graham/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infra/ansible/playbook.yml
Graham McIntire 292758900e
Add hi (74.50.113.232) with Forgejo + Caddy, bootstrapped support.vntx.net 
- DNS: hi.mcintire.me A/AAAA, git.mcintire.me A/AAAA updated to new host
- forgejo role: Docker Compose deployment with SQLite, INSTALL_LOCK, admin user creation
- Caddyfile-hi.j2: reverse proxy git.mcintire.me -> localhost:3000
- tailscale role: skip connect when no auth key; dynamic repo suite
- debian role: fix Signed-By for debian.sources on trixie
- curl added to base Debian packages
- support.vntx.net: added to vntx_servers, DNS, host_vars
2026-07-24 13:12:33 -05:00

440 lines
10 KiB
YAML
Raw Permalink Blame History

---
- name: Apply common configuration to all nodes
hosts: all
become: true
# become_method: sudo
gather_facts: true
remote_user: ansible
roles:
- base
tags:
- common
tasks:
- name: Set timezone
community.general.timezone:
name: "{{ timezone }}"
- name: Install and configure Tailscale
hosts: tailscale_servers
become: true
gather_facts: true
tags:
- tailscale
roles:
- tailscale
- name: Apply firewall configuration
hosts: all:!proxmox_servers:!irc_limited
become: true
gather_facts: true
tags:
- firewall
roles:
- firewall
- name: Install and configure NetBox
hosts: netbox_servers
become: true
gather_facts: true
tags:
- netbox
roles:
- netbox
- name: Install and configure Icinga2 monitor
hosts: monitoring_servers
become: true
gather_facts: true
tags:
- monitor
- icinga2
roles:
- monitor
- name: Install and configure Caddy
hosts: caddy_servers
become: true
tags:
- caddy
roles:
- caddy
- name: Configure PostgreSQL servers and PgBouncer
hosts: postgresql_servers
become: true
gather_facts: true
tags:
- postgresql
roles:
- role: base
tags: base
- role: geerlingguy.postgresql
tags: postgres
- role: pgbouncer
tags: pgbouncer
- name: Provision BIND9 VM on Proxmox
hosts: localhost
gather_facts: false
tags:
- dns
- bind9
- provision
- never
vars:
# Proxmox connection settings (matches terraform/variables.tf)
proxmox_node: "{{ lookup('env', 'PROXMOX_NODE') | default('vm2-380', true) }}"
proxmox_api_host: 10.0.0.2
proxmox_api_user: "{{ lookup('env', 'PROXMOX_API_USER') | default('root@pam', true) }}"
proxmox_api_password: "{{ lookup('env', 'PROXMOX_API_PASSWORD') }}"
proxmox_storage: local-lvm
proxmox_template_name: debian-cloud-init
proxmox_template_vmid: 9000
# BIND9 VM configuration
vm_name: ns1.as393837.net
vm_vmid: 222
vm_ip: 204.110.191.222
vm_gateway: 204.110.191.254
vm_netmask: 255.255.255.224
vm_cores: 2
vm_memory: 2048
vm_disk_size: 64
ansible_ssh_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFghGMnDdkfNC6JPEhMxrKhYDmNcXjHXp/y/mf3uLtzb"
tasks:
- name: Clone cloud-init template for BIND9 server
community.proxmox.proxmox_kvm:
node: "{{ proxmox_node }}"
vmid: "{{ proxmox_template_vmid }}"
clone: "{{ proxmox_template_name }}"
newid: "{{ vm_vmid }}"
name: "{{ vm_name }}"
api_user: "{{ proxmox_api_user }}"
api_password: "{{ proxmox_api_password }}"
api_host: "{{ proxmox_api_host }}"
validate_certs: false
storage: "{{ proxmox_storage }}"
timeout: 90
full: true
- name: Configure VM resources
community.proxmox.proxmox_kvm:
node: "{{ proxmox_node }}"
vmid: "{{ vm_vmid }}"
name: "{{ vm_name }}"
api_user: "{{ proxmox_api_user }}"
api_password: "{{ proxmox_api_password }}"
api_host: "{{ proxmox_api_host }}"
validate_certs: false
cores: "{{ vm_cores }}"
memory: "{{ vm_memory }}"
update: true
- name: Resize disk
community.proxmox.proxmox_disk:
vmid: "{{ vm_vmid }}"
api_user: "{{ proxmox_api_user }}"
api_password: "{{ proxmox_api_password }}"
api_host: "{{ proxmox_api_host }}"
validate_certs: false
disk: scsi0
size: "{{ vm_disk_size }}G"
state: resized
- name: Configure cloud-init network
community.proxmox.proxmox_kvm:
node: "{{ proxmox_node }}"
vmid: "{{ vm_vmid }}"
name: "{{ vm_name }}"
api_user: "{{ proxmox_api_user }}"
api_password: "{{ proxmox_api_password }}"
api_host: "{{ proxmox_api_host }}"
validate_certs: false
ipconfig:
ipconfig0: "ip={{ vm_ip }}/26,gw={{ vm_gateway }}"
nameservers:
- 1.1.1.1
- 8.8.8.8
ciuser: debian
cipassword: "sxcbctolxALGnj2R8GStXrfW8GVd3s/ju91fNon7T1U="
update: true
- name: Start VM
community.proxmox.proxmox_kvm:
node: "{{ proxmox_node }}"
vmid: "{{ vm_vmid }}"
name: "{{ vm_name }}"
api_user: "{{ proxmox_api_user }}"
api_password: "{{ proxmox_api_password }}"
api_host: "{{ proxmox_api_host }}"
validate_certs: false
state: started
- name: Wait for VM to be accessible via SSH
ansible.builtin.wait_for:
host: "{{ vm_ip }}"
port: 22
delay: 30
timeout: 300
state: started
- name: Add VM to in-memory inventory
ansible.builtin.add_host:
name: "{{ vm_name }}"
ansible_host: "{{ vm_ip }}"
groups: bind9_servers
- name: Configure BIND9 Servers
hosts: bind9_servers
become: true
gather_facts: true
tags:
- dns
- bind9
roles:
- role: base
tags: base
- role: ns
tags: ns
- name: Apply general configuration to all nodes
hosts: all:!irc_limited
become: true
become_method: sudo
roles:
- general
tags:
- general
- name: Configure LibreNMS servers
hosts: librenms_servers
become: true
gather_facts: true
tags:
- librenms
roles:
- librenms
- name: Configure aprsc servers
hosts: aprsc_servers
become: true
gather_facts: true
tags:
- aprsc
roles:
- aprsc
- name: Provision UISP VM on Proxmox
hosts: localhost
gather_facts: false
tags:
- uisp
- provision
- never
vars:
# Proxmox connection settings
proxmox_node: "{{ lookup('env', 'PROXMOX_NODE') | default('vm2-380', true) }}"
proxmox_api_host: 10.0.0.2
proxmox_api_user: "{{ lookup('env', 'PROXMOX_API_USER') | default('root@pam', true) }}"
proxmox_api_password: "{{ lookup('env', 'PROXMOX_API_PASSWORD') }}"
proxmox_storage: local-lvm
proxmox_template_name: debian-cloud-init
proxmox_template_vmid: 9000
# UISP VM configuration
vm_name: uisp.vntx.net
vm_vmid: 224
vm_ip: 204.110.191.224
vm_gateway: 204.110.191.254
vm_cores: 20
vm_memory: 16384
vm_disk_size: 64
vm_vlan: 9
ansible_ssh_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFghGMnDdkfNC6JPEhMxrKhYDmNcXjHXp/y/mf3uLtzb"
tasks:
- name: Clone cloud-init template for UISP server
community.proxmox.proxmox_kvm:
node: "{{ proxmox_node }}"
vmid: "{{ proxmox_template_vmid }}"
clone: "{{ proxmox_template_name }}"
newid: "{{ vm_vmid }}"
name: "{{ vm_name }}"
api_user: "{{ proxmox_api_user }}"
api_password: "{{ proxmox_api_password }}"
api_host: "{{ proxmox_api_host }}"
validate_certs: false
storage: "{{ proxmox_storage }}"
timeout: 90
full: true
- name: Configure VM resources
community.proxmox.proxmox_kvm:
node: "{{ proxmox_node }}"
vmid: "{{ vm_vmid }}"
name: "{{ vm_name }}"
api_user: "{{ proxmox_api_user }}"
api_password: "{{ proxmox_api_password }}"
api_host: "{{ proxmox_api_host }}"
validate_certs: false
cores: "{{ vm_cores }}"
memory: "{{ vm_memory }}"
net:
net0: "virtio,bridge=vmbr0,tag={{ vm_vlan }}"
update: true
- name: Resize disk
community.proxmox.proxmox_disk:
vmid: "{{ vm_vmid }}"
api_user: "{{ proxmox_api_user }}"
api_password: "{{ proxmox_api_password }}"
api_host: "{{ proxmox_api_host }}"
validate_certs: false
disk: scsi0
size: "{{ vm_disk_size }}G"
state: resized
- name: Configure cloud-init network
community.proxmox.proxmox_kvm:
node: "{{ proxmox_node }}"
vmid: "{{ vm_vmid }}"
name: "{{ vm_name }}"
api_user: "{{ proxmox_api_user }}"
api_password: "{{ proxmox_api_password }}"
api_host: "{{ proxmox_api_host }}"
validate_certs: false
ipconfig:
ipconfig0: "ip={{ vm_ip }}/26,gw={{ vm_gateway }}"
nameservers:
- 1.1.1.1
- 8.8.8.8
ciuser: debian
cipassword: "sxcbctolxALGnj2R8GStXrfW8GVd3s/ju91fNon7T1U="
searchdomains: vntx.net
sshkeys: "{{ ansible_ssh_key }}"
update: true
- name: Start VM
community.proxmox.proxmox_kvm:
node: "{{ proxmox_node }}"
vmid: "{{ vm_vmid }}"
name: "{{ vm_name }}"
api_user: "{{ proxmox_api_user }}"
api_password: "{{ proxmox_api_password }}"
api_host: "{{ proxmox_api_host }}"
validate_certs: false
state: started
- name: Wait for VM to be accessible via SSH
ansible.builtin.wait_for:
host: "{{ vm_ip }}"
port: 22
delay: 30
timeout: 300
state: started
- name: Add VM to in-memory inventory
ansible.builtin.add_host:
name: "{{ vm_name }}"
ansible_host: "{{ vm_ip }}"
ansible_user: debian
groups: uisp_servers
- name: Configure UISP servers
hosts: uisp_servers
become: true
gather_facts: true
tags:
- uisp
roles:
- role: base
tags: base
- role: uisp
tags: uisp
- name: Configure Dokku servers
hosts: dokku_servers
become: true
gather_facts: true
tags:
- dokku
roles:
- dokku
- name: Install and configure Forgejo
hosts: forgejo_servers
become: true
gather_facts: true
tags:
- forgejo
roles:
- forgejo
- name: Configure node_exporter targets
hosts: node_exporter_servers
become: true
gather_facts: true
tags:
- node_exporter
- prometheus_stack
roles:
- node_exporter
- name: Configure Prometheus monitoring stack
hosts: prometheus_servers
become: true
gather_facts: true
tags:
- prometheus_stack
roles:
- role: alertmanager
tags: alertmanager
- role: prometheus
tags: prometheus
- role: loki
tags: loki
- role: grafana
tags: grafana
- name: Configure FreeRADIUS servers
hosts: radius_servers
become: true
gather_facts: true
tags:
- radius
- freeradius
roles:
- freeradius
- name: Configure IRC servers
hosts: irc_servers
become: true
gather_facts: true
tags:
- irc
- inspircd
roles:
- inspircd
- name: Configure OpenSearch servers
hosts: opensearch_servers
become: true
gather_facts: true
tags:
- opensearch
- logs
roles:
- opensearch
- name: Install and configure Fluent Bit syslog collector
hosts: opensearch_servers
become: true
gather_facts: true
tags:
- fluentbit
- logs
roles:
- fluentbit
Reference in a new issue View git blame Copy permalink