ansible/server
Watch
1
0
Fork
You've already forked server
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
75 commits 4 branches 0 tags 754 KiB
  • Jinja 83.5%
  • Python 14%
  • Shell 2.5%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Stefan Lindecke 511165787f instances: enable user systemd lingering
2026-10-21 08:36:15 +02:00
backup Weitere Cleanups und Anpassungen 2025-12-20 21:17:00 +01:00
docs instances: enable user systemd lingering 2026-10-21 08:36:15 +02:00
garagehq repo: add wireguard + garagehq playbooks 2026-05-06 10:04:21 +02:00
home Ansible Playbooks für Home- und Server-Updates 2026-04-08 12:42:04 +02:00
host_vars proxmox: add Ceph bootstrap automation 2026-10-16 12:06:35 +02:00
inventory proxmox: add Ceph bootstrap automation 2026-10-16 12:06:35 +02:00
molecule/_commons initial 2025-05-21 13:10:32 +02:00
roles instances: enable user systemd lingering 2026-10-21 08:36:15 +02:00
scripts updates/mail: fixes und tooling 2026-02-04 14:43:37 +01:00
sshKeys Repository bereinigen und Inventory aktualisieren 2026-08-18 10:59:11 +02:00
templates roles/instances: reload php-fpm via systemctl 'php*-fpm.service' and reload units with xargs 2026-01-18 13:51:01 +01:00
.gitignore Merge remote-tracking branch 'origin/main' 2026-05-11 01:07:38 +02:00
AGENTS.md inventory: mockupman_vhs, ubiquiti und pc-sl ergänzen 2026-10-02 07:15:03 +02:00
ansible.cfg Merge branch 'develop' into main 2026-05-14 10:41:27 +02:00
CLAUDE.md docs: WireGuard-Hub-and-Spoke-Setup dokumentieren 2026-09-14 09:13:58 +02:00
create_instances.yml proxmox: add Ceph bootstrap automation 2026-10-16 12:06:35 +02:00
crowdsec-install.yml roles/crowdsec: CrowdSec-Rolle hinzufügen 2026-09-13 22:40:12 +02:00
enusre_host_vars.yml roles/instances: reload php-fpm via systemctl 'php*-fpm.service' and reload units with xargs 2026-01-18 13:51:01 +01:00
mail-config.yml proxmox: add Ceph bootstrap automation 2026-10-16 12:06:35 +02:00
README.md roles/wireguard_overlay: internes LAN über pve01 statt Ubiquiti-S2S 2026-09-14 18:31:38 +02:00
server-ceph.yml proxmox: add Ceph bootstrap automation 2026-10-16 12:06:35 +02:00
server-install.yml provisioning: Traefik durch Caddy ersetzt und weitere Verbesserungen 2025-12-05 16:32:52 +01:00
server-uninstall.yml initial 2025-05-21 13:10:32 +02:00
server-update.yml proxmox: add Ceph bootstrap automation 2026-10-16 12:06:35 +02:00
share_sshkeys.yml Merge branch 'develop' into main 2026-05-14 10:41:27 +02:00
unattendes.yml roles/provisioning: Umstellung auf Traefik und Apache 2025-11-21 17:14:27 +01:00
wireguard-manage.yml roles/wireguard_overlay: Hub-and-Spoke mit Site-to-Site ausbauen 2026-09-14 08:45:42 +02:00

README.md

Ansible Server Repository

This repository manages server instances and roles using a unified configuration.

Quick start

  • Define server aliases and host mapping in inventory/group_vars/all.yml.
  • Add instances to inventory/instance_vars/instances.yml with server: <alias> and reference passwords as {{ mysql_passwords['user__domain'] }}.
  • Store MySQL passwords in the vaulted file inventory/hosts/group_vars/all/mysql_passwords.yml using the key pattern username__domain.

Run

  • All hosts: ansible-playbook -i inventory/hosts create_instances.yml --check --diff
  • With Vault prompt: --ask-vault-pass or with file: --vault-password-file .vault_pass.txt
  • Limit to one host: -l sv01.server.ktrion.de

Key files

  • create_instances.yml filters instances per host by resolved alias.
  • inventory/group_vars/all.yml holds aliases and FQDN mappings.
  • inventory/instance_vars/instances.yml is the single source of instances.
  • inventory/hosts/group_vars/all/mysql_passwords.yml contains vaulted MySQL passwords.
  • inventory/hosts/group_vars/all/mail_passwords.yml contains vaulted Mail/IMAP passwords.

Mail passwords (mail_local)

  • Add password hashes to inventory/hosts/group_vars/all/mail_passwords.yml using keys:
    • <username>__<domainname>__system
    • <username>__<domainname>__mail
  • Hash generation:
    • System hash: openssl passwd -6
    • Dovecot hash: doveadm pw -s SHA512-CRYPT
  • Edit via Vault: ansible-vault edit inventory/hosts/group_vars/all/mail_passwords.yml
  • Script to set a mail password (Vault required):
    • scripts/set_mail_password.sh <username> <domain> [password]
    • Optional: FILE=inventory/hosts/group_vars/all/mail_passwords.yml

WireGuard VPN (wireguard_overlay)

  • Verbindet gateway/ns1/sv01-03 zu einem Hub-and-Spoke-VPN (10.90.0.0/24) und macht darüber das interne LAN 192.168.99.0/24 hinter der Ubiquiti-Gateway erreichbar.
  • Ausführen: ansible-playbook wireguard-manage.yml --check --diff, dann ohne --check.
  • Private Keys liegen Vault-verschlüsselt in inventory/hosts/group_vars/all/wireguard_keys.yml.
  • Die Ubiquiti-Gateway kann kein WireGuard-Site-to-Site (nur OpenVPN/IPsec) und ist daher kein VPN-Peer — pve01 ist stattdessen regulärer Spoke und LAN-Gateway; auf der Ubiquiti braucht es nur eine statische Route auf 10.90.0.0/24 via pve01.
  • Details, Variablen und die Route-Einrichtung: roles/wireguard_overlay/README.md.

Contributing

  • Keep playbooks idempotent and use FQCN modules (ansible.builtin.*).
  • Validate with --check --diff; lint with ansible-lint and yamllint if available.