aaa

2025-07-01 23:48:32 +02:00 · 2025-03-18 18:20:37 +01:00 · 2025-03-18 18:04:58 +01:00 · 2025-03-18 17:56:00 +01:00 · 2025-03-18 17:24:20 +01:00
13 changed files with 414 additions and 91 deletions
--- a/hosts_roles.yml
+++ b/hosts_roles.yml
@ -110,6 +110,35 @@ datacenter:

    containers:
      children:
+        docker_servers:
+          children:
+            router:
+              hosts:
+                router.home.lan:
+              vars:
+                ansible_python_interpreter: /usr/bin/python3
+                ansible_ssh_user: root
+                ansible_ssh_private_key_file: ssh_key.pem
+            srv:
+              hosts:
+                rpi5.home.lan:
+                m-server.home.lan:
+              vars:
+                ansible_python_interpreter: /usr/bin/python3
+                ansible_ssh_user: jd
+                ansible_become_password: l4c1j4yd33Du5lo
+                ansible_ssh_private_key_file: ssh_key.pem
+            ns:
+              hosts:
+                nas.home.lan:
+              vars:
+                ansible_ssh_user: admin
+                become_method: su
+                become_user: admin
+                ansible_ssh_private_key_file: ssh_key.pem
+                # ansible_user: admin
+                # ansible_pass: l4c1!j4yd33?Du5lo1
+                ansible_python_interpreter: /share/ZFS530_DATA/.qpkg/QPython312/bin/python3
        servers:
          hosts:
            rpi5-1.home.lan:
--- a/playbooks/00_sync_rpi5.yml
+++ b/playbooks/00_sync_rpi5.yml
@ -2,7 +2,7 @@
  name: Sync rpi5
  become: true
  tasks:
-    - name: Apt exclude linux-dtb-current-meson64
+    - name: Get running packages
      ansible.builtin.shell: "docker ps|awk '{print $NF}'"
      register: containers
    - debug:
@ -13,4 +13,4 @@
      when: item != "NAMES" and item != "watchtower-watchtower-1"
      with_items: "{{ containers.stdout_lines }}"
    - name: Sync data
-      ansible.builtin.shell: "/myapps/venv/bin/python3 /myapps/omv_backup.py -r all"
+      ansible.builtin.shell: "/myapps/venv/bin/python3 /myapps/omv_backup.py -r all"
--- a/playbooks/switch_destination.yaml
+++ b/playbooks/switch_destination.yaml
@ -1,90 +1,173 @@
- hosts: containers
-  name: Switch mailu to second
-  
+- hosts: docker_servers
+  name: Switch server
  ignore_unreachable: false
-  vars:
-      arch_name: docker_mailu2_data
-      containers: 
-        - nginx-app-1
-        - heimdall
-        - mailu2-admin-1
-        - mailu2-antispam-1
-        - mailu2-antivirus-1
-        - mailu2-fetchmail-1
-        - mailu2-front-1
-        - mailu2-imap-1
-        - mailu2-oletools-1
-        - mailu2-redis-1
-        - mailu2-resolver-1
-        - mailu2-smtp-1
-        - mailu2-webdav-1
-        - mailu2-webmail-1
-        - HomeAssistant
-        - mosquitto-mosquitto-1
-        - gitlab
-        - watchtower-watchtower-1
-        - kestra-kestra-1
-        - kestra-postgres-1
-        - authentik-worker-1
-        - authentik-server-1
-        - authentik-redis-1
-        - authentik-postgresql-1
+
  tasks:
-    - name: Start mailu containers
-      command: "docker start {{ containers | join(' ') }}"
-      become: true
+    - name: Reconfigure swap size
+      ansible.builtin.lineinfile:
+        path: /etc/sysctl.conf
+        regexp: "^net.ipv4.igmp_max_memberships =.*"
+        line: "net.ipv4.igmp_max_memberships = 1024"
+        create: true
+      become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+      when: inventory_hostname != "router.home.lan" 
+
+    - name: Start containers
+      shell: docker start `docker ps -a |awk '{ print $NF }'|grep -v NAME |xargs`
+      become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
      ignore_errors: true
-      when: inventory_hostname in groups['raspberrypi5']
-
-    - name: Get ruleset
-      command: nvram get vts_rulelist
-      when: inventory_hostname in groups['router']
-      register: ruleset
-
-    - name: Print the gateway for each host when defined
-      ansible.builtin.debug:
-        msg: "var is {{ ruleset.stdout }}"
-      when: inventory_hostname in groups['router']
+      when: inventory_hostname == destination and inventory_hostname != "nas.home.lan" 
+    - name: Start containers
+      shell: docker exec -it gitlab update-permissions
+      become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+      ignore_errors: true
+      when: inventory_hostname == destination and inventory_hostname != "nas.home.lan and inventory_hostname != "rpi5.home.lan" 


-    - name: Print the gateway for each host when defined
-      ansible.builtin.debug:
-        msg: "var is {{ destination }}"
-      when: inventory_hostname in groups['router']
+    - name: Start containers
+      shell: /share/ZFS530_DATA/.qpkg/container-station/bin/docker exec -it gitlab update-permissions
+      become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+      ignore_errors: true
+      when: inventory_hostname == destination and inventory_hostname == "nas.home.lan" 

-    - name: initialize variables
-      set_fact:                
-        regexp: "\\g<1>{{ destination }}\\3"
-      when: inventory_hostname in groups['router']
+      
+    - name: Start containers
+      shell: /share/ZFS530_DATA/.qpkg/container-station/bin/docker start `/share/ZFS530_DATA/.qpkg/container-station/bin/docker ps -a |awk '{ print $NF }'|grep -v NAME |xargs`
+      become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+      ignore_errors: true
+      when: inventory_hostname == destination and inventory_hostname == "nas.home.lan" 

-    - set_fact:
-        app_path: "{{ ruleset.stdout | regex_replace('(\\<MAIL_SERVER\\>[0-9,]{1,}\\>)([0-9.]{1,})(\\>[0-9a-zA-Z\\s-]{0,}\\>TCP\\>)', regexp) | regex_replace('(\\<WEB_SERVER\\>[0-9,]{1,}\\>)([0-9.]{1,})(\\>[0-9a-zA-Z\\s-]{0,}\\>TCP\\>)', regexp) }}"
-      when: inventory_hostname in groups['router']
+    - name: Get Authentification token
+      ansible.builtin.uri:
+        url: http://localhost:9380/api/auth
+        method: POST
+        body_format: json
+        body: {"password":"l4c1j4yd33Du5lo"}
+      register: login
+      when: inventory_hostname != "router.home.lan"
+    # - debug:
+    #     msg: "{{ login.json.session }}"
+
+    - name: Get Config 
+      ansible.builtin.uri:
+        url: http://localhost:9380/api/config
+        method: GET
+        headers:
+          X-FTL-SID: "{{ login.json.session.sid  }}"
+      register: old_config
+      when: inventory_hostname != "router.home.lan"
+
+    # - debug:
+    #     msg: "{{ old_config.json.config.dns.cnameRecords  }}"
+
+    - name: Parse config
+      ansible.builtin.set_fact:
+        jsondata: "{{ old_config }}"   
+
+    - name: New records for nas
+      ansible.builtin.set_fact:
+        new_data: ["mqtt.home.lan,nas.home.lan","media.home.lan,nas.home.lan","ldap.home.lan,nas.home.lan","webhub.home.lan,nas.home.lan","semaphore.home.lan,nas.home.lan","active.home.lan,nas.home.lan"]
+      when: destination  == 'nas.home.lan'
+
+    - name: New records for m-server
+      ansible.builtin.set_fact:
+        new_data: ["mqtt.home.lan,m-server.home.lan","media.home.lan,m-server.home.lan","ldap.home.lan,m-server.home.lan","webhub.home.lan,m-server.home.lan","semaphore.home.lan,m-server.home.lan","active.home.lan,m-server.home.lan"]
+      when: destination  == 'm-server.home.lan'
+
+    - name: New records for rpi5
+      ansible.builtin.set_fact:
+        new_data: ["mqtt.home.lan,rpi5.home.lan","media.home.lan,rpi5.home.lan","ldap.home.lan,rpi5.home.lan","webhub.home.lan,rpi5.home.lan","semaphore.home.lan,rpi5.home.lan","active.home.lan,rpi5.home.lan"]
+      when: destination  == 'rpi5.home.lan'


-    - name: Print the gateway for each host when defined
-      ansible.builtin.debug:
-        msg: "var is {{ app_path }}"
-      when: inventory_hostname in groups['router']
+    # - debug:
+    #     msg: "{{ new_data }}"
+      
+    - name: Set new values
+      ansible.utils.update_fact:
+        updates:
+          - path: jsondata.json.config.dns.cnameRecords 
+            value:  "{{ new_data }}"
+      register: new_config            
+      when: inventory_hostname != "router.home.lan"

-
-    - name: Pause for 60 seconds
-      ansible.builtin.pause:
-        seconds: 60
-        
-    - name: Set new ruleset
-      command: nvram set vts_rulelist="{{ app_path }}"
-      when: inventory_hostname in groups['router']
-
-    - name: Nvram commit
-      command: nvram commit
-      when: inventory_hostname in groups['router']
-
-    - name: Restart firewall
-      command: service restart_firewall
-      when: inventory_hostname in groups['router']
+    - name: Patch config
+      ansible.builtin.uri:
+        url: http://localhost:9380/api/config
+        method: PATCH
+        body: "{{ new_config.jsondata.json |to_json}}" 
+        headers:
+          X-FTL-SID: "{{ login.json.session.sid  }}"
+          Content-Type: application/json
+      register: _result
+      until: _result.status == 200
+      retries: 3 # 720 * 5 seconds = 1hour (60*60/5)
+      delay: 5 # Every 5 seconds
+      register: _result
+      until: _result.status == 200
+      retries: 3 # 720 * 5 seconds = 1hour (60*60/5)
+      delay: 5 # Every 5 seconds
+      when: inventory_hostname != "router.home.lan"



+    - name: Sleep for 30 seconds and continue with play
+      ansible.builtin.wait_for:
+        timeout: 10
+    - name: Logout
+      ansible.builtin.uri:
+        url: http://localhost:9380/api/auth
+        method: DELETE
+        status_code: 204
+        headers:
+          X-FTL-SID: "{{ login.json.session.sid  }}"
+      when: inventory_hostname != "router.home.lan"
+      ignore_errors: true
+    - name: Setting up resolv.conf
+      ansible.builtin.copy:
+        dest: "/etc/resolv.conf"
+        content: |
+          nameserver 192.168.77.101
+          nameserver 192.168.77.106
+          nameserver 192.168.77.238
+          options rotate
+          options timeout:1
+      become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+
+
+      # until: _result.status == 204 
+      # retries: 3 # 720 * 5 seconds = 1hour (60*60/5)
+      # delay: 5 # Every 5 seconds
+    - name: Sleep for 60 seconds and continue with play
+      ansible.builtin.wait_for:
+        timeout: 60
+
+    - name: Reconfigurte router containers
+      shell: python3 /root/unifi-api/unifi.py -s -d "{{ destination.split('.')[0] }}"
+      when: inventory_hostname == "router.home.lan"
+
+    - name: Stop containers
+      shell: docker stop `docker ps -a |awk '{ print $NF }'|egrep -v "NAME|^pihole$|watchtower|portainer" |xargs`
+      become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+      ignore_errors: true
+      when: inventory_hostname != destination and inventory_hostname != "nas.home.lan" and  inventory_hostname != "router.home.lan"
+
+    - name: Restart containers
+      shell: docker restart nginx-app-1
+      become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+      when: inventory_hostname == destination      
+
+    - name: Stop containers
+      shell: /share/ZFS530_DATA/.qpkg/container-station/bin/docker stop `/share/ZFS530_DATA/.qpkg/container-station/bin/docker ps -a |awk '{ print $NF }'|egrep -v "NAME|pihole|watchtower" |xargs`
+      become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+      ignore_errors: true
+      when: inventory_hostname != destination and inventory_hostname == "nas.home.lan" and  inventory_hostname != "router.home.lan"
+      
+    - name: Sleep for 120 seconds and continue with play
+      ansible.builtin.wait_for:
+        timeout: 120
+    # - name: Restart containers
+    #   shell: docker restart nginx-app-1
+    #   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+    #   when: inventory_hostname == destination

-      
--- a/playbooks/switch_destination_test.yaml
+++ b/playbooks/switch_destination_test.yaml
@ -0,0 +1,15 @@
+- hosts: datacenter
+  name: Switch server
+  ignore_unreachable: false
+
+  tasks:
+    - name: Unifi Modifi
+      ansible.builtin.uri:
+        url: http://192.168.77.101:8123/api/webhook/-WcEse1k5QxIBlQu5B0u-5Esb?server=nas
+        method: POST
+      when: inventory_hostname == destination and destination == "nas.home.lan"
+    - name: Unifi Modifi
+      ansible.builtin.uri:
+        url: http://192.168.77.101:8123/api/webhook/-WcEse1k5QxIBlQu5B0u-5Esb?server=m-server
+        method: POST
+      when: inventory_hostname == destination and destination == "m-server.home.lan"
--- a/roles/docker/files/ca.pem
+++ b/roles/docker/files/ca.pem
@ -0,0 +1,33 @@
+-----BEGIN CERTIFICATE-----
+MIIFqTCCA5GgAwIBAgIUKOBdRdfxq0T1Y7YREkEGUC5B644wDQYJKoZIhvcNAQEL
+BQAwZDELMAkGA1UEBhMCU0sxETAPBgNVBAgMCFNsb3Zha2lhMQswCQYDVQQHDAJT
+SzETMBEGA1UECgwKc2VjdG9ycS5ldTELMAkGA1UECwwCSVQxEzARBgNVBAMMCnNl
+Y3RvcnEuZXUwHhcNMjUwMzE4MTcxODA5WhcNMjYwMzE4MTcxODA5WjBkMQswCQYD
+VQQGEwJTSzERMA8GA1UECAwIU2xvdmFraWExCzAJBgNVBAcMAlNLMRMwEQYDVQQK
+DApzZWN0b3JxLmV1MQswCQYDVQQLDAJJVDETMBEGA1UEAwwKc2VjdG9ycS5ldTCC
+AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKTuAq0CKeyTRUz9N2nSyPL5
+MxCJZuKsFdiijjJBA0aVe7VN7sys3NYVr8A2FOpbUcWJiX3yDfPFBfIUaPubS+DR
+4O/LInT0gXBtuQZipzyyVugo2gr0WKN1Zl1lv0Jge0bwFuw4uZyZlDahF4NM4ee/
+1PZ0YgMYZNqTDfCrwy65cUIrw3AVNZQTdyYIodq2D5e3xhFO6DV4WgLskFzoN6TG
+yYMW7g1+meGrxSsx25MiDh3A6N8LeTyfmJgWL3dhLmpeoK2XkjljMe6G8pBaJm5A
+EGi8Hw6tIYtlP/E8CkWlTSTTK7RloLiy2kHaaHJNnAyjJk6N7QVJl4MBXXOj+OkF
+KbX/NUhwkXHeaqApBSTobJtPFeH1TVkEYKQ7rp/iFUHCQh8/C8v0O+SBV3TFNfS3
+IwVFbBAWQb0099ULlAqbgCViqSpsdVpg4hFr5R8FLpGSZ0dYIhgfTIdhd/4Ny9/C
+4ZyCbDyfmvxDoijINwvAwM9miPA4b1at4Irsw2jvrMxCMv+6keu0saDlPCw9f7O5
+AJGlpU9OSJ5UscSzbMOA1yiZsjI9+VCnQiaZ2Sb5U9yiLUWsz87kJed2X6Au61gP
+t8cKnCQgT+QFd6rkrxlRtMmECEWIOG6pVnk8iTQnMcnd/CtZUXTGA7plAv9FeXJD
+dmANM6qvXIszQP9FGBznAgMBAAGjUzBRMB0GA1UdDgQWBBTtSLVx7ddURGlWtSMl
+P9hjUvXA3TAfBgNVHSMEGDAWgBTtSLVx7ddURGlWtSMlP9hjUvXA3TAPBgNVHRMB
+Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4ICAQCVrHIOyr7GfX9BzAc9lcMpkhuX
+QvHesC45vEA6GSaLMT8CLe251Tag5qPAtf25aIM1ohcqLoqbjlTl51Ng3p9tow8t
+N+ITqmlJ71XxlI/3EcaZc+GwrOnwedH3XzuGS/Af6qXx5vaA0jvmkkuBvy3dQWld
+utOVBvpiYgepvYidDfpaeANfEz1UqerP4oTko5mFiKOgRjE+5/dodkWaTxjzVq6k
+LFaMuZt8h3CaolglmEAuepGJ1PBuwXE/V59Yxtj6ravxZ8Zsig11qve7MH6THIO2
+YaH/kB5CIniIsfikiDcNbuljiFdvp5Hx8hEcaCXSsZqNWxG0Ly/eRUJrMFZlW7+f
+yucbRIbGT9B3QjyOO9sojbeIjklS3fbPUSlAqMt+mTG74enGlrzrOrPN1QkO6Otc
+nZv+/u64VasO5C717n1zowquyWKKIvcUXzORxJZ26o1YiCxeJn5iRdeIyAeVSVHB
+Tzx3T/nbf9Vwvv5F1O3/5Dec3iQxhU3Tpr9QZ4bUHSjInKsdB71+TQzvsD9ep9Ok
+wD0C1Dvf5RMf8NBrIXh+Y4/Agn1UuPkfxzOxHUVWRIhJsWKtXkn3izffsq8Dg4jG
+xKkxPq4XZZW23pl08xId1u77VfXY5M55uycDQeU2Q/U/wM6F5Z9d3xsj+Ch4jbMV
+uUFBhdL6wpJ0oAps3A==
+-----END CERTIFICATE-----
--- a/roles/docker/files/server-cert.pem
+++ b/roles/docker/files/server-cert.pem
@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFmzCCA4OgAwIBAgIUIAmyLpdLLc9jLlk3yzZruYnzMDIwDQYJKoZIhvcNAQEL
+BQAwZDELMAkGA1UEBhMCU0sxETAPBgNVBAgMCFNsb3Zha2lhMQswCQYDVQQHDAJT
+SzETMBEGA1UECgwKc2VjdG9ycS5ldTELMAkGA1UECwwCSVQxEzARBgNVBAMMCnNl
+Y3RvcnEuZXUwHhcNMjUwMzE4MTcxOTA5WhcNMjYwMzE4MTcxOTA5WjAYMRYwFAYD
+VQQDDA1yYWNrLmhvbWUubGFuMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
+AgEA21urOCdoUPOBRqJBzEickOvhdQKCCTcbxHlxy80jR1PUDqmZeqPktKr0QCtf
+ntb0NH+/Ntiu3ZZBBkeyPfA50QIADmII5AbOHADszWEsKz9vhltFKpWQfsmU9H6U
+fPyHL0muqz32ujRZnQUIvQ5ekrH9ghLOhllOv+Rqbj5w6AjNYOxBuy0qgb7AZJCV
+zBjfSYm80pCY6RDU0C+v4X5TbyDAwNY5FAUfsFqpExHo9YbB2V9VNE2vW8mIy/Kg
+OZ9SfRhuFY5Gl1aEdQJUaAQe05oLvvkPPmOCv6CyEfJV5Esrnz2xludpIhET+eHu
+PXWvcvVCHPAO8HnGhqtYBmyOb8UVDgL07voXif+jtr/G31m+u4zeYrnvoe7u1U2X
+GeV97+yZafKTAD4c6kbja+ojH7JV5dwVIEmw4cSv+GWbM+JdrUskcl5Ku+vAUg/u
+RT/N6b98iWWhbwtbQkVzs4g93KWeu+416/p9DKUwT7OcKKvvc5Kxxk9Empkv5xtI
+ScABwb6YtGeVUE9CX+Xj5hHOc1zXEJ8t8PQwBKLTOd94H5I72AxjZZ+fF52ysp+w
+eGULuIYKbJI5yzIg6JYHhLR08YvGydBgbmymnejd7hGKnsNh2y5lizxBEdfqfMvw
+pAexpue3mh40dJS3c82tEo7YlsDQGwK2G/eK4k7rZDgQVpsCAwEAAaOBkDCBjTA2
+BgNVHREELzAtgg1yYWNrLmhvbWUubGFuhwTAqE1lhwTAqE03hwTAqE3uhwTAqE03
+hwR/AAABMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1UdDgQWBBSm0Th+Qn2nTOHq
+tqS7oIP+H/AhLjAfBgNVHSMEGDAWgBTtSLVx7ddURGlWtSMlP9hjUvXA3TANBgkq
+hkiG9w0BAQsFAAOCAgEAF3sZbSWnNj9X48kKtm/2btrBwC2cEg5x8pfb/orjNZmi
+47rXkLOzE0v09TO8+gFhKu6pR9SLmhTsgPRkGYolP4Bx889NMSzcoXTT18Vf6LTH
+LA3okzg4wI5uAa4OCAUJ78D9OJniJhdTamlCCw2r0TDxmf1Wc4ofWYlHuSolWetH
+MyhHjU8wp7BIG+we5CKwCQedDufrPLw9zBm7eLq9kBDUNifO0m0rJuYcnaxtGT/w
+AUFxKJ1xHNt0lqSYHpd1ljvJKXAeugN4iuoCBBuVuQHCTweeW6g4O7HPefB1cyCS
+HCUx4kKM95pPiMn0MwYPUZrP6sXsf+RPRHWROwZ/lwXcLlsmF177B7uEHqaAl66D
+5YQz0JtkAcpoglyHPYS4Z9NCEiPMNuT/xiHMESp5nBxWQk3lfg7GpwAgjNQ4uic+
+V1A5X9jTZg8qwfy1DSP33KWUgrS+uMFmJkPx6SA+2TksQkqTpr6ogS/aDgd9Sz7c
+QlA1yHUJ9Si3cP8w5y73Ih3mCUX/caq3eMCRqpK22BhShamZrUvoPESSywtCOVWq
+nzDAWZeRgFZIqAV54PFunJBd0S4yVeRkd4hgXWdEdIpbOXj3/zCY5Gl51QrymB4+
+WC4a8ZM3dTDwndCBN0p7+9Ol2YPRgv41C0vN55bib1wm2sTnQfs86ctST2ZXy28=
+-----END CERTIFICATE-----
--- a/roles/docker/files/server-key.pem
+++ b/roles/docker/files/server-key.pem
@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQDbW6s4J2hQ84FG
+okHMSJyQ6+F1AoIJNxvEeXHLzSNHU9QOqZl6o+S0qvRAK1+e1vQ0f7822K7dlkEG
+R7I98DnRAgAOYgjkBs4cAOzNYSwrP2+GW0UqlZB+yZT0fpR8/IcvSa6rPfa6NFmd
+BQi9Dl6Ssf2CEs6GWU6/5GpuPnDoCM1g7EG7LSqBvsBkkJXMGN9JibzSkJjpENTQ
+L6/hflNvIMDA1jkUBR+wWqkTEej1hsHZX1U0Ta9byYjL8qA5n1J9GG4VjkaXVoR1
+AlRoBB7Tmgu++Q8+Y4K/oLIR8lXkSyufPbGW52kiERP54e49da9y9UIc8A7wecaG
+q1gGbI5vxRUOAvTu+heJ/6O2v8bfWb67jN5iue+h7u7VTZcZ5X3v7Jlp8pMAPhzq
+RuNr6iMfslXl3BUgSbDhxK/4ZZsz4l2tSyRyXkq768BSD+5FP83pv3yJZaFvC1tC
+RXOziD3cpZ677jXr+n0MpTBPs5woq+9zkrHGT0SamS/nG0hJwAHBvpi0Z5VQT0Jf
+5ePmEc5zXNcQny3w9DAEotM533gfkjvYDGNln58XnbKyn7B4ZQu4hgpskjnLMiDo
+lgeEtHTxi8bJ0GBubKad6N3uEYqew2HbLmWLPEER1+p8y/CkB7Gm57eaHjR0lLdz
+za0SjtiWwNAbArYb94riTutkOBBWmwIDAQABAoICAGBqHsw8OfQWy3QF3mDRa4uh
+OgQJmak+QSSu8m8PF9oChPr63ZxTjDNCzr+jsNAqj8TBf4S2YcnAgI0nlzb1Lxxo
+QikQOvMq8I3LdEnjU5wgsj6+QBzzB0NLC/8Y4eA7yJlmy/C1eAwo9Vh4PXqHZdcZ
+h6ET7hWMDHp4hbU2Gb9LGyZmQY/pTr0fYAXzrPu71OzILyfn6WXLgZaN10MIGNkH
+7uDzZ7wecmq7toPMw/WjCPInnlYybQitgMSPvJAHMKUOR1iPJAThwK+DWiEr6na8
+Rzxl0SbtaysaERqlRs5koeRIpBV9Wi7gjcSv4ty9rOOc3DXG5/IXvEQ17KdKMKIs
+R1wWynxM2yR3mHi4btNpFthdZ7B3BhnliTcBRyWJWU8Zkd7pcM6AwOaA2vU7wb1c
+mvLGomtDhWf/ij/Ww8fWBmpj7yLuA5bOBCGHmCqS+ow4AUZANC6mc50GmZs4Llg0
+8CJgaynrdFKBhPbVZ/OoDK/d6yDostRx/PGReGjue1ly93sjNw16QeulHj8cWk3R
+LXNnQaDf1MCvoW7826Fzpzl/jLnB6q5CyLwdqToDtT46Zm8lGvrfb+2K0v0R3a2A
+qQLZZDoNzau8D7bjQctaHOUdIxYh1E1k+fdvyncWDOUPitNuaL9Li/usddNZKKvN
+hg3CDkxtUQdDKY6bTxo1AoIBAQD5nnGGHIhxzpYwjETl42+jM0JZywdV0zv+AQSZ
+AmQvHm2CNrr8FgdA6H1uX9iKvRShPlmvgun8mxKKZ4SFfCvqWwy1NVP0VCeZ6COX
+xSoAxO2P75j/HVZo4ZPtXrobj1t7wBllMv5YJCJL/pvNrNUeDaUmjp5oLRkGGIRA
+ZvDVmeMFNP/N0lKQfVaQ2Zr8HxvxADEtvq7Zr5YQzyNtpY80wEOpHYU1QXaf67va
+A/R90onbHxiSc8LYuPu9ltvzzwDaN4laYaxz4QemSPHSLfQoNKTrJ0th6h0+ElXt
+CUIaiZK/6RG2mgqk7X/CVFsbwRCCeegi+OgiTBjatrryGwXlAoIBAQDg9zE9ep4c
+HXJbIvEjhvv8HIoa7Jeb2Ktspqja9FZv8qn8o0e41fXnmdNkjeJPrEcUMyJrlGCG
+UlcIh8L5zdvr0Ja1epmcfJmOyfhyUwsovG3X9DlGjunKAfUaHEEozh8pd3p9MhAb
+Re/q6u5OU2MAChe8gjlD7ycPZcHhztqcoaVxg9KmozV5WSj/NWu5+o+o2PgwCbUi
+n5qEwVW9tY2qVmzmSTO/2ii4pM6SZpAGoyY4F0HR7GYYtX9JT8OiFTxVe9Qpl155
+ldFl2Mgf14kLZJqTmXBB+m3Ocujjn7HxLHoWc3q2Po3SDwpVeqQFtm1+0ap9e1XP
+6K2gXiYQYCJ/AoIBAENf0bJqFyXopb8azSnjlmlNV5ZW53bx2dp4Od52t8XEB7jC
+vvt1kqWhWuGkuxTPbjcLVje6NR+6V2nGAQ3qcwwBYU+zwiJLaJjxAFJhpDGq9ZgJ
+CpmpOH58jGngTIlNy1p+ghw/hEkUD7HFWhZMlQVUl4PtsLHbokpz6ZZccpqku5LX
+OEg8gY6AVhIoud1dJDSLYbrAIf+dlfqZfi2FJz8MufZ2glLahYMqpHx23tHrNsxO
+1nkJu5KF6CXjGylLcy4erlLbbmlPmRSgfrB7om/k9fotj8KarQrTMf63L2+7j4g
+UWig8UiM1hQEosa9+I/PCaoO1tETCw5VjeX1B0UCggEANhByDvpW4R7airh9BzK7
+gD1Dm3DchqGtoPD0h5pM456H56U96VfSPxSizvmiN8+JTXt0fDIueFl1fSFTZEFq
+5uM8NOT/4bG4Ha7APIlklyehplKVKTXTTa7mvp2nsyzGJGsITuonIMbP/77yAnTb
+x/ik97K8HG1vD64+yAu0Ugwu/HbXuyBiC4W36o1mFE35FHUAQFs04ttEgT8NYggt
+wY//n+BbxXGic613z4tCdbXjy3sbYF3Vs3561p2KwHsmAs09kblFBSdSKY3Nmolr
+8Ab/dxVa+yA6H3FSMtIAK5uqw5aBGSczYhYnP5+3p3/OFLpCpOFtIAglIfM+ZpUT
+9QKCAQBoACOCu9VZtw+8C7avhw8nv/V+SFm2anK8Q5lOQiYo40ULklbqe+onzKJ3
+oNjl7iyXZSkTyq6wEdOsKhPr7HndRTTcH2O7mxKcdEWkMtJLlo3xlohqBQymAlQl
+GEOblCG6sC0SPnse+RrrtU4EsXaTIJsOCrcmWwYnqO8nItzEnzT1ifN9Xt0rwI9y
+7ZNAM1rvbVbm/uySCRf1slZWyHm+Dqr4oUNaZvTk6sFdlSs3emUzDb4mje9G3V86
+cXZNizURN4KA3+ADjCFPpQ6HO4rGNSqKKEEiW1aVPsCC0z0vxd1vY8taYVwL/B4p
+/dKUFh7pGk5UE/IXZWlBVDufNy/b
+-----END PRIVATE KEY-----
--- a/roles/docker/tasks/main.yml
+++ b/roles/docker/tasks/main.yml
@ -1,4 +1,7 @@
 - block:
+  - name: print arch
+    debug:
+      msg: "{{ ansible_architecture }}"
  - name: Install docker
    ansible.builtin.apt:
      name: 
@ -17,6 +20,13 @@
  - name: Get keys for raspotify
    ansible.builtin.shell:
      curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
+    when:
+        - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
+  - name: Get keys for raspotify
+    ansible.builtin.shell:
+      curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc     
+    when:
+        - ansible_distribution == "Ubuntu"

  - name: Get keys for raspotify
    ansible.builtin.shell:
@ -24,7 +34,13 @@

  - name: Get keys for raspotify
    ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
-
+    when:
+        - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
+  - name: Get keys for raspotify
+    ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+    when:
+    - ansible_distribution == "Ubuntu"
+    
  - name: Install docker
    ansible.builtin.apt:
      name: 
@ -40,18 +56,58 @@
      path: /etc/systemd/system/docker.service.d/
      state: directory
      mode: '0755'
-
+  - name: Create a directory for certs
+    ansible.builtin.file:
+      path: /etc/docker/certs
+      state: directory
+      mode: '0700'
+  - name: Copy files
+    copy:
+      src: server-key.pem
+      dest: /etc/docker/certs/
+  - name: Copy files
+    copy:
+      src: ca.pem
+      dest: /etc/docker/certs/
+  - name: Copy files
+    copy:
+      src: server-cert.pem
+      dest: /etc/docker/certs/      
  - name: Creating a file with content
    copy:
      dest: "/etc/systemd/system/docker.service.d/override.conf"
      content: |
        [Service]
        ExecStart=
-        ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock -H tcp://0.0.0.0:2375
+        ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify     --tlscacert=/etc/docker/certs/ca.pem     --tlscert=/etc/docker/certs/server-cert.pem     --tlskey=/etc/docker/certs/server-key.pem     -H=0.0.0.0:2376
    notify: restart_docker
+    when:  mode == "nocert" 
+  - name: Creating a file with content
+    copy:
+      dest: "/etc/systemd/system/docker.service.d/override.conf"
+      content: |
+        [Service]
+        ExecStart=
+        ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify     --tlscacert=/etc/docker/certs/ca.pem     --tlscert=/etc/docker/certs/server-cert.pem     --tlskey=/etc/docker/certs/server-key.pem     -H=0.0.0.0:2376
+    notify: restart_docker
+    when:  mode != "nocert" 

  - name: Just force systemd to reread configs
    ansible.builtin.systemd:
      daemon_reload: true

+  - name: Restart docker service
+    ansible.builtin.service:
+      name: docker
+      state: restarted
+
+  # - name: Get keys for raspotify
+  #   ansible.builtin.shell: docker plugin install grafana/loki-docker-driver:3.3.2-{{ ansible_architecture }} --alias loki --grant-all-permissions
+  - name: Install a plugin
+    community.docker.docker_plugin:
+      plugin_name: grafana/loki-docker-driver:3.3.2
+      alias: loki
+      state: present
+
+
  become: true
--- a/roles/loki-agent/tasks/main.yml
+++ b/roles/loki-agent/tasks/main.yml
@ -0,0 +1,20 @@
+- block:
+  - name: Get keys
+    ansible.builtin.shell: curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
+  - name: Add repo
+    ansible.builtin.shell: echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
+  - name: Update cache
+    ansible.builtin.apt:
+      update_cache: true
+  - name: Instal wazuh
+    ansible.builtin.apt:
+      name: wazuh-agent
+    environment:
+      WAZUH_MANAGER: 'm-server.home.lan'
+      WAZUH_AGENT_NAME: "{{ inventory_hostname }}"
+  - name: Restart wazuh service
+    ansible.builtin.service:
+      name: wazuh-agent
+      state: restarted
+      enabled: true
+  become: true
--- a/roles/loki-agent/vars/main.yml
+++ b/roles/loki-agent/vars/main.yml
@ -0,0 +1 @@
+ZABBIX_SERVER: "zabbix.home.lan"
--- a/roles/omv_backup/tasks/main.yml
+++ b/roles/omv_backup/tasks/main.yml
@ -27,7 +27,7 @@

  - name: Upload script
    ansible.builtin.copy:
-      src: "{{ dest_folder }}/omv_backup.py"
+      src: "{{ dest_folder }}/omv_backup_v3.py"
      dest: /myapps/omv_backup.py
      remote_src: true
      mode: '0755'
@ -36,8 +36,8 @@
    when: inventory_hostname != 'nas.home.lan' 
  - name: Upload script
    ansible.builtin.copy:
-      src: "{{ dest_folder }}/omv_backup_v2.py"
-      dest: /myapps/omv_backup_v2.py
+      src: "{{ dest_folder }}/omv_backup_v3.py"
+      dest: /myapps/omv_backup.py
      remote_src: true
      mode: '0755'
      owner: root
@ -89,12 +89,14 @@
        Description=Enable OMV backup

        [Service]
-        ExecStart = nohup /myapps/venv/bin/python3 /myapps/omv_backup_v2.py -b > /dev/null  2>&1 &
+        ExecStart = nohup /myapps/venv/bin/python3 /myapps/omv_backup.py -b > /dev/null  2>&1 &

        [Install]
        WantedBy=basic.target
      owner: root
      mode: '0744'
+    when: inventory_hostname == 'amd.home.lan' 
+
  - name: Restart service omv_backup, in all cases
    ansible.builtin.service:
      name: omv_backup
@ -103,4 +105,5 @@
    # async: 
    # poll: 0
    # ignore_errors: true
+    when: inventory_hostname == 'amd.home.lan' 
  become: true
--- a/roles/wazuh-agent/tasks/main.yml
+++ b/roles/wazuh-agent/tasks/main.yml
@ -11,11 +11,10 @@
      name: wazuh-agent
    environment:
      WAZUH_MANAGER: 'm-server.home.lan'
-      WAZUH_AGENT_NAME: "{{ inventory_hostname}}"
+      WAZUH_AGENT_NAME: "{{ inventory_hostname }}"
  - name: Restart wazuh service
    ansible.builtin.service:
      name: wazuh-agent
      state: restarted
      enabled: true
-
  become: true
--- a/roles/zabbix-agent/tasks/main.yml
+++ b/roles/zabbix-agent/tasks/main.yml
@ -26,11 +26,11 @@
  #   ansible.builtin.copy:
  #     src: packages/zabbix-release_6.4-1+ubuntu22.04_all.deb
  #     dest: /tmp/
-  - name: Install a .deb package from the internet11
+  - name: Install a .deb package from the internet111
    ansible.builtin.apt:
-      deb: https://repo.zabbix.com/zabbix/6.4/ubuntu-arm64/pool/main/z/zabbix-release/zabbix-release_6.4-1+ubuntu22.04_all.deb
+      deb: https://repo.zabbix.com/zabbix/7.2/release/ubuntu/pool/main/z/zabbix-release/zabbix-release_latest_7.2+ubuntu24.04_all.deb
    when:
-      - ansible_facts.architecture != "armv7l" and  ( ansible_distribution == "Ubuntu" or ansible_distribution == "Linux Mint" )
+      - ansible_facts.architecture != "armv7l" and  ( ansible_distribution == "Ubuntu1" or ansible_distribution == "Linux Mint" )

  - name: Install a .deb package from the internet2
    ansible.builtin.apt:
@ -77,7 +77,7 @@
      path: "{{ zabbix_agent_cfg }}"
      regexp: "^Server=.*"
      insertafter: '^# Server='
-      line: "Server=192.168.77.0/24,172.30.0.0/24"
+      line: "Server=192.168.77.0/24,192.168.89.0/28"


  - name: Reconfigure zabbix agent ServerActive
Author	SHA1	Message	Date
jaydee	14d455d84d	aaa	2025-03-18 18:20:37 +01:00
jaydee	62584425b4	aaa	2025-03-18 18:04:58 +01:00
jaydee	482244589f	aaa	2025-03-18 17:56:00 +01:00
jaydee	3f601f92a0	aaa	2025-03-18 17:24:20 +01:00