diff --git a/.gitignore b/.gitignore index 15b14c4..fc0fea5 100644 --- a/.gitignore +++ b/.gitignore @@ -17,6 +17,7 @@ # Secrets and local config *-password.txt *secret.yaml +.vault_pass /secrets/ /conf/ /data/ diff --git a/.idea/runConfigurations/Ansible_Site.xml b/.idea/runConfigurations/Ansible_Site.xml new file mode 100644 index 0000000..4a3cd9c --- /dev/null +++ b/.idea/runConfigurations/Ansible_Site.xml @@ -0,0 +1,17 @@ + + + + diff --git a/infrastructure/ansible.cfg b/infrastructure/ansible.cfg index 7c19b2e..43b0762 100644 --- a/infrastructure/ansible.cfg +++ b/infrastructure/ansible.cfg @@ -3,7 +3,11 @@ inventory = inventory/hosts.ini roles_path = roles collections_paths = collections interpreter_python = auto_silent -stdout_callback = yaml +# For Ansible < 2.13, we use community.general.yaml +# For Ansible >= 2.13, we should use result_format=yaml in ansible.builtin.default +# To maintain compatibility, we use the default callback and set result_format +stdout_callback = default +result_format = yaml forks = 20 timeout = 30 host_key_checking = True diff --git a/infrastructure/inventory/hosts.ini b/infrastructure/inventory/hosts.ini index 57e3752..8d8dd67 100644 --- a/infrastructure/inventory/hosts.ini +++ b/infrastructure/inventory/hosts.ini @@ -12,9 +12,9 @@ retropie.prole.org raspberry.prole.org [k3s_hosts] -pi.prole.org +pi.prole.org swap_enabled=true myrddin.prole.org -retropie.prole.org +retropie.prole.org swap_enabled=true [Linux_Hosts:children] pihole diff --git a/infrastructure/playbooks/no_swap.yml b/infrastructure/playbooks/no_swap.yml index ce5512e..74aff16 100644 --- a/infrastructure/playbooks/no_swap.yml +++ b/infrastructure/playbooks/no_swap.yml @@ -1,6 +1,6 @@ --- -- name: Disable swap on Raspberry Pi hosts +- name: Configure swap on Raspberry Pi hosts hosts: raspberry.prole.org become: true roles: - - no_swap + - swap diff --git a/infrastructure/playbooks/site.yml b/infrastructure/playbooks/site.yml index b0cfd53..b832135 100644 --- a/infrastructure/playbooks/site.yml +++ b/infrastructure/playbooks/site.yml @@ -16,11 +16,11 @@ roles: - rsyslog -- name: Disable swap on K3s hosts +- name: Configure swap on K3s hosts hosts: k3s_hosts become: true roles: - - no_swap + - swap - name: K3s Cluster Setup hosts: k3s_hosts diff --git a/infrastructure/roles/k3s/defaults/main.yml b/infrastructure/roles/k3s/defaults/main.yml index ed207ef..680b17c 100644 --- a/infrastructure/roles/k3s/defaults/main.yml +++ b/infrastructure/roles/k3s/defaults/main.yml @@ -4,4 +4,7 @@ k3s_version: v1.31.4+k3s1 # We will use the IP address of the node on the interface that has an address in this range. # Or we can just bind to the default gateway interface if it's the wired one. # Usually on Pi, eth0 is wired. -k3s_bind_interface: eth0 +k3s_wired_interfaces: + - eth0 + - enxb827eb883a41 + - end0 diff --git a/infrastructure/roles/k3s/tasks/main.yml b/infrastructure/roles/k3s/tasks/main.yml index fb1f09d..1ae5765 100644 --- a/infrastructure/roles/k3s/tasks/main.yml +++ b/infrastructure/roles/k3s/tasks/main.yml @@ -4,20 +4,27 @@ path: /usr/local/bin/k3s register: k3s_bin -- name: Verify bind interface exists +- name: Find the first available wired interface IP + ansible.builtin.set_fact: + k3s_node_ip: "{{ ansible_facts[item]['ipv4']['address'] }}" + loop: "{{ k3s_wired_interfaces }}" + when: + - ansible_facts[item] is defined + - ansible_facts[item]['ipv4'] is defined + - ansible_facts[item]['ipv4']['address'] is defined + - k3s_node_ip is not defined + +- name: Verify k3s_node_ip was found ansible.builtin.assert: that: - - "'ansible_' + k3s_bind_interface in hostvars[inventory_hostname]" - fail_msg: "Interface {{ k3s_bind_interface }} not found on {{ inventory_hostname }}" - -- name: Get wired IP address - ansible.builtin.set_fact: - k3s_node_ip: "{{ hostvars[inventory_hostname]['ansible_' + k3s_bind_interface]['ipv4']['address'] }}" + - k3s_node_ip is defined + fail_msg: "Could not find a valid IP address on any of the specified wired interfaces: {{ k3s_wired_interfaces }}. Available facts: {{ ansible_facts.keys() | list }}" - name: Install k3s dependencies ansible.builtin.package: name: - curl + - iptables state: present - name: Download k3s install script @@ -33,6 +40,7 @@ INSTALL_K3S_VERSION: "{{ k3s_version }}" K3S_TOKEN: "prole-k3s-ha-token" # In a real prod environment, use a secret INSTALL_K3S_EXEC: "server --cluster-init --bind-address {{ k3s_node_ip }} --node-ip {{ k3s_node_ip }} --advertise-address {{ k3s_node_ip }}" + INSTALL_K3S_SKIP_SELINUX_RPM: "true" when: - inventory_hostname == groups['k3s_hosts'][0] - not k3s_bin.stat.exists @@ -66,6 +74,7 @@ K3S_URL: "https://{{ hostvars[groups['k3s_hosts'][0]]['k3s_node_ip'] }}:6443" K3S_TOKEN: "{{ k3s_cluster_token }}" INSTALL_K3S_EXEC: "server --bind-address {{ k3s_node_ip }} --node-ip {{ k3s_node_ip }} --advertise-address {{ k3s_node_ip }}" + INSTALL_K3S_SKIP_SELINUX_RPM: "true" when: - inventory_hostname != groups['k3s_hosts'][0] - not k3s_bin.stat.exists diff --git a/infrastructure/roles/no_swap/handlers/main.yml b/infrastructure/roles/no_swap/handlers/main.yml deleted file mode 100644 index 9314521..0000000 --- a/infrastructure/roles/no_swap/handlers/main.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- name: reload systemd - ansible.builtin.command: systemctl daemon-reload - changed_when: false diff --git a/infrastructure/roles/no_swap/tasks/main.yml b/infrastructure/roles/no_swap/tasks/main.yml deleted file mode 100644 index 5650dd4..0000000 --- a/infrastructure/roles/no_swap/tasks/main.yml +++ /dev/null @@ -1,86 +0,0 @@ ---- -# Disable swap immediately (safe even if no swap) -- name: Turn off all swap immediately - ansible.builtin.command: swapoff -a - changed_when: false - failed_when: false - -# Remove swap entries from /etc/fstab (prevents swap re-enabling on reboot) -- name: Remove swap entries from /etc/fstab - ansible.builtin.lineinfile: - path: /etc/fstab - state: absent - regexp: '^\s*[^#].*\s+swap\s+' - notify: reload systemd - -# If dphys-swapfile is installed (common on Raspberry Pi OS), disable it -- name: Check if dphys-swapfile is installed - ansible.builtin.command: dpkg -s dphys-swapfile - register: dphys_pkg - changed_when: false - failed_when: false - -- name: Stop and disable dphys-swapfile service if present - ansible.builtin.systemd: - name: dphys-swapfile - state: stopped - enabled: false - when: dphys_pkg.rc == 0 - failed_when: false - -- name: Uninstall dphys-swapfile if present - ansible.builtin.apt: - name: dphys-swapfile - state: absent - purge: true - update_cache: false - when: dphys_pkg.rc == 0 - -# Disable zram-tools if installed (some images enable zram swap) -- name: Check if zram-tools is installed - ansible.builtin.command: dpkg -s zram-tools - register: zram_pkg - changed_when: false - failed_when: false - -- name: Stop and disable zramswap service if present - ansible.builtin.systemd: - name: zramswap - state: stopped - enabled: false - when: zram_pkg.rc == 0 - failed_when: false - -# Disable systemd-swap if installed (less common but possible) -- name: Check if systemd-swap is installed - ansible.builtin.command: dpkg -s systemd-swap - register: systemd_swap_pkg - changed_when: false - failed_when: false - -- name: Stop and disable systemd-swap if present - ansible.builtin.systemd: - name: systemd-swap - state: stopped - enabled: false - when: systemd_swap_pkg.rc == 0 - failed_when: false - -# Optional: reduce swappiness (won't prevent swapping if swap exists, but good belt-and-suspenders) -- name: Set vm.swappiness to 0 - ansible.builtin.sysctl: - name: vm.swappiness - value: "0" - state: present - reload: true - -# Final verification command (for logs) -- name: Show active swap devices - ansible.builtin.command: swapon --show - register: swapon_show - changed_when: false - failed_when: false - -- name: Print swapon --show - ansible.builtin.debug: - var: swapon_show.stdout_lines