mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 02:54:31 +00:00
6e2d3e9011
- Monitoring: Migrated from manual Grafana/Prometheus manifests to kube-prometheus-stack based setup in etc/init_monitoring.sh. Removed old manifest files from deploy/ and k8s/. - Installer Core: Refactored installer with new modules for actions, environment handling, and UI screens. Enhanced Milestone logic to support advanced configuration (ArgoCD, Registry namespaces, Kerberos flags, etc.). - Service & Init Scripts: Updated multiple initialization scripts (init_*.sh) for better integration with OpenBao, Kerberos, and the new monitoring stack. Added new scripts for Nginx Ingress, Ollama parsing, and K3D route fixes. - Infrastructure: Enhanced Samba AD DC Ansible role with realm derivation, provisioning guidance, and group management. Updated K3s role tasks. - Configuration: Refined default settings in conf/ to align with the new deployment architecture. - App & Tools: Updated prole-app Swift code and prole.sh for improved environment variable handling and installation flow.
98 lines
3.2 KiB
YAML
98 lines
3.2 KiB
YAML
---
|
|
- name: Install Samba AD DC packages
|
|
ansible.builtin.apt:
|
|
name:
|
|
- samba
|
|
- krb5-user
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Derive child realm from namespace when unset
|
|
ansible.builtin.set_fact:
|
|
samba_ad_dc_child_id: "{{ derived_id | upper }}"
|
|
vars:
|
|
prole_ns: "{{ lookup('env', 'PROLE_NAMESPACE') | default(lookup('env', 'NAMESPACE'), true) | default('', true) }}"
|
|
derived_id: >-
|
|
{{ (prole_ns | regex_findall('^prole-db-([A-Za-z0-9]+)$') | first)
|
|
| default('', true) }}
|
|
when:
|
|
- samba_ad_dc_child_id is not defined or samba_ad_dc_child_id | length == 0
|
|
- derived_id | length > 0
|
|
|
|
- name: Check if Samba AD is provisioned
|
|
ansible.builtin.stat:
|
|
path: /var/lib/samba/private/sam.ldb
|
|
register: samba_ad_provisioned
|
|
|
|
- name: Fail if not provisioned (this role does not provision)
|
|
ansible.builtin.fail:
|
|
msg: |-
|
|
Samba AD is not provisioned on this host (missing /var/lib/samba/private/sam.ldb).
|
|
Provision the child realm first, for example:
|
|
samba-tool domain provision \
|
|
--use-rfc2307 \
|
|
--realm={{ samba_ad_dc_realm }} \
|
|
--domain={{ samba_ad_dc_workgroup }} \
|
|
--server-role=dc \
|
|
--dns-backend=SAMBA_INTERNAL \
|
|
--adminpass='<ansible vault administrator pass>' \
|
|
--parent-realm={{ samba_ad_dc_parent_realm }} \
|
|
--username='{{ samba_ad_dc_parent_netbios }}\\Administrator'
|
|
when: not samba_ad_provisioned.stat.exists
|
|
|
|
- name: Deploy smb.conf
|
|
ansible.builtin.template:
|
|
src: smb.conf.j2
|
|
dest: /etc/samba/smb.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart samba-ad-dc
|
|
|
|
- name: Ensure samba-ad-dc enabled and running
|
|
ansible.builtin.systemd:
|
|
name: samba-ad-dc
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Check for kubeadm Samba group
|
|
ansible.builtin.command: >-
|
|
samba-tool group show {{ samba_kubeadm_group }}
|
|
-U {{ samba_dns_admin_user }}%{{ samba_dns_admin_pass }}
|
|
register: samba_kubeadm_group_show
|
|
changed_when: false
|
|
failed_when: false
|
|
when:
|
|
- samba_dns_admin_pass is defined
|
|
- samba_dns_admin_pass | length > 0
|
|
|
|
- name: Create kubeadm Samba group when missing
|
|
ansible.builtin.command: >-
|
|
samba-tool group add {{ samba_kubeadm_group }}
|
|
-U {{ samba_dns_admin_user }}%{{ samba_dns_admin_pass }}
|
|
when:
|
|
- samba_dns_admin_pass is defined
|
|
- samba_dns_admin_pass | length > 0
|
|
- samba_kubeadm_group_show.rc != 0
|
|
|
|
- name: List kubeadm Samba group members
|
|
ansible.builtin.command: >-
|
|
samba-tool group listmembers {{ samba_kubeadm_group }}
|
|
-U {{ samba_dns_admin_user }}%{{ samba_dns_admin_pass }}
|
|
register: samba_kubeadm_group_members
|
|
changed_when: false
|
|
when:
|
|
- samba_dns_admin_pass is defined
|
|
- samba_dns_admin_pass | length > 0
|
|
|
|
- name: Ensure kubeadm Samba group members
|
|
ansible.builtin.command: >-
|
|
samba-tool group addmembers {{ samba_kubeadm_group }} {{ item }}
|
|
-U {{ samba_dns_admin_user }}%{{ samba_dns_admin_pass }}
|
|
loop: "{{ samba_kubeadm_members }}"
|
|
when:
|
|
- samba_dns_admin_pass is defined
|
|
- samba_dns_admin_pass | length > 0
|
|
- samba_kubeadm_members | length > 0
|
|
- item not in (samba_kubeadm_group_members.stdout_lines | default([]))
|