From f5ea712ac9ba36a1568735251355d0f81646ac83 Mon Sep 17 00:00:00 2001 From: Kyattsukuro Date: Fri, 9 Oct 2026 23:16:22 +0200 Subject: [PATCH] core sservices working --- README.md | 5 ++ inventory/host_vars/DebianMain.yml | 7 +-- inventory/host_vars/beDebianMain.yml | 4 ++ inventory/hosts.yaml | 2 +- playbooks/authentik.yml | 6 +++ playbooks/ddns.yml | 2 +- playbooks/gitea.yml | 6 +++ playbooks/jellyfin.yml | 6 +++ playbooks/nextcloud.yml | 6 +++ playbooks/reverseproxy.yml | 2 +- playbooks/vaultwarden.yml | 6 +++ roles/base_server/tasks/main.yml | 9 ++++ roles/homeassistant/templates/compose.yml.j2 | 52 ++++++++++++++++++++ roles/storage_mount/handlers/main.yml | 15 +++--- roles/storage_mount/meta/main.yml | 4 +- roles/storage_mount/tasks/main.yml | 29 ++++++++++- roles/storage_mount/templates/nfs.service.j2 | 8 +-- roles/storage_mount/templates/smb.service.j2 | 10 ++++ 18 files changed, 158 insertions(+), 21 deletions(-) create mode 100644 playbooks/authentik.yml create mode 100644 playbooks/gitea.yml create mode 100644 playbooks/jellyfin.yml create mode 100644 playbooks/nextcloud.yml create mode 100644 playbooks/vaultwarden.yml create mode 100644 roles/storage_mount/templates/smb.service.j2 diff --git a/README.md b/README.md index e69de29..5ef52d9 100644 --- a/README.md +++ b/README.md @@ -0,0 +1,5 @@ +4 drwxr-xr-x 2 someone someone 4096 Oct 9 17:34 authentik_certs +4 drwxr-xr-x 2 root root 4096 Oct 9 17:34 authentik_data +4 drwxrwxr-x 3 someone someone 4096 Oct 9 17:34 authentik_media +4 drwxr-xr-x 2 root root 4096 Oct 9 17:34 authentik_templates +4 drwx------ 19 70 root 4096 Oct 9 18:07 db diff --git a/inventory/host_vars/DebianMain.yml b/inventory/host_vars/DebianMain.yml index 408b9f2..87fcfdd 100644 --- a/inventory/host_vars/DebianMain.yml +++ b/inventory/host_vars/DebianMain.yml @@ -106,11 +106,12 @@ jellyfin_override: gitea_override: version: "1.23.7" - url: "gitea.urmel.de" + url: "git.urmel.de" db_password: "{{ (bitwarden_records_urmel_services['Gitea'].fields | selectattr('name', '==', 'db_password') | first).value }}" data_path: "/mnt/gitea" enable_ssh: true networkmount: host: "217.100.0.2" - host_path: "/mnt/Main/giteaData" - args: "rw,noatime,tcp,uid=1000,gid=1000" + host_path: "giteaData" + args: "username=smb-provider,password=byzxFp3AG2r6Tk6n3HG5lPWhLVIAUT1g,domain=WORKGROUP,uid=1000,gid=1000" + type: "cifs" diff --git a/inventory/host_vars/beDebianMain.yml b/inventory/host_vars/beDebianMain.yml index 58984bd..c97fa4a 100644 --- a/inventory/host_vars/beDebianMain.yml +++ b/inventory/host_vars/beDebianMain.yml @@ -47,6 +47,10 @@ homeassistant_override: client_id: "{{ (bitwarden_records_urmel_services['Be Homeassistant'].fields | selectattr('name', '==', 'oidc_client_id') | first).value }}" client_secret: "{{ (bitwarden_records_urmel_services['Be Homeassistant'].fields | selectattr('name', '==', 'oidc_client_secret') | first).value }}" configure_url: "{{ (bitwarden_records_urmel_services['Be Homeassistant'].fields | selectattr('name', '==', 'oidc_url') | first).value }}" + matter: + domain: "matter.arpa.urmel.de" + openthread_domain: "openthread.arpa.urmel.de" + matter_adapter_id: "usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_f4b015d959f3ef1199c2c61b6d9880ab-if00-port0" mqtt: zigbee2mqtt: zigbee_adapter_id: "usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_f4b015d959f3ef1199c2c61b6d9880ab-if00-port0" diff --git a/inventory/hosts.yaml b/inventory/hosts.yaml index 3942d76..63e35c2 100644 --- a/inventory/hosts.yaml +++ b/inventory/hosts.yaml @@ -5,4 +5,4 @@ all: beDebianMain: ansible_host: 192.168.250.2 DebianMain: - ansible_host: 172.24.2.10 + ansible_host: 172.24.2.5 diff --git a/playbooks/authentik.yml b/playbooks/authentik.yml new file mode 100644 index 0000000..454f4cf --- /dev/null +++ b/playbooks/authentik.yml @@ -0,0 +1,6 @@ +--- +- hosts: DebianMain + pre_tasks: + - include_tasks: _lazy_lookup_workaround.yml + roles: + - authentik diff --git a/playbooks/ddns.yml b/playbooks/ddns.yml index 3112353..e0257b4 100644 --- a/playbooks/ddns.yml +++ b/playbooks/ddns.yml @@ -1,5 +1,5 @@ --- -- hosts: beDebianMain +- hosts: beDebianMain, DebianMain pre_tasks: - include_tasks: _lazy_lookup_workaround.yml roles: diff --git a/playbooks/gitea.yml b/playbooks/gitea.yml new file mode 100644 index 0000000..10b8cd9 --- /dev/null +++ b/playbooks/gitea.yml @@ -0,0 +1,6 @@ +--- +- hosts: DebianMain + pre_tasks: + - include_tasks: _lazy_lookup_workaround.yml + roles: + - gitea diff --git a/playbooks/jellyfin.yml b/playbooks/jellyfin.yml new file mode 100644 index 0000000..cfed4e9 --- /dev/null +++ b/playbooks/jellyfin.yml @@ -0,0 +1,6 @@ +--- +- hosts: DebianMain + pre_tasks: + - include_tasks: _lazy_lookup_workaround.yml + roles: + - jellyfin diff --git a/playbooks/nextcloud.yml b/playbooks/nextcloud.yml new file mode 100644 index 0000000..f5a2eb3 --- /dev/null +++ b/playbooks/nextcloud.yml @@ -0,0 +1,6 @@ +--- +- hosts: DebianMain + pre_tasks: + - include_tasks: _lazy_lookup_workaround.yml + roles: + - nextcloud diff --git a/playbooks/reverseproxy.yml b/playbooks/reverseproxy.yml index beaf1fc..73eae35 100644 --- a/playbooks/reverseproxy.yml +++ b/playbooks/reverseproxy.yml @@ -1,5 +1,5 @@ --- -- hosts: beDebianMain +- hosts: production pre_tasks: - include_tasks: _lazy_lookup_workaround.yml tasks: diff --git a/playbooks/vaultwarden.yml b/playbooks/vaultwarden.yml new file mode 100644 index 0000000..0b7d298 --- /dev/null +++ b/playbooks/vaultwarden.yml @@ -0,0 +1,6 @@ +--- +- hosts: DebianMain + pre_tasks: + - include_tasks: _lazy_lookup_workaround.yml + roles: + - vaultwarden diff --git a/roles/base_server/tasks/main.yml b/roles/base_server/tasks/main.yml index 805c60a..a19c3f2 100644 --- a/roles/base_server/tasks/main.yml +++ b/roles/base_server/tasks/main.yml @@ -10,6 +10,7 @@ - docker-compose - docker-doc - netfilter-persistent + - netplan.io state: latest - name: Install devhelpers @@ -24,10 +25,18 @@ src: etc.docker.deamon.json dest: /etc/docker/daemon.json +- name: Enable systemd networking + ansible.builtin.systemd_service: + state: started + enabled: true + daemon_reload: true + name: systemd-networkd + - name: Restart docker ansible.builtin.systemd_service: state: restarted daemon_reload: true + enabled: true name: docker - name: Add .bashrc diff --git a/roles/homeassistant/templates/compose.yml.j2 b/roles/homeassistant/templates/compose.yml.j2 index c025e35..50b5a2a 100644 --- a/roles/homeassistant/templates/compose.yml.j2 +++ b/roles/homeassistant/templates/compose.yml.j2 @@ -56,6 +56,58 @@ services: traefik.http.routers.homeassistant-mqtt.middlewares: local-only@file {% endif %} +{% if homeassistant.matter.matter_adapter_id %} + matter: + image: ghcr.io/matter-js/matterjs-server:stable + volumes: + - ./data/matter:/data + networks: + local_network: + ipv4_address: ${SUBNET}.7 + exposed: + labels: + traefik.enable: true + + traefik.http.routers.homeassistant-matter.entrypoints: https + traefik.http.routers.homeassistant-matter.rule: Host(`{{ homeassistant.matter.domain }}`) + traefik.http.services.homeassistant-matter.loadbalancer.server.port: 5580 + traefik.http.routers.homeassistant-matter.tls: "true" + traefik.http.routers.homeassistant-matter.tls.certresolver: hetzner + traefik.http.routers.homeassistant-matter.middlewares: local-only@file + openthread: + image: openthread/border-router:latest + networks: + local_network: + ipv4_address: ${SUBNET}.8 + exposed: + environment: + - TZ=Europe/Berlin + - OT_RCP_DEVICE=/dev/ttyUSB0 + - OT_LOG_LEVEL=7 + - OT_THREAD_IF=wpan0 + - OT_INFRA_IF=br0 + - OT_REST_LISTEN_ADDR=0.0.0.0 + - OT_REST_LISTEN_PORT=9212 + volumes: + - ./data/openthread:/data + devices: + # Make sure this matched your adapter location + - /dev/serial/by-id/{{ homeassistant.matter.matter_adapter_id }}:/dev/ttyUSB0 + - /dev/net/tun:/dev/net/tun + cap_add: + - NET_ADMIN + labels: + traefik.enable: true + + traefik.http.routers.homeassistant-openthread.entrypoints: https + traefik.http.routers.homeassistant-openthread.rule: Host(`{{ homeassistant.matter.openthread_domain }}`) + traefik.http.services.homeassistant-openthread.loadbalancer.server.port: 9212 + traefik.http.routers.homeassistant-openthread.tls: "true" + traefik.http.routers.homeassistant-openthread.tls.certresolver: hetzner + traefik.http.routers.homeassistant-openthread.middlewares: local-only@file + restart: always +{% endif %} + mosquitto: image: eclipse-mosquitto:{{ homeassistant.mqtt.mosquitto.version }} restart: unless-stopped diff --git a/roles/storage_mount/handlers/main.yml b/roles/storage_mount/handlers/main.yml index 993ba92..c62b155 100644 --- a/roles/storage_mount/handlers/main.yml +++ b/roles/storage_mount/handlers/main.yml @@ -1,9 +1,8 @@ - name: restart container -community.docker.docker_compose_v2: - project_src: "{{ path }}" - project_name: "{{ role_name }}" - recreate: "always" - services: ["storage_mount"] - state: "restarted" -when: not _storage_mount_already_restarted - + community.docker.docker_compose_v2: + project_src: "{{ path }}" + project_name: "{{ role_name }}" + recreate: "always" + services: ["storage_mount"] + state: "restarted" + when: not _storage_mount_already_restarted diff --git a/roles/storage_mount/meta/main.yml b/roles/storage_mount/meta/main.yml index 3a1b078..f7b5618 100644 --- a/roles/storage_mount/meta/main.yml +++ b/roles/storage_mount/meta/main.yml @@ -16,5 +16,5 @@ galaxy_info: # NOTE: A tag is limited to a single word comprised of alphanumeric characters. # Maximum 20 tags per role. -# dependencies: -# - role: base +dependencies: + - role: traefik diff --git a/roles/storage_mount/tasks/main.yml b/roles/storage_mount/tasks/main.yml index c9359e6..45080f3 100644 --- a/roles/storage_mount/tasks/main.yml +++ b/roles/storage_mount/tasks/main.yml @@ -8,9 +8,34 @@ register: escaped_mount_path - block: + - name: install nfs dependencies + package: + name: + - nfs-common + - name: template nsf.service template: - stc: nfs.service.j2 - path: "/etc/systemd/system/{{ escaped_mount_path.stdout }}" + src: nfs.service.j2 + dest: "/etc/systemd/system/{{ escaped_mount_path.stdout }}" when: - "'nfs' in storage_mount.type" + +- block: + - name: install cifs (for SMB) dependencies + package: + name: + - cifs-utils + + - name: template smb.service + template: + src: smb.service.j2 + dest: "/etc/systemd/system/{{ escaped_mount_path.stdout }}" + when: + - "'cifs' in storage_mount.type" + +- name: Ensure systemd mountpoint is enabled+started + systemd_service: + state: "started" + daemon_reload: true + enabled: true + name: "{{ escaped_mount_path.stdout }}" diff --git a/roles/storage_mount/templates/nfs.service.j2 b/roles/storage_mount/templates/nfs.service.j2 index a07059e..b8c0eaa 100644 --- a/roles/storage_mount/templates/nfs.service.j2 +++ b/roles/storage_mount/templates/nfs.service.j2 @@ -1,8 +1,10 @@ [Unit] -Description=Mount {{ escaped_mount_path }} via NFS +Description=Mount {{ storage_mount.dest_path }} via NFS +After = network-online.target +Wants = network-online.target [Mount] What={{ storage_mount.host }}:{{ storage_mount.host_path }} -Where={{ escaped_mount_path }} +Where={{ storage_mount.dest_path }} Type={{ storage_mount.type }} -Options={{ storage_mount.options }} +Options={{ storage_mount.args }} diff --git a/roles/storage_mount/templates/smb.service.j2 b/roles/storage_mount/templates/smb.service.j2 new file mode 100644 index 0000000..6c748a3 --- /dev/null +++ b/roles/storage_mount/templates/smb.service.j2 @@ -0,0 +1,10 @@ +[Unit] +Description=Mount {{ storage_mount.dest_path }} via SMB +After = network-online.target +Wants = network-online.target + +[Mount] +What=//{{ storage_mount.host }}/{{ storage_mount.host_path }} +Where={{ storage_mount.dest_path }} +Type={{ storage_mount.type }} +Options={{ storage_mount.args }}