Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
191 Commits 14 Branches 0 Tags
66657f391735f0c13bdd55ce4cd8b9d7a8ecb52a
Commit Graph
191 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ruakij bcdc460297 Copy per-host files of kopia_backup from a files list, empty by default 2026-10-22 08:25:43 +00:00
Ruakij bd24f01110 Let a host name its CrowdSec machine at the LAPI with crowdsec.machine_name, the short hostname of doris is dev 2026-10-21 06:10:01 +00:00
Ruakij 1ede3d3329 Read the fail2ban sshd jail from the journal, Debian 12+ has no auth.log and the jail failed to start 2026-10-13 16:36:08 +00:00
Ruakij deb3521bfa Add a proxmox_no_nag role that hides the subscription dialog and reapplies it from an apt hook after every widget-toolkit update 2026-10-13 15:55:56 +00:00
Ruakij c8cac22d12 Run the cilium status check in check mode too and never report it as changed 2026-10-09 14:37:30 +00:00
Ruakij 6fe03c5f70 Skip the cilium CLI download when it is installed already 2026-10-09 14:37:30 +00:00
Ruakij 15b4e54bd5 Read resolv.conf for the k3s nameservers in check mode too 2026-10-09 14:37:30 +00:00
Ruakij c016459922 Write the k3s registries.yaml only on a semantic change 2026-10-09 14:37:29 +00:00
Ruakij 4d1725f17f Deploy a registries.yaml from registries_config on k3s servers and restart k3s on its change 2026-10-09 14:37:29 +00:00
Ruakij 80658c632f Add the cilium network plugin to the kubernetes role, disabling servicelb, and collect the disabled k3s components in one disable list 2026-10-09 14:37:29 +00:00
Ruakij 60b67f748e Install the k3s servers one at a time with retries from the latest channel, enable the service and link the kubeconfig to ~/.kube/config 2026-10-09 14:37:28 +00:00
Ruakij 4a76aa3a2e Set node-name, node-external-ip and labels_extra in the k3s config and config_extra for agents 2026-10-09 14:37:27 +00:00
Ruakij e9f1153482 Add clean_resolv_conf to the kubernetes role to give k3s a resolv.conf with only the nameserver lines 2026-10-09 14:37:27 +00:00
Ruakij ca1fcc16b6 Fall back to the default IPv4 and IPv6 address when the k3s node IP interface has none 2026-10-09 14:37:27 +00:00
Ruakij fb94fd5997 Deploy the calico operator v3.28.0 2026-10-09 14:37:26 +00:00
Ruakij 713d38d77d Shrink the default IPv6 cluster CIDR of k3s to fd42::/112 2026-10-09 14:37:26 +00:00
Ruakij bc71066de1 Run the k3s install of the kubernetes role only on target_host when it is set 2026-10-09 14:37:26 +00:00
Ruakij 5eae9ca348 Drop the docker dependency and the helm install from the kubernetes role 2026-10-09 14:37:25 +00:00
Ruakij 844e017f9e Add a tuned role that installs tuned and sets the throughput-performance profile 2026-10-09 14:37:25 +00:00
Ruakij 381f3ab7c9 Start the wireguard-ipv6-converter again whenever its bound service starts via a drop-in and always restart it on deploy 2026-10-09 14:37:24 +00:00
Ruakij 6390e6288b Disable SSH password auth in the common role only when sshd is active 2026-10-09 14:37:24 +00:00
Ruakij 13d60c4f9b Install nmon and fail2ban and upgrade packages on every distribution in the common role 2026-10-09 14:37:24 +00:00
Ruakij cb09f77b68 Enable TCP BBR with the fq qdisc on kernels from 4.9 in the common role 2026-10-09 14:37:23 +00:00
Ruakij 84fd52b678 Generate a random IPv6 stable secret once per host for the default interface in the common role 2026-10-09 14:37:23 +00:00
Ruakij c7eceae087 Ensure the .bashrc exists, expand aliases after sudo and color grep in the common role aliases 2026-10-09 14:37:23 +00:00
Ruakij 23ed82b113 Own the k3s config.yaml in the kubernetes role template, write it only on a semantic change and run the installer only when the pinned k3s version differs 2026-10-09 14:13:21 +00:00
Ruakij 37e21ead36 Expose the etcd metrics on the node IP of the etcd members of k3s 2026-10-09 12:56:24 +00:00
Ruakij 2798853153 Raise the inotify limits of the k3s nodes to 65536 instances and 4194304 watches, except in LXC 2026-10-09 12:55:46 +00:00
Ruakij e9ba272d70 Manage the kubelet image garbage collection drop-in and its config-dir kubelet-arg in the kubernetes role 2026-10-09 12:54:41 +00:00
Ruakij b62992f21e Cap the systemd journal at 512M on disk, 128M in memory and two weeks in the common role 2026-10-09 12:53:44 +00:00
Ruakij fd73949412 Whitelist the public_ips of every inventory host in crowdsec and keep a LAPI allowlist equal to the whitelist 2026-10-08 09:19:51 +00:00
Ruakij d345ccf585 Add a pre_command to kopia_backup for host dump scripts and install gpg for the apt key 2026-10-08 08:51:23 +00:00
Ruakij b45a07da56 Add forward_guard to host_firewall for a forward chain that drops traffic to guarded guests outside the allowed interfaces, ports and ICMP types 2026-10-08 08:48:40 +00:00
Ruakij 9ded6814c3 Pin the fstrim timer and the monthly ZFS trim and scrub per host in the common role to keep them out of the backup window 2026-10-07 22:42:08 +00:00
Ruakij a9a60e3106 Keep the clock on systemd-timesyncd and the timezone on UTC in the common role 2026-10-07 21:22:01 +00:00
Ruakij 5da89fdf29 Run the kopia_backup timer at 03:30 UTC by default since the hosts run in different timezones 2026-10-07 21:19:09 +00:00
Ruakij 9e2e6cbb99 Add IPv4 port forwards and masquerade to host_firewall in an ip host_nat table 2026-10-07 21:10:35 +00:00
Ruakij c9d2334906 Add a kopia_backup role for the daily Kopia snapshot script and timer against an existing S3 repository 2026-10-07 21:00:25 +00:00
Ruakij c87af201aa Add a crowdsec role for agents and the nftables bouncer against a central LAPI 2026-10-07 11:02:59 +00:00
Ruakij cfe87002c5 Replace the nftables role with host_firewall, one atomic inet host input table with zones, geo sets and lockout rollback 2026-10-07 11:02:59 +00:00
Ruakij 27e9d4a1ab Merge branch 'role_nftables' 2023-06-21 17:35:09 +02:00
Ruakij 755f9b2e1a Initial role 2023-05-21 20:57:43 +02:00
Ruakij 753f456ef3 Merge branch 'role_kubernetes-k3s' 2023-04-14 10:21:06 +02:00
Ruakij 093612f3a7 Change restart-check to started/restarted check 2023-04-14 10:20:16 +02:00
Ruakij a92409c56f Add failed_when to deploy calico operator 2023-04-14 10:01:42 +02:00
Ruakij f50e3ac33c Use first node's IP for joining cluster 2023-04-14 09:50:39 +02:00
Ruakij 668ff23ee6 Fix service task wrong usage 2023-04-14 09:42:46 +02:00
Ruakij c2c6a2872f Fix conditional for changed after install 2023-04-12 23:12:10 +02:00
Ruakij c1c7ec9e56 Remove workaround as k3s is now at 1.26 2023-04-12 22:39:43 +02:00
Ruakij 550f6868ff Fix old usage of network_plugin var 2023-04-12 20:49:38 +02:00