Archived
beatzaplentyandClaude Sonnet 4.6
f85c65870f
Consolidates nixos, docker, raspi, and debian-configuration into a single infrastructure-as-code repo. Includes: - ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi roles (converted from debian-configuration bash scripts) - terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub), Docker container catalog — migrated from docker/infrastructure/terraform/ - stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending git subtree population (see implementation plan) - docs/: internal MkDocs site with architecture, network topology, runbooks, and drift-detection guide; external sanitized site - scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh - CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change) - Pi-hole removed throughout — DNS is FreeIPA, DHCP is router See docs/internal/implementation-plan.md for the phased rollout after pushing to Gitea. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP
75 lines
2.3 KiB
YAML
75 lines
2.3 KiB
YAML
---
|
|
# raspberrypi/tasks/main.yml
|
|
# Post-IPA-enrollment setup for the Raspberry Pi edge node.
|
|
# Mirrors debian-configuration/raspberrypi/scripts/.
|
|
|
|
# ── IPA sudo ──────────────────────────────────────────────────────────────────
|
|
|
|
- name: Check IPA enrollment
|
|
ansible.builtin.stat:
|
|
path: /etc/ipa/default.conf
|
|
register: ipa_conf
|
|
tags: ipa
|
|
|
|
- name: Write IPA admins sudoers file
|
|
ansible.builtin.copy:
|
|
content: "%admins ALL=(ALL) NOPASSWD:ALL\n"
|
|
dest: /etc/sudoers.d/ipa-admins
|
|
mode: "0440"
|
|
validate: "visudo -cf %s"
|
|
when:
|
|
- raspberrypi_setup_ipa_sudo
|
|
- ipa_conf.stat.exists
|
|
tags: ipa
|
|
|
|
# ── Docker GID pinning ────────────────────────────────────────────────────────
|
|
|
|
- name: Check docker group GID
|
|
ansible.builtin.command:
|
|
cmd: "getent group docker"
|
|
register: docker_group
|
|
changed_when: false
|
|
failed_when: false
|
|
when: raspberrypi_pin_docker_gid
|
|
tags: docker
|
|
|
|
- name: Pin docker group GID to IPA docker-access GID
|
|
block:
|
|
- name: Stop docker service and socket
|
|
ansible.builtin.systemd:
|
|
name: "{{ item }}"
|
|
state: stopped
|
|
loop:
|
|
- docker.service
|
|
- docker.socket
|
|
|
|
- name: Remove stale docker socket
|
|
ansible.builtin.file:
|
|
path: /var/run/docker.sock
|
|
state: absent
|
|
|
|
- name: Reassign docker group GID (non-unique — SSSD already owns this GID)
|
|
ansible.builtin.command:
|
|
cmd: "groupmod --non-unique -g {{ docker_access_gid }} docker"
|
|
changed_when: true
|
|
|
|
- name: Start docker socket and service
|
|
ansible.builtin.systemd:
|
|
name: "{{ item }}"
|
|
state: started
|
|
loop:
|
|
- docker.socket
|
|
- docker.service
|
|
|
|
- name: Verify socket GID
|
|
ansible.builtin.command:
|
|
cmd: "stat -c '%g' /var/run/docker.sock"
|
|
register: socket_gid
|
|
changed_when: false
|
|
failed_when: socket_gid.stdout != docker_access_gid | string
|
|
when:
|
|
- raspberrypi_pin_docker_gid
|
|
- docker_group.rc == 0
|
|
- docker_group.stdout.split(':')[2] != docker_access_gid | string
|
|
tags: docker
|