3 Commits

Include renames

Author	SHA1	Message	Date
DmitryandClaude Sonnet 5	4b54e44116	feat: road-warrior OpenVPN profile for the phone (Android, static key) ... playbooks/openvpn-phone.yml (make openvpn-phone) stands up a separate point-to-point static-key instance on ru-vps: tcp/9444, tun2, 10.80.0.0/30, homelab-openvpn-phone unit, NAT 10.80.0.0/30 -> LAN via tun0. The client profile (with the secret) lands in ansible/generated/ada-phone.ovpn (gitignored). Android client: "OpenVPN for Android" (Arne Schwabe) — the official OpenVPN Connect does not support static-key configs. - homelab_vpn_client_routes in group_vars/all/main.yml: shared surgical route list for both road-warrior profiles; not the whole /24, since the phone's home network is almost certainly 192.168.1.0/24 too - openvpn-laptop.yml reuses that list instead of its own literal copy - both playbooks: local profile write moved from `become: false` to `vars: {ansible_connection: local, ansible_become: false}` — the keyword did not suppress the inherited ansible_become on delegate_to: localhost Deployed and verified on ru-vps 2026-09-03: service active, tun2 up, ufw 9444/tcp, NAT rule present, make openvpn-phone idempotent (changed=0 on rerun), 192.168.1.30:8082 reachable from ru-vps. openvpn-laptop.yml is still not applied on the live host. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KbuZrUoevfBgCpf5DCF4DG	2026-09-03 09:33:18 +03:00
DmitryandClaude Sonnet 5	79878e36f9	feat: adopt the ru-vps Caddy stack, fix cluster quorum, decommission ZeroTier ... One ru-vps housekeeping sweep (2026-09-02/03): - playbooks/ru-vps-base.yml (new): adopt the Caddy compose stack into Ansible (pinned image by digest, homelab-caddy.service), and manage the corosync-qnetd UFW rule - allow 5403/tcp from homelab_pve_egress_ip, drop the stale rule for the retired ZeroTier 10.122.62.0/24. The qdevice had gone silent because its only allowed path was the decommissioned ZeroTier network. - group_vars/all/main.yml: homelab_pve_egress_ip (the NATed home egress the PVE nodes reach corosync-qnetd from - a direct path that does not depend on the OpenVPN tunnel). Marked dynamic: a change silently re-breaks the qdevice. - playbooks/status.yml: CLUSTER QUORUM section (pvecm status per PVE node) so a repeat failure is visible. Also drops the memoir-bot unit list and moves the gitea offsite-restic unit to the gitea host (see the OpenTofu-migration commit). - playbooks/ru-vps-zerotier-decommission.yml (new): stop the zerotier container, disable ssh-zt22.service, remove the interface/9993/9001/10.122.62.0/24 UFW rules. Node identity and data are kept; removal is a separate step. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V	2026-09-03 07:05:11 +03:00
DmitryandClaude Opus 5	ec3b736250	Move SSH transport to ssh_config and shared group_vars ... hosts.yml repeated the same authentication block for 13 LXC hosts and carried 13 byte-identical copies of the ru-vps ProxyCommand. Describe the transport once in ansible/ssh_config instead: jump host, per-host users, keys, and the fact that pbs and ovpn-mini are reached directly rather than through ru-vps. Ansible loads that file through ansible_ssh_common_args in group_vars/all/main.yml, where the path is derived from inventory_dir so it depends on neither the current directory nor the clone location. The same file makes `ssh gitea` work from a plain terminal once ~/.ssh/config includes it. hosts.yml drops from 209 to 137 lines and now holds only addresses and per-host facts. Verified equivalent: ansible-inventory --list before and after differ only by the removed ansible_ssh_common_args, with group membership and ordering byte-identical. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71	2026-08-26 22:10:16 +03:00