DmitryandClaude Sonnet 5
e0c53a1b1b
.env is now consumed by both Ansible and OpenTofu, so keep a single copy at the repo root instead of ansible/.env: - rename ansible/.env.example -> .env.example. - Makefile: ENV_FILE ?= $(REPO_ROOT)/.env (absolute, works from any cwd); REQUIRE_ENV/LOAD_ENV updated; help text. - bootstrap-pve-api-token.yml / bootstrap-monitoring-pve-token.yml write and read ../../.env; bootstrap now keeps backup: true (it rewrites the whole file, clobbering MONITORING_*/EMERGENCY_*/PROXMOX_ROOT_PASSWORD). - roles/pve_lxc, roles/monitoring_server: fail_msg points at the repo-root .env. The Makefile also picks up the new targets added by later commits (tofu-*, validate, pbs-storage, ru-vps-base, zerotier-decommission); they are grouped here so all recipes land together. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V
78 lines
3.2 KiB
YAML
78 lines
3.2 KiB
YAML
---
|
|
- name: Create read-only Proxmox token for monitoring
|
|
hosts: mini-pc
|
|
gather_facts: false
|
|
vars:
|
|
monitoring_pve_user: monitoring@pve
|
|
monitoring_pve_token_id: prometheus
|
|
# .env лежит в корне репозитория, playbook_dir — это ansible/playbooks.
|
|
monitoring_pve_env_file: "{{ playbook_dir }}/../../.env"
|
|
monitoring_pve_rotate_existing_token: false
|
|
tasks:
|
|
- name: Read existing Proxmox users
|
|
ansible.builtin.command: pveum user list --output-format json
|
|
register: monitoring_pve_users_raw
|
|
changed_when: false
|
|
|
|
- name: Create monitoring Proxmox user
|
|
ansible.builtin.command: >-
|
|
pveum user add {{ monitoring_pve_user }}
|
|
--comment 'Read-only Prometheus monitoring user'
|
|
when: monitoring_pve_user not in (monitoring_pve_users_raw.stdout | from_json | map(attribute='userid') | list)
|
|
|
|
- name: Grant PVEAuditor role to monitoring user
|
|
ansible.builtin.command: >-
|
|
pveum acl modify / -user {{ monitoring_pve_user }} -role PVEAuditor
|
|
changed_when: false
|
|
|
|
- name: Read monitoring user tokens
|
|
ansible.builtin.command: >-
|
|
pveum user token list {{ monitoring_pve_user }} --output-format json
|
|
register: monitoring_pve_tokens_raw
|
|
changed_when: false
|
|
|
|
- name: Refuse to overwrite an existing monitoring token
|
|
ansible.builtin.assert:
|
|
that:
|
|
- monitoring_pve_token_id not in (monitoring_pve_tokens_raw.stdout | from_json | map(attribute='tokenid') | list)
|
|
fail_msg: Existing monitoring token secret cannot be recovered safely. Rotate it explicitly before rerunning this playbook.
|
|
when: not monitoring_pve_rotate_existing_token | bool
|
|
|
|
- name: Rotate existing monitoring token explicitly
|
|
ansible.builtin.command: >-
|
|
pveum user token remove {{ monitoring_pve_user }} {{ monitoring_pve_token_id }}
|
|
when:
|
|
- monitoring_pve_rotate_existing_token | bool
|
|
- monitoring_pve_token_id in (monitoring_pve_tokens_raw.stdout | from_json | map(attribute='tokenid') | list)
|
|
|
|
- name: Create separated monitoring token
|
|
ansible.builtin.command: >-
|
|
pveum user token add {{ monitoring_pve_user }} {{ monitoring_pve_token_id }}
|
|
--privsep 1 --comment 'Prometheus PVE exporter' --output-format json
|
|
register: monitoring_pve_token_created
|
|
no_log: true
|
|
|
|
- name: Grant PVEAuditor role to separated monitoring token
|
|
ansible.builtin.command: >-
|
|
pveum acl modify / -token {{ monitoring_pve_user }}!{{ monitoring_pve_token_id }} -role PVEAuditor
|
|
changed_when: false
|
|
|
|
- name: Store monitoring token variables locally
|
|
ansible.builtin.lineinfile:
|
|
path: "{{ monitoring_pve_env_file }}"
|
|
regexp: "^export {{ item.name }}="
|
|
line: "export {{ item.name }}='{{ item.value }}'"
|
|
create: false
|
|
loop:
|
|
- name: MONITORING_PVE_API_USER
|
|
value: "{{ monitoring_pve_user }}"
|
|
- name: MONITORING_PVE_API_TOKEN_ID
|
|
value: "{{ monitoring_pve_token_id }}"
|
|
- name: MONITORING_PVE_API_TOKEN_SECRET
|
|
value: "{{ (monitoring_pve_token_created.stdout | from_json).value }}"
|
|
delegate_to: localhost
|
|
vars:
|
|
ansible_connection: local
|
|
ansible_become: false
|
|
no_log: true
|