From fd518f7460f0e249e31c554eeaab3b2461874891 Mon Sep 17 00:00:00 2001 From: harry Date: Thu, 13 Nov 2025 04:43:33 +0000 Subject: [PATCH] Upload files to "playbooks" --- playbooks/bootstrap_lxc.yml | 126 +++++++++++++++++++++++++ playbooks/ping.yml | 7 ++ playbooks/proxmox-backup.yml | 60 ++++++++++++ playbooks/update_pihole_blocklists.yml | 6 ++ playbooks/update_system.yml | 23 +++++ 5 files changed, 222 insertions(+) create mode 100644 playbooks/bootstrap_lxc.yml create mode 100644 playbooks/ping.yml create mode 100644 playbooks/proxmox-backup.yml create mode 100644 playbooks/update_pihole_blocklists.yml create mode 100644 playbooks/update_system.yml diff --git a/playbooks/bootstrap_lxc.yml b/playbooks/bootstrap_lxc.yml new file mode 100644 index 0000000..55c31a2 --- /dev/null +++ b/playbooks/bootstrap_lxc.yml @@ -0,0 +1,126 @@ +- name: Bootstrap new Linux servers + hosts: all + become: yes + + tasks: + + - name: Install packages on Debian/Ubuntu + apt: + name: + - vim + - htop + - nmap + - curl + - wget + - iperf3 + - fail2ban + - net-tools + - lsof + - unzip + - zip + - git + - sudo + - tree + - traceroute + - dnsutils + - ca-certificates + - python3 + - python3-pip + - software-properties-common + - rsync + - apt-transport-https + - sysstat + - screen + - mtr + state: present + update_cache: yes + when: ansible_facts['os_family'] == "Debian" + + - name: Ensure EPEL repo is enabled (RHEL/CentOS/AlmaLinux) + yum: + name: epel-release + state: present + when: ansible_facts['os_family'] == "RedHat" + + - name: Install packages on RHEL/CentOS/AlmaLinux + yum: + name: + - vim + - htop + - nmap + - curl + - mtr + - wget + - iperf3 + - fail2ban + - net-tools + - lsof + - unzip + - zip + - git + - sudo + - tmux + - tree + - bash-completion + - traceroute + - bind-utils # provides dig, nslookup + - ca-certificates + - python3 + - python3-pip + - rsync + - sysstat + - screen + state: present + update_cache: yes + when: ansible_facts['os_family'] == "RedHat" + + - name: Ensure root's .ssh directory exists + file: + path: /root/.ssh + state: directory + owner: root + group: root + mode: '0700' + + - name: Set authorized_keys for root + copy: + dest: /root/.ssh/authorized_keys + content: | + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINegitHaQG8i+s412h3wTWf/KvpeX1CEpYFva9MhHR+7 ansible-key + owner: root + group: root + mode: '0600' + + - name: Permit root login via public key + lineinfile: + path: /etc/ssh/sshd_config + regexp: '^#?PermitRootLogin\s+' + line: 'PermitRootLogin prohibit-password' + state: present + backup: yes + + - name: Ensure PubkeyAuthentication is enabled + lineinfile: + path: /etc/ssh/sshd_config + regexp: '^#?PubkeyAuthentication\s+' + line: 'PubkeyAuthentication yes' + state: present + + - name: Ensure PasswordAuthentication is enabled + lineinfile: + path: /etc/ssh/sshd_config + regexp: '^#?PasswordAuthentication\s+' + line: 'PasswordAuthentication yes' + state: present + + - name: Restart SSH service (Debian) + service: + name: ssh + state: restarted + when: ansible_facts['os_family'] == "Debian" + + - name: Restart SSH service (RHEL) + service: + name: sshd + state: restarted + when: ansible_facts['os_family'] == "RedHat" diff --git a/playbooks/ping.yml b/playbooks/ping.yml new file mode 100644 index 0000000..3fde6e6 --- /dev/null +++ b/playbooks/ping.yml @@ -0,0 +1,7 @@ +- name: Ping all servers + hosts: all + gather_facts: no + tasks: + - name: Test connectivity with ping + ansible.builtin.ping: + diff --git a/playbooks/proxmox-backup.yml b/playbooks/proxmox-backup.yml new file mode 100644 index 0000000..3e8884a --- /dev/null +++ b/playbooks/proxmox-backup.yml @@ -0,0 +1,60 @@ +--- +- name: Backup selected Proxmox VMs and LXCs + hosts: proxmox + become: true + vars: + backup_dir: "/var/lib/vz/dump" + storage: "local" + compression: "zstd" + maxfiles: 3 + guests: + #- { id: 104, type: "lxc", name: "jellyfin" } + - { id: 108, type: "lxc", name: "docker" } + #- { id: 101, type: "qemu", name: "pnetlab" } + + tasks: + - name: Ensure backup directory exists + file: + path: "{{ backup_dir }}" + state: directory + mode: '0755' + + - name: Run vzdump backup with logging + shell: | + LOGFILE="{{ backup_dir }}/proxmox_backup.log" + START=$(date +%s) + echo "[$(date '+%Y-%m-%d %H:%M:%S')] Starting backup of {{ item.name }} ({{ item.type }}) [ID: {{ item.id }}]" >> "$LOGFILE" + + OUTPUT=$(vzdump {{ item.id }} --mode stop --compress {{ compression }} --storage {{ storage }} --remove 0 2>&1) + STATUS=$? + + END=$(date +%s) + DURATION=$((END - START)) + + if [ $STATUS -eq 0 ]; then + echo "[$(date '+%Y-%m-%d %H:%M:%S')] ✅ SUCCESS - {{ item.name }} [{{ item.id }}] - Duration: ${DURATION}s" >> "$LOGFILE" + else + echo "[$(date '+%Y-%m-%d %H:%M:%S')] ❌ FAILURE - {{ item.name }} [{{ item.id }}] - Duration: ${DURATION}s" >> "$LOGFILE" + echo "---- ERROR OUTPUT ----" >> "$LOGFILE" + echo "$OUTPUT" >> "$LOGFILE" + echo "----------------------" >> "$LOGFILE" + fi + args: + executable: /bin/bash + loop: "{{ guests }}" + + - name: Rename backup files to include guest name + shell: | + latest_file=$(ls -t {{ backup_dir }}/vzdump-{{ item.type }}-{{ item.id }}-*.{{ compression }} | head -n 1) + new_file="{{ backup_dir }}/{{ item.name }}-{{ item.type }}-{{ item.id }}-{{ '%Y%m%d-%H%M%S' | strftime(ansible_date_time.epoch | int) }}.{{ compression }}" + cp "$latest_file" "$new_file" + args: + executable: /bin/bash + loop: "{{ guests }}" + + - name: Prune old backups (keep last {{ maxfiles }}) + shell: | + ls -tp {{ backup_dir }}/{{ item.name }}-{{ item.type }}-{{ item.id }}-*{{ compression }} | grep -v '/$' | tail -n +{{ maxfiles + 1 }} | xargs -r rm -- + args: + executable: /bin/bash + loop: "{{ guests }}" diff --git a/playbooks/update_pihole_blocklists.yml b/playbooks/update_pihole_blocklists.yml new file mode 100644 index 0000000..f85aedc --- /dev/null +++ b/playbooks/update_pihole_blocklists.yml @@ -0,0 +1,6 @@ +- name: Update Pi-hole blocklists + hosts: pihole + become: yes + tasks: + - name: Update gravity + command: pihole -g diff --git a/playbooks/update_system.yml b/playbooks/update_system.yml new file mode 100644 index 0000000..718fc4d --- /dev/null +++ b/playbooks/update_system.yml @@ -0,0 +1,23 @@ +- name: Update and Upgrade Packages + hosts: all + become: yes + tasks: + + - name: Get OS Family + ansible.builtin.setup: + gather_subset: + - "min" + register: system_info + + - name: Update & Upgrade - Debian-based systems + ansible.builtin.apt: + update_cache: yes + upgrade: yes + when: system_info.ansible_facts.ansible_os_family == "Debian" + + - name: Update & Upgrade - RHEL-based systems + ansible.builtin.yum: + name: "*" + state: latest + when: system_info.ansible_facts.ansible_os_family == "RedHat" +