klal

roles/autofs_client/tasks/main.yml

@@ -30,7 +30,16 @@
         owner: root
         group: root
       when: inventory_hostname != 'm-server.home.lan'
+    - name: Creating a file with content
+      ansible.builtin.copy:
+        dest: "/etc/auto.amd"
+        content: |
+          backup  -fstype=nfs   amd.home.lan:/backup
 
+        mode: '0600'
+        owner: root
+        group: root
+      when: inventory_hostname == 'm-server.home.lan'
     - name: Creating a file with content
       ansible.builtin.copy:
         dest: "/etc/auto.rack"
@@ -192,6 +201,11 @@
         path: /etc/auto.master
         regexp: "^/media/rpi5.*"
         line: /media/rpi5  /etc/auto.rpi5 --timeout 360 --ghost
+    - name: Reconfigure autofs Server
+      ansible.builtin.lineinfile:
+        path: /etc/auto.master
+        regexp: "^/media/amd.*"
+        line: /media/amd  /etc/auto.amd --timeout 360 --ghost
 
     - name: Restart docker service
       ansible.builtin.service:

roles/cert_gen/files/certs.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+mkdir /tmp/certgen 2>/dev/null
+cd /tmp/certgen
+
+openssl genrsa -aes256 -out ca-key.pem -passout pass:"foobarpwd" 4096
+openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem -subj "/C=SK/ST=Slovakia/L=SK/O=sectorq.eu/OU=IT/CN=sectorq.eu" -passin pass:"foobarpwd"
+openssl genrsa -out server-key.pem 4096
+if [[ `hostname` == "nas" ]]
+then
+IP=`ip route get 8.8.8.8 | head -1 | cut -d' ' -f8`
+else
+IP=`ip route get 8.8.8.8 | head -1 | cut -d' ' -f7`
+fi
+HOST=`uname -n`
+openssl req -subj "/CN=$HOST" -sha256 -new -key server-key.pem -out server.csr
+echo subjectAltName = DNS:$HOST,IP:$IP,IP:127.0.0.1 >> extfile.cnf
+echo extendedKeyUsage = serverAuth >> extfile.cnf
+openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem \
+  -CAcreateserial -out server-cert.pem -extfile extfile.cnf -passin pass:"foobarpwd"
+openssl genrsa -out key.pem 4096
+openssl req -subj '/CN=client' -new -key key.pem -out client.csr
+echo extendedKeyUsage = clientAuth > extfile-client.cnf
+openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem \
+  -CAcreateserial -out cert.pem -extfile extfile-client.cnf  -passin pass:"foobarpwd"
+rm -v client.csr server.csr extfile.cnf extfile-client.cnf
+chmod -v 0400 ca-key.pem key.pem server-key.pem
+chmod -v 0444 ca.pem server-cert.pem cert.pem

roles/cert_gen/tasks/main.yml

@@ -0,0 +1,87 @@
+- name: Cert gen
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Create a directory for certs
+      ansible.builtin.file:
+        path: /tmp/certgen
+        state: directory
+        mode: '0700'
+        owner: root
+        group: root
+    - name: Copy cert generation script
+      ansible.builtin.copy:
+        src: certs.sh
+        dest: /tmp/certgen/certs.sh
+        mode: '0700'
+        owner: root
+        group: root
+    - name: Generate certs
+      ansible.builtin.command: /tmp/certgen/certs.sh
+      args:
+        chdir: /tmp/certgen
+      register: certgen
+      changed_when: "certgen.rc == 0"
+
+    - name: Copy generated certs to files
+      ansible.builtin.copy:
+        src: /tmp/certgen/server-key.pem
+        dest: /etc/docker/certs/
+        remote_src: true
+        mode: '0600'
+        owner: root
+        group: root
+    - name: Copy generated certs to files
+      ansible.builtin.copy:
+        src: /tmp/certgen/server-cert.pem
+        dest: /etc/docker/certs/
+        remote_src: true
+        mode: '0600'
+        owner: root
+        group: root
+    - name: Copy generated certs to files
+      ansible.builtin.copy:
+        src: /tmp/certgen/ca.pem
+        dest: /etc/docker/certs/
+        remote_src: true
+        mode: '0600'
+        owner: root
+        group: root
+
+    - name: Create a directory for certs on nas
+      ansible.builtin.file:
+        path: /media/nas/data/certs/docker/{{ inventory_hostname }}
+        state: directory
+        mode: '0777'
+        owner: jd
+        group: root
+
+    - name: Copy generated certs to files
+      ansible.builtin.copy:
+        src: /tmp/certgen/ca.pem
+        dest: /media/nas/data/certs/docker/{{ inventory_hostname }}
+        remote_src: true
+        mode: '0644'
+        owner: jd
+        group: root
+
+    - name: Copy generated certs to files
+      ansible.builtin.copy:
+        src: /tmp/certgen/key.pem
+        dest: /media/nas/data/certs/docker/{{ inventory_hostname }}
+        remote_src: true
+        mode: '0644'
+        owner: jd
+        group: root
+    - name: Copy generated certs to files
+      ansible.builtin.copy:
+        src: /tmp/certgen/cert.pem
+        dest: /media/nas/data/certs/docker/{{ inventory_hostname }}
+        remote_src: true
+        mode: '0644'
+        owner: jd
+        group: root
+    - name: Restart docker service
+      ansible.builtin.systemd:
+        name: docker
+        state: restarted
+  

roles/common/tasks/main.yml

@@ -18,6 +18,7 @@
           apt-mark hold docker-ce docker-compose-plugin docker-ce-rootless-extras docker-ce-cli docker-buildx-plugin
       register: logo
       changed_when: "logo.rc == 0"
+      ignore_errors: true
 
     - name: Upgrade the full OS
       ansible.builtin.apt:

roles/nfs_server/tasks/main.yml

@@ -19,6 +19,8 @@
         value: "1"
         no_extra_spaces: true
         mode: '0644'
+      when: inventory_hostname == 'rpi5.home.lan'
+
     - name: Mount and bind a volume
       ansible.posix.mount:
         path: /srv/nfs/downloads
@@ -28,6 +30,15 @@
         fstype: none
       when: inventory_hostname == 'm-server.home.lan'
 
+    - name: Mount and bind a volume
+      ansible.posix.mount:
+        path: /srv/nfs/backup
+        src: /mnt/raid/backup
+        opts: bind
+        state: mounted
+        fstype: none
+      when: inventory_hostname == 'amd.home.lan'
+
     - name: Mount and bind a volume
       ansible.posix.mount:
         path: /srv/nfs/docker_data
@@ -35,12 +46,15 @@
         opts: bind
         state: mounted
         fstype: none
+      when: inventory_hostname != 'amd.home.lan'
+
     - name: Reconfigure nfs fstab
       ansible.builtin.lineinfile:
         path: /etc/fstab
         regexp: "^/media/m-server/downloads .*"
         line: "/media/m-server/downloads  /srv/nfs/downloads    none    bind    0       0"
       when: inventory_hostname == 'm-server.home.lan'
+
     - name: Reconfigure nfs exports
       ansible.builtin.lineinfile:
         path: /etc/fstab
@@ -59,6 +73,7 @@
         path: /etc/exports
         regexp: "^/srv/nfs/docker_data .*"
         line: "/srv/nfs/docker_data 192.168.77.0/24(rw,sync,no_subtree_check)"
+      when: inventory_hostname != 'amd.home.lan'
 
     - name: Reconfigure nfs exports
       ansible.builtin.lineinfile:
@@ -66,7 +81,12 @@
         regexp: "^/srv/nfs/downloads .*"
         line: "/srv/nfs/downloads 192.168.77.0/24(rw,sync,no_subtree_check)"
       when: inventory_hostname == 'm-server.home.lan'
-
+    - name: Reconfigure nfs exports
+      ansible.builtin.lineinfile:
+        path: /etc/exports
+        regexp: "^/srv/nfs/backup .*"
+        line: "/srv/nfs/backup 192.168.77.0/24(rw,sync,no_subtree_check)"
+      when: inventory_hostname == 'amd.home.lan'
     - name: Restart nfs service
       ansible.builtin.service:
         name: nfs-server