DmitryandClaude Opus 5
c676be81ec
Commit the accumulated infrastructure work that was living only in the working tree: monitoring stack, emergency access/bot, gyro allocator, grimmory, adguard, backup audit and the OpenCode agent definitions. Also ignore Python bytecode, local archives and Nix/direnv artifacts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71
432 lines
14 KiB
YAML
432 lines
14 KiB
YAML
---
|
|
- name: Guard Grimmory VMID before API updates
|
|
hosts: cloud-pc
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Read existing VMID 149 configuration
|
|
ansible.builtin.command: pct config 149
|
|
register: grimmory_existing_vmid
|
|
check_mode: false
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Refuse to modify a foreign VMID 149
|
|
ansible.builtin.assert:
|
|
that:
|
|
- grimmory_existing_vmid.rc != 0 or grimmory_existing_hostname == 'grimmory'
|
|
fail_msg: VMID 149 already exists and is not the Grimmory container.
|
|
vars:
|
|
grimmory_existing_hostname: >-
|
|
{{ grimmory_existing_vmid.stdout_lines
|
|
| select('match', '^hostname: ')
|
|
| map('regex_replace', '^hostname: ', '')
|
|
| first
|
|
| default('') }}
|
|
|
|
- name: Create Grimmory LXC on cloud-pc
|
|
hosts: localhost
|
|
connection: local
|
|
become: false
|
|
gather_facts: false
|
|
vars:
|
|
ansible_become: false
|
|
ansible_python_interpreter: "{{ ansible_playbook_python }}"
|
|
pve_lxc_vmid: 149
|
|
pve_lxc_node: cloud-pc
|
|
pve_lxc_hostname: grimmory
|
|
pve_lxc_ip: 192.168.1.34/24
|
|
pve_lxc_gateway: 192.168.1.1
|
|
pve_lxc_disk: data:64
|
|
pve_lxc_cores: 2
|
|
pve_lxc_memory: 4096
|
|
pve_lxc_swap: 1024
|
|
pve_lxc_startup: order=100
|
|
pve_lxc_unprivileged: true
|
|
pve_lxc_update: false
|
|
pve_lxc_features:
|
|
- nesting=1
|
|
pve_lxc_ostemplate: local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst
|
|
roles:
|
|
- role: pve_lxc
|
|
|
|
- name: Configure Grimmory LXC devices
|
|
hosts: cloud-pc
|
|
gather_facts: false
|
|
vars:
|
|
grimmory_vmid: 149
|
|
handlers:
|
|
- name: restart Grimmory LXC
|
|
ansible.builtin.command: "pct reboot {{ grimmory_vmid }}"
|
|
changed_when: true
|
|
tasks:
|
|
- name: Read Grimmory LXC configuration
|
|
ansible.builtin.command: "pct config {{ grimmory_vmid }}"
|
|
register: grimmory_lxc_config
|
|
changed_when: false
|
|
|
|
- name: Require expected Grimmory LXC properties
|
|
ansible.builtin.assert:
|
|
that:
|
|
- "'unprivileged: 1' in grimmory_lxc_config.stdout"
|
|
- "'rootfs: data:' in grimmory_lxc_config.stdout"
|
|
- "'onboot: 1' in grimmory_lxc_config.stdout"
|
|
|
|
- name: Configure Grimmory LXC network
|
|
ansible.builtin.command: >-
|
|
pct set {{ grimmory_vmid }}
|
|
--net0 name=eth0,bridge=vmbr0,firewall=1,gw=192.168.1.1,ip=192.168.1.34/24
|
|
vars:
|
|
grimmory_net0: >-
|
|
{{ grimmory_lxc_config.stdout_lines
|
|
| select('match', '^net0: ')
|
|
| first
|
|
| default('') }}
|
|
when: >-
|
|
'name=eth0' not in grimmory_net0 or
|
|
'bridge=vmbr0' not in grimmory_net0 or
|
|
'firewall=1' not in grimmory_net0 or
|
|
'gw=192.168.1.1' not in grimmory_net0 or
|
|
'ip=192.168.1.34/24' not in grimmory_net0
|
|
notify: restart Grimmory LXC
|
|
|
|
- name: Enable keyctl for Docker in Grimmory LXC
|
|
ansible.builtin.command: "pct set {{ grimmory_vmid }} --features nesting=1,keyctl=1"
|
|
when: "'nesting=1' not in grimmory_lxc_config.stdout or 'keyctl=1' not in grimmory_lxc_config.stdout"
|
|
notify: restart Grimmory LXC
|
|
|
|
- name: Allow FUSE device in Grimmory LXC config
|
|
ansible.builtin.lineinfile:
|
|
path: "/etc/pve/lxc/{{ grimmory_vmid }}.conf"
|
|
line: "lxc.cgroup2.devices.allow: c 10:229 rwm"
|
|
state: present
|
|
notify: restart Grimmory LXC
|
|
|
|
- name: Bind mount FUSE device in Grimmory LXC config
|
|
ansible.builtin.lineinfile:
|
|
path: "/etc/pve/lxc/{{ grimmory_vmid }}.conf"
|
|
line: "lxc.mount.entry: /dev/fuse dev/fuse none bind,create=file"
|
|
state: present
|
|
notify: restart Grimmory LXC
|
|
|
|
- name: Apply pending Grimmory LXC configuration
|
|
ansible.builtin.meta: flush_handlers
|
|
|
|
- name: Wait for Grimmory SSH through ru-vps
|
|
ansible.builtin.wait_for_connection:
|
|
timeout: 180
|
|
delegate_to: grimmory
|
|
vars:
|
|
ansible_become: false
|
|
|
|
- name: Configure Grimmory runtime
|
|
hosts: grimmory
|
|
gather_facts: true
|
|
vars:
|
|
ansible_become: false
|
|
grimmory_root: /opt/grimmory
|
|
grimmory_image: grimmory/grimmory:v3.2.4@sha256:dfa7afdfcf25d649fd664497a62385dd00cd9678c37546e182c172e41c8e80cb
|
|
grimmory_mariadb_image: lscr.io/linuxserver/mariadb:11.4.8@sha256:91de7f701bc7fc3a424b81beafca7a7c6c4c5b7c8be6afd2ae148698695c0b0c
|
|
tasks:
|
|
- name: Install Grimmory runtime packages
|
|
ansible.builtin.apt:
|
|
name:
|
|
- ca-certificates
|
|
- curl
|
|
- docker-compose
|
|
- docker.io
|
|
- fuse-overlayfs
|
|
- mariadb-client
|
|
- openssl
|
|
- prometheus-node-exporter
|
|
- ufw
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Verify FUSE device exists
|
|
ansible.builtin.stat:
|
|
path: /dev/fuse
|
|
register: grimmory_fuse
|
|
|
|
- name: Require FUSE device
|
|
ansible.builtin.assert:
|
|
that:
|
|
- grimmory_fuse.stat.exists
|
|
- grimmory_fuse.stat.ischr
|
|
|
|
- name: Configure Docker storage driver for unprivileged LXC
|
|
ansible.builtin.copy:
|
|
dest: /etc/docker/daemon.json
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: |
|
|
{
|
|
"storage-driver": "fuse-overlayfs"
|
|
}
|
|
register: grimmory_docker_config
|
|
|
|
- name: Enable Docker service
|
|
ansible.builtin.systemd:
|
|
name: docker
|
|
enabled: true
|
|
state: "{{ 'restarted' if grimmory_docker_config.changed else 'started' }}"
|
|
|
|
- name: Allow SSH from the HomeLab LAN
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "22"
|
|
proto: tcp
|
|
src: "{{ homelab_lan_cidr }}"
|
|
|
|
- name: Allow SSH from the OpenVPN network
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "22"
|
|
proto: tcp
|
|
src: "{{ openvpn_network_cidr }}"
|
|
|
|
- name: Allow Grimmory from the HomeLab LAN
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "6060"
|
|
proto: tcp
|
|
src: "{{ homelab_lan_cidr }}"
|
|
|
|
- name: Allow Grimmory from the OpenVPN network
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "6060"
|
|
proto: tcp
|
|
src: "{{ openvpn_network_cidr }}"
|
|
|
|
- name: Allow Node Exporter from the monitoring LXC
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "9100"
|
|
proto: tcp
|
|
src: 192.168.1.30
|
|
|
|
- name: Enable restrictive Grimmory firewall
|
|
community.general.ufw:
|
|
state: enabled
|
|
policy: deny
|
|
direction: incoming
|
|
|
|
- name: Create Grimmory directories
|
|
ansible.builtin.file:
|
|
path: "{{ item.path }}"
|
|
state: directory
|
|
owner: "{{ item.owner }}"
|
|
group: "{{ item.group }}"
|
|
mode: "{{ item.mode }}"
|
|
loop:
|
|
- { path: "{{ grimmory_root }}", owner: root, group: root, mode: "0750" }
|
|
- { path: "{{ grimmory_root }}/data", owner: "1000", group: "1000", mode: "0750" }
|
|
- { path: "{{ grimmory_root }}/books", owner: "1000", group: "1000", mode: "0750" }
|
|
- { path: "{{ grimmory_root }}/bookdrop", owner: "1000", group: "1000", mode: "0750" }
|
|
- { path: "{{ grimmory_root }}/mariadb", owner: "1000", group: "1000", mode: "0750" }
|
|
- { path: "{{ grimmory_root }}/backup-staging", owner: root, group: root, mode: "0700" }
|
|
|
|
- name: Generate Grimmory secrets once
|
|
ansible.builtin.shell: |
|
|
set -eu
|
|
umask 077
|
|
if [ -e {{ grimmory_root }}/.env ]; then
|
|
exit 0
|
|
fi
|
|
db_password=$(openssl rand -hex 32)
|
|
root_password=$(openssl rand -hex 32)
|
|
cat > {{ grimmory_root }}/.env <<EOF
|
|
TZ=Europe/Moscow
|
|
APP_USER_ID=1000
|
|
APP_GROUP_ID=1000
|
|
DB_USER_ID=1000
|
|
DB_GROUP_ID=1000
|
|
DB_PASSWORD=$db_password
|
|
MYSQL_ROOT_PASSWORD=$root_password
|
|
EOF
|
|
printf created
|
|
args:
|
|
executable: /bin/sh
|
|
register: grimmory_secrets
|
|
changed_when: grimmory_secrets.stdout == 'created'
|
|
no_log: true
|
|
|
|
- name: Enforce Grimmory secret file permissions
|
|
ansible.builtin.file:
|
|
path: "{{ grimmory_root }}/.env"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
|
|
- name: Install Grimmory environment example
|
|
ansible.builtin.copy:
|
|
dest: "{{ grimmory_root }}/.env.example"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: |
|
|
TZ=Europe/Moscow
|
|
APP_USER_ID=1000
|
|
APP_GROUP_ID=1000
|
|
DB_USER_ID=1000
|
|
DB_GROUP_ID=1000
|
|
DB_PASSWORD=replace-with-random-password
|
|
MYSQL_ROOT_PASSWORD=replace-with-separate-random-password
|
|
|
|
- name: Install Grimmory Compose configuration
|
|
ansible.builtin.copy:
|
|
dest: "{{ grimmory_root }}/compose.yml"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: |
|
|
services:
|
|
grimmory:
|
|
image: {{ grimmory_image }}
|
|
container_name: grimmory
|
|
environment:
|
|
USER_ID: "${APP_USER_ID}"
|
|
GROUP_ID: "${APP_GROUP_ID}"
|
|
TZ: "${TZ}"
|
|
DATABASE_URL: jdbc:mariadb://mariadb:3306/grimmory
|
|
DATABASE_USERNAME: grimmory
|
|
DATABASE_PASSWORD: "${DB_PASSWORD}"
|
|
DISK_TYPE: LOCAL
|
|
ALLOWED_ORIGINS: https://books.ada-dev.ru
|
|
depends_on:
|
|
mariadb:
|
|
condition: service_healthy
|
|
ports:
|
|
- "192.168.1.34:6060:6060"
|
|
volumes:
|
|
- ./data:/app/data
|
|
- ./books:/books
|
|
- ./bookdrop:/bookdrop
|
|
restart: unless-stopped
|
|
|
|
mariadb:
|
|
image: {{ grimmory_mariadb_image }}
|
|
container_name: grimmory-mariadb
|
|
environment:
|
|
PUID: "${DB_USER_ID}"
|
|
PGID: "${DB_GROUP_ID}"
|
|
TZ: "${TZ}"
|
|
MYSQL_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD}"
|
|
MYSQL_DATABASE: grimmory
|
|
MYSQL_USER: grimmory
|
|
MYSQL_PASSWORD: "${DB_PASSWORD}"
|
|
volumes:
|
|
- ./mariadb:/config
|
|
healthcheck:
|
|
test: ["CMD", "mariadb-admin", "ping", "-h", "localhost"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 20
|
|
restart: unless-stopped
|
|
register: grimmory_compose
|
|
|
|
- name: Install Docker firewall script
|
|
ansible.builtin.copy:
|
|
dest: /usr/local/sbin/grimmory-docker-firewall
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
content: |
|
|
#!/bin/sh
|
|
set -eu
|
|
iptables -N GRIMMORY-FILTER 2>/dev/null || true
|
|
iptables -F GRIMMORY-FILTER
|
|
iptables -A GRIMMORY-FILTER -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
iptables -A GRIMMORY-FILTER -s {{ homelab_lan_cidr }} -p tcp -m conntrack --ctorigdst 192.168.1.34 --ctorigdstport 6060 -j ACCEPT
|
|
iptables -A GRIMMORY-FILTER -s {{ openvpn_network_cidr }} -p tcp -m conntrack --ctorigdst 192.168.1.34 --ctorigdstport 6060 -j ACCEPT
|
|
iptables -A GRIMMORY-FILTER -p tcp -m conntrack --ctorigdst 192.168.1.34 --ctorigdstport 6060 -j DROP
|
|
iptables -A GRIMMORY-FILTER -j RETURN
|
|
iptables -C DOCKER-USER -j GRIMMORY-FILTER 2>/dev/null || iptables -I DOCKER-USER 1 -j GRIMMORY-FILTER
|
|
register: grimmory_firewall_script
|
|
|
|
- name: Install Docker firewall service
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/grimmory-docker-firewall.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: |
|
|
[Unit]
|
|
Description=Restrict Grimmory Docker published port
|
|
After=docker.service
|
|
Requires=docker.service
|
|
Before=grimmory.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/grimmory-docker-firewall
|
|
RemainAfterExit=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
register: grimmory_firewall_unit
|
|
|
|
- name: Install Grimmory systemd unit
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/grimmory.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: |
|
|
[Unit]
|
|
Description=Grimmory Compose stack
|
|
Wants=network-online.target
|
|
After=network-online.target docker.service grimmory-docker-firewall.service
|
|
Requires=docker.service grimmory-docker-firewall.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
WorkingDirectory={{ grimmory_root }}
|
|
ExecStart=/usr/bin/docker compose -f {{ grimmory_root }}/compose.yml up -d --remove-orphans
|
|
ExecStop=/usr/bin/docker compose -f {{ grimmory_root }}/compose.yml down
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
register: grimmory_unit
|
|
|
|
- name: Reload systemd for Grimmory units
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
when: grimmory_firewall_unit.changed or grimmory_unit.changed
|
|
|
|
- name: Enable and apply Docker firewall
|
|
ansible.builtin.systemd:
|
|
name: grimmory-docker-firewall
|
|
enabled: true
|
|
state: "{{ 'restarted' if grimmory_firewall_script.changed or grimmory_firewall_unit.changed else 'started' }}"
|
|
|
|
- name: Validate Grimmory Compose configuration
|
|
ansible.builtin.command: docker compose -f {{ grimmory_root }}/compose.yml config --quiet
|
|
args:
|
|
chdir: "{{ grimmory_root }}"
|
|
changed_when: false
|
|
no_log: true
|
|
|
|
- name: Enable and start Grimmory
|
|
ansible.builtin.systemd:
|
|
name: grimmory
|
|
enabled: true
|
|
state: "{{ 'restarted' if grimmory_compose.changed or grimmory_unit.changed else 'started' }}"
|
|
|
|
- name: Wait for Grimmory health endpoint
|
|
ansible.builtin.uri:
|
|
url: http://192.168.1.34:6060/api/v1/healthcheck
|
|
status_code: 200
|
|
register: grimmory_health
|
|
retries: 120
|
|
delay: 5
|
|
until: grimmory_health.status == 200
|
|
|
|
- name: Verify Docker storage driver
|
|
ansible.builtin.command: docker info --format '{{ "{{" }}.Driver{{ "}}" }}'
|
|
register: grimmory_docker_driver
|
|
changed_when: false
|
|
failed_when: grimmory_docker_driver.stdout != 'fuse-overlayfs'
|