Added tautulli reverse proxy conf

Added mastodon, tautulli
feat: Add folding
2023-04-12 13:53:27 +01:00 · 2023-04-12 13:50:33 +01:00 · 2023-04-04 14:32:01 +01:00 · 2023-03-27 18:23:51 +01:00 · 2023-03-26 23:26:13 +01:00 · 2023-03-26 15:51:28 +01:00
246 changed files with 21927 additions and 1180 deletions
@@ -1,17 +1,11 @@
 ---
 exclude_paths:
  # default paths
-  - '.cache/'
+  - ".cache/"
-  - '.github/'
+  - ".github/"
-  - 'test/fixtures/formatting-before/'
+  - "test/fixtures/formatting-before/"
-  - 'test/fixtures/formatting-prettier/'
+  - "test/fixtures/formatting-prettier/"
  # The "converge" and "reset" playbooks use import_playbook in
  # conjunction with the "env" lookup plugin, which lets the
  # syntax check of ansible-lint fail.
  - 'molecule/**/converge.yml'
  - 'molecule/**/prepare.yml'
  - 'molecule/**/reset.yml'
 skip_list:
-  - 'fqcn-builtins'
+  - "fqcn-builtins"
  - "name[play]"
@@ -1,3 +0,0 @@
 ---
 github: timothystewart6
 patreon: technotim
@@ -1,77 +0,0 @@
 <!-- It's a good idea to check this post first for general troubleshooting https://github.com/techno-tim/k3s-ansible/discussions/19   -->
 <!--- Provide a general summary of the issue in the Title above -->
 ## Expected Behavior
 <!--- Tell us what should happen -->
 ## Current Behavior
 <!--- Tell us what happens instead of the expected behavior -->
 ## Steps to Reproduce
 <!--- reproduce this bug. Include code to reproduce, if relevant -->
 1.
 2.
 3.
 4.
 ## Context (variables)
 <!--- please include which OS, along with the variables used when running the playbook -->
 Operating system:
 Hardware:
 ### Variables Used
 `all.yml`
 ```yml
 k3s_version: ""
 ansible_user: NA
 systemd_dir: ""
 flannel_iface: ""
 apiserver_endpoint: ""
 k3s_token: "NA"
 extra_server_args: ""
 extra_agent_args: ""
 kube_vip_tag_version: ""
 metal_lb_speaker_tag_version: ""
 metal_lb_controller_tag_version: ""
 metal_lb_ip_range: ""
 ```
 ### Hosts
 `host.ini`
 ```ini
 [master]
 IP.ADDRESS.ONE
 IP.ADDRESS.TWO
 IP.ADDRESS.THREE
 [node]
 IP.ADDRESS.FOUR
 IP.ADDRESS.FIVE
 [k3s_cluster:children]
 master
 node
 ```
 ## Possible Solution
 <!--- Not obligatory, but suggest a fix/reason for the bug, -->
 - [ ] I've checked the [General Troubleshooting Guide](https://github.com/techno-tim/k3s-ansible/discussions/20)
@@ -1,15 +0,0 @@
 # Proposed Changes
 <!--- Provide a general summary of your changes -->
 -
 -
 -
 ## Checklist
 - [ ] Tested locally
 - [ ] Ran `site.yml` playbook
 - [ ] Ran `reset.yml` playbook
 - [ ] Did not add any unnecessary changes
 - [ ] 🚀
 - [ ] Ran pre-commit install at least once before committing
@@ -1,11 +0,0 @@
 ---
 version: 2
 updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
    rebase-strategy: "auto"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]
@@ -1,37 +0,0 @@
 #!/bin/bash
 # download-boxes.sh
 # Check all molecule.yml files for required Vagrant boxes and download the ones that are not
 # already present on the system.
 set -euo pipefail
 GIT_ROOT=$(git rev-parse --show-toplevel)
 PROVIDER=virtualbox
 # Read all boxes for all platforms from the "molecule.yml" files
 all_boxes=$(cat "${GIT_ROOT}"/molecule/*/molecule.yml |
    yq -r '.platforms[].box' |         # Read the "box" property of each node under "platforms"
    grep --invert-match --regexp=--- | # Filter out file separators
    sort |
    uniq)
 # Read the boxes that are currently present on the system (for the current provider)
 present_boxes=$(
    (vagrant box list |
        grep "${PROVIDER}" | # Filter by boxes available for the current provider
        awk '{print $1;}' |  # The box name is the first word in each line
        sort |
        uniq) ||
        echo "" # In case any of these commands fails, just use an empty list
 )
 # The boxes that we need to download are the ones present in $all_boxes, but not $present_boxes.
 download_boxes=$(comm -2 -3 <(echo "${all_boxes}") <(echo "${present_boxes}"))
 # Actually download the necessary boxes
 if [ -n "${download_boxes}" ]; then
    echo "${download_boxes}" | while IFS= read -r box; do
        vagrant box add --provider "${PROVIDER}" "${box}"
    done
 fi
@@ -1,38 +0,0 @@
 ---
 name: Linting
 on:
  pull_request:
  push:
    branches:
      - master
 jobs:
  pre-commit-ci:
    name: Pre-Commit
    runs-on: ubuntu-latest
    steps:
      - name: Check out the codebase
        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
      - name: Set up Python 3.x
        uses: actions/setup-python@b55428b1882923874294fa556849718a1d7f2ca5 #4.0.2
        with:
          python-version: "3.x"
      - name: Install dependencies
        run: |
          echo "::group::Upgrade pip"
          python3 -m pip install --upgrade pip
          echo "::endgroup::"
          echo "::group::Install Python requirements from requirements.txt"
          python3 -m pip install -r requirements.txt
          echo "::endgroup::"
          echo "::group::Install Ansible role requirements from collections/requirements.yml"
          ansible-galaxy install -r collections/requirements.yml
          echo "::endgroup::"
      - name: Run pre-commit
        uses: pre-commit/action@v3.0.0
@@ -1,81 +0,0 @@
 ---
 name: Test
 on:
  pull_request:
  push:
    branches:
      - master
    paths-ignore:
      - '**/README.md'
 jobs:
  molecule:
    name: Molecule
    runs-on: macos-12
    strategy:
      matrix:
        scenario:
          - default
          - ipv6
          - single_node
      fail-fast: false
    env:
      PYTHON_VERSION: "3.10"
    steps:
      - name: Check out the codebase
        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # 3.0.2
      - name: Configure VirtualBox
        run: |-
          sudo mkdir -p /etc/vbox
          cat <<EOF | sudo tee -a /etc/vbox/networks.conf > /dev/null
          * 192.168.30.0/24
          * fdad:bad:ba55::/64
          EOF
      - name: Cache Vagrant boxes
        uses: actions/cache@fd5de65bc895cf536527842281bea11763fefd77 # 3.0.8
        with:
          path: |
            ~/.vagrant.d/boxes
          key: vagrant-boxes-${{ hashFiles('**/molecule.yml') }}
          restore-keys: |
            vagrant-boxes
      - name: Download Vagrant boxes for all scenarios
        # To save some cache space, all scenarios share the same cache key.
        # On the other hand, this means that the cache contents should be
        # the same across all scenarios. This step ensures that.
        run: ./.github/download-boxes.sh
      - name: Set up Python ${{ env.PYTHON_VERSION }}
        uses: actions/setup-python@v2
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install dependencies
        run: >-
          python3 -m pip install --upgrade pip &&
          python3 -m pip install -r requirements.txt
      - name: Test with molecule
        run: molecule test --scenario-name ${{ matrix.scenario }}
        env:
          ANSIBLE_K3S_LOG_DIR: ${{ runner.temp }}/logs/k3s-ansible/${{ matrix.scenario }}
          ANSIBLE_SSH_RETRIES: 4
          ANSIBLE_TIMEOUT: 60
          PY_COLORS: 1
          ANSIBLE_FORCE_COLOR: 1
      - name: Upload log files
        if: always() # do this even if a step before has failed
        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # 3.1.0
        with:
          name: logs
          path: |
            ${{ runner.temp }}/logs
      - name: Delete old box versions
        if: always() # do this even if a step before has failed
        run: vagrant box prune --force
@@ -1 +1,2 @@
 .env/
 *.log
@@ -0,0 +1,3 @@
 {
  "prettier.bracketSpacing": false
 }
@@ -22,13 +22,13 @@ Build a Kubernetes cluster using Ansible with k3s. The goal is easily install a
 on processor architecture:
- [X] x64
+- [x] x64
- [X] arm64
+- [x] arm64
- [X] armhf
+- [x] armhf
 ## ✅ System requirements
- Deployment environment must have Ansible 2.4.0+.  If you need a quick primer on Ansible [you can check out my docs and setting up Ansible](https://docs.technotim.live/posts/ansible-automation/).
+- Deployment environment must have Ansible 2.4.0+. If you need a quick primer on Ansible [you can check out my docs and setting up Ansible](https://docs.technotim.live/posts/ansible-automation/).
 - [`netaddr` package](https://pypi.org/project/netaddr/) must be available to Ansible. If you have installed Ansible via apt, this is already taken care of. If you have installed Ansible via `pip`, make sure to install `netaddr` into the respective virtual environment.
@@ -76,7 +76,7 @@ If needed, you can also edit `inventory/my-cluster/group_vars/all.yml` to match
 Start provisioning of the cluster using the following command:
 ```bash
-ansible-playbook site.yml -i inventory/my-cluster/hosts.ini
+ansible-playbook site.yml -i inventory/my-cluster/hosts.ini --ask-become-pass --ask-vault-pass
 ```
 After deployment control plane will be accessible via virtual ip-address which is defined in inventory/group_vars/all.yml as `apiserver_endpoint`
@@ -87,7 +87,7 @@ After deployment control plane will be accessible via virtual ip-address which i
 ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini
 ```
->You should also reboot these nodes due to the VIP not being destroyed
+> You should also reboot these nodes due to the VIP not being destroyed
 ## ⚙️ Kube Config
@@ -105,13 +105,6 @@ See the commands [here](https://docs.technotim.live/posts/k3s-etcd-ansible/#test
 Be sure to see [this post](https://github.com/techno-tim/k3s-ansible/discussions/20) on how to troubleshoot common problems
 ### Testing the playbook using molecule
 This playbook includes a [molecule](https://molecule.rtfd.io/)-based test setup.
 It is run automatically in CI, but you can also run the tests locally.
 This might be helpful for quick feedback in a few cases.
 You can find more information about it [here](molecule/README.md).
 ## Thanks 🤝
 This repo is really standing on the shoulders of giants. Thank you to all those who have contributed and tanks to these repos for code and ideas:
@@ -119,3 +112,8 @@ This repo is really standing on the shoulders of giants. Thank you to all those
 - [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible)
 - [geerlingguy/turing-pi-cluster](https://github.com/geerlingguy/turing-pi-cluster)
 - [212850a/k3s-ansible](https://github.com/212850a/k3s-ansible)
 ## TODO
 - https://docs.k3s.io/installation/kube-dashboard
 - https://www.phillipsj.net/posts/k3s-enable-nfs-storage/
@@ -1,12 +1,23 @@
 [defaults]
-nocows = True
+nocows                  = True
-roles_path = ./roles
+roles_path              = ./roles
-inventory  = ./hosts.ini
+inventory               = ./inventory/my-cluster/hosts.ini
 stdout_callback         = yaml
-remote_tmp = $HOME/.ansible/tmp
+remote_tmp              = $HOME/.ansible/tmp
-local_tmp  = $HOME/.ansible/tmp
+local_tmp               = $HOME/.ansible/tmp
-pipelining = True
+timeout                 = 60
-become = True
+host_key_checking       = False
-host_key_checking = False
+deprecation_warnings    = False
-deprecation_warnings = False
+callback_whitelist      = profile_tasks
-callback_whitelist = profile_tasks
+log_path                = ./ansible.log
 [privilege_escalation]
 become                  = True
 [ssh_connection]
 scp_if_ssh              = smart
 retries                 = 3
 ssh_args                = -o ControlMaster=auto -o ControlPersist=30m -o Compression=yes -o ServerAliveInterval=15s
 pipelining              = True
 control_path            = %(directory)s/%%h-%%r
@@ -4,3 +4,4 @@ collections:
  - name: community.general
  - name: ansible.posix
  - name: kubernetes.core
  - name: community.docker
@@ -1,3 +0,0 @@
 /*
 !.gitignore
 !sample/
@@ -0,0 +1,225 @@
 ---
 k3s_version: v1.24.6+k3s1
 # this is the user that has ssh access to these machines
 ansible_user: lino
 systemd_dir: /etc/systemd/system
 # Set your timezone
 system_timezone: "Europe/Lisbon"
 # apiserver_endpoint is virtual ip-address which will be configured on each master
 apiserver_endpoint: "10.0.3.1"
 # k3s_token is required  masters can talk together securely
 # this token should be alpha numeric only
 k3s_token: "7qXiuKpSY9uLwdVSNSnEF5RkttoERixCpc2EVJW7vh7Ws4NMN3"
 # The IP on which the node is reachable in the cluster.
 # Here, a sensible default is provided, you can still override
 # it for each of your hosts, though.
 k3s_node_ip: '{{ ansible_facts[flannel_iface]["ipv4"]["address"] }}'
 # Disable the taint manually by setting: k3s_master_taint = false
 k3s_master_taint: false
 # these arguments are recommended for servers as well as agents:
 extra_args: >-
  --flannel-iface={{ flannel_iface }}
  --node-ip={{ k3s_node_ip }}
 # change these to your liking, the only required are: --disable servicelb, --tls-san {{ apiserver_endpoint }}
 extra_server_args: >-
  {{ extra_args }}
  {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
  --tls-san {{ apiserver_endpoint }}
  --disable servicelb
  --disable traefik
 extra_agent_args: >-
  {{ extra_args }}
 # image tag for kube-vip
 kube_vip_tag_version: "v0.5.5"
 # image tag for metal lb
 metal_lb_speaker_tag_version: "v0.13.6"
 metal_lb_controller_tag_version: "v0.13.6"
 # metallb ip range for load balancer
 metal_lb_ip_range: "10.0.4.1-10.0.4.254"
 lxc_password: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  38303735306236303463613632623161643633663631303931396564346565666236643562316264
  6533643331306364653564653763356537303932313531350a393261643137636232616335376461
  66383966333765626539363561613361393665616333303964373761356166623766663232303063
  3138353333373935660a383230393330646538303933336366383736643333623663333934663131
  3064
 proxmox_api_password: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  35376334616332386130656335663736343337396532663266383934643632363664646631653935
  6533343936353734343761343465646365616130643130360a316234333036303738663566666364
  61653638373830383733323563373862346662363339656632643661336533363162616435616531
  6331326462356366320a303331616366356333306638386130666538633833623162653934616338
  3566
 traefik_http_auth_user: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  38323532616336373939646333613338626431363466633631343162636235623563393135653231
  3961383965356631613164303566393632323938386664360a373037616335643662613564353130
  30353832376431633834336234386161313062373437613132623733646166303639313364373637
  3933626639646536320a303163353835633837356530613931346165353939363235373561333836
  39366266303064393334383835323330353934643862323330343337393761353166393333376131
  33303439393531303031653361393530313930363039646566613831373366326432653634653165
  313735383263623836363030386531613033
 cloudflare_api_key: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  38363363386466666266613930386237623430646531303734613863306530666530376433633339
  3166373361393839363439326661396136616637393865630a666637366132643035343832666335
  33376139643533313730313135653064393239316162376339653965313366643565643664666534
  6631393564333230370a303634643030346166383235643666356164393232643832333238313664
  38346161306138653735303861646638653830633938326566663136393862643264353437623963
  3462616435653132623563316231343739333761653365333437
 dns_cloudflare_api_key: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          61306235353261303235646331356666643339393164333762303730646563646633626466306436
          6565303031366262303161323536323236613861373536330a346564306238633461363765623030
          33343566363163623532386463616431313865316563616162336633353162316134363266363263
          6331353838343662380a303565643337653164613637323131363037613861306535326538333030
          64313165343933343535623731393536396332613336316239363764653565346535666531656433
          6131646439656638323561643264613834356662363332323835
 dns_cloudflare_email: cloudflare@lino.cooking
 cloudflare_ddns_api_key: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          32353865663337376239333232376630616436643435343862346164353466356563623930386461
          3132306361653330356663613534626463373133616132620a313161316137313838666534313737
          34336161373334356630326432626139666566316663373630656538333331656461373631613931
          6364313538663464350a343061383835663264616238353965656635343564306635303830343266
          38396530393133646133643232363061386265373234373832656135393764346462666566656264
          3635316261393863393736383132386133313666306234343666
 homeassistant_pwd: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          34623865646265653733666136316164303765633036616464626133306339393032336465613735
          3139333561366530383535363834316138303338313030390a306561366265643737623833633837
          31353332646635353339373937393134376566643539363563613061393731623931643931336566
          3039626631643930650a393163643534353731316261376638643736623232366431396136313666
          37613864396630306335626532633832653633346465316332356236393239653063393630323461
          3862316639643265373166373330333936303233383333653362
 gameyfin_pwd: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          64653937643761616366313263363039336262313832623035313635353638393633643330303733
          3030373063343264633265616638373463383562626132650a643163333961353861626438356339
          64326161373332396234656664343736356566356561306334306230343335323733306533343563
          3639656666313434350a303432393831323338313331386262373130633930396365653836633965
          35623030313533313462666464333339633832643261383839383432366462313262386236346434
          39646434653137633062346234373965323036636663326437346238373764363261633736356532
          346437633064623331653362303034653463
 igdb_client_id: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          36343238373066633635656365376331626231396666373039636330376132393861373739323061
          3662366362633461383730633765323530316437626639630a613337333163393539653830366235
          36636139666332393366366166343064623931326634633161666264333038643537386363663962
          6430613364653562320a313934393633386262343933363835663639313630653631356563346435
          61616130336366613066316134303866323838653938393630623763383762316432
 igdb_secret: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          65383235643965353066343661616633353163393137326661363862353131333362383336613465
          3730323833613961326161643730363434643363346138610a313230656534626137373232653633
          30303163646261666461366161336131326134633832643834623438363137323531393865613761
          3137316331353531350a306636306233326637623030666634353066396663623663386235393238
          63303939666561353032396135646666623564616562306637613430663933626530
 mastodon_db_user: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          38613037323362636233336166643239636334333333366137306335643836636338343938303135
          3134373363343964613236313562393966363033623231310a613236383134616566646466633334
          61323031393663363438336265613062636432343338383936323161313264326662346538366436
          3863633263643239390a383664663636343934383333623830333931326330613861353333643663
          66303131633433376562643938313333383335323665643030623461623836643362633034613834
          61626134386236616538366332313032383732356638356531613534313638316165383665313939
          633035373238333032303637663366326431
 mastodon_db_name: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          64376131373562633437313062366334663738336463613938653564323831316531373233396634
          3530613830303835666431366438376163383433623561350a653834353761616462316161613037
          64353430643062316465363764653830313065363261356231356466613533643565613562613437
          3338303632653865330a326337373830396230343764333231356134616365643138663731613264
          61323132363839666365326665323236373935666361663063343763363062333130663135366530
          30366231633932356662663863343330366266366538326232623136363934643334656366343763
          363833363666643162396434636536323166
 mastodon_db_pass: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          66383339653334616233336439376164616532333062393161346238643839393161653932386265
          3765376366323334613739316162336433623330373131360a653838663436663166373933353064
          30646663316631653236383437616637396331616339323439353238643866633732323438636138
          3530306635663631340a306237356664653033663865373964333835613733373565616638363864
          36333139633033333538306335336165306537303265396631616530366534643465323232336334
          33636635656130633131623437323764326565656635373265653065646135633066383561643033
          373333313535343534346331643865616539
 mastodon_key_base: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          33346261623634626666383762613065613865306530363831303032656335636332393564653030
          3866306433323432643930326133303831633437393265620a643234376332336262636364363866
          33396431653531626538396266626337623735666165636163616262393263373065356330343139
          3935356133653332370a313039366431343734363430353966386534363234316666613335353562
          36316435363862646437333431303430613138353338663233646130636436316366323831343531
          37623063656132336135313964333134323830373761316262386433363337303964366163313265
          61376438386466636332383932346431313537656332656362376630646565626130303939313432
          36646233633434383565386465376238373065303831326162386331653631633962353035376266
          33653332316563333138336439393839336263393438333663383536663834396365666332356334
          62316264633161363233346263366164643136656464373963303539623465383734326664386130
          633539303831656364653861336263613432
 mastodon_otp_secret: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          65316136326539313931396665656663356536636530613533306531663965303933643939643866
          3635646438363739303730343834623035613135623130390a316463366362386465353134663264
          64393337663866333333636635656535373064356263666161633033643635366533653530643336
          6236396264303463350a306333373231343566653939306564323332633237343463353566343836
          31323337633238393761656133613230393235663261383961616266373165376263376666333032
          62313033383339643438376662613235333464323566323763623031616531303238386334623133
          62653637323034613934313065646565323363313535653931306434393136663961663634313232
          33653933373537333834363538343432643037646165386633363334613566653538353464303839
          63373632653235376338336332303064356363653537333363326432306139666238393966306535
          66633266313465333066613161393734353263366561643865323666633733656439386564326233
          666338346237313564313937633466373937
 mastodon_vapid_private_key: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          38396438623163636339353633356339363435616262303865663834633436326331363365326433
          6438633038623639346566376233356339333832383939370a353533356630346163633434346533
          35386565386438383665623661653533646530623337373334356336396636376630356232656632
          6634376435383163300a613635613633383765646363643563393062653465353663353935333262
          35313830623635393737316337336436373730303963303962393365643165656164303633656233
          3766303666323931623230623533316139666265363231356237
 mastodon_vapid_public_key: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          61653763663734616263633063323466333064636230643263383935313134306163383135353131
          6166383263353435306333336131373431313363373334330a383031303163346238343061356537
          36653764366265323165336161303965353434366262616464646162353038353665363132616630
          6465353939316534340a626533343835303433383531373666643462326162653535313966373963
          65636561633532613166356666303833306332656266383237363561663239616139666465383532
          65613361663534616533343631386634316661616132383035333734353561643934353339373832
          34626531373530306464336437383636633830616336393265373934613030386534323335303436
          32373034336162346364643139353961323831636134313538333162373665373330636564306162
          3337
 gmail_smtp_pass: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          31396436653866313237616361636439343765323730383231633739643433646365383137343037
          3535373866653261303761396163373334383461323661380a376561663864346633646230633531
          35326435323434386564363037383961383934363163653635346233306139303664323037383435
          3763313639656566620a623639386437353662316631316638363862323334323838643037336464
          64373730623035616464303230626462666166636236363033633132363236306132
@@ -0,0 +1,6 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.16
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 vmid: 607
@@ -0,0 +1,6 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.17
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 vmid: 608
@@ -0,0 +1,10 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.2
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 ip_addr: 10.0.2.2
 # interface which will be used for flannel
 flannel_iface: "vmbr0"
@@ -0,0 +1,8 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.13
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 mac_addr: EA:11:8B:05:5A:88
 vmid: 203
 node: epona
@@ -0,0 +1,6 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.19
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 vmid: 610
@@ -0,0 +1,6 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.14
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 vmid: 605
@@ -0,0 +1,6 @@
 ---
 ansible_user: root
 ansible_host: 10.0.0.2
 ansible_ssh_pass: "{{ proxmox_api_password }}"
@@ -0,0 +1,6 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.18
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 vmid: 609
@@ -0,0 +1,9 @@
 ---
 ansible_user: root
 ansible_host: 10.0.3.111
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 # interface which will be used for flannel
 flannel_iface: "eth0"
@@ -0,0 +1,6 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.20
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 vmid: 611
@@ -0,0 +1,7 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.3
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 ip_addr: 10.0.2.3
 # interface which will be used for flannel
 flannel_iface: "vmbr0"
@@ -0,0 +1,7 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.4
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 ip_addr: 10.0.2.4
 # interface which will be used for flannel
 flannel_iface: "vmbr0"
@@ -0,0 +1,8 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.12
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 mac_addr: C2:F5:B2:99:92:51
 vmid: 202
 node: revali
@@ -0,0 +1,6 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.15
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 vmid: 606
@@ -0,0 +1,6 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.21
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 vmid: 612
@@ -0,0 +1,9 @@
 ---
 ansible_user: root
 ansible_host: 10.0.3.110
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 # interface which will be used for flannel
 flannel_iface: "eth0"
@@ -0,0 +1,7 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.11
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 mac_addr: 72:2E:3C:F0:2A:B3
 vmid: 201
 node: mipha
@@ -0,0 +1,7 @@
 ---
 ansible_user: root
 ansible_host: 10.0.2.7
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 ip_addr: 10.0.2.7
 # interface which will be used for flannel
 flannel_iface: "vmbr0"
@@ -0,0 +1,21 @@
 [lxc]
 frigate
 swag
 cloudflare-ddns
 dahua-to-mqtt
 immich
 folding
 mastodon
 tautulli
 [baremetal]
 mipha
 epona
 revali
 yuga
 hyrule
 [pihole]
 epona-pihole
 revali-pihole
 urbosa-pihole
@@ -1,51 +0,0 @@
 ---
 k3s_version: v1.24.6+k3s1
 # this is the user that has ssh access to these machines
 ansible_user: ansibleuser
 systemd_dir: /etc/systemd/system
 # Set your timezone
 system_timezone: "Your/Timezone"
 # interface which will be used for flannel
 flannel_iface: "eth0"
 # apiserver_endpoint is virtual ip-address which will be configured on each master
 apiserver_endpoint: "192.168.30.222"
 # k3s_token is required  masters can talk together securely
 # this token should be alpha numeric only
 k3s_token: "some-SUPER-DEDEUPER-secret-password"
 # The IP on which the node is reachable in the cluster.
 # Here, a sensible default is provided, you can still override
 # it for each of your hosts, though.
 k3s_node_ip: '{{ ansible_facts[flannel_iface]["ipv4"]["address"] }}'
 # Disable the taint manually by setting: k3s_master_taint = false
 k3s_master_taint: "{{ true if groups['node'] | default([]) | length >= 1 else false }}"
 # these arguments are recommended for servers as well as agents:
 extra_args: >-
  --flannel-iface={{ flannel_iface }}
  --node-ip={{ k3s_node_ip }}
 # change these to your liking, the only required are: --disable servicelb, --tls-san {{ apiserver_endpoint }}
 extra_server_args: >-
  {{ extra_args }}
  {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
  --tls-san {{ apiserver_endpoint }}
  --disable servicelb
  --disable traefik
 extra_agent_args: >-
  {{ extra_args }}
 # image tag for kube-vip
 kube_vip_tag_version: "v0.5.5"
 # image tag for metal lb
 metal_lb_speaker_tag_version: "v0.13.6"
 metal_lb_controller_tag_version: "v0.13.6"
 # metallb ip range for load balancer
 metal_lb_ip_range: "192.168.30.80-192.168.30.90"
@@ -1,12 +0,0 @@
 [master]
 192.168.30.38
 192.168.30.39
 192.168.30.40
 [node]
 192.168.30.41
 192.168.30.42
 [k3s_cluster:children]
 master
 node
@@ -1,73 +0,0 @@
 # Test suites for `k3s-ansible`
 This folder contains the [molecule](https://molecule.rtfd.io/)-based test setup for this playbook.
 ## Scenarios
 We have these scenarios:
 - **default**:
  A 3 control + 2 worker node cluster based very closely on the [sample inventory](../inventory/sample/).
 - **ipv6**:
  A cluster that is externally accessible via IPv6 ([more information](ipv6/README.md))
  To save a bit of test time, this cluster is _not_ highly available, it consists of only one control and one worker node.
 - **single_node**:
  Very similar to the default scenario, but uses only a single node for all cluster functionality.
 ## How to execute
 To test on your local machine, follow these steps:
 ### System requirements
 Make sure that the following software packages are available on your system:
 - [Python 3](https://www.python.org/downloads)
 - [Vagrant](https://www.vagrantup.com/downloads)
 - [VirtualBox](https://www.virtualbox.org/wiki/Downloads)
 ### Set up VirtualBox networking on Linux and macOS
 _You can safely skip this if you are working on Windows._
 Furthermore, the test cluster uses the `192.168.30.0/24` subnet which is [not set up by VirtualBox automatically](https://www.virtualbox.org/manual/ch06.html#network_hostonly).
 To set the subnet up for use with VirtualBox, please make sure that `/etc/vbox/networks.conf` exists and that it contains this line:
 ```
 * 192.168.30.0/24
 * fdad:bad:ba55::/64
 ```
 ### Install Python dependencies
 You will get [Molecule, Ansible and a few extra dependencies](../requirements.txt) via [pip](https://pip.pypa.io/).
 Usually, it is advisable to work in a [virtual environment](https://docs.python.org/3/tutorial/venv.html) for this:
 ```bash
 cd /path/to/k3s-ansible
 # Create a virtualenv at ".env". You only need to do this once.
 python3 -m venv .env
 # Activate the virtualenv for your current shell session.
 # If you start a new session, you will have to repeat this.
 source .env/bin/activate
 # Install the required packages into the virtualenv.
 # These remain installed across shell sessions.
 python3 -m pip install -r requirements.txt
 ```
 ### Run molecule
 With the virtual environment from the previous step active in your shell session, you can now use molecule to test the playbook.
 Interesting commands are:
 - `molecule create`: Create virtual machines for the test cluster nodes.
 - `molecule destroy`: Delete the virtual machines for the test cluster nodes.
 - `molecule converge`: Run the `site` playbook on the nodes of the test cluster.
 - `molecule side_effect`: Run the `reset` playbook on the nodes of the test cluster.
 - `molecule verify`: Verify that the cluster works correctly.
 - `molecule test`: The "all-in-one" sequence of steps that is executed in CI.
  This includes the `create`, `converge`, `verify`, `side_effect` and `destroy` steps.
  See [`molecule.yml`](default/molecule.yml) for more details.
@@ -1,82 +0,0 @@
 ---
 dependency:
  name: galaxy
 driver:
  name: vagrant
 .platform_presets:
  - &control
    memory: 2048
    cpus: 2
    groups:
      - k3s_cluster
      - master
  - &node
    memory: 2048
    cpus: 2
    groups:
      - k3s_cluster
      - node
  - &debian
    box: generic/debian11
  - &rocky
    box: generic/rocky9
  - &ubuntu
    box: generic/ubuntu2204
    config_options:
      # We currently can not use public-key based authentication on Ubuntu 22.04,
      # see: https://github.com/chef/bento/issues/1405
      ssh.username: "vagrant"
      ssh.password: "vagrant"
 platforms:
  - <<: [*control, *ubuntu]
    name: control1
    interfaces:
      - network_name: private_network
        ip: 192.168.30.38
  - <<: [*control, *debian]
    name: control2
    interfaces:
      - network_name: private_network
        ip: 192.168.30.39
  - <<: [*control, *rocky]
    name: control3
    interfaces:
      - network_name: private_network
        ip: 192.168.30.40
  - <<: [*node, *ubuntu]
    name: node1
    interfaces:
      - network_name: private_network
        ip: 192.168.30.41
  - <<: [*node, *rocky]
    name: node2
    interfaces:
      - network_name: private_network
        ip: 192.168.30.42
 provisioner:
  name: ansible
  playbooks:
    converge: ../resources/converge.yml
    side_effect: ../resources/reset.yml
    verify: ../resources/verify.yml
  inventory:
    links:
      group_vars: ../../inventory/sample/group_vars
 scenario:
  test_sequence:
    - dependency
    - lint
    - cleanup
    - destroy
    - syntax
    - create
    - prepare
    - converge
    # idempotence is not possible with the playbook in its current form.
    - verify
    # We are repurposing side_effect here to test the reset playbook.
    # This is why we do not run it before verify (which tests the cluster),
    # but after the verify step.
    - side_effect
    - cleanup
    - destroy
@@ -1,11 +0,0 @@
 ---
 - name: Apply overrides
  hosts: all
  tasks:
    - name: Override host variables
      ansible.builtin.set_fact:
        # See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant  # noqa yaml[line-length]
        flannel_iface: eth1
        # The test VMs might be a bit slow, so we give them more time to join the cluster:
        retry_count: 45
@@ -1,22 +0,0 @@
 ---
 - name: Apply overrides
  ansible.builtin.import_playbook: >-
    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
 - name: Network setup
  hosts: all
  tasks:
    - name: Disable firewalld
      when: ansible_distribution == "Rocky"
      # Rocky Linux comes with firewalld enabled. It blocks some of the network
      # connections needed for our k3s cluster. For our test setup, we just disable
      # it since the VM host's firewall is still active for connections to and from
      # the Internet.
      # When building your own cluster, please DO NOT blindly copy this. Instead,
      # please create a custom firewall configuration that fits your network design
      # and security needs.
      ansible.builtin.systemd:
        name: firewalld
        enabled: no
        state: stopped
      become: true
@@ -1,35 +0,0 @@
 # Sample IPv6 configuration for `k3s-ansible`
 This scenario contains a cluster configuration which is _IPv6 first_, but still supports dual-stack networking with IPv4 for most things.
 This means:
 - The API server VIP is an IPv6 address.
 - The MetalLB pool consists of both IPv4 and IPv4 addresses.
 - Nodes as well as cluster-internal resources (pods and services) are accessible via IPv4 as well as IPv6.
 ## Network design
 All IPv6 addresses used in this scenario share a single `/48` prefix: `fdad:bad:ba55`.
 The following subnets are used:
 - `fdad:bad:ba55:`**`0`**`::/64` is the subnet which contains the cluster components meant for external access.
  That includes:
  - The VIP for the Kubernetes API server: `fdad:bad:ba55::333`
  - Services load-balanced by MetalLB: `fdad:bad:ba55::1b:0/112`
  - Cluster nodes: `fdad:bad:ba55::de:0/112`
  - The host executing Vagrant: `fdad:bad:ba55::1`
  In a home lab setup, this might be your LAN.
 - `fdad:bad:ba55:`**`4200`**`::/56` is used internally by the cluster for pods.
 - `fdad:bad:ba55:`**`4300`**`::/108` is used internally by the cluster for services.
 IPv4 networking is also available:
 - The nodes have addresses inside `192.168.123.0/24`.
  MetalLB also has a bit of address space in this range: `192.168.123.80-192.168.123.90`
 - For pods and services, the k3s defaults (`10.42.0.0/16` and `10.43.0.0/16)` are used.
 Note that the host running Vagrant is not part any of these IPv4 networks.
@@ -1,3 +0,0 @@
 ---
 node_ipv4: 192.168.123.11
 node_ipv6: fdad:bad:ba55::de:11
@@ -1,3 +0,0 @@
 ---
 node_ipv4: 192.168.123.21
 node_ipv6: fdad:bad:ba55::de:21
@@ -1,63 +0,0 @@
 ---
 dependency:
  name: galaxy
 driver:
  name: vagrant
 .platform_presets:
  - &control
    memory: 2048
    cpus: 2
    groups:
      - k3s_cluster
      - master
  - &node
    memory: 2048
    cpus: 2
    groups:
      - k3s_cluster
      - node
  - &ubuntu
    box: generic/ubuntu2204
    config_options:
      # We currently can not use public-key based authentication on Ubuntu 22.04,
      # see: https://github.com/chef/bento/issues/1405
      ssh.username: "vagrant"
      ssh.password: "vagrant"
 platforms:
  - <<: [*control, *ubuntu]
    name: control1
    interfaces:
      - network_name: private_network
        ip: fdad:bad:ba55::de:11
  - <<: [*node, *ubuntu]
    name: node1
    interfaces:
      - network_name: private_network
        ip: fdad:bad:ba55::de:21
 provisioner:
  name: ansible
  playbooks:
    converge: ../resources/converge.yml
    side_effect: ../resources/reset.yml
    verify: ../resources/verify.yml
  inventory:
    links:
      group_vars: ../../inventory/sample/group_vars
 scenario:
  test_sequence:
    - dependency
    - lint
    - cleanup
    - destroy
    - syntax
    - create
    - prepare
    - converge
    # idempotence is not possible with the playbook in its current form.
    - verify
    # We are repurposing side_effect here to test the reset playbook.
    # This is why we do not run it before verify (which tests the cluster),
    # but after the verify step.
    - side_effect
    - cleanup
    - destroy
@@ -1,45 +0,0 @@
 ---
 - name: Apply overrides
  hosts: all
  tasks:
    - name: Override host variables (1/2)
      ansible.builtin.set_fact:
        # See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant  # noqa yaml[line-length]
        flannel_iface: eth1
        # The test VMs might be a bit slow, so we give them more time to join the cluster:
        retry_count: 45
        # IPv6 configuration
        # ######################################################################
        # The API server will be reachable on IPv6 only
        apiserver_endpoint: fdad:bad:ba55::333
        # We give MetalLB address space for both IPv4 and IPv6
        metal_lb_ip_range:
          - fdad:bad:ba55::1b:0/112
          - 192.168.123.80-192.168.123.90
        # k3s_node_ip is by default set to the IPv4 address of flannel_iface.
        # We want IPv6 addresses here of course, so we just specify them
        # manually below.
        k3s_node_ip: "{{ node_ipv4 }},{{ node_ipv6 }}"
    - name: Override host variables (2/2)
      # Since "extra_args" depends on "k3s_node_ip" and "flannel_iface" we have
      # to set this AFTER overriding the both of them.
      ansible.builtin.set_fact:
        # A few extra server args are necessary:
        #  - the network policy needs to be disabled.
        #  - we need to manually specify the subnets for services and pods, as
        #    the default has IPv4 ranges only.
        extra_server_args: >-
          {{ extra_args }}
          --tls-san {{ apiserver_endpoint }}
          {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
          --disable servicelb
          --disable traefik
          --disable-network-policy
          --cluster-cidr=10.42.0.0/16,fdad:bad:ba55:4200::/56
          --service-cidr=10.43.0.0/16,fdad:bad:ba55:4300::/108
@@ -1,51 +0,0 @@
 ---
 - name: Apply overrides
  ansible.builtin.import_playbook: >-
    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
 - name: Configure dual-stack networking
  hosts: all
  become: true
  # Unfortunately, as of 2022-09, Vagrant does not support the configuration
  # of both IPv4 and IPv6 addresses for a single network adapter. So we have
  # to configure that ourselves.
  # Moreover, we have to explicitly enable IPv6 for the loopback interface.
  tasks:
    - name: Enable IPv6 for network interfaces
      ansible.posix.sysctl:
        name: net.ipv6.conf.{{ item }}.disable_ipv6
        value: "0"
      with_items:
        - all
        - default
        - lo
    - name: Disable duplicate address detection
      # Duplicate address detection did repeatedly fail within the virtual
      # network. But since this setup does not use SLAAC anyway, we can safely
      # disable it.
      ansible.posix.sysctl:
        name: net.ipv6.conf.{{ item }}.accept_dad
        value: "0"
      with_items:
        - "{{ flannel_iface }}"
    - name: Write IPv4 configuration
      ansible.builtin.template:
        src: 55-flannel-ipv4.yaml.j2
        dest: /etc/netplan/55-flannel-ipv4.yaml
        owner: root
        group: root
        mode: 0644
      register: netplan_template
    - name: Apply netplan configuration
      # Conceptually, this should be a handler rather than a task.
      # However, we are currently not in a role context - creating
      # one just for this seemed overkill.
      when: netplan_template.changed
      ansible.builtin.command:
        cmd: netplan apply
      changed_when: true
@@ -1,8 +0,0 @@
 ---
 network:
  version: 2
  renderer: networkd
  ethernets:
    {{ flannel_iface }}:
      addresses:
      - {{ node_ipv4 }}/24
@@ -1,7 +0,0 @@
 ---
 - name: Apply overrides
  ansible.builtin.import_playbook: >-
    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
 - name: Converge
  ansible.builtin.import_playbook: ../../site.yml
@@ -1,7 +0,0 @@
 ---
 - name: Apply overrides
  ansible.builtin.import_playbook: >-
    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
 - name: Reset
  ansible.builtin.import_playbook: ../../reset.yml
@@ -1,5 +0,0 @@
 ---
 - name: Verify
  hosts: all
  roles:
    - verify/from_outside
@@ -1,9 +0,0 @@
 ---
 # A host outside of the cluster from which the checks shall be performed
 outside_host: localhost
 # This kubernetes namespace will be used for testing
 testing_namespace: molecule-verify-from-outside
 # The directory in which the example manifests reside
 example_manifests_path: ../../../../example
@@ -1,5 +0,0 @@
 ---
 - name: Clean up kubecfg
  ansible.builtin.file:
    path: "{{ kubecfg.path }}"
    state: absent
@@ -1,19 +0,0 @@
 ---
 - name: Create temporary directory for kubecfg
  ansible.builtin.tempfile:
    state: directory
    suffix: kubecfg
  register: kubecfg
 - name: Gathering facts
  delegate_to: "{{ groups['master'][0] }}"
  ansible.builtin.gather_facts:
 - name: Download kubecfg
  ansible.builtin.fetch:
    src: "{{ ansible_env.HOME }}/.kube/config"
    dest: "{{ kubecfg.path }}/"
    flat: true
  delegate_to: "{{ groups['master'][0] }}"
  delegate_facts: true
 - name: Store path to kubecfg
  ansible.builtin.set_fact:
    kubecfg_path: "{{ kubecfg.path }}/config"
@@ -1,14 +0,0 @@
 ---
 - name: Verify
  run_once: true
  delegate_to: "{{ outside_host }}"
  block:
    - name: "Test CASE: Get kube config"
      ansible.builtin.import_tasks: kubecfg-fetch.yml
    - name: "TEST CASE: Get nodes"
      ansible.builtin.include_tasks: test/get-nodes.yml
    - name: "TEST CASE: Deploy example"
      ansible.builtin.include_tasks: test/deploy-example.yml
  always:
    - name: "TEST CASE: Cleanup"
      ansible.builtin.import_tasks: kubecfg-cleanup.yml
@@ -1,58 +0,0 @@
 ---
 - name: Deploy example
  block:
    - name: "Create namespace: {{ testing_namespace }}"
      kubernetes.core.k8s:
        api_version: v1
        kind: Namespace
        name: "{{ testing_namespace }}"
        state: present
        wait: true
        kubeconfig: "{{ kubecfg_path }}"
    - name: Apply example manifests
      kubernetes.core.k8s:
        src: "{{ example_manifests_path }}/{{ item }}"
        namespace: "{{ testing_namespace }}"
        state: present
        wait: true
        kubeconfig: "{{ kubecfg_path }}"
      with_items:
        - deployment.yml
        - service.yml
    - name: Get info about nginx service
      kubernetes.core.k8s_info:
        kind: service
        name: nginx
        namespace: "{{ testing_namespace }}"
        kubeconfig: "{{ kubecfg_path }}"
      vars: &load_balancer_metadata
        metallb_ip: status.loadBalancer.ingress[0].ip
        metallb_port: spec.ports[0].port
      register: nginx_services
    - name: Assert that the nginx welcome page is available
      ansible.builtin.uri:
        url: http://{{ ip | ansible.utils.ipwrap }}:{{ port }}/
        return_content: yes
      register: result
      failed_when: "'Welcome to nginx!' not in result.content"
      vars:
        ip: >-
          {{ nginx_services.resources[0].status.loadBalancer.ingress[0].ip }}
        port: >-
          {{ nginx_services.resources[0].spec.ports[0].port }}
      # Deactivated linter rules:
      #   - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap
      #                     would be undefined. This will not be the case during playbook execution.
      # noqa jinja[invalid]
  always:
    - name: "Remove namespace: {{ testing_namespace }}"
      kubernetes.core.k8s:
        api_version: v1
        kind: Namespace
        name: "{{ testing_namespace }}"
        state: absent
        kubeconfig: "{{ kubecfg_path }}"
@@ -1,28 +0,0 @@
 ---
 - name: Get all nodes in cluster
  kubernetes.core.k8s_info:
    kind: node
    kubeconfig: "{{ kubecfg_path }}"
  register: cluster_nodes
 - name: Assert that the cluster contains exactly the expected nodes
  ansible.builtin.assert:
    that: found_nodes == expected_nodes
    success_msg: "Found nodes as expected: {{ found_nodes }}"
    fail_msg: "Expected nodes {{ expected_nodes }}, but found nodes {{ found_nodes }}"
  vars:
    found_nodes: >-
      {{ cluster_nodes | json_query('resources[*].metadata.name') | unique | sort }}
    expected_nodes: |-
      {{
        (
          ( groups['master'] | default([]) ) +
          ( groups['node'] | default([]) )
        )
        | unique
        | sort
      }}
  # Deactivated linter rules:
  #   - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap
  #                     would be undefined. This will not be the case during playbook execution.
  # noqa jinja[invalid]
@@ -1,48 +0,0 @@
 ---
 dependency:
  name: galaxy
 driver:
  name: vagrant
 platforms:
  - name: control1
    box: generic/ubuntu2204
    memory: 4096
    cpus: 4
    config_options:
      # We currently can not use public-key based authentication on Ubuntu 22.04,
      # see: https://github.com/chef/bento/issues/1405
      ssh.username: "vagrant"
      ssh.password: "vagrant"
    groups:
      - k3s_cluster
      - master
    interfaces:
      - network_name: private_network
        ip: 192.168.30.50
 provisioner:
  name: ansible
  playbooks:
    converge: ../resources/converge.yml
    side_effect: ../resources/reset.yml
    verify: ../resources/verify.yml
  inventory:
    links:
      group_vars: ../../inventory/sample/group_vars
 scenario:
  test_sequence:
    - dependency
    - lint
    - cleanup
    - destroy
    - syntax
    - create
    - prepare
    - converge
    # idempotence is not possible with the playbook in its current form.
    - verify
    # We are repurposing side_effect here to test the reset playbook.
    # This is why we do not run it before verify (which tests the cluster),
    # but after the verify step.
    - side_effect
    - cleanup
    - destroy
@@ -1,15 +0,0 @@
 ---
 - name: Apply overrides
  hosts: all
  tasks:
    - name: Override host variables
      ansible.builtin.set_fact:
        # See: https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant  # noqa yaml[line-length]
        flannel_iface: eth1
        # The test VMs might be a bit slow, so we give them more time to join the cluster:
        retry_count: 45
        # Make sure that our IP ranges do not collide with those of the default scenario
        apiserver_endpoint: "192.168.30.223"
        metal_lb_ip_range: "192.168.30.91-192.168.30.99"
@@ -0,0 +1,19 @@
 ---
 - hosts: localhost
  become: yes
  roles:
    # - role: cloudflare-ddns/provision/delete
    - role: cloudflare-ddns/provision/create
    - role: cloudflare-ddns/provision/start
 - hosts: revali
  become: yes
  roles:
    - role: lxc/enable-ssh
 - hosts: cloudflare-ddns
  become: yes
  roles:
    - role: cloudflare-ddns/update
    - role: cloudflare-ddns/install-docker
    - role: cloudflare-ddns/install-app
@@ -0,0 +1,23 @@
 ---
 - hosts: localhost
  become: yes
  roles:
    # - role: dahua-to-mqtt/provision/delete
    # - role: dahua-to-mqtt/provision/create
    - role: dahua-to-mqtt/provision/start
      vars:
        vmid: 608
 - hosts: revali
  become: yes
  roles:
    - role: dahua-to-mqtt/enable-ssh
      vars:
        vmid: 608
 - hosts: dahua-to-mqtt
  become: yes
  roles:
    - role: dahua-to-mqtt/update
    - role: dahua-to-mqtt/install-docker
    - role: dahua-to-mqtt/install-app
@@ -0,0 +1,22 @@
 ---
 # - hosts: localhost
 #   become: yes
 #   roles:
 #     - role: folding/provision/delete
 #     - role: folding/provision/create
 #     - role: folding/provision/start
 #       vars:
 #         vmid: 610
 - hosts: hyrule
  become: yes
  roles:
    - role: folding/enable-ssh
      vars:
        vmid: 610
 - hosts: folding
  become: yes
  roles:
    - role: folding/update
    - role: folding/install-app
@@ -0,0 +1,28 @@
 ---
 - hosts: localhost
  become: yes
  roles:
    - role: frigate/provision/delete
    - role: frigate/provision/create
 - hosts: epona
  become: yes
  roles:
    - role: frigate/provision/cgroup
 - hosts: localhost
  become: yes
  roles:
    - role: frigate/provision/start
 - hosts: epona
  become: yes
  roles:
    - role: lxc/enable-ssh
 - hosts: frigate
  become: yes
  roles:
    - role: frigate/update
    - role: frigate/install-docker
    - role: frigate/install-app
@@ -0,0 +1,23 @@
 ---
 - hosts: localhost
  become: yes
  roles:
    - role: immich/provision/delete
    - role: immich/provision/create
    - role: immich/provision/start
      vars:
        vmid: 609
 - hosts: hyrule
  become: yes
  roles:
    - role: immich/enable-ssh
      vars:
        vmid: 609
 - hosts: immich
  become: yes
  roles:
    - role: immich/update
    - role: immich/install-docker
    - role: immich/install-app
@@ -0,0 +1,38 @@
 ---
 # - hosts: k3s_cluster
 #   gather_facts: yes
 #   become: yes
 #   roles:
 #     - role: prereq
 #     - role: download
 # - hosts: master
 #   become: yes
 #   roles:
 #     - role: k3s/master
 # - hosts: node
 #   become: yes
 #   roles:
 #     - role: k3s/node
 # - hosts: master
 #   become: yes
 #   roles:
 #     - role: k3s/post
 # - hosts: master
 #   become: yes
 #   roles:
 #     - role: k3s/copy-config
 - hosts: localhost
  become: yes
  roles:
    # - role: traefik
    # - role: cert-manager
    # - role: authentik
    - role: argocd
    # - role: nginx
    # - role: arr
    # - role: redis
@@ -0,0 +1,23 @@
 ---
 - hosts: localhost
  become: yes
  roles:
    - role: mastodon/provision/delete
    - role: mastodon/provision/create
    - role: mastodon/provision/start
      vars:
        vmid: 611
 - hosts: epona
  become: yes
  roles:
    - role: mastodon/enable-ssh
      vars:
        vmid: 611
 - hosts: mastodon
  become: yes
  roles:
    - role: mastodon/update
    - role: mastodon/install-docker
    - role: mastodon/install-app
@@ -0,0 +1,19 @@
 ---
 # - hosts: localhost
 #   become: yes
 #   roles:
 #     - role: swag/provision/delete
 #     - role: swag/provision/create
 #     - role: swag/provision/start
 # - hosts: mipha
 #   become: yes
 #   roles:
 #     - role: lxc/enable-ssh
 - hosts: swag
  become: yes
  roles:
    # - role: swag/update
    # - role: swag/install-docker
    - role: swag/install-app
@@ -0,0 +1,23 @@
 ---
 - hosts: localhost
  become: yes
  roles:
    - role: tautulli/provision/delete
    - role: tautulli/provision/create
    - role: tautulli/provision/start
      vars:
        vmid: 612
 - hosts: epona
  become: yes
  roles:
    - role: tautulli/enable-ssh
      vars:
        vmid: 612
 - hosts: tautulli
  become: yes
  roles:
    - role: tautulli/update
    - role: tautulli/install-docker
    - role: tautulli/install-app
@@ -0,0 +1,15 @@
 ---
 - hosts: frigate
  become: yes
  roles:
    - role: frigate/update
 - hosts: cloudflare-ddns
  become: yes
  roles:
    - role: cloudflare-ddns/update
 - hosts: swag
  become: yes
  roles:
    - role: swag/update
@@ -0,0 +1,3 @@
 #!/bin/bash
 ansible-playbook reboot.yml -i inventory/my-cluster/hosts.ini
@@ -0,0 +1,9 @@
 ---
 - name: Reboot k3s_cluster
  hosts: k3s_cluster
  gather_facts: yes
  become: yes
  tasks:
    - name: Reboot the nodes (and Wait upto 5 mins max)
      reboot:
        reboot_timeout: 300
@@ -0,0 +1,10 @@
 ansible-core>=2.13.2
 ansible-lint>=6.6.0
 kubernetes>=12.0.0
 netaddr>=0.8.0
 pyyaml>=3.11
 yamllint>=1.28.0
 jmespath>=1.0.1
 jsonpatch>=1.32
 pre-commit>=2.20.0
 netaddr>=0.8.0
@@ -1,72 +1,218 @@
-ansible-compat==2.2.1
+#
 # This file is autogenerated by pip-compile with python 3.8
 # To update, run:
 #
 #    pip-compile requirements.in
 #
 ansible-compat==2.2.4
    # via
    #   ansible-lint
 ansible-core==2.13.5
-ansible-lint==6.8.4
+    # via
    #   -r requirements.in
    #   ansible-lint
 ansible-lint==6.8.6
    # via -r requirements.in
 arrow==1.2.3
    # via jinja2-time
 attrs==22.1.0
    # via jsonschema
 binaryornot==0.4.4
    # via cookiecutter
 black==22.10.0
    # via ansible-lint
 bracex==2.3.post1
    # via wcmatch
 cachetools==5.2.0
-Cerberus==1.3.2
+    # via google-auth
 certifi==2022.9.24
    # via
    #   kubernetes
    #   requests
 cffi==1.15.1
    # via cryptography
 cfgv==3.3.1
    # via pre-commit
 chardet==5.0.0
    # via binaryornot
 charset-normalizer==2.1.1
    # via requests
 click==8.1.3
    # via
    #   black
    #   click-help-colors
    #   cookiecutter
 click-help-colors==0.9.1
 commonmark==0.9.1
    # via rich
 cookiecutter==2.1.1
-cryptography==38.0.1
+cryptography==38.0.3
    # via ansible-core
 distlib==0.3.6
    # via virtualenv
 distro==1.8.0
    # via selinux
 enrich==1.2.7
    # via molecule
 filelock==3.8.0
-google-auth==2.13.0
+    # via
    #   ansible-lint
    #   virtualenv
 google-auth==2.14.0
    # via kubernetes
 identify==2.5.8
    # via pre-commit
 idna==3.4
    # via requests
 importlib-resources==5.10.0
-Jinja2==3.1.2
+    # via jsonschema
 jinja2==3.1.2
    # via
    #   ansible-core
    #   cookiecutter
    #   jinja2-time
    #   molecule
    #   molecule-vagrant
 jinja2-time==0.2.0
    # via cookiecutter
 jmespath==1.0.1
    # via -r requirements.in
 jsonpatch==1.32
    # via -r requirements.in
 jsonpointer==2.3
-jsonschema==4.16.0
+    # via jsonpatch
-kubernetes==24.2.0
+jsonschema==4.17.0
-MarkupSafe==2.1.1
+    # via
-molecule==4.0.1
+    #   ansible-compat
    #   ansible-lint
    #   molecule
 kubernetes==25.3.0
    # via -r requirements.in
 markupsafe==2.1.1
    # via jinja2
 molecule==4.0.3
    # via
    #   -r requirements.in
    #   molecule-vagrant
 molecule-vagrant==1.0.0
    # via -r requirements.in
 mypy-extensions==0.4.3
    # via black
 netaddr==0.8.0
    # via -r requirements.in
 nodeenv==1.7.0
    # via pre-commit
 oauthlib==3.2.2
    # via requests-oauthlib
 packaging==21.3
    # via
    #   ansible-compat
    #   ansible-core
    #   ansible-lint
    #   molecule
 pathspec==0.10.1
    # via
    #   black
    #   yamllint
 pkgutil-resolve-name==1.3.10
    # via jsonschema
 platformdirs==2.5.2
    # via
    #   black
    #   virtualenv
 pluggy==1.0.0
    # via molecule
 pre-commit==2.20.0
    # via -r requirements.in
 pyasn1==0.4.8
    # via
    #   pyasn1-modules
    #   rsa
 pyasn1-modules==0.2.8
    # via google-auth
 pycparser==2.21
-Pygments==2.13.0
+    # via cffi
 pygments==2.13.0
    # via rich
 pyparsing==3.0.9
-pyrsistent==0.18.1
+    # via packaging
 pyrsistent==0.19.2
    # via jsonschema
 python-dateutil==2.8.2
    # via
    #   arrow
    #   kubernetes
 python-slugify==6.1.2
    # via cookiecutter
 python-vagrant==1.0.0
-PyYAML==6.0
+    # via molecule-vagrant
 pyyaml==6.0
    # via
    #   -r requirements.in
    #   ansible-compat
    #   ansible-core
    #   ansible-lint
    #   cookiecutter
    #   kubernetes
    #   molecule
    #   molecule-vagrant
    #   pre-commit
    #   yamllint
 requests==2.28.1
    # via
    #   cookiecutter
    #   kubernetes
    #   requests-oauthlib
 requests-oauthlib==1.3.1
    # via kubernetes
 resolvelib==0.8.1
    # via ansible-core
 rich==12.6.0
    # via
    #   ansible-lint
    #   enrich
    #   molecule
 rsa==4.9
-ruamel.yaml==0.17.21
+    # via google-auth
-ruamel.yaml.clib==0.2.7
+ruamel-yaml==0.17.21
    # via ansible-lint
 ruamel-yaml-clib==0.2.7
    # via ruamel-yaml
 selinux==0.2.1
    # via molecule-vagrant
 six==1.16.0
    # via
    #   google-auth
    #   kubernetes
    #   python-dateutil
 subprocess-tee==0.3.5
    # via ansible-compat
 text-unidecode==1.3
    # via python-slugify
 toml==0.10.2
    # via pre-commit
 tomli==2.0.1
    # via black
 typing-extensions==4.4.0
    # via
    #   black
    #   rich
 urllib3==1.26.12
    # via
    #   kubernetes
    #   requests
 virtualenv==20.16.6
    # via pre-commit
 wcmatch==8.4.1
-websocket-client==1.4.1
+    # via ansible-lint
 websocket-client==1.4.2
    # via kubernetes
 yamllint==1.28.0
    # via
    #   -r requirements.in
    #   ansible-lint
 zipp==3.10.0
    # via importlib-resources
 # The following packages are considered to be unsafe in a requirements file:
 # setuptools
@@ -1,3 +1,3 @@
 #!/bin/bash
-ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini
+ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini --ask-become-pass --ask-vault-pass
@@ -1,12 +1,9 @@
 ---
 - hosts: k3s_cluster
  gather_facts: yes
  become: yes
  roles:
    - role: reset
    - role: raspberrypi
      vars: {state: absent}
  post_tasks:
    - name: Reboot and wait for node to come back up
      reboot:
@@ -0,0 +1,27 @@
 ---
 - name: Create argocd namespace
  kubernetes.core.k8s:
    name: argocd
    kubeconfig: /Users/lino.silva/.kube/config
    api_version: v1
    kind: Namespace
    state: present
 - name: Install argocd
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    namespace: argocd
    definition: "{{ lookup('template', 'install.yml') | from_yaml }}"
 - name: Deploy forwardauth middleware
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
 - name: Deploy argocd - ingress
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"
@@ -0,0 +1,37 @@
 ---
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
  name: argocd
  namespace: argocd
  annotations:
    kubernetes.io/ingress.class: traefik-external
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`argocd.lino.cooking`)
      kind: Rule
      services:
        - name: argocd-server
          port: 80
      middlewares:
        - name: argocd-forwardauth
          namespace: argocd
    - match: Host(`argocd.lino.cooking`) && Headers(`Content-Type`, `application/grpc`)
      kind: Rule
      services:
        - name: argocd-server
          port: 80
          scheme: h2c
    - match: "Host(`argocd.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
      kind: Rule
      priority: 15
      services:
        - kind: Service
          # Or, to use an external Outpost, create an ExternalName service and reference that here.
          # See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
          name: authentik
          port: 9000
  tls:
    secretName: lino-cooking-tls
@@ -0,0 +1,21 @@
 apiVersion: traefik.containo.us/v1alpha1
 kind: Middleware
 metadata:
  name: argocd-forwardauth
  namespace: argocd
 spec:
  forwardAuth:
    address: https://argocd.lino.cooking/outpost.goauthentik.io/auth/traefik
    trustForwardHeader: true
    authResponseHeaders:
      - X-authentik-username
      - X-authentik-groups
      - X-authentik-email
      - X-authentik-name
      - X-authentik-uid
      - X-authentik-jwt
      - X-authentik-meta-jwks
      - X-authentik-meta-outpost
      - X-authentik-meta-provider
      - X-authentik-meta-app
      - X-authentik-meta-version
@@ -0,0 +1,64 @@
 ---
 # - name: Create a arr-apps namespace
 #   kubernetes.core.k8s:
 #     name: arr-apps
 #     kubeconfig: /Users/lino.silva/.kube/config
 #     api_version: v1
 #     kind: Namespace
 #     state: present
 - name: Deploy arr - deployment
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    definition: "{{ lookup('template', 'deployment.yml') | from_yaml }}"
  loop:
    - { name: 'radarr', port: 7878 }
    - { name: 'prowlarr', port: 9696 }
    - { name: 'sonarr', port: 8989 }
    - { name: 'overseerr', port: 5055 }
    - { name: 'transmission', port: 9091 }
    - { name: 'bazarr', port: 6767 }
    - { name: 'lidarr', port: 8686 }
 - name: Deploy arr services
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    definition: "{{ lookup('template', 'service.yml') | from_yaml }}"
  loop:
    - { name: 'radarr', port: 7878 }
    - { name: 'prowlarr', port: 9696 }
    - { name: 'sonarr', port: 8989 }
    - { name: 'overseerr', port: 5055 }
    - { name: 'transmission', port: 9091 }
    - { name: 'bazarr', port: 6767 }
    - { name: 'lidarr', port: 8686 }
 - name: Deploy forwardauth middleware
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
  loop:
    - radarr
    - prowlarr
    - sonarr
    - overseerr
    - transmission
    - bazarr
    - lidarr
 - name: Deploy arr - ingress
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"
  loop:
    - { name: 'radarr', port: 7878 }
    - { name: 'prowlarr', port: 9696 }
    - { name: 'sonarr', port: 8989 }
    - { name: 'overseerr', port: 5055 }
    - { name: 'transmission', port: 9091 }
    - { name: 'bazarr', port: 6767 }
    - { name: 'lidarr', port: 8686 }
@@ -0,0 +1,30 @@
 ---
 - kind: Deployment
  apiVersion: apps/v1
  metadata:
    name: {{ item.name }}
    namespace: default
    labels:
      app: {{ item.name }}
  spec:
    replicas: 1
    progressDeadlineSeconds: 600
    revisionHistoryLimit: 2
    strategy:
      type: Recreate
    selector:
      matchLabels:
        app: {{ item.name }}
    template:
      metadata:
        labels:
          app: {{ item.name }}
      spec:
        containers:
          - name: {{ item.name }}
            image: linuxserver/{{ item.name }}
            ports:
              - name: app-port
                containerPort: {{ item.port }}
                hostPort: {{ item.port }}
                protocol: TCP
@@ -0,0 +1,32 @@
 ---
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
  name: {{ item.name }}
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik-external
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`{{ item.name }}.lino.cooking`)
      kind: Rule
      services:
        - name: {{ item.name }}
          port: {{ item.port }}
      middlewares:
        - name: default-headers
        - name: {{ item.name }}-forwardauth
          namespace: traefik
    - match: "Host(`{{ item.name }}.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
      kind: Rule
      priority: 15
      services:
        - kind: Service
          # Or, to use an external Outpost, create an ExternalName service and reference that here.
          # See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
          name: authentik
          port: 9000
  tls:
    secretName: lino-cooking-tls
@@ -0,0 +1,21 @@
 apiVersion: traefik.containo.us/v1alpha1
 kind: Middleware
 metadata:
  name: {{ item }}-forwardauth
  namespace: traefik
 spec:
  forwardAuth:
    address: https://{{ item }}.lino.cooking/outpost.goauthentik.io/auth/traefik
    trustForwardHeader: true
    authResponseHeaders:
      - X-authentik-username
      - X-authentik-groups
      - X-authentik-email
      - X-authentik-name
      - X-authentik-uid
      - X-authentik-jwt
      - X-authentik-meta-jwks
      - X-authentik-meta-outpost
      - X-authentik-meta-provider
      - X-authentik-meta-app
      - X-authentik-meta-version
@@ -0,0 +1,13 @@
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: {{ item.name }}
  namespace: default
 spec:
  selector:
    app: {{ item.name }}
  ports:
    - name: http
      targetPort: {{ item.port }}
      port: {{ item.port }}
@@ -0,0 +1,21 @@
 ---
 - name: Add authentik helm repo
  kubernetes.core.helm_repository:
    name: authentik
    repo_url: "https://charts.goauthentik.io"
 - name: Update the repository cache
  kubernetes.core.helm:
    kubeconfig: /Users/lino.silva/.kube/config
    name: dummy
    namespace: kube-system
    state: absent
    update_repo_cache: true
 - name: Deploy latest version of Authentik chart inside
  kubernetes.core.helm:
    kubeconfig: /Users/lino.silva/.kube/config
    name: authentik
    namespace: traefik
    chart_ref: authentik/authentik
    values: "{{ lookup('template', 'values.yml') | from_yaml }}"
@@ -0,0 +1,22 @@
 authentik:
  secret_key: "fKkVEXDoUdGYwoNb$97xQuG9uw7zu$rFDe6y7!UZ&6$5*cyx6h"
  # This sends anonymous usage-data, stack traces on errors and
  # performance data to sentry.io, and is fully opt-in
  error_reporting:
    enabled: true
  postgresql:
    password: "uNP9W3zMpp4853QF9f@mpJDEXprca@tX@cEj3#BLFR&WFZVBU^"
 ingress:
  enabled: true
  hosts:
    - host: auth.lino.cooking
      paths:
        - path: "/"
          pathType: Prefix
 postgresql:
  enabled: true
  postgresqlPassword: "uNP9W3zMpp4853QF9f@mpJDEXprca@tX@cEj3#BLFR&WFZVBU^"
 redis:
  enabled: true
@@ -0,0 +1,65 @@
 ---
 # From repository
 - name: Add traefik helm repo
  kubernetes.core.helm_repository:
    name: jetstack
    repo_url: "https://charts.jetstack.io"
 - name: Update the repository cache
  kubernetes.core.helm:
    kubeconfig: /Users/lino.silva/.kube/config
    name: dummy
    namespace: kube-system
    state: absent
    update_repo_cache: true
 - name: Download cert-manager.crds manifest to the cluster.
  ansible.builtin.get_url:
    url: https://github.com/cert-manager/cert-manager/releases/download/v1.10.0/cert-manager.crds.yaml
    dest: /tmp/cert-manager.crds.yaml
    mode: "0664"
 - name: Apply cert-manager.crds manifest to the cluster.
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    src: /tmp/cert-manager.crds.yaml
 - name: Deploy latest version of cert-manager chart inside cert-manager namespace (and create it)
  kubernetes.core.helm:
    kubeconfig: /Users/lino.silva/.kube/config
    name: cert-manager
    chart_ref: jetstack/cert-manager
    release_namespace: cert-manager
    create_namespace: true
    values: "{{ lookup('template', 'values.yml') | from_yaml }}"
 - name: Deploy cert-manager secret - Cloudflare
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    definition: "{{ lookup('template', 'secret-cf-token.yml') | from_yaml }}"
 - name: Deploy lets encrypt staging
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    definition: "{{ lookup('template', 'letsencrypt-staging.yml') | from_yaml }}"
 - name: Deploy cert-manager staging
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    definition: "{{ lookup('template', 'lino-cooking.staging.yml') | from_yaml }}"
 - name: Deploy lets encrypt production
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    definition: "{{ lookup('template', 'letsencrypt-production.yml') | from_yaml }}"
 - name: Deploy cert-manager production
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    definition: "{{ lookup('template', 'lino-cooking.prod.yml') | from_yaml }}"
@@ -0,0 +1,21 @@
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
  name: letsencrypt-production
 spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: letsencrypt@lino.cooking
    privateKeySecretRef:
      name: letsencrypt-production
    solvers:
      - dns01:
          cloudflare:
            email: D5&YbHe&oKx82uuTQ^AfW#$*D8GsDE#K3x^446S^wvH#8T@W2C
            apiTokenSecretRef:
              name: cloudflare-api-token-secret
              key: cloudflare-token
        selector:
          dnsZones:
            - "lino.cooking"
@@ -0,0 +1,21 @@
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
  name: letsencrypt-staging
 spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: letsencrypt@lino.cooking
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
      - dns01:
          cloudflare:
            email: okulto+cloudflare@gmail.com
            apiTokenSecretRef:
              name: cloudflare-api-token-secret
              key: api-token
        selector:
          dnsZones:
            - "lino.cooking"
@@ -0,0 +1,15 @@
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: lino-cooking
  namespace: default
 spec:
  secretName: lino-cooking-tls
  issuerRef:
    name: letsencrypt-production
    kind: ClusterIssuer
  commonName: "*.lino.cooking"
  dnsNames:
    - "lino.cooking"
    - "*.lino.cooking"
@@ -0,0 +1,15 @@
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: lino-cooking
  namespace: default
 spec:
  secretName: lino-cooking-staging-tls
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer
  commonName: "*.lino.cooking"
  dnsNames:
    - "lino.cooking"
    - "*.lino.cooking"
@@ -0,0 +1,9 @@
 ---
 apiVersion: v1
 kind: Secret
 metadata:
  name: cloudflare-api-token-secret
  namespace: cert-manager
 type: Opaque
 stringData:
  cloudflare-token: "{{ cloudflare_api_key }}"
@@ -0,0 +1,10 @@
 installCRDs: false
 replicaCount: 3
 extraArgs:
  - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
  - --dns01-recursive-nameservers-only
 podDnsPolicy: None
 podDnsConfig:
  nameservers:
    - "1.1.1.1"
    - "9.9.9.9"
@@ -0,0 +1,7 @@
 ---
 - name: Store kube configuration
  ansible.builtin.fetch:
    src: ~/.kube/config
    dest: ~/.kube/config
    flat: true
  when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']
@@ -0,0 +1,12 @@
 ---
 - name: Deploy admin user
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    definition: "{{ lookup('template', 'dashboard.admin-user.yml') | from_yaml }}"
 - name: Deploy admin user role
  kubernetes.core.k8s:
    kubeconfig: /Users/lino.silva/.kube/config
    state: present
    definition: "{{ lookup('template', 'dashboard.admin-user-role.yml') | from_yaml }}"
@@ -0,0 +1,12 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
  name: admin-user
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
 subjects:
  - kind: ServiceAccount
    name: admin-user
    namespace: kubernetes-dashboard
@@ -0,0 +1,5 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: admin-user
  namespace: kubernetes-dashboard
@@ -5,7 +5,7 @@ server_init_args: >-
    {% if ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname'] %}
      --cluster-init
    {% else %}
-      --server https://{{ hostvars[groups['master'][0]].k3s_node_ip }}:6443
+      --server https://{{ hostvars[groups['master'][0]].ansible_host }}:6443
    {% endif %}
    --token {{ k3s_token }}
  {% endif %}
@@ -1,5 +1,4 @@
 ---
 - name: Clean previous runs of k3s-init
  systemd:
    name: k3s-init
@@ -11,7 +10,7 @@
  failed_when: false
  changed_when: false
  args:
-    warn: false  # The ansible systemd module does not support reset-failed
+    warn: false # The ansible systemd module does not support reset-failed
 - name: Create manifests directory on first master
  file:
@@ -62,12 +61,12 @@
 - name: Init cluster inside the transient k3s-init service
  command:
    cmd: "systemd-run -p RestartSec=2 \
-                      -p Restart=on-failure \
+      -p Restart=on-failure \
-                      --unit=k3s-init \
+      --unit=k3s-init \
-                      k3s server {{ server_init_args }}"
+      k3s server {{ server_init_args }}"
    creates: "{{ systemd_dir }}/k3s.service"
  args:
-    warn: false  # The ansible systemd module does not support transient units
+    warn: false # The ansible systemd module does not support transient units
 - name: Verification
  block:
@@ -76,8 +75,8 @@
        cmd: k3s kubectl get nodes -l "node-role.kubernetes.io/master=true" -o=jsonpath="{.items[*].metadata.name}"
      register: nodes
      until: nodes.rc == 0 and (nodes.stdout.split() | length) == (groups['master'] | length)
-      retries: "{{ retry_count | default(20) }}"
+      retries: "{{ retry_count | default(40) }}"
-      delay: 10
+      delay: 20
      changed_when: false
  always:
    - name: Save logs of k3s-init.service
@@ -85,7 +84,7 @@
      when: log_destination
      vars:
        log_destination: >-
-          {{ lookup('ansible.builtin.env', 'ANSIBLE_K3S_LOG_DIR', default=False) }}
+          {{ lookup('ansible.builtin.env', 'ANSIBLE_K3S_LOG_DIR', default=True) }}
    - name: Kill the temporary service used for initialization
      systemd:
        name: k3s-init
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Lino Silva	1a23832aa9	Added tautulli reverse proxy conf	2023-04-12 13:53:27 +01:00
Lino Silva	4fbe12c336	Added mastodon, tautulli	2023-04-12 13:50:33 +01:00
Lino Silva	e37782b856	feat: Add folding	2023-04-04 14:32:01 +01:00
Lino Silva	d48f3e739b	fix: Mount ids on immich	2023-03-27 18:23:51 +01:00
Lino Silva	a12b6e6c7f	feat: Immich	2023-03-26 23:26:13 +01:00
Lino Silva	0ad4fd3945	fix: Enable ssh	2023-03-26 15:51:28 +01:00
Lino Silva	a43c1593d9	feat: Buncha shit	2023-03-25 23:54:00 +00:00
Lino Silva	fe17c6eb69	feat: Swag with reverse proxy for most services	2023-03-20 23:16:16 +00:00
Lino Silva	cfecd0afd8	feat: Add swag container	2023-03-20 14:56:20 +00:00
Lino Silva	fbd6e53083	feat: added argocd and arr	2023-02-13 14:58:21 +00:00
Lino Silva	5fab069837	feat: Authentik, forward auth proxy	2023-02-09 23:03:36 +00:00
Lino Silva	acd49ed5d8	feat: Shit, multiple things	2023-01-31 15:37:13 +00:00
Lino Silva	51400d260b	feat: Frigate db mountpoint on NFS	2023-01-04 10:23:22 +00:00
lino	8c2abd090c	Merge pull request 'feat/pihole' (#2 ) from feat/pihole into master Reviewed-on: #2	2023-01-03 12:03:19 +00:00
Lino Silva	5d2bd81a14	feat: wtf	2023-01-03 12:02:07 +00:00
Lino Silva	c9c9861a82	feat: changed lxc to vm in k3s	2023-01-03 12:00:52 +00:00
Lino Silva	e596ff0e83	feat: changed lxc to vm in k3s	2023-01-03 11:59:54 +00:00
lino	1913d6417c	Updated frigate playbooks	2023-01-03 11:58:31 +00:00
lino	508e433bab	feat: Frigate Co-authored-by: Lino Silva <lino.silva@farfetch.com> Reviewed-on: #1	2022-11-25 23:29:38 +00:00
Lino Silva	5075a3e697	Add TODO and pre-commit hook	2022-11-20 00:05:51 +00:00
Lino Silva	b27354241d	feat: reverse proxy and certs working	2022-11-19 23:42:06 +00:00
Lino Silva	645dacdca4	feat: Added k3s, metallb, tried adding traefik	2022-11-15 09:35:05 +00:00
lino	f783d35513	Added pre-role for k3s and frigate	2022-11-10 21:01:15 +00:00
Lino Silva	9a7c540c7e	added inventory	2022-11-07 22:52:11 +00:00
Lino Silva	6753d614ee	k3s lxc playbook done	2022-11-07 21:18:02 +00:00
automationxpert	f892029fcf	Adding additional reboot (optional) (#139 ) * Create reboot.yml * Create reboot.sh * Updated the Playbook and Tasks Name Co-authored-by: Techno Tim <timothystewart6@gmail.com>	2022-11-06 05:54:29 +00:00
snoopy82481	6b37ba5e60	chore: ⚡ Multiple configuration changes (#144 ) Added yaml stdout for better readability, optimize ssh connections, moved become to correct section	2022-11-05 21:54:06 -05:00
Techno Tim	b1fee44403	GitHub Actions Fixes (#150 )	2022-11-05 19:57:36 -05:00
Techno Tim	a1c7175bd1	fix(requirements.txt): Use pip-compile (#148 ) * fix(requirements.txt): Use pip-compile * fix(lint): Remove anchors from molecule since they aren't yet supported via lint * fix(lint): Remove anchors from molecule since they aren't yet supported via lint	2022-11-05 18:37:46 -05:00
dependabot[bot]	69d3bdcd88	chore(deps): bump pyrsistent from 0.18.1 to 0.19.2 (#141 ) Bumps [pyrsistent](https://github.com/tobgu/pyrsistent) from 0.18.1 to 0.19.2. - [Release notes](https://github.com/tobgu/pyrsistent/releases) - [Changelog](https://github.com/tobgu/pyrsistent/blob/master/CHANGES.txt) - [Commits](https://github.com/tobgu/pyrsistent/commits) --- updated-dependencies: - dependency-name: pyrsistent dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2022-11-04 23:07:18 -05:00
		`@@ -0,0 +1,3 @@`
							`#!/bin/bash`

							`ansible-playbook reboot.yml -i inventory/my-cluster/hosts.ini`
`@@ -1,3 +1,3 @@`
	`#!/bin/bash`	`#!/bin/bash`

	`ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini`	`ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini --ask-become-pass --ask-vault-pass`