build

all.yml

@@ -44,9 +44,9 @@
     - name: zabbix-agent
       role: zabbix-agent
       tags: zabbix-agent
-    - name: autofs_client
-      role: autofs_client
-      tags: autofs_client
+    - name: autofs
+      role: autofs
+      tags: autofs
     - name: ldap_client
       role: ldap_client
       tags: ldap_client
@@ -71,9 +71,6 @@
     - name: sudoers
       role: sudoers
       tags: sudoers
-    - name: docker_packages
-      role: docker_packages
-      tags: docker_packages
     - name: watcher
       role: watcher
       tags: watcher
@@ -86,3 +83,6 @@
     - name: letsgo
       role: letsgo
       tags: letsgo
+    - name: docker_swarm
+      role: docker_swarm
+      tags: docker_swarm

hosts_init.yml

@@ -48,11 +48,14 @@ datacenter:
         vm01.home.lan:
         vm02.home.lan:
         vm03.home.lan:
+        vm04.home.lan:
+        vm05.home.lan:
+        vm06.home.lan:
       vars:
         ansible_python_interpreter: /usr/bin/python3
         ansible_ssh_user: jd
         ansible_ssh_password: q
-        become_method: su
+        ansible_become_method: su
         ansible_become_password: q
         ansible_ssh_pass: q
         ansible_become_user: root

hosts_kestra copy.yml

@@ -1,153 +0,0 @@
----
-datacenter:  
-  children:
-    odroid_cluster:
-      children:
-        odroid_master:
-          hosts:
-            192.168.77.131:
-          vars:
-            testVar: 999
-        odroid_worker:
-          hosts:
-            192.168.77.13[2:5]:
-        
-      vars:
-        ansible_ssh_user: jd
-        ansible_ssh_pass: lacijaydee
-        ansible_become_password: lacijaydee
-        ssh_args: "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
-        ansible_ssh_common_args: "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
-
-    localhost1:
-          hosts:
-            localhost
-          vars:
-            ansible_user: root
-    morefine:
-      hosts:
-        192.168.77.12:
-      vars:
-        jaydee_install_mqtt_srv: true
-        ansible_python_interpreter: auto_silent
-        ansible_ssh_user: jd
-        ansible_become_user: root
-        ansible_become_password: q
-        ansible_ssh_common_args: "-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
-        
-    ryzen:
-      hosts:
-        192.168.77.15:
-      vars:
-        ansible_python_interpreter: auto_silent
-        ansible_ssh_user: root
-        ansible_ssh_pass: lacijaydee
-        ansible_password: lacijaydee
-        ansible_become_user: root
-        ansible_become_password: lacijaydee
-    omv:
-      hosts:
-        192.168.77.189:
-      vars:
-        ansible_user: root
-        ansible_password: lacijaydee
-        ansible_ssh_user: root
-        ansible_ssh_pass: lacijaydee
-        ansible_become_user: root
-        ansible_become_password: lacijaydee
-    amd:
-      hosts:
-        192.168.77.4:
-      vars:
-        ansible_user: root
-        ansible_password: l4c1j4yd33Du5lo
-        ansible_ssh_user: root
-        ansible_ssh_pass: l4c1j4yd33Du5lo
-        ansible_become_user: root
-        ansible_become_password: l4c1j4yd33Du5lo
-    rhasspy:
-      hosts:
-        192.168.77.224
-      vars:
-        ansible_user: jd
-        ansible_ssh_pass: q
-        ansible_become_password: l4c1j4yd33Du5lo
-    windows:
-      hosts:
-        192.168.77.211
-      vars:
-        ansible_user: jd
-        ansible_password: "q"
-        ansible_connection: winrm
-        ansible_port: 5985
-        ansible_winrm_server_cert_validation: ignore
-        ansible_winrm_kerberos_delegation: true
-    mqtt_srv:
-      children:
-        servers:
-          hosts:
-            rpi5-1.home.lan:
-            rpi5.home.lan:
-            omv.home.lan:
-            rack.home.lan:
-            m-server.home.lan:
-            zabbix.home.lan:
-            192.168.77.101:
-          vars:
-            ansible_python_interpreter: /usr/bin/python3
-            ansible_ssh_user: jd
-            ansible_become_password: l4c1j4yd33Du5lo
-            ansible_ssh_private_key_file: ssh_key.pem
-            identity_file: ssh_key.pem
-        nas:
-          hosts:
-            nas.home.lan:
-          vars:
-            ansible_ssh_user: admin
-            become_method: su
-            become_user: admin
-            ansible_ssh_private_key_file: ssh_key.pem
-            # ansible_user: admin
-            # ansible_pass: l4c1!j4yd33?Du5lo1
-            ansible_python_interpreter: /share/ZFS530_DATA/.qpkg/QPython312/bin/python3
-        desktop:
-          hosts:
-            morefine.home.lan:
-          vars:
-            ansible_ssh_user: jd
-            ansible_become_user: root
-            ansible_become_password: q
-            # ansible_ssh_password: q
-            ansible_ssh_private_key_file: ssh_key.pem
-
-    containers:
-      children:
-        servers:
-          hosts:
-            rpi5-1.home.lan:
-            rpi5.home.lan:
-            m-server.home.lan:
-            fog.home.lan:
-            zabbix.home.lan:
-            omv.home.lan:
-            192.168.77.101:
-          vars:
-            ansible_python_interpreter: /usr/bin/python3
-            ansible_ssh_user: jd
-            # ansible_ssh_password: l4c1j4yd33Du5lo
-            ansible_become_password: l4c1j4yd33Du5lo
-            ansible_ssh_private_key_file: ssh_key.pem
-            identity_file: ssh_key.pem
-            ansible_ssh_pass: l4c1j4yd33Du5lo
-        nas:
-          hosts:
-            nas.home.lan:
-            192.168.77.106:
-          vars:
-            ansible_ssh_user: admin
-            become_method: su
-            become_user: admin
-            ansible_ssh_private_key_file: ssh_key.pem
-            # ansible_user: admin
-            # ansible_pass: l4c1!j4yd33?Du5lo1
-            ansible_python_interpreter: /share/ZFS530_DATA/.qpkg/QPython312/bin/python3

hosts_roles.yml

@@ -188,6 +188,9 @@ datacenter:
         vm01.home.lan:
         vm02.home.lan:
         vm03.home.lan:
+        vm04.home.lan:
+        vm05.home.lan:
+        vm06.home.lan:
       vars:
         ansible_python_interpreter: /usr/bin/python3
         ansible_ssh_user: jd

requirements.txt

@@ -0,0 +1,10 @@
+ansible-core==2.20.0
+ansible-lint==25.11.1
+
+# YAML libs
+PyYAML>=6.0.2
+ruamel.yaml==0.18.16
+ruamel.yaml.clib==0.2.15
+
+jinja2==3.1.6
+ansible-compat==25.11.0

roles/autofs/tasks/main.yml

@@ -26,6 +26,9 @@
         content: |
           docker_data  -fstype=nfs   m-server.home.lan:/docker_data
           downloads  -fstype=nfs   m-server.home.lan:/downloads
+          movies  -fstype=nfs   m-server.home.lan:/movies
+          shows  -fstype=nfs   m-server.home.lan:/shows
+          music  -fstype=nfs   m-server.home.lan:/music
         mode: '0600'
         owner: root
         group: root
@@ -150,6 +153,7 @@
           shows --fstype=nfs,rw nas.home.lan:/shows
           xxx --fstype=nfs,rw nas.home.lan:/xxx
           proxmox --fstype=nfs,rw nas.home.lan:/proxmox
+          live --fstype=nfs,rw nas.home.lan:/live
         mode: '0600'
         owner: root
         group: root

roles/common/tasks/main.yml

@@ -18,7 +18,7 @@
           apt-mark hold docker-ce docker-compose-plugin docker-ce-rootless-extras docker-ce-cli docker-buildx-plugin
       register: logo
       changed_when: "logo.rc == 0"
-      ignore_errors: true
+      when: inventory_hostname != 'morefine.home.lan'
 
     - name: Upgrade the full OS
       ansible.builtin.apt:

roles/docker/tasks/main.yml

@@ -18,6 +18,11 @@
           - python3-dev
         state: present
         update_cache: true
+      register: install_docker_deps
+      until: install_docker_deps is succeeded
+      retries: 10
+      delay: 10
+
     - name: Get keys for raspotify
       ansible.builtin.command:
         install -m 0755 -d /etc/apt/keyrings
@@ -42,15 +47,14 @@
       when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "12"
 
-
     - name: Ensure docker keyring directory exists
-      ansible.builtin.file:
+      file:
         path: /etc/apt/keyrings
         state: directory
         mode: "0755"
 
     - name: Download Docker GPG key
-      ansible.builtin.get_url:
+      get_url:
         url: https://download.docker.com/linux/debian/gpg
         dest: /etc/apt/keyrings/docker.asc
         mode: "0644"
@@ -58,7 +62,7 @@
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
         
     - name: Install docker.sources file
-      ansible.builtin.template:
+      template:
         src: docker.sources.j2
         dest: /etc/apt/sources.list.d/docker.sources
         owner: root
@@ -68,7 +72,7 @@
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
 
     - name: Create docker.sources file
-      ansible.builtin.copy:
+      copy:
         dest: /etc/apt/sources.list.d/docker.sources
         mode: "0644"
         content: |
@@ -82,20 +86,27 @@
 
 
     - name: Update apt cache
-      ansible.builtin.apt:
-        update_cache: true
+      apt:
+        update_cache: yes
 
       when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
 
     - name: Download Docker GPG key
-      ansible.builtin.get_url:
+      get_url:
         url: https://download.docker.com/linux/debian/gpg
         dest: /etc/apt/keyrings/docker.asc
         mode: "0644"
       when:
         - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
 
+
+
+
+
+
+
+
     - name: Add an Apt signing key to a specific keyring file
       ansible.builtin.apt_key:
         url: https://download.docker.com/linux/ubuntu/gpg
@@ -128,36 +139,75 @@
       ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
       when:
         - ansible_distribution == "Ubuntu"
-    - name: Pin docker version
-      ansible.builtin.copy:
-        dest: /etc/apt/preferences.d/docker.pref
-        mode: "0644"
-        content: |
-          Package: docker-ce
-          Pin: version 5:28.5.2-1~debian.13~trixie
-          Pin-Priority: 1001
-
-          Package: docker-ce-cli
-          Pin: version 5:28.5.2-1~debian.13~trixie
-          Pin-Priority: 1001
-      when:
-        - ansible_distribution == "Debian"
-        - ansible_distribution_major_version == "13"
 
+    # - name: Install docker
+    #   ansible.builtin.apt:
+    #     name:
+    #       - docker-ce
+    #       - docker-ce-cli
+    #       - containerd.io
+    #       - docker-buildx-plugin
+    #       - docker-compose-plugin
+    #     update_cache: true
     - name: Install the version docker1
       ansible.builtin.apt:
-        name: "{{ docker_package }}"
+        name: "{{ item }}"
         state: present
       when:
         - ansible_distribution == "Debian"
-      loop_control:
-        loop_var: docker_package
       loop:
         - docker-ce
         - docker-ce-cli
+    - name: Install the version docker
+      ansible.builtin.apt:
+        name: "{{ item }}"
+        state: present
+        allow_downgrade: true
+      when:
+        - ansible_distribution == "Debian"
+      loop:
         - containerd.io
+
+    - name: Install the version docker
+      ansible.builtin.apt:
+        name: "{{ item }}"
+        state: present
+        allow_downgrade: true
+      when:
+        - ansible_distribution == "Debian"
+      loop:
+        - docker-buildx-plugin
+
+
+    - name: Install the version docker
+      ansible.builtin.apt:
+        name: "{{ item }}=5:28.5.2-1~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
+        state: present
+        allow_downgrade: true
+      when:
+        - ansible_distribution == "Debian1"
+      loop:
+        - docker-ce
+        - docker-ce-cli
+    - name: Install the version docker
+      ansible.builtin.apt:
+        name: "{{ item }}=1.7.28-2~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
+        state: present
+        allow_downgrade: true
+      when:
+        - ansible_distribution == "Debian1"
+      loop:
+        - containerd.io
+
+    - name: Install the version docker
+      ansible.builtin.apt:
+        name: "{{ item }}=0.28.0-0~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
+        state: present
+        allow_downgrade: true
+      when:
+        - ansible_distribution == "Debian1"
+      loop:
         - docker-buildx-plugin
-        - docker-compose-plugin
 
     - name: Create a directory docker.service.d
       ansible.builtin.file:
@@ -165,51 +215,111 @@
         state: directory
         mode: '0755'
 
+    - name: Create a directory for certs
+      ansible.builtin.file:
+        path: /etc/docker/certs
+        state: directory
+        mode: '0700'
+        owner: root
+        group: root
+
+    # - name: Copy files
+    #   ansible.builtin.copy:
+    #     src: server-key.pem
+    #     dest: /etc/docker/certs/
+    #     mode: '0600'
+    #     owner: root
+    #     group: root
+    # - name: Copy files
+    #   ansible.builtin.copy:
+    #     src: ca.pem
+    #     dest: /etc/docker/certs/
+    #     mode: '0600'
+    #     owner: root
+    #     group: root
+    # - name: Copy files
+    #   ansible.builtin.copy:
+    #     src: server-cert.pem
+    #     dest: /etc/docker/certs/
+    #     mode: '0600'
+    #     owner: root
+    #     group: root
     - name: Creating a file with content
       ansible.builtin.copy:
         dest: "/etc/systemd/system/docker.service.d/override.conf"
         content: |
           [Service]
           ExecStart=
-          ExecStart=/usr/bin/dockerd -H fd:// \
-          --containerd=/run/containerd/containerd.sock \
-          --tlsverify --tlscacert=/etc/docker/certs/ca.pem \
-          --tlscert=/etc/docker/certs/server-cert.pem \
-          --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
+          ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
         mode: '0600'
         owner: root
         group: root
       notify: restart_docker
       when: mode == "cert"
 
-    - name: Creating a file with content
-      ansible.builtin.copy:
-        dest: "/etc/systemd/system/docker.service.d/override.conf"
-        content: |
-          [Service]
-          ExecStart=
-          ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock  -H=0.0.0.0:2376
-        mode: '0600'
-        owner: root
-        group: root
-      notify: restart_docker
-      when: mode != "cert"
+    # - name: Creating a file with content
+    #   ansible.builtin.copy:
+    #     dest: "/etc/systemd/system/docker.service.d/override.conf"
+    #     content: |
+    #       [Service]
+    #       ExecStart=
+    #       ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify \
+    #       --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem \
+    #       --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
+    #     mode: '0600'
+    #     owner: root
+    #     group: root
+    #   notify: restart_docker
+    #   when: mode != "nocert"
 
     - name: Just force systemd to reread configs
       ansible.builtin.systemd:
         daemon_reload: true
 
+    - name: Check if file exists
+      ansible.builtin.stat:
+        path: /etc/docker/certs/ca.pem
+      register: file_check
+
+    - name: Print file check result
+      ansible.builtin.debug:
+        var: file_check
+
+    - name: Include role only if missing
+      ansible.builtin.include_role:
+        name: cert_gen
+      when: not file_check.stat.exists and mode == "cert"
+
+
+    - name: Create docker config file
+      ansible.builtin.copy:
+        dest: /etc/docker/daemon.json
+        content: |
+          {
+            "log-driver": "json-file",
+            "log-opts": {
+              "max-size": "10m",
+              "max-file": "3"
+            },
+            "data-root": "/var/lib/docker",
+            "dns": ["192.168.77.101", "192.168.77.106", "8.8.8.8"],
+            "dns-search": ["lan", "home.lan"]
+
+          }
+        mode: '0644'
+        owner: root
+        group: root
+
+
     - name: Restart docker service
       ansible.builtin.service:
         name: docker
         state: restarted
 
-    - name: Install Loki plugin with TLS
+    # - name: Get keys for raspotify
+    #   ansible.builtin.shell: docker plugin install grafana/loki-docker-driver:3.3.2-{{ ansible_architecture }} --alias loki --grant-all-permissions
+    - name: Install a plugin
       community.docker.docker_plugin:
         plugin_name: grafana/loki-docker-driver
         alias: loki
         state: present
-      environment:
-        DOCKER_HOST: "tcp://{{ inventory_hostname }}:2376"
-        DOCKER_TLS_VERIFY: "1"
-        DOCKER_CERT_PATH: "/tmp/certgen"

roles/docker_packages/tasks/main.yml

@@ -1,8 +0,0 @@
-- name: Install container packages
-  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
-  block:
-    - name: Create Banner
-      ansible.builtin.command: |
-        docker exec --user root zabbix-server-zabbix-server-1  apk add curl
-      register: logo
-      changed_when: "logo.rc == 0"

roles/docker_swarm/files/ca.pem

@@ -0,0 +1,33 @@
+-----BEGIN CERTIFICATE-----
+MIIFqTCCA5GgAwIBAgIUJ3kgn/onrwoKs+MqhsHo7RmF/20wDQYJKoZIhvcNAQEL
+BQAwZDELMAkGA1UEBhMCU0sxETAPBgNVBAgMCFNsb3Zha2lhMQswCQYDVQQHDAJT
+SzETMBEGA1UECgwKc2VjdG9ycS5ldTELMAkGA1UECwwCSVQxEzARBgNVBAMMCnNl
+Y3RvcnEuZXUwHhcNMjUwMzExMTc1MDA5WhcNMjYwMzExMTc1MDA5WjBkMQswCQYD
+VQQGEwJTSzERMA8GA1UECAwIU2xvdmFraWExCzAJBgNVBAcMAlNLMRMwEQYDVQQK
+DApzZWN0b3JxLmV1MQswCQYDVQQLDAJJVDETMBEGA1UEAwwKc2VjdG9ycS5ldTCC
+AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJsXcxwOjZ3jBO3j7gps12vo
+zXmSNEoka5RiUvZlfopifwKVxFMzAJd/yoeaxiUBYKIlHgZ/OYu/+WkrwgpX2HO3
+2ZuB83Ym7P3TkTBhRp1S/HqBIb6aORGKhiuhZt6PNiCgqFszmb4Wl0Ox2cYxWYi5
+1DeHXNa5vRob2rSfsJwtamiksJkAsXclQu5dyfMv+cvc4Pob1o/DT76+xDpqT4lr
+pzXhpfXyT/xwtOEWku/53fccU0SBSSHPp6HzZUWHoodmHPigYYFEz1drYk1nDr3u
+gZq+nEQAVpcn1JrH7DuUaX/CrgBZNRdQ8d+mQ9EEDAQXNfzlH10ebfTjm2ol40cu
+9mwVJQ5Ru+h2xvfAlbcqnDTinXFgABuquSNzEz/1eJMIhm+myVOqF1WGeA/LnXGp
+OaNny7oQW8/9OLmpAZKIFzcD7KxvdBAu9IkO/KduqJohD8BBPqVAksan85bmEs8R
+Iu46XAJ7nmlX1DLchBtwvYv5MRdna73M52rTpNlmidWuiUeysZs8Nx7dGh1bd5I6
+9JnHcMl01UorQn0uitnO9zrOTEg0KkEmUZab1A2CbqeoYYLXi72Sva959faviXb0
+0HaPDtWuih9jQORu7fH7H6ghLFdfgUOp9am1hQpX1P7uXmUOB4iztMrh3bM8m2ZE
+HEvr+VfNkcq9KaAfXPhHAgMBAAGjUzBRMB0GA1UdDgQWBBTG6a566m85pq5bLi0O
+nC5y0pg6sjAfBgNVHSMEGDAWgBTG6a566m85pq5bLi0OnC5y0pg6sjAPBgNVHRMB
+Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4ICAQA5g9OxfcoAbYvi2T89E5205QkC
+ZxwWgrHIVGICeOF1K2nIypnddoJQUvMT/GYIK4QjZSWLGB2+YZMtXS+U/C9uxKOm
+d7bbzp437wUZwUJRtA4JZayxIitVTtzLYYLimb13GrsPs2KwGaZALe0K7dYzDwP1
+74gqOPvP7snDD98c6HV6vVXnTN+0T7djQyv/TqcyQ/IZjVY6JpsqgMg1rHqkYhDM
+Na7XBgwOt0Y4QmgS6EYEVv1+QsVB0U1tdH1oa+zwiyj5xDwVNmU5bLocEq3kYIRU
+tQUarNNKY4fMq529Heq7Ki63DLYTP8tJGh0Yijm9SFPqKYaZy6iL5xbdRFNCIFR/
+FnBZmRVxvPealAoIg9vutHkQrdqebBfX11PwWtLn+fkGTXq+5fBwjYllK04/MBk0
+SNjt6qwnOGZOc4gmEjthF4oVcVKoE7sVSCdgu/2jtLeJ48s0MwGhWZCk21ZgJbZY
+5gMahOiSndmudTo1ubFrqLb71MBTpqjiHTF2VLdxZEsrFCqeQAbsG+KmMuj+UhzV
+yuO3ycAGSDxsgbyHHYzjo2O5BvY35J7w1lZe1CExgoeeYFWlJ6t5PySf6OJupFit
+7FNwYgVXqC3+vwEWmbXz0WHwPh4aCvfSuNAHoiwX2UyzceYOWB5F4TmA2Chj23Ih
+isOdaq7ol1Q0iF9tjQ==
+-----END CERTIFICATE-----

roles/docker_swarm/files/server-cert.pem

@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFkDCCA3igAwIBAgIUUYzivwquTJnP+9/Q/zb/0Ew+eVowDQYJKoZIhvcNAQEL
+BQAwZDELMAkGA1UEBhMCU0sxETAPBgNVBAgMCFNsb3Zha2lhMQswCQYDVQQHDAJT
+SzETMBEGA1UECgwKc2VjdG9ycS5ldTELMAkGA1UECwwCSVQxEzARBgNVBAMMCnNl
+Y3RvcnEuZXUwHhcNMjUwMzExMTc1MDEzWhcNMjYwMzExMTc1MDEzWjAcMRowGAYD
+VQQDDBFtLXNlcnZlci5ob21lLmxhbjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC
+AgoCggIBALcgqTwwWnKeiHt1ZZQjoyZw/c/DbPwQnBuQVhNGF6RX7apXP/eY4Sf8
+/l2y6awZd6vM4JyFonPENbll/dEVgFEPgwwiqiaBC9PuZIbC60LLYwpDUmaHXNAd
+xgohSWOEc7uT1lcW2yn5n1A93JpoOScb/dAmjWPUYV3BqnKTtcqVs3a5SzWxnIqO
+szWt97SZpRY3GWIAiOmFqcKE5gL7FkSaMyS81E/Qfct/37o5OHWpiBhzLZUyop1e
+z9f7RrgDRzEoNlJisWFY/wF0xvmowkslL8QsYBTkfgofP7dEm8MOn0hJOFzuUY75
+TAp+h6wiL0bhTab4XDOrFjFy5ivehICdDSal+IlNEmI9Zsziy/1gW7WXCMMgOXKn
+xX7se2OFbHGCaf9NCn+0ODHev9ZeDni5SQsgyD3Zjyh3kc7AZ97M8jNJlCGb2QaJ
+f/BF2Q9EzbQYHjor97r/+tMdvYkYNo9+FYoJH3yP+T378Tn+DFe8KthvbqCSF01t
+aDdfcRu0p+qNalVkD2rctohJgiEuhzVIIpfqe3P9yMyzBYgwoXMUIthug4wOo8gE
+Xwr7cgTTK8pxPQGlo1JL0WuBxodtdHP9/VQmf3Qkgj3W0UTAP3rphnvg/5S5tqIT
+P7W+HVjEzTEh2z2FGxz4lvEbo82FrhxnCrW+Gk/jhbY99Lr3SeetAgMBAAGjgYEw
+fzAoBgNVHREEITAfghFtLXNlcnZlci5ob21lLmxhbocEwKhN7ocEfwAAATATBgNV
+HSUEDDAKBggrBgEFBQcDATAdBgNVHQ4EFgQUOIy9QvfKWPuMGEp4C2yvjNO2uYsw
+HwYDVR0jBBgwFoAUxumueupvOaauWy4tDpwuctKYOrIwDQYJKoZIhvcNAQELBQAD
+ggIBAIJBsaPUjAApSDplyUGru6XnLL1UHjG+g49A12QIfgG9x2frRRhvAbx21121
+sCJ5/dvHJS/a8xppcNd4cMFrvLrOkZn6s+gfeXc20sMscdyjnjIbxdmDiUwnhoFT
++9OKg5BYokg11PmEOhMEK7L9qEXaf5L+9TdcxBl/qvciqSpZ9FsOGDYCgB0EMsQ/
+48/Tj/0ABF+c/+WVXzWL51Gdj6waM0qqXjGArbjAUA7ft8gy18n/6DyM3KWlZXCb
++mAwUGnOvHFNbb8jgxSDvFeIos0P6Edq0PDcK5k1uYEeATp0CC6/F3z1Eai2vKy+
+c1BbJZtDJmlKTL+7vykHMSVqAuN/Vq4uvtxv1pOCR1UJk1mW0mr6Ovm9sVVk5HFD
+3j6nOF81PiabdWA6GbbSCQdlpL2v0KipAR/sNheMwXAe+5NGJAiE5uaBgQSTVZS+
+7b4DDKFxfkHR9ISOGURgf9wRxqF6jNS4qqQp9+sOdK6y++ZVGRTTpQbCHEg9V79r
+TTGs4lbvaFCmF/Y9/NPSrRo//l+XhJrpjoeyx04iy6QipErCCFK2dHH5hYfS3ISt
+kbaw2ARNqbcktQkWwA+W+rb83en/w3WG1v2vByKGCr1s4jHAhWtSLZhXx+PIYeT+
+ml/kv+Y3W1T/lOcsytJrXug8t+g4nh9wYTnRl5YwruaKQjWF
+-----END CERTIFICATE-----

roles/docker_swarm/files/server-key.pem

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQC3IKk8MFpynoh7
+dWWUI6MmcP3Pw2z8EJwbkFYTRhekV+2qVz/3mOEn/P5dsumsGXerzOCchaJzxDW5
+Zf3RFYBRD4MMIqomgQvT7mSGwutCy2MKQ1Jmh1zQHcYKIUljhHO7k9ZXFtsp+Z9Q
+PdyaaDknG/3QJo1j1GFdwapyk7XKlbN2uUs1sZyKjrM1rfe0maUWNxliAIjphanC
+hOYC+xZEmjMkvNRP0H3Lf9+6OTh1qYgYcy2VMqKdXs/X+0a4A0cxKDZSYrFhWP8B
+dMb5qMJLJS/ELGAU5H4KHz+3RJvDDp9ISThc7lGO+UwKfoesIi9G4U2m+FwzqxYx
+cuYr3oSAnQ0mpfiJTRJiPWbM4sv9YFu1lwjDIDlyp8V+7HtjhWxxgmn/TQp/tDgx
+3r/WXg54uUkLIMg92Y8od5HOwGfezPIzSZQhm9kGiX/wRdkPRM20GB46K/e6//rT
+Hb2JGDaPfhWKCR98j/k9+/E5/gxXvCrYb26gkhdNbWg3X3EbtKfqjWpVZA9q3LaI
+SYIhLoc1SCKX6ntz/cjMswWIMKFzFCLYboOMDqPIBF8K+3IE0yvKcT0BpaNSS9Fr
+gcaHbXRz/f1UJn90JII91tFEwD966YZ74P+UubaiEz+1vh1YxM0xIds9hRsc+Jbx
+G6PNha4cZwq1vhpP44W2PfS690nnrQIDAQABAoICAACEElRh8wKkg6xWkQULDMdi
+wWen/H85frbufBhkyQH3NWjErCMmwzJsMWi9EUkKGs7VWKgLv7uadY4q03XHhgmc
+GrAEwS6UaFmNgd5fmk3j1rHhUSIUyq8JNkbtIPr9bC+a6C/OuRYpE4o2V1zzPK1D
+HokafrNqxHGne/g8ASfgGcApH9C1MwR9bnyi6txmhRcDM7SiZ5JCDCGdgg11eirz
+45PvsAysg3ZfA4DAQOWn4defEj8NtO9kisbRKWBKosrrJmSWZ4fnd6F8TzSX/dO8
+MEEXUW7RJ7G0vviTnSeQNnjsZB+wQk84y3lRGDzvCVxR7cqLdaKjMD38zQdr1HiM
+IysiYw7aUQ8ukz+4I4izPmn/iDdTxNzTHSvaxCjKRqsaj9R3kEFqtVuOoInfwKD9
+iSoEI35IkEIJwhvnt/xfZY03HwI7JBvSgA23zM5L2dvuM0nwGVcn+/WkLcYRum2y
+hXRbpQ69dVTiFCxQG71bdcuK8z2lxXDPsyBjkcBta/WwQe8sHHdrszyc1Zf5DIDx
+341bQ0cJEZQJD5BmKNij6Ow0N9g/0vySAScKF1zM9J0fE/XBihNYIH9JCXPRrFqw
+BmUGmNjjyJSbnYMxjyVDz8g9026N+w23VtLv0UlA4hF3Hexupqol7XM+MhqNSFIO
+A+F8Ho9U38LZfA3yt8JpAoIBAQD00RQmllHGtRR2zsIA0LPMVUyV3DOshJ4XYj8a
+sN2rSU9rgNRB0rnpgWoGMAysOerPphvoY6bf1wrI3dFt5pzQMuKJLz6VFl135k5R
+11kxZfCmZC/pIp3WLkIHDthAXkU5IKnWw/4vQgmIwTZ5I7rNjPaJYuoH8z5Buuwi
+qUnEJj3czq4iNW2DHAFd657NQImrIbvN4T9SHLGrFBG3Bqf43xc/TMNqOnD7FcYe
++DIkBFXBFqx6pwMjP7hUwo88Oxzp7I/MaDXw9LnSPt2YQqdyNaaFiyk8JWc87LMq
+DFaXFh+aON9XFxvKfCQA5uNCwyaWMi8zNWLpFTPKuZPPaWR5AoIBAQC/fi5ReLUL
+HEpGgKw9UstgexmdnQLVisVfRH9eaQn/U6Yoo8XD0gpdjtqdA9dStV3jw9zKAoeP
+twg819A/nl+kavDP1bGxaxEou9BUFvxyqw0OrA1bKznNlcpCNpqShSiFVO/6CqaU
+awaDRuAsf4gs8/vKzw3q5bPErC+/a8x8USicOMc1tPrUxmTSwoXCfgtb+l7+7K48
+QeA27zPxaOCotAhef1T6KW1mYC7vP0ertZwiG+Lqoh9fzrun5TUYielqqrAJWPFC
+o12r6jqhr9a6dPZ0/ZBCK3JyvdYGt321P6yffA78sz0hvSqT9JMmNnZJSc6oOiuB
+qqutqzl/KgfVAoIBAQDoZWD/kEpompSmg3beVz+WhJKC39mdtvZrtDO7HpIOezUN
+E+pp4aPh6Zu/6/TbuM8R9tkfLRnH+tad/xNDhFrvuJ4bI+IAnI51twY54nck0WQ0
+T367jMTQAHFlSc42rEaCCGOxH7Q3IDT0wJT5QdWeMmYF3QPUMC+1Lb/i11jS/opT
+BU9/4b/nabpSccz5gn4tGYSx11TImbx+bjqyx3rEYOIskK4gNQHzF6RO2cSfNA5D
+kUaB1/C+kUpmC5r0zhiQZqPKolIyPd33mv23/+38GLnOo1+tXMQ3rWoWTEgWfEXb
+nIlGnwUeneF/ia3KPn5urYzoy5DtOddEZg3OInnhAoIBAGrVZ9v2PvMi5mFtGirg
+TSzXoNPpLBKc6D6dRX4TlgtHzNSxgf0c6sGFmHuvD+tJ2kbfGAfv31eTotnnAXzs
+y6k8LHuXWhqEhD84gSLY7CDBQ3ijDpSFiisjXYMRWa1S8udoGrZiSMtW5nxJB3pr
+8Do8KIbee4JIgsG/2qet6ZiV4tU9bA6PmL0qrkdTVTLMBWRcS7FntFFT41Zin5UY
+kPYt8tldqrgicrGCCc1afY7TtHbnHfMPXfeiq9kgrD2ze3ESJ0IfyAIIiJMIC4v3
+QRInfPSKHnh8Ks7PEGAQ8OY0zwbvPKFJElsHYYDIG2xfSCDdN5ltUqZ15G/wrhQ/
+C70CggEAHKhqoWElJNa3Ba4UscXKWL28cXRkMLdZGRngU5W9GLUQhDVYHdy+x5jU
+5V4OnhCFo4Vq8uc2HsKnknhu/KGJ2gf3g8ASkILCG6aqB+0xZ+N6/dW0Yfft7vV4
+az9azn2nEK6Pqiokm0ggc+UhZ4C6EKWY3Vefs0scxKBIx48aGDP0I/XwFrZpwdWC
+Z/jlCjTZlJ+5G7VenkqWtIlJmXZ6zrRFkPKlmxSTKIrDTJaD0dcNmDrwe+au0x+y
+YHMSo0gMN9W5pFN6LDc/JYXOkb995mkKXyzeRTFy+v2yFig6rSwBStwcSTsuNWAe
+FOWrzZPSFGNqLJEHjZdIBAaDR6ER7A==
+-----END PRIVATE KEY-----

roles/docker_swarm/handlers/main.yml

@@ -0,0 +1,5 @@
+- name: restart_docker
+  ansible.builtin.service:
+    name: docker.service
+    state: restarted
+  become: true

roles/docker_swarm/tasks/main.yml

@@ -0,0 +1,29 @@
+- name: Setup docker
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  collections:
+    - community.docker
+  block:
+    - name: Facts
+      ansible.builtin.setup:
+    - name: Install Docker SDK for Python
+      pip:
+        name: docker>=5.0.0
+        executable: pip3
+        break_system_packages: true
+    - name: Initialize swarm
+      docker_swarm:
+        state: present
+        listen_addr: "{{ ansible_default_ipv4.address }}:2377"
+      register: swarm_init
+      when: inventory_hostname == "vm01.home.lan"
+
+    - name: Show join tokens
+      ansible.builtin.debug:
+        msg:
+          - "Manager join token: {{ swarm_init.swarm_facts['JoinTokens']['Manager'] }}"
+          - "Worker join token: {{ swarm_init.swarm_facts['JoinTokens']['Worker'] }}"
+      when: inventory_hostname == "vm01.home.lan"
+
+    - name: Join swarm as worker
+      shell: docker swarm join --token {{ hostvars['vm01.home.lan']['swarm_init'].swarm_facts['JoinTokens']['Worker'] }} {{ hostvars['vm01.home.lan']['ansible_default_ipv4']['address'] }}:2377
+      when: inventory_hostname != "vm01.home.lan"

roles/docker_swarm/vars/main.yml

@@ -0,0 +1 @@
+mode: cert

roles/letsgo/tasks/main.yml

@@ -7,5 +7,6 @@
       loop_control:
         loop_var: roles_item
       loop:
-        - cert_gen
         - docker
+        - docker_swarm
+        - autofs

roles/nfs_server/tasks/main.yml

@@ -48,44 +48,65 @@
         fstype: none
       when: inventory_hostname != 'amd.home.lan'
 
-    - name: Reconfigure nfs fstab
+    - name: Reconfigure nfs exports
       ansible.builtin.lineinfile:
         path: /etc/fstab
-        regexp: "^/media/m-server/downloads .*"
-        line: "/media/m-server/downloads  /srv/nfs/downloads    none    bind    0       0"
+        regexp: "^/share/{{ volume }} .*"
+        line: "/media/m-server/{{ volume }}  /srv/nfs/{{ volume }}    none    bind    0       0"
       when: inventory_hostname == 'm-server.home.lan'
+      loop_control:
+        loop_var: volume
+      loop: 
+        - downloads
+        - music
+        - movies
+        - shows
 
     - name: Reconfigure nfs exports
       ansible.builtin.lineinfile:
         path: /etc/fstab
-        regexp: "^/share/docker_data .*"
-        line: "/share/docker_data  /srv/nfs/docker_data    none    bind    0       0"
+        regexp: "^/share/{{ volume }} .*"
+        line: "/share/{{ volume }}  /srv/nfs/{{ volume }}    none    bind    0       0"
       when: inventory_hostname == 'm-server.home.lan'
+      loop_control:
+        loop_var: volume
+      loop: 
+        - docker_data
 
     - name: Reconfigure nfs exports
       ansible.builtin.lineinfile:
         path: /etc/exports
         regexp: "^/srv/nfs .*"
-        line: "/srv/nfs         192.168.77.0/24(rw,sync,no_subtree_check,crossmnt,fsid=0)"
+        line: "/srv/nfs         192.168.77.0/24(rw,sync,no_subtree_check,crossmnt,fsid=0) 192.168.80.0/24(rw,sync,no_subtree_check,crossmnt,fsid=0)"
 
     - name: Reconfigure nfs exports
       ansible.builtin.lineinfile:
         path: /etc/exports
         regexp: "^/srv/nfs/docker_data .*"
-        line: "/srv/nfs/docker_data 192.168.77.0/24(rw,sync,no_subtree_check)"
+        line: "/srv/nfs/docker_data 192.168.77.0/24(rw,sync,no_subtree_check) 192.168.80.0/24(rw,sync,no_subtree_check)"
       when: inventory_hostname != 'amd.home.lan'
 
     - name: Reconfigure nfs exports
       ansible.builtin.lineinfile:
         path: /etc/exports
-        regexp: "^/srv/nfs/downloads .*"
-        line: "/srv/nfs/downloads 192.168.77.0/24(rw,sync,no_subtree_check)"
+        regexp: "^/srv/nfs/{{ volume }} .*"
+        line: "/srv/nfs/{{ volume }} 192.168.77.0/24(rw,sync,no_subtree_check) 192.168.80.0/24(rw,sync,no_subtree_check)"
       when: inventory_hostname == 'm-server.home.lan'
+      loop_control:
+        loop_var: volume
+      loop: 
+        - downloads
+        - music
+        - movies
+        - shows
+
+
+
     - name: Reconfigure nfs exports
       ansible.builtin.lineinfile:
         path: /etc/exports
         regexp: "^/srv/nfs/backup .*"
-        line: "/srv/nfs/backup 192.168.77.0/24(rw,sync,no_subtree_check)"
+        line: "/srv/nfs/backup 192.168.77.0/24(rw,sync,no_subtree_check) 192.168.80.0/24(rw,sync,no_subtree_check)"
       when: inventory_hostname == 'amd.home.lan'
     - name: Restart nfs service
       ansible.builtin.service:

roles/proxmox/tasks/main.yml

@@ -0,0 +1,127 @@
+- name: Omv Setup
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    # - name: Gather facts
+    #   ansible.builtin.setup:
+    # - name: Print
+    #   ansible.builtin.debug:
+    #     msg: "{{ ansible_facts }}"
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: jaydee.yml
+        name: mysecrets
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Delete content & directory
+      ansible.builtin.file:
+        state: absent
+        path: "{{ dest_folder }}"
+
+    - name: "Check if listed package is installed or not on Debian Linux family"
+      ansible.builtin.package:
+        name: "{{ item }}"
+        state: present
+      check_mode: true
+      loop:
+        - git
+      register: git_installed
+
+    - name: Include role only if missing
+      ansible.builtin.include_role:
+        name: git
+      when: not git_installed
+
+    - name: Pull repo
+      tags:
+        - git_pull
+      ansible.builtin.git:
+        repo: "https://{{ mysecrets['git_user'] | urlencode }}:{{ mysecrets['git_password_mqtt'] | urlencode }}@gitlab.sectorq.eu/jaydee/proxmox.git"
+        dest: "{{ dest_folder }}"
+        update: true
+        clone: true
+        version: main
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Print
+      ansible.builtin.debug:
+        msg: "{{ inventory_hostname }}"
+    - name: Create a directory if it does not exist
+      ansible.builtin.file:
+        path: /myapps/proxmox
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'
+
+    - name: Upload script
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/proxmox.py"
+        dest: /myapps/proxmox/proxmox.py
+        remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Upload exclude file
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/exclude.txt"
+        dest: /myapps/exclude.txt
+        remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Upload requirements
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/requirements.txt"
+        dest: /myapps/requirements.txt
+        remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Upload docker_backups.py
+      ansible.builtin.copy:
+        src: "{{ dest_folder }}/docker_backups.py"
+        dest: /myapps/docker_backups.py
+        remote_src: true
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname == 'm-server.home.lan'
+    - name: Install venv
+      ansible.builtin.apt:
+        name:
+          - python3-virtualenv
+          - rsync
+
+    - name: Install specified python requirements in indicated (virtualenv)
+      ansible.builtin.pip:
+        requirements: /myapps/requirements.txt
+        virtualenv: /myapps/venv
+
+    - name: 'Ensure an old job is no longer present. Removes any job that is prefixed by "#Ansible: an old job" from the crontab'
+      ansible.builtin.cron:
+        name: "omv_backup"
+        state: absent
+    - name: Upload service config
+      ansible.builtin.copy:
+        src: omv_backup.service
+        dest: /etc/systemd/system/omv_backup.service
+        mode: '0755'
+        owner: root
+        group: root
+      when: inventory_hostname == 'amd.home.lan'
+    - name: Restart omv service
+      ansible.builtin.service:
+        name: omv_backup
+        state: restarted
+        daemon_reload: true
+        enabled: true
+      when: inventory_hostname == 'amd.home.lan'
+    # - name: Ensure a job that runs at 2 and 5 exists. Creates an entry like "0 5,2 * * ls -alh > /dev/null"
+    #   ansible.builtin.cron:
+    #     name: "omv_backup"
+    #     minute: "0"
+    #     hour: "8"
+    #     job: "sudo /myapps/omv_backup.py -b > /dev/null  2>&1 &"
+    #     state: present

roles/proxmox/vars/main.yml

@@ -0,0 +1 @@
+dest_folder: "/tmp/ans_repo"

test.yml

@@ -1,4 +0,0 @@
----
-- hosts: datacenter
-  roles:
-    - wazuh-agent