ansible: replace no_swap role with swap role and enhance K3s setup

- Removed the `no_swap` role and replaced it with the new `swap` role for managing swap configurations.
- Updated the K3s role to dynamically detect the first available wired interface IP and validate it.
- Enhanced K3s installation by adding support for disabling SELinux RPM.
- Adjusted inventory and `site.yml` to align with the updated roles.
- Added `.vault_pass` to `.gitignore`.
- Updated Ansible configuration with result format compatibility for different versions.

.gitignore

@@ -17,6 +17,7 @@
 # Secrets and local config
 *-password.txt
 *secret.yaml
+.vault_pass
 /secrets/
 /conf/
 /data/

.idea/runConfigurations/Ansible_Site.xml

@@ -0,0 +1,17 @@
+<component name="RunManager">
+  <configuration name="Ansible: Run Site Playbook" type="ShConfigurationType">
+    <option name="SCRIPT_TEXT" value="ansible-playbook infrastructure/playbooks/site.yml --vault-password-file .vault_pass" />
+    <option name="INDEPENDENT_SCRIPT_PATH" value="true" />
+    <option name="SCRIPT_PATH" value="" />
+    <option name="SCRIPT_OPTIONS" value="" />
+    <option name="INDEPENDENT_SCRIPT_WORKING_DIRECTORY" value="true" />
+    <option name="SCRIPT_WORKING_DIRECTORY" value="$PROJECT_DIR$" />
+    <option name="INDEPENDENT_INTERPRETER_PATH" value="true" />
+    <option name="INTERPRETER_PATH" value="/bin/zsh" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="EXECUTE_IN_TERMINAL" value="true" />
+    <option name="EXECUTE_SCRIPT_FILE" value="false" />
+    <envs />
+    <method v="2" />
+  </configuration>
+</component>

infrastructure/ansible.cfg

@@ -3,7 +3,11 @@ inventory = inventory/hosts.ini
 roles_path = roles
 collections_paths = collections
 interpreter_python = auto_silent
-stdout_callback = yaml
+# For Ansible < 2.13, we use community.general.yaml
+# For Ansible >= 2.13, we should use result_format=yaml in ansible.builtin.default
+# To maintain compatibility, we use the default callback and set result_format
+stdout_callback = default
+result_format = yaml
 forks = 20
 timeout = 30
 host_key_checking = True

infrastructure/inventory/hosts.ini

@@ -12,9 +12,9 @@ retropie.prole.org
 raspberry.prole.org
 
 [k3s_hosts]
-pi.prole.org
+pi.prole.org swap_enabled=true
 myrddin.prole.org
-retropie.prole.org
+retropie.prole.org swap_enabled=true
 
 [Linux_Hosts:children]
 pihole

infrastructure/playbooks/no_swap.yml

@@ -1,6 +1,6 @@
 ---
-- name: Disable swap on Raspberry Pi hosts
+- name: Configure swap on Raspberry Pi hosts
   hosts: raspberry.prole.org
   become: true
   roles:
-    - no_swap
+    - swap

infrastructure/playbooks/site.yml

@@ -16,11 +16,11 @@
   roles:
     - rsyslog
 
-- name: Disable swap on K3s hosts
+- name: Configure swap on K3s hosts
   hosts: k3s_hosts
   become: true
   roles:
-    - no_swap
+    - swap
 
 - name: K3s Cluster Setup
   hosts: k3s_hosts

infrastructure/roles/k3s/defaults/main.yml

@@ -4,4 +4,7 @@ k3s_version: v1.31.4+k3s1
 # We will use the IP address of the node on the interface that has an address in this range.
 # Or we can just bind to the default gateway interface if it's the wired one.
 # Usually on Pi, eth0 is wired.
-k3s_bind_interface: eth0
+k3s_wired_interfaces:
+  - eth0
+  - enxb827eb883a41
+  - end0

infrastructure/roles/k3s/tasks/main.yml

@@ -4,20 +4,27 @@
     path: /usr/local/bin/k3s
   register: k3s_bin
 
-- name: Verify bind interface exists
+- name: Find the first available wired interface IP
+  ansible.builtin.set_fact:
+    k3s_node_ip: "{{ ansible_facts[item]['ipv4']['address'] }}"
+  loop: "{{ k3s_wired_interfaces }}"
+  when:
+    - ansible_facts[item] is defined
+    - ansible_facts[item]['ipv4'] is defined
+    - ansible_facts[item]['ipv4']['address'] is defined
+    - k3s_node_ip is not defined
+
+- name: Verify k3s_node_ip was found
   ansible.builtin.assert:
     that:
-      - "'ansible_' + k3s_bind_interface in hostvars[inventory_hostname]"
-    fail_msg: "Interface {{ k3s_bind_interface }} not found on {{ inventory_hostname }}"
-
-- name: Get wired IP address
-  ansible.builtin.set_fact:
-    k3s_node_ip: "{{ hostvars[inventory_hostname]['ansible_' + k3s_bind_interface]['ipv4']['address'] }}"
+      - k3s_node_ip is defined
+    fail_msg: "Could not find a valid IP address on any of the specified wired interfaces: {{ k3s_wired_interfaces }}. Available facts: {{ ansible_facts.keys() | list }}"
 
 - name: Install k3s dependencies
   ansible.builtin.package:
     name:
       - curl
+      - iptables
     state: present
 
 - name: Download k3s install script
@@ -33,6 +40,7 @@
     INSTALL_K3S_VERSION: "{{ k3s_version }}"
     K3S_TOKEN: "prole-k3s-ha-token" # In a real prod environment, use a secret
     INSTALL_K3S_EXEC: "server --cluster-init --bind-address {{ k3s_node_ip }} --node-ip {{ k3s_node_ip }} --advertise-address {{ k3s_node_ip }}"
+    INSTALL_K3S_SKIP_SELINUX_RPM: "true"
   when:
     - inventory_hostname == groups['k3s_hosts'][0]
     - not k3s_bin.stat.exists
@@ -66,6 +74,7 @@
     K3S_URL: "https://{{ hostvars[groups['k3s_hosts'][0]]['k3s_node_ip'] }}:6443"
     K3S_TOKEN: "{{ k3s_cluster_token }}"
     INSTALL_K3S_EXEC: "server --bind-address {{ k3s_node_ip }} --node-ip {{ k3s_node_ip }} --advertise-address {{ k3s_node_ip }}"
+    INSTALL_K3S_SKIP_SELINUX_RPM: "true"
   when:
     - inventory_hostname != groups['k3s_hosts'][0]
     - not k3s_bin.stat.exists

infrastructure/roles/no_swap/handlers/main.yml

@@ -1,4 +0,0 @@
----
-- name: reload systemd
-  ansible.builtin.command: systemctl daemon-reload
-  changed_when: false

infrastructure/roles/no_swap/tasks/main.yml

@@ -1,86 +0,0 @@
----
-# Disable swap immediately (safe even if no swap)
-- name: Turn off all swap immediately
-  ansible.builtin.command: swapoff -a
-  changed_when: false
-  failed_when: false
-
-# Remove swap entries from /etc/fstab (prevents swap re-enabling on reboot)
-- name: Remove swap entries from /etc/fstab
-  ansible.builtin.lineinfile:
-    path: /etc/fstab
-    state: absent
-    regexp: '^\s*[^#].*\s+swap\s+'
-  notify: reload systemd
-
-# If dphys-swapfile is installed (common on Raspberry Pi OS), disable it
-- name: Check if dphys-swapfile is installed
-  ansible.builtin.command: dpkg -s dphys-swapfile
-  register: dphys_pkg
-  changed_when: false
-  failed_when: false
-
-- name: Stop and disable dphys-swapfile service if present
-  ansible.builtin.systemd:
-    name: dphys-swapfile
-    state: stopped
-    enabled: false
-  when: dphys_pkg.rc == 0
-  failed_when: false
-
-- name: Uninstall dphys-swapfile if present
-  ansible.builtin.apt:
-    name: dphys-swapfile
-    state: absent
-    purge: true
-    update_cache: false
-  when: dphys_pkg.rc == 0
-
-# Disable zram-tools if installed (some images enable zram swap)
-- name: Check if zram-tools is installed
-  ansible.builtin.command: dpkg -s zram-tools
-  register: zram_pkg
-  changed_when: false
-  failed_when: false
-
-- name: Stop and disable zramswap service if present
-  ansible.builtin.systemd:
-    name: zramswap
-    state: stopped
-    enabled: false
-  when: zram_pkg.rc == 0
-  failed_when: false
-
-# Disable systemd-swap if installed (less common but possible)
-- name: Check if systemd-swap is installed
-  ansible.builtin.command: dpkg -s systemd-swap
-  register: systemd_swap_pkg
-  changed_when: false
-  failed_when: false
-
-- name: Stop and disable systemd-swap if present
-  ansible.builtin.systemd:
-    name: systemd-swap
-    state: stopped
-    enabled: false
-  when: systemd_swap_pkg.rc == 0
-  failed_when: false
-
-# Optional: reduce swappiness (won't prevent swapping if swap exists, but good belt-and-suspenders)
-- name: Set vm.swappiness to 0
-  ansible.builtin.sysctl:
-    name: vm.swappiness
-    value: "0"
-    state: present
-    reload: true
-
-# Final verification command (for logs)
-- name: Show active swap devices
-  ansible.builtin.command: swapon --show
-  register: swapon_show
-  changed_when: false
-  failed_when: false
-
-- name: Print swapon --show
-  ansible.builtin.debug:
-    var: swapon_show.stdout_lines