feat: Buncha shit

inventory/my-cluster/group_vars/all.yml

@@ -91,4 +91,22 @@ dns_cloudflare_api_key: !vault |
           64313165343933343535623731393536396332613336316239363764653565346535666531656433
           6131646439656638323561643264613834356662363332323835
 
-dns_cloudflare_email: cloudflare@lino.cooking
+dns_cloudflare_email: cloudflare@lino.cooking
+
+cloudflare_ddns_api_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          32353865663337376239333232376630616436643435343862346164353466356563623930386461
+          3132306361653330356663613534626463373133616132620a313161316137313838666534313737
+          34336161373334356630326432626139666566316663373630656538333331656461373631613931
+          6364313538663464350a343061383835663264616238353965656635343564306635303830343266
+          38396530393133646133643232363061386265373234373832656135393764346462666566656264
+          3635316261393863393736383132386133313666306234343666
+
+homeassistant_pwd: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          34623865646265653733666136316164303765633036616464626133306339393032336465613735
+          3139333561366530383535363834316138303338313030390a306561366265643737623833633837
+          31353332646635353339373937393134376566643539363563613061393731623931643931336566
+          3039626631643930650a393163643534353731316261376638643736623232366431396136313666
+          37613864396630306335626532633832653633346465316332356236393239653063393630323461
+          3862316639643265373166373330333936303233383333653362

inventory/my-cluster/host_vars/cloudflare-ddns

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.16
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 607

inventory/my-cluster/host_vars/dahua-to-mqtt

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.17
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 608

inventory/my-cluster/host_vars/daruk

@@ -1,7 +0,0 @@
----
-ansible_user: root
-ansible_host: 10.0.2.6
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.2.6
-# interface which will be used for flannel
-flannel_iface: "vmbr0"

inventory/my-cluster/host_vars/frigate

@@ -3,3 +3,4 @@
 ansible_user: root
 ansible_host: 10.0.2.14
 ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 605

inventory/my-cluster/host_vars/swag

@@ -3,3 +3,4 @@
 ansible_user: root
 ansible_host: 10.0.2.15
 ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 606

inventory/my-cluster/hosts.ini

@@ -1,4 +1,7 @@
 frigate
+swag
+cloudflare-ddns
+dahua-to-mqtt
 
 [master]
 mipha
@@ -7,9 +10,6 @@ yuga
 
 [node]
 revali
-; daruk
-; tingle
-; impa
 
 [k3s_cluster:children]
 master
@@ -22,18 +22,9 @@ k3s_cluster
 mipha
 epona
 revali
-; daruk
 yuga
 
 [pihole]
 epona-pihole
 revali-pihole
 urbosa-pihole
-
-; [raspi]
-; tingle
-; impa
-
-[ingress]
-swag
-authelia

playbook-cloudflare-ddns.yml

@@ -0,0 +1,19 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    # - role: cloudflare-ddns/provision/delete
+    - role: cloudflare-ddns/provision/create
+    - role: cloudflare-ddns/provision/start
+
+- hosts: revali
+  become: yes
+  roles:
+    - role: lxc/enable-ssh
+
+- hosts: cloudflare-ddns
+  become: yes
+  roles:
+    - role: cloudflare-ddns/update
+    - role: cloudflare-ddns/install-docker
+    - role: cloudflare-ddns/install-app

playbook-dahua-to-mqtt.yml

@@ -0,0 +1,23 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    # - role: dahua-to-mqtt/provision/delete
+    # - role: dahua-to-mqtt/provision/create
+    - role: dahua-to-mqtt/provision/start
+      vars:
+        vmid: 608
+
+- hosts: revali
+  become: yes
+  roles:
+    - role: dahua-to-mqtt/enable-ssh
+      vars:
+        vmid: 608
+
+- hosts: dahua-to-mqtt
+  become: yes
+  roles:
+    - role: dahua-to-mqtt/update
+    - role: dahua-to-mqtt/install-docker
+    - role: dahua-to-mqtt/install-app

playbook-frigate.yml

@@ -18,7 +18,7 @@
 - hosts: epona
   become: yes
   roles:
-    - role: frigate/provision/enable-ssh
+    - role: lxc/enable-ssh
 
 - hosts: frigate
   become: yes

playbook-swag.yml

@@ -9,7 +9,7 @@
 # - hosts: mipha
 #   become: yes
 #   roles:
-#     - role: swag/provision/enable-ssh
+#     - role: lxc/enable-ssh
 
 - hosts: swag
   become: yes

playbook-update-lxc.yml

@@ -0,0 +1,15 @@
+---
+- hosts: frigate
+  become: yes
+  roles:
+    - role: frigate/update
+
+- hosts: cloudflare-ddns
+  become: yes
+  roles:
+    - role: cloudflare-ddns/update
+
+- hosts: swag
+  become: yes
+  roles:
+    - role: swag/update

roles/cloudflare-ddns/install-app/tasks/main.yml

@@ -0,0 +1,20 @@
+---
+- name: Create directory for docker-compose
+  ansible.builtin.file:
+    path: /root/docker/swag/
+    state: directory
+    mode: "0755"
+
+- name: Copy docker-compose file
+  template:
+    src: "docker-compose.yml"
+    dest: /root/docker/swag/docker-compose.yml
+    owner: root
+    group: root
+    mode: 0755
+
+- name: Run docker-compose
+  ansible.builtin.shell:
+  args:
+    cmd: docker compose up -d
+    chdir: /root/docker/swag/

roles/cloudflare-ddns/install-app/templates/docker-compose.yml

@@ -0,0 +1,11 @@
+version: '3'
+
+services:
+  app:
+    image: oznu/cloudflare-ddns:latest
+    container_name: cloudflare-ddns
+    restart: always
+    environment:
+      - API_KEY={{ cloudflare_ddns_api_key }}
+      - ZONE=lino.cooking
+      - PROXIED=false

roles/cloudflare-ddns/install-docker/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Get convenience script
+  uri:
+    url: "https://get.docker.com"
+    method: GET
+    dest: /tmp/get-docker.sh
+    mode: a+x
+    creates: /tmp/get-docker.sh
+
+- name: Execute script
+  ansible.builtin.shell: /tmp/get-docker.sh
+
+- name: Ensure group "docker" exists
+  ansible.builtin.group:
+    name: docker
+    state: present
+
+- name: Add root user to docker group
+  ansible.builtin.user:
+    name: root
+    groups: docker
+    append: yes
+
+- name: Enable docker on startup
+  ansible.builtin.shell: |
+    systemctl enable docker.service
+    systemctl enable containerd.service

roles/cloudflare-ddns/provision/create/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Create container
+  community.general.proxmox:
+    vmid: 607
+    node: revali
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    password: "{{ lxc_password }}"
+    hostname: cloudflare-ddns
+    ostemplate: "hyrule-8tb-nfs:vztmpl/debian-11-standard_11.3-1_amd64.tar.zst"
+    netif: "{'net0':'name=eth0,\
+      gw=10.0.0.1,\
+      ip=10.0.2.16/21,\
+      hwaddr=cc:c6:cf:de:17:76,\
+      bridge=vmbr0'}"
+    cores: 1
+    memory: 512
+    unprivileged: no
+    swap: 0
+    searchdomain: "home"
+    onboot: 1
+    features:
+      - nesting=1
+      - keyctl=1
+    disk: local-lvm:10
+    force: yes

roles/cloudflare-ddns/provision/delete/tasks/main.yml

@@ -0,0 +1,26 @@
+---
+- name: Stop container
+  community.general.proxmox:
+    vmid: 607
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    state: stopped
+  ignore_errors: true
+  timeout: 90
+
+- name: Remove containers
+  community.general.proxmox:
+    vmid: 607
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    state: absent
+  ignore_errors: true
+  timeout: 90
+
+- name: Remove .ssh/known_hosts lines
+  ansible.builtin.lineinfile:
+    path: /Users/lino.silva/.ssh/known_hosts
+    state: absent
+    regexp: "^10.0.2.16"

roles/cloudflare-ddns/provision/start/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Start deployments
+  community.general.proxmox:
+    vmid: 607
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    state: started

roles/cloudflare-ddns/update/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Update all packages to their latest version
+  become: true
+  ansible.builtin.apt:
+    update_cache: yes
+    upgrade: full

roles/dahua-to-mqtt/enable-ssh/tasks/main.yml

@@ -2,7 +2,7 @@
 # Unable to use ansible.builtin.lineinfile, because we need to run this through the proxmox host (because SSH is not enabled duh)
 
 - name: Allow SSH into LXC
-  ansible.builtin.command: lxc-attach -n 605 -- sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
+  ansible.builtin.command: lxc-attach -n 608 -- sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
 
 - name: Restart SSH Service
-  ansible.builtin.command: lxc-attach -n 605 service ssh restart
+  ansible.builtin.command: lxc-attach -n 608 service ssh restart

roles/dahua-to-mqtt/install-app/tasks/main.yml

@@ -0,0 +1,20 @@
+---
+- name: Create directory for docker-compose
+  ansible.builtin.file:
+    path: /root/docker/swag/
+    state: directory
+    mode: "0755"
+
+- name: Copy docker-compose file
+  template:
+    src: "docker-compose.yml"
+    dest: /root/docker/swag/docker-compose.yml
+    owner: root
+    group: root
+    mode: 0755
+
+- name: Run docker-compose
+  ansible.builtin.shell:
+  args:
+    cmd: docker compose up -d
+    chdir: /root/docker/swag/

roles/dahua-to-mqtt/install-app/templates/docker-compose.yml

@@ -0,0 +1,18 @@
+version: '3'
+services:
+  dahuavto2mqtt:
+    image: "registry.gitlab.com/elad.bar/dahuavto2mqtt:latest"
+    container_name: "dahua2mqtt"
+    hostname: "dahua2mqtt"
+    restart: "unless-stopped"
+    environment:
+      - DAHUA_VTO_HOST=10.0.0.100
+      - DAHUA_VTO_USERNAME=admin
+      - DAHUA_VTO_PASSWORD=admin1234
+      - MQTT_BROKER_HOST=10.0.2.100
+      - MQTT_BROKER_PORT=1883 
+      - MQTT_BROKER_USERNAME=lino
+      - MQTT_BROKER_PASSWORD={{ homeassistant_pwd }} 
+      - MQTT_BROKER_TOPIC_PREFIX=DahuaVTO
+      - MQTT_BROKER_CLIENT_ID=DahuaVTO2MQTT
+      - DEBUG=False

roles/dahua-to-mqtt/install-docker/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Get convenience script
+  uri:
+    url: "https://get.docker.com"
+    method: GET
+    dest: /tmp/get-docker.sh
+    mode: a+x
+    creates: /tmp/get-docker.sh
+
+- name: Execute script
+  ansible.builtin.shell: /tmp/get-docker.sh
+
+- name: Ensure group "docker" exists
+  ansible.builtin.group:
+    name: docker
+    state: present
+
+- name: Add root user to docker group
+  ansible.builtin.user:
+    name: root
+    groups: docker
+    append: yes
+
+- name: Enable docker on startup
+  ansible.builtin.shell: |
+    systemctl enable docker.service
+    systemctl enable containerd.service

roles/dahua-to-mqtt/provision/create/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Create container
+  community.general.proxmox:
+    vmid: 608
+    node: revali
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    password: "{{ lxc_password }}"
+    hostname: dahua-to-mqtt
+    ostemplate: "hyrule-8tb-nfs:vztmpl/debian-11-standard_11.3-1_amd64.tar.zst"
+    netif: "{'net0':'name=eth0,\
+      gw=10.0.0.1,\
+      ip=10.0.2.17/21,\
+      hwaddr=cc:c6:cf:de:17:77,\
+      bridge=vmbr0'}"
+    cores: 1
+    memory: 256
+    unprivileged: no
+    swap: 0
+    searchdomain: "home"
+    onboot: 1
+    features:
+      - nesting=1
+      - keyctl=1
+    disk: local-lvm:5
+    force: yes

roles/dahua-to-mqtt/provision/delete/tasks/main.yml

@@ -0,0 +1,26 @@
+---
+- name: Stop container
+  community.general.proxmox:
+    vmid: "{{ vmid }}"
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    state: stopped
+  ignore_errors: true
+  timeout: 90
+
+- name: Remove containers
+  community.general.proxmox:
+    vmid: "{{ vmid }}"
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    state: absent
+  ignore_errors: true
+  timeout: 90
+
+- name: Remove .ssh/known_hosts lines
+  ansible.builtin.lineinfile:
+    path: /Users/lino.silva/.ssh/known_hosts
+    state: absent
+    regexp: "^10.0.2.16"

roles/dahua-to-mqtt/provision/start/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Start deployments
+  community.general.proxmox:
+    vmid: "{{ vmid }}"
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    state: started

roles/dahua-to-mqtt/update/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Update all packages to their latest version
+  become: true
+  ansible.builtin.apt:
+    update_cache: yes
+    upgrade: full

roles/pihole/provision/enable-ssh/tasks/main.yml

@@ -1,8 +0,0 @@
----
-# Unable to use ansible.builtin.lineinfile, because we need to run this through the proxmox host (because SSH is not enabled duh)
-
-- name: Allow SSH into LXC
-  ansible.builtin.command: lxc-attach -n "{{ vmid }}" -- sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
-
-- name: Restart SSH Service
-  ansible.builtin.command: lxc-attach -n "{{ vmid }}" service ssh restart

roles/swag/install-app/templates/docker-compose.yml

@@ -24,8 +24,6 @@ services:
       - 443:443
       - 80:80
     restart: unless-stopped
-    networks:
-      - reverse-proxy
 
   authelia:
     image: authelia/authelia:latest
@@ -37,9 +35,3 @@ services:
     volumes:
       - /data/authelia/config:/config
     restart: unless-stopped
-    networks:
-      - reverse-proxy
-
-networks:
-  reverse-proxy:
-    external: true

roles/swag/install-docker/tasks/main.yml

@@ -25,7 +25,3 @@
   ansible.builtin.shell: |
     systemctl enable docker.service
     systemctl enable containerd.service
-
-- name: Create reverse-proxy network
-  ansible.builtin.shell: |
-    docker network create reverse-proxy

roles/swag/provision/enable-ssh/tasks/main.yml

@@ -1,8 +0,0 @@
----
-# Unable to use ansible.builtin.lineinfile, because we need to run this through the proxmox host (because SSH is not enabled duh)
-
-- name: Allow SSH into LXC
-  ansible.builtin.command: lxc-attach -n 606 -- sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
-
-- name: Restart SSH Service
-  ansible.builtin.command: lxc-attach -n 606 service ssh restart