seba
/
myansible
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
myansible/README.md

5.5 KiB
Raw Permalink Blame History

Ansible Infrastructure

Private home infrastructure managed with Ansible: NAS (WD MyCloud, Asustor), Raspberry Pi 4, main workstation (acemagic), and MikroTik router.

The -i inventory/hosts.yml and --vault-password-file=vault.pass flags are pre-configured in ansible.cfg and can be omitted from all commands.

Inventory

Host IP Role
acemagic 192.168.1.132 Main workstation - backups, crons, autofs, FTP
mycloud 192.168.1.219 WD MyCloud EX2 Ultra NAS (ARM32)
asustor-lan1 192.168.1.10:8883 Asustor NAS
rpi4 192.168.1.151 Raspberry Pi 4 (AdGuard Home)
mikrotik 192.168.1.1 MikroTik router

Host variables are encrypted with Ansible Vault in inventory/host_vars/.

Playbooks

common.yml - base server configuration

Hosts: acemagic, mycloud, rpi4 (excludes asustor and mikrotik)

  • Sets hostname
  • Installs apt packages (autofs, rsync, vim, net-tools, python3, ...)
  • Stops and disables unnecessary systemd services
  • Deploys SSH authorized keys (from roles/common/vars/main.yml)
  • Updates /etc/hosts with ~55 LAN entries (cameras, IoT devices, printers, switches)
  • Configures vsftpd + FTP user for Hikvision cameras (acemagic only, password from vault)
ansible-playbook playbooks/common.yml

# Update /etc/hosts only:
ansible-playbook playbooks/common.yml --tags update_hosts

# Target a single host:
ansible-playbook playbooks/common.yml -l rpi4

mycloud.yml - WD MyCloud EX2 Ultra

Hosts: mycloud

  • Deploys authorized SSH keys to NAS
  • Installs node_exporter (ARM32/armv7) - copies binary, starts via nohup (no systemd on MyCloud OS)
  • Creates /etc/init.d/S99node_exporter init script for persistence across reboots
  • Verifies metrics are reachable from the Ansible controller
ansible-playbook -l mycloud playbooks/mycloud.yml

Note: --check (dry-run) will incorrectly fail on the copy step if the binary is not present locally in /tmp/. This is a check-mode limitation, not a real error.

asustor.yml - Asustor NAS

Hosts: asustor-lan1 (SSH port 8883)

  • Deploys authorized SSH keys
  • Checks if node_exporter is running, starts it if not
  • Verifies port 9100 is accessible
ansible-playbook -l asustor-lan1 playbooks/asustor.yml

autofs.yml - NAS automount via autofs

Hosts: acemagic

  • Configures /etc/auto.master.d/asustor.autofs and /etc/auto.asustor
  • Configures /etc/auto.master.d/mycloud.autofs and /etc/auto.mycloud
  • Restarts autofs service
ansible-playbook playbooks/autofs.yml

crons-only.yml - scheduled tasks on acemagic

Hosts: acemagic

  • Cron: Frigate Docker container restart
  • Cron: Bitwarden database backup
  • Cron: HDD keep-alive for Seagate drives (5TB, 6TB, 16TB) - prevents spin-down
  • hdparm: spin-down prevention for SDE and SDB
ansible-playbook playbooks/crons-only.yml

acemagic.backups.yml - backup scripts

Hosts: acemagic

  • Deploys backup.sh (rsync to Google Drive via rclone)
  • Deploys backup_seagata16t.sh (rsync Seagate 16TB -> Asustor NAS)
  • Creates log file and cron for the 16TB backup
ansible-playbook playbooks/acemagic.backups.yml

mikrotik.backup.yml - router backup

Hosts: mikrotik

  • Uploads SSH key to MikroTik if missing
  • Sets up a local cron on acemagic to pull router backup daily at 03:30
ansible-playbook playbooks/mikrotik.backup.yml

setup_postgres_replication.yml - PostgreSQL logical replication

Hosts: acemagic (primary), asustor-lan1 (replica)

  • Creates publications on primary
  • Creates subscriptions on replica for selected databases
ansible-playbook playbooks/setup_postgres_replication.yml

override_properties.yml - patch .properties files on remote hosts

ansible-playbook playbooks/override_properties.yml \
  -e "target_host=acemagic service_file=/path/to/app.properties"

Playbooks with missing roles (not yet implemented):

  • pureftpd_doorbell.yml - FTP for Ring doorbell (pureftpd_doorbell role missing)
  • rsync-mycloud.yml - rsync from MyCloud (rsync.mycloud role missing)

Secret Management

Files in inventory/host_vars/*.yml and roles/*/vars/vault.yml are encrypted with Ansible Vault (AES256). The vault password is stored in vault.pass (excluded from git via .gitignore).

# Edit an encrypted file
ansible-vault edit inventory/host_vars/mycloud.yml

# Decrypt all files before editing
bash decrypt_vars.sh

# Re-encrypt all files after editing
bash encrypt_vars.sh

Pre-commit Security Hooks

Two layers of protection:

1. Custom git hook (.git/hooks/pre-commit) - always active:

  • Blocks unencrypted inventory/host_vars/*.yml commits
  • Blocks unencrypted roles/*/vars/vault.yml commits
  • Scans staged files for hardcoded secrets (passwords, tokens, API keys)

2. pre-commit framework (.pre-commit-config.yaml) - requires one-time setup:

  • detect-secrets - entropy-based secret scanning
  • detect-private-key - blocks PEM/private key files
  • check-yaml --unsafe - validates YAML (unsafe flag needed for Ansible vault tags)
  • trailing-whitespace, end-of-file-fixer, check-merge-conflict
  • Blocks accidental vault.pass commits
# One-time setup after cloning:
pip install pre-commit
pre-commit install

Run Logging

callback_plugins/json_logger.py appends all playbook run results to ansible_runs.jsonl (excluded from git).

Dependencies

  • geerlingguy.nfs - installed locally in collections/