Upload files to "playbooks"

playbooks/bootstrap_lxc.yml

@@ -0,0 +1,126 @@
+- name: Bootstrap new Linux servers
+  hosts: all
+  become: yes
+
+  tasks:
+
+    - name: Install packages on Debian/Ubuntu
+      apt:
+        name:
+          - vim
+          - htop
+          - nmap
+          - curl
+          - wget
+          - iperf3
+          - fail2ban
+          - net-tools
+          - lsof
+          - unzip
+          - zip
+          - git
+          - sudo
+          - tree
+          - traceroute
+          - dnsutils
+          - ca-certificates
+          - python3
+          - python3-pip
+          - software-properties-common
+          - rsync
+          - apt-transport-https
+          - sysstat
+          - screen
+          - mtr
+        state: present
+        update_cache: yes
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Ensure EPEL repo is enabled (RHEL/CentOS/AlmaLinux)
+      yum:
+        name: epel-release
+        state: present
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Install packages on RHEL/CentOS/AlmaLinux
+      yum:
+        name:
+          - vim
+          - htop
+          - nmap
+          - curl
+          - mtr
+          - wget
+          - iperf3
+          - fail2ban
+          - net-tools
+          - lsof
+          - unzip
+          - zip
+          - git
+          - sudo
+          - tmux
+          - tree
+          - bash-completion
+          - traceroute
+          - bind-utils        # provides dig, nslookup
+          - ca-certificates
+          - python3
+          - python3-pip
+          - rsync
+          - sysstat
+          - screen
+        state: present
+        update_cache: yes
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: Ensure root's .ssh directory exists
+      file:
+        path: /root/.ssh
+        state: directory
+        owner: root
+        group: root
+        mode: '0700'
+
+    - name: Set authorized_keys for root
+      copy:
+        dest: /root/.ssh/authorized_keys
+        content: |
+          ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINegitHaQG8i+s412h3wTWf/KvpeX1CEpYFva9MhHR+7 ansible-key
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Permit root login via public key
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PermitRootLogin\s+'
+        line: 'PermitRootLogin prohibit-password'
+        state: present
+        backup: yes
+
+    - name: Ensure PubkeyAuthentication is enabled
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PubkeyAuthentication\s+'
+        line: 'PubkeyAuthentication yes'
+        state: present
+
+    - name: Ensure PasswordAuthentication is enabled
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PasswordAuthentication\s+'
+        line: 'PasswordAuthentication yes'
+        state: present
+
+    - name: Restart SSH service (Debian)
+      service:
+        name: ssh
+        state: restarted
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Restart SSH service (RHEL)
+      service:
+        name: sshd
+        state: restarted
+      when: ansible_facts['os_family'] == "RedHat"

playbooks/ping.yml

@@ -0,0 +1,7 @@
+- name: Ping all servers
+  hosts: all
+  gather_facts: no
+  tasks:
+    - name: Test connectivity with ping
+      ansible.builtin.ping:
+

playbooks/proxmox-backup.yml

@@ -0,0 +1,60 @@
+---
+- name: Backup selected Proxmox VMs and LXCs
+  hosts: proxmox
+  become: true
+  vars:
+    backup_dir: "/var/lib/vz/dump"
+    storage: "local"
+    compression: "zstd"
+    maxfiles: 3
+    guests:
+      #- { id: 104, type: "lxc", name: "jellyfin" }
+      - { id: 108, type: "lxc", name: "docker" }
+      #- { id: 101, type: "qemu", name: "pnetlab" }
+
+  tasks:
+    - name: Ensure backup directory exists
+      file:
+        path: "{{ backup_dir }}"
+        state: directory
+        mode: '0755'
+
+    - name: Run vzdump backup with logging
+      shell: |
+        LOGFILE="{{ backup_dir }}/proxmox_backup.log"
+        START=$(date +%s)
+        echo "[$(date '+%Y-%m-%d %H:%M:%S')] Starting backup of {{ item.name }} ({{ item.type }}) [ID: {{ item.id }}]" >> "$LOGFILE"
+
+        OUTPUT=$(vzdump {{ item.id }} --mode stop --compress {{ compression }} --storage {{ storage }} --remove 0 2>&1)
+        STATUS=$?
+
+        END=$(date +%s)
+        DURATION=$((END - START))
+
+        if [ $STATUS -eq 0 ]; then
+          echo "[$(date '+%Y-%m-%d %H:%M:%S')] ✅ SUCCESS - {{ item.name }} [{{ item.id }}] - Duration: ${DURATION}s" >> "$LOGFILE"
+        else
+          echo "[$(date '+%Y-%m-%d %H:%M:%S')] ❌ FAILURE - {{ item.name }} [{{ item.id }}] - Duration: ${DURATION}s" >> "$LOGFILE"
+          echo "---- ERROR OUTPUT ----" >> "$LOGFILE"
+          echo "$OUTPUT" >> "$LOGFILE"
+          echo "----------------------" >> "$LOGFILE"
+        fi
+      args:
+        executable: /bin/bash
+      loop: "{{ guests }}"
+
+    - name: Rename backup files to include guest name
+      shell: |
+        latest_file=$(ls -t {{ backup_dir }}/vzdump-{{ item.type }}-{{ item.id }}-*.{{ compression }} | head -n 1)
+        new_file="{{ backup_dir }}/{{ item.name }}-{{ item.type }}-{{ item.id }}-{{ '%Y%m%d-%H%M%S' | strftime(ansible_date_time.epoch | int) }}.{{ compression }}"
+        cp "$latest_file" "$new_file"
+      args:
+        executable: /bin/bash
+      loop: "{{ guests }}"
+
+    - name: Prune old backups (keep last {{ maxfiles }})
+      shell: |
+        ls -tp {{ backup_dir }}/{{ item.name }}-{{ item.type }}-{{ item.id }}-*{{ compression }} | grep -v '/$' | tail -n +{{ maxfiles + 1 }} | xargs -r rm --
+      args:
+        executable: /bin/bash
+      loop: "{{ guests }}"

playbooks/update_pihole_blocklists.yml

@@ -0,0 +1,6 @@
+- name: Update Pi-hole blocklists
+  hosts: pihole
+  become: yes
+  tasks:
+    - name: Update gravity
+      command: pihole -g

playbooks/update_system.yml

@@ -0,0 +1,23 @@
+- name: Update and Upgrade Packages
+  hosts: all
+  become: yes
+  tasks:
+
+    - name: Get OS Family
+      ansible.builtin.setup:
+        gather_subset:
+          - "min"
+      register: system_info
+
+    - name: Update & Upgrade - Debian-based systems
+      ansible.builtin.apt:
+        update_cache: yes
+        upgrade: yes
+      when: system_info.ansible_facts.ansible_os_family == "Debian"
+
+    - name: Update & Upgrade - RHEL-based systems
+      ansible.builtin.yum:
+        name: "*"
+        state: latest
+      when: system_info.ansible_facts.ansible_os_family == "RedHat"
+