Upload files to "/"

Install-LAMP.yml

@@ -0,0 +1,164 @@
+- name: Install LAMP stack with phpMyAdmin (Debian + RHEL)
+  hosts: lampservers
+  become: yes
+  vars:
+    mysql_root_password: "ts;hffkX^8Mtip'8!O,!"
+    phpmyadmin_password: "ts;hffkX^8Mtip'8!O,!"
+    php_version: "default"    # You can override this per-host/group
+
+    # Debian/Ubuntu package lists
+    deb_packages:
+      - apache2
+      - mysql-server
+      - php
+      - php-mysql
+      - libapache2-mod-php
+      - php-cli
+      - php-cgi
+      - php-gd
+      - php-json
+      - php-mbstring
+      - php-zip
+      - phpmyadmin
+
+    # RHEL/CentOS/Alma/Rocky package lists
+    rhel_packages:
+      - httpd
+      - mariadb-server
+      - php
+      - php-mysqlnd
+      - php-gd
+      - php-json
+      - php-mbstring
+      - php-zip
+      - epel-release
+
+  tasks:
+
+    - name: Install required packages (Debian/Ubuntu)
+      apt:
+        name: "{{ deb_packages }}"
+        state: present
+        update_cache: yes
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Preseed MySQL and phpMyAdmin passwords (Debian/Ubuntu)
+      debconf:
+        name: "{{ item.name }}"
+        question: "{{ item.question }}"
+        value: "{{ item.value }}"
+        vtype: "string"
+      loop:
+        - { name: "mysql-server", question: "mysql-server/root_password",        value: "{{ mysql_root_password }}" }
+        - { name: "mysql-server", question: "mysql-server/root_password_again",  value: "{{ mysql_root_password }}" }
+        - { name: "phpmyadmin", question: "phpmyadmin/phpmyadmin/reconfigure-webserver", value: "apache2" }
+        - { name: "phpmyadmin", question: "phpmyadmin/phpmyadmin/dbconfig-install", value: "true" }
+        - { name: "phpmyadmin", question: "phpmyadmin/app-password-confirm", value: "{{ phpmyadmin_password }}" }
+        - { name: "phpmyadmin", question: "phpmyadmin/mysql/admin-pass", value: "{{ mysql_root_password }}" }
+        - { name: "phpmyadmin", question: "phpmyadmin/mysql/app-pass", value: "{{ phpmyadmin_password }}" }
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Ensure Apache is installed and enabled (Debian)
+      service:
+        name: apache2
+        state: started
+        enabled: yes
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Ensure MySQL is installed and enabled (Debian)
+      service:
+        name: mysql
+        state: started
+        enabled: yes
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Install EPEL repo for phpMyAdmin (RHEL/CentOS)
+      yum:
+        name: epel-release
+        state: present
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Install required packages (RHEL/CentOS)
+      yum:
+        name: "{{ rhel_packages }}"
+        state: present
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Install phpMyAdmin (RHEL/CentOS)
+      yum:
+        name: phpMyAdmin
+        state: present
+      ignore_errors: yes
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Ensure Apache is installed and enabled (RHEL)
+      service:
+        name: httpd
+        state: started
+        enabled: yes
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Ensure MariaDB is installed and enabled (RHEL)
+      service:
+        name: mariadb
+        state: started
+        enabled: yes
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Enable Apache mod_rewrite (Debian)
+      community.general.apache2_module:
+        name: rewrite
+        state: present
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Enable mod_rewrite (RHEL/CentOS)
+      lineinfile:
+        dest: /etc/httpd/conf/httpd.conf
+        regexp: '^#?LoadModule rewrite_module modules/mod_rewrite.so'
+        line: 'LoadModule rewrite_module modules/mod_rewrite.so'
+        state: present
+      notify: restart apache
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Allow .htaccess overrides (RHEL/CentOS)
+      replace:
+        path: /etc/httpd/conf/httpd.conf
+        regexp: 'AllowOverride None'
+        replace: 'AllowOverride All'
+      notify: restart apache
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Set MySQL root password (Debian/Ubuntu)
+      mysql_user:
+        name: root
+        host: "{{ item }}"
+        password: "{{ mysql_root_password }}"
+        login_unix_socket: /var/run/mysqld/mysqld.sock
+        state: present
+        check_implicit_admin: yes
+      loop: ['localhost', '127.0.0.1']
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Set MariaDB root password (RHEL/CentOS)
+      mysql_user:
+        name: root
+        host: "{{ item }}"
+        password: "{{ mysql_root_password }}"
+        login_unix_socket: /var/lib/mysql/mysql.sock
+        state: present
+        check_implicit_admin: yes
+      loop: ['localhost', '127.0.0.1']
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Ensure Apache is listening on 80
+      lineinfile:
+        path: "{{ '/etc/apache2/ports.conf' if ansible_facts['os_family'] == 'Debian' else '/etc/httpd/conf/httpd.conf' }}"
+        regexp: '^Listen 80'
+        line: 'Listen 80'
+        state: present
+
+  handlers:
+    - name: restart apache
+      service:
+        name: "{{ 'apache2' if ansible_facts['os_family'] == 'Debian' else 'httpd' }}"
+        state: restarted

bootstrap_lxc.yml

@@ -0,0 +1,126 @@
+- name: Bootstrap new Linux servers
+  hosts: all
+  become: yes
+
+  tasks:
+
+    - name: Install packages on Debian/Ubuntu
+      apt:
+        name:
+          - vim
+          - htop
+          - nmap
+          - curl
+          - wget
+          - iperf3
+          - fail2ban
+          - net-tools
+          - lsof
+          - unzip
+          - zip
+          - git
+          - sudo
+          - tree
+          - traceroute
+          - dnsutils
+          - ca-certificates
+          - python3
+          - python3-pip
+          - software-properties-common
+          - rsync
+          - apt-transport-https
+          - sysstat
+          - screen
+          - mtr
+        state: present
+        update_cache: yes
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Ensure EPEL repo is enabled (RHEL/CentOS/AlmaLinux)
+      yum:
+        name: epel-release
+        state: present
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Install packages on RHEL/CentOS/AlmaLinux
+      yum:
+        name:
+          - vim
+          - htop
+          - nmap
+          - curl
+          - mtr
+          - wget
+          - iperf3
+          - fail2ban
+          - net-tools
+          - lsof
+          - unzip
+          - zip
+          - git
+          - sudo
+          - tmux
+          - tree
+          - bash-completion
+          - traceroute
+          - bind-utils        # provides dig, nslookup
+          - ca-certificates
+          - python3
+          - python3-pip
+          - rsync
+          - sysstat
+          - screen
+        state: present
+        update_cache: yes
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Ensure root's .ssh directory exists
+      file:
+        path: /root/.ssh
+        state: directory
+        owner: root
+        group: root
+        mode: '0700'
+
+    - name: Set authorized_keys for root
+      copy:
+        dest: /root/.ssh/authorized_keys
+        content: |
+          ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINegitHaQG8i+s412h3wTWf/KvpeX1CEpYFva9MhHR+7 ansible-key
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Permit root login via public key
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PermitRootLogin\s+'
+        line: 'PermitRootLogin prohibit-password'
+        state: present
+        backup: yes
+
+    - name: Ensure PubkeyAuthentication is enabled
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PubkeyAuthentication\s+'
+        line: 'PubkeyAuthentication yes'
+        state: present
+
+    - name: Ensure PasswordAuthentication is enabled
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PasswordAuthentication\s+'
+        line: 'PasswordAuthentication yes'
+        state: present
+
+    - name: Restart SSH service (Debian)
+      service:
+        name: ssh
+        state: restarted
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Restart SSH service (RHEL)
+      service:
+        name: sshd
+        state: restarted
+      when: ansible_facts['os_family'] == "RedHat"

ping.yml

@@ -0,0 +1,7 @@
+- name: Ping all servers
+  hosts: all
+  gather_facts: no
+  tasks:
+    - name: Test connectivity with ping
+      ansible.builtin.ping:
+

proxmox-backup.yml

@@ -0,0 +1,60 @@
+---
+- name: Backup selected Proxmox VMs and LXCs
+  hosts: proxmox
+  become: true
+  vars:
+    backup_dir: "/var/lib/vz/dump"
+    storage: "local"
+    compression: "zstd"
+    maxfiles: 3
+    guests:
+      #- { id: 104, type: "lxc", name: "jellyfin" }
+      - { id: 108, type: "lxc", name: "docker" }
+      #- { id: 101, type: "qemu", name: "pnetlab" }
+
+  tasks:
+    - name: Ensure backup directory exists
+      file:
+        path: "{{ backup_dir }}"
+        state: directory
+        mode: '0755'
+
+    - name: Run vzdump backup with logging
+      shell: |
+        LOGFILE="{{ backup_dir }}/proxmox_backup.log"
+        START=$(date +%s)
+        echo "[$(date '+%Y-%m-%d %H:%M:%S')] Starting backup of {{ item.name }} ({{ item.type }}) [ID: {{ item.id }}]" >> "$LOGFILE"
+
+        OUTPUT=$(vzdump {{ item.id }} --mode stop --compress {{ compression }} --storage {{ storage }} --remove 0 2>&1)
+        STATUS=$?
+
+        END=$(date +%s)
+        DURATION=$((END - START))
+
+        if [ $STATUS -eq 0 ]; then
+          echo "[$(date '+%Y-%m-%d %H:%M:%S')] ✅ SUCCESS - {{ item.name }} [{{ item.id }}] - Duration: ${DURATION}s" >> "$LOGFILE"
+        else
+          echo "[$(date '+%Y-%m-%d %H:%M:%S')] ❌ FAILURE - {{ item.name }} [{{ item.id }}] - Duration: ${DURATION}s" >> "$LOGFILE"
+          echo "---- ERROR OUTPUT ----" >> "$LOGFILE"
+          echo "$OUTPUT" >> "$LOGFILE"
+          echo "----------------------" >> "$LOGFILE"
+        fi
+      args:
+        executable: /bin/bash
+      loop: "{{ guests }}"
+
+    - name: Rename backup files to include guest name
+      shell: |
+        latest_file=$(ls -t {{ backup_dir }}/vzdump-{{ item.type }}-{{ item.id }}-*.{{ compression }} | head -n 1)
+        new_file="{{ backup_dir }}/{{ item.name }}-{{ item.type }}-{{ item.id }}-{{ '%Y%m%d-%H%M%S' | strftime(ansible_date_time.epoch | int) }}.{{ compression }}"
+        cp "$latest_file" "$new_file"
+      args:
+        executable: /bin/bash
+      loop: "{{ guests }}"
+
+    - name: Prune old backups (keep last {{ maxfiles }})
+      shell: |
+        ls -tp {{ backup_dir }}/{{ item.name }}-{{ item.type }}-{{ item.id }}-*{{ compression }} | grep -v '/$' | tail -n +{{ maxfiles + 1 }} | xargs -r rm --
+      args:
+        executable: /bin/bash
+      loop: "{{ guests }}"

update_pihole_blocklists.yml

@@ -0,0 +1,6 @@
+- name: Update Pi-hole blocklists
+  hosts: pihole
+  become: yes
+  tasks:
+    - name: Update gravity
+      command: pihole -g