inital
This commit is contained in:
commit
b6dafc7a73
9 changed files with 391 additions and 0 deletions
18
.gitignore
vendored
Normal file
18
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,18 @@
|
||||||
|
# Vault Password File
|
||||||
|
.vault-password
|
||||||
|
vault-password
|
||||||
|
*.vault-pass
|
||||||
|
|
||||||
|
# Sensible Dateien
|
||||||
|
*.key
|
||||||
|
*.pem
|
||||||
|
*.pfx
|
||||||
|
|
||||||
|
# Ansible temporäre Dateien
|
||||||
|
*.retry
|
||||||
|
.ansible/
|
||||||
|
|
||||||
|
# Editor
|
||||||
|
.vscode/
|
||||||
|
*.swp
|
||||||
|
*~
|
||||||
7
ansible.cfg
Normal file
7
ansible.cfg
Normal file
|
|
@ -0,0 +1,7 @@
|
||||||
|
[defaults]
|
||||||
|
host_key_checking = false
|
||||||
|
inventory=pfannkuchen.ini
|
||||||
|
ansible_python_interpreter=/usr/bin/python3
|
||||||
|
interpreter_python = auto_silent
|
||||||
|
[ssh_connection]
|
||||||
|
ssh_args = -o PasswordAuthentication=yes
|
||||||
141
base-debian.yml
Normal file
141
base-debian.yml
Normal file
|
|
@ -0,0 +1,141 @@
|
||||||
|
---
|
||||||
|
- name: Basis-Konfiguration für Debian VMs
|
||||||
|
hosts: all
|
||||||
|
become: yes
|
||||||
|
vars:
|
||||||
|
# Pfad auf dem Ansible-LXC (Quelle)
|
||||||
|
source_folder: "/ansible/komodo/"
|
||||||
|
# Pfad auf der Ziel-VM (Ziel)
|
||||||
|
dest_folder: "/app-config/komodo/"
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: SSH Key für Benutzer sascha hinterlegen
|
||||||
|
ansible.posix.authorized_key:
|
||||||
|
user: chris
|
||||||
|
state: present
|
||||||
|
key: "{{ lookup('file', '/root/.ssh/id_rsa.pub') }}"
|
||||||
|
- name: Standard Debian Trixie Repositories setzen
|
||||||
|
copy:
|
||||||
|
dest: /etc/apt/sources.list
|
||||||
|
content: |
|
||||||
|
deb http://ftp.gwdg.de/debian/ trixie main non-free-firmware non-free contrib
|
||||||
|
deb-src http://ftp.gwdg.de/debian/ trixie main non-free-firmware non-free contrib
|
||||||
|
|
||||||
|
deb http://security.debian.org/debian-security trixie-security main non-free-firmware non-free contrib
|
||||||
|
deb-src http://security.debian.org/debian-security trixie-security main non-free-firmware non-free contrib
|
||||||
|
|
||||||
|
deb http://ftp.gwdg.de/debian/ trixie-updates main non-free-firmware non-free contrib
|
||||||
|
deb-src http://ftp.gwdg.de/debian/ trixie-updates main non-free-firmware non-free contrib
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: '0644'
|
||||||
|
register: repo_status
|
||||||
|
|
||||||
|
- name: Apt Cache aktualisieren (falls Repos geändert wurden)
|
||||||
|
apt:
|
||||||
|
update_cache: yes
|
||||||
|
when: repo_status.changed
|
||||||
|
|
||||||
|
- name: Installiere benötigte Basis-Pakete
|
||||||
|
apt:
|
||||||
|
name:
|
||||||
|
- curl
|
||||||
|
- gnupg
|
||||||
|
- ca-certificates
|
||||||
|
- sudo
|
||||||
|
- wget
|
||||||
|
- vim
|
||||||
|
- mc
|
||||||
|
state: present
|
||||||
|
update_cache: yes
|
||||||
|
- name: Locales-Paket sicherstellen
|
||||||
|
apt:
|
||||||
|
name: locales
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: en_US.UTF-8 Locale generieren
|
||||||
|
locale_gen:
|
||||||
|
name: en_US.UTF-8
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Systemweite Sprache auf en_US.UTF-8 setzen
|
||||||
|
debconf:
|
||||||
|
name: locales
|
||||||
|
question: locales/default_environment_locale
|
||||||
|
value: en_US.UTF-8
|
||||||
|
vtype: select
|
||||||
|
|
||||||
|
- name: Locale-Datei manuell schreiben (Sicherheitsnetz)
|
||||||
|
copy:
|
||||||
|
dest: /etc/default/locale
|
||||||
|
content: |
|
||||||
|
LANG=en_US.UTF-8
|
||||||
|
LC_ALL=en_US.UTF-8
|
||||||
|
|
||||||
|
- name: Verzeichnis für Keyrings erstellen
|
||||||
|
file:
|
||||||
|
path: /etc/apt/keyrings
|
||||||
|
state: directory
|
||||||
|
mode: '0755'
|
||||||
|
|
||||||
|
- name: Docker GPG Key herunterladen (Modern)
|
||||||
|
get_url:
|
||||||
|
url: https://download.docker.com/linux/debian/gpg
|
||||||
|
dest: /etc/apt/keyrings/docker.asc
|
||||||
|
mode: '0644'
|
||||||
|
|
||||||
|
- name: Docker Repository Datei erstellen
|
||||||
|
copy:
|
||||||
|
dest: /etc/apt/sources.list.d/docker.list
|
||||||
|
content: "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable"
|
||||||
|
mode: '0644'
|
||||||
|
register: docker_repo
|
||||||
|
|
||||||
|
- name: Paketliste aktualisieren
|
||||||
|
apt:
|
||||||
|
update_cache: yes
|
||||||
|
when: docker_repo.changed
|
||||||
|
|
||||||
|
- name: Docker Engine installieren
|
||||||
|
apt:
|
||||||
|
name:
|
||||||
|
- docker-ce
|
||||||
|
- docker-ce-cli
|
||||||
|
- containerd.io
|
||||||
|
- docker-compose-plugin
|
||||||
|
state: present
|
||||||
|
- name: Zielverzeichnis auf der VM erstellen
|
||||||
|
file:
|
||||||
|
path: "{{ dest_folder }}"
|
||||||
|
state: directory
|
||||||
|
mode: '0755'
|
||||||
|
|
||||||
|
# 2. Sudoers anpassen (Ohne Passwort-Abfrage für die Gruppe sudo)
|
||||||
|
- name: Gruppe sudo passwortloses sudo erlauben
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/sudoers
|
||||||
|
state: present
|
||||||
|
regexp: '^%sudo'
|
||||||
|
line: '%sudo ALL=(ALL:ALL) NOPASSWD: ALL'
|
||||||
|
validate: '/usr/sbin/visudo -cf %s'
|
||||||
|
|
||||||
|
# 3. Sascha in Gruppen stecken
|
||||||
|
- name: Benutzer sascha zu sudo und docker Gruppen hinzufügen
|
||||||
|
user:
|
||||||
|
name: sascha
|
||||||
|
groups: sudo,docker
|
||||||
|
append: yes
|
||||||
|
|
||||||
|
- name: Unnötige Pakete entfernen
|
||||||
|
apt:
|
||||||
|
autoremove: yes
|
||||||
|
|
||||||
|
- name: QEMU Guest Agent installieren und starten
|
||||||
|
apt:
|
||||||
|
name: qemu-guest-agent
|
||||||
|
state: present
|
||||||
|
- name: Agent Dienst aktivieren
|
||||||
|
service:
|
||||||
|
name: qemu-guest-agent
|
||||||
|
state: started
|
||||||
|
enabled: yes
|
||||||
14
hawser.yml
Normal file
14
hawser.yml
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
---
|
||||||
|
- name: Hawser
|
||||||
|
hosts: all
|
||||||
|
become: yes
|
||||||
|
tasks:
|
||||||
|
- name: Hawser installieren (offizielles Install-Script)
|
||||||
|
ansible.builtin.shell:
|
||||||
|
cmd: curl -fsSL https://raw.githubusercontent.com/Finsys/hawser/main/scripts/install.sh | bash
|
||||||
|
- name: Hawser aktivieren und starten
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: hawser
|
||||||
|
enabled: true
|
||||||
|
state: started
|
||||||
|
daemon_reload: true
|
||||||
88
nvidia.yml
Normal file
88
nvidia.yml
Normal file
|
|
@ -0,0 +1,88 @@
|
||||||
|
---
|
||||||
|
- name: NVIDIA + Docker Setup fuer Debian Trixie
|
||||||
|
hosts: all
|
||||||
|
become: true
|
||||||
|
|
||||||
|
vars:
|
||||||
|
docker_daemon_config:
|
||||||
|
default-runtime: nvidia
|
||||||
|
runtimes:
|
||||||
|
nvidia:
|
||||||
|
path: nvidia-container-runtime
|
||||||
|
runtimeArgs: []
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
|
||||||
|
# --- Repos ----------------------------------------------------------------
|
||||||
|
|
||||||
|
- name: NVIDIA Container Toolkit GPG Key hinzufuegen
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \
|
||||||
|
| gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
|
||||||
|
args:
|
||||||
|
creates: /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
|
||||||
|
|
||||||
|
- name: NVIDIA Container Toolkit Repo hinzufuegen
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
curl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list \
|
||||||
|
| sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' \
|
||||||
|
| tee /etc/apt/sources.list.d/nvidia-container-toolkit.list
|
||||||
|
args:
|
||||||
|
creates: /etc/apt/sources.list.d/nvidia-container-toolkit.list
|
||||||
|
|
||||||
|
- name: apt update
|
||||||
|
ansible.builtin.apt:
|
||||||
|
update_cache: true
|
||||||
|
|
||||||
|
# --- Pakete ---------------------------------------------------------------
|
||||||
|
- name: Kernel Headers und DKMS installieren
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name:
|
||||||
|
- linux-headers-{{ ansible_kernel }}
|
||||||
|
- dkms
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: NVIDIA Treiber installieren
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name:
|
||||||
|
- "nvidia-driver"
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: NVIDIA Container Toolkit installieren
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name:
|
||||||
|
- nvidia-container-toolkit
|
||||||
|
- nvidia-docker2
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: NFS und CIFS Pakete installieren
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name:
|
||||||
|
- nfs-common
|
||||||
|
- cifs-utils
|
||||||
|
state: present
|
||||||
|
|
||||||
|
# --- Docker konfigurieren -------------------------------------------------
|
||||||
|
|
||||||
|
- name: /etc/docker Verzeichnis sicherstellen
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /etc/docker
|
||||||
|
state: directory
|
||||||
|
mode: "0755"
|
||||||
|
|
||||||
|
- name: Docker daemon.json konfigurieren (NVIDIA als default runtime)
|
||||||
|
ansible.builtin.copy:
|
||||||
|
content: "{{ docker_daemon_config | to_nice_json }}"
|
||||||
|
dest: /etc/docker/daemon.json
|
||||||
|
mode: "0644"
|
||||||
|
notify: Docker neustarten
|
||||||
|
|
||||||
|
- name: nvidia-ctk runtime fuer Docker konfigurieren
|
||||||
|
ansible.builtin.command: nvidia-ctk runtime configure --runtime=docker
|
||||||
|
changed_when: false
|
||||||
|
|
||||||
|
handlers:
|
||||||
|
- name: Docker neustarten
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: docker
|
||||||
|
state: restarted
|
||||||
45
pfannkuchen.ini
Normal file
45
pfannkuchen.ini
Normal file
|
|
@ -0,0 +1,45 @@
|
||||||
|
[proxmox]
|
||||||
|
node1 ansible_host=10.10.1.1
|
||||||
|
node2 ansible_host=10.5.85.200
|
||||||
|
node4 ansible_host=10.5.85.100
|
||||||
|
node5 ansible_host=10.5.85.101
|
||||||
|
|
||||||
|
[proxmox:vars]
|
||||||
|
ansible_user=root
|
||||||
|
|
||||||
|
[media]
|
||||||
|
emby_sascha ansible_host=10.5.1.103 ansible_user=sascha
|
||||||
|
emby_chris ansible_host=10.5.1.106 ansible_user=chris
|
||||||
|
jellyfin ansible_host=10.5.1.112 ansible_user=sascha ansible_become_method=su ansible_become_password=GT500r8
|
||||||
|
immich ansible_host=10.4.1.107 ansible_user=sascha ansible_become_method=su ansible_become_password=GT500r8
|
||||||
|
emby_chris_new ansible_host=10.5.1.117 ansible_user=chris ansible_become_method=su ansible_become_password=Pimmelparty123 ansible_password=Pimmelparty123
|
||||||
|
|
||||||
|
|
||||||
|
[arr]
|
||||||
|
tdarr ansible_host=10.2.1.104 ansible_user=sascha ansible_become_method=su ansible_become_password=GT500r8
|
||||||
|
arrapps ansible_host=10.2.1.100 ansible_user=sascha ansible_become_method=su ansible_become_password=GT500r8
|
||||||
|
sabnzbd ansible_host=10.2.1.119 ansible_user=sascha ansible_become_method=su ansible_become_password=GT500r8
|
||||||
|
|
||||||
|
[docker]
|
||||||
|
dockhand ansible_host=10.4.1.116 ansible_user=sascha ansible_become_method=su ansible_become_password=GT500r8 ansible_password=GT500r8
|
||||||
|
|
||||||
|
[auto]
|
||||||
|
n8n ansible_host=10.4.1.113 ansible_user=sascha ansible_become_method=su ansible_become_password=GT500r8 ansible_password=GT500r8
|
||||||
|
ansible ansible_host=localhost ansible_user=root
|
||||||
|
|
||||||
|
[communication]
|
||||||
|
matrix ansible_host=10.4.1.110 ansible_user=sascha ansible_become_method=su ansible_become_password=GT500r8 ansible_password=GT500r8
|
||||||
|
|
||||||
|
[hetzner]
|
||||||
|
emby ansible_host=emby ansible_user=root
|
||||||
|
proxy ansible_host=proxy ansible_user=root
|
||||||
|
|
||||||
|
|
||||||
|
[all:children]
|
||||||
|
media
|
||||||
|
arr
|
||||||
|
media
|
||||||
|
docker
|
||||||
|
auto
|
||||||
|
hetzner
|
||||||
|
#proxmox
|
||||||
27
sysctl-proxmox.yaml
Normal file
27
sysctl-proxmox.yaml
Normal file
|
|
@ -0,0 +1,27 @@
|
||||||
|
---
|
||||||
|
- name: Sysctl Tuning fuer Proxmox Hosts
|
||||||
|
hosts: proxmox
|
||||||
|
become: true
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
|
||||||
|
- name: Sysctl Parameter setzen
|
||||||
|
ansible.posix.sysctl:
|
||||||
|
name: "{{ item.key }}"
|
||||||
|
value: "{{ item.value }}"
|
||||||
|
sysctl_file: /etc/sysctl.d/99-proxmox-tuning.conf
|
||||||
|
reload: true
|
||||||
|
state: present
|
||||||
|
loop:
|
||||||
|
# KVM / Virtualisierung
|
||||||
|
- { key: vm.overcommit_memory, value: "1" }
|
||||||
|
- { key: vm.swappiness, value: "1" }
|
||||||
|
# Viele VMs = viele File Handles
|
||||||
|
- { key: fs.file-max, value: "9999999" }
|
||||||
|
- { key: fs.inotify.max_user_watches, value: "524288" }
|
||||||
|
- { key: fs.inotify.max_user_instances, value: "512" }
|
||||||
|
# Routing zwischen VMs / Bridges
|
||||||
|
- { key: net.ipv4.ip_forward, value: "1" }
|
||||||
|
# WireGuard MTU-Anpassung
|
||||||
|
# TODO: entfernen sobald WireGuard abgeschaltet wird
|
||||||
|
- { key: net.ipv4.tcp_mtu_probing, value: "1" }
|
||||||
41
sysctl.yaml
Normal file
41
sysctl.yaml
Normal file
|
|
@ -0,0 +1,41 @@
|
||||||
|
---
|
||||||
|
- name: Sysctl Tuning fuer Emby
|
||||||
|
hosts: all
|
||||||
|
become: true
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
|
||||||
|
- name: BBR Kernel Modul laden
|
||||||
|
ansible.builtin.modprobe:
|
||||||
|
name: tcp_bbr
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: BBR Modul beim Boot laden
|
||||||
|
ansible.builtin.copy:
|
||||||
|
content: "tcp_bbr\n"
|
||||||
|
dest: /etc/modules-load.d/bbr.conf
|
||||||
|
mode: "0644"
|
||||||
|
|
||||||
|
- name: Sysctl Parameter setzen
|
||||||
|
ansible.posix.sysctl:
|
||||||
|
name: "{{ item.key }}"
|
||||||
|
value: "{{ item.value }}"
|
||||||
|
sysctl_file: /etc/sysctl.d/99-net-tuning.conf
|
||||||
|
reload: true
|
||||||
|
state: present
|
||||||
|
loop:
|
||||||
|
- { key: net.core.rmem_default, value: "262144" }
|
||||||
|
- { key: net.core.wmem_default, value: "262144" }
|
||||||
|
- { key: net.core.rmem_max, value: "67108864" }
|
||||||
|
- { key: net.core.wmem_max, value: "67108864" }
|
||||||
|
- { key: net.ipv4.tcp_rmem, value: "4096 87380 67108864" }
|
||||||
|
- { key: net.ipv4.tcp_wmem, value: "4096 65536 67108864" }
|
||||||
|
- { key: net.ipv4.tcp_window_scaling, value: "1" }
|
||||||
|
- { key: net.ipv4.tcp_congestion_control, value: "bbr" }
|
||||||
|
- { key: net.ipv4.tcp_slow_start_after_idle, value: "0" }
|
||||||
|
- { key: net.ipv4.tcp_fastopen, value: "3" }
|
||||||
|
- { key: net.core.netdev_max_backlog, value: "16384" }
|
||||||
|
# RAM ist reichlich vorhanden, Transcoding auf tmpfs
|
||||||
|
- { key: vm.swappiness, value: "1" }
|
||||||
|
- { key: vm.dirty_ratio, value: "15" }
|
||||||
|
- { key: vm.dirty_background_ratio, value: "5" }
|
||||||
10
update.yml
Normal file
10
update.yml
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
---
|
||||||
|
- name: Alle VMs aktualisieren
|
||||||
|
hosts: all
|
||||||
|
become: yes
|
||||||
|
tasks:
|
||||||
|
- name: Update apt cache and upgrade packages
|
||||||
|
apt:
|
||||||
|
update_cache: yes
|
||||||
|
upgrade: dist
|
||||||
|
autoremove: yes
|
||||||
Loading…
Add table
Add a link
Reference in a new issue