build

all.yml

@@ -2,6 +2,9 @@
   name: Roles
   gather_facts: false
   roles:
+    - name: init
+      role: init
+      tags: init
     - name: setup
       role: setup
       tags: setup
@@ -80,3 +83,6 @@
     - name: cert_gen
       role: cert_gen
       tags: cert_gen
+    - name: letsgo
+      role: letsgo
+      tags: letsgo

hosts_init.yml

@@ -15,11 +15,23 @@ datacenter:
         ansible_python_interpreter: /usr/bin/python3
         ansible_ssh_user: jd
         # ansible_ssh_password: l4c1j4yd33Du5lo
-        ansible_become_password: l4c1j4yd33Du5lo
+        ansible_become_password: l4c1j4yd33Du5lo-
         identity_file: ssh_key.pem
-        ansible_ssh_pass: l4c1j4yd33Du5lo
+        ansible_ssh_pass: l4c1j4yd33Du5lo-
         ansible_become_user: root
-        amd.home.lan:
+
+    external:
+      hosts:
+        sectorq.cloud:
+      vars:
+        ansible_python_interpreter: /usr/bin/python3
+        ansible_ssh_user: root
+        # ansible_ssh_password: l4c1j4yd33Du5lo
+        ansible_become_password: l4c1j4yd33Du5lo-
+        identity_file: ssh_key.pem
+        ansible_ssh_pass: l4c1j4yd33Du5lo-
+        ansible_become_user: root
+     
     nas:
       hosts:
         nas.home.lan:
@@ -31,3 +43,15 @@ datacenter:
         # ansible_user: admin
         # ansible_pass: l4c1!j4yd33?Du5lo1
         ansible_python_interpreter: /share/ZFS530_DATA/.qpkg/QPython312/bin/python3
+    vms:
+      hosts:
+        vm01.home.lan:
+        vm02.home.lan:
+      vars:
+        ansible_python_interpreter: /usr/bin/python3
+        ansible_ssh_user: jd
+        ansible_ssh_password: q
+        become_method: su
+        ansible_become_password: q
+        ansible_ssh_pass: q
+        ansible_become_user: root

hosts_roles.yml

@@ -183,3 +183,12 @@ datacenter:
             ansible_ssh_user: jd
             ansible_become_password: q
             ansible_ssh_private_key_file: ssh_key.pem
+    vms:
+      hosts:
+        vm01.home.lan:
+        vm02.home.lan:
+      vars:
+        ansible_python_interpreter: /usr/bin/python3
+        ansible_ssh_user: jd
+        ansible_become_password: l4c1j4yd33Du5lo
+        ansible_ssh_private_key_file: ssh_key.pem

jaydee.yml

@@ -1,17 +1,18 @@
 $ANSIBLE_VAULT;1.1;AES256
-34653034626436373537323430316462643663336164613763306336333038346562356565393036
+63356366383732396163376631336164373666646234646335323762626333316435356133393661
-3964393861323439333839383061303864326235306665620a346233313633393135366362326464
+6630376666323636633065653466343361643763376364310a303334343035626565303133396439
-63643039363635646131323365313833643864373637346536663831613837353833343030623366
+35636130336265373230613766373831333863353339643631333262373439323561653737663265
-3038303063393565350a613439646161363330626566646264313939653339383439623532636638
+3733626334306165660a333631383966666238376135653065646134376335326635363136613734
-38646433353765396136333236656535636235313639393565306636376438346362646438613835
+36643733333835303563653035363530653333626437316436396163333635313033363039306533
-62663031333832666262616365343831353530646263383932373666386631633430626363363966
+66333538656564313062366437393666643161306139313936356134623133333931353733663834
-61396336303365306135363039303032646137613330646434366638633738363064356132383439
+35653234383466383530356235303564383062626663343563663964323638323538336435363864
-36346432306531356333313963353463626232613563653331396334656539643531343136636635
+35383839386230646636616633336639663038633237373530616233326436383666313338373761
-31613762383664353930653165313461626133336161353639303662666234356138373539376161
+39653338663737666132393638343066346431326533653538353533313733363063356535326231
-30653837316266356136353132373663396365633434393166383230363263326139316362383766
+65306464386332616561313664313066666231666366346434633633363934376137626662363939
-64303738393663343636616437346535346566346536616663333866613966343563306265633064
+31383637333263383435633631393162653137336262313335303539666366623134333430643165
-66333331393861626637616330333463636135316466616532373663663464613034656337363437
+62306364613436663932376530366534323038646639313630643637613531656239663434646437
-62653333653838326632643238616638313935383532303233643132303637653963626363633662
+35303139373230646164353265313964326264616465623261633732643637306462653930353330
-33646161373931386133353338643462306635393866656662376234396533376431366134653536
+63313363643832616433353565306462383962363331383431373630306566613931313564363439
-36363835346434323338363465336166303161633732333232653861646136326334616261653462
+34383037366230363862313433633164303932343738393964353065613130376535326266326563
-66376139313433383665
+62666664323731396639333931316635653464386166343464373664393334623430333037623764
+36383964623530373132323731396132306234343934653337326132653232333566

roles/cert_gen/files/certs.sh

@@ -3,7 +3,7 @@ mkdir /tmp/certgen 2>/dev/null
 cd /tmp/certgen
 
 openssl genrsa -aes256 -out ca-key.pem -passout pass:"foobarpwd" 4096
-openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem -subj "/C=SK/ST=Slovakia/L=SK/O=sectorq.eu/OU=IT/CN=sectorq.eu" -passin pass:"foobarpwd"
+openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem -subj "/C=SK/ST=Slovakia/L=SK/O=sectorq.cloud/OU=IT/CN=sectorq.cloud" -passin pass:"foobarpwd"
 openssl genrsa -out server-key.pem 4096
 if [[ `hostname` == "nas" ]]
 then

roles/cert_gen/tasks/main.yml

@@ -1,6 +1,9 @@
 - name: Cert gen
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
   block:
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: jaydee.yml
     - name: Create a directory for certs
       ansible.builtin.file:
         path: /tmp/certgen
@@ -54,34 +57,50 @@
         mode: '0777'
         owner: jd
         group: root
+      when: inventory_hostname != 'sectorq.cloud'
 
     - name: Copy generated certs to files
       ansible.builtin.copy:
-        src: /tmp/certgen/ca.pem
+        src: /tmp/certgen/{{ cert1 }}
         dest: /media/nas/data/certs/docker/{{ inventory_hostname }}
         remote_src: true
         mode: '0644'
         owner: jd
         group: root
+      when: inventory_hostname != 'sectorq.cloud'
+      loop_control:
+        loop_var: cert1
+      loop:
+        - ca.pem
+        - cert.pem
+        - key.pem
 
-    - name: Copy generated certs to files
+    - name: Install sshpass
-      ansible.builtin.copy:
+      ansible.builtin.apt:
-        src: /tmp/certgen/key.pem
+        name: sshpass
-        dest: /media/nas/data/certs/docker/{{ inventory_hostname }}
+        state: present
-        remote_src: true
+      when: inventory_hostname != 'nas.home.lan'
-        mode: '0644'
+    - name: Create cert directory on nas server
-        owner: jd
+      ansible.builtin.command: |
-        group: root
+        sshpass -p {{ nas_password }} \
-    - name: Copy generated certs to files
+        ssh  -p2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null admin@sectorq.eu "mkdir -p /share/Data/certs/docker/{{ inventory_hostname }}"
-      ansible.builtin.copy:
+      register: certgen
-        src: /tmp/certgen/cert.pem
+      changed_when: "certgen.rc == 0"
-        dest: /media/nas/data/certs/docker/{{ inventory_hostname }}
+      ignore_errors: true
-        remote_src: true
+      when: inventory_hostname != 'nas.home.lan'
-        mode: '0644'
+    - name: Generate certs
-        owner: jd
+      ansible.builtin.command: |
-        group: root
+        sshpass -p {{ nas_password }} \
-    - name: Restart docker service
+        scp -P2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null {{ cert2 }} admin@sectorq.eu:/share/Data/certs/docker/{{ inventory_hostname }}/
-      ansible.builtin.systemd:
+      register: certgen
-        name: docker
+      changed_when: "certgen.rc == 0"
-        state: restarted
+      args:
-  
+        chdir: /tmp/certgen
+      loop_control:
+        loop_var: cert2
+      loop:
+        - ca.pem
+        - cert.pem
+        - key.pem
+        - server-cert.pem
+        - server-key.pem

roles/docker/tasks/main.yml

@@ -44,13 +44,13 @@
 
 
     - name: Ensure docker keyring directory exists
-      file:
+      ansible.builtin.file:
         path: /etc/apt/keyrings
         state: directory
         mode: "0755"
 
     - name: Download Docker GPG key
-      get_url:
+      ansible.builtin.get_url:
         url: https://download.docker.com/linux/debian/gpg
         dest: /etc/apt/keyrings/docker.asc
         mode: "0644"
@@ -58,7 +58,7 @@
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
 
     - name: Install docker.sources file
-      template:
+      ansible.builtin.template:
         src: docker.sources.j2
         dest: /etc/apt/sources.list.d/docker.sources
         owner: root
@@ -68,7 +68,7 @@
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
 
     - name: Create docker.sources file
-      copy:
+      ansible.builtin.copy:
         dest: /etc/apt/sources.list.d/docker.sources
         mode: "0644"
         content: |
@@ -82,27 +82,20 @@
 
 
     - name: Update apt cache
-      apt:
+      ansible.builtin.apt:
-        update_cache: yes
+        update_cache: true
 
       when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
 
     - name: Download Docker GPG key
-      get_url:
+      ansible.builtin.get_url:
         url: https://download.docker.com/linux/debian/gpg
         dest: /etc/apt/keyrings/docker.asc
         mode: "0644"
       when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
 
-
-
-
-
-
-
-
     - name: Add an Apt signing key to a specific keyring file
       ansible.builtin.apt_key:
         url: https://download.docker.com/linux/ubuntu/gpg
@@ -135,137 +128,72 @@
       ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
       when:
         - ansible_distribution == "Ubuntu"
+    - name: Pin docker version
+      ansible.builtin.copy:
+        dest: /etc/apt/preferences.d/docker.pref
+        mode: "0644"
+        content: |
+          Package: docker-ce
+          Pin: version 5:28.5.2-1~debian.13~trixie
+          Pin-Priority: 1001
+
+          Package: docker-ce-cli
+          Pin: version 5:28.5.2-1~debian.13~trixie
+          Pin-Priority: 1001
+      when:
+        - ansible_distribution == "Debian"
+        - ansible_distribution_major_version == "13"
 
-    # - name: Install docker
-    #   ansible.builtin.apt:
-    #     name:
-    #       - docker-ce
-    #       - docker-ce-cli
-    #       - containerd.io
-    #       - docker-buildx-plugin
-    #       - docker-compose-plugin
-    #     update_cache: true
     - name: Install the version docker1
       ansible.builtin.apt:
-        name: "{{ item }}"
+        name: "{{ docker_package }}"
         state: present
       when:
         - ansible_distribution == "Debian"
+      loop_control:
+        loop_var: docker_package
       loop:
         - docker-ce
         - docker-ce-cli
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian"
-      loop:
         - containerd.io
-
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian"
-      loop:
-        - docker-buildx-plugin
-        
-
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}=5:28.5.2-1~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian1"
-      loop:
-        - docker-ce
-        - docker-ce-cli
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}=1.7.28-2~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian1"
-      loop:
-        - containerd.io
-
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}=0.28.0-0~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian1"
-      loop:
         - docker-buildx-plugin
+        - docker-compose-plugin
 
     - name: Create a directory docker.service.d
       ansible.builtin.file:
         path: /etc/systemd/system/docker.service.d/
         state: directory
         mode: '0755'
-    - name: Create a directory for certs
-      ansible.builtin.file:
-        path: /etc/docker/certs
-        state: directory
-        mode: '0700'
-        owner: root
-        group: root
 
-    # - name: Copy files
-    #   ansible.builtin.copy:
-    #     src: server-key.pem
-    #     dest: /etc/docker/certs/
-    #     mode: '0600'
-    #     owner: root
-    #     group: root
-    # - name: Copy files
-    #   ansible.builtin.copy:
-    #     src: ca.pem
-    #     dest: /etc/docker/certs/
-    #     mode: '0600'
-    #     owner: root
-    #     group: root
-    # - name: Copy files
-    #   ansible.builtin.copy:
-    #     src: server-cert.pem
-    #     dest: /etc/docker/certs/
-    #     mode: '0600'
-    #     owner: root
-    #     group: root
     - name: Creating a file with content
       ansible.builtin.copy:
         dest: "/etc/systemd/system/docker.service.d/override.conf"
         content: |
           [Service]
           ExecStart=
-          ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
+          ExecStart=/usr/bin/dockerd -H fd:// \
+          --containerd=/run/containerd/containerd.sock \
+          --tlsverify --tlscacert=/etc/docker/certs/ca.pem \
+          --tlscert=/etc/docker/certs/server-cert.pem \
+          --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
         mode: '0600'
         owner: root
         group: root
       notify: restart_docker
       when: mode == "cert"
 
-    # - name: Creating a file with content
+    - name: Creating a file with content
-    #   ansible.builtin.copy:
+      ansible.builtin.copy:
-    #     dest: "/etc/systemd/system/docker.service.d/override.conf"
+        dest: "/etc/systemd/system/docker.service.d/override.conf"
-    #     content: |
+        content: |
-    #       [Service]
+          [Service]
-    #       ExecStart=
+          ExecStart=
-    #       ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify \
+          ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock  -H=0.0.0.0:2376
-    #       --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem \
+        mode: '0600'
-    #       --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
+        owner: root
-    #     mode: '0600'
+        group: root
-    #     owner: root
+      notify: restart_docker
-    #     group: root
+      when: mode != "cert"
-    #   notify: restart_docker
-    #   when: mode != "nocert"
 
     - name: Just force systemd to reread configs
       ansible.builtin.systemd:
@@ -276,10 +204,12 @@
         name: docker
         state: restarted
 
-    # - name: Get keys for raspotify
+    - name: Install Loki plugin with TLS
-    #   ansible.builtin.shell: docker plugin install grafana/loki-docker-driver:3.3.2-{{ ansible_architecture }} --alias loki --grant-all-permissions
-    - name: Install a plugin
       community.docker.docker_plugin:
-        plugin_name: grafana/loki-docker-driver:3.3.2
+        plugin_name: grafana/loki-docker-driver
         alias: loki
         state: present
+      environment:
+        DOCKER_HOST: "tcp://{{ inventory_hostname }}:2376"
+        DOCKER_TLS_VERIFY: "1"
+        DOCKER_CERT_PATH: "/tmp/certgen"

roles/setup/tasks/main.yml

@@ -1,5 +1,5 @@
 - name: Setup
-  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
+  become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
   block:
     - name: Gather facts
       ansible.builtin.setup: