New structure

README.md

@@ -1 +1,10 @@
 Ansible playbooks
+
+
+$ cd /home/joachim/git/ansible-semaphore
+
+$ ansible-playbook setup1.yml -i hosts/hosts -u root
+
+$ ansible-playbook -i inventory/hetzner/dev/hosts playbooks/inital_setup_new_server.yml
+
+$ ansible-playbook -i inventory/homelab/hosts playbooks/jetson.yml

ansible.cfg

@@ -0,0 +1,40 @@
+[defaults]
+#nocolor = true
+remote_user = ansible
+ask_pass = false
+host_key_checking = false
+
+# set ansible log path
+log_path=/tmp/ansible.log
+
+# enable debugging
+#stdout_callback = debug
+
+forks = 50
+
+# transport = local
+# additional paths to search for roles in, colon separated
+#
+# !!! BITTE nicht den /ansible/.. Pfad wegnehmen, der wird fuer die container images benoetigt !!!
+roles_path    = ./roles:/ansible/roles
+library       = /ansible/library:/ansible/library/module_utils:./library
+
+#stdout_callback = yaml
+#callback_whitelist = timer, mail, ara
+
+#action_plugins     = /usr/share/ansible/plugins/action:/home/ansible/.local/lib/python3.6/site-packages/ara/plugins/action
+#callback_plugins   = /usr/share/ansible/plugins/callback:/home/ansible/.local/lib/python3.6/site-packages/ara/plugins/callback
+#lookup_plugins     = /usr/share/ansible/plugins/lookup:/home/ansible/.local/lib/python3.6/site-packages/ara/plugins/lookup
+#
+# or
+#
+# export ANSIBLE_CALLBACK_PLUGINS=$(python3 -m ara.setup.callback_plugins)
+# Set up the ARA callback to know where the API server is located
+#export ARA_API_CLIENT="http"
+#export ARA_API_SERVER="http://127.0.0.1:8000"
+#export ARA_API_USERNAME=ansible
+#export ARA_API_PASSWORD=
+
+[ssh_connection]
+pipelining = True
+#ssh_args = -o ControlMaster=auto -o ControlPersist=1200

inventory/hetzner/dev/hosts

@@ -0,0 +1,53 @@
+# This is the default ansible 'hosts' file.
+#
+# It should live in /etc/ansible/hosts
+#
+#   - Comments begin with the '#' character
+#   - Blank lines are ignored
+#   - Groups of hosts are delimited by [header] elements
+#   - You can enter hostnames or ip addresses
+#   - A hostname/ip can be a member of multiple groups
+
+# Ex 1: Ungrouped hosts, specify before any group headers.
+
+
+#[servers]
+#server1 ansible_host=192.168.10.147
+#server2 ansible_host=192.168.10.97
+#server3 ansible_host=192.168.10.89
+
+#green.example.com
+#blue.example.com
+#192.168.100.1
+#192.168.100.10
+
+# Ex 2: A collection of hosts belonging to the 'webservers' group
+
+#[webservers]
+#alpha.example.org
+#beta.example.org
+#192.168.1.100
+#192.168.1.110
+
+# If you have multiple hosts following a pattern you can specify
+# them like this:
+
+#www[001:006].example.com
+
+# Ex 3: A collection of database servers in the 'dbservers' group
+
+#[dbservers]
+#
+#db01.intranet.mydomain.net
+#db02.intranet.mydomain.net
+#10.25.1.56
+#10.25.1.57
+
+# Here's another example of host ranges, this time there are no
+# leading 0s:
+
+#db-[99:101]-node.example.com
+
+
+[new]
+server1 ansible_host=65.108.82.143

inventory/homelab/hosts

@@ -0,0 +1,14 @@
+[all]
+server1 ansible_ssh_host=192.168.10.7
+server2 ansible_ssh_host=192.168.10.58
+
+[gitea]
+server1 ansible_ssh_host=192.168.1.1
+server2 ansible_ssh_host=192.168.1.2
+
+[jetson]
+server1 ansible_ssh_host=192.168.10.155
+
+[docker]
+server1 ansible_ssh_host=192.168.10.155
+

playbooks/gitea.yml

@@ -3,25 +3,30 @@
   become: true
   become_user: root
   tasks:
-    - name: Stop service gitea on debian, if running
+    - name: gitea.yml | Stop service gitea on debian, if running
       ansible.builtin.systemd:
         name: gitea
         state: stopped
 
-    - name: Download newest gitea binary
+    - name: gitea.yml | Download newest gitea binary
       ansible.builtin.get_url:
         url: "{{ var_gitea_url }}"
         dest: /tmp/gitea
         mode: '0511'
 
-    - name: Copy file with owner and permissions
+    - name: gitea.yml | Copy file with owner and permissions
       ansible.builtin.copy:
         src: /tmp/gitea
         dest: /usr/local/bin/gitea
         mode: '0511'
         remote_src: yes
 
-    - name: Start service gitea on debian, if not running
+    - name: gitea.yml | Start service gitea on debian, if not running
       ansible.builtin.systemd:
         name: gitea
         state: started
+
+    - name: gitea.yml | clean and remove /tmp directory
+      ansible.builtin.file:
+        path: /tmp/gitea
+        state: absent

playbooks/inital_setup_new_server.yml

@@ -0,0 +1,99 @@
+- hosts: new
+  vars:
+    ansible_host_key_checking: false ##If you get an error about hosts not trusted
+  become_user: root
+  become: yes
+  tasks:
+    - name: Update apt repo and cache on all Debian/Ubuntu boxes
+      apt: update_cache=yes force_apt_get=yes cache_valid_time=3600
+
+    - name: Upgrade all packages on servers
+      apt: upgrade=dist force_apt_get=yes
+
+    - name: Check if a reboot is needed on all servers
+      register: reboot_required_file
+      stat: path=/var/run/reboot-required get_md5=no
+
+    - name: Reboot the box if kernel updated
+      reboot:
+        msg: "Reboot initiated by Ansible for kernel updates"
+        connect_timeout: 5
+        reboot_timeout: 300
+        pre_reboot_delay: 0
+        post_reboot_delay: 30
+        test_command: uptime
+      when: reboot_required_file.stat.exists
+
+    - name: Add the user 'joachim' with a specific uid and a primary group of 'admin'
+      ansible.builtin.user:
+        name: joachim
+        shell: /bin/bash
+        comment: Joachim Hummel
+        createhome: yes
+        uid: 1000
+        group: sudo
+
+
+    - name: Add the user 'sysadmin' with a specific uid and a primary group of 'admin'
+      ansible.builtin.user:
+        name: sysadmin42
+        shell: /bin/bash
+        comment: Ansible Sysadmin42 
+        createhome: yes
+        uid: 1010
+        group: sudo
+
+    - name: Set authorized key for remote user joachim
+      ansible.posix.authorized_key:
+        user: joachim 
+        state: present
+        key: "{{ lookup('url', 'https://git.homeabc.de/jhummel/ansible-semaphore/raw/branch/master/keys/id_rsa.joachim', split_lines=False) }}" 
+
+    - name: Set authorized key for remote user sysadmin42
+      ansible.posix.authorized_key:
+        user: sysadmin42
+        state: present
+        key: "{{ lookup('url', 'https://git.homeabc.de/jhummel/ansible-semaphore/raw/branch/master/keys/id_rsa.semphore', split_lines=False) }}" 
+
+    - name: Disable password authentication for root
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        state: present
+        regexp: '^#?PermitRootLogin'
+        line: 'PermitRootLogin prohibit-password'
+
+    - name: Update apt and install required system packages
+      apt:
+        pkg:
+          - curl
+          - vim
+          - git
+          - ufw
+          - fail2ban
+          - apache2
+        state: latest
+        update_cache: true
+
+    - name: UFW - Allow SSH connections
+      community.general.ufw:
+        rule: allow
+        name: OpenSSH
+
+
+    - name: UFW - Allow HTTP connections
+      community.general.ufw:
+        rule: allow
+        port: 80
+        proto: tcp
+
+    - name: UFW - Allow HTTPS connections
+      community.general.ufw:
+        rule: allow
+        port: 443
+        proto: tcp
+
+    - name: UFW - Enable and deny by default
+      community.general.ufw:
+        state: enabled
+        default: deny
+

playbooks/install-docker.yml

@@ -0,0 +1,17 @@
+---
+- hosts: docker
+  become: true
+  become_user: root
+  tasks:
+    - name: install-docker.yml | Stop service gitea on debian, if running
+      ansible.builtin.systemd:
+        name: gitea
+        state: stopped
+
+    - name: gitea.yml | Download newest gitea binary
+      ansible.builtin.get_url:
+        url: "{{ var_gitea_url }}"
+        dest: /tmp/gitea
+        mode: '0511'
+
+

playbooks/jetson.yml

@@ -0,0 +1,8 @@
+---
+- name: Ansible Playbook for Jetson and Docker
+  hosts: jetson
+  become: true
+
+  roles:
+    - jetson
+

roles/docker/.travis.yml

@@ -0,0 +1,29 @@
+---
+language: python
+python: "2.7"
+
+# Use the new container infrastructure
+sudo: false
+
+# Install ansible
+addons:
+  apt:
+    packages:
+    - python-pip
+
+install:
+  # Install ansible
+  - pip install ansible
+
+  # Check ansible version
+  - ansible --version
+
+  # Create ansible.cfg with correct roles_path
+  - printf '[defaults]\nroles_path=../' >ansible.cfg
+
+script:
+  # Basic role syntax check
+  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

roles/docker/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/docker/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for docker

roles/docker/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for docker

roles/docker/meta/main.yml

@@ -0,0 +1,52 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.1
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

roles/docker/tasks/main.yml

@@ -0,0 +1,2 @@
+---
+# tasks file for docker

roles/docker/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

roles/docker/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - docker

roles/docker/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for docker

roles/jetson/.travis.yml

@@ -0,0 +1,29 @@
+---
+language: python
+python: "2.7"
+
+# Use the new container infrastructure
+sudo: false
+
+# Install ansible
+addons:
+  apt:
+    packages:
+    - python-pip
+
+install:
+  # Install ansible
+  - pip install ansible
+
+  # Check ansible version
+  - ansible --version
+
+  # Create ansible.cfg with correct roles_path
+  - printf '[defaults]\nroles_path=../' >ansible.cfg
+
+script:
+  # Basic role syntax check
+  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

roles/jetson/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/jetson/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for jetson

roles/jetson/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for jetson

roles/jetson/meta/main.yml

@@ -0,0 +1,52 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.1
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

roles/jetson/tasks/main.yml

@@ -0,0 +1,57 @@
+---
+# tasks file for jetson
+
+- name: jetson.yml -  Copy docker.tar
+  ansible.builtin.copy:
+    src: files/docker.tar
+    dest: /home/joachim/docker
+    owner: joachim
+    group: joachim
+
+- name: jetson.yml - Unarchive docker.tar that is already on the remote machine
+  ansible.builtin.unarchive:
+    src: /home/joachim/docker/docker.tar
+    dest: /home/joachim/docker
+    remote_src: yes
+
+- name: jetson.yml - Remove file docker.tar 
+  ansible.builtin.file:
+    path: /home/joachim/docker/docker.tar
+    state: absent
+
+- name: Deploy docker compose Flightradar24
+  docker_compose:
+    project_src: /home/joachim/docker/fr24feed
+    files:
+    - docker-compose.yml
+
+- name: Deploy docker compose ChatGPT
+  docker_compose:
+    project_src: /home/joachim/docker/chatgpt
+    files:
+    - docker-compose.yml
+
+- name: Deploy docker compose restreamer
+  docker_compose:
+    project_src: /home/joachim/docker/restreamer
+    files:
+    - docker-compose.yml
+
+- name: Deploy docker compose watchtower
+  docker_compose:
+    project_src: /home/joachim/docker/watchtower
+    files:
+    - docker-compose.yml
+
+- name: Deploy docker compose portainer
+  docker_compose:
+    project_src: /home/joachim/docker/portainer
+    files:
+    - docker-compose.yml
+
+- name: Deploy docker compose apache2
+  docker_compose:
+    project_src: /home/joachim/docker/apache2
+    files:
+    - docker-compose.yml
+

roles/jetson/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

roles/jetson/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - jetson

roles/jetson/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for jetson

roles/linux/.travis.yml

@@ -0,0 +1,29 @@
+---
+language: python
+python: "2.7"
+
+# Use the new container infrastructure
+sudo: false
+
+# Install ansible
+addons:
+  apt:
+    packages:
+    - python-pip
+
+install:
+  # Install ansible
+  - pip install ansible
+
+  # Check ansible version
+  - ansible --version
+
+  # Create ansible.cfg with correct roles_path
+  - printf '[defaults]\nroles_path=../' >ansible.cfg
+
+script:
+  # Basic role syntax check
+  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

roles/linux/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/linux/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for linux

roles/linux/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for linux

roles/linux/meta/main.yml

@@ -0,0 +1,52 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.1
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

roles/linux/tasks/main.yml

@@ -0,0 +1,2 @@
+---
+# tasks file for linux

roles/linux/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

roles/linux/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - linux

roles/linux/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for linux