core sservices working

README.md

@@ -0,0 +1,5 @@
+4 drwxr-xr-x  2 someone someone 4096 Oct  9 17:34 authentik_certs
+4 drwxr-xr-x  2 root    root    4096 Oct  9 17:34 authentik_data
+4 drwxrwxr-x  3 someone someone 4096 Oct  9 17:34 authentik_media
+4 drwxr-xr-x  2 root    root    4096 Oct  9 17:34 authentik_templates
+4 drwx------ 19      70 root    4096 Oct  9 18:07 db

inventory/host_vars/DebianMain.yml

@@ -106,11 +106,12 @@ jellyfin_override:
 
 gitea_override:
   version: "1.23.7"
-  url: "gitea.urmel.de"
+  url: "git.urmel.de"
   db_password: "{{ (bitwarden_records_urmel_services['Gitea'].fields | selectattr('name', '==', 'db_password') | first).value }}"
   data_path: "/mnt/gitea"
   enable_ssh: true
   networkmount:
     host: "217.100.0.2"
-    host_path: "/mnt/Main/giteaData"
-    args: "rw,noatime,tcp,uid=1000,gid=1000"
+    host_path: "giteaData"
+    args: "username=smb-provider,password=byzxFp3AG2r6Tk6n3HG5lPWhLVIAUT1g,domain=WORKGROUP,uid=1000,gid=1000"
+    type: "cifs"

inventory/host_vars/beDebianMain.yml

@@ -47,6 +47,10 @@ homeassistant_override:
     client_id: "{{ (bitwarden_records_urmel_services['Be Homeassistant'].fields | selectattr('name', '==', 'oidc_client_id') | first).value }}"
     client_secret: "{{ (bitwarden_records_urmel_services['Be Homeassistant'].fields | selectattr('name', '==', 'oidc_client_secret') | first).value }}"
     configure_url: "{{ (bitwarden_records_urmel_services['Be Homeassistant'].fields | selectattr('name', '==', 'oidc_url') | first).value }}"
+  matter:
+    domain: "matter.arpa.urmel.de"
+    openthread_domain: "openthread.arpa.urmel.de"
+    matter_adapter_id: "usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_f4b015d959f3ef1199c2c61b6d9880ab-if00-port0"
   mqtt:
     zigbee2mqtt:
       zigbee_adapter_id: "usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_f4b015d959f3ef1199c2c61b6d9880ab-if00-port0"

inventory/hosts.yaml

@@ -5,4 +5,4 @@ all:
         beDebianMain:
           ansible_host: 192.168.250.2
         DebianMain:
-          ansible_host: 172.24.2.10
+          ansible_host: 172.24.2.5

playbooks/authentik.yml

@@ -0,0 +1,6 @@
+---
+- hosts: DebianMain
+  pre_tasks:
+    - include_tasks: _lazy_lookup_workaround.yml
+  roles:
+    - authentik

playbooks/ddns.yml

@@ -1,5 +1,5 @@
 ---
-- hosts: beDebianMain
+- hosts: beDebianMain, DebianMain
   pre_tasks:
     - include_tasks: _lazy_lookup_workaround.yml
   roles:

playbooks/gitea.yml

@@ -0,0 +1,6 @@
+---
+- hosts: DebianMain
+  pre_tasks:
+    - include_tasks: _lazy_lookup_workaround.yml
+  roles:
+    - gitea

playbooks/jellyfin.yml

@@ -0,0 +1,6 @@
+---
+- hosts: DebianMain
+  pre_tasks:
+    - include_tasks: _lazy_lookup_workaround.yml
+  roles:
+    - jellyfin

playbooks/nextcloud.yml

@@ -0,0 +1,6 @@
+---
+- hosts: DebianMain
+  pre_tasks:
+    - include_tasks: _lazy_lookup_workaround.yml
+  roles:
+    - nextcloud

playbooks/reverseproxy.yml

@@ -1,5 +1,5 @@
 ---
-- hosts: beDebianMain
+- hosts: production
   pre_tasks:
     - include_tasks: _lazy_lookup_workaround.yml
   tasks:

playbooks/vaultwarden.yml

@@ -0,0 +1,6 @@
+---
+- hosts: DebianMain
+  pre_tasks:
+    - include_tasks: _lazy_lookup_workaround.yml
+  roles:
+    - vaultwarden

roles/base_server/tasks/main.yml

@@ -10,6 +10,7 @@
       - docker-compose
       - docker-doc
       - netfilter-persistent
+      - netplan.io
     state: latest
 
 - name: Install devhelpers
@@ -24,10 +25,18 @@
     src: etc.docker.deamon.json
     dest: /etc/docker/daemon.json
 
+- name: Enable systemd networking
+  ansible.builtin.systemd_service:
+    state: started
+    enabled: true
+    daemon_reload: true
+    name: systemd-networkd
+
 - name: Restart docker
   ansible.builtin.systemd_service:
     state: restarted
     daemon_reload: true
+    enabled: true
     name: docker
 
 - name: Add .bashrc

roles/homeassistant/templates/compose.yml.j2

@@ -56,6 +56,58 @@ services:
       traefik.http.routers.homeassistant-mqtt.middlewares: local-only@file
 {% endif %}
 
+{% if homeassistant.matter.matter_adapter_id %}
+  matter:
+    image: ghcr.io/matter-js/matterjs-server:stable
+    volumes:
+        - ./data/matter:/data
+    networks:
+      local_network:
+        ipv4_address: ${SUBNET}.7
+      exposed:
+    labels:
+      traefik.enable: true
+
+      traefik.http.routers.homeassistant-matter.entrypoints: https
+      traefik.http.routers.homeassistant-matter.rule: Host(`{{ homeassistant.matter.domain }}`)
+      traefik.http.services.homeassistant-matter.loadbalancer.server.port: 5580
+      traefik.http.routers.homeassistant-matter.tls: "true"
+      traefik.http.routers.homeassistant-matter.tls.certresolver: hetzner
+      traefik.http.routers.homeassistant-matter.middlewares: local-only@file
+  openthread:
+    image: openthread/border-router:latest
+    networks:
+      local_network:
+        ipv4_address: ${SUBNET}.8
+      exposed:
+    environment:
+      - TZ=Europe/Berlin
+      - OT_RCP_DEVICE=/dev/ttyUSB0
+      - OT_LOG_LEVEL=7
+      - OT_THREAD_IF=wpan0
+      - OT_INFRA_IF=br0
+      - OT_REST_LISTEN_ADDR=0.0.0.0
+      - OT_REST_LISTEN_PORT=9212
+    volumes:
+      - ./data/openthread:/data
+    devices:
+      # Make sure this matched your adapter location
+      - /dev/serial/by-id/{{ homeassistant.matter.matter_adapter_id }}:/dev/ttyUSB0
+      - /dev/net/tun:/dev/net/tun
+    cap_add:
+      - NET_ADMIN
+    labels:
+      traefik.enable: true
+
+      traefik.http.routers.homeassistant-openthread.entrypoints: https
+      traefik.http.routers.homeassistant-openthread.rule: Host(`{{ homeassistant.matter.openthread_domain }}`)
+      traefik.http.services.homeassistant-openthread.loadbalancer.server.port: 9212
+      traefik.http.routers.homeassistant-openthread.tls: "true"
+      traefik.http.routers.homeassistant-openthread.tls.certresolver: hetzner
+      traefik.http.routers.homeassistant-openthread.middlewares: local-only@file
+    restart: always
+{% endif %}
+
   mosquitto:
     image: eclipse-mosquitto:{{ homeassistant.mqtt.mosquitto.version }}
     restart: unless-stopped

roles/storage_mount/handlers/main.yml

@@ -1,9 +1,8 @@
 - name: restart container
-community.docker.docker_compose_v2:
+  community.docker.docker_compose_v2:
       project_src: "{{ path }}"
       project_name: "{{ role_name }}"
       recreate: "always"
       services: ["storage_mount"]
       state: "restarted"
-when: not _storage_mount_already_restarted
-
+  when: not _storage_mount_already_restarted

roles/storage_mount/meta/main.yml

@@ -16,5 +16,5 @@ galaxy_info:
     # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
     #       Maximum 20 tags per role.
 
-# dependencies:
-#  - role: base
+dependencies:
+  - role: traefik

roles/storage_mount/tasks/main.yml

@@ -8,9 +8,34 @@
   register: escaped_mount_path
 
 - block:
+  - name: install nfs dependencies
+    package:
+      name:
+        - nfs-common
+
   - name: template nsf.service
     template:
-      stc: nfs.service.j2
-      path: "/etc/systemd/system/{{ escaped_mount_path.stdout }}"
+      src: nfs.service.j2
+      dest: "/etc/systemd/system/{{ escaped_mount_path.stdout }}"
   when:
       - "'nfs' in storage_mount.type"
+
+- block:
+  - name: install cifs (for SMB) dependencies
+    package:
+      name:
+        - cifs-utils
+
+  - name: template smb.service
+    template:
+      src: smb.service.j2
+      dest: "/etc/systemd/system/{{ escaped_mount_path.stdout }}"
+  when:
+      - "'cifs' in storage_mount.type"
+
+- name: Ensure systemd mountpoint is enabled+started
+  systemd_service:
+    state: "started"
+    daemon_reload: true
+    enabled: true
+    name: "{{ escaped_mount_path.stdout }}"

roles/storage_mount/templates/nfs.service.j2

@@ -1,8 +1,10 @@
 [Unit]
-Description=Mount {{ escaped_mount_path }} via NFS
+Description=Mount {{ storage_mount.dest_path }} via NFS
+After = network-online.target
+Wants = network-online.target
 
 [Mount]
 What={{ storage_mount.host }}:{{ storage_mount.host_path }}
-Where={{ escaped_mount_path }}
+Where={{ storage_mount.dest_path }}
 Type={{ storage_mount.type }}
-Options={{ storage_mount.options }}
+Options={{ storage_mount.args }}

roles/storage_mount/templates/smb.service.j2

@@ -0,0 +1,10 @@
+[Unit]
+Description=Mount {{ storage_mount.dest_path }} via SMB
+After = network-online.target
+Wants = network-online.target
+
+[Mount]
+What=//{{ storage_mount.host }}/{{ storage_mount.host_path }}
+Where={{ storage_mount.dest_path }}
+Type={{ storage_mount.type }}
+Options={{ storage_mount.args }}