klal

.gitea/workflows/demo.yaml

@@ -0,0 +1,9 @@
+name: Gitea Actions Demo
+run-name: ${{ gitea.actor }} is testing out Gitea Actions 🚀
+on: [push]
+
+jobs:
+  Explore-Gitea-Actions:
+    runs-on: jaydee
+    steps:
+      - run: curl -X GET  https://kestra.sectorq.eu/api/v1/executions/webhook/jaydee/ansible-all/f851511c32ca9450

all.yml

@@ -1,33 +1,67 @@
 - hosts: datacenter
   name: Roles
+  gather_facts: false
   roles:
+    - name: setup
+      role: setup
+      tags: setup
     - name: common
       tags: common
+      role: common
+    - name: hosts
+      role: hosts
+      tags: hosts
+    - name: ssh_config
+      role: ssh_config
+      tags: ssh_config
+    - name: sshd_config
+      role: sshd_config
+      tags: sshd_config
+    - name: ssh_keys
+      role: ssh_keys
+      tags: ssh_keys
     - name: wake_on_lan
+      role: wake_on_lan
       tags: wake_on_lan
     - name: matter-server
+      role: matter-server
       tags: matter-server
     - name: docker
+      role: docker
       tags: docker
     - name: timeshift
+      role: timeshift
       tags: timeshift
     - name: monitoring
+      role: monitoring
       tags: monitoring
     - name: zabbix-agent
+      role: zabbix-agent
       tags: zabbix-agent
     - name: autofs_client
+      role: autofs_client
       tags: autofs_client
     - name: ldap_client
+      role: ldap_client
       tags: ldap_client
     - name: ssh_banner
+      role: ssh_banner
       tags: ssh_banner
     - name: omv_backup
+      role: omv_backup
       tags: omv_backup
     - name: wazuh-agent
+      role: wazuh-agent
       tags: wazuh-agent
-    - role: mqtt-srv
+    - name: mqtt-srv
+      role: mqtt-srv
       tags: mqtt-srv
-    - role: vnc_server
+    - name: vnc_server
+      role: vnc_server
       tags: vnc_server
-    - role: promtail
+    - name: promtail
+      role: promtail
       tags: promtail
+    - name: sudoers
+      role: sudoers
+      tags: sudoers

collections/requirements.yml

@@ -1,3 +1,6 @@
----
+# requirements.yml
+# ansible-galaxy collection install -r collections/requirements.yml --force
 collections:
-  - name: community.general
+  - name: community.general
+    source: https://galaxy.ansible.com
+  - name: community.docker

hosts

@@ -10,6 +10,7 @@
 
 # Ex 1: Ungrouped hosts, specify before any group headers.
 
+
 #green.example.com
 #blue.example.com
 #192.168.100.1

jaydee.yml

@@ -1,17 +1,17 @@
 $ANSIBLE_VAULT;1.1;AES256
-61323036366363323032396232663032666134316166633635316134623436303565316538333637
-6138356462323362636265323030353439393233643032330a313763336632383432613830356136
-31353731646665373863666364363163633539313436643638663736393734363532363562353866
-3333343966613162310a643534663838306435373630303337356331356164356463653863613363
-62663862376430383238616135383233313430323839613631633339373430353361326338303666
-35316631363739313938613737656661366636613165643736343433646233666362363034333139
-31646636663161313365373337333661373330386365306664306233343765636136393531643531
-63653362323461313763653836663165383162363763396162393932653764646532313637656136
-62313761386237326633653037636334343765383464333562326230323131306637323265373261
-37316263613732333633636334363762383733646461653632363434386539303130626538616437
-66306433353061323932383437373637613638643232363461316262346436366162316637306461
-64336261613436323664643063616239636631343139636164633234613536633665643231346463
-33343536373235303032373939353032666237663137353366326639613730393439353232303964
-63623536666339333135643361636138303539613233326639623236323331336661353734373562
-31633131383835323734646235363266666336343565623339373265623635323134333964353966
-61623231323936643565
+34653034626436373537323430316462643663336164613763306336333038346562356565393036
+3964393861323439333839383061303864326235306665620a346233313633393135366362326464
+63643039363635646131323365313833643864373637346536663831613837353833343030623366
+3038303063393565350a613439646161363330626566646264313939653339383439623532636638
+38646433353765396136333236656535636235313639393565306636376438346362646438613835
+62663031333832666262616365343831353530646263383932373666386631633430626363363966
+61396336303365306135363039303032646137613330646434366638633738363064356132383439
+36346432306531356333313963353463626232613563653331396334656539643531343136636635
+31613762383664353930653165313461626133336161353639303662666234356138373539376161
+30653837316266356136353132373663396365633434393166383230363263326139316362383766
+64303738393663343636616437346535346566346536616663333866613966343563306265633064
+66333331393861626637616330333463636135316466616532373663663464613034656337363437
+62653333653838326632643238616638313935383532303233643132303637653963626363633662
+33646161373931386133353338643462306635393866656662376234396533376431366134653536
+36363835346434323338363465336166303161633732333232653861646136326334616261653462
+66376139313433383665

playbooks/build_tasmota_v2.yml

@@ -4,54 +4,87 @@
   # vars:
   #   DOCKER_IMAGE: docker-tasmota
   #   FWS: tasmota
+  become: true
   tasks:
-    - name: Pull tasmota
-      ansible.builtin.shell: 
-        cmd: 'git config --global --add safe.directory /share/docker_data/docker-tasmota/Tasmota'
- 
-    - name: Fetch tasmota
-      ansible.builtin.shell: 
-        cmd: 'git fetch https://github.com/arendst/Tasmota.git {{ BRANCH }}'
-        chdir: /share/docker_data/docker-tasmota/Tasmota
+    - name: Change conf
+      community.general.git_config:
+        name: safe.director
+        scope: global
+        value: /share/docker_data/docker-tasmota/Tasmota
 
-    - name: Checkout tasmota branch
-      ansible.builtin.shell: 
-        cmd: 'git checkout --force {{ BRANCH }}'
-        chdir: /share/docker_data/docker-tasmota/Tasmota
+    # - name: Pull tasmota
+    #   ansible.builtin.shell:
+    #     cmd: 'git config --global --add safe.directory /share/docker_data/docker-tasmota/Tasmota'
 
-    - name: Pull tasmota
-      ansible.builtin.shell: 
-        cmd: 'git pull'
-        chdir: /share/docker_data/docker-tasmota/Tasmota
+    - name: Checkout a github repo and use refspec to fetch all pull requests
+      ansible.builtin.git:
+        repo: 'https://github.com/arendst/Tasmota.git'
+        dest: /share/docker_data/docker-tasmota/Tasmota
+        version: '{{ BRANCH }}'
+
+    # - name: Fetch tasmota
+    #   ansible.builtin.shell:
+    #     cmd: 'git fetch https://github.com/arendst/Tasmota.git {{ BRANCH }}'
+    #     chdir: /share/docker_data/docker-tasmota/Tasmota
+
+
+    - name: Git checkout
+      ansible.builtin.git:
+        repo: 'https://github.com/arendst/Tasmota.git'
+        dest: /share/docker_data/docker-tasmota/Tasmota
+        version: '{{ BRANCH }}'
+
+    # - name: Checkout tasmota branch
+    #   ansible.builtin.shell:
+    #     cmd: 'git checkout --force {{ BRANCH }}'
+    #     chdir: /share/docker_data/docker-tasmota/Tasmota
+    - name: Just get information about the repository whether or not it has already been cloned locally
+      ansible.builtin.git:
+        repo: https://github.com/arendst/Tasmota.git
+        dest: /share/docker_data/docker-tasmota/Tasmota
+        update: true
+
+    # - name: Pull tasmota
+    #   ansible.builtin.shell:
+    #     cmd: 'git pull'
+    #     chdir: /share/docker_data/docker-tasmota/Tasmota
 
     - name: Copy platformio_override
-      ansible.builtin.shell: 
+      ansible.builtin.command:
         cmd: 'cp platformio_override.ini Tasmota/platformio_override.ini'
         chdir: /share/docker_data/docker-tasmota/
+      register: my_output
+      changed_when: my_output.rc != 0
 
     - name: Copy user_config_override
-      ansible.builtin.shell: 
+      ansible.builtin.command:
         cmd: 'cp user_config_override.h Tasmota/tasmota/user_config_override.h'
         chdir: /share/docker_data/docker-tasmota/
+      register: my_output
+      changed_when: my_output.rc != 0
 
     - name: Build tasmota
-      ansible.builtin.shell: 
-        cmd: 'docker run --rm -v /share/docker_data/docker-tasmota/Tasmota:/tasmota -u $UID:$GID {{ DOCKER_IMAGE }} -e {{ FWS }}'
+      ansible.builtin.command:
+        cmd: 'docker run --rm -v /share/docker_data/docker-tasmota/Tasmota:/tasmota -u 0:0 {{ DOCKER_IMAGE }} -e {{ FWS }}'
         chdir: /share/docker_data/docker-tasmota/
       when: FWS != "all"
+      register: my_output
+      changed_when: my_output.rc != 0
 
     - name: Build tasmota
-      ansible.builtin.shell: 
-        cmd: 'docker run --rm -v /share/docker_data/docker-tasmota/Tasmota:/tasmota -u $UID:$GID {{ DOCKER_IMAGE }}'
+      ansible.builtin.command:
+        cmd: 'docker run --rm -v /share/docker_data/docker-tasmota/Tasmota:/tasmota -u 0:0 {{ DOCKER_IMAGE }}'
         chdir: /share/docker_data/docker-tasmota/
       when: FWS == "all"
+      register: my_output
+      changed_when: my_output.rc != 0
 
     - name: Create a directory if it does not exist
       ansible.builtin.file:
         path: /share/docker_data/webhub/fw/{{ BRANCH }}
         state: directory
-        mode: '0755'  
+        mode: '0755'
 
     - name: Build tasmota
-      ansible.builtin.shell: 
-        cmd: 'mv  /share/docker_data/docker-tasmota/Tasmota/build_output/firmware/* /share/docker_data/webhub/fw/{{ BRANCH }}'
+      ansible.builtin.shell:
+        cmd: 'mv /share/docker_data/docker-tasmota/Tasmota/build_output/firmware/* /share/docker_data/webhub/fw/{{ BRANCH }}/'

playbooks/restore_container.yaml

@@ -1,10 +0,0 @@
-- hosts: nas
-  name: Sync mailu
-  ignore_unreachable: false
-  tasks:   
-  - name: Syncing all
-    ansible.builtin.shell: 'rsync -avh --delete root@192.168.77.189:/srv/dev-disk-by-uuid-02fbe97a-cd9a-4511-8bd5-21f8516353ee/docker_data/latest/{{ CONTAINERS }}  /share/docker_data/ --exclude="home-assistant.log*" --exclude="gitlab/logs/*"'
-    #ansible.builtin.shell: 'rsync -avh --delete /share/docker_data/{mailu2,webhub,nginx,heimdall} root@192.168.77.238:/share/docker_data/ --exclude="home-assistant.log*" --exclude="gitlab/logs/*"'
-    #ansible.builtin.shell: 'ls -la'
-    when: inventory_hostname in groups['nas']
-    # loop: '{{ CONTAINERS }}'

roles/autofs_client/tasks/main.yml

@@ -1,83 +1,109 @@
-- block:
-  - name: include vault
-    ansible.builtin.include_vars:
-      file: jaydee.yml
-  - name: Install autofs
-    ansible.builtin.apt:
-      name: 
-        - autofs
-        - cifs-utils
-      state: present
+- name: Setup autofs
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: jaydee.yml
+    - name: Install autofs
+      ansible.builtin.apt:
+        name:
+          - autofs
+          - cifs-utils
+        state: present
 
-  - name: Creating a file with content
-    copy:
-      dest: "/etc/auto.auth"
-      content: |
-        username={{ samba_user }}
-        password={{ samba_password }}
-        
-  - name: Creating a file with content
-    copy:
-      dest: "/etc/auto.nas-movies"
-      content: |
-        movies  -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw    ://nas.home.lan/movies
-  - name: Creating a file with content
-    copy:
-      dest: "/etc/auto.nas-music"
-      content: |
-        music   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw    ://nas.home.lan/music
-  - name: Creating a file with content
-    copy:
-      dest: "/etc/auto.nas-shows"
-      content: |
-        shows   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0777,file_mode=0777,uid=jd,rw    ://nas.home.lan/shows
-        
-  - name: Creating a file with content
-    copy:
-      dest: "/etc/auto.nas"
-      content: |
-        nas-data   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/Data
-        nas-docker-data   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/docker_data
-        nas-photo   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/Photo
-        nas-public   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/Public
-        nas-install   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/install
-        nas-downloads   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/downloads
-        nas-games   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/qda_2
-  # - name: Reconfigure autofs Server
-  #   ansible.builtin.lineinfile:
-  #     path: /etc/auto.master
-  #     regexp: "^/media/nas.*"
-  #     insertafter: '^/media/nas'
-  #     line: "/media/nas   /etc/auto.nas --timeout 360 --ghost"
+    - name: Creating a file with content
+      ansible.builtin.copy:
+        dest: "/etc/auto.auth"
+        content: |
+          username={{ samba_user }}
+          password={{ samba_password }}
+        mode: '0600'
+        owner: root
+        group: root
+    - name: Creating a file with content
+      ansible.builtin.copy:
+        dest: "/etc/auto.m-server"
+        content: |
+          docker_data  -fstype=nfs   m-server.home.lan:/share/docker_data
+          downloads  -fstype=nfs   m-server.home.lan:/media/data/downloads
+        mode: '0600'
+        owner: root
+        group: root
+    - name: Creating a file with content
+      ansible.builtin.copy:
+        dest: "/etc/auto.nas-movies"
+        content: |
+          movies  -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/movies
+        mode: '0600'
+        owner: root
+        group: root
 
-  - name: Reconfigure autofs Server
-    ansible.builtin.lineinfile:
-      path: /etc/auto.master
-      regexp: "^/media/data/music/nas.*"
-      line: /media/data/music/nas   /etc/auto.nas-music --timeout 360 --ghost
-  - name: Reconfigure autofs Server
-    ansible.builtin.lineinfile:
-      path: /etc/auto.master
-      regexp: "^/media/data/movies/nas.*"
-      line: /media/data/movies/nas   /etc/auto.nas-movies --timeout 360 --ghost
-  - name: Reconfigure autofs Server
-    ansible.builtin.lineinfile:
-      path: /etc/auto.master
-      regexp: "^/media/data/shows/nas.*"
-      line: /media/data/shows/nas   /etc/auto.nas-shows --timeout 360 --ghost
-  - name: Reconfigure autofs Server
-    ansible.builtin.lineinfile:
-      path: /etc/auto.master
-      line: /media/nas   /etc/auto.nas --timeout 360 --ghost
+    - name: Creating a file with content
+      ansible.builtin.copy:
+        dest: "/etc/auto.nas-music"
+        content: |
+          music   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/music
+        mode: '0600'
+        owner: root
+        group: root
+
+    - name: Creating a file with content
+      ansible.builtin.copy:
+        dest: "/etc/auto.nas-shows"
+        content: |
+          shows   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/shows
+        mode: '0600'
+        owner: root
+        group: root
+
+    - name: Creating a file with content
+      ansible.builtin.copy:
+        dest: "/etc/auto.nas"
+        content: |
+          nas-data   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/Data
+          nas-docker-data   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/docker_data
+          nas-photo -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/Photo
+          nas-public   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/Public
+          nas-install   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/install
+          nas-downloads   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw    ://nas.home.lan/downloads
+          nas-games   -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw  ://nas.home.lan/qda_2
+        mode: '0600'
+        owner: root
+        group: root
+    # - name: Reconfigure autofs Server
+    #   ansible.builtin.lineinfile:
+    #     path: /etc/auto.master
+    #     regexp: "^/media/nas.*"
+    #     insertafter: '^/media/nas'
+    #     line: "/media/nas   /etc/auto.nas --timeout 360 --ghost"
+
+    - name: Reconfigure autofs Server
+      ansible.builtin.lineinfile:
+        path: /etc/auto.master
+        regexp: "^/media/data/music/nas.*"
+        line: /media/data/music/nas   /etc/auto.nas-music --timeout 360 --ghost
+    - name: Reconfigure autofs Server
+      ansible.builtin.lineinfile:
+        path: /etc/auto.master
+        regexp: "^/media/data/movies/nas.*"
+        line: /media/data/movies/nas   /etc/auto.nas-movies --timeout 360 --ghost
+    - name: Reconfigure autofs Server
+      ansible.builtin.lineinfile:
+        path: /etc/auto.master
+        regexp: "^/media/data/shows/nas.*"
+        line: /media/data/shows/nas   /etc/auto.nas-shows --timeout 360 --ghost
 
 
+    - name: Reconfigure autofs Server
+      ansible.builtin.lineinfile:
+        path: /etc/auto.master
+        line: /media/nas   /etc/auto.nas --timeout 360 --ghost
+    - name: Reconfigure autofs Server
+      ansible.builtin.lineinfile:
+        path: /etc/auto.master
+        line: /media/m-server  /etc/auto.m-server --timeout 360 --ghost
 
-
-
-
-
-  - name: Restart docker service
-    ansible.builtin.service:
-      name: autofs
-      state: restarted
-  become: true
+    - name: Restart docker service
+      ansible.builtin.service:
+        name: autofs
+        state: restarted

roles/common/tasks/main.yml

@@ -1,8 +1,10 @@
-- name: Upgrade the full OS 
-  ansible.builtin.apt:
-    upgrade: full
-  become: true
-- name: Upgrade flatpack 
-  ansible.builtin.command:  flatpak update -y
-  become: true
-  when: inventory_hostname == 'morefine.home.lan'
+- name: Upgrade
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Upgrade the full OS
+      ansible.builtin.apt:
+        update_cache: true
+        upgrade: full
+    - name: Upgrade flatpack
+      ansible.builtin.command: flatpak update -y
+      when: inventory_hostname == 'morefine.home.lan'

roles/docker/files/ca.pem

@@ -1,33 +1,33 @@
 -----BEGIN CERTIFICATE-----
-MIIFqTCCA5GgAwIBAgIUKOBdRdfxq0T1Y7YREkEGUC5B644wDQYJKoZIhvcNAQEL
+MIIFqTCCA5GgAwIBAgIUJ3kgn/onrwoKs+MqhsHo7RmF/20wDQYJKoZIhvcNAQEL
 BQAwZDELMAkGA1UEBhMCU0sxETAPBgNVBAgMCFNsb3Zha2lhMQswCQYDVQQHDAJT
 SzETMBEGA1UECgwKc2VjdG9ycS5ldTELMAkGA1UECwwCSVQxEzARBgNVBAMMCnNl
-Y3RvcnEuZXUwHhcNMjUwMzE4MTcxODA5WhcNMjYwMzE4MTcxODA5WjBkMQswCQYD
+Y3RvcnEuZXUwHhcNMjUwMzExMTc1MDA5WhcNMjYwMzExMTc1MDA5WjBkMQswCQYD
 VQQGEwJTSzERMA8GA1UECAwIU2xvdmFraWExCzAJBgNVBAcMAlNLMRMwEQYDVQQK
 DApzZWN0b3JxLmV1MQswCQYDVQQLDAJJVDETMBEGA1UEAwwKc2VjdG9ycS5ldTCC
-AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKTuAq0CKeyTRUz9N2nSyPL5
-MxCJZuKsFdiijjJBA0aVe7VN7sys3NYVr8A2FOpbUcWJiX3yDfPFBfIUaPubS+DR
-4O/LInT0gXBtuQZipzyyVugo2gr0WKN1Zl1lv0Jge0bwFuw4uZyZlDahF4NM4ee/
-1PZ0YgMYZNqTDfCrwy65cUIrw3AVNZQTdyYIodq2D5e3xhFO6DV4WgLskFzoN6TG
-yYMW7g1+meGrxSsx25MiDh3A6N8LeTyfmJgWL3dhLmpeoK2XkjljMe6G8pBaJm5A
-EGi8Hw6tIYtlP/E8CkWlTSTTK7RloLiy2kHaaHJNnAyjJk6N7QVJl4MBXXOj+OkF
-KbX/NUhwkXHeaqApBSTobJtPFeH1TVkEYKQ7rp/iFUHCQh8/C8v0O+SBV3TFNfS3
-IwVFbBAWQb0099ULlAqbgCViqSpsdVpg4hFr5R8FLpGSZ0dYIhgfTIdhd/4Ny9/C
-4ZyCbDyfmvxDoijINwvAwM9miPA4b1at4Irsw2jvrMxCMv+6keu0saDlPCw9f7O5
-AJGlpU9OSJ5UscSzbMOA1yiZsjI9+VCnQiaZ2Sb5U9yiLUWsz87kJed2X6Au61gP
-t8cKnCQgT+QFd6rkrxlRtMmECEWIOG6pVnk8iTQnMcnd/CtZUXTGA7plAv9FeXJD
-dmANM6qvXIszQP9FGBznAgMBAAGjUzBRMB0GA1UdDgQWBBTtSLVx7ddURGlWtSMl
-P9hjUvXA3TAfBgNVHSMEGDAWgBTtSLVx7ddURGlWtSMlP9hjUvXA3TAPBgNVHRMB
-Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4ICAQCVrHIOyr7GfX9BzAc9lcMpkhuX
-QvHesC45vEA6GSaLMT8CLe251Tag5qPAtf25aIM1ohcqLoqbjlTl51Ng3p9tow8t
-N+ITqmlJ71XxlI/3EcaZc+GwrOnwedH3XzuGS/Af6qXx5vaA0jvmkkuBvy3dQWld
-utOVBvpiYgepvYidDfpaeANfEz1UqerP4oTko5mFiKOgRjE+5/dodkWaTxjzVq6k
-LFaMuZt8h3CaolglmEAuepGJ1PBuwXE/V59Yxtj6ravxZ8Zsig11qve7MH6THIO2
-YaH/kB5CIniIsfikiDcNbuljiFdvp5Hx8hEcaCXSsZqNWxG0Ly/eRUJrMFZlW7+f
-yucbRIbGT9B3QjyOO9sojbeIjklS3fbPUSlAqMt+mTG74enGlrzrOrPN1QkO6Otc
-nZv+/u64VasO5C717n1zowquyWKKIvcUXzORxJZ26o1YiCxeJn5iRdeIyAeVSVHB
-Tzx3T/nbf9Vwvv5F1O3/5Dec3iQxhU3Tpr9QZ4bUHSjInKsdB71+TQzvsD9ep9Ok
-wD0C1Dvf5RMf8NBrIXh+Y4/Agn1UuPkfxzOxHUVWRIhJsWKtXkn3izffsq8Dg4jG
-xKkxPq4XZZW23pl08xId1u77VfXY5M55uycDQeU2Q/U/wM6F5Z9d3xsj+Ch4jbMV
-uUFBhdL6wpJ0oAps3A==
+AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJsXcxwOjZ3jBO3j7gps12vo
+zXmSNEoka5RiUvZlfopifwKVxFMzAJd/yoeaxiUBYKIlHgZ/OYu/+WkrwgpX2HO3
+2ZuB83Ym7P3TkTBhRp1S/HqBIb6aORGKhiuhZt6PNiCgqFszmb4Wl0Ox2cYxWYi5
+1DeHXNa5vRob2rSfsJwtamiksJkAsXclQu5dyfMv+cvc4Pob1o/DT76+xDpqT4lr
+pzXhpfXyT/xwtOEWku/53fccU0SBSSHPp6HzZUWHoodmHPigYYFEz1drYk1nDr3u
+gZq+nEQAVpcn1JrH7DuUaX/CrgBZNRdQ8d+mQ9EEDAQXNfzlH10ebfTjm2ol40cu
+9mwVJQ5Ru+h2xvfAlbcqnDTinXFgABuquSNzEz/1eJMIhm+myVOqF1WGeA/LnXGp
+OaNny7oQW8/9OLmpAZKIFzcD7KxvdBAu9IkO/KduqJohD8BBPqVAksan85bmEs8R
+Iu46XAJ7nmlX1DLchBtwvYv5MRdna73M52rTpNlmidWuiUeysZs8Nx7dGh1bd5I6
+9JnHcMl01UorQn0uitnO9zrOTEg0KkEmUZab1A2CbqeoYYLXi72Sva959faviXb0
+0HaPDtWuih9jQORu7fH7H6ghLFdfgUOp9am1hQpX1P7uXmUOB4iztMrh3bM8m2ZE
+HEvr+VfNkcq9KaAfXPhHAgMBAAGjUzBRMB0GA1UdDgQWBBTG6a566m85pq5bLi0O
+nC5y0pg6sjAfBgNVHSMEGDAWgBTG6a566m85pq5bLi0OnC5y0pg6sjAPBgNVHRMB
+Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4ICAQA5g9OxfcoAbYvi2T89E5205QkC
+ZxwWgrHIVGICeOF1K2nIypnddoJQUvMT/GYIK4QjZSWLGB2+YZMtXS+U/C9uxKOm
+d7bbzp437wUZwUJRtA4JZayxIitVTtzLYYLimb13GrsPs2KwGaZALe0K7dYzDwP1
+74gqOPvP7snDD98c6HV6vVXnTN+0T7djQyv/TqcyQ/IZjVY6JpsqgMg1rHqkYhDM
+Na7XBgwOt0Y4QmgS6EYEVv1+QsVB0U1tdH1oa+zwiyj5xDwVNmU5bLocEq3kYIRU
+tQUarNNKY4fMq529Heq7Ki63DLYTP8tJGh0Yijm9SFPqKYaZy6iL5xbdRFNCIFR/
+FnBZmRVxvPealAoIg9vutHkQrdqebBfX11PwWtLn+fkGTXq+5fBwjYllK04/MBk0
+SNjt6qwnOGZOc4gmEjthF4oVcVKoE7sVSCdgu/2jtLeJ48s0MwGhWZCk21ZgJbZY
+5gMahOiSndmudTo1ubFrqLb71MBTpqjiHTF2VLdxZEsrFCqeQAbsG+KmMuj+UhzV
+yuO3ycAGSDxsgbyHHYzjo2O5BvY35J7w1lZe1CExgoeeYFWlJ6t5PySf6OJupFit
+7FNwYgVXqC3+vwEWmbXz0WHwPh4aCvfSuNAHoiwX2UyzceYOWB5F4TmA2Chj23Ih
+isOdaq7ol1Q0iF9tjQ==
 -----END CERTIFICATE-----

roles/docker/files/server-cert.pem

@@ -1,32 +1,32 @@
 -----BEGIN CERTIFICATE-----
-MIIFmzCCA4OgAwIBAgIUIAmyLpdLLc9jLlk3yzZruYnzMDIwDQYJKoZIhvcNAQEL
+MIIFkDCCA3igAwIBAgIUUYzivwquTJnP+9/Q/zb/0Ew+eVowDQYJKoZIhvcNAQEL
 BQAwZDELMAkGA1UEBhMCU0sxETAPBgNVBAgMCFNsb3Zha2lhMQswCQYDVQQHDAJT
 SzETMBEGA1UECgwKc2VjdG9ycS5ldTELMAkGA1UECwwCSVQxEzARBgNVBAMMCnNl
-Y3RvcnEuZXUwHhcNMjUwMzE4MTcxOTA5WhcNMjYwMzE4MTcxOTA5WjAYMRYwFAYD
-VQQDDA1yYWNrLmhvbWUubGFuMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
-AgEA21urOCdoUPOBRqJBzEickOvhdQKCCTcbxHlxy80jR1PUDqmZeqPktKr0QCtf
-ntb0NH+/Ntiu3ZZBBkeyPfA50QIADmII5AbOHADszWEsKz9vhltFKpWQfsmU9H6U
-fPyHL0muqz32ujRZnQUIvQ5ekrH9ghLOhllOv+Rqbj5w6AjNYOxBuy0qgb7AZJCV
-zBjfSYm80pCY6RDU0C+v4X5TbyDAwNY5FAUfsFqpExHo9YbB2V9VNE2vW8mIy/Kg
-OZ9SfRhuFY5Gl1aEdQJUaAQe05oLvvkPPmOCv6CyEfJV5Esrnz2xludpIhET+eHu
-PXWvcvVCHPAO8HnGhqtYBmyOb8UVDgL07voXif+jtr/G31m+u4zeYrnvoe7u1U2X
-GeV97+yZafKTAD4c6kbja+ojH7JV5dwVIEmw4cSv+GWbM+JdrUskcl5Ku+vAUg/u
-RT/N6b98iWWhbwtbQkVzs4g93KWeu+416/p9DKUwT7OcKKvvc5Kxxk9Empkv5xtI
-ScABwb6YtGeVUE9CX+Xj5hHOc1zXEJ8t8PQwBKLTOd94H5I72AxjZZ+fF52ysp+w
-eGULuIYKbJI5yzIg6JYHhLR08YvGydBgbmymnejd7hGKnsNh2y5lizxBEdfqfMvw
-pAexpue3mh40dJS3c82tEo7YlsDQGwK2G/eK4k7rZDgQVpsCAwEAAaOBkDCBjTA2
-BgNVHREELzAtgg1yYWNrLmhvbWUubGFuhwTAqE1lhwTAqE03hwTAqE3uhwTAqE03
-hwR/AAABMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1UdDgQWBBSm0Th+Qn2nTOHq
-tqS7oIP+H/AhLjAfBgNVHSMEGDAWgBTtSLVx7ddURGlWtSMlP9hjUvXA3TANBgkq
-hkiG9w0BAQsFAAOCAgEAF3sZbSWnNj9X48kKtm/2btrBwC2cEg5x8pfb/orjNZmi
-47rXkLOzE0v09TO8+gFhKu6pR9SLmhTsgPRkGYolP4Bx889NMSzcoXTT18Vf6LTH
-LA3okzg4wI5uAa4OCAUJ78D9OJniJhdTamlCCw2r0TDxmf1Wc4ofWYlHuSolWetH
-MyhHjU8wp7BIG+we5CKwCQedDufrPLw9zBm7eLq9kBDUNifO0m0rJuYcnaxtGT/w
-AUFxKJ1xHNt0lqSYHpd1ljvJKXAeugN4iuoCBBuVuQHCTweeW6g4O7HPefB1cyCS
-HCUx4kKM95pPiMn0MwYPUZrP6sXsf+RPRHWROwZ/lwXcLlsmF177B7uEHqaAl66D
-5YQz0JtkAcpoglyHPYS4Z9NCEiPMNuT/xiHMESp5nBxWQk3lfg7GpwAgjNQ4uic+
-V1A5X9jTZg8qwfy1DSP33KWUgrS+uMFmJkPx6SA+2TksQkqTpr6ogS/aDgd9Sz7c
-QlA1yHUJ9Si3cP8w5y73Ih3mCUX/caq3eMCRqpK22BhShamZrUvoPESSywtCOVWq
-nzDAWZeRgFZIqAV54PFunJBd0S4yVeRkd4hgXWdEdIpbOXj3/zCY5Gl51QrymB4+
-WC4a8ZM3dTDwndCBN0p7+9Ol2YPRgv41C0vN55bib1wm2sTnQfs86ctST2ZXy28=
+Y3RvcnEuZXUwHhcNMjUwMzExMTc1MDEzWhcNMjYwMzExMTc1MDEzWjAcMRowGAYD
+VQQDDBFtLXNlcnZlci5ob21lLmxhbjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC
+AgoCggIBALcgqTwwWnKeiHt1ZZQjoyZw/c/DbPwQnBuQVhNGF6RX7apXP/eY4Sf8
+/l2y6awZd6vM4JyFonPENbll/dEVgFEPgwwiqiaBC9PuZIbC60LLYwpDUmaHXNAd
+xgohSWOEc7uT1lcW2yn5n1A93JpoOScb/dAmjWPUYV3BqnKTtcqVs3a5SzWxnIqO
+szWt97SZpRY3GWIAiOmFqcKE5gL7FkSaMyS81E/Qfct/37o5OHWpiBhzLZUyop1e
+z9f7RrgDRzEoNlJisWFY/wF0xvmowkslL8QsYBTkfgofP7dEm8MOn0hJOFzuUY75
+TAp+h6wiL0bhTab4XDOrFjFy5ivehICdDSal+IlNEmI9Zsziy/1gW7WXCMMgOXKn
+xX7se2OFbHGCaf9NCn+0ODHev9ZeDni5SQsgyD3Zjyh3kc7AZ97M8jNJlCGb2QaJ
+f/BF2Q9EzbQYHjor97r/+tMdvYkYNo9+FYoJH3yP+T378Tn+DFe8KthvbqCSF01t
+aDdfcRu0p+qNalVkD2rctohJgiEuhzVIIpfqe3P9yMyzBYgwoXMUIthug4wOo8gE
+Xwr7cgTTK8pxPQGlo1JL0WuBxodtdHP9/VQmf3Qkgj3W0UTAP3rphnvg/5S5tqIT
+P7W+HVjEzTEh2z2FGxz4lvEbo82FrhxnCrW+Gk/jhbY99Lr3SeetAgMBAAGjgYEw
+fzAoBgNVHREEITAfghFtLXNlcnZlci5ob21lLmxhbocEwKhN7ocEfwAAATATBgNV
+HSUEDDAKBggrBgEFBQcDATAdBgNVHQ4EFgQUOIy9QvfKWPuMGEp4C2yvjNO2uYsw
+HwYDVR0jBBgwFoAUxumueupvOaauWy4tDpwuctKYOrIwDQYJKoZIhvcNAQELBQAD
+ggIBAIJBsaPUjAApSDplyUGru6XnLL1UHjG+g49A12QIfgG9x2frRRhvAbx21121
+sCJ5/dvHJS/a8xppcNd4cMFrvLrOkZn6s+gfeXc20sMscdyjnjIbxdmDiUwnhoFT
++9OKg5BYokg11PmEOhMEK7L9qEXaf5L+9TdcxBl/qvciqSpZ9FsOGDYCgB0EMsQ/
+48/Tj/0ABF+c/+WVXzWL51Gdj6waM0qqXjGArbjAUA7ft8gy18n/6DyM3KWlZXCb
++mAwUGnOvHFNbb8jgxSDvFeIos0P6Edq0PDcK5k1uYEeATp0CC6/F3z1Eai2vKy+
+c1BbJZtDJmlKTL+7vykHMSVqAuN/Vq4uvtxv1pOCR1UJk1mW0mr6Ovm9sVVk5HFD
+3j6nOF81PiabdWA6GbbSCQdlpL2v0KipAR/sNheMwXAe+5NGJAiE5uaBgQSTVZS+
+7b4DDKFxfkHR9ISOGURgf9wRxqF6jNS4qqQp9+sOdK6y++ZVGRTTpQbCHEg9V79r
+TTGs4lbvaFCmF/Y9/NPSrRo//l+XhJrpjoeyx04iy6QipErCCFK2dHH5hYfS3ISt
+kbaw2ARNqbcktQkWwA+W+rb83en/w3WG1v2vByKGCr1s4jHAhWtSLZhXx+PIYeT+
+ml/kv+Y3W1T/lOcsytJrXug8t+g4nh9wYTnRl5YwruaKQjWF
 -----END CERTIFICATE-----

roles/docker/files/server-key.pem

@@ -1,52 +1,52 @@
 -----BEGIN PRIVATE KEY-----
-MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQDbW6s4J2hQ84FG
-okHMSJyQ6+F1AoIJNxvEeXHLzSNHU9QOqZl6o+S0qvRAK1+e1vQ0f7822K7dlkEG
-R7I98DnRAgAOYgjkBs4cAOzNYSwrP2+GW0UqlZB+yZT0fpR8/IcvSa6rPfa6NFmd
-BQi9Dl6Ssf2CEs6GWU6/5GpuPnDoCM1g7EG7LSqBvsBkkJXMGN9JibzSkJjpENTQ
-L6/hflNvIMDA1jkUBR+wWqkTEej1hsHZX1U0Ta9byYjL8qA5n1J9GG4VjkaXVoR1
-AlRoBB7Tmgu++Q8+Y4K/oLIR8lXkSyufPbGW52kiERP54e49da9y9UIc8A7wecaG
-q1gGbI5vxRUOAvTu+heJ/6O2v8bfWb67jN5iue+h7u7VTZcZ5X3v7Jlp8pMAPhzq
-RuNr6iMfslXl3BUgSbDhxK/4ZZsz4l2tSyRyXkq768BSD+5FP83pv3yJZaFvC1tC
-RXOziD3cpZ677jXr+n0MpTBPs5woq+9zkrHGT0SamS/nG0hJwAHBvpi0Z5VQT0Jf
-5ePmEc5zXNcQny3w9DAEotM533gfkjvYDGNln58XnbKyn7B4ZQu4hgpskjnLMiDo
-lgeEtHTxi8bJ0GBubKad6N3uEYqew2HbLmWLPEER1+p8y/CkB7Gm57eaHjR0lLdz
-za0SjtiWwNAbArYb94riTutkOBBWmwIDAQABAoICAGBqHsw8OfQWy3QF3mDRa4uh
-OgQJmak+QSSu8m8PF9oChPr63ZxTjDNCzr+jsNAqj8TBf4S2YcnAgI0nlzb1Lxxo
-QikQOvMq8I3LdEnjU5wgsj6+QBzzB0NLC/8Y4eA7yJlmy/C1eAwo9Vh4PXqHZdcZ
-h6ET7hWMDHp4hbU2Gb9LGyZmQY/pTr0fYAXzrPu71OzILyfn6WXLgZaN10MIGNkH
-7uDzZ7wecmq7toPMw/WjCPInnlYybQitgMSPvJAHMKUOR1iPJAThwK+DWiEr6na8
-Rzxl0SbtaysaERqlRs5koeRIpBV9Wi7gjcSv4ty9rOOc3DXG5/IXvEQ17KdKMKIs
-R1wWynxM2yR3mHi4btNpFthdZ7B3BhnliTcBRyWJWU8Zkd7pcM6AwOaA2vU7wb1c
-mvLGomtDhWf/ij/Ww8fWBmpj7yLuA5bOBCGHmCqS+ow4AUZANC6mc50GmZs4Llg0
-8CJgaynrdFKBhPbVZ/OoDK/d6yDostRx/PGReGjue1ly93sjNw16QeulHj8cWk3R
-LXNnQaDf1MCvoW7826Fzpzl/jLnB6q5CyLwdqToDtT46Zm8lGvrfb+2K0v0R3a2A
-qQLZZDoNzau8D7bjQctaHOUdIxYh1E1k+fdvyncWDOUPitNuaL9Li/usddNZKKvN
-hg3CDkxtUQdDKY6bTxo1AoIBAQD5nnGGHIhxzpYwjETl42+jM0JZywdV0zv+AQSZ
-AmQvHm2CNrr8FgdA6H1uX9iKvRShPlmvgun8mxKKZ4SFfCvqWwy1NVP0VCeZ6COX
-xSoAxO2P75j/HVZo4ZPtXrobj1t7wBllMv5YJCJL/pvNrNUeDaUmjp5oLRkGGIRA
-ZvDVmeMFNP/N0lKQfVaQ2Zr8HxvxADEtvq7Zr5YQzyNtpY80wEOpHYU1QXaf67va
-A/R90onbHxiSc8LYuPu9ltvzzwDaN4laYaxz4QemSPHSLfQoNKTrJ0th6h0+ElXt
-CUIaiZK/6RG2mgqk7X/CVFsbwRCCeegi+OgiTBjatrryGwXlAoIBAQDg9zE9ep4c
-HXJbIvEjhvv8HIoa7Jeb2Ktspqja9FZv8qn8o0e41fXnmdNkjeJPrEcUMyJrlGCG
-UlcIh8L5zdvr0Ja1epmcfJmOyfhyUwsovG3X9DlGjunKAfUaHEEozh8pd3p9MhAb
-Re/q6u5OU2MAChe8gjlD7ycPZcHhztqcoaVxg9KmozV5WSj/NWu5+o+o2PgwCbUi
-n5qEwVW9tY2qVmzmSTO/2ii4pM6SZpAGoyY4F0HR7GYYtX9JT8OiFTxVe9Qpl155
-ldFl2Mgf14kLZJqTmXBB+m3Ocujjn7HxLHoWc3q2Po3SDwpVeqQFtm1+0ap9e1XP
-6K2gXiYQYCJ/AoIBAENf0bJqFyXopb8azSnjlmlNV5ZW53bx2dp4Od52t8XEB7jC
-vvt1kqWhWuGkuxTPbjcLVje6NR+6V2nGAQ3qcwwBYU+zwiJLaJjxAFJhpDGq9ZgJ
-CpmpOH58jGngTIlNy1p+ghw/hEkUD7HFWhZMlQVUl4PtsLHbokpz6ZZccpqku5LX
-OEg8gY6AVhIoud1dJDSLYbrAIf+dlfqZfi2FJz8MufZ2glLahYMqpHx23tHrNsxO
-+1nkJu5KF6CXjGylLcy4erlLbbmlPmRSgfrB7om/k9fotj8KarQrTMf63L2+7j4g
-UWig8UiM1hQEosa9+I/PCaoO1tETCw5VjeX1B0UCggEANhByDvpW4R7airh9BzK7
-gD1Dm3DchqGtoPD0h5pM456H56U96VfSPxSizvmiN8+JTXt0fDIueFl1fSFTZEFq
-5uM8NOT/4bG4Ha7APIlklyehplKVKTXTTa7mvp2nsyzGJGsITuonIMbP/77yAnTb
-x/ik97K8HG1vD64+yAu0Ugwu/HbXuyBiC4W36o1mFE35FHUAQFs04ttEgT8NYggt
-wY//n+BbxXGic613z4tCdbXjy3sbYF3Vs3561p2KwHsmAs09kblFBSdSKY3Nmolr
-8Ab/dxVa+yA6H3FSMtIAK5uqw5aBGSczYhYnP5+3p3/OFLpCpOFtIAglIfM+ZpUT
-9QKCAQBoACOCu9VZtw+8C7avhw8nv/V+SFm2anK8Q5lOQiYo40ULklbqe+onzKJ3
-oNjl7iyXZSkTyq6wEdOsKhPr7HndRTTcH2O7mxKcdEWkMtJLlo3xlohqBQymAlQl
-GEOblCG6sC0SPnse+RrrtU4EsXaTIJsOCrcmWwYnqO8nItzEnzT1ifN9Xt0rwI9y
-7ZNAM1rvbVbm/uySCRf1slZWyHm+Dqr4oUNaZvTk6sFdlSs3emUzDb4mje9G3V86
-cXZNizURN4KA3+ADjCFPpQ6HO4rGNSqKKEEiW1aVPsCC0z0vxd1vY8taYVwL/B4p
-/dKUFh7pGk5UE/IXZWlBVDufNy/b
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQC3IKk8MFpynoh7
+dWWUI6MmcP3Pw2z8EJwbkFYTRhekV+2qVz/3mOEn/P5dsumsGXerzOCchaJzxDW5
+Zf3RFYBRD4MMIqomgQvT7mSGwutCy2MKQ1Jmh1zQHcYKIUljhHO7k9ZXFtsp+Z9Q
+PdyaaDknG/3QJo1j1GFdwapyk7XKlbN2uUs1sZyKjrM1rfe0maUWNxliAIjphanC
+hOYC+xZEmjMkvNRP0H3Lf9+6OTh1qYgYcy2VMqKdXs/X+0a4A0cxKDZSYrFhWP8B
+dMb5qMJLJS/ELGAU5H4KHz+3RJvDDp9ISThc7lGO+UwKfoesIi9G4U2m+FwzqxYx
+cuYr3oSAnQ0mpfiJTRJiPWbM4sv9YFu1lwjDIDlyp8V+7HtjhWxxgmn/TQp/tDgx
+3r/WXg54uUkLIMg92Y8od5HOwGfezPIzSZQhm9kGiX/wRdkPRM20GB46K/e6//rT
+Hb2JGDaPfhWKCR98j/k9+/E5/gxXvCrYb26gkhdNbWg3X3EbtKfqjWpVZA9q3LaI
+SYIhLoc1SCKX6ntz/cjMswWIMKFzFCLYboOMDqPIBF8K+3IE0yvKcT0BpaNSS9Fr
+gcaHbXRz/f1UJn90JII91tFEwD966YZ74P+UubaiEz+1vh1YxM0xIds9hRsc+Jbx
+G6PNha4cZwq1vhpP44W2PfS690nnrQIDAQABAoICAACEElRh8wKkg6xWkQULDMdi
+wWen/H85frbufBhkyQH3NWjErCMmwzJsMWi9EUkKGs7VWKgLv7uadY4q03XHhgmc
+GrAEwS6UaFmNgd5fmk3j1rHhUSIUyq8JNkbtIPr9bC+a6C/OuRYpE4o2V1zzPK1D
+HokafrNqxHGne/g8ASfgGcApH9C1MwR9bnyi6txmhRcDM7SiZ5JCDCGdgg11eirz
+45PvsAysg3ZfA4DAQOWn4defEj8NtO9kisbRKWBKosrrJmSWZ4fnd6F8TzSX/dO8
+MEEXUW7RJ7G0vviTnSeQNnjsZB+wQk84y3lRGDzvCVxR7cqLdaKjMD38zQdr1HiM
+IysiYw7aUQ8ukz+4I4izPmn/iDdTxNzTHSvaxCjKRqsaj9R3kEFqtVuOoInfwKD9
+iSoEI35IkEIJwhvnt/xfZY03HwI7JBvSgA23zM5L2dvuM0nwGVcn+/WkLcYRum2y
+hXRbpQ69dVTiFCxQG71bdcuK8z2lxXDPsyBjkcBta/WwQe8sHHdrszyc1Zf5DIDx
+341bQ0cJEZQJD5BmKNij6Ow0N9g/0vySAScKF1zM9J0fE/XBihNYIH9JCXPRrFqw
+BmUGmNjjyJSbnYMxjyVDz8g9026N+w23VtLv0UlA4hF3Hexupqol7XM+MhqNSFIO
+A+F8Ho9U38LZfA3yt8JpAoIBAQD00RQmllHGtRR2zsIA0LPMVUyV3DOshJ4XYj8a
+sN2rSU9rgNRB0rnpgWoGMAysOerPphvoY6bf1wrI3dFt5pzQMuKJLz6VFl135k5R
+11kxZfCmZC/pIp3WLkIHDthAXkU5IKnWw/4vQgmIwTZ5I7rNjPaJYuoH8z5Buuwi
+qUnEJj3czq4iNW2DHAFd657NQImrIbvN4T9SHLGrFBG3Bqf43xc/TMNqOnD7FcYe
++DIkBFXBFqx6pwMjP7hUwo88Oxzp7I/MaDXw9LnSPt2YQqdyNaaFiyk8JWc87LMq
+DFaXFh+aON9XFxvKfCQA5uNCwyaWMi8zNWLpFTPKuZPPaWR5AoIBAQC/fi5ReLUL
+HEpGgKw9UstgexmdnQLVisVfRH9eaQn/U6Yoo8XD0gpdjtqdA9dStV3jw9zKAoeP
+twg819A/nl+kavDP1bGxaxEou9BUFvxyqw0OrA1bKznNlcpCNpqShSiFVO/6CqaU
+awaDRuAsf4gs8/vKzw3q5bPErC+/a8x8USicOMc1tPrUxmTSwoXCfgtb+l7+7K48
+QeA27zPxaOCotAhef1T6KW1mYC7vP0ertZwiG+Lqoh9fzrun5TUYielqqrAJWPFC
+o12r6jqhr9a6dPZ0/ZBCK3JyvdYGt321P6yffA78sz0hvSqT9JMmNnZJSc6oOiuB
+qqutqzl/KgfVAoIBAQDoZWD/kEpompSmg3beVz+WhJKC39mdtvZrtDO7HpIOezUN
+E+pp4aPh6Zu/6/TbuM8R9tkfLRnH+tad/xNDhFrvuJ4bI+IAnI51twY54nck0WQ0
+T367jMTQAHFlSc42rEaCCGOxH7Q3IDT0wJT5QdWeMmYF3QPUMC+1Lb/i11jS/opT
+BU9/4b/nabpSccz5gn4tGYSx11TImbx+bjqyx3rEYOIskK4gNQHzF6RO2cSfNA5D
+kUaB1/C+kUpmC5r0zhiQZqPKolIyPd33mv23/+38GLnOo1+tXMQ3rWoWTEgWfEXb
+nIlGnwUeneF/ia3KPn5urYzoy5DtOddEZg3OInnhAoIBAGrVZ9v2PvMi5mFtGirg
+TSzXoNPpLBKc6D6dRX4TlgtHzNSxgf0c6sGFmHuvD+tJ2kbfGAfv31eTotnnAXzs
+y6k8LHuXWhqEhD84gSLY7CDBQ3ijDpSFiisjXYMRWa1S8udoGrZiSMtW5nxJB3pr
+8Do8KIbee4JIgsG/2qet6ZiV4tU9bA6PmL0qrkdTVTLMBWRcS7FntFFT41Zin5UY
+kPYt8tldqrgicrGCCc1afY7TtHbnHfMPXfeiq9kgrD2ze3ESJ0IfyAIIiJMIC4v3
+QRInfPSKHnh8Ks7PEGAQ8OY0zwbvPKFJElsHYYDIG2xfSCDdN5ltUqZ15G/wrhQ/
+C70CggEAHKhqoWElJNa3Ba4UscXKWL28cXRkMLdZGRngU5W9GLUQhDVYHdy+x5jU
+5V4OnhCFo4Vq8uc2HsKnknhu/KGJ2gf3g8ASkILCG6aqB+0xZ+N6/dW0Yfft7vV4
+az9azn2nEK6Pqiokm0ggc+UhZ4C6EKWY3Vefs0scxKBIx48aGDP0I/XwFrZpwdWC
+Z/jlCjTZlJ+5G7VenkqWtIlJmXZ6zrRFkPKlmxSTKIrDTJaD0dcNmDrwe+au0x+y
+YHMSo0gMN9W5pFN6LDc/JYXOkb995mkKXyzeRTFy+v2yFig6rSwBStwcSTsuNWAe
+FOWrzZPSFGNqLJEHjZdIBAaDR6ER7A==
 -----END PRIVATE KEY-----

roles/docker/tasks/main.yml

@@ -1,113 +1,165 @@
-- block:
-  - name: print arch
-    debug:
-      msg: "{{ ansible_architecture }}"
-  - name: Install docker
-    ansible.builtin.apt:
-      name: 
-        - ca-certificates
-        - curl 
-        - telnet
-        - net-tools
-        - python3-pip
-        - python3-dev
-      state: present
-      update_cache: true
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      install -m 0755 -d /etc/apt/keyrings
+- name: Setup docker
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Facts
+      ansible.builtin.setup:
 
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
-    when:
+    - name: Print arch
+      ansible.builtin.debug:
+        msg: "{{ ansible_architecture }}"
+    - name: Install docker dependencies
+      ansible.builtin.apt:
+        name:
+          - ca-certificates
+          - curl
+          - telnet
+          - net-tools
+          - python3-pip
+          - python3-dev
+        state: present
+        update_cache: true
+    - name: Get keys for raspotify
+      ansible.builtin.command:
+        install -m 0755 -d /etc/apt/keyrings
+
+
+    # - name: Add an Apt signing key to a specific keyring file
+    #   ansible.builtin.apt_key:
+    #     url: https://download.docker.com/linux/debian/gpg
+    #     keyring: /etc/apt/keyrings/docker.asc
+    #   when:
+    #     - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
+
+    # - name: Get keys for raspotify
+    #   ansible.builtin.shell:
+    #     curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
+    #   when:
+    #     - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
+
+    - name: Get keys for raspotify
+      ansible.builtin.shell:
+        curl -fsSL https://download.docker.com/linux/raspbian/gpg -o /etc/apt/keyrings/docker.asc
+      when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc     
-    when:
+
+    - name: Add an Apt signing key to a specific keyring file
+      ansible.builtin.apt_key:
+        url: https://download.docker.com/linux/ubuntu/gpg
+        keyring: /etc/apt/keyrings/docker.asc
+      when:
         - ansible_distribution == "Ubuntu"
 
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      chmod a+r /etc/apt/keyrings/docker.asc
+    # - name: Get keys for raspotify
+    #   ansible.builtin.shell:
+    #     curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+    #   when:
+    #     - ansible_distribution == "Ubuntu"
+    - name: Change file ownership, group and permissions
+      ansible.builtin.file:
+        path: /etc/apt/keyrings/docker.asc
+        owner: root
+        group: root
+        mode: '0644'
 
-  - name: Get keys for raspotify
-    ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
-    when:
+    # - name: Get keys for raspotify
+    #   ansible.builtin.shell:
+    #     chmod a+r /etc/apt/keyrings/docker.asc
+
+    - name: Get keys for raspotify
+      ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
+      when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
-  - name: Get keys for raspotify
-    ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
-    when:
-    - ansible_distribution == "Ubuntu"
-    
-  - name: Install docker
-    ansible.builtin.apt:
-      name: 
-        - docker-ce
-        - docker-ce-cli
-        - containerd.io
-        - docker-buildx-plugin
-        - docker-compose-plugin
-      update_cache: true
 
-  - name: Create a directory docker.service.d
-    ansible.builtin.file:
-      path: /etc/systemd/system/docker.service.d/
-      state: directory
-      mode: '0755'
-  - name: Create a directory for certs
-    ansible.builtin.file:
-      path: /etc/docker/certs
-      state: directory
-      mode: '0700'
-  - name: Copy files
-    copy:
-      src: server-key.pem
-      dest: /etc/docker/certs/
-  - name: Copy files
-    copy:
-      src: ca.pem
-      dest: /etc/docker/certs/
-  - name: Copy files
-    copy:
-      src: server-cert.pem
-      dest: /etc/docker/certs/      
-  - name: Creating a file with content
-    copy:
-      dest: "/etc/systemd/system/docker.service.d/override.conf"
-      content: |
-        [Service]
-        ExecStart=
-        ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify     --tlscacert=/etc/docker/certs/ca.pem     --tlscert=/etc/docker/certs/server-cert.pem     --tlskey=/etc/docker/certs/server-key.pem     -H=0.0.0.0:2376
-    notify: restart_docker
-    when:  mode == "nocert" 
-  - name: Creating a file with content
-    copy:
-      dest: "/etc/systemd/system/docker.service.d/override.conf"
-      content: |
-        [Service]
-        ExecStart=
-        ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify     --tlscacert=/etc/docker/certs/ca.pem     --tlscert=/etc/docker/certs/server-cert.pem     --tlskey=/etc/docker/certs/server-key.pem     -H=0.0.0.0:2376
-    notify: restart_docker
-    when:  mode != "nocert" 
+    - name: Get keys for raspotify
+      ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+      when:
+        - ansible_distribution == "Ubuntu"
 
-  - name: Just force systemd to reread configs
-    ansible.builtin.systemd:
-      daemon_reload: true
+    - name: Install docker
+      ansible.builtin.apt:
+        name:
+          - docker-ce
+          - docker-ce-cli
+          - containerd.io
+          - docker-buildx-plugin
+          - docker-compose-plugin
+        update_cache: true
 
-  - name: Restart docker service
-    ansible.builtin.service:
-      name: docker
-      state: restarted
+    - name: Create a directory docker.service.d
+      ansible.builtin.file:
+        path: /etc/systemd/system/docker.service.d/
+        state: directory
+        mode: '0755'
+    - name: Create a directory for certs
+      ansible.builtin.file:
+        path: /etc/docker/certs
+        state: directory
+        mode: '0700'
+        owner: root
+        group: root
 
-  # - name: Get keys for raspotify
-  #   ansible.builtin.shell: docker plugin install grafana/loki-docker-driver:3.3.2-{{ ansible_architecture }} --alias loki --grant-all-permissions
-  - name: Install a plugin
-    community.docker.docker_plugin:
-      plugin_name: grafana/loki-docker-driver:3.3.2
-      alias: loki
-      state: present
+    - name: Copy files
+      ansible.builtin.copy:
+        src: server-key.pem
+        dest: /etc/docker/certs/
+        mode: '0600'
+        owner: root
+        group: root
+    - name: Copy files
+      ansible.builtin.copy:
+        src: ca.pem
+        dest: /etc/docker/certs/
+        mode: '0600'
+        owner: root
+        group: root
+    - name: Copy files
+      ansible.builtin.copy:
+        src: server-cert.pem
+        dest: /etc/docker/certs/
+        mode: '0600'
+        owner: root
+        group: root
+    - name: Creating a file with content
+      ansible.builtin.copy:
+        dest: "/etc/systemd/system/docker.service.d/override.conf"
+        content: |
+          [Service]
+          ExecStart=
+          ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
+        mode: '0600'
+        owner: root
+        group: root
+      notify: restart_docker
+      when: mode == "cert"
 
+    # - name: Creating a file with content
+    #   ansible.builtin.copy:
+    #     dest: "/etc/systemd/system/docker.service.d/override.conf"
+    #     content: |
+    #       [Service]
+    #       ExecStart=
+    #       ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify \
+    #       --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem \
+    #       --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
+    #     mode: '0600'
+    #     owner: root
+    #     group: root
+    #   notify: restart_docker
+    #   when: mode != "nocert"
 
-  become: true
+    - name: Just force systemd to reread configs
+      ansible.builtin.systemd:
+        daemon_reload: true
+
+    - name: Restart docker service
+      ansible.builtin.service:
+        name: docker
+        state: restarted
+
+    # - name: Get keys for raspotify
+    #   ansible.builtin.shell: docker plugin install grafana/loki-docker-driver:3.3.2-{{ ansible_architecture }} --alias loki --grant-all-permissions
+    - name: Install a plugin
+      community.docker.docker_plugin:
+        plugin_name: grafana/loki-docker-driver:3.3.2
+        alias: loki
+        state: present

roles/fail2ban/tasks/main.yml

@@ -1,41 +1,51 @@
-- block:
-  - name: Install fail2ban packages
-    ansible.builtin.apt:
-      name: 
-        - fail2ban
-        - sendmail
-#add line  to /etc/hosts  
-#127.0.0.1 m-server localhost....
-  - name: Copy files
-    copy:
-      src: "{{ item }}"
-      dest: /etc/fail2ban/jail.d/
-    with_fileglob:
-      - "jail.d/*.conf"
+- name: Setup Fail2ban
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Install fail2ban packages
+      ansible.builtin.apt:
+        name:
+          - fail2ban
+          - sendmail
+  # add line  to /etc/hosts
+  # 127.0.0.1 m-server localhost....
+    - name: Copy files
+      ansible.builtin.copy:
+        src: "{{ item }}"
+        dest: /etc/fail2ban/jail.d/
+        mode: '0700'
+        owner: root
+        group: root
+      with_fileglob:
+        - "jail.d/*.conf"
 
-  - name: Copy files
-    copy:
-      src: "{{ item }}"
-      dest: /etc/fail2ban/filter.d/
-    with_fileglob:
-      - "filter.d/*.conf"
+    - name: Copy files
+      ansible.builtin.copy:
+        src: "{{ item }}"
+        dest: /etc/fail2ban/filter.d/
+        mode: '0700'
+        owner: root
+        group: root
+      with_fileglob:
+        - "filter.d/*.conf"
 
-  - name: Copy files
-    copy:
-      src: "{{ item }}"
-      dest: /etc/fail2ban/action.d/
-    with_fileglob:
-      - "action.d/*.conf"
+    - name: Copy files
+      ansible.builtin.copy:
+        src: "{{ item }}"
+        dest: /etc/fail2ban/action.d/
+        mode: '0700'
+        owner: root
+        group: root
+      with_fileglob:
+        - "action.d/*.conf"
 
-  - name: disable sendmail service
-    ansible.builtin.service:
-      name: sendmail.service
-      state: stopped
-      enabled: false
+    - name: Disable sendmail service
+      ansible.builtin.service:
+        name: sendmail.service
+        state: stopped
+        enabled: false
 
-  - name: Restart fail2ban service
-    ansible.builtin.service:
-      name: fail2ban.service
-      state: restarted
-      enabled: true
-  become: true
+    - name: Restart fail2ban service
+      ansible.builtin.service:
+        name: fail2ban.service
+        state: restarted
+        enabled: true

roles/hosts/tasks/main.yml

@@ -0,0 +1,28 @@
+- name: Hosts
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Reconfigure hosts file
+      ansible.builtin.lineinfile:
+        path: "/etc/hosts"
+        regexp: "^192.168.77.101 .*"
+        line: "192.168.77.101 m-server m-server.home.lan"
+    - name: Reconfigure hosts file
+      ansible.builtin.lineinfile:
+        path: "/etc/hosts"
+        regexp: "^192.168.77.106 .*"
+        line: "192.168.77.106 nas nas.home.lan"
+    - name: Reconfigure hosts file
+      ansible.builtin.lineinfile:
+        path: "/etc/hosts"
+        regexp: "^192.168.77.238 .*"
+        line: "192.168.77.238 rpi5 rpi5.home.lan"
+    - name: Reconfigure hosts file
+      ansible.builtin.lineinfile:
+        path: "/etc/hosts"
+        regexp: "^192.168.77.4 .*"
+        line: "192.168.77.4 amd amd.home.lan"
+    - name: Reconfigure hosts file
+      ansible.builtin.lineinfile:
+        path: "/etc/hosts"
+        regexp: "^192.168.77.55 .*"
+        line: "192.168.77.55 rack rack.home.lan"

roles/loki-agent/tasks/main.yml

@@ -1,20 +0,0 @@
-- block:
-  - name: Get keys
-    ansible.builtin.shell: curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
-  - name: Add repo
-    ansible.builtin.shell: echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
-  - name: Update cache
-    ansible.builtin.apt:
-      update_cache: true
-  - name: Instal wazuh
-    ansible.builtin.apt:
-      name: wazuh-agent
-    environment:
-      WAZUH_MANAGER: 'm-server.home.lan'
-      WAZUH_AGENT_NAME: "{{ inventory_hostname }}"
-  - name: Restart wazuh service
-    ansible.builtin.service:
-      name: wazuh-agent
-      state: restarted
-      enabled: true
-  become: true

roles/loki-agent/vars/main.yml

@@ -1 +0,0 @@
-ZABBIX_SERVER: "zabbix.home.lan"

roles/matter-server/tasks/main.yml

@@ -1,10 +1,12 @@
-- block:
-  - name: Reconfigure config
-    ansible.builtin.lineinfile:
-      path: /etc/sysctl.conf
-      regexp: "^Unet.ipv4.igmp_max_memberships.*"
-      line: "net.ipv4.igmp_max_memberships = 80"
-  - name: Restart agent
-    ansible.builtin.shell: echo 80 > /proc/sys/net/ipv4/igmp_max_memberships
-    notify: restart_matter_server
-  become: true
+- name: Setup matter server
+  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
+  block:
+    - name: Reconfigure config
+      ansible.builtin.lineinfile:
+        path: /etc/sysctl.conf
+        regexp: "^Unet.ipv4.igmp_max_memberships.*"
+        line: "net.ipv4.igmp_max_memberships = 80"
+    - name: Restart agent
+      ansible.builtin.shell: echo 80 > /proc/sys/net/ipv4/igmp_max_memberships
+      notify: restart_matter_server
+      changed_when: my_output.rc != 0

roles/monitoring/tasks/main.yml

@@ -2,7 +2,7 @@
   ansible.builtin.set_fact:
     zabbix_agent_cfg: "/etc/zabbix/zabbix_agent2.conf"
   when: inventory_hostname != 'nas.home.lan'
-  
+
 - name: Get config for nas
   ansible.builtin.set_fact:
     zabbix_agent_cfg: "/opt/ZabbixAgent/etc/zabbix_agentd.conf"
@@ -29,42 +29,43 @@
   become: true
 - name: Install a .deb package from the internet2
   ansible.builtin.apt:
-    #deb: https://repo.zabbix.com/zabbix/6.4/raspbian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian11_all.deb
+    # deb: https://repo.zabbix.com/zabbix/6.4/raspbian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian11_all.deb
     deb: https://repo.zabbix.com/zabbix/7.0/raspbian/pool/main/z/zabbix-release/zabbix-release_7.0-1+debian11_all.deb
   retries: 5
   delay: 5
   when:
     - ansible_facts.architecture == "armv7l" or ansible_facts.architecture == "aarch64"
   become: true
-  ignore_errors: true
+  failed_when: my_output.rc != 0
 
 - name: Install a .deb package from the internet3
   ansible.builtin.apt:
     deb: https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian11_all.deb
-  become: true  
+  become: true
   when:
     - ansible_facts.architecture != "armv7l"  and ansible_distribution == "Debian"  and ansible_distribution_major_version  == "11"
-  
+
 - name: Install a .deb package from the internet4
   ansible.builtin.apt:
-    #deb: https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian12_all.deb
+    # deb: https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian12_all.deb
     deb: https://repo.zabbix.com/zabbix/7.2/debian/pool/main/z/zabbix-release/zabbix-release_7.2-1+debian12_all.deb
   when:
-    - ansible_facts.architecture != "armv7l" and  ansible_facts.architecture != "aarch64" and ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
-  ignore_errors: true
+    - ansible_facts.architecture != "armv7l"
+    - ansible_facts.architecture != "aarch64"
+    - ansible_distribution == "Debian"
+    - ansible_distribution_major_version  == "12"
+  failed_when: my_output.rc != 0
   become: true
-# - name: Install a .deb package localy
-#   ansible.builtin.apt:
-#     deb: /tmp/zabbix-release_6.4-1+ubuntu22.04_all.deb
+
 - name: Install zabbix packages
   ansible.builtin.apt:
-    name: 
+    name:
       - zabbix-agent2
       - zabbix-agent2-plugin-mongodb
       - zabbix-agent2-plugin-postgresql
-    update_cache: yes
+    update_cache: false
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
-  ignore_errors: true
+  failed_when: my_output.rc != 0
   when: inventory_hostname != 'nas.home.lan'
 
 - name: Reconfigure zabbix agent Server
@@ -99,14 +100,14 @@
     regexp: "^Hostname=.*"
     line: "Hostname={{ inventory_hostname }}"
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
-  
+
 - name: Reconfigure zabbix-agent2 config
   ansible.builtin.lineinfile:
     path: "{{ zabbix_agent_cfg }}"
     insertafter: '^# UserParameter='
     regexp: "^UserParameter=system.certs.*"
     line: "UserParameter=system.certs,python3 /share/ZFS530_DATA/.qpkg/ZabbixAgent/cert_check2.py"
-  when: inventory_hostname == 'nas.home.lan' 
+  when: inventory_hostname == 'nas.home.lan'
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
 
 - name: Reconfigure zabbix-agent2 config
@@ -115,7 +116,7 @@
     insertafter: '^# UserParameter='
     regexp: "^UserParameter=system.certs.*"
     line: "UserParameter=system.certs,python3 /usr/bin/cert_check2.py"
-  when: inventory_hostname == 'm-server.home.lan' 
+  when: inventory_hostname == 'm-server.home.lan'
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
 
 - name: Reconfigure zabbix-agent2 config
@@ -140,14 +141,14 @@
     regexp: "^HostMetadata=.*"
     insertafter: '^# HostMetadata='
     line: "HostMetadata=server;jaydee"
-  when: inventory_hostname == 'nas.home.lan' or inventory_hostname == 'm-server.home.lan' 
+  when: inventory_hostname == 'nas.home.lan' or inventory_hostname == 'm-server.home.lan'
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
 
 - name: Add the user 'to group video
   ansible.builtin.user:
     name: zabbix
     groups: video
-    append: yes
+    append: true
   when: inventory_hostname != 'nas.home.lan'
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
 
@@ -160,6 +161,8 @@
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
 
 - name: Restart agent
-  ansible.builtin.shell: /etc/init.d/ZabbixAgent.sh restart
+  ansible.builtin.command: /etc/init.d/ZabbixAgent.sh restart
   when: inventory_hostname == 'nas.home.lan'
-  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  changed_when: my_output.rc != 0
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  

roles/mqtt-srv/tasks/main.yml

@@ -1,116 +1,146 @@
-- block:
-  - name: include vault
-    ansible.builtin.include_vars:
-      file: jaydee.yml
-  - name: Delete content & directory
-    ansible.builtin.file:
-      state: absent
-      path: "{{ dest_folder }}"
-  - name: GIT pull
-    tags:
-      - git_pull
-    git:
-      repo: "https://{{ git_user | urlencode }}:{{ git_password_mqtt | urlencode }}@gitlab.sectorq.eu/jaydee/mqtt_srv.git"
-      dest: "{{ dest_folder }}"
-      update: yes
-      clone: yes
-      version: main
-  - debug:
-      msg: "{{ inventory_hostname }}"
+- name: Setup mqtt_srv
+  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
+  block:
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: jaydee.yml
+    - name: Delete content & directory
+      ansible.builtin.file:
+        state: absent
+        path: "{{ dest_folder }}"
+    - name: GIT pull
+      tags:
+        - git_pull
+      ansible.builtin.git:
+        repo: "https://{{ git_user | urlencode }}:{{ git_password_mqtt | urlencode }}@gitlab.sectorq.eu/jaydee/mqtt_srv.git"
+        dest: "{{ dest_folder }}"
+        update: true
+        clone: true
+        version: main
+    - name: Print message
+      ansible.builtin.debug:
+        msg: "{{ inventory_hostname }}"
+    - name: Create dir
+      ansible.builtin.file:
+        path: /etc/mqtt_srv/
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+    - name: Create dir
+      ansible.builtin.file:
+        path: /myapps/mqtt_srv/
+        recurse: true
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+    - name: Upload service config
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/mqtt_srv.service"
+        dest: /etc/systemd/system/mqtt_srv.service
+        remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'
 
-  - name: Upload service config
-    ansible.builtin.copy:
-      src: "{{ dest_folder }}/mqtt_srv.service"
-      dest: /etc/systemd/system/mqtt_srv.service
-      remote_src: true
-    when: inventory_hostname != 'nas.home.lan' 
-
-  - name: Upload service script
-    ansible.builtin.copy:
-      src: "{{ dest_folder }}/mqtt_srv.py"
-      dest: /usr/bin/mqtt_srv.py
-      mode: '755'
-      owner: root
-      remote_src: true
-    when: inventory_hostname != 'nas.home.lan'
-    
-  - name: Upload service script config
-    ansible.builtin.copy:
-      src: "{{ dest_folder }}/mqtt_srv.cfg"
-      dest: /etc/mqtt_srv/mqtt_srv.cfg
-      mode: '755'
-      owner: root
-      remote_src: true
-    when: inventory_hostname != 'nas.home.lan'
-
-    
-  # - name: Upload service script1
-  #   ansible.builtin.copy:
-  #     src: scripts/mqtt_srv.sh
-  #     dest: /jffs/scripts/mqtt_srv/
-  #     mode: '755'
-  #     owner: admin
-  #   when: inventory_hostname in groups['router']
-  #   become: false
+    - name: Upload service script
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/mqtt_srv.py"
+        dest: /myapps/mqtt_srv/mqtt_srv.py
+        mode: '0755'
+        owner: root
+        group: root
+        remote_src: true
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Upload service req
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/requirements.txt"
+        dest: /myapps/mqtt_srv/requirements.txt
+        mode: '0755'
+        owner: root
+        group: root
+        remote_src: true
+      when: inventory_hostname != 'nas.home.lan'
 
 
-  # - name: Upload service script
-  #   ansible.builtin.copy:
-  #     src: scripts/mqtt_srv.py
-  #     dest: /jffs/scripts/mqtt_srv/
-  #     mode: '755'
-  #     owner: admin
-  #   when: inventory_hostname in groups['router']
-  #   become: false
+    - name: Upload service script config
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/mqtt_srv.cfg"
+        dest: /etc/mqtt_srv/mqtt_srv.cfg
+        mode: '755'
+        owner: root
+        remote_src: true
+      when: inventory_hostname != 'nas.home.lan'
 
-  - name: Upload service script1
-    ansible.builtin.copy:
-      src: "{{ dest_folder }}/mqtt_srv.sh"
-      dest: /etc/init.d/
-      mode: '755'
-      owner: admin
-      remote_src: true
-    when: inventory_hostname == 'nas.home.lan'
-
-  - debug:
-      msg: "{{ dest_folder }}"
-  - name: Upload service script2
-    ansible.builtin.copy:
-      src: "{{ dest_folder }}/mqtt_srv.py"
-      dest: /usr/bin/mqtt_srv.py
-      mode: '755'
-      owner: admin
-      remote_src: true
-    when: inventory_hostname == 'nas.home.lan'
-
-  - name: Install bottle python package
-    ansible.builtin.shell: pip  install {{ item }}  --break-system-packages
-    loop:
-      - paho-mqtt
-      - getmac
-      - ping3
-      - psutil
-      - autorandr
-    when: inventory_hostname != 'nas.home.lan'
-
-  - name: Just force systemd to reread configs (2.4 and above)
-    ansible.builtin.systemd:
-      daemon_reload: true
-    when: inventory_hostname != 'nas.home.lan'
+    # - name: Upload service script1
+    #   ansible.builtin.copy:
+    #     src: scripts/mqtt_srv.sh
+    #     dest: /jffs/scripts/mqtt_srv/
+    #     mode: '755'
+    #     owner: admin
+    #   when: inventory_hostname in groups['router']
+    #   become: false
 
 
+    # - name: Upload service script
+    #   ansible.builtin.copy:
+    #     src: scripts/mqtt_srv.py
+    #     dest: /jffs/scripts/mqtt_srv/
+    #     mode: '755'
+    #     owner: admin
+    #   when: inventory_hostname in groups['router']
+    #   become: false
 
-  - name: Restart mqtt_srv service
-    ansible.builtin.service:
-      name: mqtt_srv.service
-      state: restarted
-      enabled: true
-    when: inventory_hostname != 'nas.home.lan'
+    # - name: Upload service script1
+    #   ansible.builtin.copy:
+    #     src: "{{ dest_folder }}/mqtt_srv.sh"
+    #     dest: /etc/init.d/
+    #     mode: '755'
+    #     owner: admin
+    #     remote_src: true
+    #   when: inventory_hostname == 'nas.home.lan'
 
-  - name: Restart mqtt service
-    ansible.builtin.shell: "(/etc/init.d/mqtt_srv.sh restart >/dev/null 2>&1 &)"
-    async: 10
-    poll: 0
-    when: inventory_hostname == 'nas.home.lan'
+    - name: Print message
+      ansible.builtin.debug:
+        msg: "{{ dest_folder }}"
 
-  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
+    - name: Upload service script2
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/mqtt_srv.py"
+        dest: /myapps/mqtt_srv/mqtt_srv.py
+        mode: '755'
+        owner: admin
+        remote_src: true
+      when: inventory_hostname == 'nas.home.lan'
+
+    - name: Install venv
+      ansible.builtin.apt:
+        name:
+          - python3-virtualenv
+
+    - name: Install specified python requirements in indicated (virtualenv)
+      ansible.builtin.pip:
+        requirements: /myapps/mqtt_srv/requirements.txt
+        virtualenv: /myapps/mqtt_srv/venv
+      when: inventory_hostname != 'nas.home.lan'
+
+    - name: Just force systemd to reread configs (2.4 and above)
+      ansible.builtin.systemd:
+        daemon_reload: true
+      when: inventory_hostname != 'nas.home.lan'
+
+    - name: Restart mqtt_srv service
+      ansible.builtin.service:
+        name: mqtt_srv.service
+        state: restarted
+        enabled: true
+      when: inventory_hostname != 'nas.home.lan'
+
+    - name: Restart mqtt service
+      ansible.builtin.shell: "(/etc/init.d/mqtt_srv.sh restart >/dev/null 2>&1 &)"
+      async: 10
+      poll: 0
+      when: inventory_hostname == 'nas.home.lan'
+      changed_when: my_output.rc != 0

roles/omv_backup/files/omv_backup.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Enable OMV backup
+
+[Service]
+ExecStart = nohup /myapps/omv_backup.py -b > /dev/null  2>&1 &
+
+[Install]
+WantedBy=basic.target

roles/omv_backup/tasks/main.yml

@@ -1,109 +1,91 @@
-- block:
-  - name: include vault
-    ansible.builtin.include_vars:
-      file: jaydee.yml
-  - name: Delete content & directory
-    ansible.builtin.file:
-      state: absent
-      path: "{{ dest_folder }}"
-  - name: GIT pull
-    tags:
-      - git_pull
-    git:
-      repo: "https://{{ git_user | urlencode }}:{{ git_password_mqtt | urlencode }}@gitlab.sectorq.eu/jaydee/omv_backup.git"
-      dest: "{{ dest_folder }}"
-      update: yes
-      clone: yes
-      version: main
-  - debug:
-      msg: "{{ inventory_hostname }}"
-  - name: Create a directory if it does not exist
-    ansible.builtin.file:
-      path: /myapps
-      state: directory
-      mode: '0755'
-      owner: root
-      group: root
+- name: Omv Setup
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: jaydee.yml
+        name: mysecrets
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Delete content & directory
+      ansible.builtin.file:
+        state: absent
+        path: "{{ dest_folder }}"
+    - name: Pull repo
+      tags:
+        - git_pull
+      ansible.builtin.git:
+        repo: "https://{{ mysecrets['git_user'] | urlencode }}:{{ mysecrets['git_password_mqtt'] | urlencode }}@gitlab.sectorq.eu/jaydee/omv_backup.git"
+        dest: "{{ dest_folder }}"
+        update: true
+        clone: true
+        version: main
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Print
+      ansible.builtin.debug:
+        msg: "{{ inventory_hostname }}"
+    - name: Create a directory if it does not exist
+      ansible.builtin.file:
+        path: /myapps
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'
 
-  - name: Upload script
-    ansible.builtin.copy:
-      src: "{{ dest_folder }}/omv_backup_v3.py"
-      dest: /myapps/omv_backup.py
-      remote_src: true
-      mode: '0755'
-      owner: root
-      group: root
-    when: inventory_hostname != 'nas.home.lan' 
-  - name: Upload script
-    ansible.builtin.copy:
-      src: "{{ dest_folder }}/omv_backup_v3.py"
-      dest: /myapps/omv_backup.py
-      remote_src: true
-      mode: '0755'
-      owner: root
-      group: root
-    when: inventory_hostname != 'nas.home.lan' 
-  - name: Upload script
-    ansible.builtin.copy:
-      src: "{{ dest_folder }}/docker_backups.py"
-      dest: /myapps/docker_backups.py
-      remote_src: true
-      mode: '0755'
-      owner: root
-      group: root
-    when: inventory_hostname != 'nas.home.lan'
-  - name: Upload requirements
-    ansible.builtin.copy:
-      src: "{{ dest_folder }}/requirements.txt"
-      dest: /myapps/requirements.txt
-      remote_src: true
-    when: inventory_hostname != 'nas.home.lan' 
+    - name: Upload script
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/omv_backup.py"
+        dest: /myapps/omv_backup.py
+        remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'
 
-  - name: Install venv
-    ansible.builtin.apt:
-      name: 
-        - python3-virtualenv
 
-  - name: Install specified python requirements in indicated (virtualenv)
-    ansible.builtin.pip:
-      requirements: /myapps/requirements.txt
-      virtualenv: /myapps/venv
+    - name: Upload requirements
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/requirements.txt"
+        dest: /myapps/requirements.txt
+        remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'
 
-  - name: 'Ensure an old job is no longer present. Removes any job that is prefixed by "#Ansible: an old job" from the crontab'
-    ansible.builtin.cron:
-      name: "omv_backup"
-      state: absent
+    - name: Install venv
+      ansible.builtin.apt:
+        name:
+          - python3-virtualenv
 
-  # - name: Ensure a job that runs at 2 and 5 exists. Creates an entry like "0 5,2 * * ls -alh > /dev/null"
-  #   ansible.builtin.cron:
-  #     name: "omv_backup"
-  #     minute: "0"
-  #     hour: "8"
-  #     job: "/myapps/venv/bin/python3 /myapps/omv_backup.py -b > /dev/null  2>&1 &"
-  
-  - name: Creating config
-    ansible.builtin.copy:
-      dest: "/etc/systemd/system/omv_backup.service"
-      content: |
-        [Unit]
-        Description=Enable OMV backup
+    - name: Install specified python requirements in indicated (virtualenv)
+      ansible.builtin.pip:
+        requirements: /myapps/requirements.txt
+        virtualenv: /myapps/venv
 
-        [Service]
-        ExecStart = nohup /myapps/venv/bin/python3 /myapps/omv_backup.py -b > /dev/null  2>&1 &
-
-        [Install]
-        WantedBy=basic.target
-      owner: root
-      mode: '0744'
-    when: inventory_hostname == 'amd.home.lan' 
-
-  - name: Restart service omv_backup, in all cases
-    ansible.builtin.service:
-      name: omv_backup
-      state: restarted
-      enabled: true
-    # async: 
-    # poll: 0
-    # ignore_errors: true
-    when: inventory_hostname == 'amd.home.lan' 
-  become: true
+    - name: 'Ensure an old job is no longer present. Removes any job that is prefixed by "#Ansible: an old job" from the crontab'
+      ansible.builtin.cron:
+        name: "omv_backup"
+        state: absent
+    - name: Upload service config
+      ansible.builtin.copy:
+        src: omv_backup.service
+        dest: /etc/systemd/system/omv_backup.service
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname == 'amd.home.lan'
+    - name: Restart omv service
+      ansible.builtin.service:
+        name: omv_backup
+        state: restarted
+        daemon_reload: true
+        enabled: true
+      when: inventory_hostname == 'amd.home.lan'
+    # - name: Ensure a job that runs at 2 and 5 exists. Creates an entry like "0 5,2 * * ls -alh > /dev/null"
+    #   ansible.builtin.cron:
+    #     name: "omv_backup"
+    #     minute: "0"
+    #     hour: "8"
+    #     job: "sudo /myapps/omv_backup.py -b > /dev/null  2>&1 &"
+    #     state: present

roles/prevent_policy/tasks/main.yml

@@ -1,12 +1,15 @@
-- block:
-  - name: Creating a file with content
-    copy:
-      dest: "/etc/polkit-1/rules.d/50_disable_pol.rules"
-      content: |
-        polkit.addRule(function(action, subject) {
-          if (action.id == "org.freedesktop.NetworkManager.wifi.scan") {
-              return polkit.Result.YES;
-          }
-        });
+- name: Setup policies
   become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
-    
+  block:
+    - name: Creating a file with content
+      ansible.builtin.copy:
+        dest: "/etc/polkit-1/rules.d/50_disable_pol.rules"
+        content: |
+          polkit.addRule(function(action, subject) {
+            if (action.id == "org.freedesktop.NetworkManager.wifi.scan") {
+                return polkit.Result.YES;
+            }
+          });
+        mode: '0644'
+        owner: root
+        group: root

roles/promtail/tasks/main.yml

@@ -1,68 +1,76 @@
 ---
-- block:
-  - name: Create dir
-    ansible.builtin.file:
-      path: /etc/apt/keyrings/
-      owner: root
-      group: root
+- name: Promtail
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Create dir
+      ansible.builtin.file:
+        path: /etc/apt/keyrings/
+        owner: root
+        group: root
+    - name: Create Banner
+      ansible.builtin.shell: wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor > /etc/apt/keyrings/grafana.gpg
+      register: my_output
+      changed_when: my_output.rc != 0
+  # - name: < Fetch file that requires authentication.
+  #         username/password only available since 2.8, in older versions you need to use url_username/url_password
+  #   ansible.builtin.get_url:
+  #     url: https://apt.grafana.com/gpg.key
+  #     dest: /etc/foo.conf
+  #     username: bar
+  #     password: '{{ mysecret }}'
+  #   changed_when: my_output.rc != 0
 
-  - name: Create Banner
-    ansible.builtin.shell: wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor > /etc/apt/keyrings/grafana.gpg
-    register: my_output
-    changed_when: my_output.rc != 0
+    - name: Create Banner
+      ansible.builtin.shell: echo "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main" | tee /etc/apt/sources.list.d/grafana.list
+      register: my_output
+      changed_when: my_output.rc != 0
 
-  - name: Create Banner
-    ansible.builtin.shell: echo "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main" | tee /etc/apt/sources.list.d/grafana.list
-    register: my_output
-    changed_when: my_output.rc != 0
+    - name: Install packages
+      ansible.builtin.apt:
+        name:
+          - promtail
+        update_cache: true
 
-  - name: Install packages
-    ansible.builtin.apt:
-      name:
-        - promtail
-      update_cache: true
+    - name: Creating a file with content
+      ansible.builtin.copy:
+        dest: "/etc/promtail/config.yml"
+        owner: root
+        group: root
+        mode: '0644'
+        content: |
+          # This minimal config scrape only single log file.
+          # Primarily used in rpm/deb packaging where promtail service can be started during system init process.
+          # And too much scraping during init process can overload the complete system.
+          # https://github.com/grafana/loki/issues/11398
 
-  - name: Creating a file with content
-    ansible.builtin.copy:
-      dest: "/etc/promtail/config.yml"
-      owner: root
-      group: root
-      mode: '0644'
-      content: |
-        # This minimal config scrape only single log file.
-        # Primarily used in rpm/deb packaging where promtail service can be started during system init process.
-        # And too much scraping during init process can overload the complete system.
-        # https://github.com/grafana/loki/issues/11398
+          server:
+            http_listen_port: 9080
+            grpc_listen_port: 0
 
-        server:
-          http_listen_port: 9080
-          grpc_listen_port: 0
+          positions:
+            filename: /tmp/positions.yaml
 
-        positions:
-          filename: /tmp/positions.yaml
+          clients:
+          - url: http://192.168.77.101:3100/loki/api/v1/push
+            external_labels:
+                nodename: {{ inventory_hostname }}
 
-        clients:
-        - url: http://192.168.77.101:3100/loki/api/v1/push
-          external_labels:
-              nodename: {{ inventory_hostname }}
+          scrape_configs:
+          - job_name: system
+            static_configs:
+            - targets:
+                - localhost
+              labels:
+                job: varlogs1
+                #NOTE: Need to be modified to scrape any additional logs of the system.
+                __path__: /var/log/zabbix/*.log
+            - targets:
+                - localhost
+              labels:
+                job: omv_backup
+                __path__: /myapps/omv_backup.log
 
-        scrape_configs:
-        - job_name: system
-          static_configs:
-          - targets:
-              - localhost
-            labels:
-              job: varlogs1
-              #NOTE: Need to be modified to scrape any additional logs of the system.
-              __path__: /var/log/zabbix/*.log
-          - targets:
-              - localhost
-            labels:
-              job: omv_backup
-              __path__: /myapps/omv_backup.log
-
-  - name: Sshd
-    ansible.builtin.service:
-      name: promtail
-      state: restarted
-  become: true
+    - name: Sshd
+      ansible.builtin.service:
+        name: promtail
+        state: restarted

roles/requirements.yml

@@ -1,5 +1,5 @@
----
+# requirements.yml
 collections:
   - name: community.general
     source: https://galaxy.ansible.com
-  
+  - name: community.docker

roles/sendmail/handlers/main.yml

@@ -1,5 +0,0 @@
-- name: restart_docker
-  ansible.builtin.service:
-    name: docker.service
-    state: restarted
-  become: true

roles/sendmail/tasks/main.yml

@@ -1,57 +0,0 @@
-- block:
-  - name: Install docker
-    ansible.builtin.apt:
-      name: 
-        - ca-certificates
-        - curl 
-        - telnet
-        - net-tools
-        - python3-pip
-        - python3-dev
-      state: present
-      update_cache: true
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      install -m 0755 -d /etc/apt/keyrings
-
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
-
-  - name: Get keys for raspotify
-    ansible.builtin.shell:
-      chmod a+r /etc/apt/keyrings/docker.asc
-
-  - name: Get keys for raspotify
-    ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
-
-  - name: Install docker
-    ansible.builtin.apt:
-      name: 
-        - docker-ce
-        - docker-ce-cli
-        - containerd.io
-        - docker-buildx-plugin
-        - docker-compose-plugin
-      update_cache: true
-
-  - name: Create a directory docker.service.d
-    ansible.builtin.file:
-      path: /etc/systemd/system/docker.service.d/
-      state: directory
-      mode: '0755'
-
-  - name: Creating a file with content
-    copy:
-      dest: "/etc/systemd/system/docker.service.d/override.conf"
-      content: |
-        [Service]
-        ExecStart=
-        ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock -H tcp://0.0.0.0:2375
-    notify: restart_docker
-
-  - name: Just force systemd to reread configs
-    ansible.builtin.systemd:
-      daemon_reload: true
-
-  become: true

roles/setup/tasks/main.yml

@@ -0,0 +1,5 @@
+- name: Setup
+  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
+  block:
+    - name: Gather facts
+      ansible.builtin.setup:

roles/ssh_banner/tasks/main.yml

@@ -1,38 +1,40 @@
-- block:
-  - name: Install packages
-    ansible.builtin.apt:
-      name: 
-        - figlet 
-        - toilet
+- name: Set banner
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Install packages
+      ansible.builtin.apt:
+        name:
+          - figlet
+          - toilet
 
-  - name: Create Banner
-    ansible.builtin.command: |
-      figlet -c  {{ (inventory_hostname|split('.'))[0] }} -f slant
-    register: logo
+    - name: Create Banner
+      ansible.builtin.command: |
+        figlet -c {{ (inventory_hostname | split('.'))[0] }} -f slant
+      register: logo
+      changed_when: "logo.rc == 0"
 
-  - name: Creating a file with content
-    copy:
-      dest: "/etc/motd"
-      content: |
-        {{ logo.stdout }}
+    - name: Creating a file with content
+      ansible.builtin.copy:
+        dest: "/etc/motd"
+        content: |
+          {{ logo.stdout }}
+        owner: 0
+        group: 0
+        mode: "0777"
 
-  - name: Reconfigure sshd
-    ansible.builtin.lineinfile:
-      path: /etc/ssh/sshd_config
-      regexp: "^Banner.* "
-      line: "#Banner /etc/banner"
+    - name: Reconfigure sshd
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^Banner.* "
+        line: "#Banner /etc/banner"
 
-  - name: Reconfigure sshd
-    ansible.builtin.lineinfile:
-      path: /etc/ssh/sshd_config
-      regexp: "^#PrintLastLog.* "
-      line: "PrintLastLog no"
+    - name: Reconfigure sshd
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#PrintLastLog.* "
+        line: "PrintLastLog no"
 
-  - name: sshd
-    ansible.builtin.service:
-      name: ssh.service
-      state: restarted
-  become: true
-
-
-  
+    - name: Sshd
+      ansible.builtin.service:
+        name: ssh.service
+        state: restarted

roles/ssh_config/files/config

@@ -0,0 +1,24 @@
+Host m-server
+  HostName m-server.home.lan
+ 
+Host rpi5
+  HostName rpi5.home.lan
+
+Host rack
+  HostName rack.home.lan
+
+Host amd
+  HostName amd.home.lan
+  
+Host nas
+  HostName nas.home.lan
+  User admin
+
+Host router
+  HostName router.home.lan
+  User root
+
+Host *
+    User jd
+    IdentityFile ~/.ssh/id_rsa
+    StrictHostKeyChecking no

roles/ssh_config/tasks/main.yml

@@ -0,0 +1,19 @@
+- name: SSH config Setup
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Upload config
+      ansible.builtin.copy:
+        src: config
+        dest: /home/jd/.ssh/config
+        mode: '0600'
+        owner: jd
+        group: jd
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Upload config
+      ansible.builtin.copy:
+        src: config
+        dest: /root/.ssh/config
+        mode: '0600'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'

roles/ssh_config/vars/main.yml

@@ -0,0 +1 @@
+dest_folder: "/tmp/ans_repo"

roles/ssh_keys/tasks/main.yml

@@ -0,0 +1,24 @@
+- name: SSH keys deploy
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Upload key
+      ansible.builtin.copy:
+        src: id_rsa
+        dest: /home/jd/.ssh/id_rsa
+        mode: '0600'
+        owner: jd
+        group: jd
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Upload key
+      ansible.builtin.copy:
+        src: id_rsa
+        dest: /home/jd/.ssh/id_rsa.pub
+        mode: '0600'
+        owner: jd
+        group: jd
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Set authorized key taken from file
+      ansible.posix.authorized_key:
+        user: jd
+        state: present
+        key: "{{ lookup('file', '/home/jd/.ssh/id_rsa.pub') }}"

roles/sshd_config/tasks/main.yml

@@ -0,0 +1,14 @@
+- name: SSHD config Setup
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Reconfigure sshd
+      ansible.builtin.replace:
+        path: /etc/ssh/sshd_config
+        regexp: "^PermitRootLogin"
+        replace: "#PermitRootLogin"
+    - name: Restart ssh service
+      ansible.builtin.service:
+        name: ssh
+        state: restarted
+        daemon_reload: true
+        enabled: true

roles/sshd_config/vars/main.yml

@@ -0,0 +1 @@
+dest_folder: "/tmp/ans_repo"

roles/sudoers/tasks/main.yml

@@ -0,0 +1,12 @@
+- name: Set sudoers
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Allow the backup jd to sudo /myapps/omv_backup.py
+      community.general.sudoers:
+        name: allow-backup
+        state: present
+        user: jd
+        commands:
+          - /myapps/omv_backup.py *
+          - /usr/sbin/poweroff
+          - /usr/sbin/shutdown *

roles/wazuh-agent/tasks/main.yml

@@ -1,20 +1,29 @@
-- block:
-  - name: Get keys
-    ansible.builtin.shell: curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
-  - name: Add repo
-    ansible.builtin.shell: echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
-  - name: Update cache
-    ansible.builtin.apt:
-      update_cache: true
-  - name: Instal wazuh
-    ansible.builtin.apt:
-      name: wazuh-agent
-    environment:
-      WAZUH_MANAGER: 'm-server.home.lan'
-      WAZUH_AGENT_NAME: "{{ inventory_hostname }}"
-  - name: Restart wazuh service
-    ansible.builtin.service:
-      name: wazuh-agent
-      state: restarted
-      enabled: true
-  become: true
+- name: Setup loki agent
+  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
+  block:
+    - name: Get keys
+      ansible.builtin.command: |
+        curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
+      changed_when: my_output.rc != 0
+
+    - name: Add repo
+      ansible.builtin.command: |
+        echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
+      changed_when: my_output.rc != 0
+
+    - name: Update cache
+      ansible.builtin.apt:
+        update_cache: true
+
+    - name: Instal wazuh
+      ansible.builtin.apt:
+        name: wazuh-agent
+      environment:
+        WAZUH_MANAGER: 'm-server.home.lan'
+        WAZUH_AGENT_NAME: "{{ inventory_hostname }}"
+
+    - name: Restart wazuh service
+      ansible.builtin.service:
+        name: wazuh-agent
+        state: restarted
+        enabled: true

roles/zabbix-agent/tasks/main.yml

@@ -1,175 +1,181 @@
-- block:
-  - name: Get config for not nas
-    ansible.builtin.set_fact:
-      zabbix_agent_cfg: "/etc/zabbix/zabbix_agent2.conf"
-    when: inventory_hostname != 'nas.home.lan'
-    
-  - name: Get config for nas
-    ansible.builtin.set_fact:
-      zabbix_agent_cfg: "/opt/ZabbixAgent/etc/zabbix_agentd.conf"
-    when: inventory_hostname  == 'nas.home.lan'
+- name: Install zabbix agent
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Get config for not nas
+      ansible.builtin.set_fact:
+        zabbix_agent_cfg: "/etc/zabbix/zabbix_agent2.conf"
+      when: inventory_hostname != 'nas.home.lan'
 
-  - name: Print all available facts
-    ansible.builtin.debug:
-      msg: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+    - name: Get config for nas
+      ansible.builtin.set_fact:
+        zabbix_agent_cfg: "/opt/ZabbixAgent/etc/zabbix_agentd.conf"
+      when: inventory_hostname  == 'nas.home.lan'
 
-  - name: Print all available facts
-    ansible.builtin.debug:
-      var: ansible_facts.architecture
-  - name: Print all available facts
-    ansible.builtin.debug:
-      var: ansible_distribution
-  - name: Print all available facts
-    ansible.builtin.debug:
-      var: ansible_distribution_major_version
-  # - name: Upload zabbix package
-  #   ansible.builtin.copy:
-  #     src: packages/zabbix-release_6.4-1+ubuntu22.04_all.deb
-  #     dest: /tmp/
-  - name: Install a .deb package from the internet111
-    ansible.builtin.apt:
-      deb: https://repo.zabbix.com/zabbix/7.2/release/ubuntu/pool/main/z/zabbix-release/zabbix-release_latest_7.2+ubuntu24.04_all.deb
-    when:
-      - ansible_facts.architecture != "armv7l" and  ( ansible_distribution == "Ubuntu1" or ansible_distribution == "Linux Mint" )
+    - name: Print all available facts
+      ansible.builtin.debug:
+        msg: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
 
-  - name: Install a .deb package from the internet2
-    ansible.builtin.apt:
-      #deb: https://repo.zabbix.com/zabbix/6.4/raspbian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian11_all.deb
-      deb: https://repo.zabbix.com/zabbix/7.0/raspbian/pool/main/z/zabbix-release/zabbix-release_7.0-1+debian11_all.deb
-    retries: 5
-    delay: 5
-    when:
-      - ansible_facts.architecture == "armv7l" or ansible_facts.architecture == "aarch64"
+    - name: Print all available facts
+      ansible.builtin.debug:
+        var: ansible_facts.architecture
+    - name: Print all available facts
+      ansible.builtin.debug:
+        var: ansible_distribution
+    - name: Print all available facts
+      ansible.builtin.debug:
+        var: ansible_distribution_major_version
+    # - name: Upload zabbix package
+    #   ansible.builtin.copy:
+    #     src: packages/zabbix-release_6.4-1+ubuntu22.04_all.deb
+    #     dest: /tmp/
+    - name: Install a .deb package from the internet111
+      ansible.builtin.apt:
+        deb: https://repo.zabbix.com/zabbix/7.2/release/ubuntu/pool/main/z/zabbix-release/zabbix-release_latest_7.2+ubuntu24.04_all.deb
+      when:
+        - ansible_facts.architecture != "armv7l" and  ( ansible_distribution == "Ubuntu1" or ansible_distribution == "Linux Mint" )
 
-    ignore_errors: true
+    - name: Install a .deb package from the internet2
+      ansible.builtin.apt:
+        # deb: https://repo.zabbix.com/zabbix/6.4/raspbian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian11_all.deb
+        deb: https://repo.zabbix.com/zabbix/7.2/release/raspbian/pool/main/z/zabbix-release/zabbix-release_latest_7.2+debian12_all.deb
+      retries: 5
+      delay: 5
+      when:
+        - ansible_facts.architecture == "armv7l" or ansible_facts.architecture == "aarch64"
+      register: command_result
+      failed_when: "'FAILED' in command_result.stderr"
 
-  - name: Install a .deb package from the internet3
-    ansible.builtin.apt:
-      deb: https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian11_all.deb
-      
-    when:
-      - ansible_facts.architecture != "armv7l"  and ansible_distribution == "Debian"  and ansible_distribution_major_version  == "11"
-    
-  - name: Install a .deb package from the internet4
-    ansible.builtin.apt:
-      #deb: https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian12_all.deb
-      deb: https://repo.zabbix.com/zabbix/7.0/debian/pool/main/z/zabbix-release/zabbix-release_7.0-1+debian12_all.deb
-    when:
-      - ansible_facts.architecture != "armv7l" and  ansible_facts.architecture != "aarch64" and ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
-    ignore_errors: true
+    - name: Install a .deb package from the internet3
+      ansible.builtin.apt:
+        deb: https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian11_all.deb
+      when:
+        - ansible_facts.architecture != "armv7l"  and ansible_distribution == "Debian"  and ansible_distribution_major_version  == "11"
 
-  # - name: Install a .deb package localy
-  #   ansible.builtin.apt:
-  #     deb: /tmp/zabbix-release_6.4-1+ubuntu22.04_all.deb
-  - name: Install zabbix packages
-    ansible.builtin.apt:
-      name: 
-        - zabbix-agent2
-        - zabbix-agent2-plugin-mongodb
-        - zabbix-agent2-plugin-postgresql
-        # - zabbix-agent2-plugin-mysql
-      update_cache: yes
-    ignore_errors: true
-    when: inventory_hostname != 'nas.home.lan'
+    - name: Install a .deb package from the internet4
+      ansible.builtin.apt:
+        # deb: https://repo.zabbix.com/zabbix/6.4/debian/pool/main/z/zabbix-release/zabbix-release_6.4-1+debian12_all.deb
+        deb: https://repo.zabbix.com/zabbix/7.0/debian/pool/main/z/zabbix-release/zabbix-release_7.0-1+debian12_all.deb
+      when:
+        - ansible_facts.architecture != "armv7l"
+        - ansible_facts.architecture != "aarch64"
+        - ansible_distribution == "Debian"
+        - ansible_distribution_major_version  == "12"
+      register: command_result
+      failed_when: "'FAILED' in command_result.stderr"
+    # - name: Install a .deb package localy
+    #   ansible.builtin.apt:
+    #     deb: /tmp/zabbix-release_6.4-1+ubuntu22.04_all.deb
+    - name: Install zabbix packages
+      ansible.builtin.apt:
+        name:
+          - zabbix-agent2
+          - zabbix-agent2-plugin-mongodb
+          - zabbix-agent2-plugin-postgresql
+          # - zabbix-agent2-plugin-mysql
+        update_cache: true
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Install zabbix packages
+      ansible.builtin.apt:
+        name:
+          - zabbix-agent2
+          - zabbix-agent2-plugin-mongodb
+          - zabbix-agent2-plugin-postgresql
+          # - zabbix-agent2-plugin-mysql
+        only_upgrade: true
+      when: inventory_hostname != 'nas.home.lan'
 
-  - name: Reconfigure zabbix agent Server
-    ansible.builtin.lineinfile:
-      path: "{{ zabbix_agent_cfg }}"
-      regexp: "^Server=.*"
-      insertafter: '^# Server='
-      line: "Server=192.168.77.0/24,192.168.89.0/28"
+    - name: Reconfigure zabbix agent Server
+      ansible.builtin.lineinfile:
+        path: "{{ zabbix_agent_cfg }}"
+        regexp: "^Server=.*"
+        insertafter: '^# Server='
+        line: "Server=192.168.77.0/24,192.168.89.0/28"
 
 
-  - name: Reconfigure zabbix agent ServerActive
-    ansible.builtin.lineinfile:
-      path: "{{ zabbix_agent_cfg }}"
-      regexp: "^ServerActive=.*"
-      line: "ServerActive={{ ZABBIX_SERVER }}"
+    - name: Reconfigure zabbix agent ServerActive
+      ansible.builtin.lineinfile:
+        path: "{{ zabbix_agent_cfg }}"
+        regexp: "^ServerActive=.*"
+        line: "ServerActive={{ ZABBIX_SERVER }}"
 
 
-  - name: Reconfigure zabbix agent ListenPort
-    ansible.builtin.lineinfile:
-      path: "{{ zabbix_agent_cfg }}"
-      regexp: "^ListenPort=.*"
-      line: "ListenPort=10050"
-  # - name: Reconfigure zabbix agent ListenIP
-  #   ansible.builtin.lineinfile:
-  #     path: /"{{ zabbix_agent_cfg }}"
-  #     regexp: "^ListenIP=.*"
-  #     line: "ListenIP=0.0.0.0"
+    - name: Reconfigure zabbix agent ListenPort
+      ansible.builtin.lineinfile:
+        path: "{{ zabbix_agent_cfg }}"
+        regexp: "^ListenPort=.*"
+        line: "ListenPort=10050"
+    # - name: Reconfigure zabbix agent ListenIP
+    #   ansible.builtin.lineinfile:
+    #     path: /"{{ zabbix_agent_cfg }}"
+    #     regexp: "^ListenIP=.*"
+    #     line: "ListenIP=0.0.0.0"
 
 
-  - name: Reconfigure zabbix-agent2 hostname
-    ansible.builtin.lineinfile:
-      path: "{{ zabbix_agent_cfg }}"
-      regexp: "^Hostname=.*"
-      line: "Hostname={{ inventory_hostname }}"
+    - name: Reconfigure zabbix-agent2 hostname
+      ansible.builtin.lineinfile:
+        path: "{{ zabbix_agent_cfg }}"
+        regexp: "^Hostname=.*"
+        line: "Hostname={{ inventory_hostname }}"
 
 
-  - name: Reconfigure zabbix-agent2 config
-    ansible.builtin.lineinfile:
-      path: "{{ zabbix_agent_cfg }}"
-      insertafter: '^# UserParameter='
-      regexp: "^UserParameter=system.certs.*"
-      line: "UserParameter=system.certs,python3 /share/ZFS530_DATA/.qpkg/ZabbixAgent/cert_check2.py"
-    when: inventory_hostname == 'nas.home.lan'
+    - name: Reconfigure zabbix-agent2 config
+      ansible.builtin.lineinfile:
+        path: "{{ zabbix_agent_cfg }}"
+        insertafter: '^# UserParameter='
+        regexp: "^UserParameter=system.certs.*"
+        line: "UserParameter=system.certs,python3 /share/ZFS530_DATA/.qpkg/ZabbixAgent/cert_check2.py"
+      when: inventory_hostname == 'nas.home.lan'
 
 
-  - name: Reconfigure zabbix-agent2 config
-    ansible.builtin.lineinfile:
-      path: "{{ zabbix_agent_cfg }}"
-      insertafter: '^# UserParameter='
-      regexp: "^UserParameter=system.certs.*"
-      line: "UserParameter=system.certs,python3 /usr/bin/cert_check2.py"
-    when: inventory_hostname == 'm-server.home.lan' 
+    - name: Reconfigure zabbix-agent2 config
+      ansible.builtin.lineinfile:
+        path: "{{ zabbix_agent_cfg }}"
+        insertafter: '^# UserParameter='
+        regexp: "^UserParameter=system.certs.*"
+        line: "UserParameter=system.certs,python3 /usr/bin/cert_check2.py"
+      when: inventory_hostname == 'm-server.home.lan'
 
 
-  - name: Reconfigure zabbix-agent2 config
-    ansible.builtin.lineinfile:
-      path: "{{ zabbix_agent_cfg }}"
-      insertafter: '^# UserParameter='
-      line: "UserParameter=rpi.hw.temp,/usr/bin/vcgencmd measure_temp"
-    when: inventory_hostname == 'rpi5.home.lan'
+    - name: Reconfigure zabbix-agent2 config
+      ansible.builtin.lineinfile:
+        path: "{{ zabbix_agent_cfg }}"
+        insertafter: '^# UserParameter='
+        line: "UserParameter=rpi.hw.temp,/usr/bin/vcgencmd measure_temp"
+      when: inventory_hostname == 'rpi5.home.lan'
 
 
-  - name: Reconfigure zabbix-agent2 hostname
-    ansible.builtin.lineinfile:
-      path: "{{ zabbix_agent_cfg }}"
-      regexp: "^HostMetadata=.*"
-      insertafter: '^# HostMetadata='
-      line: "HostMetadata=linux;jaydee"
+    - name: Reconfigure zabbix-agent2 hostname
+      ansible.builtin.lineinfile:
+        path: "{{ zabbix_agent_cfg }}"
+        regexp: "^HostMetadata=.*"
+        insertafter: '^# HostMetadata='
+        line: "HostMetadata=linux;jaydee"
+
+    - name: Reconfigure zabbix-agent2 hostname
+      ansible.builtin.lineinfile:
+        path: "{{ zabbix_agent_cfg }}"
+        regexp: "^HostMetadata=.*"
+        insertafter: '^# HostMetadata='
+        line: "HostMetadata=server;jaydee"
+      when: inventory_hostname == 'nas.home.lan' or inventory_hostname == 'm-server.home.lan'
+
+    - name: Add the user 'to group video
+      ansible.builtin.user:
+        name: zabbix
+        groups: video
+        append: true
+      when: inventory_hostname != 'nas.home.lan'
 
 
-
-  - name: Reconfigure zabbix-agent2 hostname
-    ansible.builtin.lineinfile:
-      path: "{{ zabbix_agent_cfg }}"
-      regexp: "^HostMetadata=.*"
-      insertafter: '^# HostMetadata='
-      line: "HostMetadata=server;jaydee"
-    when: inventory_hostname == 'nas.home.lan' or inventory_hostname == 'm-server.home.lan' 
+    - name: Restart zabbix-agent2 service
+      ansible.builtin.service:
+        name: zabbix-agent2.service
+        state: restarted
+        enabled: true
+      when: inventory_hostname != 'nas.home.lan'
 
 
-
-  - name: Add the user 'to group video
-    ansible.builtin.user:
-      name: zabbix
-      groups: video
-      append: yes
-    when: inventory_hostname != 'nas.home.lan'
-
-
-  - name: Restart zabbix-agent2 service
-    ansible.builtin.service:
-      name: zabbix-agent2.service
-      state: restarted
-      enabled: true
-    when: inventory_hostname != 'nas.home.lan'
-
-
-  - name: Restart agent
-    ansible.builtin.shell: /etc/init.d/ZabbixAgent.sh restart
-    when: inventory_hostname == 'nas.home.lan'
-
-
-  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+    - name: Restart agent
+      ansible.builtin.command: /etc/init.d/ZabbixAgent.sh restart
+      when: inventory_hostname == 'nas.home.lan'
+      changed_when: false

ssh_key.pem

@@ -0,0 +1,38 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAYEAoz4u+IAB09hgWyllpplK8864SkDd5p89w01p9NioW4FrOjES5U65
+9ny6geIZKFRDmrdvcADidsbmOGhIxnzup5f95Gt6KrJcMVvRqhQkV1R5xd2/lpcvo5J97W
+4bfoIxSuMdJ6dVmW6UyP50e4BJVmu++Cwh8uYuH5uSEqAh80TLCnd3VReGDrXukAvVLuLk
+EI6WVpLGEYwDbVwJORAxDhEc/g4fEQ5F2xmFtr8dYoTUBoed893Olum2oxqt6sf/hvdOTL
+UYLrWx1jjmEhPKNqt72g5AjQOhY3dz+oB0z3EYxRH6B3PFcadL40fXuqJfF+w/hhC+oOkD
+eueu+9maN/0JGtKyf8zJ094GdkuItAs5qg6HnG8wwl+8sMLsIL5ZiRjrMIMMDij/xNP0Z1
+outwVBVf31PaOZ6/WV4JIkWvWQs7mx2YccjemexIXDlZzG731dVuRZ/724/OGLnQi5s65O
+ar6UPqlbDF4tRjyBMhcMoPwH7uSU6TROfuFYhc0zAAAFiO2G2RLthtkSAAAAB3NzaC1yc2
+EAAAGBAKM+LviAAdPYYFspZaaZSvPOuEpA3eafPcNNafTYqFuBazoxEuVOufZ8uoHiGShU
+Q5q3b3AA4nbG5jhoSMZ87qeX/eRreiqyXDFb0aoUJFdUecXdv5aXL6OSfe1uG36CMUrjHS
+enVZlulMj+dHuASVZrvvgsIfLmLh+bkhKgIfNEywp3d1UXhg617pAL1S7i5BCOllaSxhGM
+A21cCTkQMQ4RHP4OHxEORdsZhba/HWKE1AaHnfPdzpbptqMarerH/4b3Tky1GC61sdY45h
+ITyjare9oOQI0DoWN3c/qAdM9xGMUR+gdzxXGnS+NH17qiXxfsP4YQvqDpA3rnrvvZmjf9
+CRrSsn/MydPeBnZLiLQLOaoOh5xvMMJfvLDC7CC+WYkY6zCDDA4o/8TT9GdaLrcFQVX99T
+2jmev1leCSJFr1kLO5sdmHHI3pnsSFw5Wcxu99XVbkWf+9uPzhi50IubOuTmq+lD6pWwxe
+LUY8gTIXDKD8B+7klOk0Tn7hWIXNMwAAAAMBAAEAAAGABj1wcTT/cjghXXVkeoJTQE+aHC
+iE8vW1AtwDiAWnezFOxn+CupDlqzuTAOJXgNhRFJRyJjoPw2eQpv5W2H4vvJNNnrzRri55
+jLTMURqKVcDtE2MJxE63gPgEEp6KCYNzhpUjk6pMq4aebwfJrxY1IiBl6+RP+zzQ7YoLrY
++Wd09IDaM0b2Rso5pRFLYxv3mSgI7axf4VToK8zMzfA2HlkM/sUkp65d2Bo8GYKrynzxDH
+GWV3ZGTe//DOIkejofJkIpm8l3xHAhkOQuEu6HubbLNCrIbwtTeGQuVQW6EqdGIF55/wHu
+vrwrjkaGT4rdsCD4Ue3aCDfc5PFgRkDSmGUwcQmSRiA3vDliYe33m61SXqngbE763EIv12
+vQBzU+vRR/IjQQAfX7bEJNnZ//TbiiA0vQzXnjrxNtwJVgPAQduqJI7F9D6r6TvpLeB7TS
+NjJErQivVj3Uwvjz2xHum9+Z9hOtA0hwuvqsRqvxarlIGpV12tDK/Qe2r/sUMHvEbBAAAA
+wQCTkbTjZ+KyOGp54SlzFWXrxYZcswzr7UKms+WlmT8NFtqpwnLg6/KzyLURWVns3k2eTz
+ZRC3lJhGVZyTyuVR9ek0wbI+f/JmnTsAPaas76KHcXszpxftwf6blZc1wZUEJLmRDTy5K2
+tEDoll4lki2L2Wyv6KPWyG6Gai34YigW95vS7veaslLVIy/nNRkwBEBpwRtOV/YCy1SC3U
+PRMaMUyHNzcdwbeT1uymU/UeGc+h8pTGriG/5EhbvCHhLqVV8AAADBAOMRDYvh6wT4f31K
+JitrfTruY+Bdg9O9aqyQXzEkCtzJWoHTLQY/brMo0mvUxR9wSxKBwR+Nu9EXqkBpA3g1Hv
+UgXv3NWrpAiAVVs6NHay0aDa1uIY/Ol8k6DbLL5R0k7tQc2nD44Ey9zme88/0sdHA2VIQ2
+z/tlcPSQ8VKKhDmRY7BTE5YgeE6615nqvCq8e6CRSjFa0HKbfdFsmSnOHgil6Oc2MKT2pL
+i/dKSxeAr2BP++xF9xYe0bVMdy4mEF8wAAAMEAuAsxC2bs0FnzoInge3W1ra55+qZF3LFp
+efTVb26yciNYYeJLeks+nOjOQQd+kcISILdIhYnUGIumWQR/CiY2KL89AXLoTB6EIt5DGC
+udKAjIzSeHtXTliZ1okgjGSmJeE6dhr0UwdLYyaFkdscbF17iTndLc74yCrKIoUnHfxBEc
+/34AT8UdwkrJXj7e2nJyV9WGYz/Ga2xd3s56hVSTUckjxQaBnkZWFilw7ZAlHhPhSglTmd
+pkgWv+Gd4evavBAAAAC2pkQG1vcmVmaW5lAQIDBAUGBw==
+-----END OPENSSH PRIVATE KEY-----