Added tautulli reverse proxy conf

Reviewed-on: #2

.ansible-lint

@@ -1,3 +1,11 @@
 ---
+exclude_paths:
+  # default paths
+  - ".cache/"
+  - ".github/"
+  - "test/fixtures/formatting-before/"
+  - "test/fixtures/formatting-prettier/"
+
 skip_list:
-  - 'fqcn-builtins'
+  - "fqcn-builtins"
+  - "name[play]"

.editorconfig

@@ -0,0 +1,13 @@
+root = true
+[*]
+indent_style = space
+indent_size = 2
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+end_of_line = lf
+max_line_length = off
+[Makefile]
+indent_style = tab
+[*.go]
+indent_style = tab

.github/FUNDING.yml

@@ -1,3 +0,0 @@
----
-github: timothystewart6
-patreon: technotim

.github/ISSUE_TEMPLATE.md

@@ -1,75 +0,0 @@
-
-<!-- It's a good idea to check this post first for general troubleshooting https://github.com/techno-tim/k3s-ansible/discussions/19   -->
-
-<!--- Provide a general summary of the issue in the Title above -->
-
-## Expected Behavior
-
-<!--- Tell us what should happen -->
-
-## Current Behavior
-<!--- Tell us what happens instead of the expected behavior -->
-
-## Steps to Reproduce
-
-<!--- reproduce this bug. Include code to reproduce, if relevant -->
-
-1.
-2.
-3.
-4.
-
-## Context (variables)
-<!--- please include which OS, along with the variables used when running the playbook -->
-
-Operating system:
-
-Hardware:
-
-### Variables Used:
-
-`all.yml`
-
-```yml
-k3s_version: ""
-ansible_user: NA
-systemd_dir: ""
-
-flannel_iface: ""
-
-apiserver_endpoint: ""
-
-k3s_token: "NA"
-
-extra_server_args: ""
-extra_agent_args: ""
-
-kube_vip_tag_version: ""
-
-metal_lb_speaker_tag_version: ""
-metal_lb_controller_tag_version: ""
-
-metal_lb_ip_range: ""
-```
-
-### Hosts 
-
-`host.ini`
-
-```ini
-[master]
-IP.ADDRESS.ONE
-IP.ADDRESS.TWO
-IP.ADDRESS.THREE
-
-[node]
-IP.ADDRESS.FOUR
-IP.ADDRESS.FIVE
-
-[k3s_cluster:children]
-master
-node
-```
-
-## Possible Solution
-<!--- Not obligatory, but suggest a fix/reason for the bug, -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,14 +0,0 @@
-# Proposed Changes
-<!--- Provide a general summary of your changes -->
-
--
--
--
-
-## Checklist
-
-- [ ] Tested locally
-- [ ] Ran `site.yml` playbook
-- [ ] Ran `reset.yml` playbook
-- [ ] Did not add any unnecessary changes
-- [ ] 🚀

.github/workflows/lint.yml

@@ -1,31 +0,0 @@
----
-name: Lint
-'on':
-  pull_request:
-  push:
-    branches:
-      - master
-
-jobs:
-
-  test:
-    name: Lint
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Check out the codebase.
-        uses: actions/checkout@v2
-
-      - name: Set up Python 3.7.
-        uses: actions/setup-python@v2
-        with:
-          python-version: '3.x'
-
-      - name: Install test dependencies.
-        run: pip3 install yamllint ansible-lint ansible
-
-      - name: Run yamllint.
-        run: yamllint .
-
-      - name: Run ansible-lint.
-        run: ansible-lint

.gitignore

@@ -1 +1,2 @@
-.vagrant
+.env/
+*.log

.pre-commit-config.yaml

@@ -0,0 +1,21 @@
+---
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.3.0
+    hooks:
+      - id: requirements-txt-fixer
+      - id: sort-simple-yaml
+      - id: detect-private-key
+  - repo: https://github.com/adrienverge/yamllint.git
+    rev: v1.28.0
+    hooks:
+      - id: yamllint
+        args: [-c=.yamllint]
+  - repo: https://github.com/ansible-community/ansible-lint.git
+    rev: v6.8.2
+    hooks:
+      - id: ansible-lint
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.8.0.4
+    hooks:
+      - id: shellcheck

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+  "prettier.bracketSpacing": false
+}

README.md

@@ -16,21 +16,26 @@ If you want more context on how this works, see:
 
 Build a Kubernetes cluster using Ansible with k3s. The goal is easily install a HA Kubernetes cluster on machines running:
 
-- [X] Debian
+- [x] Debian (tested on version 11)
-- [X] Ubuntu
+- [x] Ubuntu (tested on version 22.04)
-- [X] CentOS
+- [x] Rocky (tested on version 9)
 
 on processor architecture:
 
-- [X] x64
+- [x] x64
-- [X] arm64
+- [x] arm64
-- [X] armhf
+- [x] armhf
 
 ## ✅ System requirements
 
 - Deployment environment must have Ansible 2.4.0+. If you need a quick primer on Ansible [you can check out my docs and setting up Ansible](https://docs.technotim.live/posts/ansible-automation/).
+
+- [`netaddr` package](https://pypi.org/project/netaddr/) must be available to Ansible. If you have installed Ansible via apt, this is already taken care of. If you have installed Ansible via `pip`, make sure to install `netaddr` into the respective virtual environment.
+
 - `server` and `agent` nodes should have passwordless SSH access, if not you can supply arguments to provide credentials `--ask-pass --ask-become-pass` to each command.
 
+- You will also need to install collections that this playbook uses by running `ansible-galaxy collection install -r ./collections/requirements.yml`
+
 ## 🚀 Getting Started
 
 ### 🍴 Preparation
@@ -71,7 +76,7 @@ If needed, you can also edit `inventory/my-cluster/group_vars/all.yml` to match
 Start provisioning of the cluster using the following command:
 
 ```bash
-ansible-playbook site.yml -i inventory/my-cluster/hosts.ini
+ansible-playbook site.yml -i inventory/my-cluster/hosts.ini --ask-become-pass --ask-vault-pass
 ```
 
 After deployment control plane will be accessible via virtual ip-address which is defined in inventory/group_vars/all.yml as `apiserver_endpoint`
@@ -100,19 +105,15 @@ See the commands [here](https://docs.technotim.live/posts/k3s-etcd-ansible/#test
 
 Be sure to see [this post](https://github.com/techno-tim/k3s-ansible/discussions/20) on how to troubleshoot common problems
 
-### 🔷 Vagrant
-
-You may want to kickstart your k3s cluster by using Vagrant to quickly build you all needed VMs with one command.
-Head to the `vagrant` subfolder and type `vagrant up` to get your environment setup.
-After the VMs have got build, deploy k3s using the Ansible playbook `site.yml` by the
-`vagrant provision --provision-with ansible` command.
-
 ## Thanks 🤝
 
-This repo is really standing on the shoulders of giants.  To all those who have contributed.
+This repo is really standing on the shoulders of giants. Thank you to all those who have contributed and tanks to these repos for code and ideas:
-
-Thanks to these repos for code and ideas:
 
 - [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible)
 - [geerlingguy/turing-pi-cluster](https://github.com/geerlingguy/turing-pi-cluster)
 - [212850a/k3s-ansible](https://github.com/212850a/k3s-ansible)
+
+## TODO
+
+- https://docs.k3s.io/installation/kube-dashboard
+- https://www.phillipsj.net/posts/k3s-enable-nfs-storage/

ansible.cfg

@@ -1,12 +1,23 @@
 [defaults]
 nocows                  = True
 roles_path              = ./roles
-inventory  = ./hosts.ini
+inventory               = ./inventory/my-cluster/hosts.ini
+stdout_callback         = yaml
 
 remote_tmp              = $HOME/.ansible/tmp
 local_tmp               = $HOME/.ansible/tmp
-pipelining = True
+timeout                 = 60
-become = True
 host_key_checking       = False
 deprecation_warnings    = False
 callback_whitelist      = profile_tasks
+log_path                = ./ansible.log
+
+[privilege_escalation]
+become                  = True
+
+[ssh_connection]
+scp_if_ssh              = smart
+retries                 = 3
+ssh_args                = -o ControlMaster=auto -o ControlPersist=30m -o Compression=yes -o ServerAliveInterval=15s
+pipelining              = True
+control_path            = %(directory)s/%%h-%%r

collections/requirements.yml

@@ -1,3 +1,7 @@
 ---
 collections:
+  - name: ansible.utils
   - name: community.general
+  - name: ansible.posix
+  - name: kubernetes.core
+  - name: community.docker

inventory/.gitignore

@@ -1,3 +0,0 @@
-*
-!.gitignore
-!sample/

inventory/my-cluster/group_vars/all.yml

@@ -0,0 +1,225 @@
+---
+k3s_version: v1.24.6+k3s1
+# this is the user that has ssh access to these machines
+ansible_user: lino
+systemd_dir: /etc/systemd/system
+
+# Set your timezone
+system_timezone: "Europe/Lisbon"
+
+# apiserver_endpoint is virtual ip-address which will be configured on each master
+apiserver_endpoint: "10.0.3.1"
+
+# k3s_token is required  masters can talk together securely
+# this token should be alpha numeric only
+k3s_token: "7qXiuKpSY9uLwdVSNSnEF5RkttoERixCpc2EVJW7vh7Ws4NMN3"
+
+# The IP on which the node is reachable in the cluster.
+# Here, a sensible default is provided, you can still override
+# it for each of your hosts, though.
+k3s_node_ip: '{{ ansible_facts[flannel_iface]["ipv4"]["address"] }}'
+
+# Disable the taint manually by setting: k3s_master_taint = false
+k3s_master_taint: false
+
+# these arguments are recommended for servers as well as agents:
+extra_args: >-
+  --flannel-iface={{ flannel_iface }}
+  --node-ip={{ k3s_node_ip }}
+
+# change these to your liking, the only required are: --disable servicelb, --tls-san {{ apiserver_endpoint }}
+extra_server_args: >-
+  {{ extra_args }}
+  {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
+  --tls-san {{ apiserver_endpoint }}
+  --disable servicelb
+  --disable traefik
+extra_agent_args: >-
+  {{ extra_args }}
+
+# image tag for kube-vip
+kube_vip_tag_version: "v0.5.5"
+
+# image tag for metal lb
+metal_lb_speaker_tag_version: "v0.13.6"
+metal_lb_controller_tag_version: "v0.13.6"
+
+# metallb ip range for load balancer
+metal_lb_ip_range: "10.0.4.1-10.0.4.254"
+
+lxc_password: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  38303735306236303463613632623161643633663631303931396564346565666236643562316264
+  6533643331306364653564653763356537303932313531350a393261643137636232616335376461
+  66383966333765626539363561613361393665616333303964373761356166623766663232303063
+  3138353333373935660a383230393330646538303933336366383736643333623663333934663131
+  3064
+
+proxmox_api_password: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  35376334616332386130656335663736343337396532663266383934643632363664646631653935
+  6533343936353734343761343465646365616130643130360a316234333036303738663566666364
+  61653638373830383733323563373862346662363339656632643661336533363162616435616531
+  6331326462356366320a303331616366356333306638386130666538633833623162653934616338
+  3566
+
+traefik_http_auth_user: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  38323532616336373939646333613338626431363466633631343162636235623563393135653231
+  3961383965356631613164303566393632323938386664360a373037616335643662613564353130
+  30353832376431633834336234386161313062373437613132623733646166303639313364373637
+  3933626639646536320a303163353835633837356530613931346165353939363235373561333836
+  39366266303064393334383835323330353934643862323330343337393761353166393333376131
+  33303439393531303031653361393530313930363039646566613831373366326432653634653165
+  313735383263623836363030386531613033
+
+cloudflare_api_key: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  38363363386466666266613930386237623430646531303734613863306530666530376433633339
+  3166373361393839363439326661396136616637393865630a666637366132643035343832666335
+  33376139643533313730313135653064393239316162376339653965313366643565643664666534
+  6631393564333230370a303634643030346166383235643666356164393232643832333238313664
+  38346161306138653735303861646638653830633938326566663136393862643264353437623963
+  3462616435653132623563316231343739333761653365333437
+
+dns_cloudflare_api_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          61306235353261303235646331356666643339393164333762303730646563646633626466306436
+          6565303031366262303161323536323236613861373536330a346564306238633461363765623030
+          33343566363163623532386463616431313865316563616162336633353162316134363266363263
+          6331353838343662380a303565643337653164613637323131363037613861306535326538333030
+          64313165343933343535623731393536396332613336316239363764653565346535666531656433
+          6131646439656638323561643264613834356662363332323835
+
+dns_cloudflare_email: cloudflare@lino.cooking
+
+cloudflare_ddns_api_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          32353865663337376239333232376630616436643435343862346164353466356563623930386461
+          3132306361653330356663613534626463373133616132620a313161316137313838666534313737
+          34336161373334356630326432626139666566316663373630656538333331656461373631613931
+          6364313538663464350a343061383835663264616238353965656635343564306635303830343266
+          38396530393133646133643232363061386265373234373832656135393764346462666566656264
+          3635316261393863393736383132386133313666306234343666
+
+homeassistant_pwd: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          34623865646265653733666136316164303765633036616464626133306339393032336465613735
+          3139333561366530383535363834316138303338313030390a306561366265643737623833633837
+          31353332646635353339373937393134376566643539363563613061393731623931643931336566
+          3039626631643930650a393163643534353731316261376638643736623232366431396136313666
+          37613864396630306335626532633832653633346465316332356236393239653063393630323461
+          3862316639643265373166373330333936303233383333653362
+
+gameyfin_pwd: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          64653937643761616366313263363039336262313832623035313635353638393633643330303733
+          3030373063343264633265616638373463383562626132650a643163333961353861626438356339
+          64326161373332396234656664343736356566356561306334306230343335323733306533343563
+          3639656666313434350a303432393831323338313331386262373130633930396365653836633965
+          35623030313533313462666464333339633832643261383839383432366462313262386236346434
+          39646434653137633062346234373965323036636663326437346238373764363261633736356532
+          346437633064623331653362303034653463
+
+igdb_client_id: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          36343238373066633635656365376331626231396666373039636330376132393861373739323061
+          3662366362633461383730633765323530316437626639630a613337333163393539653830366235
+          36636139666332393366366166343064623931326634633161666264333038643537386363663962
+          6430613364653562320a313934393633386262343933363835663639313630653631356563346435
+          61616130336366613066316134303866323838653938393630623763383762316432
+
+igdb_secret: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          65383235643965353066343661616633353163393137326661363862353131333362383336613465
+          3730323833613961326161643730363434643363346138610a313230656534626137373232653633
+          30303163646261666461366161336131326134633832643834623438363137323531393865613761
+          3137316331353531350a306636306233326637623030666634353066396663623663386235393238
+          63303939666561353032396135646666623564616562306637613430663933626530
+
+mastodon_db_user: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          38613037323362636233336166643239636334333333366137306335643836636338343938303135
+          3134373363343964613236313562393966363033623231310a613236383134616566646466633334
+          61323031393663363438336265613062636432343338383936323161313264326662346538366436
+          3863633263643239390a383664663636343934383333623830333931326330613861353333643663
+          66303131633433376562643938313333383335323665643030623461623836643362633034613834
+          61626134386236616538366332313032383732356638356531613534313638316165383665313939
+          633035373238333032303637663366326431
+
+mastodon_db_name: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          64376131373562633437313062366334663738336463613938653564323831316531373233396634
+          3530613830303835666431366438376163383433623561350a653834353761616462316161613037
+          64353430643062316465363764653830313065363261356231356466613533643565613562613437
+          3338303632653865330a326337373830396230343764333231356134616365643138663731613264
+          61323132363839666365326665323236373935666361663063343763363062333130663135366530
+          30366231633932356662663863343330366266366538326232623136363934643334656366343763
+          363833363666643162396434636536323166
+
+mastodon_db_pass: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          66383339653334616233336439376164616532333062393161346238643839393161653932386265
+          3765376366323334613739316162336433623330373131360a653838663436663166373933353064
+          30646663316631653236383437616637396331616339323439353238643866633732323438636138
+          3530306635663631340a306237356664653033663865373964333835613733373565616638363864
+          36333139633033333538306335336165306537303265396631616530366534643465323232336334
+          33636635656130633131623437323764326565656635373265653065646135633066383561643033
+          373333313535343534346331643865616539
+
+mastodon_key_base: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          33346261623634626666383762613065613865306530363831303032656335636332393564653030
+          3866306433323432643930326133303831633437393265620a643234376332336262636364363866
+          33396431653531626538396266626337623735666165636163616262393263373065356330343139
+          3935356133653332370a313039366431343734363430353966386534363234316666613335353562
+          36316435363862646437333431303430613138353338663233646130636436316366323831343531
+          37623063656132336135313964333134323830373761316262386433363337303964366163313265
+          61376438386466636332383932346431313537656332656362376630646565626130303939313432
+          36646233633434383565386465376238373065303831326162386331653631633962353035376266
+          33653332316563333138336439393839336263393438333663383536663834396365666332356334
+          62316264633161363233346263366164643136656464373963303539623465383734326664386130
+          633539303831656364653861336263613432
+
+mastodon_otp_secret: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          65316136326539313931396665656663356536636530613533306531663965303933643939643866
+          3635646438363739303730343834623035613135623130390a316463366362386465353134663264
+          64393337663866333333636635656535373064356263666161633033643635366533653530643336
+          6236396264303463350a306333373231343566653939306564323332633237343463353566343836
+          31323337633238393761656133613230393235663261383961616266373165376263376666333032
+          62313033383339643438376662613235333464323566323763623031616531303238386334623133
+          62653637323034613934313065646565323363313535653931306434393136663961663634313232
+          33653933373537333834363538343432643037646165386633363334613566653538353464303839
+          63373632653235376338336332303064356363653537333363326432306139666238393966306535
+          66633266313465333066613161393734353263366561643865323666633733656439386564326233
+          666338346237313564313937633466373937
+
+mastodon_vapid_private_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          38396438623163636339353633356339363435616262303865663834633436326331363365326433
+          6438633038623639346566376233356339333832383939370a353533356630346163633434346533
+          35386565386438383665623661653533646530623337373334356336396636376630356232656632
+          6634376435383163300a613635613633383765646363643563393062653465353663353935333262
+          35313830623635393737316337336436373730303963303962393365643165656164303633656233
+          3766303666323931623230623533316139666265363231356237
+
+mastodon_vapid_public_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          61653763663734616263633063323466333064636230643263383935313134306163383135353131
+          6166383263353435306333336131373431313363373334330a383031303163346238343061356537
+          36653764366265323165336161303965353434366262616464646162353038353665363132616630
+          6465353939316534340a626533343835303433383531373666643462326162653535313966373963
+          65636561633532613166356666303833306332656266383237363561663239616139666465383532
+          65613361663534616533343631386634316661616132383035333734353561643934353339373832
+          34626531373530306464336437383636633830616336393265373934613030386534323335303436
+          32373034336162346364643139353961323831636134313538333162373665373330636564306162
+          3337
+
+gmail_smtp_pass: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          31396436653866313237616361636439343765323730383231633739643433646365383137343037
+          3535373866653261303761396163373334383461323661380a376561663864346633646230633531
+          35326435323434386564363037383961383934363163653635346233306139303664323037383435
+          3763313639656566620a623639386437353662316631316638363862323334323838643037336464
+          64373730623035616464303230626462666166636236363033633132363236306132

inventory/my-cluster/host_vars/cloudflare-ddns

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.16
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 607

inventory/my-cluster/host_vars/dahua-to-mqtt

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.17
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 608

inventory/my-cluster/host_vars/epona

@@ -0,0 +1,10 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.2
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+ip_addr: 10.0.2.2
+
+# interface which will be used for flannel
+
+flannel_iface: "vmbr0"

inventory/my-cluster/host_vars/epona-pihole

@@ -0,0 +1,8 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.13
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+mac_addr: EA:11:8B:05:5A:88
+vmid: 203
+node: epona

inventory/my-cluster/host_vars/folding

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.19
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 610

inventory/my-cluster/host_vars/frigate

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.14
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 605

inventory/my-cluster/host_vars/hyrule

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.0.2
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+

inventory/my-cluster/host_vars/immich

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.18
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 609

inventory/my-cluster/host_vars/impa

@@ -0,0 +1,9 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.3.111
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+
+# interface which will be used for flannel
+
+flannel_iface: "eth0"

inventory/my-cluster/host_vars/mastodon

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.20
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 611

inventory/my-cluster/host_vars/mipha

@@ -0,0 +1,7 @@
+---
+ansible_user: root
+ansible_host: 10.0.2.3
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+ip_addr: 10.0.2.3
+# interface which will be used for flannel
+flannel_iface: "vmbr0"

inventory/my-cluster/host_vars/revali

@@ -0,0 +1,7 @@
+---
+ansible_user: root
+ansible_host: 10.0.2.4
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+ip_addr: 10.0.2.4
+# interface which will be used for flannel
+flannel_iface: "vmbr0"

inventory/my-cluster/host_vars/revali-pihole

@@ -0,0 +1,8 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.12
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+mac_addr: C2:F5:B2:99:92:51
+vmid: 202
+node: revali

inventory/my-cluster/host_vars/swag

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.15
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 606

inventory/my-cluster/host_vars/tautulli

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.21
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 612

inventory/my-cluster/host_vars/tingle

@@ -0,0 +1,9 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.3.110
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+
+# interface which will be used for flannel
+
+flannel_iface: "eth0"

inventory/my-cluster/host_vars/urbosa-pihole

@@ -0,0 +1,7 @@
+---
+ansible_user: root
+ansible_host: 10.0.2.11
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+mac_addr: 72:2E:3C:F0:2A:B3
+vmid: 201
+node: mipha

inventory/my-cluster/host_vars/yuga

@@ -0,0 +1,7 @@
+---
+ansible_user: root
+ansible_host: 10.0.2.7
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+ip_addr: 10.0.2.7
+# interface which will be used for flannel
+flannel_iface: "vmbr0"

inventory/my-cluster/hosts.ini

@@ -0,0 +1,21 @@
+[lxc]
+frigate
+swag
+cloudflare-ddns
+dahua-to-mqtt
+immich
+folding
+mastodon
+tautulli
+
+[baremetal]
+mipha
+epona
+revali
+yuga
+hyrule
+
+[pihole]
+epona-pihole
+revali-pihole
+urbosa-pihole

inventory/sample/group_vars/all.yml

@@ -1,32 +0,0 @@
----
-k3s_version: v1.23.4+k3s1
-# this is the user that has ssh access to these machines
-ansible_user: ansibleuser
-systemd_dir: /etc/systemd/system
-
-# Set your timezone
-system_timezone: "Your/Timezone"
-
-# interface which will be used for flannel
-flannel_iface: "eth0"
-
-# apiserver_endpoint is virtual ip-address which will be configured on each master
-apiserver_endpoint: "192.168.30.222"
-
-# k3s_token is required  masters can talk together securely
-# this token should be alpha numeric only
-k3s_token: "some-SUPER-DEDEUPER-secret-password"
-
-# change these to your liking, the only required one is--no-deploy servicelb
-extra_server_args: "--no-deploy servicelb --no-deploy traefik"
-extra_agent_args: ""
-
-# image tag for kube-vip
-kube_vip_tag_version: "v0.4.4"
-
-# image tag for metal lb
-metal_lb_speaker_tag_version: "v0.12.1"
-metal_lb_controller_tag_version: "v0.12.1"
-
-# metallb ip range for load balancer
-metal_lb_ip_range: "192.168.30.80-192.168.30.90"

inventory/sample/hosts.ini

@@ -1,12 +0,0 @@
-[master]
-192.168.30.38
-192.168.30.39
-192.168.30.40
-
-[node]
-192.168.30.41
-192.168.30.42
-
-[k3s_cluster:children]
-master
-node

playbook-cloudflare-ddns.yml

@@ -0,0 +1,19 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    # - role: cloudflare-ddns/provision/delete
+    - role: cloudflare-ddns/provision/create
+    - role: cloudflare-ddns/provision/start
+
+- hosts: revali
+  become: yes
+  roles:
+    - role: lxc/enable-ssh
+
+- hosts: cloudflare-ddns
+  become: yes
+  roles:
+    - role: cloudflare-ddns/update
+    - role: cloudflare-ddns/install-docker
+    - role: cloudflare-ddns/install-app

playbook-dahua-to-mqtt.yml

@@ -0,0 +1,23 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    # - role: dahua-to-mqtt/provision/delete
+    # - role: dahua-to-mqtt/provision/create
+    - role: dahua-to-mqtt/provision/start
+      vars:
+        vmid: 608
+
+- hosts: revali
+  become: yes
+  roles:
+    - role: dahua-to-mqtt/enable-ssh
+      vars:
+        vmid: 608
+
+- hosts: dahua-to-mqtt
+  become: yes
+  roles:
+    - role: dahua-to-mqtt/update
+    - role: dahua-to-mqtt/install-docker
+    - role: dahua-to-mqtt/install-app

playbook-folding.yml

@@ -0,0 +1,22 @@
+---
+# - hosts: localhost
+#   become: yes
+#   roles:
+#     - role: folding/provision/delete
+#     - role: folding/provision/create
+#     - role: folding/provision/start
+#       vars:
+#         vmid: 610
+
+- hosts: hyrule
+  become: yes
+  roles:
+    - role: folding/enable-ssh
+      vars:
+        vmid: 610
+
+- hosts: folding
+  become: yes
+  roles:
+    - role: folding/update
+    - role: folding/install-app

playbook-frigate.yml

@@ -0,0 +1,28 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    - role: frigate/provision/delete
+    - role: frigate/provision/create
+
+- hosts: epona
+  become: yes
+  roles:
+    - role: frigate/provision/cgroup
+
+- hosts: localhost
+  become: yes
+  roles:
+    - role: frigate/provision/start
+
+- hosts: epona
+  become: yes
+  roles:
+    - role: lxc/enable-ssh
+
+- hosts: frigate
+  become: yes
+  roles:
+    - role: frigate/update
+    - role: frigate/install-docker
+    - role: frigate/install-app

playbook-immich.yml

@@ -0,0 +1,23 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    - role: immich/provision/delete
+    - role: immich/provision/create
+    - role: immich/provision/start
+      vars:
+        vmid: 609
+
+- hosts: hyrule
+  become: yes
+  roles:
+    - role: immich/enable-ssh
+      vars:
+        vmid: 609
+
+- hosts: immich
+  become: yes
+  roles:
+    - role: immich/update
+    - role: immich/install-docker
+    - role: immich/install-app

playbook-k3s.yml

@@ -0,0 +1,38 @@
+---
+# - hosts: k3s_cluster
+#   gather_facts: yes
+#   become: yes
+#   roles:
+#     - role: prereq
+#     - role: download
+
+# - hosts: master
+#   become: yes
+#   roles:
+#     - role: k3s/master
+
+# - hosts: node
+#   become: yes
+#   roles:
+#     - role: k3s/node
+
+# - hosts: master
+#   become: yes
+#   roles:
+#     - role: k3s/post
+
+# - hosts: master
+#   become: yes
+#   roles:
+#     - role: k3s/copy-config
+
+- hosts: localhost
+  become: yes
+  roles:
+    # - role: traefik
+    # - role: cert-manager
+    # - role: authentik
+    - role: argocd
+    # - role: nginx
+    # - role: arr
+    # - role: redis

playbook-mastodon.yml

@@ -0,0 +1,23 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    - role: mastodon/provision/delete
+    - role: mastodon/provision/create
+    - role: mastodon/provision/start
+      vars:
+        vmid: 611
+
+- hosts: epona
+  become: yes
+  roles:
+    - role: mastodon/enable-ssh
+      vars:
+        vmid: 611
+
+- hosts: mastodon
+  become: yes
+  roles:
+    - role: mastodon/update
+    - role: mastodon/install-docker
+    - role: mastodon/install-app

playbook-swag.yml

@@ -0,0 +1,19 @@
+---
+# - hosts: localhost
+#   become: yes
+#   roles:
+#     - role: swag/provision/delete
+#     - role: swag/provision/create
+#     - role: swag/provision/start
+
+# - hosts: mipha
+#   become: yes
+#   roles:
+#     - role: lxc/enable-ssh
+
+- hosts: swag
+  become: yes
+  roles:
+    # - role: swag/update
+    # - role: swag/install-docker
+    - role: swag/install-app

playbook-tautulli.yml

@@ -0,0 +1,23 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    - role: tautulli/provision/delete
+    - role: tautulli/provision/create
+    - role: tautulli/provision/start
+      vars:
+        vmid: 612
+
+- hosts: epona
+  become: yes
+  roles:
+    - role: tautulli/enable-ssh
+      vars:
+        vmid: 612
+
+- hosts: tautulli
+  become: yes
+  roles:
+    - role: tautulli/update
+    - role: tautulli/install-docker
+    - role: tautulli/install-app

playbook-update-lxc.yml

@@ -0,0 +1,15 @@
+---
+- hosts: frigate
+  become: yes
+  roles:
+    - role: frigate/update
+
+- hosts: cloudflare-ddns
+  become: yes
+  roles:
+    - role: cloudflare-ddns/update
+
+- hosts: swag
+  become: yes
+  roles:
+    - role: swag/update

reboot.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+ansible-playbook reboot.yml -i inventory/my-cluster/hosts.ini

reboot.yml

@@ -0,0 +1,9 @@
+---
+- name: Reboot k3s_cluster
+  hosts: k3s_cluster
+  gather_facts: yes
+  become: yes
+  tasks:
+    - name: Reboot the nodes (and Wait upto 5 mins max)
+      reboot:
+        reboot_timeout: 300

requirements.in

@@ -0,0 +1,10 @@
+ansible-core>=2.13.2
+ansible-lint>=6.6.0
+kubernetes>=12.0.0
+netaddr>=0.8.0
+pyyaml>=3.11
+yamllint>=1.28.0
+jmespath>=1.0.1
+jsonpatch>=1.32
+pre-commit>=2.20.0
+netaddr>=0.8.0

requirements.txt

@@ -0,0 +1,218 @@
+#
+# This file is autogenerated by pip-compile with python 3.8
+# To update, run:
+#
+#    pip-compile requirements.in
+#
+ansible-compat==2.2.4
+    # via
+    #   ansible-lint
+ansible-core==2.13.5
+    # via
+    #   -r requirements.in
+    #   ansible-lint
+ansible-lint==6.8.6
+    # via -r requirements.in
+arrow==1.2.3
+    # via jinja2-time
+attrs==22.1.0
+    # via jsonschema
+binaryornot==0.4.4
+    # via cookiecutter
+black==22.10.0
+    # via ansible-lint
+bracex==2.3.post1
+    # via wcmatch
+cachetools==5.2.0
+    # via google-auth
+certifi==2022.9.24
+    # via
+    #   kubernetes
+    #   requests
+cffi==1.15.1
+    # via cryptography
+cfgv==3.3.1
+    # via pre-commit
+chardet==5.0.0
+    # via binaryornot
+charset-normalizer==2.1.1
+    # via requests
+click==8.1.3
+    # via
+    #   black
+    #   click-help-colors
+    #   cookiecutter
+click-help-colors==0.9.1
+commonmark==0.9.1
+    # via rich
+cookiecutter==2.1.1
+cryptography==38.0.3
+    # via ansible-core
+distlib==0.3.6
+    # via virtualenv
+distro==1.8.0
+    # via selinux
+enrich==1.2.7
+    # via molecule
+filelock==3.8.0
+    # via
+    #   ansible-lint
+    #   virtualenv
+google-auth==2.14.0
+    # via kubernetes
+identify==2.5.8
+    # via pre-commit
+idna==3.4
+    # via requests
+importlib-resources==5.10.0
+    # via jsonschema
+jinja2==3.1.2
+    # via
+    #   ansible-core
+    #   cookiecutter
+    #   jinja2-time
+    #   molecule
+    #   molecule-vagrant
+jinja2-time==0.2.0
+    # via cookiecutter
+jmespath==1.0.1
+    # via -r requirements.in
+jsonpatch==1.32
+    # via -r requirements.in
+jsonpointer==2.3
+    # via jsonpatch
+jsonschema==4.17.0
+    # via
+    #   ansible-compat
+    #   ansible-lint
+    #   molecule
+kubernetes==25.3.0
+    # via -r requirements.in
+markupsafe==2.1.1
+    # via jinja2
+molecule==4.0.3
+    # via
+    #   -r requirements.in
+    #   molecule-vagrant
+molecule-vagrant==1.0.0
+    # via -r requirements.in
+mypy-extensions==0.4.3
+    # via black
+netaddr==0.8.0
+    # via -r requirements.in
+nodeenv==1.7.0
+    # via pre-commit
+oauthlib==3.2.2
+    # via requests-oauthlib
+packaging==21.3
+    # via
+    #   ansible-compat
+    #   ansible-core
+    #   ansible-lint
+    #   molecule
+pathspec==0.10.1
+    # via
+    #   black
+    #   yamllint
+pkgutil-resolve-name==1.3.10
+    # via jsonschema
+platformdirs==2.5.2
+    # via
+    #   black
+    #   virtualenv
+pluggy==1.0.0
+    # via molecule
+pre-commit==2.20.0
+    # via -r requirements.in
+pyasn1==0.4.8
+    # via
+    #   pyasn1-modules
+    #   rsa
+pyasn1-modules==0.2.8
+    # via google-auth
+pycparser==2.21
+    # via cffi
+pygments==2.13.0
+    # via rich
+pyparsing==3.0.9
+    # via packaging
+pyrsistent==0.19.2
+    # via jsonschema
+python-dateutil==2.8.2
+    # via
+    #   arrow
+    #   kubernetes
+python-slugify==6.1.2
+    # via cookiecutter
+python-vagrant==1.0.0
+    # via molecule-vagrant
+pyyaml==6.0
+    # via
+    #   -r requirements.in
+    #   ansible-compat
+    #   ansible-core
+    #   ansible-lint
+    #   cookiecutter
+    #   kubernetes
+    #   molecule
+    #   molecule-vagrant
+    #   pre-commit
+    #   yamllint
+requests==2.28.1
+    # via
+    #   cookiecutter
+    #   kubernetes
+    #   requests-oauthlib
+requests-oauthlib==1.3.1
+    # via kubernetes
+resolvelib==0.8.1
+    # via ansible-core
+rich==12.6.0
+    # via
+    #   ansible-lint
+    #   enrich
+    #   molecule
+rsa==4.9
+    # via google-auth
+ruamel-yaml==0.17.21
+    # via ansible-lint
+ruamel-yaml-clib==0.2.7
+    # via ruamel-yaml
+selinux==0.2.1
+    # via molecule-vagrant
+six==1.16.0
+    # via
+    #   google-auth
+    #   kubernetes
+    #   python-dateutil
+subprocess-tee==0.3.5
+    # via ansible-compat
+text-unidecode==1.3
+    # via python-slugify
+toml==0.10.2
+    # via pre-commit
+tomli==2.0.1
+    # via black
+typing-extensions==4.4.0
+    # via
+    #   black
+    #   rich
+urllib3==1.26.12
+    # via
+    #   kubernetes
+    #   requests
+virtualenv==20.16.6
+    # via pre-commit
+wcmatch==8.4.1
+    # via ansible-lint
+websocket-client==1.4.2
+    # via kubernetes
+yamllint==1.28.0
+    # via
+    #   -r requirements.in
+    #   ansible-lint
+zipp==3.10.0
+    # via importlib-resources
+
+# The following packages are considered to be unsafe in a requirements file:
+# setuptools

reset.sh

@@ -1,3 +1,3 @@
 #!/bin/bash
 
-ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini
+ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini --ask-become-pass --ask-vault-pass

reset.yml

@@ -1,7 +1,10 @@
 ---
-
 - hosts: k3s_cluster
   gather_facts: yes
   become: yes
   roles:
     - role: reset
+  post_tasks:
+    - name: Reboot and wait for node to come back up
+      reboot:
+        reboot_timeout: 3600

roles/archive/argocd/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Create argocd namespace
+  kubernetes.core.k8s:
+    name: argocd
+    kubeconfig: /Users/lino.silva/.kube/config
+    api_version: v1
+    kind: Namespace
+    state: present
+
+- name: Install argocd
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    namespace: argocd
+    definition: "{{ lookup('template', 'install.yml') | from_yaml }}"
+
+- name: Deploy forwardauth middleware
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
+
+- name: Deploy argocd - ingress
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"

roles/archive/argocd/templates/ingress.yml

@@ -0,0 +1,37 @@
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: argocd
+  namespace: argocd
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`argocd.lino.cooking`)
+      kind: Rule
+      services:
+        - name: argocd-server
+          port: 80
+      middlewares:
+        - name: argocd-forwardauth
+          namespace: argocd
+    - match: Host(`argocd.lino.cooking`) && Headers(`Content-Type`, `application/grpc`)
+      kind: Rule
+      services:
+        - name: argocd-server
+          port: 80
+          scheme: h2c
+    - match: "Host(`argocd.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
+      kind: Rule
+      priority: 15
+      services:
+        - kind: Service
+          # Or, to use an external Outpost, create an ExternalName service and reference that here.
+          # See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
+          name: authentik
+          port: 9000
+  tls:
+    secretName: lino-cooking-tls

roles/archive/argocd/templates/middleware-forwardauth.yml

@@ -0,0 +1,21 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: argocd-forwardauth
+  namespace: argocd
+spec:
+  forwardAuth:
+    address: https://argocd.lino.cooking/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version

roles/archive/arr/tasks/main.yml

@@ -0,0 +1,64 @@
+---
+# - name: Create a arr-apps namespace
+#   kubernetes.core.k8s:
+#     name: arr-apps
+#     kubeconfig: /Users/lino.silva/.kube/config
+#     api_version: v1
+#     kind: Namespace
+#     state: present
+
+- name: Deploy arr - deployment
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'deployment.yml') | from_yaml }}"
+  loop:
+    - { name: 'radarr', port: 7878 }
+    - { name: 'prowlarr', port: 9696 }
+    - { name: 'sonarr', port: 8989 }
+    - { name: 'overseerr', port: 5055 }
+    - { name: 'transmission', port: 9091 }
+    - { name: 'bazarr', port: 6767 }
+    - { name: 'lidarr', port: 8686 }
+
+- name: Deploy arr services
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'service.yml') | from_yaml }}"
+  loop:
+    - { name: 'radarr', port: 7878 }
+    - { name: 'prowlarr', port: 9696 }
+    - { name: 'sonarr', port: 8989 }
+    - { name: 'overseerr', port: 5055 }
+    - { name: 'transmission', port: 9091 }
+    - { name: 'bazarr', port: 6767 }
+    - { name: 'lidarr', port: 8686 }
+
+- name: Deploy forwardauth middleware
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
+  loop:
+    - radarr
+    - prowlarr
+    - sonarr
+    - overseerr
+    - transmission
+    - bazarr
+    - lidarr
+
+- name: Deploy arr - ingress
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"
+  loop:
+    - { name: 'radarr', port: 7878 }
+    - { name: 'prowlarr', port: 9696 }
+    - { name: 'sonarr', port: 8989 }
+    - { name: 'overseerr', port: 5055 }
+    - { name: 'transmission', port: 9091 }
+    - { name: 'bazarr', port: 6767 }
+    - { name: 'lidarr', port: 8686 }

roles/archive/arr/templates/deployment.yml

@@ -0,0 +1,30 @@
+---
+- kind: Deployment
+  apiVersion: apps/v1
+  metadata:
+    name: {{ item.name }}
+    namespace: default
+    labels:
+      app: {{ item.name }}
+  spec:
+    replicas: 1
+    progressDeadlineSeconds: 600
+    revisionHistoryLimit: 2
+    strategy:
+      type: Recreate
+    selector:
+      matchLabels:
+        app: {{ item.name }}
+    template:
+      metadata:
+        labels:
+          app: {{ item.name }}
+      spec:
+        containers:
+          - name: {{ item.name }}
+            image: linuxserver/{{ item.name }}
+            ports:
+              - name: app-port
+                containerPort: {{ item.port }}
+                hostPort: {{ item.port }}
+                protocol: TCP

roles/archive/arr/templates/ingress.yml

@@ -0,0 +1,32 @@
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: {{ item.name }}
+  namespace: default
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`{{ item.name }}.lino.cooking`)
+      kind: Rule
+      services:
+        - name: {{ item.name }}
+          port: {{ item.port }}
+      middlewares:
+        - name: default-headers
+        - name: {{ item.name }}-forwardauth
+          namespace: traefik
+    - match: "Host(`{{ item.name }}.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
+      kind: Rule
+      priority: 15
+      services:
+        - kind: Service
+          # Or, to use an external Outpost, create an ExternalName service and reference that here.
+          # See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
+          name: authentik
+          port: 9000
+  tls:
+    secretName: lino-cooking-tls

roles/archive/arr/templates/middleware-forwardauth.yml

@@ -0,0 +1,21 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ item }}-forwardauth
+  namespace: traefik
+spec:
+  forwardAuth:
+    address: https://{{ item }}.lino.cooking/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version

roles/archive/arr/templates/service.yml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ item.name }}
+  namespace: default
+spec:
+  selector:
+    app: {{ item.name }}
+  ports:
+    - name: http
+      targetPort: {{ item.port }}
+      port: {{ item.port }}

roles/archive/authentik/tasks/main.yml

@@ -0,0 +1,21 @@
+---
+- name: Add authentik helm repo
+  kubernetes.core.helm_repository:
+    name: authentik
+    repo_url: "https://charts.goauthentik.io"
+
+- name: Update the repository cache
+  kubernetes.core.helm:
+    kubeconfig: /Users/lino.silva/.kube/config
+    name: dummy
+    namespace: kube-system
+    state: absent
+    update_repo_cache: true
+
+- name: Deploy latest version of Authentik chart inside
+  kubernetes.core.helm:
+    kubeconfig: /Users/lino.silva/.kube/config
+    name: authentik
+    namespace: traefik
+    chart_ref: authentik/authentik
+    values: "{{ lookup('template', 'values.yml') | from_yaml }}"

roles/archive/authentik/templates/values.yml

@@ -0,0 +1,22 @@
+authentik:
+  secret_key: "fKkVEXDoUdGYwoNb$97xQuG9uw7zu$rFDe6y7!UZ&6$5*cyx6h"
+  # This sends anonymous usage-data, stack traces on errors and
+  # performance data to sentry.io, and is fully opt-in
+  error_reporting:
+    enabled: true
+  postgresql:
+    password: "uNP9W3zMpp4853QF9f@mpJDEXprca@tX@cEj3#BLFR&WFZVBU^"
+
+ingress:
+  enabled: true
+  hosts:
+    - host: auth.lino.cooking
+      paths:
+        - path: "/"
+          pathType: Prefix
+
+postgresql:
+  enabled: true
+  postgresqlPassword: "uNP9W3zMpp4853QF9f@mpJDEXprca@tX@cEj3#BLFR&WFZVBU^"
+redis:
+  enabled: true

roles/archive/cert-manager/tasks/main.yml

@@ -0,0 +1,65 @@
+---
+# From repository
+- name: Add traefik helm repo
+  kubernetes.core.helm_repository:
+    name: jetstack
+    repo_url: "https://charts.jetstack.io"
+
+- name: Update the repository cache
+  kubernetes.core.helm:
+    kubeconfig: /Users/lino.silva/.kube/config
+    name: dummy
+    namespace: kube-system
+    state: absent
+    update_repo_cache: true
+
+- name: Download cert-manager.crds manifest to the cluster.
+  ansible.builtin.get_url:
+    url: https://github.com/cert-manager/cert-manager/releases/download/v1.10.0/cert-manager.crds.yaml
+    dest: /tmp/cert-manager.crds.yaml
+    mode: "0664"
+
+- name: Apply cert-manager.crds manifest to the cluster.
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    src: /tmp/cert-manager.crds.yaml
+
+- name: Deploy latest version of cert-manager chart inside cert-manager namespace (and create it)
+  kubernetes.core.helm:
+    kubeconfig: /Users/lino.silva/.kube/config
+    name: cert-manager
+    chart_ref: jetstack/cert-manager
+    release_namespace: cert-manager
+    create_namespace: true
+    values: "{{ lookup('template', 'values.yml') | from_yaml }}"
+
+- name: Deploy cert-manager secret - Cloudflare
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'secret-cf-token.yml') | from_yaml }}"
+
+- name: Deploy lets encrypt staging
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'letsencrypt-staging.yml') | from_yaml }}"
+
+- name: Deploy cert-manager staging
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'lino-cooking.staging.yml') | from_yaml }}"
+
+- name: Deploy lets encrypt production
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'letsencrypt-production.yml') | from_yaml }}"
+
+- name: Deploy cert-manager production
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'lino-cooking.prod.yml') | from_yaml }}"

roles/archive/cert-manager/templates/letsencrypt-production.yml

@@ -0,0 +1,21 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-production
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: letsencrypt@lino.cooking
+    privateKeySecretRef:
+      name: letsencrypt-production
+    solvers:
+      - dns01:
+          cloudflare:
+            email: D5&YbHe&oKx82uuTQ^AfW#$*D8GsDE#K3x^446S^wvH#8T@W2C
+            apiTokenSecretRef:
+              name: cloudflare-api-token-secret
+              key: cloudflare-token
+        selector:
+          dnsZones:
+            - "lino.cooking"

roles/archive/cert-manager/templates/letsencrypt-staging.yml

@@ -0,0 +1,21 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: letsencrypt@lino.cooking
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    solvers:
+      - dns01:
+          cloudflare:
+            email: okulto+cloudflare@gmail.com
+            apiTokenSecretRef:
+              name: cloudflare-api-token-secret
+              key: api-token
+        selector:
+          dnsZones:
+            - "lino.cooking"

roles/archive/cert-manager/templates/lino-cooking.prod.yml

@@ -0,0 +1,15 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: lino-cooking
+  namespace: default
+spec:
+  secretName: lino-cooking-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "*.lino.cooking"
+  dnsNames:
+    - "lino.cooking"
+    - "*.lino.cooking"

roles/archive/cert-manager/templates/lino-cooking.staging.yml

@@ -0,0 +1,15 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: lino-cooking
+  namespace: default
+spec:
+  secretName: lino-cooking-staging-tls
+  issuerRef:
+    name: letsencrypt-staging
+    kind: ClusterIssuer
+  commonName: "*.lino.cooking"
+  dnsNames:
+    - "lino.cooking"
+    - "*.lino.cooking"

roles/archive/cert-manager/templates/secret-cf-token.yml

@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflare-api-token-secret
+  namespace: cert-manager
+type: Opaque
+stringData:
+  cloudflare-token: "{{ cloudflare_api_key }}"

roles/archive/cert-manager/templates/values.yml

@@ -0,0 +1,10 @@
+installCRDs: false
+replicaCount: 3
+extraArgs:
+  - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
+  - --dns01-recursive-nameservers-only
+podDnsPolicy: None
+podDnsConfig:
+  nameservers:
+    - "1.1.1.1"
+    - "9.9.9.9"

roles/archive/k3s/copy-config/tasks/main.yml

@@ -0,0 +1,7 @@
+---
+- name: Store kube configuration
+  ansible.builtin.fetch:
+    src: ~/.kube/config
+    dest: ~/.kube/config
+    flat: true
+  when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']

roles/archive/k3s/dashboard/tasks/main.yml

@@ -0,0 +1,12 @@
+---
+- name: Deploy admin user
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'dashboard.admin-user.yml') | from_yaml }}"
+
+- name: Deploy admin user role
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'dashboard.admin-user-role.yml') | from_yaml }}"

roles/archive/k3s/dashboard/templates/dashboard.admin-user-role.yml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: admin-user
+    namespace: kubernetes-dashboard

roles/archive/k3s/dashboard/templates/dashboard.admin-user.yml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: admin-user
+  namespace: kubernetes-dashboard

roles/archive/k3s/master/defaults/main.yml

@@ -2,10 +2,10 @@
 ansible_user: root
 server_init_args: >-
   {% if groups['master'] | length > 1 %}
-    {% if ansible_host == hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0]) %}
+    {% if ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname'] %}
       --cluster-init
     {% else %}
-      --server https://{{ hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0]) }}:6443
+      --server https://{{ hostvars[groups['master'][0]].ansible_host }}:6443
     {% endif %}
     --token {{ k3s_token }}
   {% endif %}

roles/archive/k3s/master/tasks/fetch_k3s_init_logs.yml

@@ -0,0 +1,28 @@
+---
+# Download logs of k3s-init.service from the nodes to localhost.
+# Note that log_destination must be set.
+
+- name: Fetch k3s-init.service logs
+  ansible.builtin.command:
+    cmd: journalctl --all --unit=k3s-init.service
+  changed_when: false
+  register: k3s_init_log
+
+- name: Create {{ log_destination }}
+  delegate_to: localhost
+  run_once: true
+  become: false
+  ansible.builtin.file:
+    path: "{{ log_destination }}"
+    state: directory
+    mode: "0755"
+
+- name: Store logs to {{ log_destination }}
+  delegate_to: localhost
+  become: false
+  ansible.builtin.template:
+    src: content.j2
+    dest: "{{ log_destination }}/k3s-init@{{ ansible_hostname }}.log"
+    mode: 0644
+  vars:
+    content: "{{ k3s_init_log.stdout }}"

roles/archive/k3s/master/tasks/main.yml

@@ -1,5 +1,4 @@
 ---
-
 - name: Clean previous runs of k3s-init
   systemd:
     name: k3s-init
@@ -20,16 +19,16 @@
     owner: root
     group: root
     mode: 0644
-  when: ansible_host == hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0])
+  when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']
 
 - name: Copy vip rbac manifest to first master
   template:
     src: "vip.rbac.yaml.j2"
-    dest: "/var/lib/rancher/k3s/server/manifests/vip.rbac.yaml"
+    dest: "/var/lib/rancher/k3s/server/manifests/vip-rbac.yaml"
     owner: root
     group: root
     mode: 0644
-  when: ansible_host == hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0])
+  when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']
 
 - name: Copy vip manifest to first master
   template:
@@ -38,34 +37,26 @@
     owner: root
     group: root
     mode: 0644
-  when: ansible_host == hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0])
+  when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']
 
-- name: Copy metallb namespace manifest to first master
+# these will be copied and installed now, then tested later and apply config
+- name: Copy metallb namespace to first master
   template:
     src: "metallb.namespace.j2"
-    dest: "/var/lib/rancher/k3s/server/manifests/metallb.namespace.yaml"
+    dest: "/var/lib/rancher/k3s/server/manifests/metallb-namespace.yaml"
     owner: root
     group: root
     mode: 0644
-  when: ansible_host == hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0])
+  when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']
 
-- name: Copy metallb ConfigMap manifest to first master
+- name: Copy metallb namespace to first master
   template:
-    src: "metallb.configmap.j2"
+    src: "metallb.crds.j2"
-    dest: "/var/lib/rancher/k3s/server/manifests/metallb.configmap.yaml"
+    dest: "/var/lib/rancher/k3s/server/manifests/metallb-crds.yaml"
     owner: root
     group: root
     mode: 0644
-  when: ansible_host == hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0])
+  when: ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname']
-
-- name: Copy metallb main manifest to first master
-  template:
-    src: "metallb.yaml.j2"
-    dest: "/var/lib/rancher/k3s/server/manifests/metallb.yaml"
-    owner: root
-    group: root
-    mode: 0644
-  when: ansible_host == hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0])
 
 - name: Init cluster inside the transient k3s-init service
   command:
@@ -84,15 +75,22 @@
         cmd: k3s kubectl get nodes -l "node-role.kubernetes.io/master=true" -o=jsonpath="{.items[*].metadata.name}"
       register: nodes
       until: nodes.rc == 0 and (nodes.stdout.split() | length) == (groups['master'] | length)
-      retries: "{{ retry_count | default(20) }}"
+      retries: "{{ retry_count | default(40) }}"
-      delay: 10
+      delay: 20
       changed_when: false
   always:
+    - name: Save logs of k3s-init.service
+      include_tasks: fetch_k3s_init_logs.yml
+      when: log_destination
+      vars:
+        log_destination: >-
+          {{ lookup('ansible.builtin.env', 'ANSIBLE_K3S_LOG_DIR', default=True) }}
     - name: Kill the temporary service used for initialization
       systemd:
         name: k3s-init
         state: stopped
       failed_when: false
+  when: not ansible_check_mode
 
 - name: Copy K3s service file
   register: k3s_service
@@ -153,12 +151,19 @@
     owner: "{{ ansible_user }}"
     mode: "u=rw,g=,o="
 
-- name: Configure kubectl cluster to https://{{ apiserver_endpoint }}:6443
+- name: Configure kubectl cluster to {{ endpoint_url }}
   command: >-
     k3s kubectl config set-cluster default
-      --server=https://{{ apiserver_endpoint }}:6443
+      --server={{ endpoint_url }}
       --kubeconfig ~{{ ansible_user }}/.kube/config
   changed_when: true
+  vars:
+    endpoint_url: >-
+      https://{{ apiserver_endpoint | ansible.utils.ipwrap }}:6443
+  # Deactivated linter rules:
+  #   - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap
+  #                     would be undefined. This will not be the case during playbook execution.
+  # noqa jinja[invalid]
 
 - name: Create kubectl symlink
   file:
@@ -171,3 +176,25 @@
     src: /usr/local/bin/k3s
     dest: /usr/local/bin/crictl
     state: link
+
+- name: Get contents of manifests folder
+  find:
+    paths: /var/lib/rancher/k3s/server/manifests
+    file_type: file
+  register: k3s_server_manifests
+
+- name: Get sub dirs of manifests folder
+  find:
+    paths: /var/lib/rancher/k3s/server/manifests
+    file_type: directory
+  register: k3s_server_manifests_directories
+
+- name: Remove manifests and folders that are only needed for bootstrapping cluster so k3s doesn't auto apply on start
+  file:
+    path: "{{ item.path }}"
+    state: absent
+  with_items:
+    - "{{ k3s_server_manifests.files }}"
+    - "{{ k3s_server_manifests_directories.files }}"
+  loop_control:
+    label: "{{ item.path }}"

roles/archive/k3s/master/templates/content.j2

@@ -0,0 +1,5 @@
+{#
+    This is a really simple template that just outputs the
+    value of the "content" variable.
+#}
+{{ content }}

roles/archive/k3s/master/templates/metallb.namespace.j2

@@ -4,4 +4,3 @@ metadata:
   name: metallb-system
   labels:
     app: metallb
-    

roles/archive/k3s/master/templates/vip.rbac.yaml.j2

@@ -12,7 +12,7 @@ metadata:
   name: system:kube-vip-role
 rules:
   - apiGroups: [""]
-    resources: ["services", "services/status", "nodes"]
+    resources: ["services", "services/status", "nodes", "endpoints"]
     verbs: ["list","get","watch", "update"]
   - apiGroups: ["coordination.k8s.io"]
     resources: ["leases"]
@@ -30,4 +30,3 @@ subjects:
 - kind: ServiceAccount
   name: kube-vip
   namespace: kube-system
-  

roles/archive/k3s/master/templates/vip.yaml.j2

@@ -1,7 +1,6 @@
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
-  creationTimestamp: null
   name: kube-vip-ds
   namespace: kube-system
 spec:
@@ -10,7 +9,6 @@ spec:
       name: kube-vip-ds
   template:
     metadata:
-      creationTimestamp: null
       labels:
         name: kube-vip-ds
     spec:
@@ -35,7 +33,7 @@ spec:
         - name: vip_interface
           value: {{ flannel_iface }}
         - name: vip_cidr
-          value: "32"
+          value: "{{ apiserver_endpoint | ansible.utils.ipsubnet | ansible.utils.ipaddr('prefix') }}"
         - name: cp_enable
           value: "true"
         - name: cp_namespace

roles/archive/k3s/node/templates/k3s.service.j2

@@ -7,7 +7,7 @@ After=network-online.target
 Type=notify
 ExecStartPre=-/sbin/modprobe br_netfilter
 ExecStartPre=-/sbin/modprobe overlay
-ExecStart=/usr/local/bin/k3s agent --server https://{{ apiserver_endpoint }}:6443 --token {{ hostvars[groups['master'][0]]['token'] | default(k3s_token) }} {{ extra_agent_args | default("") }}
+ExecStart=/usr/local/bin/k3s agent --server https://{{ apiserver_endpoint | ansible.utils.ipwrap }}:6443 --token {{ hostvars[groups['master'][0]]['token'] | default(k3s_token) }} {{ extra_agent_args | default("") }}
 KillMode=process
 Delegate=yes
 # Having non-zero Limit*s causes performance problems due to accounting overhead

roles/archive/k3s/post/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+# Timeout to wait for MetalLB services to come up
+metal_lb_available_timeout: 120s

roles/archive/k3s/post/tasks/main.yml

@@ -0,0 +1,94 @@
+---
+- name: Create manifests directory for temp configuration
+  file:
+    path: /tmp/k3s
+    state: directory
+    owner: "{{ ansible_user }}"
+    mode: 0755
+  with_items: "{{ groups['master'] }}"
+  run_once: true
+
+- name: Copy metallb CRs manifest to first master
+  template:
+    src: "metallb.crs.j2"
+    dest: "/tmp/k3s/metallb-crs.yaml"
+    owner: "{{ ansible_user }}"
+    mode: 0755
+  with_items: "{{ groups['master'] }}"
+  run_once: true
+
+- name: Test metallb-system namespace
+  command: >-
+    k3s kubectl -n metallb-system
+  changed_when: false
+  with_items: "{{ groups['master'] }}"
+  run_once: true
+
+- name: Wait for MetalLB resources
+  command: >-
+    k3s kubectl wait {{ item.resource }}
+    --namespace='metallb-system'
+    {% if item.name | default(False) -%}{{ item.name }}{%- endif %}
+    {% if item.selector | default(False) -%}--selector='{{ item.selector }}'{%- endif %}
+    {% if item.condition | default(False) -%}{{ item.condition }}{%- endif %}
+    --timeout='{{ metal_lb_available_timeout }}'
+  changed_when: false
+  run_once: true
+  with_items:
+    - description: controller
+      resource: deployment
+      name: controller
+      condition: --for condition=Available=True
+    - description: webhook service
+      resource: pod
+      selector: component=controller
+      condition: --for=jsonpath='{.status.phase}'=Running
+    - description: pods in replica sets
+      resource: pod
+      selector: component=controller,app=metallb
+      condition: --for condition=Ready
+    - description: ready replicas of controller
+      resource: replicaset
+      selector: component=controller,app=metallb
+      condition: --for=jsonpath='{.status.readyReplicas}'=1
+    - description: fully labeled replicas of controller
+      resource: replicaset
+      selector: component=controller,app=metallb
+      condition: --for=jsonpath='{.status.fullyLabeledReplicas}'=1
+    - description: available replicas of controller
+      resource: replicaset
+      selector: component=controller,app=metallb
+      condition: --for=jsonpath='{.status.availableReplicas}'=1
+  loop_control:
+    label: "{{ item.description }}"
+
+- name: Test metallb-system webhook-service endpoint
+  command: >-
+    k3s kubectl -n metallb-system get endpoints webhook-service
+  changed_when: false
+  with_items: "{{ groups['master'] }}"
+  run_once: true
+
+- name: Apply metallb CRs
+  command: >-
+    k3s kubectl apply -f /tmp/k3s/metallb-crs.yaml
+    --timeout='{{ metal_lb_available_timeout }}'
+  register: this
+  changed_when: false
+  run_once: true
+  until: this.rc == 0
+  retries: 5
+
+- name: Test metallb-system resources
+  command: >-
+    k3s kubectl -n metallb-system get {{ item }}
+  changed_when: false
+  run_once: true
+  with_items:
+    - IPAddressPool
+    - L2Advertisement
+
+- name: Remove tmp directory used for manifests
+  file:
+    path: /tmp/k3s
+    state: absent

roles/archive/k3s/post/templates/metallb.crs.j2

@@ -0,0 +1,21 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: first-pool
+  namespace: metallb-system
+spec:
+  addresses:
+{% if metal_lb_ip_range is string %}
+{# metal_lb_ip_range was used in the legacy way: single string instead of a list #}
+{#   => transform to list with single element #}
+{% set metal_lb_ip_range = [metal_lb_ip_range] %}
+{% endif %}
+{% for range in metal_lb_ip_range %}
+  - {{ range }}
+{% endfor %}
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: default
+  namespace: metallb-system

roles/archive/k3s/provision/cgroup/tasks/main.yml

@@ -0,0 +1,24 @@
+---
+- name: Add cgroup rule
+  ansible.builtin.lineinfile:
+    path: /etc/pve/nodes/{{ ansible_hostname }}/lxc/{{ hostvars[ansible_hostname]['k3s_vmid'] }}.conf
+    state: present
+    line: lxc.apparmor.profile{{":"}} unconfined
+
+- name: Add cgroup rule
+  ansible.builtin.lineinfile:
+    path: /etc/pve/nodes/{{ ansible_hostname }}/lxc/{{ hostvars[ansible_hostname]['k3s_vmid'] }}.conf
+    state: present
+    line: lxc.cap.drop{{":"}}
+
+- name: Add cgroup rule
+  ansible.builtin.lineinfile:
+    path: /etc/pve/nodes/{{ ansible_hostname }}/lxc/{{ hostvars[ansible_hostname]['k3s_vmid'] }}.conf
+    state: present
+    line: lxc.mount.auto"{{":"}}" "proc{{":"}}rw sys{{":"}}rw"
+
+- name: Add cgroup rule
+  ansible.builtin.lineinfile:
+    path: /etc/pve/nodes/{{ ansible_hostname }}/lxc/{{ hostvars[ansible_hostname]['k3s_vmid'] }}.conf
+    state: present
+    line: lxc.cgroup2.devices.allow{{":"}} c 10{{":"}}200 rwm

roles/archive/k3s/provision/cloud-init/tasks/main.yml

@@ -0,0 +1,21 @@
+---
+- name: Configure cloud-init - IP
+  ansible.builtin.command: qm set "{{ k3s_vmid }}" --ipconfig0 ip="{{ k3s_vm_host }}"/21,gw=10.0.0.1
+
+- name: Configure cloud-init - User
+  ansible.builtin.command: qm set "{{ k3s_vmid }}" --ciuser "root"
+
+- name: Configure cloud-init - Password
+  ansible.builtin.command: qm set "{{ k3s_vmid }}" --cipassword "{{ ansible_ssh_pass }}"
+
+- name: Copy SSH Pub key
+  ansible.builtin.copy:
+    src: ~/.ssh/id_rsa.pub
+    dest: /tmp/ansible_controller-key.pub
+    mode: 0600
+
+- name: Configure cloud-init - SSH Key
+  ansible.builtin.command: qm set "{{ k3s_vmid }}" --sshkey /tmp/ansible_controller-key.pub
+
+- name: Configure networking
+  ansible.builtin.command: qm set "{{ k3s_vmid }}" --net0 virtio={{ k3s_mac_addr }},bridge=vmbr0

roles/archive/k3s/provision/create/tasks/main.yml

@@ -0,0 +1,51 @@
+---
+- name: Create containers
+  # community.general.proxmox:
+  #   vmid: "{{ hostvars[item]['k3s_vmid'] }}"
+  #   node: "{{ item }}"
+  #   api_user: root@pam
+  #   api_password: "{{ proxmox_api_password }}"
+  #   api_host: 10.0.2.2
+  #   password: "{{ lxc_password }}"
+  #   hostname: "{{ hostvars[item]['k3s_hostname'] }}"
+  #   ostemplate: "hyrule-8tb-nfs:vztmpl/debian-11-standard_11.3-1_amd64.tar.zst"
+  #   netif: "{'net0':'name=eth0,\
+  #     gw=10.0.0.1,\
+  #     ip={{ hostvars[item]['k3s_lxc_host'] }}/21,\
+  #     hwaddr={{ hostvars[item]['k3s_mac_addr'] }},\
+  #     bridge=vmbr0'}"
+  #   cores: "{{ hostvars[item]['k3s_cores'] }}"
+  #   memory: "{{ hostvars[item]['k3s_memory'] }}"
+  #   unprivileged: no
+  #   swap: 0
+  #   searchdomain: "home"
+  #   onboot: 1
+  #   features:
+  #     - nesting=1
+  #   disk: local-lvm:{{ hostvars[item]['k3s_disk'] }}
+  #   force: yes
+  # loop: "{{ groups['k3s_hosts'] }}"
+  proxmox_kvm:
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    name: "{{ hostvars[item]['k3s_hostname'] }}"
+    node: "{{ item }}"
+    newid: "{{ hostvars[item]['k3s_vmid'] }}"
+    clone: debian-10-openstack-amd64
+    vmid: "{{ hostvars[item]['k3s_template_id'] }}"
+    timeout: 900
+  loop: "{{ groups['k3s_hosts'] }}"
+
+- name: Update VMs
+  proxmox_kvm:
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    memory: "{{ hostvars[item]['k3s_memory'] }}"
+    cores: "{{ hostvars[item]['k3s_cores'] }}"
+    vmid: "{{ hostvars[item]['k3s_vmid'] }}"
+    node: "{{ item }}"
+    update: yes
+    agent: yes
+  loop: "{{ groups['k3s_hosts'] }}"

roles/archive/k3s/provision/delete/tasks/main.yml

@@ -0,0 +1,44 @@
+---
+- name: Stop containers
+  # community.general.proxmox:
+  #   vmid: "{{ hostvars[item]['k3s_vmid'] }}"
+  #   api_user: root@pam
+  #   api_password: "{{ proxmox_api_password }}"
+  #   api_host: 10.0.2.2
+  #   state: stopped
+  proxmox_kvm:
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    name: "{{ hostvars[item]['k3s_hostname'] }}"
+    node: "{{ item }}"
+    state: stopped
+    timeout: 240
+  loop: "{{ groups['k3s_hosts'] }}"
+  ignore_errors: true
+
+- name: Remove containers
+  # community.general.proxmox:
+  # vmid: "{{ hostvars[item]['k3s_vmid'] }}"
+  # api_user: root@pam
+  # api_password: "{{ proxmox_api_password }}"
+  # api_host: "{{ hostvars[item]['ip_addr'] }}"
+  # state: absent
+  proxmox_kvm:
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    name: "{{ hostvars[item]['k3s_hostname'] }}"
+    node: "{{ item }}"
+    state: absent
+    timeout: 90
+  loop: "{{ groups['k3s_hosts'] }}"
+  ignore_errors: true
+
+- name: Remove .ssh/known_hosts lines
+  ansible.builtin.lineinfile:
+    path: /Users/lino.silva/.ssh/known_hosts
+    state: absent
+    # regexp: '^{{ hostvars[item]["k3s_lxc_host"] }}'
+    regexp: '^{{ hostvars[item]["k3s_vm_host"] }}'
+  loop: "{{ groups['k3s_hosts'] }}"

roles/archive/k3s/provision/enable-ssh/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+# Unable to use ansible.builtin.lineinfile, because we need to run this through the proxmox host (because SSH is not enabled duh)
+
+- name: Allow SSH into LXC
+  ansible.builtin.command: lxc-attach -n "{{ k3s_vmid }}" -- sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
+
+- name: Restart SSH Service
+  ansible.builtin.command: lxc-attach -n "{{ k3s_vmid }}" service ssh restart

roles/archive/k3s/provision/pre/tasks/main.yml

@@ -0,0 +1,19 @@
+---
+# - name: Move storage to local_lvm
+#   ansible.builtin.command: qm disk move "{{ k3s_vmid }}" scsi0 local-lvm
+#   ignore_errors: true
+
+# - name: Resize storage
+#   ansible.builtin.command: qm disk resize "{{ k3s_vmid }}" scsi0 +"{{ k3s_disk }}G"
+
+- name: Allow ipv4 forwarding
+  ansible.builtin.shell: "sysctl net.ipv4.ip_forward=1"
+
+- name: Allow ipv6 forwarding
+  ansible.builtin.shell: "sysctl net.ipv6.conf.all.forwarding=1"
+
+- name: Uncomment ipv4 forward line on /etc/sysctl.conf
+  ansible.builtin.shell: "sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/g' /etc/sysctl.conf"
+
+- name: Uncomment ipv6 forward line on /etc/sysctl.conf
+  ansible.builtin.shell: "sed -i 's/#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=1/g' /etc/sysctl.conf"

roles/archive/k3s/provision/start/tasks/main.yml

@@ -0,0 +1,16 @@
+---
+- name: Start deployments
+  # community.general.proxmox:
+  #   vmid: "{{ hostvars[item]['k3s_vmid'] }}"
+  #   api_user: root@pam
+  #   api_password: "{{ proxmox_api_password }}"
+  #   api_host: 10.0.2.2
+  #   state: started
+  community.general.cloud.misc.proxmox_kvm:
+    api_user: root@pam
+    api_password: "{{ proxmox_api_password }}"
+    api_host: 10.0.2.2
+    name: "{{ hostvars[item]['k3s_hostname'] }}"
+    node: "{{ item }}"
+    state: started
+  loop: "{{ groups['k3s_hosts'] }}"

roles/archive/nginx/tasks/main.yml

@@ -0,0 +1,24 @@
+---
+- name: Deploy nginx - deployment
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'deployment.yml') | from_yaml }}"
+
+- name: Deploy nginx - service
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'service.yml') | from_yaml }}"
+
+- name: Deploy forwardauth middleware
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
+
+- name: Deploy nginx - ingress
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"

roles/archive/nginx/templates/deployment.yml

@@ -1,13 +1,20 @@
 ---
-apiVersion: apps/v1
 kind: Deployment
+apiVersion: apps/v1
 metadata:
   name: nginx
+  namespace: default
+  labels:
+    app: nginx
 spec:
+  replicas: 3
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 2
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: nginx
-  replicas: 3
   template:
     metadata:
       labels:
@@ -15,6 +22,4 @@ spec:
     spec:
       containers:
         - name: nginx
-          image: nginx:alpine
+          image: nginx:latest
-          ports:
-            - containerPort: 80

roles/archive/nginx/templates/ingress.yml

@@ -0,0 +1,32 @@
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: nginx
+  namespace: default
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`nginx.lino.cooking`)
+      kind: Rule
+      services:
+        - name: nginx
+          port: 80
+      middlewares:
+        - name: default-headers
+        - name: nginx-middleware-forwardauth
+          namespace: traefik
+    - match: "Host(`nginx.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
+      kind: Rule
+      priority: 15
+      services:
+        - kind: Service
+          # Or, to use an external Outpost, create an ExternalName service and reference that here.
+          # See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
+          name: authentik
+          port: 9000
+  tls:
+    secretName: lino-cooking-tls

roles/archive/nginx/templates/middleware-forwardauth.yml

@@ -0,0 +1,21 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: nginx-middleware-forwardauth
+  namespace: traefik
+spec:
+  forwardAuth:
+    address: https://nginx.lino.cooking/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version

roles/archive/nginx/templates/service.yml

@@ -3,10 +3,11 @@ apiVersion: v1
 kind: Service
 metadata:
   name: nginx
+  namespace: default
 spec:
   selector:
     app: nginx
   ports:
-    - port: 80
+    - name: http
       targetPort: 80
-  type: LoadBalancer
+      port: 80