Nik Afiq
5a00f5767b
Stage 4 of REFACTOR_PLAN.md. - Merge ansible/ansible.cfg into root ansible.cfg (single source of truth); the dual-config setup silently broke documented commands and lost host_key_checking=False when run from the ansible/ directory. - Add ansible/requirements.yml pinning community.general, ansible.posix, community.docker -- previously undocumented deps of the glances/watch-party roles that would fail a fresh bootstrap. - Align K3s version to v1.32.4+k3s1 across roles/k3s-server, roles/k3s-agent, and host_vars/gpu-node.yaml defaults (was skewed: .2 vs .4). This only changes what a *future* provision installs -- minisforum/debian are still live on v1.32.2+k3s1 until separately upgraded. - Fix kubeconfig fetch/replace path mismatch in k3s-server role: the `fetch` task (flat: true) writes to ~/.kube/config, but `replace` was targeting a /tmp/k3s-minisforum.yaml nothing creates -- would break a fresh rebuild. - gitea-runner: only remove /run/docker.sock when it's actually a directory (task name implied a check that wasn't there); tighten registration-token systemd unit from 0644 to 0600. - nvidia: stop unconditionally reporting `changed` (and restarting Docker) on every run for an idempotent runtime-configure command. - Gate the K3s join-token debug print and WireGuard client-config/QR display behind opt-in vars (k3s_show_token, wireguard_show_client_configs), default off -- both were printing real secrets to console on every run. - Parameterize the docker role for Debian and Ubuntu; homeassistant now depends on it (meta/main.yaml) instead of duplicating a Debian-only Docker install inline. - FQCN cleanup across wireguard, homeassistant, and ollama roles/handlers (bare module names -> ansible.builtin.*/community.general.*/ansible.posix.*), plus a few ansible-lint name-casing/idiom fixes. Handler renames verified against their `notify:` call sites so notifications still fire. - Update ansible/README.md and root README.md: add gpu-node/gpu_workstation (4th host, previously undocumented), docker/nvidia roles, setup-gpu-node.yaml, homeassistant.yaml, requirements.yml install step; correct the "Legacy" homeassistant label (it's the only thing serving ha.home.arpa); correct the Gitea ingress/backup-storage doc-drift; flag the Grafana/Loki static-PV binding drift discovered via live cluster check. Verified: all playbooks pass `ansible-playbook --syntax-check`, yamllint clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
74 lines
2.0 KiB
YAML
74 lines
2.0 KiB
YAML
---
|
|
# Part of role: k3s-server
|
|
# Called by: ansible/playbooks/setup-k3s.yaml
|
|
# Description: Installs K3s server, fetches kubeconfig, installs Helm, and labels the node as primary.
|
|
|
|
- name: Create K3s config directory
|
|
ansible.builtin.file:
|
|
path: /etc/rancher/k3s
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Write K3s server config
|
|
ansible.builtin.copy:
|
|
dest: /etc/rancher/k3s/config.yaml
|
|
content: "{{ k3s_server_config | to_nice_yaml }}"
|
|
mode: "0644"
|
|
|
|
- name: Download and install K3s
|
|
ansible.builtin.shell:
|
|
cmd: >
|
|
curl -sfL https://get.k3s.io |
|
|
INSTALL_K3S_VERSION={{ k3s_version }}
|
|
sh -
|
|
creates: /usr/local/bin/k3s
|
|
|
|
- name: Wait for K3s to be ready
|
|
ansible.builtin.wait_for:
|
|
path: /etc/rancher/k3s/k3s.yaml
|
|
timeout: 60
|
|
|
|
- name: Ensure K3s service is running
|
|
ansible.builtin.service:
|
|
name: k3s
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Read node token
|
|
ansible.builtin.slurp:
|
|
src: /var/lib/rancher/k3s/server/node-token
|
|
register: k3s_token_raw
|
|
|
|
- name: Save node token as fact
|
|
ansible.builtin.set_fact:
|
|
k3s_node_token: "{{ k3s_token_raw['content'] | b64decode | trim }}"
|
|
|
|
- name: Print node token
|
|
ansible.builtin.debug:
|
|
msg: "K3s node token: {{ k3s_node_token }}"
|
|
when: k3s_show_token | default(false)
|
|
|
|
- name: Fetch kubeconfig to workstation
|
|
ansible.builtin.fetch:
|
|
src: /etc/rancher/k3s/k3s.yaml
|
|
dest: ~/.kube/config
|
|
flat: true
|
|
|
|
- name: Fix kubeconfig server address
|
|
ansible.builtin.replace:
|
|
path: "{{ lookup('env', 'HOME') }}/.kube/config"
|
|
regexp: 'https://127\.0\.0\.1:6443'
|
|
replace: "https://{{ k3s_server_ip }}:6443"
|
|
delegate_to: localhost
|
|
become: false
|
|
|
|
- name: Install Helm
|
|
ansible.builtin.shell:
|
|
cmd: curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
|
creates: /usr/local/bin/helm
|
|
|
|
- name: Label server node as primary
|
|
ansible.builtin.command:
|
|
cmd: k3s kubectl label node minisforum node-role=primary --overwrite
|
|
changed_when: false
|