build

all.yml

@@ -2,9 +2,15 @@
   name: Roles
   gather_facts: false
   roles:
+    - name: init
+      role: init
+      tags: init
     - name: setup
       role: setup
       tags: setup
+    - name: git
+      role: git
+      tags: git
     - name: common
       tags: common
       role: common
@@ -38,9 +44,9 @@
     - name: zabbix-agent
       role: zabbix-agent
       tags: zabbix-agent
-    - name: autofs_client
-      role: autofs_client
-      tags: autofs_client
+    - name: autofs
+      role: autofs
+      tags: autofs
     - name: ldap_client
       role: ldap_client
       tags: ldap_client
@@ -65,9 +71,6 @@
     - name: sudoers
       role: sudoers
       tags: sudoers
-    - name: docker_packages
-      role: docker_packages
-      tags: docker_packages
     - name: watcher
       role: watcher
       tags: watcher
@@ -77,3 +80,9 @@
     - name: cert_gen
       role: cert_gen
       tags: cert_gen
+    - name: letsgo
+      role: letsgo
+      tags: letsgo
+    - name: docker_swarm
+      role: docker_swarm
+      tags: docker_swarm

hosts_init.yml

@@ -6,19 +6,32 @@ datacenter:
         rpi5-1.home.lan:
         rpi5.home.lan:
         m-server.home.lan:
-        amd.home.lan:
         fog.home.lan:
         zabbix.home.lan:
+        amd.home.lan:
         omv.home.lan:
         192.168.77.101:
+        rack.home.lan:
       vars:
         ansible_python_interpreter: /usr/bin/python3
         ansible_ssh_user: jd
         # ansible_ssh_password: l4c1j4yd33Du5lo
-        ansible_become_password: l4c1j4yd33Du5lo
-        identity_file: ssh_key.pem
-        ansible_ssh_pass: l4c1j4yd33Du5lo
+        ansible_become_password: q
+        ansible_ssh_pass: q
         ansible_become_user: root
+
+    external:
+      hosts:
+        sectorq.cloud:
+      vars:
+        ansible_python_interpreter: /usr/bin/python3
+        ansible_ssh_user: root
+        # ansible_ssh_password: l4c1j4yd33Du5lo
+        ansible_become_password: l4c1j4yd33Du5lo-
+        identity_file: ssh_key.pem
+        ansible_ssh_pass: l4c1j4yd33Du5lo-
+        ansible_become_user: root
+     
     nas:
       hosts:
         nas.home.lan:
@@ -30,3 +43,19 @@ datacenter:
         # ansible_user: admin
         # ansible_pass: l4c1!j4yd33?Du5lo1
         ansible_python_interpreter: /share/ZFS530_DATA/.qpkg/QPython312/bin/python3
+    vms:
+      hosts:
+        vm01.home.lan:
+        vm02.home.lan:
+        vm03.home.lan:
+        vm04.home.lan:
+        vm05.home.lan:
+        vm06.home.lan:
+      vars:
+        ansible_python_interpreter: /usr/bin/python3
+        ansible_ssh_user: jd
+        ansible_ssh_password: q
+        ansible_become_method: su
+        ansible_become_password: q
+        ansible_ssh_pass: q
+        ansible_become_user: root

hosts_kestra copy.yml

@@ -1,153 +0,0 @@
----
-datacenter:  
-  children:
-    odroid_cluster:
-      children:
-        odroid_master:
-          hosts:
-            192.168.77.131:
-          vars:
-            testVar: 999
-        odroid_worker:
-          hosts:
-            192.168.77.13[2:5]:
-        
-      vars:
-        ansible_ssh_user: jd
-        ansible_ssh_pass: lacijaydee
-        ansible_become_password: lacijaydee
-        ssh_args: "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
-        ansible_ssh_common_args: "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
-
-    localhost1:
-          hosts:
-            localhost
-          vars:
-            ansible_user: root
-    morefine:
-      hosts:
-        192.168.77.12:
-      vars:
-        jaydee_install_mqtt_srv: true
-        ansible_python_interpreter: auto_silent
-        ansible_ssh_user: jd
-        ansible_become_user: root
-        ansible_become_password: q
-        ansible_ssh_common_args: "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
-        
-    ryzen:
-      hosts:
-        192.168.77.15:
-      vars:
-        ansible_python_interpreter: auto_silent
-        ansible_ssh_user: root
-        ansible_ssh_pass: lacijaydee
-        ansible_password: lacijaydee
-        ansible_become_user: root
-        ansible_become_password: lacijaydee
-    omv:
-      hosts:
-        192.168.77.189:
-      vars:
-        ansible_user: root
-        ansible_password: lacijaydee
-        ansible_ssh_user: root
-        ansible_ssh_pass: lacijaydee
-        ansible_become_user: root
-        ansible_become_password: lacijaydee
-    amd:
-      hosts:
-        192.168.77.4:
-      vars:
-        ansible_user: root
-        ansible_password: l4c1j4yd33Du5lo
-        ansible_ssh_user: root
-        ansible_ssh_pass: l4c1j4yd33Du5lo
-        ansible_become_user: root
-        ansible_become_password: l4c1j4yd33Du5lo
-    rhasspy:
-      hosts:
-        192.168.77.224
-      vars:
-        ansible_user: jd
-        ansible_ssh_pass: q
-        ansible_become_password: l4c1j4yd33Du5lo
-    windows:
-      hosts:
-        192.168.77.211
-      vars:
-        ansible_user: jd
-        ansible_password: "q"
-        ansible_connection: winrm
-        ansible_port: 5985
-        ansible_winrm_server_cert_validation: ignore
-        ansible_winrm_kerberos_delegation: true
-    mqtt_srv:
-      children:
-        servers:
-          hosts:
-            rpi5-1.home.lan:
-            rpi5.home.lan:
-            omv.home.lan:
-            rack.home.lan:
-            m-server.home.lan:
-            zabbix.home.lan:
-            192.168.77.101:
-          vars:
-            ansible_python_interpreter: /usr/bin/python3
-            ansible_ssh_user: jd
-            ansible_become_password: l4c1j4yd33Du5lo
-            ansible_ssh_private_key_file: ssh_key.pem
-            identity_file: ssh_key.pem
-        nas:
-          hosts:
-            nas.home.lan:
-          vars:
-            ansible_ssh_user: admin
-            become_method: su
-            become_user: admin
-            ansible_ssh_private_key_file: ssh_key.pem
-            # ansible_user: admin
-            # ansible_pass: l4c1!j4yd33?Du5lo1
-            ansible_python_interpreter: /share/ZFS530_DATA/.qpkg/QPython312/bin/python3
-        desktop:
-          hosts:
-            morefine.home.lan:
-          vars:
-            ansible_ssh_user: jd
-            ansible_become_user: root
-            ansible_become_password: q
-            # ansible_ssh_password: q
-            ansible_ssh_private_key_file: ssh_key.pem
-
-    containers:
-      children:
-        servers:
-          hosts:
-            rpi5-1.home.lan:
-            rpi5.home.lan:
-            m-server.home.lan:
-            fog.home.lan:
-            zabbix.home.lan:
-            omv.home.lan:
-            192.168.77.101:
-          vars:
-            ansible_python_interpreter: /usr/bin/python3
-            ansible_ssh_user: jd
-            # ansible_ssh_password: l4c1j4yd33Du5lo
-            ansible_become_password: l4c1j4yd33Du5lo
-            ansible_ssh_private_key_file: ssh_key.pem
-            identity_file: ssh_key.pem
-            ansible_ssh_pass: l4c1j4yd33Du5lo
-        nas:
-          hosts:
-            nas.home.lan:
-            192.168.77.106:
-          vars:
-            ansible_ssh_user: admin
-            become_method: su
-            become_user: admin
-            ansible_ssh_private_key_file: ssh_key.pem
-            # ansible_user: admin
-            # ansible_pass: l4c1!j4yd33?Du5lo1
-            ansible_python_interpreter: /share/ZFS530_DATA/.qpkg/QPython312/bin/python3

hosts_roles.yml

@@ -107,7 +107,19 @@ datacenter:
             ansible_become_password: q
             # ansible_ssh_password: q
             ansible_ssh_private_key_file: ssh_key.pem
-
+    proxmox:
+      children:
+        docker_workers:
+          children:
+            worker1:
+              hosts:
+                192.168.77.184:
+              vars:
+                ansible_ssh_user: jd
+                ansible_become_user: root
+                ansible_become_password: q
+                # ansible_ssh_password: q
+                ansible_ssh_password: q
     containers:
       children:
         docker_servers:
@@ -171,3 +183,16 @@ datacenter:
             ansible_ssh_user: jd
             ansible_become_password: q
             ansible_ssh_private_key_file: ssh_key.pem
+    vms:
+      hosts:
+        vm01.home.lan:
+        vm02.home.lan:
+        vm03.home.lan:
+        vm04.home.lan:
+        vm05.home.lan:
+        vm06.home.lan:
+      vars:
+        ansible_python_interpreter: /usr/bin/python3
+        ansible_ssh_user: jd
+        ansible_become_password: l4c1j4yd33Du5lo
+        ansible_ssh_private_key_file: ssh_key.pem

jaydee.yml

@@ -1,17 +1,20 @@
 $ANSIBLE_VAULT;1.1;AES256
-34653034626436373537323430316462643663336164613763306336333038346562356565393036
-3964393861323439333839383061303864326235306665620a346233313633393135366362326464
-63643039363635646131323365313833643864373637346536663831613837353833343030623366
-3038303063393565350a613439646161363330626566646264313939653339383439623532636638
-38646433353765396136333236656535636235313639393565306636376438346362646438613835
-62663031333832666262616365343831353530646263383932373666386631633430626363363966
-61396336303365306135363039303032646137613330646434366638633738363064356132383439
-36346432306531356333313963353463626232613563653331396334656539643531343136636635
-31613762383664353930653165313461626133336161353639303662666234356138373539376161
-30653837316266356136353132373663396365633434393166383230363263326139316362383766
-64303738393663343636616437346535346566346536616663333866613966343563306265633064
-66333331393861626637616330333463636135316466616532373663663464613034656337363437
-62653333653838326632643238616638313935383532303233643132303637653963626363633662
-33646161373931386133353338643462306635393866656662376234396533376431366134653536
-36363835346434323338363465336166303161633732333232653861646136326334616261653462
-66376139313433383665
+37663331373063666438653164616534303732366337653238316433326364333765306339373863
+3461393866633063303730653635356435613163623337650a636639623733346638626239326566
+37393032353063363735376133333636376262386364383933303133376630353432313136356439
+6237653563646437660a653764653562626137393363396565316666383064383933323338623838
+31373234313330663861336537313431616136356234626435383037333966326637313836633561
+65356437333264393061303263326637643839313732386533366133376534383263643562333636
+62383736333438663131613563373936623261356666393931326461363336353534623464613733
+62333636326538623539393634366137663833353137656235356135326435306563393336663866
+38373563346339386364323063613436326562336337363330656330313436313730356530643237
+30316463613338613765383235613665383666303135353236663830623639343764313330653937
+35393132333565386333643534366564306165636235356138313533616261653936333161373135
+65363333376331653735336133613938313436366530656261366630616330643233353731663931
+34303632373530663437386130656633376131326538323466643830326266346465666563343364
+63303631363635303337653135336662346434653166623635633730613639653539626161323636
+31356164623537386634393534623538373833633732396232613532383163303136386139613730
+61653534636434616438633030633636343663396636653536386536333866646438633433613931
+61323833333237333063356331333137616564653636333361353239653738653830633537386661
+65353763623666326265633164633763323463363237363333373562336434393264356438323634
+613632373265346632306436633535323731

requirements.txt

@@ -0,0 +1,10 @@
+ansible-core==2.20.0
+ansible-lint==25.11.1
+
+# YAML libs
+PyYAML>=6.0.2
+ruamel.yaml==0.18.16
+ruamel.yaml.clib==0.2.15
+
+jinja2==3.1.6
+ansible-compat==25.11.0

roles/autofs/tasks/main.yml

@@ -26,11 +26,23 @@
         content: |
           docker_data  -fstype=nfs   m-server.home.lan:/docker_data
           downloads  -fstype=nfs   m-server.home.lan:/downloads
+          movies  -fstype=nfs   m-server.home.lan:/movies
+          shows  -fstype=nfs   m-server.home.lan:/shows
+          music  -fstype=nfs   m-server.home.lan:/music
         mode: '0600'
         owner: root
         group: root
       when: inventory_hostname != 'm-server.home.lan'
+    - name: Creating a file with content
+      ansible.builtin.copy:
+        dest: "/etc/auto.amd"
+        content: |
+          backup  -fstype=nfs   amd.home.lan:/backup
 
+        mode: '0600'
+        owner: root
+        group: root
+      when: inventory_hostname == 'm-server.home.lan'
     - name: Creating a file with content
       ansible.builtin.copy:
         dest: "/etc/auto.rack"
@@ -140,6 +152,8 @@
           music --fstype=nfs,rw nas.home.lan:/music
           shows --fstype=nfs,rw nas.home.lan:/shows
           xxx --fstype=nfs,rw nas.home.lan:/xxx
+          proxmox --fstype=nfs,rw nas.home.lan:/proxmox
+          live --fstype=nfs,rw nas.home.lan:/live
         mode: '0600'
         owner: root
         group: root
@@ -192,6 +206,11 @@
         path: /etc/auto.master
         regexp: "^/media/rpi5.*"
         line: /media/rpi5  /etc/auto.rpi5 --timeout 360 --ghost
+    - name: Reconfigure autofs Server
+      ansible.builtin.lineinfile:
+        path: /etc/auto.master
+        regexp: "^/media/amd.*"
+        line: /media/amd  /etc/auto.amd --timeout 360 --ghost
 
     - name: Restart docker service
       ansible.builtin.service:

roles/cert_gen/files/certs.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+mkdir /tmp/certgen 2>/dev/null
+cd /tmp/certgen
+
+openssl genrsa -aes256 -out ca-key.pem -passout pass:"foobarpwd" 4096
+openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem -subj "/C=SK/ST=Slovakia/L=SK/O=sectorq.cloud/OU=IT/CN=sectorq.cloud" -passin pass:"foobarpwd"
+openssl genrsa -out server-key.pem 4096
+if [[ `hostname` == "nas" ]]
+then
+IP=`ip route get 8.8.8.8 | head -1 | cut -d' ' -f8`
+else
+IP=`ip route get 8.8.8.8 | head -1 | cut -d' ' -f7`
+fi
+HOST=`uname -n`
+openssl req -subj "/CN=$HOST" -sha256 -new -key server-key.pem -out server.csr
+echo subjectAltName = DNS:$HOST,DNS:${HOST}.home.lan,IP:$IP,IP:127.0.0.1 >> extfile.cnf
+echo extendedKeyUsage = serverAuth >> extfile.cnf
+openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem \
+  -CAcreateserial -out server-cert.pem -extfile extfile.cnf -passin pass:"foobarpwd"
+openssl genrsa -out key.pem 4096
+openssl req -subj '/CN=client' -new -key key.pem -out client.csr
+echo extendedKeyUsage = clientAuth > extfile-client.cnf
+openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem \
+  -CAcreateserial -out cert.pem -extfile extfile-client.cnf  -passin pass:"foobarpwd"
+rm -v client.csr server.csr extfile.cnf extfile-client.cnf
+chmod -v 0400 ca-key.pem key.pem server-key.pem
+chmod -v 0444 ca.pem server-cert.pem cert.pem

roles/cert_gen/tasks/main.yml

@@ -0,0 +1,106 @@
+- name: Cert gen
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: jaydee.yml
+    - name: Create a directory for certs
+      ansible.builtin.file:
+        path: /tmp/certgen
+        state: directory
+        mode: '0700'
+        owner: root
+        group: root
+    - name: Copy cert generation script
+      ansible.builtin.copy:
+        src: certs.sh
+        dest: /tmp/certgen/certs.sh
+        mode: '0700'
+        owner: root
+        group: root
+    - name: Generate certs
+      ansible.builtin.command: /tmp/certgen/certs.sh
+      args:
+        chdir: /tmp/certgen
+      register: certgen
+      changed_when: "certgen.rc == 0"
+
+    - name: Copy generated certs to files
+      ansible.builtin.copy:
+        src: /tmp/certgen/server-key.pem
+        dest: /etc/docker/certs/
+        remote_src: true
+        mode: '0600'
+        owner: root
+        group: root
+    - name: Copy generated certs to files
+      ansible.builtin.copy:
+        src: /tmp/certgen/server-cert.pem
+        dest: /etc/docker/certs/
+        remote_src: true
+        mode: '0600'
+        owner: root
+        group: root
+    - name: Copy generated certs to files
+      ansible.builtin.copy:
+        src: /tmp/certgen/ca.pem
+        dest: /etc/docker/certs/
+        remote_src: true
+        mode: '0600'
+        owner: root
+        group: root
+
+    - name: Create a directory for certs on nas
+      ansible.builtin.file:
+        path: /media/nas/data/certs/docker/{{ inventory_hostname }}
+        state: directory
+        mode: '0777'
+        owner: jd
+        group: root
+      when: inventory_hostname != 'sectorq.cloud'
+
+    - name: Copy generated certs to files
+      ansible.builtin.copy:
+        src: /tmp/certgen/{{ cert1 }}
+        dest: /media/nas/data/certs/docker/{{ inventory_hostname }}
+        remote_src: true
+        mode: '0644'
+        owner: jd
+        group: root
+      when: inventory_hostname != 'sectorq.cloud'
+      loop_control:
+        loop_var: cert1
+      loop:
+        - ca.pem
+        - cert.pem
+        - key.pem
+
+    - name: Install sshpass
+      ansible.builtin.apt:
+        name: sshpass
+        state: present
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Create cert directory on nas server
+      ansible.builtin.command: |
+        sshpass -p {{ nas_password }} \
+        ssh  -p2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null admin@sectorq.eu "mkdir -p /share/Data/certs/docker/{{ inventory_hostname }}"
+      register: certgen
+      changed_when: "certgen.rc == 0"
+      ignore_errors: true
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Generate certs
+      ansible.builtin.command: |
+        sshpass -p {{ nas_password }} \
+        scp -P2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null {{ cert2 }} admin@sectorq.eu:/share/Data/certs/docker/{{ inventory_hostname }}/
+      register: certgen
+      changed_when: "certgen.rc == 0"
+      args:
+        chdir: /tmp/certgen
+      loop_control:
+        loop_var: cert2
+      loop:
+        - ca.pem
+        - cert.pem
+        - key.pem
+        - server-cert.pem
+        - server-key.pem

roles/common/tasks/main.yml

@@ -18,6 +18,7 @@
           apt-mark hold docker-ce docker-compose-plugin docker-ce-rootless-extras docker-ce-cli docker-buildx-plugin
       register: logo
       changed_when: "logo.rc == 0"
+      when: inventory_hostname != 'morefine.home.lan'
 
     - name: Upgrade the full OS
       ansible.builtin.apt:

roles/docker/tasks/main.yml

@@ -18,6 +18,11 @@
           - python3-dev
         state: present
         update_cache: true
+      register: install_docker_deps
+      until: install_docker_deps is succeeded
+      retries: 10
+      delay: 10
+
     - name: Get keys for raspotify
       ansible.builtin.command:
         install -m 0755 -d /etc/apt/keyrings
@@ -42,6 +47,66 @@
       when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
 
+    - name: Ensure docker keyring directory exists
+      file:
+        path: /etc/apt/keyrings
+        state: directory
+        mode: "0755"
+
+    - name: Download Docker GPG key
+      get_url:
+        url: https://download.docker.com/linux/debian/gpg
+        dest: /etc/apt/keyrings/docker.asc
+        mode: "0644"
+      when:
+        - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
+        
+    - name: Install docker.sources file
+      template:
+        src: docker.sources.j2
+        dest: /etc/apt/sources.list.d/docker.sources
+        owner: root
+        group: root
+        mode: "0644"
+      when:
+        - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
+
+    - name: Create docker.sources file
+      copy:
+        dest: /etc/apt/sources.list.d/docker.sources
+        mode: "0644"
+        content: |
+          Types: deb
+          URIs: https://download.docker.com/linux/debian
+          Suites: {{ ansible_facts['lsb']['codename'] }}
+          Components: stable
+          Signed-By: /etc/apt/keyrings/docker.asc
+      when:
+          - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"        
+
+
+    - name: Update apt cache
+      apt:
+        update_cache: yes
+
+      when:
+        - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
+
+    - name: Download Docker GPG key
+      get_url:
+        url: https://download.docker.com/linux/debian/gpg
+        dest: /etc/apt/keyrings/docker.asc
+        mode: "0644"
+      when:
+        - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
+
+
+
+
+
+
+
+
     - name: Add an Apt signing key to a specific keyring file
       ansible.builtin.apt_key:
         url: https://download.docker.com/linux/ubuntu/gpg
@@ -84,13 +149,10 @@
     #       - docker-buildx-plugin
     #       - docker-compose-plugin
     #     update_cache: true
-
-
-    - name: Install the version docker
+    - name: Install the version docker1
       ansible.builtin.apt:
-        name: "{{ item }}=5:28.5.2-1~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
+        name: "{{ item }}"
         state: present
-        allow_downgrade: true
       when:
         - ansible_distribution == "Debian"
       loop:
@@ -98,7 +160,7 @@
         - docker-ce-cli
     - name: Install the version docker
       ansible.builtin.apt:
-        name: "{{ item }}=1.7.28-2~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
+        name: "{{ item }}"
         state: present
         allow_downgrade: true
       when:
@@ -108,7 +170,7 @@
 
     - name: Install the version docker
       ansible.builtin.apt:
-        name: "{{ item }}=0.28.0-0~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
+        name: "{{ item }}"
         state: present
         allow_downgrade: true
       when:
@@ -116,11 +178,43 @@
       loop:
         - docker-buildx-plugin
 
+
+    - name: Install the version docker
+      ansible.builtin.apt:
+        name: "{{ item }}=5:28.5.2-1~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
+        state: present
+        allow_downgrade: true
+      when:
+        - ansible_distribution == "Debian1"
+      loop:
+        - docker-ce
+        - docker-ce-cli
+    - name: Install the version docker
+      ansible.builtin.apt:
+        name: "{{ item }}=1.7.28-2~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
+        state: present
+        allow_downgrade: true
+      when:
+        - ansible_distribution == "Debian1"
+      loop:
+        - containerd.io
+
+    - name: Install the version docker
+      ansible.builtin.apt:
+        name: "{{ item }}=0.28.0-0~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
+        state: present
+        allow_downgrade: true
+      when:
+        - ansible_distribution == "Debian1"
+      loop:
+        - docker-buildx-plugin
+
     - name: Create a directory docker.service.d
       ansible.builtin.file:
         path: /etc/systemd/system/docker.service.d/
         state: directory
         mode: '0755'
+
     - name: Create a directory for certs
       ansible.builtin.file:
         path: /etc/docker/certs
@@ -182,6 +276,41 @@
       ansible.builtin.systemd:
         daemon_reload: true
 
+    - name: Check if file exists
+      ansible.builtin.stat:
+        path: /etc/docker/certs/ca.pem
+      register: file_check
+
+    - name: Print file check result
+      ansible.builtin.debug:
+        var: file_check
+
+    - name: Include role only if missing
+      ansible.builtin.include_role:
+        name: cert_gen
+      when: not file_check.stat.exists and mode == "cert"
+
+
+    - name: Create docker config file
+      ansible.builtin.copy:
+        dest: /etc/docker/daemon.json
+        content: |
+          {
+            "log-driver": "json-file",
+            "log-opts": {
+              "max-size": "10m",
+              "max-file": "3"
+            },
+            "data-root": "/var/lib/docker",
+            "dns": ["192.168.77.101", "192.168.77.106", "8.8.8.8"],
+            "dns-search": ["lan", "home.lan"]
+
+          }
+        mode: '0644'
+        owner: root
+        group: root
+
+
     - name: Restart docker service
       ansible.builtin.service:
         name: docker
@@ -191,6 +320,6 @@
     #   ansible.builtin.shell: docker plugin install grafana/loki-docker-driver:3.3.2-{{ ansible_architecture }} --alias loki --grant-all-permissions
     - name: Install a plugin
       community.docker.docker_plugin:
-        plugin_name: grafana/loki-docker-driver:3.3.2
+        plugin_name: grafana/loki-docker-driver
         alias: loki
         state: present

roles/docker/templates/docker.sources.j2

@@ -0,0 +1,5 @@
+Types: deb
+URIs: https://download.docker.com/linux/debian
+Suites: "{{ ansible_facts['lsb']['codename'] }}"
+Components: stable
+Signed-By: /etc/apt/keyrings/docker.asc

roles/docker/vars/main.yml

@@ -0,0 +1 @@
+mode: cert

roles/docker_packages/tasks/main.yml

@@ -1,8 +0,0 @@
-- name: Install container packages
-  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
-  block:
-    - name: Create Banner
-      ansible.builtin.command: |
-        docker exec --user root zabbix-server-zabbix-server-1  apk add curl
-      register: logo
-      changed_when: "logo.rc == 0"

roles/docker_swarm/files/ca.pem

@@ -0,0 +1,33 @@
+-----BEGIN CERTIFICATE-----
+MIIFqTCCA5GgAwIBAgIUJ3kgn/onrwoKs+MqhsHo7RmF/20wDQYJKoZIhvcNAQEL
+BQAwZDELMAkGA1UEBhMCU0sxETAPBgNVBAgMCFNsb3Zha2lhMQswCQYDVQQHDAJT
+SzETMBEGA1UECgwKc2VjdG9ycS5ldTELMAkGA1UECwwCSVQxEzARBgNVBAMMCnNl
+Y3RvcnEuZXUwHhcNMjUwMzExMTc1MDA5WhcNMjYwMzExMTc1MDA5WjBkMQswCQYD
+VQQGEwJTSzERMA8GA1UECAwIU2xvdmFraWExCzAJBgNVBAcMAlNLMRMwEQYDVQQK
+DApzZWN0b3JxLmV1MQswCQYDVQQLDAJJVDETMBEGA1UEAwwKc2VjdG9ycS5ldTCC
+AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJsXcxwOjZ3jBO3j7gps12vo
+zXmSNEoka5RiUvZlfopifwKVxFMzAJd/yoeaxiUBYKIlHgZ/OYu/+WkrwgpX2HO3
+2ZuB83Ym7P3TkTBhRp1S/HqBIb6aORGKhiuhZt6PNiCgqFszmb4Wl0Ox2cYxWYi5
+1DeHXNa5vRob2rSfsJwtamiksJkAsXclQu5dyfMv+cvc4Pob1o/DT76+xDpqT4lr
+pzXhpfXyT/xwtOEWku/53fccU0SBSSHPp6HzZUWHoodmHPigYYFEz1drYk1nDr3u
+gZq+nEQAVpcn1JrH7DuUaX/CrgBZNRdQ8d+mQ9EEDAQXNfzlH10ebfTjm2ol40cu
+9mwVJQ5Ru+h2xvfAlbcqnDTinXFgABuquSNzEz/1eJMIhm+myVOqF1WGeA/LnXGp
+OaNny7oQW8/9OLmpAZKIFzcD7KxvdBAu9IkO/KduqJohD8BBPqVAksan85bmEs8R
+Iu46XAJ7nmlX1DLchBtwvYv5MRdna73M52rTpNlmidWuiUeysZs8Nx7dGh1bd5I6
+9JnHcMl01UorQn0uitnO9zrOTEg0KkEmUZab1A2CbqeoYYLXi72Sva959faviXb0
+0HaPDtWuih9jQORu7fH7H6ghLFdfgUOp9am1hQpX1P7uXmUOB4iztMrh3bM8m2ZE
+HEvr+VfNkcq9KaAfXPhHAgMBAAGjUzBRMB0GA1UdDgQWBBTG6a566m85pq5bLi0O
+nC5y0pg6sjAfBgNVHSMEGDAWgBTG6a566m85pq5bLi0OnC5y0pg6sjAPBgNVHRMB
+Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4ICAQA5g9OxfcoAbYvi2T89E5205QkC
+ZxwWgrHIVGICeOF1K2nIypnddoJQUvMT/GYIK4QjZSWLGB2+YZMtXS+U/C9uxKOm
+d7bbzp437wUZwUJRtA4JZayxIitVTtzLYYLimb13GrsPs2KwGaZALe0K7dYzDwP1
+74gqOPvP7snDD98c6HV6vVXnTN+0T7djQyv/TqcyQ/IZjVY6JpsqgMg1rHqkYhDM
+Na7XBgwOt0Y4QmgS6EYEVv1+QsVB0U1tdH1oa+zwiyj5xDwVNmU5bLocEq3kYIRU
+tQUarNNKY4fMq529Heq7Ki63DLYTP8tJGh0Yijm9SFPqKYaZy6iL5xbdRFNCIFR/
+FnBZmRVxvPealAoIg9vutHkQrdqebBfX11PwWtLn+fkGTXq+5fBwjYllK04/MBk0
+SNjt6qwnOGZOc4gmEjthF4oVcVKoE7sVSCdgu/2jtLeJ48s0MwGhWZCk21ZgJbZY
+5gMahOiSndmudTo1ubFrqLb71MBTpqjiHTF2VLdxZEsrFCqeQAbsG+KmMuj+UhzV
+yuO3ycAGSDxsgbyHHYzjo2O5BvY35J7w1lZe1CExgoeeYFWlJ6t5PySf6OJupFit
+7FNwYgVXqC3+vwEWmbXz0WHwPh4aCvfSuNAHoiwX2UyzceYOWB5F4TmA2Chj23Ih
+isOdaq7ol1Q0iF9tjQ==
+-----END CERTIFICATE-----

roles/docker_swarm/files/server-cert.pem

@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFkDCCA3igAwIBAgIUUYzivwquTJnP+9/Q/zb/0Ew+eVowDQYJKoZIhvcNAQEL
+BQAwZDELMAkGA1UEBhMCU0sxETAPBgNVBAgMCFNsb3Zha2lhMQswCQYDVQQHDAJT
+SzETMBEGA1UECgwKc2VjdG9ycS5ldTELMAkGA1UECwwCSVQxEzARBgNVBAMMCnNl
+Y3RvcnEuZXUwHhcNMjUwMzExMTc1MDEzWhcNMjYwMzExMTc1MDEzWjAcMRowGAYD
+VQQDDBFtLXNlcnZlci5ob21lLmxhbjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC
+AgoCggIBALcgqTwwWnKeiHt1ZZQjoyZw/c/DbPwQnBuQVhNGF6RX7apXP/eY4Sf8
+/l2y6awZd6vM4JyFonPENbll/dEVgFEPgwwiqiaBC9PuZIbC60LLYwpDUmaHXNAd
+xgohSWOEc7uT1lcW2yn5n1A93JpoOScb/dAmjWPUYV3BqnKTtcqVs3a5SzWxnIqO
+szWt97SZpRY3GWIAiOmFqcKE5gL7FkSaMyS81E/Qfct/37o5OHWpiBhzLZUyop1e
+z9f7RrgDRzEoNlJisWFY/wF0xvmowkslL8QsYBTkfgofP7dEm8MOn0hJOFzuUY75
+TAp+h6wiL0bhTab4XDOrFjFy5ivehICdDSal+IlNEmI9Zsziy/1gW7WXCMMgOXKn
+xX7se2OFbHGCaf9NCn+0ODHev9ZeDni5SQsgyD3Zjyh3kc7AZ97M8jNJlCGb2QaJ
+f/BF2Q9EzbQYHjor97r/+tMdvYkYNo9+FYoJH3yP+T378Tn+DFe8KthvbqCSF01t
+aDdfcRu0p+qNalVkD2rctohJgiEuhzVIIpfqe3P9yMyzBYgwoXMUIthug4wOo8gE
+Xwr7cgTTK8pxPQGlo1JL0WuBxodtdHP9/VQmf3Qkgj3W0UTAP3rphnvg/5S5tqIT
+P7W+HVjEzTEh2z2FGxz4lvEbo82FrhxnCrW+Gk/jhbY99Lr3SeetAgMBAAGjgYEw
+fzAoBgNVHREEITAfghFtLXNlcnZlci5ob21lLmxhbocEwKhN7ocEfwAAATATBgNV
+HSUEDDAKBggrBgEFBQcDATAdBgNVHQ4EFgQUOIy9QvfKWPuMGEp4C2yvjNO2uYsw
+HwYDVR0jBBgwFoAUxumueupvOaauWy4tDpwuctKYOrIwDQYJKoZIhvcNAQELBQAD
+ggIBAIJBsaPUjAApSDplyUGru6XnLL1UHjG+g49A12QIfgG9x2frRRhvAbx21121
+sCJ5/dvHJS/a8xppcNd4cMFrvLrOkZn6s+gfeXc20sMscdyjnjIbxdmDiUwnhoFT
++9OKg5BYokg11PmEOhMEK7L9qEXaf5L+9TdcxBl/qvciqSpZ9FsOGDYCgB0EMsQ/
+48/Tj/0ABF+c/+WVXzWL51Gdj6waM0qqXjGArbjAUA7ft8gy18n/6DyM3KWlZXCb
++mAwUGnOvHFNbb8jgxSDvFeIos0P6Edq0PDcK5k1uYEeATp0CC6/F3z1Eai2vKy+
+c1BbJZtDJmlKTL+7vykHMSVqAuN/Vq4uvtxv1pOCR1UJk1mW0mr6Ovm9sVVk5HFD
+3j6nOF81PiabdWA6GbbSCQdlpL2v0KipAR/sNheMwXAe+5NGJAiE5uaBgQSTVZS+
+7b4DDKFxfkHR9ISOGURgf9wRxqF6jNS4qqQp9+sOdK6y++ZVGRTTpQbCHEg9V79r
+TTGs4lbvaFCmF/Y9/NPSrRo//l+XhJrpjoeyx04iy6QipErCCFK2dHH5hYfS3ISt
+kbaw2ARNqbcktQkWwA+W+rb83en/w3WG1v2vByKGCr1s4jHAhWtSLZhXx+PIYeT+
+ml/kv+Y3W1T/lOcsytJrXug8t+g4nh9wYTnRl5YwruaKQjWF
+-----END CERTIFICATE-----

roles/docker_swarm/files/server-key.pem

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQC3IKk8MFpynoh7
+dWWUI6MmcP3Pw2z8EJwbkFYTRhekV+2qVz/3mOEn/P5dsumsGXerzOCchaJzxDW5
+Zf3RFYBRD4MMIqomgQvT7mSGwutCy2MKQ1Jmh1zQHcYKIUljhHO7k9ZXFtsp+Z9Q
+PdyaaDknG/3QJo1j1GFdwapyk7XKlbN2uUs1sZyKjrM1rfe0maUWNxliAIjphanC
+hOYC+xZEmjMkvNRP0H3Lf9+6OTh1qYgYcy2VMqKdXs/X+0a4A0cxKDZSYrFhWP8B
+dMb5qMJLJS/ELGAU5H4KHz+3RJvDDp9ISThc7lGO+UwKfoesIi9G4U2m+FwzqxYx
+cuYr3oSAnQ0mpfiJTRJiPWbM4sv9YFu1lwjDIDlyp8V+7HtjhWxxgmn/TQp/tDgx
+3r/WXg54uUkLIMg92Y8od5HOwGfezPIzSZQhm9kGiX/wRdkPRM20GB46K/e6//rT
+Hb2JGDaPfhWKCR98j/k9+/E5/gxXvCrYb26gkhdNbWg3X3EbtKfqjWpVZA9q3LaI
+SYIhLoc1SCKX6ntz/cjMswWIMKFzFCLYboOMDqPIBF8K+3IE0yvKcT0BpaNSS9Fr
+gcaHbXRz/f1UJn90JII91tFEwD966YZ74P+UubaiEz+1vh1YxM0xIds9hRsc+Jbx
+G6PNha4cZwq1vhpP44W2PfS690nnrQIDAQABAoICAACEElRh8wKkg6xWkQULDMdi
+wWen/H85frbufBhkyQH3NWjErCMmwzJsMWi9EUkKGs7VWKgLv7uadY4q03XHhgmc
+GrAEwS6UaFmNgd5fmk3j1rHhUSIUyq8JNkbtIPr9bC+a6C/OuRYpE4o2V1zzPK1D
+HokafrNqxHGne/g8ASfgGcApH9C1MwR9bnyi6txmhRcDM7SiZ5JCDCGdgg11eirz
+45PvsAysg3ZfA4DAQOWn4defEj8NtO9kisbRKWBKosrrJmSWZ4fnd6F8TzSX/dO8
+MEEXUW7RJ7G0vviTnSeQNnjsZB+wQk84y3lRGDzvCVxR7cqLdaKjMD38zQdr1HiM
+IysiYw7aUQ8ukz+4I4izPmn/iDdTxNzTHSvaxCjKRqsaj9R3kEFqtVuOoInfwKD9
+iSoEI35IkEIJwhvnt/xfZY03HwI7JBvSgA23zM5L2dvuM0nwGVcn+/WkLcYRum2y
+hXRbpQ69dVTiFCxQG71bdcuK8z2lxXDPsyBjkcBta/WwQe8sHHdrszyc1Zf5DIDx
+341bQ0cJEZQJD5BmKNij6Ow0N9g/0vySAScKF1zM9J0fE/XBihNYIH9JCXPRrFqw
+BmUGmNjjyJSbnYMxjyVDz8g9026N+w23VtLv0UlA4hF3Hexupqol7XM+MhqNSFIO
+A+F8Ho9U38LZfA3yt8JpAoIBAQD00RQmllHGtRR2zsIA0LPMVUyV3DOshJ4XYj8a
+sN2rSU9rgNRB0rnpgWoGMAysOerPphvoY6bf1wrI3dFt5pzQMuKJLz6VFl135k5R
+11kxZfCmZC/pIp3WLkIHDthAXkU5IKnWw/4vQgmIwTZ5I7rNjPaJYuoH8z5Buuwi
+qUnEJj3czq4iNW2DHAFd657NQImrIbvN4T9SHLGrFBG3Bqf43xc/TMNqOnD7FcYe
++DIkBFXBFqx6pwMjP7hUwo88Oxzp7I/MaDXw9LnSPt2YQqdyNaaFiyk8JWc87LMq
+DFaXFh+aON9XFxvKfCQA5uNCwyaWMi8zNWLpFTPKuZPPaWR5AoIBAQC/fi5ReLUL
+HEpGgKw9UstgexmdnQLVisVfRH9eaQn/U6Yoo8XD0gpdjtqdA9dStV3jw9zKAoeP
+twg819A/nl+kavDP1bGxaxEou9BUFvxyqw0OrA1bKznNlcpCNpqShSiFVO/6CqaU
+awaDRuAsf4gs8/vKzw3q5bPErC+/a8x8USicOMc1tPrUxmTSwoXCfgtb+l7+7K48
+QeA27zPxaOCotAhef1T6KW1mYC7vP0ertZwiG+Lqoh9fzrun5TUYielqqrAJWPFC
+o12r6jqhr9a6dPZ0/ZBCK3JyvdYGt321P6yffA78sz0hvSqT9JMmNnZJSc6oOiuB
+qqutqzl/KgfVAoIBAQDoZWD/kEpompSmg3beVz+WhJKC39mdtvZrtDO7HpIOezUN
+E+pp4aPh6Zu/6/TbuM8R9tkfLRnH+tad/xNDhFrvuJ4bI+IAnI51twY54nck0WQ0
+T367jMTQAHFlSc42rEaCCGOxH7Q3IDT0wJT5QdWeMmYF3QPUMC+1Lb/i11jS/opT
+BU9/4b/nabpSccz5gn4tGYSx11TImbx+bjqyx3rEYOIskK4gNQHzF6RO2cSfNA5D
+kUaB1/C+kUpmC5r0zhiQZqPKolIyPd33mv23/+38GLnOo1+tXMQ3rWoWTEgWfEXb
+nIlGnwUeneF/ia3KPn5urYzoy5DtOddEZg3OInnhAoIBAGrVZ9v2PvMi5mFtGirg
+TSzXoNPpLBKc6D6dRX4TlgtHzNSxgf0c6sGFmHuvD+tJ2kbfGAfv31eTotnnAXzs
+y6k8LHuXWhqEhD84gSLY7CDBQ3ijDpSFiisjXYMRWa1S8udoGrZiSMtW5nxJB3pr
+8Do8KIbee4JIgsG/2qet6ZiV4tU9bA6PmL0qrkdTVTLMBWRcS7FntFFT41Zin5UY
+kPYt8tldqrgicrGCCc1afY7TtHbnHfMPXfeiq9kgrD2ze3ESJ0IfyAIIiJMIC4v3
+QRInfPSKHnh8Ks7PEGAQ8OY0zwbvPKFJElsHYYDIG2xfSCDdN5ltUqZ15G/wrhQ/
+C70CggEAHKhqoWElJNa3Ba4UscXKWL28cXRkMLdZGRngU5W9GLUQhDVYHdy+x5jU
+5V4OnhCFo4Vq8uc2HsKnknhu/KGJ2gf3g8ASkILCG6aqB+0xZ+N6/dW0Yfft7vV4
+az9azn2nEK6Pqiokm0ggc+UhZ4C6EKWY3Vefs0scxKBIx48aGDP0I/XwFrZpwdWC
+Z/jlCjTZlJ+5G7VenkqWtIlJmXZ6zrRFkPKlmxSTKIrDTJaD0dcNmDrwe+au0x+y
+YHMSo0gMN9W5pFN6LDc/JYXOkb995mkKXyzeRTFy+v2yFig6rSwBStwcSTsuNWAe
+FOWrzZPSFGNqLJEHjZdIBAaDR6ER7A==
+-----END PRIVATE KEY-----

roles/docker_swarm/handlers/main.yml

@@ -0,0 +1,5 @@
+- name: restart_docker
+  ansible.builtin.service:
+    name: docker.service
+    state: restarted
+  become: true

roles/docker_swarm/tasks/main.yml

@@ -0,0 +1,29 @@
+- name: Setup docker
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  collections:
+    - community.docker
+  block:
+    - name: Facts
+      ansible.builtin.setup:
+    - name: Install Docker SDK for Python
+      pip:
+        name: docker>=5.0.0
+        executable: pip3
+        break_system_packages: true
+    - name: Initialize swarm
+      docker_swarm:
+        state: present
+        listen_addr: "{{ ansible_default_ipv4.address }}:2377"
+      register: swarm_init
+      when: inventory_hostname == "vm01.home.lan"
+
+    - name: Show join tokens
+      ansible.builtin.debug:
+        msg:
+          - "Manager join token: {{ swarm_init.swarm_facts['JoinTokens']['Manager'] }}"
+          - "Worker join token: {{ swarm_init.swarm_facts['JoinTokens']['Worker'] }}"
+      when: inventory_hostname == "vm01.home.lan"
+
+    - name: Join swarm as worker
+      shell: docker swarm join --token {{ hostvars['vm01.home.lan']['swarm_init'].swarm_facts['JoinTokens']['Worker'] }} {{ hostvars['vm01.home.lan']['ansible_default_ipv4']['address'] }}:2377
+      when: inventory_hostname != "vm01.home.lan"

roles/docker_swarm/vars/main.yml

@@ -0,0 +1 @@
+mode: cert

roles/git/tasks/main.yml

@@ -0,0 +1,9 @@
+- name: Install git
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Install the version git
+      ansible.builtin.apt:
+        name: "{{ item }}"
+        state: present
+      loop:
+        - git

roles/hosts/tasks/main.yml

@@ -26,3 +26,8 @@
         path: "/etc/hosts"
         regexp: "^192.168.77.55 .*"
         line: "192.168.77.55 rack rack.home.lan"
+    - name: Reconfigure hosts file
+      ansible.builtin.lineinfile:
+        path: "/etc/hosts"
+        regexp: "^193.168.144.164 .*"
+        line: "193.168.144.164 external"

roles/init/files/id_rsa.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCjPi74gAHT2GBbKWWmmUrzzrhKQN3mnz3DTWn02KhbgWs6MRLlTrn2fLqB4hkoVEOat29wAOJ2xuY4aEjGfO6nl/3ka3oqslwxW9GqFCRXVHnF3b+Wly+jkn3tbht+gjFK4x0np1WZbpTI/nR7gElWa774LCHy5i4fm5ISoCHzRMsKd3dVF4YOte6QC9Uu4uQQjpZWksYRjANtXAk5EDEOERz+Dh8RDkXbGYW2vx1ihNQGh53z3c6W6bajGq3qx/+G905MtRgutbHWOOYSE8o2q3vaDkCNA6Fjd3P6gHTPcRjFEfoHc8Vxp0vjR9e6ol8X7D+GEL6g6QN656772Zo3/Qka0rJ/zMnT3gZ2S4i0CzmqDoecbzDCX7ywwuwgvlmJGOswgwwOKP/E0/RnWi63BUFV/fU9o5nr9ZXgkiRa9ZCzubHZhxyN6Z7EhcOVnMbvfV1W5Fn/vbj84YudCLmzrk5qvpQ+qVsMXi1GPIEyFwyg/Afu5JTpNE5+4ViFzTM= jd@morefine

roles/init/tasks/main.yml

@@ -0,0 +1,53 @@
+- name: Init
+  become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
+  become_method: su
+  block:
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: jaydee.yml
+    - name: Change password for jd
+      ansible.builtin.user:
+        name: jd
+        password: "{{ jd_password | password_hash('sha512') }}"
+    - name: Ensure deploy user exists
+      ansible.builtin.user:
+        name: jd
+        shell: /bin/bash
+        groups: sudo
+        append: true
+    - name: Give deploy sudo access
+      ansible.builtin.copy:
+        dest: /etc/sudoers.d/jd
+        content: "jd ALL=(ALL:ALL) ALL\n"
+        owner: root
+        group: root
+        mode: '0440'
+
+    - name: Change password for root
+      ansible.builtin.user:
+        name: root
+        password: "{{ jd_password | password_hash('sha512') }}"
+    - name: Update become password for subsequent tasks
+      ansible.builtin.set_fact:
+        ansible_become_password: "{{ jd_password }}"
+
+    - name: Add authorized SSH key
+      ansible.posix.authorized_key:
+        user: "jd"
+        key: "{{ lookup('file', 'id_rsa.pub') }}"
+        state: present
+
+    - name: Set timezone to Europe/Bratislava
+      ansible.builtin.command:
+        cmd: timedatectl set-timezone Europe/Bratislava
+      args:
+        creates: /etc/timezone
+    - name: Set hostname
+      ansible.builtin.hostname:
+        name: "{{ inventory_hostname }}"
+    - name: Add host entry to /etc/hosts
+      ansible.builtin.lineinfile:
+        path: /etc/hosts
+        regexp: "^127.0.0.1 .*"
+        line: "127.0.0.1 {{ inventory_hostname }} {{ inventory_hostname.split('.')[0] }}"
+        state: present

roles/letsgo/tasks/main.yml

@@ -0,0 +1,12 @@
+- name: Letsgo
+  become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
+  block:
+    - name: Include roles
+      ansible.builtin.include_role:
+        name: "{{ roles_item }}"
+      loop_control:
+        loop_var: roles_item
+      loop:
+        - docker
+        - docker_swarm
+        - autofs

roles/nfs_server/tasks/main.yml

@@ -19,6 +19,8 @@
         value: "1"
         no_extra_spaces: true
         mode: '0644'
+      when: inventory_hostname == 'rpi5.home.lan'
+
     - name: Mount and bind a volume
       ansible.posix.mount:
         path: /srv/nfs/downloads
@@ -28,6 +30,15 @@
         fstype: none
       when: inventory_hostname == 'm-server.home.lan'
 
+    - name: Mount and bind a volume
+      ansible.posix.mount:
+        path: /srv/nfs/backup
+        src: /mnt/raid/backup
+        opts: bind
+        state: mounted
+        fstype: none
+      when: inventory_hostname == 'amd.home.lan'
+
     - name: Mount and bind a volume
       ansible.posix.mount:
         path: /srv/nfs/docker_data
@@ -35,38 +46,68 @@
         opts: bind
         state: mounted
         fstype: none
-    - name: Reconfigure nfs fstab
-      ansible.builtin.lineinfile:
-        path: /etc/fstab
-        regexp: "^/media/m-server/downloads .*"
-        line: "/media/m-server/downloads  /srv/nfs/downloads    none    bind    0       0"
-      when: inventory_hostname == 'm-server.home.lan'
+      when: inventory_hostname != 'amd.home.lan'
+
     - name: Reconfigure nfs exports
       ansible.builtin.lineinfile:
         path: /etc/fstab
-        regexp: "^/share/docker_data .*"
-        line: "/share/docker_data  /srv/nfs/docker_data    none    bind    0       0"
+        regexp: "^/share/{{ volume }} .*"
+        line: "/media/m-server/{{ volume }}  /srv/nfs/{{ volume }}    none    bind    0       0"
       when: inventory_hostname == 'm-server.home.lan'
+      loop_control:
+        loop_var: volume
+      loop: 
+        - downloads
+        - music
+        - movies
+        - shows
+
+    - name: Reconfigure nfs exports
+      ansible.builtin.lineinfile:
+        path: /etc/fstab
+        regexp: "^/share/{{ volume }} .*"
+        line: "/share/{{ volume }}  /srv/nfs/{{ volume }}    none    bind    0       0"
+      when: inventory_hostname == 'm-server.home.lan'
+      loop_control:
+        loop_var: volume
+      loop: 
+        - docker_data
 
     - name: Reconfigure nfs exports
       ansible.builtin.lineinfile:
         path: /etc/exports
         regexp: "^/srv/nfs .*"
-        line: "/srv/nfs         192.168.77.0/24(rw,sync,no_subtree_check,crossmnt,fsid=0)"
+        line: "/srv/nfs         192.168.77.0/24(rw,sync,no_subtree_check,crossmnt,fsid=0) 192.168.80.0/24(rw,sync,no_subtree_check,crossmnt,fsid=0)"
 
     - name: Reconfigure nfs exports
       ansible.builtin.lineinfile:
         path: /etc/exports
         regexp: "^/srv/nfs/docker_data .*"
-        line: "/srv/nfs/docker_data 192.168.77.0/24(rw,sync,no_subtree_check)"
+        line: "/srv/nfs/docker_data 192.168.77.0/24(rw,sync,no_subtree_check) 192.168.80.0/24(rw,sync,no_subtree_check)"
+      when: inventory_hostname != 'amd.home.lan'
 
     - name: Reconfigure nfs exports
       ansible.builtin.lineinfile:
         path: /etc/exports
-        regexp: "^/srv/nfs/downloads .*"
-        line: "/srv/nfs/downloads 192.168.77.0/24(rw,sync,no_subtree_check)"
+        regexp: "^/srv/nfs/{{ volume }} .*"
+        line: "/srv/nfs/{{ volume }} 192.168.77.0/24(rw,sync,no_subtree_check) 192.168.80.0/24(rw,sync,no_subtree_check)"
       when: inventory_hostname == 'm-server.home.lan'
+      loop_control:
+        loop_var: volume
+      loop: 
+        - downloads
+        - music
+        - movies
+        - shows
 
+
+
+    - name: Reconfigure nfs exports
+      ansible.builtin.lineinfile:
+        path: /etc/exports
+        regexp: "^/srv/nfs/backup .*"
+        line: "/srv/nfs/backup 192.168.77.0/24(rw,sync,no_subtree_check) 192.168.80.0/24(rw,sync,no_subtree_check)"
+      when: inventory_hostname == 'amd.home.lan'
     - name: Restart nfs service
       ansible.builtin.service:
         name: nfs-server

roles/omv_backup/tasks/main.yml

@@ -1,6 +1,11 @@
 - name: Omv Setup
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
   block:
+    # - name: Gather facts
+    #   ansible.builtin.setup:
+    # - name: Print
+    #   ansible.builtin.debug:
+    #     msg: "{{ ansible_facts }}"
     - name: Include vault
       ansible.builtin.include_vars:
         file: jaydee.yml
@@ -10,6 +15,21 @@
       ansible.builtin.file:
         state: absent
         path: "{{ dest_folder }}"
+
+    - name: "Check if listed package is installed or not on Debian Linux family"
+      ansible.builtin.package:
+        name: "{{ item }}"
+        state: present
+      check_mode: true
+      loop:
+        - git
+      register: git_installed
+
+    - name: Include role only if missing
+      ansible.builtin.include_role:
+        name: git
+      when: not git_installed
+
     - name: Pull repo
       tags:
         - git_pull
@@ -72,6 +92,7 @@
       ansible.builtin.apt:
         name:
           - python3-virtualenv
+          - rsync
 
     - name: Install specified python requirements in indicated (virtualenv)
       ansible.builtin.pip:

roles/proxmox/tasks/main.yml

@@ -0,0 +1,127 @@
+- name: Omv Setup
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    # - name: Gather facts
+    #   ansible.builtin.setup:
+    # - name: Print
+    #   ansible.builtin.debug:
+    #     msg: "{{ ansible_facts }}"
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: jaydee.yml
+        name: mysecrets
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Delete content & directory
+      ansible.builtin.file:
+        state: absent
+        path: "{{ dest_folder }}"
+
+    - name: "Check if listed package is installed or not on Debian Linux family"
+      ansible.builtin.package:
+        name: "{{ item }}"
+        state: present
+      check_mode: true
+      loop:
+        - git
+      register: git_installed
+
+    - name: Include role only if missing
+      ansible.builtin.include_role:
+        name: git
+      when: not git_installed
+
+    - name: Pull repo
+      tags:
+        - git_pull
+      ansible.builtin.git:
+        repo: "https://{{ mysecrets['git_user'] | urlencode }}:{{ mysecrets['git_password_mqtt'] | urlencode }}@gitlab.sectorq.eu/jaydee/proxmox.git"
+        dest: "{{ dest_folder }}"
+        update: true
+        clone: true
+        version: main
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Print
+      ansible.builtin.debug:
+        msg: "{{ inventory_hostname }}"
+    - name: Create a directory if it does not exist
+      ansible.builtin.file:
+        path: /myapps/proxmox
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'
+
+    - name: Upload script
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/proxmox.py"
+        dest: /myapps/proxmox/proxmox.py
+        remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Upload exclude file
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/exclude.txt"
+        dest: /myapps/exclude.txt
+        remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Upload requirements
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/requirements.txt"
+        dest: /myapps/requirements.txt
+        remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Upload docker_backups.py
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/docker_backups.py"
+        dest: /myapps/docker_backups.py
+        remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname == 'm-server.home.lan'
+    - name: Install venv
+      ansible.builtin.apt:
+        name:
+          - python3-virtualenv
+          - rsync
+
+    - name: Install specified python requirements in indicated (virtualenv)
+      ansible.builtin.pip:
+        requirements: /myapps/requirements.txt
+        virtualenv: /myapps/venv
+
+    - name: 'Ensure an old job is no longer present. Removes any job that is prefixed by "#Ansible: an old job" from the crontab'
+      ansible.builtin.cron:
+        name: "omv_backup"
+        state: absent
+    - name: Upload service config
+      ansible.builtin.copy:
+        src: omv_backup.service
+        dest: /etc/systemd/system/omv_backup.service
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname == 'amd.home.lan'
+    - name: Restart omv service
+      ansible.builtin.service:
+        name: omv_backup
+        state: restarted
+        daemon_reload: true
+        enabled: true
+      when: inventory_hostname == 'amd.home.lan'
+    # - name: Ensure a job that runs at 2 and 5 exists. Creates an entry like "0 5,2 * * ls -alh > /dev/null"
+    #   ansible.builtin.cron:
+    #     name: "omv_backup"
+    #     minute: "0"
+    #     hour: "8"
+    #     job: "sudo /myapps/omv_backup.py -b > /dev/null  2>&1 &"
+    #     state: present

roles/proxmox/vars/main.yml

@@ -0,0 +1 @@
+dest_folder: "/tmp/ans_repo"

roles/setup/tasks/main.yml

@@ -1,5 +1,5 @@
 - name: Setup
-  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
+  become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
   block:
     - name: Gather facts
       ansible.builtin.setup:

roles/ssh_config/files/config

@@ -17,7 +17,9 @@ Host nas
 Host router
   HostName router.home.lan
   User root
-
+Host external
+  HostName 193.168.144.164
+  User root
 Host *
     User jd
     IdentityFile ~/.ssh/id_rsa

roles/ssh_keys/files/id_rsa

@@ -0,0 +1,38 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAYEAoz4u+IAB09hgWyllpplK8864SkDd5p89w01p9NioW4FrOjES5U65
+9ny6geIZKFRDmrdvcADidsbmOGhIxnzup5f95Gt6KrJcMVvRqhQkV1R5xd2/lpcvo5J97W
+4bfoIxSuMdJ6dVmW6UyP50e4BJVmu++Cwh8uYuH5uSEqAh80TLCnd3VReGDrXukAvVLuLk
+EI6WVpLGEYwDbVwJORAxDhEc/g4fEQ5F2xmFtr8dYoTUBoed893Olum2oxqt6sf/hvdOTL
+UYLrWx1jjmEhPKNqt72g5AjQOhY3dz+oB0z3EYxRH6B3PFcadL40fXuqJfF+w/hhC+oOkD
+eueu+9maN/0JGtKyf8zJ094GdkuItAs5qg6HnG8wwl+8sMLsIL5ZiRjrMIMMDij/xNP0Z1
+outwVBVf31PaOZ6/WV4JIkWvWQs7mx2YccjemexIXDlZzG731dVuRZ/724/OGLnQi5s65O
+ar6UPqlbDF4tRjyBMhcMoPwH7uSU6TROfuFYhc0zAAAFiO2G2RLthtkSAAAAB3NzaC1yc2
+EAAAGBAKM+LviAAdPYYFspZaaZSvPOuEpA3eafPcNNafTYqFuBazoxEuVOufZ8uoHiGShU
+Q5q3b3AA4nbG5jhoSMZ87qeX/eRreiqyXDFb0aoUJFdUecXdv5aXL6OSfe1uG36CMUrjHS
+enVZlulMj+dHuASVZrvvgsIfLmLh+bkhKgIfNEywp3d1UXhg617pAL1S7i5BCOllaSxhGM
+A21cCTkQMQ4RHP4OHxEORdsZhba/HWKE1AaHnfPdzpbptqMarerH/4b3Tky1GC61sdY45h
+ITyjare9oOQI0DoWN3c/qAdM9xGMUR+gdzxXGnS+NH17qiXxfsP4YQvqDpA3rnrvvZmjf9
+CRrSsn/MydPeBnZLiLQLOaoOh5xvMMJfvLDC7CC+WYkY6zCDDA4o/8TT9GdaLrcFQVX99T
+2jmev1leCSJFr1kLO5sdmHHI3pnsSFw5Wcxu99XVbkWf+9uPzhi50IubOuTmq+lD6pWwxe
+LUY8gTIXDKD8B+7klOk0Tn7hWIXNMwAAAAMBAAEAAAGABj1wcTT/cjghXXVkeoJTQE+aHC
+iE8vW1AtwDiAWnezFOxn+CupDlqzuTAOJXgNhRFJRyJjoPw2eQpv5W2H4vvJNNnrzRri55
+jLTMURqKVcDtE2MJxE63gPgEEp6KCYNzhpUjk6pMq4aebwfJrxY1IiBl6+RP+zzQ7YoLrY
++Wd09IDaM0b2Rso5pRFLYxv3mSgI7axf4VToK8zMzfA2HlkM/sUkp65d2Bo8GYKrynzxDH
+GWV3ZGTe//DOIkejofJkIpm8l3xHAhkOQuEu6HubbLNCrIbwtTeGQuVQW6EqdGIF55/wHu
+vrwrjkaGT4rdsCD4Ue3aCDfc5PFgRkDSmGUwcQmSRiA3vDliYe33m61SXqngbE763EIv12
+vQBzU+vRR/IjQQAfX7bEJNnZ//TbiiA0vQzXnjrxNtwJVgPAQduqJI7F9D6r6TvpLeB7TS
+NjJErQivVj3Uwvjz2xHum9+Z9hOtA0hwuvqsRqvxarlIGpV12tDK/Qe2r/sUMHvEbBAAAA
+wQCTkbTjZ+KyOGp54SlzFWXrxYZcswzr7UKms+WlmT8NFtqpwnLg6/KzyLURWVns3k2eTz
+ZRC3lJhGVZyTyuVR9ek0wbI+f/JmnTsAPaas76KHcXszpxftwf6blZc1wZUEJLmRDTy5K2
+tEDoll4lki2L2Wyv6KPWyG6Gai34YigW95vS7veaslLVIy/nNRkwBEBpwRtOV/YCy1SC3U
+PRMaMUyHNzcdwbeT1uymU/UeGc+h8pTGriG/5EhbvCHhLqVV8AAADBAOMRDYvh6wT4f31K
+JitrfTruY+Bdg9O9aqyQXzEkCtzJWoHTLQY/brMo0mvUxR9wSxKBwR+Nu9EXqkBpA3g1Hv
+UgXv3NWrpAiAVVs6NHay0aDa1uIY/Ol8k6DbLL5R0k7tQc2nD44Ey9zme88/0sdHA2VIQ2
+z/tlcPSQ8VKKhDmRY7BTE5YgeE6615nqvCq8e6CRSjFa0HKbfdFsmSnOHgil6Oc2MKT2pL
+i/dKSxeAr2BP++xF9xYe0bVMdy4mEF8wAAAMEAuAsxC2bs0FnzoInge3W1ra55+qZF3LFp
+efTVb26yciNYYeJLeks+nOjOQQd+kcISILdIhYnUGIumWQR/CiY2KL89AXLoTB6EIt5DGC
+udKAjIzSeHtXTliZ1okgjGSmJeE6dhr0UwdLYyaFkdscbF17iTndLc74yCrKIoUnHfxBEc
+/34AT8UdwkrJXj7e2nJyV9WGYz/Ga2xd3s56hVSTUckjxQaBnkZWFilw7ZAlHhPhSglTmd
+pkgWv+Gd4evavBAAAAC2pkQG1vcmVmaW5lAQIDBAUGBw==
+-----END OPENSSH PRIVATE KEY-----

roles/ssh_keys/files/id_rsa.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCjPi74gAHT2GBbKWWmmUrzzrhKQN3mnz3DTWn02KhbgWs6MRLlTrn2fLqB4hkoVEOat29wAOJ2xuY4aEjGfO6nl/3ka3oqslwxW9GqFCRXVHnF3b+Wly+jkn3tbht+gjFK4x0np1WZbpTI/nR7gElWa774LCHy5i4fm5ISoCHzRMsKd3dVF4YOte6QC9Uu4uQQjpZWksYRjANtXAk5EDEOERz+Dh8RDkXbGYW2vx1ihNQGh53z3c6W6bajGq3qx/+G905MtRgutbHWOOYSE8o2q3vaDkCNA6Fjd3P6gHTPcRjFEfoHc8Vxp0vjR9e6ol8X7D+GEL6g6QN656772Zo3/Qka0rJ/zMnT3gZ2S4i0CzmqDoecbzDCX7ywwuwgvlmJGOswgwwOKP/E0/RnWi63BUFV/fU9o5nr9ZXgkiRa9ZCzubHZhxyN6Z7EhcOVnMbvfV1W5Fn/vbj84YudCLmzrk5qvpQ+qVsMXi1GPIEyFwyg/Afu5JTpNE5+4ViFzTM= jd@morefine

roles/ssh_keys/tasks/main.yml

@@ -1,6 +1,13 @@
 - name: SSH keys deploy
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
   block:
+    - name: Create dir
+      ansible.builtin.file:
+        path: /home/jd/.ssh
+        owner: jd
+        group: jd
+        mode: '0700'
+        state: directory
     - name: Upload key
       ansible.builtin.copy:
         src: id_rsa
@@ -11,7 +18,7 @@
       when: inventory_hostname != 'nas.home.lan'
     - name: Upload key
       ansible.builtin.copy:
-        src: id_rsa
+        src: id_rsa.pub
         dest: /home/jd/.ssh/id_rsa.pub
         mode: '0600'
         owner: jd

roles/wake_on_lan/tasks/main.yml

@@ -1,3 +1,10 @@
+- name: Install zabbix agent
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Include facts
+      ansible.builtin.include_role:
+        name: "setup"
+      when: ansible_facts.architecture is not defined
     - name: Install ethtool
       ansible.builtin.apt:
         name: ethtool
@@ -10,7 +17,7 @@
       ansible.builtin.set_fact:
         active_adapter: '{{ item }}'
       loop: '{{ ansible_facts.interfaces }}'
-  when: '(item.startswith("eno") or item.startswith("enp")) and not item.endswith("avahi")'
+      when: '(item.startswith("eno") or item.startswith("enp") or item.startswith("nic")) and not item.endswith("avahi")'
 
 
     - name: Creating config

roles/zabbix-agent/tasks/main.yml

@@ -1,6 +1,11 @@
 - name: Install zabbix agent
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
   block:
+    - name: Include facts
+      ansible.builtin.include_role:
+        name: "setup"
+      when: ansible_facts.architecture is not defined
+
     - name: Get config for not nas
       ansible.builtin.set_fact:
         zabbix_agent_cfg: "/etc/zabbix/zabbix_agent2.conf"
@@ -62,6 +67,17 @@
         - ansible_distribution_major_version  == "12"
       register: command_result
       failed_when: "'FAILED' in command_result.stderr"
+    - name: Install a .deb package from the Debian 13
+      ansible.builtin.apt:
+        # deb: https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian12_all.deb
+        deb: https://repo.zabbix.com/zabbix/7.4/release/debian/pool/main/z/zabbix-release/zabbix-release_latest_7.4+debian13_all.deb
+      when:
+        - ansible_facts.architecture != "armv7l"
+        - ansible_facts.architecture != "aarch64"
+        - ansible_distribution == "Debian"
+        - ansible_distribution_major_version  == "13"
+      register: command_result
+      failed_when: "'FAILED' in command_result.stderr"
     # - name: Install a .deb package localy
     #   ansible.builtin.apt:
     #     deb: /tmp/zabbix-release_6.4-1+ubuntu22.04_all.deb
@@ -83,7 +99,7 @@
           - zabbix-agent2-plugin-postgresql
           # - zabbix-agent2-plugin-mysql
         only_upgrade: true
-        state: latest
+        state: present
       when: inventory_hostname != 'nas.home.lan'
 
     - name: Reconfigure zabbix agent Server
@@ -173,9 +189,40 @@
         regexp: "^HostMetadata=.*"
         insertafter: '^# HostMetadata='
         line: "HostMetadata=server;jaydee"
-      when: inventory_hostname == 'nas.home.lan' or inventory_hostname == 'm-server.home.lan'
+      when: inventory_hostname == 'm-server.home.lan'
 
-    - name: Add the user 'to group video
+    - name: Create docker-swarm plugin directory
+      ansible.builtin.file:
+        path: /usr/lib/zabbix/plugins/docker-swarm/
+        state: directory
+        mode: '0755'
+        owner: zabbix
+        group: zabbix
+
+    - name: Copy docker-swarm plugin
+      ansible.builtin.copy:
+        src: docker-swarm-linux-amd64
+        dest: /usr/lib/zabbix/plugins/docker-swarm/docker-swarm-linux-x86_64
+        mode: '0755'
+        owner: zabbix
+        group: zabbix
+      when: inventory_hostname == 'm-server.home.lan'
+
+    - name: Reconfigure zabbix-agent2 hostname
+      ansible.builtin.lineinfile:
+        path: "{{ zabbix_agent_cfg }}"
+        regexp: "^Plugins.DockerSwarm.System.Path=.*"
+        insertafter: '^# HostMetadata='
+        line: "Plugins.DockerSwarm.System.Path=/usr/lib/zabbix/plugins/docker-swarm/docker-swarm-linux-x86_64"
+      when: inventory_hostname == 'm-server.home.lan'
+    - name: Reconfigure zabbix-agent2 hostname
+      ansible.builtin.lineinfile:
+        path: "{{ zabbix_agent_cfg }}"
+        regexp: "^Plugins.DockerSwarm.System.Timeout=.*"
+        line: "Plugins.DockerSwarm.System.Timeout=30"
+      when: inventory_hostname == 'm-server.home.lan'
+
+    - name: Add the user 'zabbix' to group video
       ansible.builtin.user:
         name: zabbix
         groups: video

test.yml

@@ -1,4 +0,0 @@
----
-- hosts: datacenter
-  roles:
-    - wazuh-agent