DmitryandClaude Sonnet 5
e0c53a1b1b
.env is now consumed by both Ansible and OpenTofu, so keep a single copy at the repo root instead of ansible/.env: - rename ansible/.env.example -> .env.example. - Makefile: ENV_FILE ?= $(REPO_ROOT)/.env (absolute, works from any cwd); REQUIRE_ENV/LOAD_ENV updated; help text. - bootstrap-pve-api-token.yml / bootstrap-monitoring-pve-token.yml write and read ../../.env; bootstrap now keeps backup: true (it rewrites the whole file, clobbering MONITORING_*/EMERGENCY_*/PROXMOX_ROOT_PASSWORD). - roles/pve_lxc, roles/monitoring_server: fail_msg points at the repo-root .env. The Makefile also picks up the new targets added by later commits (tofu-*, validate, pbs-storage, ru-vps-base, zerotier-decommission); they are grouped here so all recipes land together. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V
61 lines
2.6 KiB
YAML
61 lines
2.6 KiB
YAML
- name: Bootstrap Proxmox API token for Ansible
|
|
hosts: mini-pc
|
|
gather_facts: false
|
|
become: true
|
|
vars:
|
|
pve_api_user: ansible@pve
|
|
pve_api_token_id: homelab
|
|
pve_api_role: Administrator
|
|
tasks:
|
|
- name: Ensure Proxmox API user exists
|
|
ansible.builtin.command: "pveum user add {{ pve_api_user }} --comment 'Ansible automation user'"
|
|
register: pve_user_add
|
|
changed_when: pve_user_add.rc == 0
|
|
failed_when:
|
|
- pve_user_add.rc != 0
|
|
- "'already exists' not in (pve_user_add.stderr | lower)"
|
|
|
|
- name: Grant Proxmox API user permissions
|
|
ansible.builtin.command: "pveum aclmod / -user {{ pve_api_user }} -role {{ pve_api_role }}"
|
|
changed_when: true
|
|
|
|
- name: Remove old Ansible token if present
|
|
ansible.builtin.command: "pveum user token remove {{ pve_api_user }} {{ pve_api_token_id }}"
|
|
register: pve_token_remove
|
|
changed_when: pve_token_remove.rc == 0
|
|
failed_when: false
|
|
no_log: true
|
|
|
|
- name: Create Proxmox API token
|
|
ansible.builtin.command: "pveum user token add {{ pve_api_user }} {{ pve_api_token_id }} --privsep 0 --comment 'HomeLab Ansible token' --output-format json"
|
|
register: pve_token_add
|
|
changed_when: true
|
|
no_log: true
|
|
|
|
- name: Store token data
|
|
ansible.builtin.set_fact:
|
|
pve_token_data: "{{ pve_token_add.stdout | from_json }}"
|
|
no_log: true
|
|
|
|
# ВНИМАНИЕ: задача переписывает файл ЦЕЛИКОМ, а не правит отдельные строки.
|
|
# Всё, что добавлено вручную или другими целями — MONITORING_*, EMERGENCY_*,
|
|
# PROXMOX_ROOT_PASSWORD — будет потеряно. Поэтому backup: true.
|
|
# Строки пишутся с префиксом `export`: по нему bootstrap-monitoring-pve-token.yml
|
|
# находит их своим lineinfile (regexp: "^export NAME="), и он же позволяет
|
|
# просто сделать `source .env` в обычном шелле.
|
|
- name: Write the local .env in the repository root
|
|
ansible.builtin.copy:
|
|
dest: "{{ playbook_dir }}/../../.env"
|
|
mode: "0600"
|
|
backup: true
|
|
content: |
|
|
export PROXMOX_HOST={{ ansible_host }}
|
|
export PROXMOX_USER='{{ pve_api_user }}'
|
|
export PROXMOX_TOKEN_ID='{{ pve_api_token_id }}'
|
|
export PROXMOX_TOKEN_SECRET='{{ pve_token_data.value }}'
|
|
export PROXMOX_VALIDATE_CERTS=false
|
|
export PVE_LXC_OSTEMPLATE='local:vztmpl/debian-13-standard_13.0-1_amd64.tar.zst'
|
|
delegate_to: localhost
|
|
become: false
|
|
no_log: true
|