Move SSH transport to ssh_config and shared group_vars
hosts.yml repeated the same authentication block for 13 LXC hosts and carried 13 byte-identical copies of the ru-vps ProxyCommand. Describe the transport once in ansible/ssh_config instead: jump host, per-host users, keys, and the fact that pbs and ovpn-mini are reached directly rather than through ru-vps. Ansible loads that file through ansible_ssh_common_args in group_vars/all/main.yml, where the path is derived from inventory_dir so it depends on neither the current directory nor the clone location. The same file makes `ssh gitea` work from a plain terminal once ~/.ssh/config includes it. hosts.yml drops from 209 to 137 lines and now holds only addresses and per-host facts. Verified equivalent: ansible-inventory --list before and after differ only by the removed ansible_ssh_common_args, with group membership and ordering byte-identical. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71
This commit is contained in:
Dmitry
@@ -0,0 +1,23 @@
|
||||
---
|
||||
# Общие переменные для всех управляемых хостов.
|
||||
# SSH-транспорт (ProxyJump, порты, ключи по хостам) описан в ansible/ssh_config.
|
||||
# Путь считается от каталога inventory, поэтому работает из любого cwd
|
||||
# и не ломается при клоне репозитория в другое место.
|
||||
ansible_ssh_common_args: "-F {{ inventory_dir }}/../ssh_config"
|
||||
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
ansible_user: ansible
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab_ansible
|
||||
ansible_become: true
|
||||
|
||||
homelab_lan_cidr: 192.168.1.0/24
|
||||
homelab_service_range: 192.168.1.5-192.168.1.40
|
||||
|
||||
openvpn_network_cidr: 10.78.0.0/30
|
||||
openvpn_listen_port: 8443
|
||||
openvpn_forwarded_services:
|
||||
- name: satisfactory
|
||||
protocol: udp
|
||||
public_port: 7777
|
||||
target_host: 192.168.1.100
|
||||
target_port: 7777
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
# LXC-контейнеры управляются напрямую под root, sudo не требуется.
|
||||
|
||||
ansible_user: root
|
||||
ansible_become: false
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
|
||||
@@ -1,20 +1,11 @@
|
||||
# Каноничный список хостов HomeLab.
|
||||
#
|
||||
# Общие переменные: inventory/group_vars/all/main.yml
|
||||
# Переменные LXC: inventory/group_vars/lxc_infra/main.yml
|
||||
# SSH-транспорт: ../ssh_config (подключён через ssh_args в ansible.cfg)
|
||||
#
|
||||
# Здесь у хоста остаются только адрес и его индивидуальные факты.
|
||||
all:
|
||||
vars:
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
ansible_user: ansible
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab_ansible
|
||||
ansible_become: true
|
||||
homelab_lan_cidr: 192.168.1.0/24
|
||||
homelab_service_range: 192.168.1.5-192.168.1.40
|
||||
openvpn_network_cidr: 10.78.0.0/30
|
||||
openvpn_listen_port: 8443
|
||||
openvpn_forwarded_services:
|
||||
- name: satisfactory
|
||||
protocol: udp
|
||||
public_port: 7777
|
||||
target_host: 192.168.1.100
|
||||
target_port: 7777
|
||||
|
||||
children:
|
||||
homelab:
|
||||
hosts:
|
||||
@@ -29,8 +20,6 @@ all:
|
||||
hosts:
|
||||
cloud-pc:
|
||||
ansible_host: 192.168.1.5
|
||||
ansible_ssh_common_args: >-
|
||||
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
|
||||
expected_lan_ip: 192.168.1.5
|
||||
storage_mounts:
|
||||
- src: UUID=ae278333-4116-4225-9b95-595496fadd26
|
||||
@@ -42,128 +31,67 @@ all:
|
||||
|
||||
mini-pc:
|
||||
ansible_host: 192.168.1.10
|
||||
ansible_ssh_common_args: >-
|
||||
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
|
||||
expected_lan_ip: 192.168.1.10
|
||||
|
||||
lxc_infra:
|
||||
hosts:
|
||||
# Доступны напрямую по LAN (без ProxyJump через ru-vps)
|
||||
pbs:
|
||||
ansible_host: 192.168.1.20
|
||||
ansible_user: root
|
||||
ansible_become: false
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
|
||||
expected_lan_ip: 192.168.1.20
|
||||
|
||||
ovpn-mini:
|
||||
ansible_host: 192.168.1.23
|
||||
ansible_user: root
|
||||
ansible_become: false
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
|
||||
expected_lan_ip: 192.168.1.23
|
||||
openvpn_local_ip: 10.78.0.2
|
||||
openvpn_peer_ip: 10.78.0.1
|
||||
openvpn_role: gateway
|
||||
|
||||
# Остальные LXC — через ru-vps (см. ssh_config)
|
||||
adguard:
|
||||
ansible_host: 192.168.1.28
|
||||
ansible_user: root
|
||||
ansible_become: false
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
|
||||
ansible_ssh_common_args: >-
|
||||
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
|
||||
expected_lan_ip: 192.168.1.28
|
||||
|
||||
docker-test:
|
||||
ansible_host: 192.168.1.29
|
||||
ansible_user: root
|
||||
ansible_become: false
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
|
||||
ansible_ssh_common_args: >-
|
||||
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
|
||||
expected_lan_ip: 192.168.1.29
|
||||
|
||||
vaultwarden:
|
||||
ansible_host: 192.168.1.24
|
||||
ansible_user: root
|
||||
ansible_become: false
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
|
||||
ansible_ssh_common_args: >-
|
||||
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
|
||||
expected_lan_ip: 192.168.1.24
|
||||
|
||||
gitea:
|
||||
ansible_host: 192.168.1.25
|
||||
ansible_user: root
|
||||
ansible_become: false
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
|
||||
ansible_ssh_common_args: >-
|
||||
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
|
||||
expected_lan_ip: 192.168.1.25
|
||||
|
||||
memoir-bot:
|
||||
ansible_host: 192.168.1.26
|
||||
ansible_user: root
|
||||
ansible_become: false
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
|
||||
ansible_ssh_common_args: >-
|
||||
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
|
||||
expected_lan_ip: 192.168.1.26
|
||||
|
||||
mihomo:
|
||||
ansible_host: 192.168.1.27
|
||||
ansible_user: root
|
||||
ansible_become: false
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
|
||||
ansible_ssh_common_args: >-
|
||||
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
|
||||
expected_lan_ip: 192.168.1.27
|
||||
|
||||
monitoring:
|
||||
ansible_host: 192.168.1.30
|
||||
ansible_user: root
|
||||
ansible_become: false
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
|
||||
ansible_ssh_common_args: >-
|
||||
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
|
||||
expected_lan_ip: 192.168.1.30
|
||||
|
||||
hermes-ai:
|
||||
ansible_host: 192.168.1.31
|
||||
ansible_user: root
|
||||
ansible_become: false
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
|
||||
ansible_ssh_common_args: >-
|
||||
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
|
||||
expected_lan_ip: 192.168.1.31
|
||||
bash_config_proxy_http_url: http://192.168.1.27:7890
|
||||
bash_config_proxy_socks_url: socks5h://192.168.1.27:7890
|
||||
|
||||
emergency-bot:
|
||||
ansible_host: 192.168.1.32
|
||||
ansible_user: root
|
||||
ansible_become: false
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
|
||||
ansible_ssh_common_args: >-
|
||||
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
|
||||
expected_lan_ip: 192.168.1.32
|
||||
|
||||
grimmory:
|
||||
ansible_host: 192.168.1.34
|
||||
ansible_user: root
|
||||
ansible_become: false
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
|
||||
ansible_ssh_common_args: >-
|
||||
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
|
||||
expected_lan_ip: 192.168.1.34
|
||||
|
||||
gyro:
|
||||
ansible_host: 192.168.1.35
|
||||
ansible_user: root
|
||||
ansible_become: false
|
||||
ansible_ssh_private_key_file: ~/.ssh/id_ed25519_homelab
|
||||
ansible_ssh_common_args: >-
|
||||
-o ProxyCommand="ssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -p 3422 -W %h:%p ansible@157.22.231.198"
|
||||
expected_lan_ip: 192.168.1.35
|
||||
|
||||
monitoring_exporters:
|
||||
|
||||
Reference in New Issue
Block a user