Bradley/Random_Ansible_Stuff
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

The beginnings of a backup solution

Browse Source
This commit is contained in:
Bradley Bickford 2025-08-17 21:01:27 -04:00
parent d9262852c8
commit 686543a1b9
14 changed files with 501 additions and 251 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.vscode/settings.json vendored
View File

@ -1,3 +1,3 @@
{
"ansible.python.interpreterPath": "c:\\Program Files\\Python312\\python.exe"
{
"ansible.python.interpreterPath": "c:\\Program Files\\Python312\\python.exe"
}

4
ansible.cfg
View File

@ -1,2 +1,2 @@
[defaults]
host_key_checking = false
[defaults]
host_key_checking = false

42
inventories/core_infrastructure.yml Normal file
View File

@ -0,0 +1,42 @@
---
all:
hosts:
blacktide:
ansible_host: "192.168.3.2"
connection: "local"
web:
ansible_host: "10.26.48.3"
docker_backup:
- container_name: http-test
directories_to_backup:
- /var/www/html
backup_dir: /backup
backup_name_prefix: http-test
max_backups_kept: 5
database:
ansible_host: "10.12.34.3"
publicworks:
ansible_host: "10.77.7.3"
dmz:
ansible_host: "172.16.132.4"
games:
ansible_host: "10.20.24.3"
nfsserver:
ansible_host: "10.42.0.3"
openocean:
ansible_host: "172.16.132.2"
boardwalk:
ansible_host: "10.77.7.2"
children:
docker_nodes:
hosts:
web:
database:
publicworks:
dmz:
games:
pfsense_nodes:
hosts:
openocean:
boardwalk:

18
inventories/kubernetes
View File

@ -1,9 +1,9 @@
[masters]
kubemaster ansible_host=10.20.24.4 master=true
[workers]
kubeworker1 ansible_host=10.20.24.5 worker=true
kubeworker2 ansible_host=10.20.24.6 worker=true
[ansible_nodes]
ansible ansible_host=10.20.24.3 connection=local
[masters]
kubemaster ansible_host=10.20.24.4 master=true
[workers]
kubeworker1 ansible_host=10.20.24.5 worker=true
kubeworker2 ansible_host=10.20.24.6 worker=true
[ansible_nodes]
ansible ansible_host=10.20.24.3 connection=local

BIN
playbooks/.IaC_database.yml.swp
View File

Binary file not shown.

62
playbooks/backup_protocol.yml Normal file
View File

@ -0,0 +1,62 @@
---
- name: Backup Protocol
hosts: all
become: true
become_method: sudo
collections:
- community.docker
- community.general
vars:
env_backups_to_keep: 10
tasks:
- name: Run container mounts backup
ansible.builtin.import_role:
name: docker_backup
vars:
backup_rules: "{{ item }}"
when: docker_backup is defined and docker_backup | length != 0
loop: "{{ docker_backup }}"
- name: Stat the /root/infrastructure-compose folder
ansible.builtin.stat:
path: "/root/infrastructure-compose"
register: infra_compose_stat
- name: Find all .env files
ansible.builtin.find:
paths: "/root/infrastructure-compose"
patterns: ".*.env"
when: infra_compose_stat.stat.exists
register: all_env_files
- name: .env Backup block
when: infra_compose_stat.stat.exists and all_env_files.files is defined and all_env_files.files | length != 0
block:
- name: Archive .env files
community.general.archive:
path: "{{ all_env_files.files }}"
dest: >-
/backup/env/{{ inventory_hostname }}_{{ now().strftime("%Y%m%d%H%M%S") }}.tar.gz
format: gz
force_archive: true
- name: Find all .env backup files for the current host
ansible.builtin.find:
paths: "/backup/env"
patterns: "{{ inventory_hostname }}*"
register: backup_env_files
- name: If too many backups kept
when: backup_env_files.files | length > env_backups_to_keep
block:
- name: Get the oldest file paths
ansible.builtin.set_fact:
oldest_file_paths: >-
{{ (backup_env_files.files | sort(attribute='mtime'))[:backup_env_files.files | length - env_backups_to_keep] |
map(attribute=path) | list }}
- name: Remove the files
ansible.builtin.file:
path: "{{ item }}"
state: absent
loop: "{{ oldest_file_paths }}"

152
playbooks/fedora_configure_node_for_k8s.yml
View File

@ -1,76 +1,76 @@
---
- hosts: masters,workers
become: true
become_method: sudo
become_user: root
tasks:
- name: Update grub config to remove zram generation
ansible.builtin.shell:
cmd: grubby --update-kernel ALL --args='systemd.zram=0'
- name: Update grub config
ansible.builtin.shell:
cmd: grub2-mkconfig -o /boot/grub2/grub.cfg
- name: Reboot the system to get rid of the zram swap that's already been set up
ansible.builtin.reboot:
reboot_timeout: 900
- name: Set SELinux to Permissive
ansible.posix.selinux:
state: disabled
- name: Disable firewalld
ansible.builtin.service:
name: firewalld
enabled: false
state: stopped
- name: Install iptables components
ansible.builtin.yum:
name:
- iptables
- iproute-tc
state: present
- name: Add overlay modprobe module
community.general.modprobe:
name: overlay
persistent: present
state: present
- name: Add br_netfilter module
community.general.modprobe:
name: br_netfilter
persistent: present
state: present
- name: Create network settings configuration file
ansible.builtin.blockinfile:
path: "/etc/sysctl.d/99-kubernetes-cri.conf"
block: |
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-ip6tables = 1
create: true
- name: Apply new sysctl settings
ansible.builtin.shell:
cmd: sysctl --system
changed_when: false
- name: Install cri-o and kubernetes
ansible.builtin.yum:
name:
- cri-o
- containernetworking-plugins
- kubernetes
- kubernetes-kubeadm
- kubernetes-client
state: present
- name: Enable and start cri-o
ansible.builtin.service:
name: crio
enabled: true
state: started
---
- hosts: masters,workers
become: true
become_method: sudo
become_user: root
tasks:
- name: Update grub config to remove zram generation
ansible.builtin.shell:
cmd: grubby --update-kernel ALL --args='systemd.zram=0'
- name: Update grub config
ansible.builtin.shell:
cmd: grub2-mkconfig -o /boot/grub2/grub.cfg
- name: Reboot the system to get rid of the zram swap that's already been set up
ansible.builtin.reboot:
reboot_timeout: 900
- name: Set SELinux to Permissive
ansible.posix.selinux:
state: disabled
- name: Disable firewalld
ansible.builtin.service:
name: firewalld
enabled: false
state: stopped
- name: Install iptables components
ansible.builtin.yum:
name:
- iptables
- iproute-tc
state: present
- name: Add overlay modprobe module
community.general.modprobe:
name: overlay
persistent: present
state: present
- name: Add br_netfilter module
community.general.modprobe:
name: br_netfilter
persistent: present
state: present
- name: Create network settings configuration file
ansible.builtin.blockinfile:
path: "/etc/sysctl.d/99-kubernetes-cri.conf"
block: |
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-ip6tables = 1
create: true
- name: Apply new sysctl settings
ansible.builtin.shell:
cmd: sysctl --system
changed_when: false
- name: Install cri-o and kubernetes
ansible.builtin.yum:
name:
- cri-o
- containernetworking-plugins
- kubernetes
- kubernetes-kubeadm
- kubernetes-client
state: present
- name: Enable and start cri-o
ansible.builtin.service:
name: crio
enabled: true
state: started

62
playbooks/make_ansible_user.yml
View File

@ -1,31 +1,31 @@
---
- hosts: all
become: true
become_method: su
become_user: root
tasks:
- name: Create the ansible user
ansible.builtin.user:
name: ansible
append: true
state: present
createhome: true
shell: /bin/bash
- name: Make sure the sudoers dropin directory exists
ansible.builtin.file:
path: "/etc/sudoers.d"
state: directory
- name: Create a sudoers file for the ansible user
ansible.builtin.lineinfile:
path: "/etc/sudoers.d/50-ansible"
line: "ansible ALL=(ALL) NOPASSWD: ALL"
create: true
validate: "visudo -cf %s"
- name: Add authorized key for ansible user
ansible.builtin.authorized_key:
user: ansible
key: "{{ lookup('ansible.builtin.file', '/home/ansible/.ssh/id_rsa.pub') }}"
---
- hosts: all
become: true
become_method: su
become_user: root
tasks:
- name: Create the ansible user
ansible.builtin.user:
name: ansible
append: true
state: present
createhome: true
shell: /bin/bash
- name: Make sure the sudoers dropin directory exists
ansible.builtin.file:
path: "/etc/sudoers.d"
state: directory
- name: Create a sudoers file for the ansible user
ansible.builtin.lineinfile:
path: "/etc/sudoers.d/50-ansible"
line: "ansible ALL=(ALL) NOPASSWD: ALL"
create: true
validate: "visudo -cf %s"
- name: Add authorized key for ansible user
ansible.builtin.authorized_key:
user: ansible
key: "{{ lookup('ansible.builtin.file', '/home/ansible/.ssh/id_rsa.pub') }}"

32
playbooks/patch.yml
View File

@ -1,16 +1,16 @@
---
- hosts: all
become: true
become_method: sudo
become_user: root
tasks:
- name: Update all packages
ansible.builtin.yum:
name: "*"
state: latest
async: 3600
poll: 60
- name: Reboot Node
ansible.builtin.reboot:
reboot_timeout: 1800
---
- hosts: all
become: true
become_method: sudo
become_user: root
tasks:
- name: Update all packages
ansible.builtin.yum:
name: "*"
state: latest
async: 3600
poll: 60
- name: Reboot Node
ansible.builtin.reboot:
reboot_timeout: 1800

230
playbooks/rocky_configure_node_for_k8s.yml
View File

@ -1,116 +1,116 @@
---
- hosts: masters,workers
become: yes
become_method: sudo
become_user: root
tasks:
- name: Add overlay modprobe module
community.general.modprobe:
name: overlay
persistent: present
state: present
- name: Add br_netfilter module
community.general.modprobe:
name: br_netfilter
persistent: present
state: present
- name: Set SELinux to Permissive
ansible.posix.selinux:
state: permissive
- name: Set firewalld configuration | Master Nodes
ansible.posix.firewalld:
port: "{{ item }}"
permanent: true
state: enabled
loop:
- "6443/tcp"
- "2379-2380/tcp"
- "10250/tcp"
- "10251/tcp"
- "10259/tcp"
- "10257/tcp"
- "179/tcp"
- "4789/udp"
when: master | default(false)
- name: Set firewalld configuration | Worker Nodes
ansible.posix.firewalld:
port: "{{ item }}"
permanent: true
state: enabled
loop:
- "179/tcp"
- "10250/tcp"
- "30000-32767/tcp"
- "4789/udp"
when: worker | default(false)
- name: Create network settings configuration file
ansible.builtin.blockinfile:
path: "/etc/sysctl.d/99-kubernetes-cri.conf"
block: |
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-ip6tables = 1
create: true
- name: Apply new sysctl settings
ansible.builtin.shell:
cmd: sysctl --system
changed_when: false
- name: Add docker repo
ansible.builtin.shell:
cmd: dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
changed_when: false
- name: Install containerd
ansible.builtin.yum:
name: containerd.io
state: present
- name: Build default containerd config
ansible.builtin.shell:
cmd: set -o pipefail && mkdir -p /etc/containerd && containerd config default | tee /etc/containerd/config.toml
changed_when: false
- name: Restart containerd
ansible.builtin.service:
name: containerd
state: restarted
enabled: true
- name: Create Kubernetes repo
ansible.builtin.blockinfile:
path: "/etc/yum.repos.d/kubernetes.repo"
create: true
block: |
[kubernetes]
name=Kubernetes
baseurl=https://pkgs.k8s.io/core:/stable:/v1.31/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/core:/stable:/v1.31/rpm/repodata/repomd.xml.key
exclude=kubelet kubeadm kubectl cri-tools kubernetes-cni
- name: Install Kubernetes components
ansible.builtin.yum:
name:
- kubelet
- kubeadm
- kubectl
state: present
disable_excludes: all
- name: Disable running swap
ansible.builtin.shell:
cmd: swapoff -a
changed_when: false
- name: Disable swap in fstab
ansible.builtin.shell:
cmd: sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
---
- hosts: masters,workers
become: yes
become_method: sudo
become_user: root
tasks:
- name: Add overlay modprobe module
community.general.modprobe:
name: overlay
persistent: present
state: present
- name: Add br_netfilter module
community.general.modprobe:
name: br_netfilter
persistent: present
state: present
- name: Set SELinux to Permissive
ansible.posix.selinux:
state: permissive
- name: Set firewalld configuration | Master Nodes
ansible.posix.firewalld:
port: "{{ item }}"
permanent: true
state: enabled
loop:
- "6443/tcp"
- "2379-2380/tcp"
- "10250/tcp"
- "10251/tcp"
- "10259/tcp"
- "10257/tcp"
- "179/tcp"
- "4789/udp"
when: master | default(false)
- name: Set firewalld configuration | Worker Nodes
ansible.posix.firewalld:
port: "{{ item }}"
permanent: true
state: enabled
loop:
- "179/tcp"
- "10250/tcp"
- "30000-32767/tcp"
- "4789/udp"
when: worker | default(false)
- name: Create network settings configuration file
ansible.builtin.blockinfile:
path: "/etc/sysctl.d/99-kubernetes-cri.conf"
block: |
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-ip6tables = 1
create: true
- name: Apply new sysctl settings
ansible.builtin.shell:
cmd: sysctl --system
changed_when: false
- name: Add docker repo
ansible.builtin.shell:
cmd: dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
changed_when: false
- name: Install containerd
ansible.builtin.yum:
name: containerd.io
state: present
- name: Build default containerd config
ansible.builtin.shell:
cmd: set -o pipefail && mkdir -p /etc/containerd && containerd config default | tee /etc/containerd/config.toml
changed_when: false
- name: Restart containerd
ansible.builtin.service:
name: containerd
state: restarted
enabled: true
- name: Create Kubernetes repo
ansible.builtin.blockinfile:
path: "/etc/yum.repos.d/kubernetes.repo"
create: true
block: |
[kubernetes]
name=Kubernetes
baseurl=https://pkgs.k8s.io/core:/stable:/v1.31/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/core:/stable:/v1.31/rpm/repodata/repomd.xml.key
exclude=kubelet kubeadm kubectl cri-tools kubernetes-cni
- name: Install Kubernetes components
ansible.builtin.yum:
name:
- kubelet
- kubeadm
- kubectl
state: present
disable_excludes: all
- name: Disable running swap
ansible.builtin.shell:
cmd: swapoff -a
changed_when: false
- name: Disable swap in fstab
ansible.builtin.shell:
cmd: sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
changed_when: false

38
playbooks/roles/docker_backup/README.md Normal file
View File

@ -0,0 +1,38 @@
Role Name
=========
A brief description of the role goes here.
Requirements
------------
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
Role Variables
--------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
Dependencies
------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License
-------
BSD
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).

2
playbooks/roles/docker_backup/defaults/main.yml Normal file
View File

@ -0,0 +1,2 @@
---
backup_rules: ""

52
playbooks/roles/docker_backup/meta/main.yml Normal file
View File

@ -0,0 +1,52 @@
galaxy_info:
author: your name
description: your role description
company: your company (optional)
# If the issue tracker for your role is not on github, uncomment the
# next line and provide a value
# issue_tracker_url: http://example.com/issue/tracker
# Choose a valid license ID from https://spdx.org - some suggested licenses:
# - BSD-3-Clause (default)
# - MIT
# - GPL-2.0-or-later
# - GPL-3.0-only
# - Apache-2.0
# - CC-BY-4.0
license: license (GPL-2.0-or-later, MIT, etc)
min_ansible_version: 2.1
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
#
# Provide a list of supported platforms, and for each platform a list of versions.
# If you don't wish to enumerate all versions for a particular platform, use 'all'.
# To view available platforms and versions (or releases), visit:
# https://galaxy.ansible.com/api/v1/platforms/
#
# platforms:
# - name: Fedora
# versions:
# - all
# - 25
# - name: SomePlatform
# versions:
# - all
# - 1.0
# - 7
# - 99.99
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
# if you add dependencies to this list.

54
playbooks/roles/docker_backup/tasks/main.yml Normal file
View File

@ -0,0 +1,54 @@
---
- name: Ensure backup rules contains the necessary fields
ansible.builtin.fail:
msg: "You must define {{ item }} in the backup ruleset"
when: not backup_rules[item] is defined
loop:
- container_name
- directories_to_backup
- backup_dir
- backup_name_prefix
- max_backups_kept
- name: Stop the running container
community.docker.docker_container:
name: "{{ backup_rules.container_name }}"
state: stopped
- name: Archive necessary directories
community.general.archive:
path: "{{ backup_rules.directories_to_backup }}"
dest: >-
{{ backup_rules.backup_dir }}/{{ backup_rules.backup_name_prefix }}_
{{ now().strftime("%Y%m%d%H%M%S") }}.tar.gz
format: gz
async: 3600
poll: 60
- name: Start the stopped container
community.docker.docker_container:
name: "{{ backup_rules.container_name }}"
state: started
- name: Find all files that start with the backup_name_prefix
ansible.builtin.find:
paths: "{{ backup_rules.backup_dir }}"
patterns: "{{ backup_rules.backup_name_prefix }}*"
register: all_backup_files
- name: If too many backups kept
when: all_backup_files.files | length > backup_rules.max_backups_kept
block:
- name: Get the oldest file paths
ansible.builtin.set_fact:
oldest_file_paths: >-
{{ (all_backup_files.files | sort(attribute='mtime'))[:all_backup_files.files | length - backup_rules.max_backups_kept] |
map(attribute=path) | list }}
- name: Remove the files
ansible.builtin.file:
path: "{{ item }}"
state: absent
loop: "{{ oldest_file_paths }}"