common + docker working

.gitignore

@@ -1 +1,38 @@
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version
+# control as they are data points which are potentially sensitive and subject
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+.terraform.lock.hcl
+*.tfbackend
+
 .vault_password

ansible.cfg

@@ -1,5 +1,4 @@
 [defaults]
-# (pathspec) Colon separated paths in which Ansible will search for Roles.
 roles_path=~/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:roles
 inventory=inventory
 vault_password_file=util/secret-service-client.sh

data/main.tf

@@ -0,0 +1,30 @@
+terraform {
+  backend "pg" {
+    schema_name = "max-data"
+    conn_str    = "postgres://terraform@10.42.0.1/terraform_state"
+  }
+
+  required_providers {
+    libvirt = {
+      source = "dmacvicar/libvirt"
+    }
+  }
+}
+
+provider "libvirt" {
+  uri = "qemu+ssh://root@atlas.lan/system"
+}
+
+resource "libvirt_volume" "data" {
+  name = "max-data"
+  pool = "data"
+  size = 1024 * 1024 * 1024 * 65
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+output "data_disk_id" {
+  value = libvirt_volume.data.id
+}

inventory/hosts.yml

@@ -1,7 +1,5 @@
 all:
-  children:
-    homeserver:
   hosts:
     max:
       ansible_user: root
-          ansible_host: max.dmz
+      ansible_host: max2.dmz

main.tf

@@ -0,0 +1,25 @@
+terraform {
+  backend "pg" {
+    schema_name = "max"
+    conn_str    = "postgres://terraform@10.42.0.1/terraform_state"
+  }
+
+  required_providers {
+    libvirt = {
+      source = "dmacvicar/libvirt"
+    }
+  }
+}
+
+provider "libvirt" {
+  uri = "qemu+ssh://root@atlas.lan/system"
+}
+
+module "tf-datatest" {
+  source          = "git::https://git.pim.kunis.nl/home/tf-modules.git//debian"
+  name            = "max2"
+  domain_name     = "tf-max"
+  data_disk       = "/kvm/data/max-data"
+  fixed_address   = "192.168.30.66/24"
+  ansible_command = "ansible-playbook max.yml"
+}

max.yml

@@ -1,17 +1,25 @@
 - name: Setup homeserver
-  hosts: homeserver
+  hosts: max
+  gather_facts: no
+
+  pre_tasks:
+  - name: Wait for host to come up
+    wait_for:
+      state: started
+      port: 22
+      host: max2.dmz
+      timeout: 10
+      connect_timeout: 300
+      search_regex: OpenSSH
+    delegate_to: localhost
+  - name: Wait for cloud-init to finish
+    command:
+      cmd: cloud-init status --wait
+    register: cloudinit
+    changed_when: "'..' in cloudinit.stdout"
+  - name: Gather facts
+    setup:
+
   roles:
-    - {role: 'ssh', tags: 'ssh'}
-    - {role: 'watchtower', tags: 'watchtower'}
-    - {role: 'forgejo', tags: 'forgejo'}
-    - {role: 'syncthing', tags: 'syncthing'}
-    - {role: 'kms', tags: 'kms'}
-    - {role: 'cyberchef', tags: 'cyberchef'}
-    - {role: 'radicale', tags: 'radicale'}
-    - {role: 'mastodon', tags: 'mastodon'}
-    - {role: 'seafile', tags: 'seafile'}
-    - {role: 'jitsi', tags: 'jitsi'}
-    - {role: 'freshrss', tags: 'freshrss'}
-    - {role: 'static', tags: 'static'}
-    - {role: 'inbucket', tags: 'inbucket'}
-    - {role: 'prometheus', tags: 'prometheus'}
+    - {role: 'common', tags: 'common'}
+    - {role: 'docker', tags: 'docker'}

roles/common/files/resolv.conf

@@ -1,5 +0,0 @@
-nameserver 192.168.30.7
-nameserver 192.168.30.1
-nameserver 1.1.1.1
-nameserver 1.0.0.1
-search lan

roles/common/tasks/main.yml

@@ -9,13 +9,3 @@
   file:
     path: "{{ base_service_dir }}"
     state: directory
-- name: Disable systemd-resolved
-  systemd:
-    name: systemd-resolved
-    enabled: false
-    state: stopped
-- name: Copy resolv.conf
-  copy:
-    src: "{{ role_path }}/files/resolv.conf"
-    dest: /etc/resolv.conf
-    follow: true

roles/docker/tasks/main.yml

@@ -12,7 +12,7 @@
     keyring: /etc/apt/keyrings/docker.gpg
 - name: Add Docker repository
   apt_repository:
-    repo: "deb [signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
+    repo: "deb [signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable"
   register: apt_repository
 - name: Update APT cache
   apt:
@@ -25,11 +25,12 @@
       - docker-ce-cli
       - containerd.io
       - docker-compose-plugin
-- name: Install Docker modules for Python
-  pip:
-    name:
-      - docker
-      - docker-compose
+# Do we need this? pip doesn't like it
+# - name: Install Docker modules for Python
+#   pip:
+#     name:
+#       - docker
+#       - docker-compose
 - name: Copy daemon.json
   copy:
     src: "{{ role_path }}/files/daemon.json"