Nik Afiq
5a00f5767b
Stage 4 of REFACTOR_PLAN.md. - Merge ansible/ansible.cfg into root ansible.cfg (single source of truth); the dual-config setup silently broke documented commands and lost host_key_checking=False when run from the ansible/ directory. - Add ansible/requirements.yml pinning community.general, ansible.posix, community.docker -- previously undocumented deps of the glances/watch-party roles that would fail a fresh bootstrap. - Align K3s version to v1.32.4+k3s1 across roles/k3s-server, roles/k3s-agent, and host_vars/gpu-node.yaml defaults (was skewed: .2 vs .4). This only changes what a *future* provision installs -- minisforum/debian are still live on v1.32.2+k3s1 until separately upgraded. - Fix kubeconfig fetch/replace path mismatch in k3s-server role: the `fetch` task (flat: true) writes to ~/.kube/config, but `replace` was targeting a /tmp/k3s-minisforum.yaml nothing creates -- would break a fresh rebuild. - gitea-runner: only remove /run/docker.sock when it's actually a directory (task name implied a check that wasn't there); tighten registration-token systemd unit from 0644 to 0600. - nvidia: stop unconditionally reporting `changed` (and restarting Docker) on every run for an idempotent runtime-configure command. - Gate the K3s join-token debug print and WireGuard client-config/QR display behind opt-in vars (k3s_show_token, wireguard_show_client_configs), default off -- both were printing real secrets to console on every run. - Parameterize the docker role for Debian and Ubuntu; homeassistant now depends on it (meta/main.yaml) instead of duplicating a Debian-only Docker install inline. - FQCN cleanup across wireguard, homeassistant, and ollama roles/handlers (bare module names -> ansible.builtin.*/community.general.*/ansible.posix.*), plus a few ansible-lint name-casing/idiom fixes. Handler renames verified against their `notify:` call sites so notifications still fire. - Update ansible/README.md and root README.md: add gpu-node/gpu_workstation (4th host, previously undocumented), docker/nvidia roles, setup-gpu-node.yaml, homeassistant.yaml, requirements.yml install step; correct the "Legacy" homeassistant label (it's the only thing serving ha.home.arpa); correct the Gitea ingress/backup-storage doc-drift; flag the Grafana/Loki static-PV binding drift discovered via live cluster check. Verified: all playbooks pass `ansible-playbook --syntax-check`, yamllint clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
116 lines
3.3 KiB
YAML
116 lines
3.3 KiB
YAML
---
|
|
# Part of role: gitea-runner
|
|
# Called by: ansible/playbooks/setup-gitea-runner.yaml
|
|
# Description: Downloads, configures, and registers act_runner as a systemd service connected to the Gitea instance.
|
|
|
|
- name: Download act_runner binary
|
|
ansible.builtin.get_url:
|
|
url: https://gitea.com/gitea/act_runner/releases/download/v0.2.11/act_runner-0.2.11-linux-amd64
|
|
dest: /usr/local/bin/act_runner
|
|
mode: "0755"
|
|
become: true
|
|
|
|
- name: Create act_runner config directory
|
|
ansible.builtin.file:
|
|
path: /etc/act_runner
|
|
state: directory
|
|
mode: "0755"
|
|
become: true
|
|
|
|
- name: Write act_runner config
|
|
ansible.builtin.copy:
|
|
dest: /etc/act_runner/config.yaml
|
|
content: |
|
|
log:
|
|
level: info
|
|
runner:
|
|
fetch_timeout: 5s
|
|
fetch_interval: 2s
|
|
labels:
|
|
- "ubuntu-latest:host"
|
|
- "ubuntu-22.04:host"
|
|
container:
|
|
network: host
|
|
privileged: true
|
|
valid_volumes:
|
|
- "**"
|
|
host:
|
|
workdir_parent: /tmp/act-runner-work
|
|
mode: "0644"
|
|
become: true
|
|
|
|
- name: Install internal CA certificate
|
|
ansible.builtin.copy:
|
|
src: /etc/rancher/k3s/homelab-ca.crt
|
|
dest: /usr/local/share/ca-certificates/homelab-ca.crt
|
|
mode: "0644"
|
|
remote_src: true
|
|
become: true
|
|
|
|
- name: Update CA certificates
|
|
ansible.builtin.command: update-ca-certificates
|
|
become: true
|
|
changed_when: false
|
|
|
|
- name: Create act_runner systemd service
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/act_runner.service
|
|
content: |
|
|
[Unit]
|
|
Description=Gitea Actions Runner
|
|
After=network.target
|
|
|
|
[Service]
|
|
Environment=GITEA_INSTANCE_URL=https://gitea.nik4nao.com
|
|
Environment=GITEA_RUNNER_REGISTRATION_TOKEN={{ gitea_runner_token }}
|
|
Environment=GITEA_RUNNER_NAME=minisforum
|
|
Environment=SSL_CERT_FILE=/etc/ssl/certs/homelab-ca.pem
|
|
Environment=GIT_SSL_CAINFO=/etc/ssl/certs/homelab-ca.pem
|
|
ExecStartPre=/bin/sh -c 'if [ ! -f /etc/act_runner/.runner ]; then cp ~/.runner /etc/act_runner/.runner 2>/dev/null || act_runner register --no-interactive --config /etc/act_runner/config.yaml --instance $GITEA_INSTANCE_URL --token $GITEA_RUNNER_REGISTRATION_TOKEN --name $GITEA_RUNNER_NAME; fi'
|
|
ExecStart=/usr/local/bin/act_runner daemon --config /etc/act_runner/config.yaml
|
|
WorkingDirectory=/etc/act_runner
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
mode: "0600"
|
|
become: true
|
|
notify: Restart act_runner
|
|
|
|
- name: Copy runner registration file if exists
|
|
ansible.builtin.shell: |
|
|
if [ -f ~/.runner ] && [ ! -f /etc/act_runner/.runner ]; then
|
|
cp ~/.runner /etc/act_runner/.runner
|
|
fi
|
|
become: false
|
|
changed_when: false
|
|
|
|
- name: Check docker.sock type
|
|
ansible.builtin.stat:
|
|
path: /run/docker.sock
|
|
register: docker_sock_stat
|
|
become: true
|
|
|
|
- name: Remove docker.sock if it is a directory
|
|
ansible.builtin.file:
|
|
path: /run/docker.sock
|
|
state: absent
|
|
become: true
|
|
when: docker_sock_stat.stat.exists and docker_sock_stat.stat.isdir
|
|
|
|
- name: Enable and start Docker
|
|
ansible.builtin.systemd:
|
|
name: docker
|
|
enabled: true
|
|
state: started
|
|
become: true
|
|
|
|
- name: Enable and start act_runner
|
|
ansible.builtin.systemd:
|
|
name: act_runner
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
become: true
|