feat: Changed IP for impa

inventory/my-cluster/host_vars/impa

@@ -1,9 +1,10 @@
 ---
 
 ansible_user: root
-ansible_host: 10.0.3.111
+ansible_host: 10.0.2.1
 ansible_ssh_pass: "{{ proxmox_api_password }}"
+ip_addr: 10.0.2.2
 
 # interface which will be used for flannel
 
-flannel_iface: "eth0"
+flannel_iface: "vmbr0"

inventory/my-cluster/host_vars/openvpn

@@ -1,6 +1,6 @@
 ---
 
 ansible_user: root
-ansible_host: 10.0.0.2
+ansible_host: 10.0.2.22
 ansible_ssh_pass: "{{ proxmox_api_password }}"
-
+vmid: 613

inventory/my-cluster/host_vars/youtube-downloader

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.23
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 614

inventory/my-cluster/hosts.ini

@@ -7,13 +7,15 @@ immich
 folding
 mastodon
 tautulli
+openvpn
+youtube-downloader
 
 [baremetal]
 mipha
 epona
 revali
 yuga
-hyrule
+impa
 
 [pihole]
 epona-pihole

playbook-openvpn.yml

@@ -0,0 +1,42 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    - role: openvpn/provision/stop
+    - role: openvpn/provision/delete
+    - role: openvpn/provision/create
+    - role: openvpn/provision/start
+      vars:
+        vmid: 613
+
+- hosts: mipha
+  become: yes
+  roles:
+    - role: openvpn/enable-ssh
+      vars:
+        vmid: 613
+
+- hosts: localhost
+  become: yes
+  roles:
+    - role: openvpn/provision/stop
+      vars:
+        vmid: 613
+
+- hosts: mipha
+  become: yes
+  roles:
+    - role: openvpn/cgroup-rules
+
+- hosts: localhost
+  become: yes
+  roles:
+    - role: openvpn/provision/start
+      vars:
+        vmid: 613
+
+- hosts: openvpn
+  become: yes
+  roles:
+    - role: openvpn/update
+    - role: openvpn/install-app

playbook-youtube-downloader.yml

@@ -0,0 +1,23 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    - role: youtube-downloader/provision/delete
+    - role: youtube-downloader/provision/create
+    - role: youtube-downloader/provision/start
+      vars:
+        vmid: 614
+
+- hosts: impa
+  become: yes
+  roles:
+    - role: youtube-downloader/enable-ssh
+      vars:
+        vmid: 614
+
+- hosts: youtube-downloader
+  become: yes
+  roles:
+    - role: youtube-downloader/update
+    - role: youtube-downloader/install-docker
+    - role: youtube-downloader/install-app

roles/openvpn/cgroup-rules/tasks/main.yml

@@ -0,0 +1,14 @@
+---
+- name: Add cgroup rule
+  ansible.builtin.blockinfile:
+    path: /etc/pve/nodes/mipha/lxc/613.conf
+    state: present
+    block: |
+      lxc.cgroup2.devices.allow: c 10:200 rwm
+      lxc.mount.entry: /dev/net dev/net none bind,create=dir
+
+- name: Change /dev/net/tun ownership
+  ansible.builtin.file:
+    path: /dev/net/tun
+    owner: 100000
+    group: 100000

roles/openvpn/enable-ssh/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+# Unable to use ansible.builtin.lineinfile, because we need to run this through the proxmox host (because SSH is not enabled duh)
+
+- name: Allow SSH into LXC
+  ansible.builtin.command: lxc-attach -n 613 -- sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
+
+- name: Restart SSH Service
+  ansible.builtin.command: lxc-attach -n 613 service ssh restart

roles/openvpn/install-app/tasks/main.yml

@@ -0,0 +1,19 @@
+---
+- name: Install openvpn
+  ansible.builtin.apt:
+    name: openvpn
+    state: present
+    update_cache: yes
+
+- name: Install git
+  ansible.builtin.apt:
+    name: git
+    state: present
+    update_cache: yes
+
+- name: Example clone of a single branch
+  ansible.builtin.git:
+    repo: https://github.com/Nyr/openvpn-install
+    dest: /root/openvpn-install
+    single_branch: yes
+    version: master

roles/openvpn/provision/create/tasks/main.yml

@@ -0,0 +1,30 @@
+---
+- name: Create container
+  community.general.proxmox:
+    vmid: 613
+    node: mipha
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    password: "{{ lxc_password }}"
+    hostname: openvpn
+    ostemplate: "hyrule-8tb-nfs:vztmpl/debian-11-standard_11.3-1_amd64.tar.zst"
+    netif: "{'net0': '\
+        name=eth0,\
+        gw=10.0.0.1,\
+        ip=10.0.2.22/21,\
+        firewall=1,\
+        hwaddr=cc:c6:cf:de:17:82,\
+        type=veth,\
+        bridge=vmbr0\
+      '}"
+    cores: 2
+    memory: 2048
+    unprivileged: yes
+    swap: 512
+    searchdomain: "home"
+    onboot: 1
+    features:
+      - nesting=1
+    disk: local-lvm:4
+    force: yes

roles/openvpn/provision/delete/tasks/main.yml

@@ -0,0 +1,16 @@
+---
+- name: Remove containers
+  community.general.proxmox:
+    vmid: "{{ vmid }}"
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    state: absent
+  ignore_errors: true
+  timeout: 90
+
+- name: Remove .ssh/known_hosts lines
+  ansible.builtin.lineinfile:
+    path: /Users/lino.silva/.ssh/known_hosts
+    state: absent
+    regexp: "^10.0.2.22"

roles/openvpn/provision/start/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Start deployments
+  community.general.proxmox:
+    vmid: "{{ vmid }}"
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    state: started

roles/openvpn/provision/stop/tasks/main.yml

@@ -0,0 +1,10 @@
+---
+- name: Stop container
+  community.general.proxmox:
+    vmid: "{{ vmid }}"
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    state: stopped
+  ignore_errors: true
+  timeout: 90

roles/openvpn/update/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Update all packages to their latest version
+  become: true
+  ansible.builtin.apt:
+    update_cache: yes
+    upgrade: full

roles/swag/install-app/templates/bazarr.subdomain.conf

@@ -37,7 +37,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 6767;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
@@ -47,7 +47,7 @@ server {
     location ~ (/bazarr)?/api {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 6767;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/swag/install-app/templates/changedetection.subdomain.conf

@@ -37,7 +37,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 5000;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/swag/install-app/templates/cloud.subdomain.conf

@@ -27,7 +27,7 @@ server {
     location / {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 8001;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/swag/install-app/templates/gitea.subdomain.conf

@@ -42,7 +42,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 3000;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/swag/install-app/templates/lidarr.subdomain.conf

@@ -37,7 +37,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 8686;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
@@ -47,7 +47,7 @@ server {
     location ~ (/lidarr)?/api {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 8686;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/swag/install-app/templates/mealie.subdomain.conf

@@ -36,7 +36,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 8002;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/swag/install-app/templates/metube.subdomain.conf

@@ -37,7 +37,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.23;
         set $upstream_port 8081;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/swag/install-app/templates/overseerr.subdomain.conf

@@ -37,7 +37,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 5055;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
@@ -47,7 +47,7 @@ server {
     location ~ (/overseerr)?/api {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 5055;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/swag/install-app/templates/paperless.subdomain.conf

@@ -36,7 +36,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 8003;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/swag/install-app/templates/portainer.subdomain.conf

@@ -37,7 +37,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 9000;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
@@ -48,7 +48,7 @@ server {
     location ~ (/portainer)?/api {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 9000;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/swag/install-app/templates/prowlarr.subdomain.conf

@@ -37,7 +37,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 9696;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
@@ -46,7 +46,7 @@ server {
     location ~ (/prowlarr)?(/[0-9]+)?/api {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 9696;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/swag/install-app/templates/radarr.subdomain.conf

@@ -37,7 +37,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 7878;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
@@ -47,7 +47,7 @@ server {
     location ~ (/radarr)?/api {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 7878;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/swag/install-app/templates/sonarr.subdomain.conf

@@ -37,7 +37,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 8989;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
@@ -47,7 +47,7 @@ server {
     location ~ (/sonarr)?/api {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 8989;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/swag/install-app/templates/transmission.subdomain.conf

@@ -46,7 +46,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 9091;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
@@ -57,7 +57,7 @@ server {
     location ~ (/transmission)?/rpc {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 9091;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/swag/install-app/templates/vaultwarden.subdomain.conf

@@ -38,7 +38,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 8004;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
@@ -61,7 +61,7 @@ server {
 
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 8004;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
@@ -71,7 +71,7 @@ server {
     location ~ (/pwds)?/api {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 8004;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
@@ -81,7 +81,7 @@ server {
     location ~ (/pwds)?/notifications/hub {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 3012;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
@@ -91,7 +91,7 @@ server {
     location ~ (/pwds)?/notifications/hub/negotiate {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
-        set $upstream_app 10.0.0.2;
+        set $upstream_app 10.0.2.1;
         set $upstream_port 8004;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;

roles/youtube-downloader/enable-ssh/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+# Unable to use ansible.builtin.lineinfile, because we need to run this through the proxmox host (because SSH is not enabled duh)
+
+- name: Allow SSH into LXC
+  ansible.builtin.command: lxc-attach -n 614 -- sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
+
+- name: Restart SSH Service
+  ansible.builtin.command: lxc-attach -n 614 service ssh restart

roles/youtube-downloader/install-app/tasks/main.yml

@@ -0,0 +1,20 @@
+---
+- name: Create directory for docker-compose
+  ansible.builtin.file:
+    path: /root/docker/
+    state: directory
+    mode: "0755"
+
+- name: Copy docker-compose file
+  template:
+    src: "docker-compose.yml"
+    dest: /root/docker/docker-compose.yml
+    owner: root
+    group: root
+    mode: 0755
+
+- name: Run docker-compose
+  ansible.builtin.shell:
+  args:
+    cmd: docker compose up -d
+    chdir: /root/docker/

roles/youtube-downloader/install-app/templates/docker-compose.yml

@@ -0,0 +1,10 @@
+version: "3"
+services:
+  metube:
+    image: alexta69/metube
+    container_name: metube
+    restart: unless-stopped
+    ports:
+      - 8081:8081
+    volumes:
+      - /downloads:/downloads

roles/youtube-downloader/install-docker/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Get convenience script
+  uri:
+    url: "https://get.docker.com"
+    method: GET
+    dest: /tmp/get-docker.sh
+    mode: a+x
+    creates: /tmp/get-docker.sh
+
+- name: Execute script
+  ansible.builtin.shell: /tmp/get-docker.sh
+
+- name: Ensure group "docker" exists
+  ansible.builtin.group:
+    name: docker
+    state: present
+
+- name: Add root user to docker group
+  ansible.builtin.user:
+    name: root
+    groups: docker
+    append: yes
+
+- name: Enable docker on startup
+  ansible.builtin.shell: |
+    systemctl enable docker.service
+    systemctl enable containerd.service

roles/youtube-downloader/provision/create/tasks/main.yml

@@ -0,0 +1,31 @@
+---
+- name: Create container
+  community.general.proxmox:
+    vmid: 614
+    node: impa
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    password: "{{ lxc_password }}"
+    hostname: youtube-downloader
+    ostemplate: "hyrule-8tb-nfs:vztmpl/debian-11-standard_11.3-1_amd64.tar.zst"
+    netif: "{'net0':'name=eth0,\
+      gw=10.0.0.1,\
+      ip=10.0.2.23/21,\
+      hwaddr=cc:c6:cf:de:17:83,\
+      bridge=vmbr0'}"
+    cores: 1
+    memory: 1024
+    unprivileged: no
+    swap: 0
+    searchdomain: "home"
+    onboot: 1
+    features:
+      - nesting=1
+      - keyctl=1
+    disk: ssd250:5
+    mounts: '{
+      "mp1":"/mnt/8TB/Youtube,mp=/downloads"
+      }'
+
+    force: yes

roles/youtube-downloader/provision/delete/tasks/main.yml

@@ -0,0 +1,26 @@
+---
+- name: Stop container
+  community.general.proxmox:
+    vmid: "{{ vmid }}"
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    state: stopped
+  ignore_errors: true
+  timeout: 90
+
+- name: Remove containers
+  community.general.proxmox:
+    vmid: "{{ vmid }}"
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    state: absent
+  ignore_errors: true
+  timeout: 90
+
+- name: Remove .ssh/known_hosts lines
+  ansible.builtin.lineinfile:
+    path: /Users/lino.silva/.ssh/known_hosts
+    state: absent
+    regexp: "^10.0.2.23"

roles/youtube-downloader/provision/start/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Start deployments
+  community.general.proxmox:
+    vmid: "{{ vmid }}"
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    state: started

roles/youtube-downloader/update/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Update all packages to their latest version
+  become: true
+  ansible.builtin.apt:
+    update_cache: yes
+    upgrade: full