docs to eng, improvements & fixes
This commit is contained in:
parent
f6e398bf5c
commit
3f931af5f0
|
|
@ -4,7 +4,10 @@
|
|||
"Bash(ansible-playbook *)",
|
||||
"Bash(qwen *)",
|
||||
"Bash(npx *)",
|
||||
"Bash(timeout *)"
|
||||
"Bash(timeout *)",
|
||||
"Read(//home/seba/mydocker/**)",
|
||||
"Read(//home/seba/.qwen/**)",
|
||||
"Read(//home/seba/myansible/**)"
|
||||
]
|
||||
},
|
||||
"$version": 3,
|
||||
|
|
@ -22,4 +25,4 @@
|
|||
"playwright"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,4 +4,4 @@
|
|||
"Bash(ansible-playbook *)"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
184
README.md
184
README.md
|
|
@ -1,74 +1,71 @@
|
|||
# Ansible Configuration Management
|
||||
# Ansible Infrastructure
|
||||
|
||||
Repozytorium zarządza prywatną infrastrukturą: NAS (MyCloud, Asustor), RPI4, komputer (acemagic), router MikroTik.
|
||||
Private home infrastructure managed with Ansible: NAS (WD MyCloud, Asustor), Raspberry Pi 4, main workstation (acemagic), and MikroTik router.
|
||||
|
||||
Parametry `-i inventory/hosts.yml` i `--vault-password-file=vault.pass` sa skonfigurowane w `ansible.cfg` i mozna je pominac.
|
||||
The `-i inventory/hosts.yml` and `--vault-password-file=vault.pass` flags are pre-configured in `ansible.cfg` and can be omitted from all commands.
|
||||
|
||||
---
|
||||
|
||||
## Inwentarz
|
||||
## Inventory
|
||||
|
||||
| Host | IP | Rola |
|
||||
| Host | IP | Role |
|
||||
|---|---|---|
|
||||
| acemagic | 192.168.1.132 | komputer glowny (backupy, crony, autofs, FTP) |
|
||||
| mycloud | 192.168.1.219 | NAS WD MyCloud EX2 Ultra (ARM32) |
|
||||
| asustor-lan1 | 192.168.1.10:8883 | NAS Asustor |
|
||||
| rpi4 | 192.168.1.151 | Raspberry Pi 4 |
|
||||
| mikrotik | 192.168.1.1 | router MikroTik |
|
||||
| `acemagic` | 192.168.1.132 | Main workstation - backups, crons, autofs, FTP |
|
||||
| `mycloud` | 192.168.1.219 | WD MyCloud EX2 Ultra NAS (ARM32) |
|
||||
| `asustor-lan1` | 192.168.1.10:8883 | Asustor NAS |
|
||||
| `rpi4` | 192.168.1.151 | Raspberry Pi 4 (AdGuard Home) |
|
||||
| `mikrotik` | 192.168.1.1 | MikroTik router |
|
||||
|
||||
Zmienne hostow sa szyfrowane Ansible Vault w `inventory/host_vars/`.
|
||||
Host variables are encrypted with Ansible Vault in `inventory/host_vars/`.
|
||||
|
||||
---
|
||||
|
||||
## Playbooki
|
||||
## Playbooks
|
||||
|
||||
### `common.yml` - wspolna konfiguracja serwerow
|
||||
**Hosty:** acemagic, mycloud, rpi4 (nie asustor, nie mikrotik)
|
||||
**Role:** `common`
|
||||
### `common.yml` - base server configuration
|
||||
**Hosts:** `acemagic`, `mycloud`, `rpi4` (excludes asustor and mikrotik)
|
||||
|
||||
Co robi:
|
||||
- ustawia hostname
|
||||
- instaluje pakiety apt (autofs, rsync, vim, net-tools, python3...)
|
||||
- zatrzymuje i wylacza zbedne uslugi systemd
|
||||
- deployuje SSH authorized_keys (klucze z `roles/common/vars/main.yml`)
|
||||
- aktualizuje `/etc/hosts` (52 hosty LAN: kamery, IoT, drukarki)
|
||||
- konfiguruje vsftpd + uzytkownika FTP dla Hikvision (tylko acemagic, haslo z vault)
|
||||
- Sets hostname
|
||||
- Installs apt packages (autofs, rsync, vim, net-tools, python3, ...)
|
||||
- Stops and disables unnecessary systemd services
|
||||
- Deploys SSH authorized keys (from `roles/common/vars/main.yml`)
|
||||
- Updates `/etc/hosts` with ~55 LAN entries (cameras, IoT devices, printers, switches)
|
||||
- Configures vsftpd + FTP user for Hikvision cameras (acemagic only, password from vault)
|
||||
|
||||
```bash
|
||||
ansible-playbook playbooks/common.yml
|
||||
# samo /etc/hosts:
|
||||
|
||||
# Update /etc/hosts only:
|
||||
ansible-playbook playbooks/common.yml --tags update_hosts
|
||||
|
||||
# Target a single host:
|
||||
ansible-playbook playbooks/common.yml -l rpi4
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### `mycloud.yml` - WD MyCloud EX2 Ultra
|
||||
**Hosty:** mycloud
|
||||
**Role:** `mycloud.ssh_keys`, `mycloud.node_exporter`
|
||||
**Hosts:** `mycloud`
|
||||
|
||||
Co robi:
|
||||
- wgrywa authorized_keys na NAS
|
||||
- instaluje node_exporter (ARM32/armv7) - pobiera binarke lokalnie, kopiuje na NAS
|
||||
- uruchamia node_exporter przez nohup (brak systemd na MyCloud OS)
|
||||
- tworzy init script `/etc/init.d/S99node_exporter` dla persistencji
|
||||
- weryfikuje dostepnosc metryk z hosta Ansible
|
||||
- Deploys authorized SSH keys to NAS
|
||||
- Installs node_exporter (ARM32/armv7) - copies binary, starts via nohup (no systemd on MyCloud OS)
|
||||
- Creates `/etc/init.d/S99node_exporter` init script for persistence across reboots
|
||||
- Verifies metrics are reachable from the Ansible controller
|
||||
|
||||
```bash
|
||||
ansible-playbook -l mycloud playbooks/mycloud.yml
|
||||
```
|
||||
|
||||
> **Uwaga:** `--check` (dry-run) blednie failuje na kroku `copy` jesli binarki nie ma lokalnie w `/tmp/` - to ograniczenie check mode, nie blad.
|
||||
> **Note:** `--check` (dry-run) will incorrectly fail on the `copy` step if the binary is not present locally in `/tmp/`. This is a check-mode limitation, not a real error.
|
||||
|
||||
---
|
||||
|
||||
### `asustor.yml` - Asustor NAS
|
||||
**Hosty:** asustor-lan1 (port 8883)
|
||||
**Role:** `asustor.ssh_keys`, `asustor.node_exporter`
|
||||
**Hosts:** `asustor-lan1` (SSH port 8883)
|
||||
|
||||
Co robi:
|
||||
- wgrywa authorized_keys na NAS
|
||||
- sprawdza czy node_exporter dziala, startuje jesli nie
|
||||
- weryfikuje port 9100
|
||||
- Deploys authorized SSH keys
|
||||
- Checks if node_exporter is running, starts it if not
|
||||
- Verifies port 9100 is accessible
|
||||
|
||||
```bash
|
||||
ansible-playbook -l asustor-lan1 playbooks/asustor.yml
|
||||
|
|
@ -76,14 +73,12 @@ ansible-playbook -l asustor-lan1 playbooks/asustor.yml
|
|||
|
||||
---
|
||||
|
||||
### `autofs.yml` - montowanie NAS przez autofs
|
||||
**Hosty:** acemagic
|
||||
**Role:** `autofs_nas`
|
||||
### `autofs.yml` - NAS automount via autofs
|
||||
**Hosts:** `acemagic`
|
||||
|
||||
Co robi:
|
||||
- konfiguruje `/etc/auto.master.d/asustor.autofs` i `/etc/auto.asustor`
|
||||
- konfiguruje `/etc/auto.master.d/mycloud.autofs` i `/etc/auto.mycloud`
|
||||
- restartuje uslugi autofs
|
||||
- Configures `/etc/auto.master.d/asustor.autofs` and `/etc/auto.asustor`
|
||||
- Configures `/etc/auto.master.d/mycloud.autofs` and `/etc/auto.mycloud`
|
||||
- Restarts autofs service
|
||||
|
||||
```bash
|
||||
ansible-playbook playbooks/autofs.yml
|
||||
|
|
@ -91,15 +86,13 @@ ansible-playbook playbooks/autofs.yml
|
|||
|
||||
---
|
||||
|
||||
### `crons-only.yml` - crony na acemagic
|
||||
**Hosty:** acemagic
|
||||
**Role:** `crons.acemagic`
|
||||
### `crons-only.yml` - scheduled tasks on acemagic
|
||||
**Hosts:** `acemagic`
|
||||
|
||||
Co robi:
|
||||
- cron: restart kontenera Frigate (Docker)
|
||||
- cron: backup bazy Bitwarden
|
||||
- cron: keep-alive dla HDD (Seagate 5T, 6T, 16T) - zapobiega usypianiu
|
||||
- hdparm: konfiguracja zapobiegajaca spindown dla SDE i SDB
|
||||
- Cron: Frigate Docker container restart
|
||||
- Cron: Bitwarden database backup
|
||||
- Cron: HDD keep-alive for Seagate drives (5TB, 6TB, 16TB) - prevents spin-down
|
||||
- hdparm: spin-down prevention for SDE and SDB
|
||||
|
||||
```bash
|
||||
ansible-playbook playbooks/crons-only.yml
|
||||
|
|
@ -107,15 +100,12 @@ ansible-playbook playbooks/crons-only.yml
|
|||
|
||||
---
|
||||
|
||||
### `acemagic.backups.yml` - skrypty backup na acemagic
|
||||
**Hosty:** acemagic
|
||||
**Role:** `backups.acemagic`
|
||||
### `acemagic.backups.yml` - backup scripts
|
||||
**Hosts:** `acemagic`
|
||||
|
||||
Co robi:
|
||||
- deployuje `backup.sh` (rsync do Google Drive przez rclone)
|
||||
- deployuje `backup_seagata16t.sh` (rsync Seagate 16T -> Asustor)
|
||||
- tworzy log file
|
||||
- ustawia cron dla backupu 16T
|
||||
- Deploys `backup.sh` (rsync to Google Drive via rclone)
|
||||
- Deploys `backup_seagata16t.sh` (rsync Seagate 16TB -> Asustor NAS)
|
||||
- Creates log file and cron for the 16TB backup
|
||||
|
||||
```bash
|
||||
ansible-playbook playbooks/acemagic.backups.yml
|
||||
|
|
@ -123,13 +113,11 @@ ansible-playbook playbooks/acemagic.backups.yml
|
|||
|
||||
---
|
||||
|
||||
### `mikrotik.backup.yml` - backup routera
|
||||
**Hosty:** mikrotik
|
||||
**Role:** `mikrotik.backup`
|
||||
### `mikrotik.backup.yml` - router backup
|
||||
**Hosts:** `mikrotik`
|
||||
|
||||
Co robi:
|
||||
- wgrywa klucz SSH na MikroTik (jesli nie ma)
|
||||
- ustawia cron lokalny (acemagic) do sciagania backupu codziennie o 03:30
|
||||
- Uploads SSH key to MikroTik if missing
|
||||
- Sets up a local cron on acemagic to pull router backup daily at 03:30
|
||||
|
||||
```bash
|
||||
ansible-playbook playbooks/mikrotik.backup.yml
|
||||
|
|
@ -138,11 +126,10 @@ ansible-playbook playbooks/mikrotik.backup.yml
|
|||
---
|
||||
|
||||
### `setup_postgres_replication.yml` - PostgreSQL logical replication
|
||||
**Hosty:** acemagic (primary), asustor-lan1 (replica)
|
||||
**Hosts:** `acemagic` (primary), `asustor-lan1` (replica)
|
||||
|
||||
Co robi:
|
||||
- tworzy publikacje na primary (acemagic)
|
||||
- tworzy subskrypcje na replice (asustor) dla wybranych baz
|
||||
- Creates publications on primary
|
||||
- Creates subscriptions on replica for selected databases
|
||||
|
||||
```bash
|
||||
ansible-playbook playbooks/setup_postgres_replication.yml
|
||||
|
|
@ -150,47 +137,68 @@ ansible-playbook playbooks/setup_postgres_replication.yml
|
|||
|
||||
---
|
||||
|
||||
### `override_properties.yml` - nadpisanie properties w plikach serwisow
|
||||
Narzedzie do patch'owania plikow `.properties` na zdalnych hostach.
|
||||
### `override_properties.yml` - patch `.properties` files on remote hosts
|
||||
|
||||
```bash
|
||||
ansible-playbook playbooks/override_properties.yml -e "target_host=acemagic service_file=/path/to/app.properties"
|
||||
ansible-playbook playbooks/override_properties.yml \
|
||||
-e "target_host=acemagic service_file=/path/to/app.properties"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
> **Playbooki z brakujacymi rolami** (wymagaja implementacji rol):
|
||||
> - `pureftpd_doorbell.yml` - FTP dla kamery Ring (rola `pureftpd_doorbell` nie istnieje)
|
||||
> - `rsync-mycloud.yml` - rsync z MyCloud (rola `rsync.mycloud` nie istnieje)
|
||||
> **Playbooks with missing roles** (not yet implemented):
|
||||
> - `pureftpd_doorbell.yml` - FTP for Ring doorbell (`pureftpd_doorbell` role missing)
|
||||
> - `rsync-mycloud.yml` - rsync from MyCloud (`rsync.mycloud` role missing)
|
||||
|
||||
---
|
||||
|
||||
## Szyfrowanie zmiennych
|
||||
## Secret Management
|
||||
|
||||
Pliki `inventory/host_vars/*.yml` sa szyfrowane Ansible Vault (AES256).
|
||||
Haslo vault trzymane jest w `vault.pass` (wykluczone z git przez `.gitignore`).
|
||||
Files in `inventory/host_vars/*.yml` and `roles/*/vars/vault.yml` are encrypted with Ansible Vault (AES256). The vault password is stored in `vault.pass` (excluded from git via `.gitignore`).
|
||||
|
||||
```bash
|
||||
# Edycja zaszyfrowanego pliku
|
||||
# Edit an encrypted file
|
||||
ansible-vault edit inventory/host_vars/mycloud.yml
|
||||
|
||||
# Odszyfrowanie wszystkich (przed git operations)
|
||||
# Decrypt all files before editing
|
||||
bash decrypt_vars.sh
|
||||
|
||||
# Ponowne zaszyfrowanie po zmianach
|
||||
# Re-encrypt all files after editing
|
||||
bash encrypt_vars.sh
|
||||
```
|
||||
|
||||
Wrażliwe zmienne per-rola (np. `ftp_password_secret`) sa w `roles/common/vars/vault.yml` (rowniez zaszyfrowany).
|
||||
---
|
||||
|
||||
## Pre-commit Security Hooks
|
||||
|
||||
Two layers of protection:
|
||||
|
||||
**1. Custom git hook** (`.git/hooks/pre-commit`) - always active:
|
||||
- Blocks unencrypted `inventory/host_vars/*.yml` commits
|
||||
- Blocks unencrypted `roles/*/vars/vault.yml` commits
|
||||
- Scans staged files for hardcoded secrets (passwords, tokens, API keys)
|
||||
|
||||
**2. `pre-commit` framework** (`.pre-commit-config.yaml`) - requires one-time setup:
|
||||
- `detect-secrets` - entropy-based secret scanning
|
||||
- `detect-private-key` - blocks PEM/private key files
|
||||
- `check-yaml --unsafe` - validates YAML (unsafe flag needed for Ansible vault tags)
|
||||
- `trailing-whitespace`, `end-of-file-fixer`, `check-merge-conflict`
|
||||
- Blocks accidental `vault.pass` commits
|
||||
|
||||
```bash
|
||||
# One-time setup after cloning:
|
||||
pip install pre-commit
|
||||
pre-commit install
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Logging
|
||||
## Run Logging
|
||||
|
||||
Callback plugin `callback_plugins/json_logger.py` zapisuje wyniki uruchomien do `ansible_runs.jsonl` (wykluczone z git).
|
||||
`callback_plugins/json_logger.py` appends all playbook run results to `ansible_runs.jsonl` (excluded from git).
|
||||
|
||||
---
|
||||
|
||||
## Zaleznosci
|
||||
## Dependencies
|
||||
|
||||
- `geerlingguy.nfs` - zainstalowana lokalnie w `collections/`
|
||||
- `geerlingguy.nfs` - installed locally in `collections/`
|
||||
|
|
|
|||
|
|
@ -7,37 +7,40 @@
|
|||
192.168.1.65 hik2
|
||||
192.168.1.67 hik3
|
||||
192.168.1.100 asrog
|
||||
192.168.1.101 reolink_1
|
||||
192.168.1.62 reolink_2
|
||||
192.168.1.150 reolink_3
|
||||
192.168.1.168 reolink_4
|
||||
192.168.1.172 reolink_5
|
||||
192.168.1.103 Samsung
|
||||
192.168.1.101 reolink_1
|
||||
192.168.1.62 reolink_2
|
||||
192.168.1.150 reolink_3
|
||||
192.168.1.168 reolink_4
|
||||
192.168.1.172 reolink_5
|
||||
192.168.1.103 reolink_1_wifi
|
||||
192.168.1.105 unifi-switch usw-pro-max
|
||||
192.168.1.107 seb-air mac-seb mac-air seb-mac-air
|
||||
192.168.1.110 des-3052p dlink-switch
|
||||
192.168.1.117 raspberrypi
|
||||
192.168.1.119 mr_robot
|
||||
192.168.1.117 raspberrypi rpi4-stefi
|
||||
192.168.1.119 mr_robot vacuum-xiaomi
|
||||
192.168.1.120 reolink
|
||||
192.168.1.127 google-display
|
||||
192.168.1.126 hikvision-domofon-in
|
||||
192.168.1.127 hikvision-domofon hik-domofon
|
||||
192.168.1.128 brother-printer brotherpBC9EB8A
|
||||
192.168.1.130 Mac
|
||||
192.168.1.130 mac-wday-new
|
||||
192.168.1.132 acemagic acemagic-eth
|
||||
192.168.1.133 uap5 UAP5
|
||||
192.168.1.134 uap6 UAP6
|
||||
192.168.1.135 ring ring-doorbell RingDoorbell-87
|
||||
192.168.1.136 gateway-0832-1736-2438
|
||||
192.168.1.138 Chromecast-Ultra
|
||||
192.168.1.139 reolink
|
||||
192.168.1.139 reolink-extra
|
||||
192.168.1.142 acemagic-wifi
|
||||
192.168.1.148 tasmota-EC6CFA-3322
|
||||
192.168.1.149 tasmota-89BA05-6661
|
||||
192.168.1.150 reolink
|
||||
192.168.1.151 rpi4 rpi4-adguard adguard
|
||||
192.168.1.154 homepod
|
||||
192.168.1.155 ESP_61A657
|
||||
192.168.1.156 homeassistant
|
||||
192.168.1.157 unknown-157
|
||||
192.168.1.160 stefi stefi-rpi BATOCERA
|
||||
192.168.1.178 sebas-macpro macpro-personal
|
||||
192.168.1.179 dell-wifi
|
||||
192.168.1.184 tasmota-EC152B-5419
|
||||
192.168.1.185 tasmota-EC1593-5523
|
||||
192.168.1.186 tasmota-EC15A7-5543
|
||||
|
|
|
|||
Loading…
Reference in New Issue