aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat (limited to 'clarkzjw.cc/config/atlas/ansible')
-rw-r--r--clarkzjw.cc/config/atlas/ansible/README.md34
-rw-r--r--clarkzjw.cc/config/atlas/ansible/ansible.cfg14
-rw-r--r--clarkzjw.cc/config/atlas/ansible/init.yaml10
-rw-r--r--clarkzjw.cc/config/atlas/ansible/inventory/hosts.yaml3
-rw-r--r--clarkzjw.cc/config/atlas/ansible/requirements.yaml6
-rw-r--r--clarkzjw.cc/config/atlas/ansible/role.yaml3
-rw-r--r--clarkzjw.cc/config/atlas/ansible/roles/debian_init/defaults/main.yaml0
-rw-r--r--clarkzjw.cc/config/atlas/ansible/roles/debian_init/tasks/main.yaml66
-rw-r--r--clarkzjw.cc/config/atlas/ansible/roles/init/tasks/main.yaml56
-rw-r--r--clarkzjw.cc/config/atlas/ansible/roles/samba/defaults/main.yaml3
-rw-r--r--clarkzjw.cc/config/atlas/ansible/roles/samba/tasks/main.yaml53
-rw-r--r--clarkzjw.cc/config/atlas/ansible/roles/samba/templates/smb.conf.j233
-rw-r--r--clarkzjw.cc/config/atlas/ansible/samba.yaml7
-rw-r--r--clarkzjw.cc/config/atlas/ansible/setup.yaml7
14 files changed, 295 insertions, 0 deletions
diff --git a/clarkzjw.cc/config/atlas/ansible/README.md b/clarkzjw.cc/config/atlas/ansible/README.md
new file mode 100644
index 0000000..55f8989
--- /dev/null
+++ b/clarkzjw.cc/config/atlas/ansible/README.md
@@ -0,0 +1,34 @@
1# Atlas
2
3Hostname: atlas
4Usage: HomeLab Main NAS
5
6## Step
7
8### Init
9
10```bash
11ansible-playbook init.yaml -K -k
12```
13
14Login and exec `sudo tailscale up` and authorize Tailscale in the admin panel.
15
16### Setup
17```bash
18ansible-playbook setup.yaml
19```
20
21### Import zfs pool
22```bash
23zpool status
24zpool import pool1
25
26...
27zpool export pool1
28```
29
30### Setup Samba
31```bash
32source admin-rc
33ansible-playbook samba.yaml
34```
diff --git a/clarkzjw.cc/config/atlas/ansible/ansible.cfg b/clarkzjw.cc/config/atlas/ansible/ansible.cfg
new file mode 100644
index 0000000..e0f6c28
--- /dev/null
+++ b/clarkzjw.cc/config/atlas/ansible/ansible.cfg
@@ -0,0 +1,14 @@
1[defaults]
2host_key_checking = False
3transport = ssh
4remote_user = clarkzjw
5roles_path = roles
6inventory = inventory
7force_color = True
8interpreter_python = auto_silent
9
10[connection]
11pipelining = True
12
13[privilege_escalation]
14become = True
diff --git a/clarkzjw.cc/config/atlas/ansible/init.yaml b/clarkzjw.cc/config/atlas/ansible/init.yaml
new file mode 100644
index 0000000..3dfbc09
--- /dev/null
+++ b/clarkzjw.cc/config/atlas/ansible/init.yaml
@@ -0,0 +1,10 @@
1---
2- name: Init
3 hosts: atlas
4 remote_user: root
5 gather_facts: true
6 vars:
7 ansible_ssh_common_args: "-J pve"
8
9 roles:
10 - role: init
diff --git a/clarkzjw.cc/config/atlas/ansible/inventory/hosts.yaml b/clarkzjw.cc/config/atlas/ansible/inventory/hosts.yaml
new file mode 100644
index 0000000..bee48c4
--- /dev/null
+++ b/clarkzjw.cc/config/atlas/ansible/inventory/hosts.yaml
@@ -0,0 +1,3 @@
1all:
2 hosts:
3 atlas:
diff --git a/clarkzjw.cc/config/atlas/ansible/requirements.yaml b/clarkzjw.cc/config/atlas/ansible/requirements.yaml
new file mode 100644
index 0000000..33f6117
--- /dev/null
+++ b/clarkzjw.cc/config/atlas/ansible/requirements.yaml
@@ -0,0 +1,6 @@
1---
2collections:
3 - name: community.general
4 version: 4.7.0
5 - name: ansible.posix
6 version: 1.3.0
diff --git a/clarkzjw.cc/config/atlas/ansible/role.yaml b/clarkzjw.cc/config/atlas/ansible/role.yaml
new file mode 100644
index 0000000..ab3fca5
--- /dev/null
+++ b/clarkzjw.cc/config/atlas/ansible/role.yaml
@@ -0,0 +1,3 @@
1- hosts: "{{ target }}"
2 roles:
3 - role: "{{ role }}"
diff --git a/clarkzjw.cc/config/atlas/ansible/roles/debian_init/defaults/main.yaml b/clarkzjw.cc/config/atlas/ansible/roles/debian_init/defaults/main.yaml
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/clarkzjw.cc/config/atlas/ansible/roles/debian_init/defaults/main.yaml
diff --git a/clarkzjw.cc/config/atlas/ansible/roles/debian_init/tasks/main.yaml b/clarkzjw.cc/config/atlas/ansible/roles/debian_init/tasks/main.yaml
new file mode 100644
index 0000000..e53d3eb
--- /dev/null
+++ b/clarkzjw.cc/config/atlas/ansible/roles/debian_init/tasks/main.yaml
@@ -0,0 +1,66 @@
1- name: Disable unattended-upgrades
2 systemd:
3 name: unattended-upgrades
4 state: stopped
5 enabled: false
6
7- name: Install packages
8 apt:
9 name:
10 - apt-transport-https
11 - build-essential
12 - ca-certificates
13 - cifs-utils
14 - vnstat
15 - postfix
16 - lsb-release
17 - python3
18 - python3-dev
19 - python3-pip
20 - unzip
21 - gnupg
22 - rsync
23 - sudo
24 - htop
25 - curl
26 - tree
27 - zip
28 - vim
29 - zsh
30 - git
31 update_cache: true
32
33- name: Enable bullseye-backport
34 apt_repository:
35 repo: deb https://deb.debian.org/debian {{ ansible_distribution_release | lower }}-backports main contrib non-free
36 state: present
37
38# Check https://wiki.debian.org/ZFS for additional information
39- name: Install ZFS
40 apt:
41 name:
42 - linux-headers-amd64
43 - linux-headers-{{ ansible_kernel }}
44 - zfsutils-linux
45 - zfs-dkms
46 update_cache: true
47 fail_on_autoremove: yes
48 default_release: "{{ ansible_distribution_release | lower }}-backports"
49
50- name: Load zfs kernel module
51 modprobe:
52 name: zfs
53 state: present
54
55- name: Clean unneeded packages
56 apt:
57 autoremove: true
58 purge: true
59
60- name: Remove useless packages from the cache
61 apt:
62 autoclean: yes
63
64- name: Run the equivalent of "apt-get clean" as a separate step
65 apt:
66 clean: yes
diff --git a/clarkzjw.cc/config/atlas/ansible/roles/init/tasks/main.yaml b/clarkzjw.cc/config/atlas/ansible/roles/init/tasks/main.yaml
new file mode 100644
index 0000000..29cf529
--- /dev/null
+++ b/clarkzjw.cc/config/atlas/ansible/roles/init/tasks/main.yaml
@@ -0,0 +1,56 @@
1- name: Make sure we have a 'wheel' group
2 group:
3 name: wheel
4 state: present
5
6- name: Allow 'wheel' group to have passwordless sudo
7 lineinfile:
8 dest: /etc/sudoers
9 state: present
10 regexp: '^%wheel'
11 line: '%wheel ALL=(ALL) NOPASSWD: ALL'
12 validate: visudo -cf %s
13
14- name: Add sudoers users to wheel group
15 user:
16 name: clarkzjw
17 groups: wheel
18 append: yes
19
20- name: Set authorized keys taken from url
21 authorized_key:
22 user: clarkzjw
23 state: present
24 key: https://github.com/clarkzjw.keys
25
26- name: Add Tailscale GPG apt Key
27 apt_key:
28 url: https://pkgs.tailscale.com/stable/debian/bullseye.noarmor.gpg
29 keyring: /usr/share/keyrings/tailscale-archive-keyring.gpg
30 state: present
31
32- name: Add Tailscale Repository
33 get_url:
34 url: https://pkgs.tailscale.com/stable/debian/bullseye.tailscale-keyring.list
35 dest: /etc/apt/sources.list.d/tailscale.list
36
37- name: Install Tailscale
38 apt:
39 name:
40 - tailscale
41 update_cache: true
42
43- name: Disable Root Login
44 lineinfile:
45 dest: /etc/ssh/sshd_config
46 regexp: '^PermitRootLogin yes'
47 line: "PermitRootLogin no"
48 state: present
49 backup: yes
50
51- name: Restart SSHD
52 systemd:
53 name: ssh
54 enabled: true
55 state: restarted
56 daemon_reload: true
diff --git a/clarkzjw.cc/config/atlas/ansible/roles/samba/defaults/main.yaml b/clarkzjw.cc/config/atlas/ansible/roles/samba/defaults/main.yaml
new file mode 100644
index 0000000..88c23b1
--- /dev/null
+++ b/clarkzjw.cc/config/atlas/ansible/roles/samba/defaults/main.yaml
@@ -0,0 +1,3 @@
1samba_users:
2- username: clarkzjw
3 password: "{{ lookup('env', 'SAMBA_PASSWORD') }}" \ No newline at end of file
diff --git a/clarkzjw.cc/config/atlas/ansible/roles/samba/tasks/main.yaml b/clarkzjw.cc/config/atlas/ansible/roles/samba/tasks/main.yaml
new file mode 100644
index 0000000..80950dc
--- /dev/null
+++ b/clarkzjw.cc/config/atlas/ansible/roles/samba/tasks/main.yaml
@@ -0,0 +1,53 @@
1- name: Install Samba
2 apt:
3 name:
4 - samba
5 - smbclient
6 - cifs-utils
7 update_cache: true
8
9- name: Disable Samba NetBIOS server nmbd
10 systemd:
11 name: nmbd
12 state: stopped
13 enabled: false
14
15- name: render samba config file
16 template:
17 src: smb.conf.j2
18 dest: "/etc/samba/smb.conf"
19 mode: 0644
20
21# https://stackoverflow.com/questions/44762488/non-interactive-samba-user-creation-via-ansible
22- name: shell - create samba users
23 shell: >
24 set -e -o pipefail
25 && (pdbedit --user={{ item.username }} 2>&1 > /dev/null)
26 || (echo '{{ item.password }}'; echo '{{ item.password }}')
27 | smbpasswd -s -a {{ item.username }}
28 args:
29 executable: /bin/bash
30 register: samba_create_users
31 changed_when: "'Added user' in samba_create_users.stdout"
32 loop: "{{ samba_users }}"
33 no_log: true
34
35- name: shell - set samba passwords correctly
36 shell: >
37 set -e -o pipefail
38 && (smbclient -U {{ item.username }}%{{ item.password }} -L 127.0.0.1 2>&1 > /dev/null)
39 || (echo '{{ item.password }}'; echo '{{ item.password }}')
40 | smbpasswd {{ item.username }}
41 args:
42 executable: /bin/bash
43 register: samba_verify_users
44 changed_when: "'New SMB password' in samba_verify_users.stdout"
45 loop: "{{ samba_users }}"
46 no_log: true
47
48- name: Restart SMB service
49 systemd:
50 name: smbd
51 state: restarted
52 enabled: true
53 daemon_reload: true
diff --git a/clarkzjw.cc/config/atlas/ansible/roles/samba/templates/smb.conf.j2 b/clarkzjw.cc/config/atlas/ansible/roles/samba/templates/smb.conf.j2
new file mode 100644
index 0000000..06e2567
--- /dev/null
+++ b/clarkzjw.cc/config/atlas/ansible/roles/samba/templates/smb.conf.j2
@@ -0,0 +1,33 @@
1[global]
2 workgroup = WORKGROUP
3 interfaces = 192.168.1.0/24 tailscale0
4 bind interfaces only = yes
5 log file = /var/log/samba/log.%m
6 max log size = 1000
7 logging = file
8 panic action = /usr/share/samba/panic-action %d
9 server role = standalone server
10 obey pam restrictions = yes
11 unix password sync = yes
12 passwd program = /usr/bin/passwd %u
13 passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
14 pam password change = yes
15 map to guest = bad user
16
17[homes]
18 comment = Home Directories
19 browseable = no
20 read only = yes
21 create mask = 0700
22 directory mask = 0700
23 valid users = %S
24
25[pool1]
26 comment = NAS Share
27 path = /pool1/clarkzjw
28 writable = yes
29 guest ok = no
30 valid users = @clarkzjw
31 force create mode = 770
32 force directory mode = 770
33 inherit permissions = yes
diff --git a/clarkzjw.cc/config/atlas/ansible/samba.yaml b/clarkzjw.cc/config/atlas/ansible/samba.yaml
new file mode 100644
index 0000000..f363afc
--- /dev/null
+++ b/clarkzjw.cc/config/atlas/ansible/samba.yaml
@@ -0,0 +1,7 @@
1- name: Setup Samba
2 hosts: atlas
3 remote_user: clarkzjw
4 gather_facts: true
5
6 roles:
7 - role: samba
diff --git a/clarkzjw.cc/config/atlas/ansible/setup.yaml b/clarkzjw.cc/config/atlas/ansible/setup.yaml
new file mode 100644
index 0000000..0dbbd4a
--- /dev/null
+++ b/clarkzjw.cc/config/atlas/ansible/setup.yaml
@@ -0,0 +1,7 @@
1- name: Install ZFS and setup Debian
2 hosts: atlas
3 remote_user: clarkzjw
4 gather_facts: true
5
6 roles:
7 - role: debian_init
Powered by cgit v1.2.3 (git 2.41.0)