.builtin.command: docker info --format '{{ "{{" }}.Driver{{ "}}" }}'
|
||||
register: grimmory_docker_driver
|
||||
changed_when: false
|
||||
failed_when: grimmory_docker_driver.stdout != 'fuse-overlayfs'
|
||||
Reference in New Issue
Block a user