homeserver/README.md

170 lines
4.6 KiB
Markdown
Raw Normal View History

2020-08-18 11:57:53 +02:00
# ansible_heimserver
2021-01-29 12:33:22 +01:00
[![pipeline status](http://git.mgrote.net/mg/ansible/badges/master/pipeline.svg)](http://git.mgrote.net/mg/ansible/-/commits/master)
2021-02-06 18:34:31 +01:00
## Dateirechte
```bash
chmod 0400 vault-pass.yml id_rsa_ansible_user
```
2021-01-27 08:41:58 +01:00
## Ansible KeePass Lookup Plugin aktualisieren
2021-01-27 08:41:58 +01:00
```bash
pip install 'pykeepass>3.2.0' --user
mkdir -p ~/.ansible/plugins/lookup && cd "$_"
curl https://raw.githubusercontent.com/viczem/ansible-keepass/master/keepass.py -o ./keepass.py
```
## collections als Dependency
- in meta
```yaml
collections:
- community.general
```
## defaults in Dictionary
```bash
- name: "register_runner"
community.general.gitlab_runner:
description: "{{ description|default('GitLab-Runner') }}"
```
2021-01-27 09:22:19 +01:00
```yaml
description: <-- Original-Variable
"{{ item.description| <-- Original-Inhalt
default('GitLab-Runner') }}" <-- wenn Inhalt leer, dann default...
```
2021-01-27 09:22:19 +01:00
## [playbook-grapher](https://github.com/haidaraM/ansible-playbook-grapher)
2021-01-08 08:38:21 +01:00
`ansible-playbook-grapher --include-role-tasks tests/fixtures/with_roles.yml`
## example-cli
2021-01-31 14:30:14 +01:00
`ansible-playbook playbooks/base/0_master.yml -i inventory --key-file id_rsa_ansible_user --vault-password-file vault-pass.yml --limit jenkins-test.grote.lan`
## install necessary collections
`ansible-galaxy collection install -r requirements.yml`
## list installed collections
`ansible-galaxy collection list -vvv`
## fix ansible vault-permissions
```bash
sudo chmod 400 id_rsa_ansible_user
sudo chmod 400 vault-pass.yml
```
## vault + KeePass LookUp-Plugin
### Einrichtung
Das Plugin wird bei einer Installation mit dem Playbook "ansible" mit eingerichtet.
2021-02-12 10:32:22 +01:00
Die "Secrets" liegen in der KeepassDB die mit dem Kennwort aus `vault-pass.yml` verschlüsselt ist.
`vault-pass.yml` steht mit in der .gitignore
Die Variable `vault_password_file` ist mit `~/ansible/vault-pass.yml` in der `ansible.cfg` gesetzt.
Diese Datei enthält das Passwort mit dem die KeePassDB verschlüsselt ist.
Das vault-secret für die GroupVars wird mit `ansible-vault encrypt_string <password>` erstellt.
### Erklärung
2021-01-27 09:22:19 +01:00
```yaml
keepass_dbx: "./keepass_db.kdbx"
keepass_psw: !vault |
$ANSIBLE_VAULT;1.1;AES256
62383737XXXXXX531
2021-01-07 11:20:35 +01:00
```
2021-02-12 10:32:22 +01:00
1. mit `vault-pass.yml` wird das Kennwort an ansible-vault übergeben
2021-01-07 11:20:35 +01:00
2. ansible-vault entschlüsselt hiermit die Variable `keepass_psw`
3. der Inhalt der Variable wird dann an das KeePass-Lookup-Plugin übergeben was damit die KeePass-Datei öffnet
### Abfrage der Secrets in tasks/playbooks
`restic_repository_password: "{{ lookup('keepass', 'restic_repository_password', 'password') }}"`
#### Erklärung
2021-01-27 09:22:19 +01:00
```yaml
restic_repository_password: <-- Ansible Variablen Name
lookup('keepass' <-- Aufruf Keepass-Lookup-Plugin
restic_repository_password <-- Titel Eintrag mit Secret
password <-- Feldbzeichner in KeepassDB
```
2021-01-07 11:20:35 +01:00
## Inventory anzeigen
`ansible-inventory -i inventory --graph`
## Alternatives Dictionary Format
2021-01-07 11:20:35 +01:00
```bash
zfs_pool:
- name: "ssd_vm_mirror"
type: "ssd"
cron_minute_zfs_trim: "5"
cron_hour_zfs_trim: "22"
cron_month_zfs_trim: "4,8,12"
cron_day_zfs_trim: "2"
cron_weekday_zfs_scrub: "6"
cron_minutes_zfs_scrub: "0"
cron_hour_zfs_scrub: "23"
```
2021-01-07 11:20:35 +01:00
ist das gleiche wie:
2021-01-07 11:42:14 +01:00
2021-01-27 09:22:19 +01:00
```yaml
2021-01-07 11:20:35 +01:00
zfs_pool:
- { name: "ssd_vm_mirror", type: "ssd", cron_minute_zfs_trim: "5", cron_hour_zfs_trim: "22", cron_month_zfs_trim: "4,8,12", cron_day_zfs_trim: "2", cron_weekday_zfs_scrub: "6", cron_minutes_zfs_scrub: "0", cron_hour_zfs_scrub: "23"}
```
## when: true
`Use when: var rather than when: var == True (or conversely when: not var)`
`when: dokuwiki_update # entspricht when: dokuwiki_update == true`
2021-01-07 11:42:14 +01:00
## Loop + Join
2021-01-07 11:20:35 +01:00
### Vars
2021-01-27 09:22:19 +01:00
```yaml
2021-01-07 11:20:35 +01:00
mountpoint: "/shares"
sources:
- "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi1"
- "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi2"
opts: defaults,allow_other,direct_io,use_ino,moveonenospc=true,category.create=mfs,minfreespace=100G
```
### Tasks
2021-01-27 09:22:19 +01:00
```yaml
2021-01-07 11:20:35 +01:00
- name: "Join/Combine sources"
set_fact:
src: "{{sources | join (':')}}"
loop: "{{ sources }}"
- debug:
msg: "{{src}}"
- name: "Mount mergerFS"
mount:
path: "{{ mountpoint }}"
src: "{{ src }}"
opts: "{{ opts }}"
fstype: fuse.mergerfs
state: mounted
```
2021-01-07 11:42:14 +01:00
## prüfen ob eine Datei existiert
2021-01-27 09:22:19 +01:00
```yaml
2021-01-07 11:42:14 +01:00
- name: check if migration file exists
stat:
path: /etc/miniflux.d/.migration_successful
register: migration_successful_existiert
- name: migration tocuh
file:
path: /etc/miniflux.d/.migration_successful
state: touch
when: migration_successful_existiert.stat.exists == False
```