test inv cleanup

Vagrantfile

@@ -29,31 +29,6 @@ Vagrant.configure("2") do |config|
       lv.machine_virtual_size = 40
     end
   end
-  config.vm.define "vaermina" do |debian|
-    debian.vm.box = "debian/bookworm64"
-    debian.vm.hostname = "test-vaermina"
-    debian.vm.network "private_network", type: "dhcp"
-    debian.vm.network "forwarded_port", guest: 22, host: 3024
-  end
-
-  # config.vm.define "meridia" do |arch|
-  #   arch.vm.box = "generic/arch"
-  #   arch.vm.hostname = "test-meridia"
-  #   arch.vm.network "private_network", type: "dhcp"
-  #   arch.vm.network "forwarded_port", guest: 22, host: 3025
-  #   arch.vm.provision "shell", inline: <<-SHELL
-  #     pacman -Sy --noconfirm python
-  #   SHELL
-  # end
-  # config.vm.define "dibella" do |arch|
-  #   arch.vm.box = "generic/arch"
-  #   arch.vm.hostname = "test-dibella"
-  #   arch.vm.network "private_network", type: "dhcp"
-  #   arch.vm.network "forwarded_port", guest: 22, host: 3026
-  #   arch.vm.provision "shell", inline: <<-SHELL
-  #     pacman -Sy --noconfirm python
-  #   SHELL
-  # end
   # config.vm.define "azura" do |arch|
   #   arch.vm.box = "generic/arch"
   #   arch.vm.hostname = "test-azura"

group_vars/cloud.yml

@@ -1,9 +0,0 @@
-users:
-  - mark
-  - martijn
-  - jp
-  - lourens
-  - guus
-# The cloud hosts have no nerevar user;
-ansible_user: mark
-backup_dump_dir: /var/backups/aurbis

group_vars/home.yml

@@ -1,3 +1,2 @@
 users:
   - mark
-  - martijn

host_vars/akatosh.yml

@@ -30,6 +30,10 @@ cloud_nginx_sites:
     port: 8087
     max_body: 2g # song uploads
 
+stroopwafel_dir: /opt/stroopwafel
+stroopwafel_repo: gitea@git.hoekveen.net:mark/stroopwafel.git
+stroopwafel_version: master
+
 backup_dump_dir: /var/backups/aurbis
 backup_paths:
   - /etc # nginx, certs, systemd units

host_vars/todd-test.yml

@@ -1,2 +0,0 @@
-users:
-  - mark

inventory.test.yml

@@ -1,20 +1,5 @@
 rpi:
   hosts:
-    vaermina:
-      ansible_host: 127.0.0.1
-      ansible_port: 3024
-      ansible_user: vagrant
-      ansible_ssh_private_key_file: .vagrant/machines/vaermina/libvirt/private_key
-    # azura:
-    #   ansible_host: 127.0.0.1
-    #   ansible_port: 3027
-    #   ansible_user: vagrant
-    #   ansible_ssh_private_key_file: .vagrant/machines/azura/libvirt/private_key
-    # kynareth:
-    #   ansible_host: 127.0.0.1
-    #   ansible_port: 3028
-    #   ansible_user: vagrant
-    #   ansible_ssh_private_key_file: .vagrant/machines/kynareth/libvirt/private_key
     nocturnal:
       ansible_host: 127.0.0.1
       ansible_port: 3023
@@ -29,43 +14,25 @@ x86:
       ansible_user: vagrant
       ansible_ssh_private_key_file: .vagrant/machines/talos/libvirt/private_key
     akatosh:
-      # qemu test VM, see docs/migration-survey.md (cloud-init creates nerevar)
       ansible_host: 127.0.0.1
       ansible_port: 3029
       ansible_user: nerevar
-    # meridia:
-    #   ansible_host: 127.0.0.1
-    #   ansible_port: 3025
-    #   ansible_user: vagrant
-    #   ansible_ssh_private_key_file: .vagrant/machines/meridia/libvirt/private_key
-    # dibella:
-    #   ansible_host: 127.0.0.1
-    #   ansible_port: 3026
-    #   ansible_user: vagrant
-    #   ansible_ssh_private_key_file: .vagrant/machines/dibella/libvirt/private_key
 
 debian:
   hosts:
-    vaermina:
     talos:
     nocturnal:
     akatosh:
-# arch:
-#   hosts:
-#     azura:
-#     kynareth:
-#     meridia:
-#     dibella:
 home:
   hosts:
-    # azura:
-    vaermina:
-    # kynareth:
     nocturnal:
     talos:
-# cloud:
-#   hosts:
-#     meridia:
-#     dibella:
 cloud:
   hosts:
+    akatosh:
+backup_sources:
+  hosts:
+    akatosh:
+backup:
+  hosts:
+    talos:

inventory.yml

@@ -1,7 +1,5 @@
 rpi:
   hosts:
-    vaermina:
-      ansible_host: 192.168.178.95
     azura:
       ansible_host: 192.168.178.94
     kynareth:
@@ -12,15 +10,10 @@ x86:
   hosts:
     talos:
       ansible_host: 192.168.178.64
-    meridia:
-      ansible_host: 62.171.176.43
-    dibella:
-      ansible_host: 45.88.188.77
     akatosh:
       ansible_host: 169.58.40.23
 debian:
   hosts:
-    vaermina:
     talos:
     nocturnal:
     akatosh:
@@ -28,25 +21,18 @@ arch:
   hosts:
     azura:
     kynareth:
-    meridia:
-    dibella:
 home:
   hosts:
     azura:
-    vaermina:
     kynareth:
     nocturnal:
     talos:
 cloud:
   hosts:
-    meridia:
+    akatosh:
-    dibella:
 # Hosts whose application data talos pulls into hardlinked snapshots.
-# TODO: kill meridia/dibella
 backup_sources:
   hosts:
-    meridia:
-    dibella:
     akatosh:
 backup:
   hosts:

playbook.yml

@@ -1,12 +1,12 @@
 - name: Preprovisioning
-  hosts: all:!cloud
+  hosts: all
   become: true
   tasks:
     - import_tasks: tasks/preprovision.yml
   handlers:
     - import_tasks: handlers/main.yml
 - name: Provision all hosts
-  hosts: all:!cloud
+  hosts: all
   become: true
   remote_user: nerevar
   tasks:
@@ -39,6 +39,7 @@
           (inventory_hostname not in groups['home'] and item in groups['cloud'])
       with_items: "{{ groups.all }}"
     - import_tasks: tasks/motd.yml
+      tags: motd
 - name: Update Debian hosts
   hosts: debian
   become: true
@@ -46,8 +47,9 @@
   tasks:
     - name: Update
       include_tasks: tasks/update_debian.yml
+# azura werkt niet echt mee met updates op het moment
 - name: Update Arch hosts
-  hosts: arch:!cloud
+  hosts: arch:!azura
   become: true
   remote_user: nerevar
   tasks:
@@ -60,18 +62,11 @@
     - name: Update
       include_tasks: tasks/install_docker_debian.yml
 - name: Add utility scripts
-  hosts: all:!cloud
+  hosts: all
   become: true
   remote_user: nerevar
   tasks:
     - import_tasks: tasks/scripts.yml
-# - name: Add Nocturnal SMB share
-#   hosts: home
-#   vars_files:
-#     - vault/nocturnal.yml
-#   become: true
-#   tasks:
-#     - import_tasks: tasks/nocturnal_smb.yml
 - name: Setup zsh
   hosts: debian
   become: true
@@ -79,7 +74,7 @@
   tasks:
     - import_tasks: tasks/zsh.yml
 - name: Install tmux
-  hosts: all:!cloud
+  hosts: all
   become: true
   remote_user: nerevar
   tasks:
@@ -90,7 +85,6 @@
   remote_user: nerevar
   tasks:
     - import_tasks: tasks/vcmp_timer.yml
-    - import_tasks: tasks/audiobookshelf.yml
     - import_tasks: tasks/stash.yml
     - import_tasks: tasks/jellyfin.yml
     - import_tasks: tasks/wireguard.yml
@@ -106,15 +100,7 @@
   tags:
     - leaf
     - backup
-- name: Backup sources (cloud hosts)
+- name: Akatosh install
-  hosts: cloud
-  become: true
-  tasks:
-    - import_tasks: tasks/backup_source.yml
-  tags:
-    - leaf
-    - backup
-- name: Akatosh install (replacement cloud server)
   hosts: akatosh
   become: true
   remote_user: nerevar
@@ -135,6 +121,7 @@
     - import_tasks: tasks/hdwiki.yml
     - import_tasks: tasks/gitea.yml
     - import_tasks: tasks/nightingale.yml
+    - import_tasks: tasks/stroopwafel.yml
     - import_tasks: tasks/cloud_nginx.yml
     - name: Ensure the backup user can run the forced-command pull
       user:
@@ -145,14 +132,6 @@
   handlers:
     - import_tasks: handlers/main.yml
   tags: leaf
-- name: Vaermina install
-  hosts: vaermina
-  become: true
-  remote_user: nerevar
-  tasks:
-    - import_tasks: tasks/pihole.yml
-    - import_tasks: tasks/mediawiki.yml
-  tags: leaf
 - name: Kynareth install
   hosts: kynareth
   become: true

tasks/audiobookshelf.yml

@@ -1,4 +0,0 @@
-- name: Deploy Audio Bookshelf
-  include_tasks: tasks/docker_service.yml
-  vars:
-    service_name: audiobookshelf

tasks/audiobookshelf/docker-compose.yml.j2

@@ -1,13 +0,0 @@
-services:
-  audiobookshelf:
-    image: ghcr.io/advplyr/audiobookshelf:latest
-    ports:
-      - 13378:80
-    volumes:
-      #- </path/to/audiobooks>:/audiobooks
-      #- </path/to/podcasts>:/podcasts
-      - /mnt/azura/Books:/audiobooks
-      - .config/:/config
-      - .metadata:/metadata
-    environment:
-      - TZ=Europe/Amsterdam

tasks/audiobookshelf/vault.yml

@@ -1,6 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-38333333623830373232656136653330383737663565326538363462663966623364623237343836
-3635353564346238313865363361306563303734366336300a383030323538386438373563303238
-30346265396136616238376539633532613363323034343339636130393739376563323036393463
-6266363262363263330a366330633638336331666335373233323537666166366564333736353764
-3039

tasks/create_users.yml

@@ -6,7 +6,6 @@
       - sudo
       - wheel
     append: true
-    shell: /bin/bash
     state: present
   when: users is defined
   loop: "{{ users }}"

tasks/docker_service.yml

@@ -16,7 +16,7 @@
         src: "{{ service_name }}/docker-compose.yml.j2"
         dest: "/opt/{{ service_name }}/docker-compose.yml"
         group: "{{ service_group | default('aurbis') }}"
-        mode: "0775"
+        mode: "0664"
     - name: Start docker service
       community.docker.docker_compose_v2:
         project_src: "/opt/{{ service_name }}"

tasks/gitea.yml

@@ -27,6 +27,6 @@
         -e GITEA_CUSTOM=/data/gitea \
         gitea-gitea-1 /usr/local/bin/gitea "$@"
 - name: Deploy Gitea
-  include_tasks: tasks/setup_docker_service.yml
+  include_tasks: tasks/docker_service.yml
   vars:
     service_name: gitea

tasks/hdwiki.yml

@@ -1,4 +1,4 @@
 - name: Deploy HD MediaWiki
-  include_tasks: tasks/setup_docker_service.yml
+  include_tasks: tasks/docker_service.yml
   vars:
     service_name: hdwiki

tasks/jellyfin/docker-compose.yml.j2

@@ -14,6 +14,10 @@ services:
         source: /mnt/azura
         target: /media
         read_only: true
+      - type: bind
+        source: ./local
+        target: /media2
+        read_only: true
     devices:
       - /dev/dri:/dev/dri
     restart: 'unless-stopped'

tasks/mediawiki.yml

@@ -1,4 +0,0 @@
-- name: Deploy MediaWiki
-  include_tasks: tasks/docker_service.yml
-  vars:
-    service_name: mediawiki

tasks/mediawiki/docker-compose.yml.j2

@@ -1,43 +0,0 @@
-services:
-  db:
-    image: mariadb:11
-    environment:
-      MARIADB_USER: wiki
-      MARIADB_PASSWORD: {{ mediawiki_db_password }}
-      MARIADB_DATABASE: wiki
-      MARIADB_RANDOM_ROOT_PASSWORD: 1
-    restart: unless-stopped
-    volumes:
-      - ./mysql/conf.d:/etc/mysql/conf.d
-  mediawiki:
-    image: mediawiki
-    restart: always
-    depends_on:
-      - db
-    volumes:
-      - images:/var/www/html/images
-      - ./LocalSettings.php:/var/www/html/LocalSettings.php
-    networks:
-      - proxy
-networks:
-  proxy:
-    external: true
-      # After initial setup, download LocalSettings.php to the same directory as
-      # this yaml and uncomment the following line and use compose to restart
-      # the mediawiki service
-  # This key also defines the name of the database host used during setup instead of the default "localhost"
-  # database:
-  #   image: mariadb
-  #   restart: always
-  #   environment:
-  #     # @see https://phabricator.wikimedia.org/source/mediawiki/browse/master/includes/DefaultSettings.php
-  #     MYSQL_DATABASE: my_wiki
-  #     MYSQL_USER: wikiuser
-  #     MYSQL_PASSWORD: example
-  #     MYSQL_RANDOM_ROOT_PASSWORD: 'yes'
-  #   volumes:
-  #     - db:/var/lib/mysql
-
-volumes:
-  images:
-#   db:

tasks/mediawiki/vault.yml

@@ -1,8 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-34373261306661343338643437303430616236646361383332333564323861633830353338643762
-6438396639613866666336353838313632336262336261310a343335303464616266303863636232
-30373831623835346337646137356634313832663239326531386432633063373636623962343139
-3865363861646634660a393236623237656239616366313931663464336139326333643865356264
-39386138636332636161643535386164313266303764373362366431613733646633343865363930
-39623362613434316430343664343565653537343436393633393332343032623662353962366362
-316433386639326262353539303833356134

tasks/nextcloud.yml

@@ -1,4 +1,4 @@
 - name: Deploy Nextcloud
-  include_tasks: tasks/setup_docker_service.yml
+  include_tasks: tasks/docker_service.yml
   vars:
     service_name: nextcloud

tasks/nextcloud/docker-compose.yml.j2

@@ -46,6 +46,7 @@ services:
     volumes:
       - html:/var/www/html
       - /var/nextcloud:/var/nextcloud
+      - /opt/nightingale/songs:/karaoke
 
 volumes:
   db:

tasks/nocturnal_smb.yml

@@ -1,22 +0,0 @@
-- name: Get aurbis group gid
-  getent:
-    database: group
-    key: aurbis
-- name: Mount (1)
-  ansible.posix.mount:
-    #src: //{{ hostvars['nocturnal']['ansible_host']}}/nocturnal
-    src: //{{ hostvars['nocturnal']['internal_ip'] | default(hostvars['nocturnal']['ansible_host']) }}/nocturnal
-    path: /mnt/nocturnal/share
-    state: mounted
-    opts: "_netdev,username={{ nocturnal_smb_username }},password={{ nocturnal_smb_password }},file_mode=0775,dir_mode=0775,uid=0,gid={{ getent_group['aurbis'][1] }}"
-    fstype: cifs
-  when: inventory_hostname != 'nocturnal'
-- name: Mount (2)
-  ansible.posix.mount:
-    #src: //{{ hostvars['nocturnal']['ansible_host']}}/nocturnalocal
-    src: //{{ hostvars['nocturnal']['internal_ip'] | default(hostvars['nocturnal']['ansible_host']) }}/nocturnalocal
-    path: /mnt/nocturnal/local
-    state: mounted
-    opts: "_netdev,username={{ nocturnal_smb_username }},password={{ nocturnal_smb_password }},file_mode=0775,dir_mode=0775,uid=0,gid={{ getent_group['aurbis'][1] }}"
-    fstype: cifs
-  when: inventory_hostname != 'nocturnal'

tasks/pihole.yml

@@ -1,18 +0,0 @@
-- name: Pi-hole
-  include_vars:
-    file: pihole/vault.yml
-- name: Create /opt/pihole directory
-  file:
-    path: "/opt/pihole"
-    state: directory
-    owner: root
-    group: aurbis
-    mode: "0755"
-- name: Copy docker-compose file
-  template:
-    src: pihole/docker-compose.yml.j2
-    dest: /opt/pihole/docker-compose.yml
-    group: aurbis
-- name: Go go gadget pihole
-  community.docker.docker_compose_v2:
-    project_src: /opt/pihole

tasks/pihole/docker-compose.yml.j2

@@ -1,17 +0,0 @@
-# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
-services:
-  pihole:
-    container_name: pihole
-    image: pihole/pihole:latest
-    ports:
-      - "53:53/tcp"
-      - "53:53/udp"
-      - "80:80/tcp"
-    environment:
-      TZ: "Europe/Amsterdam"
-      WEBPASSWORD: "{{ pihole_password }}"
-      WEBTHEME: "default-dark"
-    volumes:
-      - "./etc-pihole:/etc/pihole"
-      - "./etc-dnsmasq.d:/etc/dnsmasq.d"
-    restart: unless-stopped

tasks/pihole/vault.yml

@@ -1,6 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-39636161643531383438646638376437613630663932623366366132346662303266313834643835
-3537373030666638313833623765336335386135363036610a316231333431666639316139663738
-31336539366161323162373736626534323432333663363534336565353763653363353365396266
-3935663537303165640a393334306565383730663934653536393839313437313330623438636564
-63363234336365616639613236336233333739383264383762343462316564316434

tasks/stroopwafel.yml

@@ -0,0 +1,41 @@
+# Pulling needs to have git access; root does not.
+- name: Include stroopwafel vault
+  include_vars:
+    dir: stroopwafel
+    files_matching: vault.yml
+- name: Create stroopwafel directory
+  file:
+    path: "{{ stroopwafel_dir }}"
+    state: directory
+    owner: root
+    group: "{{ service_group | default('aurbis') }}"
+    mode: "0775"
+- name: Check out stroopwafel source
+  ansible.builtin.git:
+    repo: "{{ stroopwafel_repo }}"
+    dest: "{{ stroopwafel_dir }}"
+    version: "{{ stroopwafel_version }}"
+    update: "{{ stroopwafel_update | default(false) }}"
+    accept_hostkey: true
+    force: false
+  become_user: "{{ stroopwafel_git_user | default(omit) }}"
+- name: Deploy stroopwafel .env
+  copy:
+    content: "{{ stroopwafel_env_b64 | b64decode }}"
+    dest: "{{ stroopwafel_dir }}/.env"
+    owner: root
+    group: "{{ service_group | default('aurbis') }}"
+    mode: "0640"
+  when: stroopwafel_env_b64 is defined
+  no_log: true
+- name: Copy docker-compose file
+  template:
+    src: stroopwafel/docker-compose.yml.j2
+    dest: "{{ stroopwafel_dir }}/docker-compose.yml"
+    owner: root
+    group: "{{ service_group | default('aurbis') }}"
+    mode: "0664"
+- name: Start stroopwafel
+  community.docker.docker_compose_v2:
+    project_src: "{{ stroopwafel_dir }}"
+    build: policy

tasks/stroopwafel/docker-compose.yml.j2

@@ -0,0 +1,7 @@
+services:
+  stroopwafel:
+    build: .
+    command: python Stroopwafel.py
+    restart: unless-stopped
+    volumes:
+      - .:/opt/stroopwafel

tasks/wikijs.yml

@@ -1,18 +0,0 @@
-- name: Wiki.js
-  include_vars:
-    file: wikijs/vault.yml
-- name: Create /opt/wikijs directory
-  file:
-    path: "/opt/wikijs"
-    state: directory
-    owner: root
-    group: aurbis
-    mode: "0755"
-- name: Copy docker-compose file
-  template:
-    src: wikijs/docker-compose.yml.j2
-    dest: /opt/wikijs/docker-compose.yml
-    group: aurbis
-- name: Go go gadget wiki.js
-  community.docker.docker_compose_v2:
-    project_src: /opt/wikijs

tasks/wikijs/docker-compose.yml.j2

@@ -1,35 +0,0 @@
-services:
-  db:
-    image: mariadb:11
-    environment:
-      MARIADB_USER: wiki
-      MARIADB_PASSWORD: {{ wikijs_db_password }}
-      MARIADB_DATABASE: wiki
-      MARIADB_RANDOM_ROOT_PASSWORD: 1
-    restart: unless-stopped
-    volumes:
-      - ./mysql/conf.d:/etc/mysql/conf.d
-  phpmyadmin:
-    image: phpmyadmin:latest
-    restart: always
-    ports:
-      - 8080:80
-    environment:
-      - PMA_HOST=db
-  wiki:
-    image: requarks/wiki:2
-    depends_on:
-      - db
-    environment:
-      DB_TYPE: mariadb
-      DB_HOST: db
-      DB_PORT: 3306
-      DB_USER: wiki
-      DB_PASS: {{ wikijs_db_password }}
-      DB_NAME: wiki
-    restart: unless-stopped
-    ports:
-      - 3004:3000
-
-# volumes:
-#   db-data:

tasks/wikijs/vault.yml

@@ -1,7 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-63353939373666343366396161306662333730323765353536383961626234356332343439643065
-6138626461343764376161323135346666326230313965300a366163656564353437626434306163
-31393832323134653630663334303733616534303632376138383630336366313733323064313334
-6333313539346564610a666639643133393238653237636165353565333233356630303464333236
-36663437393835346134393735316666663031396333663636663339643733613762646165626662
-3264343864396233633631613534313563633466626331373162

tasks/zsh.yml

@@ -5,17 +5,21 @@
       - zsh-syntax-highlighting
       - fzf
     state: present
-- name: Create .config/zsh directory
+- name: Create .config and .config/zsh directories
   file:
-    path: "/home/{{ item }}/.config/zsh"
+    path: "/home/{{ item.0 }}/{{ item.1 }}"
     state: directory
+    owner: "{{ item.0 }}"
+    group: "{{ item.0 }}"
     mode: "0755"
-  loop: "{{ users }}"
+  loop: "{{ users | product(['.config', '.config/zsh']) | list }}"
   when: users is defined
 - name: Copy .zshenv
   copy:
     src: zsh/.zshenv
     dest: "/home/{{ item }}/.zshenv"
+    owner: "{{ item }}"
+    group: "{{ item }}"
     mode: "0644"
   loop: "{{ users }}"
   when: users is defined
@@ -23,6 +27,8 @@
   copy:
     src: zsh/.zshrc
     dest: "/home/{{ item }}/.config/zsh/.zshrc"
+    owner: "{{ item }}"
+    group: "{{ item }}"
     mode: "0644"
   loop: "{{ users }}"
   when: users is defined
@@ -30,6 +36,8 @@
   copy:
     src: zsh/.aliasrc
     dest: "/home/{{ item }}/.config/zsh/.aliasrc"
+    owner: "{{ item }}"
+    group: "{{ item }}"
     mode: "0644"
   loop: "{{ users }}"
   when: users is defined

vault/nocturnal.yml

@@ -1,9 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-62343164653332363039613065656238616461626663383262373132623432333263323138633834
-3231626235323039316539326138643339643565303934610a393864623132336134393734326263
-65623338663837353032373732393935316661333965376266323835316630393734666234323835
-6232666333613630660a666464626661646339306230303631653431303765353764623663646636
-30616462613831363364306334616262323865613333383631346334393937383332396232336563
-30313361346438666365366633613062343964616233303130396436313862363264366637366630
-35613161383232626336343133626239346264626135366265343838643164613761656262356261
-61353761333833343965