Removing Immich from backups

inventories/church.yml

@@ -0,0 +1,12 @@
+---
+all:
+  hosts:
+    vestrytv:
+      ansible_host: "192.168.1.200"
+      connection: "local"
+    sanctuarytvs:
+      ansible_host: "192.168.1.201"
+  children:
+    docker_nodes:
+      hosts:
+        vestrytv:  

inventories/core_infrastructure

@@ -1,13 +0,0 @@
-[ansible_nodes]
-blacktide ansible_host=192.168.3.2 connection=local
-
-[podman_nodes]
-arcade ansible_host=10.20.24.3
-beachpolice ansible_host=10.42.0.3
-bulletinboard ansible_host=10.26.48.3
-lifeguard ansible_host=172.16.132.4
-beachsidelibrary ansible_host=10.12.34.3
-
-[pfsense_nodes]
-openocean ansible_host=172.16.132.2
-boardwalk ansible_host=10.77.7.2

inventories/core_infrastructure.yml

@@ -0,0 +1,151 @@
+---
+all:
+  hosts:
+    blacktide:
+      ansible_host: "192.168.3.2"
+      connection: "local"
+    web:
+      ansible_host: "10.26.48.3"
+      docker_backup:
+        - container_name: http-test
+          directories_to_backup:
+            - /var/www/html
+          backup_dir: /backup/httptest
+          backup_name_prefix: http-test
+          max_backups_kept: 3
+        - container_name: gitea
+          directories_to_backup:
+            - /gitea
+          backup_dir: /backup/gitea
+          backup_name_prefix: gitea
+          max_backups_kept: 3
+        - container_name: infrastructure-compose-web_recipes-1
+          directories_to_backup:
+            - /tandoor
+          backup_dir: /backup/tandoor
+          backup_name_prefix: tandoor
+          max_backups_kept: 3
+    database:
+      ansible_host: "10.12.34.3"
+    publicworks:
+      ansible_host: "10.77.7.3"
+    dmz:
+      ansible_host: "172.16.132.4"
+      docker_backup:
+        - container_name: infrastructure-compose-velocity-1
+          directories_to_backup:
+            - /velocity
+          backup_dir: /backup/velocity
+          backup_name_prefix: velocity
+          max_backups_kept: 3
+        - container_name: infrastructure-compose-bedrockconnect-1
+          directories_to_backup:
+            - /root/bedrockconnect/custom_servers.json
+          backup_dir: /backup/bedrockconnect
+          backup_name_prefix: bedrockconnect
+          max_backups_kept: 3
+    games:
+      ansible_host: "10.20.24.3"
+      docker_backup:
+        - container_name: infrastructure-compose-team2648mc-1
+          directories_to_backup:
+            - /minecraft_team2648mc/superflat
+            - /minecraft_team2648mc/world
+            - /minecraft_team2648mc/server.properties
+            - /minecraft_team2648mc/config/paper-global.yml
+            - /minecraft_team2648mc/whitelist.json
+            - /minecraft_team2648mc/plugins/CatchBall
+            - /minecraft_team2648mc/plugins/ChestShop
+            - /minecraft_team2648mc/plugins/CoreProtect/config.yml
+            - /minecraft_team2648mc/plugins/dynmap/configuration.txt
+            - /minecraft_team2648mc/plugins/EconomyShopGUI
+            - /minecraft_team2648mc/plugins/GriefPreventionData
+            - /minecraft_team2648mc/plugins/HuskHomes
+            - /minecraft_team2648mc/plugins/LuckPerms
+            - /minecraft_team2648mc/plugins/mcMMO/config.yml
+            - /minecraft_team2648mc/plugins/Multiverse-Core
+            - /minecraft_team2648mc/plugins/Multiverse-Portals
+            - /minecraft_team2648mc/plugins/PlayerPoints
+            - /minecraft_team2648mc/plugins/SkinsRestorer
+            - /minecraft_team2648mc/plugins/Vault
+          backup_dir: /backup/minecraft
+          backup_name_prefix: team2648mc
+          max_backups_kept: 3
+        - container_name: infrastructure-compose-caleysmc-1
+          directories_to_backup:
+            - /minecraft_caleysmc/world
+            - /minecraft_caleysmc/server.properties
+            - /minecraft_caleysmc/config/paper-global.yml
+            - /minecraft_caleysmc/whitelist.json
+            - /minecraft_caleysmc/plugins/CatchBall
+            - /minecraft_caleysmc/plugins/ChestShop
+            - /minecraft_caleysmc/plugins/CoreProtect/config.yml
+            - /minecraft_caleysmc/plugins/dynmap/configuration.txt
+            - /minecraft_caleysmc/plugins/EconomyShopGUI
+            - /minecraft_caleysmc/plugins/GriefPreventionData
+            - /minecraft_caleysmc/plugins/HuskHomes
+            - /minecraft_caleysmc/plugins/LuckPerms
+            - /minecraft_caleysmc/plugins/mcMMO/config.yml
+            - /minecraft_caleysmc/plugins/Multiverse-Core
+            - /minecraft_caleysmc/plugins/Multiverse-Portals
+            - /minecraft_caleysmc/plugins/PlayerPoints
+            - /minecraft_caleysmc/plugins/SkinsRestorer
+            - /minecraft_caleysmc/plugins/Vault
+          backup_dir: /backup/minecraft
+          backup_name_prefix: caleysmc
+          max_backups_kept: 3
+        - container_name: infrastructure-compose-thespacebetween-1
+          directories_to_backup:
+            - /minecraft_caleysmc/world
+            - /minecraft_caleysmc/server.properties
+            - /minecraft_caleysmc/config/paper-global.yml
+            - /minecraft_caleysmc/whitelist.json
+            - /minecraft_caleysmc/plugins/SkinsRestorer
+          backup_dir: /backup/minecraft
+          backup_name_prefix: thespacebetween
+          max_backups_kept: 3
+    nfsserver:
+      ansible_host: "10.42.0.3"
+    openocean:
+      ansible_host: "172.16.132.2"
+      backup_url: "172.16.132.2:1234"
+      backup_user: "backup"
+      backup_user_password: !vault |
+        $ANSIBLE_VAULT;1.1;AES256
+        31336636333061393333326263353835636431313739613462356531623532663137626466613433
+        3438616239333536643835643933333461323666343864640a386361306163623261656630643837
+        65396139333264636333656337383766393931393934373335646231336330656561303039326665
+        3331636339356236330a333330373264306163393162386330393763613332376261373433303035
+        65633034366439343232356639346665326234666630633063616437376131396463
+      backup_location: "/backup"
+      backup_number_to_keep: 10
+    boardwalk:
+      ansible_host: "10.77.7.2"
+      backup_url: "10.77.7.2:1234"
+      backup_user: "backup"
+      backup_user_password: !vault |
+        $ANSIBLE_VAULT;1.1;AES256
+        34313763623733323133393734326533333661343239393037666462323732393839386131393165
+        6233376533623431333238373039353330616265363566320a393730343938306430313864666534
+        36363736303436643163313636303931323032366136616634366363383036303737356336343638
+        6566663062336566320a323536303233393431363263313933643839303435356266656136343438
+        35306638356564333962656433323735656136386130373233393765616265306636
+      backup_location: "/backup"
+      backup_number_to_keep: 10
+    monitor:
+      ansible_host: "10.42.0.4"
+  children:
+    docker_nodes:
+      hosts:
+        web:
+        database:
+        publicworks:
+        dmz:
+        games:
+    pfsense_nodes:
+      hosts:
+        openocean:
+        boardwalk:
+    database_nodes:
+      database:
+    

inventories/kubernetes

@@ -1,9 +0,0 @@
-[masters]
-kubemaster ansible_host=10.20.24.4 master=true
-
-[workers]
-kubeworker1 ansible_host=10.20.24.5 worker=true
-kubeworker2 ansible_host=10.20.24.6 worker=true
-
-[ansible_nodes]
-ansible ansible_host=10.20.24.3 connection=local

playbooks/IaC_database.yml

@@ -0,0 +1,263 @@
+---
+- hosts: beachsidelibrary
+  become: true
+  become_method: sudo
+  become_user: root
+  vars:
+    postgres_device: "/dev/vdc"
+    postgres_vg_name: "vg_postgres"
+    postgres_lv_name: "lv_pgdata"
+    postgres_data_directory: "/pgdata"
+    mysql_device: "/dev/vdd"
+    mysql_vg_name: "vg_mysql"
+    mysql_lv_name: "lv_mysql_data"
+    mysql_data_directory: "/mysql_data"
+  vars_prompt:
+    - name: psql_password
+      prompt: "Enter psql Password: "
+      private: true
+      encrypt: sha512_crypt
+      confirm: true
+      salt_size: 7
+    - name: mysql_password
+      prompt: "Enter mysql Password: "
+      private: true
+      encrypt: sha512_crypt
+      confirm: true
+      salt_size: 7
+    - name: postgres_db_password
+      prompt: "Enter Postgres DB Password: "
+      private: true
+    - name: mysql_db_password
+      prompt: "Enter MySQL DB Password: "
+      private: true
+  tasks:
+    - name: Create psql user
+      ansible.builtin.user:
+        name: psql
+        password: "{{ psql_password }}"
+        comment: "Podman user for Postgresql Database"
+        uid: 2000
+
+    - name: Make .bashrc.d directory for psql user
+      ansible.builtin.file:
+        path: /home/psql/.bashrc.d
+        owner: psql
+        group: psql
+        mode: "0750"
+        state: directory
+
+    - name: Set XDG_RUNTIME_DIR var for psql user
+      ansible.builtin.lineinfile:
+        path: /home/psql/.bashrc.d/systemd
+        owner: psql
+        group: psql
+        mode: "0750"
+        line: "export XDG_RUNTIME_DIR=/run/user/2000"
+        create: true
+
+    - name: Allow psql user to linger
+      ansible.builtin.shell:
+        cmd: "loginctl enable-linger 2000"
+
+    - name: Build /pgdata mount
+      ansible.builtin.import_role:
+        name: make_lvm_mount
+      vars:
+        device_name: "{{ postgres_device }}"
+        vg_name: "{{ postgres_vg_name }}"
+        lvs:
+          - lv_name: "{{ postgres_lv_name }}"
+            lv_size: "100%FREE"
+        directories:
+          - name: "{{ postgres_data_directory }}"
+            owner: psql
+            group: psql
+            mode: "0755"
+            lv: "{{ postgres_lv_name }}"
+
+    - name: Create mysql user
+      ansible.builtin.user:
+        name: mysql
+        password: "{{ mysql_password }}"
+        comment: "Podman user for MySQL Database"
+        uid: 2001
+
+    - name: Make .bashrc.d directory for mysql user
+      ansible.builtin.file:
+        path: /home/mysql/.bashrc.d
+        owner: mysql
+        group: mysql
+        mode: "0750"
+        state: directory
+
+    - name: Set XDG_RUNTIME_DIR var for mysql user
+      ansible.builtin.lineinfile:
+        path: /home/mysql/.bashrc.d/systemd
+        owner: mysql
+        group: mysql
+        mode: "0750"
+        line: "export XDG_RUNTIME_DIR=/run/user/2001"
+        create: true
+
+    - name: Place container environment file for psql user
+      ansible.builtin.lineinfile:
+        path: /home/psql/.containerenv
+        owner: psql
+        group: psql
+        mode: "0750"
+        line: "POSTGRES_PASSWORD={{ postgres_db_password }}"
+        create: true
+
+    - name: Place container environment file for mysql user
+      ansible.builtin.lineinfile:
+        path: /home/mysql/.containerenv
+        owner: mysql
+        group: mysql
+        mode: "0750"
+        line: "MYSQL_ROOT_PASSWORD={{ mysql_db_password }}"
+        create: true
+
+    - name: Allow mysql user to linger
+      ansible.builtin.shell:
+        cmd: "loginctl enable-linger 2001"
+
+    - name: Build /mysql_data mount
+      ansible.builtin.import_role:
+        name: make_lvm_mount
+      vars:
+        device_name: "{{ mysql_device }}"
+        vg_name: "{{ mysql_vg_name }}"
+        lvs:
+          - lv_name: "{{ mysql_lv_name }}"
+            lv_size: "100%FREE"
+        directories:
+          - name: "{{ mysql_data_directory }}"
+            owner: mysql
+            group: mysql
+            mode: "0755"
+            lv: "{{ mysql_lv_name }}"
+
+    - name: Run systemctl daemon-reload
+      ansible.builtin.systemd_service:
+        daemon_reload: true
+    
+    - name: Write subuid user entry for psql
+      ansible.builtin.lineinfile:
+        path: /etc/subuid
+        line: "psql:100000:2000"
+        insertafter: EOF
+        create: true
+        state: present
+      
+    - name: Write subuid user entry for mysql
+      ansible.builtin.lineinfile:
+        path: /etc/subuid
+        line: "mysql:102000:2000"
+        insertafter: EOF
+        create: true
+        state: present
+
+    - name: Write subgid group entry for psql
+      ansible.builtin.lineinfile:
+        path: /etc/subgid
+        line: "psql:100000:2000"
+        insertafter: EOF
+        create: true
+        state: present
+
+    - name: Write subgid group entry for mysql
+      ansible.builtin.lineinfile:
+        path: /etc/subgid
+        line: "mysql:102000:2000"
+        insertafter: EOF
+        create: true
+        state: present
+
+    - name: Configure firewalld for postgres
+      ansible.posix.firewalld:
+        service: postgresql
+        state: enabled
+        permanent: true
+        immediate: true
+
+    - name: Configure firewalld for mysql
+      ansible.posix.firewalld:
+        service: mysql
+        state: enabled
+        permanent: true
+        immediate: true
+
+    # TODO Unit spec should get *.mount After directive from variables
+    - name: Build postgres quadlet
+      containers.podman.podman_container:
+        name: postgres
+        image: "docker.io/library/postgres:17"
+        state: quadlet
+        quadlet_filename: "postgres-quadlet"
+        quadlet_file_mode: "0640"
+        rm: false
+        ports:
+          - "5432:5432"
+        volumes:
+          - "{{ postgres_data_directory }}:/var/lib/postgresql/data:Z"
+        quadlet_options:
+          - "AutoUpdate=registry"
+          - "Pull=newer"
+          - |
+            [Install]
+            WantedBy=default.target
+          - |
+            [Unit]
+            Description=Postgres Quadlet
+            After=pgdata.mount
+        env_file: "/home/psql/.containerenv"
+      become_user: "psql"
+
+    - name: Build mysql quadlet
+      containers.podman.podman_container:
+        name: mysql
+        image: "docker.io/library/mysql:8"
+        state: quadlet
+        quadlet_filename: "mysql-quadlet"
+        quadlet_file_mode: "0640"
+        rm: false
+        ports:
+          - "3306:3306"
+        volumes:
+          - "{{ mysql_data_directory }}:/var/lib/mysql:Z"
+        quadlet_options:
+          - "AutoUpdate=registry"
+          - "Pull=newer"
+          - ""
+          - |
+            [Install]
+            WantedBy=default.target
+          - |
+            [Unit]
+            Description=MySQL Quadlet
+            After=mysql_data.mount
+        env_file: "/home/mysql/.containerenv"
+      become_user: "mysql"
+
+    - name: Run systemctl --user daemon-reload
+      ansible.builtin.systemd_service:
+        daemon_reload: true
+        scope: user
+      become_user: "{{ item }}"
+      loop:
+        - psql
+        - mysql
+
+    - name: Run systemctl --user start for each quadlet
+      ansible.builtin.systemd_service:
+        name: "{{ item.service }}"
+        scope: user
+        state: started
+      become_user: "{{ item.user }}"
+      loop:
+        - service: postgres-quadlet.service
+          user: psql
+        - service: mysql-quadlet.service
+          user: mysql
+    

playbooks/IaC_gitea.yml

@@ -0,0 +1,159 @@
+---
+- hosts: bulletinboard
+  become: true
+  become_method: sudo
+  become_user: root
+  vars:
+    gitea_device: "/dev/vdc"
+    gitea_vg_name: "vg_gitea"
+    gitea_lv_name: "lv_gitea"
+    gitea_data_directory: "/gitea"
+  vars_prompt:
+    - name: gitea_password
+      prompt: "Enter gitea Password: "
+      private: true
+      encrypt: sha512_crypt
+      confirm: true
+      salt_size: 7
+    - name: gitea_db_password
+      prompt: "Enter Gitea DB Password: "
+      private: true
+  tasks:
+    - name: Create gitea user
+      ansible.builtin.user:
+        name: gitea
+        password: "{{ gitea_password }}"
+        comment: "Podman user for Gitea application"
+        uid: 2001
+
+    - name: Make .bashrc.d directory for gitea user
+      ansible.builtin.file:
+        path: /home/gitea/.bashrc.d
+        owner: gitea
+        group: gitea
+        mode: "0750"
+        state: directory
+
+    - name: Set XDG_RUNTIME_DIR var for gitea user
+      ansible.builtin.lineinfile:
+        path: /home/gitea/.bashrc.d/systemd
+        owner: gitea
+        group: gitea
+        mode: "0750"
+        line: "export XDG_RUNTIME_DIR=/run/user/2001"
+        create: true
+
+    - name: Allow gitea user to linger
+      ansible.builtin.shell:
+        cmd: "loginctl enable-linger 2001"
+
+    - name: Place container environment file for gitea user
+      ansible.builtin.lineinfile:
+        path: /home/gitea/.containerenv
+        owner: gitea
+        group: gitea
+        mode: "0750"
+        line: "{{ item }}"
+        insertafter: EOF
+        create: true
+      no_log: true
+      loop:
+        - "GITEA__database_DB_TYPE=mysql"
+        - "GITEA__database__HOST=10.12.34.3:3306"
+        - "GITEA__database__NAME=gitea"
+        - "GITEA__database__USER=gitea"
+        - "GITEA__database__PASSWD={{ gitea_db_password }}"
+
+    - name: Run systemctl daemon-reload
+      ansible.builtin.systemd_service:
+        daemon_reload: true
+    
+    - name: Write subuid user entry for gitea
+      ansible.builtin.lineinfile:
+        path: /etc/subuid
+        line: "gitea:102000:2000"
+        insertafter: EOF
+        create: true
+        state: present
+
+    - name: Write subgid user entry for gitea
+      ansible.builtin.lineinfile:
+        path: /etc/subgid
+        line: "gitea:102000:2000"
+        insertafter: EOF
+        create: true
+        state: present
+
+    - name: Configure firewalld for gitea
+      ansible.posix.firewalld:
+        port: "8081/tcp"
+        state: enabled
+        permanent: true
+        immediate: true
+
+    - name: Configure quadlet volumes
+      containers.podman.podman_volume:
+        state: quadlet
+        name: "gitea-{{ item }}"
+        quadlet_filename: "gitea-quadlet-volumes-{{ item }}"
+        quadlet_file_mode: "0640"
+        quadlet_options:
+          - |
+            [Install]
+            WantedBy=default.target
+          - |
+            [Unit]
+            Description=Gitea {{ item }} Volume
+      loop:
+        - "data"
+        - "config"
+      become_user: gitea
+
+    # TODO Unit spec should get *.mount After directive from variables
+    - name: Build gitea quadlet
+      containers.podman.podman_container:
+        name: gitea
+        image: "docker.io/gitea/gitea:latest-rootless"
+        state: quadlet
+        quadlet_filename: "gitea-quadlet"
+        quadlet_file_mode: "0640"
+        rm: false
+        ports:
+          - "8081:3000"
+        volumes:
+          - "gitea-data:/var/lib/gitea:Z"
+          - "gitea-config:/etc/gitea:Z"
+          - "/etc/localtime:/etc/timezone:ro"
+          - "/etc/localtime:/etc/localtime:ro"
+        quadlet_options:
+          - "AutoUpdate=registry"
+          - "Pull=newer"
+          - |
+            [Install]
+            WantedBy=default.target
+          - |
+            [Unit]
+            Description=Gitea Quadlet
+          - |
+            [Service]
+            ExecStartPre=/home/gitea/service_up.sh 3306
+        env_file: "/home/gitea/.containerenv"
+      become_user: "gitea"
+
+    - name: Run systemctl --user daemon-reload
+      ansible.builtin.systemd_service:
+        daemon_reload: true
+        scope: user
+      become_user: "gitea"
+
+    - name: Run systemctl --user start for all services
+      ansible.builtin.systemd_service:
+        state: started
+        scope: user
+        name: "{{ item }}"
+      loop:
+        - "gitea-quadlet-volumes-data-volume.service"
+        - "gitea-quadlet-volumes-config-volume.service"
+        - "gitea-quadlet.service"
+      become_user: "gitea"
+

playbooks/IaC_gitea.yml.bak

@@ -0,0 +1,160 @@
+---
+- hosts: bulletinboard
+  become: true
+  become_method: sudo
+  become_user: root
+  vars:
+    gitea_device: "/dev/vdc"
+    gitea_vg_name: "vg_gitea"
+    gitea_lv_name: "lv_gitea"
+    gitea_data_directory: "/gitea"
+  vars_prompt:
+    - name: gitea_password
+      prompt: "Enter gitea Password: "
+      private: true
+      encrypt: sha512_crypt
+      confirm: true
+      salt_size: 7
+    - name: gitea_db_password
+      prompt: "Enter Gitea DB Password: "
+      private: true
+  tasks:
+    - name: Create gitea user
+      ansible.builtin.user:
+        name: gitea
+        password: "{{ gitea_password }}"
+        comment: "Podman user for Gitea application"
+        uid: 2001
+
+    - name: Make .bashrc.d directory for gitea user
+      ansible.builtin.file:
+        path: /home/gitea/.bashrc.d
+        owner: gitea
+        group: gitea
+        mode: "0750"
+        state: directory
+
+    - name: Set XDG_RUNTIME_DIR var for gitea user
+      ansible.builtin.lineinfile:
+        path: /home/gitea/.bashrc.d/systemd
+        owner: gitea
+        group: gitea
+        mode: "0750"
+        line: "export XDG_RUNTIME_DIR=/run/user/2001"
+        create: true
+
+    - name: Allow gitea user to linger
+      ansible.builtin.shell:
+        cmd: "loginctl enable-linger 2001"
+
+    - name: Build /gitea mount
+      ansible.builtin.import_role:
+        name: make_lvm_mount
+      vars:
+        device_name: "{{ gitea_device }}"
+        vg_name: "{{ gitea_vg_name }}"
+        lvs:
+          - lv_name: "{{ gitea_lv_name }}"
+            lv_size: "100%FREE"
+        directories:
+          - name: "{{ gitea_data_directory }}"
+            owner: gitea
+            group: gitea
+            mode: "0755"
+            lv: "{{ gitea_lv_name }}"
+
+    - name: Make /gitea subdirectories
+      ansible.builtin.file:
+        path: "{{ gitea_data_directory }}/{{ item }}"
+        owner: gitea
+        group: gitea
+        mode: "0750"
+        state: directory
+      loop:
+        - "data"
+        - "config"
+
+    - name: Place container environment file for gitea user
+      ansible.builtin.lineinfile:
+        path: /home/gitea/.containerenv
+        owner: gitea
+        group: gitea
+        mode: "0750"
+        line: "{{ item }}"
+        insertafter: EOF
+        create: true
+      no_log: true
+      loop:
+        - "USER_UID=2001"
+        - "USER_GID=2001"
+        - "GITEA__database_DB_TYPE=mysql"
+        - "GITEA__database__HOST=10.12.34.3:3306"
+        - "GITEA__database__NAME=gitea"
+        - "GITEA__database__USER=gitea"
+        - "GITEA__database__PASSWD={{ gitea_db_password }}"
+
+    - name: Run systemctl daemon-reload
+      ansible.builtin.systemd_service:
+        daemon_reload: true
+    
+    - name: Write subuid user entry for gitea
+      ansible.builtin.lineinfile:
+        path: /etc/subuid
+        line: "gitea:102000:2000"
+        insertafter: EOF
+        create: true
+        state: present
+
+    - name: Write subgid user entry for gitea
+      ansible.builtin.lineinfile:
+        path: /etc/subgid
+        line: "gitea:102000:2000"
+        insertafter: EOF
+        create: true
+        state: present
+
+    - name: Configure firewalld for gitea
+      ansible.posix.firewalld:
+        port: "8081/tcp"
+        state: enabled
+        permanent: true
+        immediate: true
+
+    # TODO Unit spec should get *.mount After directive from variables
+    - name: Build gitea quadlet
+      containers.podman.podman_container:
+        name: gitea
+        image: "docker.io/gitea/gitea:latest-rootless"
+        state: quadlet
+        quadlet_filename: "gitea-quadlet"
+        quadlet_file_mode: "0640"
+        rm: false
+        ports:
+          - "8081:3000"
+        volumes:
+          - "{{ gitea_data_directory }}/data:/var/lib/gitea:Z"
+          - "{{ gitea_data_directory }}/config:/etc/gitea:Z"
+          - "/etc/localtime:/etc/timezone:ro"
+          - "/etc/localtime:/etc/localtime:ro"
+        quadlet_options:
+          - "AutoUpdate=registry"
+          - "Pull=newer"
+          - |
+            [Install]
+            WantedBy=default.target
+          - |
+            [Unit]
+            Description=Gitea Quadlet
+            After=gitea.mount
+          - |
+            [Service]
+            ExecStartPre=/home/gitea/service_up.sh 3306
+        env_file: "/home/gitea/.containerenv"
+      become_user: "gitea"
+
+    - name: Run systemctl --user daemon-reload
+      ansible.builtin.systemd_service:
+        daemon_reload: true
+        scope: user
+      become_user: "gitea"
+

playbooks/IaC_httptest.yml

@@ -0,0 +1,118 @@
+---
+- hosts: bulletinboard
+  become: true
+  become_method: sudo
+  become_user:
+  vars:
+    httptest_user_www: "/home/httptest/www"
+  vars_prompt:
+    - name: httptest_password
+      prompt: "Enter httptest Password: "
+      private: true
+      encrypt: sha512_crypt
+      confirm: true
+      salt_size: 7
+  tasks:
+    - name: Create httptest user
+      ansible.builtin.user:
+        name: httptest
+        password: "{{ httptest_password }}"
+        comment: "Podman user for httpd test host"
+        uid: 2000
+
+    - name: Make .bashrc.d directory for httptest user
+      ansible.builtin.file:
+        path: /home/httptest/.bashrc.d
+        owner: httptest
+        group: httptest
+        mode: "0750"
+        state: directory
+
+    - name: Set XDG_RUNTIME_DIR var for httptest user
+      ansible.builtin.lineinfile:
+        path: /home/httptest/.bashrc.d/systemd
+        owner: httptest
+        group: httptest
+        mode: "0750"
+        line: "export XDG_RUNTIME_DIR=/run/user/2000"
+        create: true
+
+    - name: Allow httptest user to linger
+      ansible.builtin.shell:
+        cmd: "loginctl enable-linger 2000"
+      
+    - name: Make www directory for httptest user
+      ansible.builtin.file:
+        path: "{{ httptest_user_www }}"
+        owner: httptest
+        group: httptest
+        mode: "0755"
+        state: directory
+
+    - name: Make index.html file
+      ansible.builtin.lineinfile:
+        path: "{{ httptest_user_www }}/index.html"
+        owner: httptest
+        group: httptest
+        mode: "0644"
+        line: "<!DOCTYPE html><html><body><h1>TEST</h1></body></html>"
+        create: true
+
+    - name: Write subuid user entry for httptest
+      ansible.builtin.lineinfile:
+        path: /etc/subuid
+        line: "httptest:100000:2000"
+        insertafter: EOF
+        create: true
+        state: present
+
+    - name: Write subgid user entry for httptest
+      ansible.builtin.lineinfile:
+        path: /etc/subgid
+        line: "httptest:100000:2000"
+        insertafter: EOF
+        create: true
+        state: present
+
+    - name: Configure firewalld for httpd
+      ansible.posix.firewalld:
+        port: "8080/tcp"
+        state: enabled
+        permanent: true
+        immediate: true
+
+    - name: Build httpd quadlet
+      containers.podman.podman_container:
+        name: httptest
+        image: "docker.io/library/httpd:latest"
+        state: quadlet
+        quadlet_filename: "httptest-quadlet"
+        quadlet_file_mode: "0640"
+        rm: false
+        ports: 8080:80
+        volumes:
+          - "{{ httptest_user_www }}:/usr/local/apache2/htdocs:Z"
+        quadlet_options:
+          - "AutoUpdate=registry"
+          - "Pull=newer"
+          - |
+            [Install]
+            WantedBy=default.target
+          - |
+            [Unit]
+            Description=httpd Test Quadlet
+            After=home.mount
+      become_user: "httptest"
+
+    - name: Run systemctl --user daemon-reload
+      ansible.builtin.systemd_service:
+        daemon_reload: true
+        scope: user
+      become_user: "httptest"
+
+    - name: Run systemctl --user start for httptest-quadlet
+      ansible.builtin.systemd_service:
+        name: "httptest-quadlet.service"
+        scope: user
+        state: started
+      become_user: "httptest"

playbooks/backup_protocol.yml

@@ -0,0 +1,220 @@
+---
+# Bits an pieces of this play are stolen from https://github.com/gavinwill/ansible-role-pfsense-backup/tree/main
+- name: PFSense Backups
+  hosts: pfsense_nodes
+  gather_facts: false
+  collections:
+    - ansible.posix
+  tasks:
+    - name: "Log first stage start time"
+      ansible.builtin.debug:
+        msg: "{{ now() }}"
+      run_once: true
+      delegate_to: blacktide
+
+    - name: Mount backup share
+      ansible.posix.mount:
+        path: /backup
+        src: "10.42.0.3:/backups/pfsense"
+        fstype: nfs
+        opts: "hard,intr,nodev,nosuid,noexec"
+        state: ephemeral
+      delegate_to: blacktide
+      run_once: true
+      become: true
+      become_method: sudo
+
+    - name: Get Cookies and CSRF Token
+      ansible.builtin.uri:
+        url: "http://{{ backup_url }}/diag_backup.php"
+        validate_certs: false
+        method: GET
+        return_content: true
+      register: pfsense_cookie_token
+      no_log: "{{ pfsense_backup_disable_logging | default(false) }}"
+      delegate_to: blacktide
+
+    - name: Set CSRF Token and Cookie Fact
+      ansible.builtin.set_fact:
+        pfsense_backup_csrf: "{{ pfsense_cookie_token.content | regex_search('var\\s+csrfMagicToken\\s+=\\s+\\\"([a-f0-9sidp:;,]+)\\\"', '\\1') }}"
+        pfsense_backup_cookie: "{{ pfsense_cookie_token.set_cookie }}"
+      no_log: "{{ pfsense_backup_disable_logging | default(false) }}"
+
+    - name: Authenticate with backup page and register backup CSRF
+      ansible.builtin.uri:
+        url: "http://{{ backup_url }}/diag_backup.php"
+        validate_certs: false
+        follow_redirects: false
+        method: POST
+        return_content: true
+        body_format: form-urlencoded
+        status_code: 302
+        body:
+          login: Login
+          usernamefld: "{{ backup_user }}"
+          passwordfld: "{{ backup_user_password }}"
+          __csrf_magic: "{{ pfsense_backup_csrf }}"
+        headers:
+          Cookie: "{{ pfsense_backup_cookie }}"
+      register: pfsense_cookie_token_2
+      delegate_to: blacktide
+      no_log: "{{ pfsense_backup_disable_logging | default(false) }}"
+
+    - name: Set Cookie Fact from Backup page
+      ansible.builtin.set_fact:
+        pfsense_backup_cookie_1: "{{ pfsense_cookie_token_2.set_cookie }}"
+      no_log: "{{ pfsense_backup_disable_logging | default(false) }}"
+
+    - name: Fetch Target page for new CSRF token
+      ansible.builtin.uri:
+        url: "http://{{ backup_url }}/diag_backup.php"
+        validate_certs: false
+        follow_redirects: false
+        method: GET
+        return_content: true
+        headers:
+          Cookie: "{{ pfsense_backup_cookie_1 }}"
+      register: pfsense_cookie_token_3
+      delegate_to: blacktide
+      no_log: "{{ pfsense_backup_disable_logging | default(false) }}"
+
+    - name: Set fact for CSRF Token and Cookie
+      ansible.builtin.set_fact:
+        pfsense_backup_csrf_1: "{{ pfsense_cookie_token_3.content | regex_search('var\\s+csrfMagicToken\\s+=\\s+\\\"([a-f0-9sidp:;,]+)\\\"', '\\1') }}"
+        pfsense_backup_cookie_2: "{{ pfsense_cookie_token_3.set_cookie }}"
+      no_log: "{{ pfsense_backup_disable_logging | default(false) }}"
+
+    - name: Download Backup Configuration
+      ansible.builtin.uri:
+        url: "http://{{ backup_url }}/diag_backup.php"
+        validate_certs: false
+        follow_redirects: false
+        method: "POST"
+        return_content: true
+        body_format: form-urlencoded
+        body:
+          download: download
+          backupssh: "yes"
+          backupdata: "yes"
+          donotbackuprrd: "yes"
+          __csrf_magic: "{{ pfsense_backup_csrf_1 }}"
+        headers:
+          Cookie: "{{ pfsense_backup_cookie_2 }}"
+        dest: "{{ backup_location }}/{{ inventory_hostname }}_{{ now().strftime('%Y%m%d%H%M%S') }}.xml"
+      changed_when: false
+      delegate_to: blacktide
+      no_log: "{{ pfsense_backup_disable_logging | default(false) }}"
+
+    - name: Find all PFSense backups for the current host
+      ansible.builtin.find:
+        paths: "{{ backup_location }}"
+        patterns: "{{ inventory_hostname }}*"
+      register: all_pfsense_backups
+      delegate_to: blacktide
+
+    - name: If too many backups kept
+      when: all_pfsense_backups.files | length > backup_number_to_keep
+      block:
+        - name: Get the oldest file paths
+          ansible.builtin.set_fact:
+            oldest_file_paths: >-
+              {{ (all_pfsense_backups.files | sort(attribute='mtime'))[:all_pfsense_backups.files | length - backup_number_to_keep] |
+                  map(attribute='path') | list }}
+          
+        - name: Remove the files
+          ansible.builtin.file:
+            path: "{{ item }}"
+            state: absent
+          loop: "{{ oldest_file_paths }}"
+          delegate_to: blacktide
+    
+- name: Docker Infrastructure Compose Backups
+  hosts: docker_nodes,!publicworks
+  become: true
+  become_method: sudo
+  gather_facts: false
+  collections:
+    - community.docker
+    - community.general
+  vars:
+    env_backups_to_keep: 10
+  tasks:
+    - name: "Log first stage start time"
+      ansible.builtin.debug:
+        msg: "{{ now() }}"
+      run_once: true
+      delegate_to: blacktide
+
+    - name: Run mount to ensure the /backup directory is present
+      ansible.builtin.shell:
+        cmd: "mount -a"
+      changed_when: false
+
+    - name: Run container mounts backup
+      ansible.builtin.include_role:
+        name: docker_backup
+      vars:
+        backup_rules: "{{ item }}"
+      when: docker_backup is defined and docker_backup | length != 0
+      loop: "{{ docker_backup }}"
+
+    - name: Stat the /root/infrastructure-compose folder
+      ansible.builtin.stat:
+        path: "/root/infrastructure-compose"
+      register: infra_compose_stat
+
+    - name: Find all .env files
+      ansible.builtin.find:
+        paths: "/root/infrastructure-compose"
+        hidden: true
+        patterns: ".*.env"
+      when: infra_compose_stat.stat.exists
+      register: all_env_files
+
+    - name: .env Backup block
+      when: infra_compose_stat.stat.exists and all_env_files.files is defined and all_env_files.files | length != 0
+      block:
+        - name: Show file list
+          ansible.builtin.debug:
+            msg: "{{ all_env_files.files | map(attribute='path') | list }}"
+
+        - name: Archive .env files
+          community.general.archive:
+            path: "{{ all_env_files.files | map(attribute='path') | list }}"
+            dest: >-
+              /backup/{{ inventory_hostname }}_{{ now().strftime("%Y%m%d%H%M%S") }}.tar.gz
+            format: gz
+            force_archive: true
+
+        - name: Find all .env backup files for the current host
+          ansible.builtin.find:
+            paths: "/backup"
+            patterns: "{{ inventory_hostname }}*"
+          register: backup_env_files
+
+        - name: If too many backups kept
+          when: backup_env_files.files | length > env_backups_to_keep
+          block:
+            - name: Get the oldest file paths
+              ansible.builtin.set_fact:
+                oldest_file_paths: >-
+                  {{ (backup_env_files.files | sort(attribute='mtime'))[:backup_env_files.files | length - env_backups_to_keep] |
+                      map(attribute='path') | list }}
+              
+            - name: Remove the files
+              ansible.builtin.file:
+                path: "{{ item }}"
+                state: absent
+              loop: "{{ oldest_file_paths }}"
+- name: Trigger rclone backup
+  hosts: nfsserver
+  become: true
+  become_method: sudo
+  gather_facts: false
+  tasks:
+    - name: Run rclone
+      ansible.builtin.shell:
+        cmd: "rclone sync /backups dropbox:Backup/infrastructure --progress --dropbox-chunk-size 128M --dropbox-batch-mode sync --dropbox-batch-size 100 --tpslimit 12 --tpslimit-burst 0"
+      changed_when: false
+      async: 3600
+      poll: 60

playbooks/install_docker.yml

@@ -0,0 +1,47 @@
+---
+- hosts: docker_nodes
+  become: true
+  become_method: sudo
+  become_user: root
+  vars:
+    docker_device: "/dev/vdb"
+    docker_vg_name: "vg_docker"
+    docker_lv_name: "lv_docker"
+    docker_data_directory: "/var/lib/docker"
+  tasks:
+    - name: Build /var/lib/docker mount
+      ansible.builtin.import_role:
+        name: make_lvm_mount
+      vars:
+        device_name: "{{ docker_device }}"
+        vg_name: "{{ docker_vg_name }}"
+        lvs:
+          - lv_name: "{{ docker_lv_name }}"
+            lv_size: "100%FREE"
+        directories:
+          - name: "{{ docker_data_directory }}"
+            owner: root
+            group: root
+            mode: "0750"
+            lv: "{{ docker_lv_name }}"
+      tags:
+        - "make_mount"
+
+    - name: Add repo with config-manager
+      ansible.builtin.shell:
+        cmd: "dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo"
+
+    - name: Install docker
+      ansible.builtin.yum:
+        name:
+          - docker-ce
+          - docker-ce-cli
+          - containerd.io
+          - docker-compose-plugin
+
+    - name: Start docker service
+      ansible.builtin.systemd_service:
+        name: docker
+        enabled: true
+        state: started
+

playbooks/podman_setup.yml

@@ -1,48 +1,59 @@
----
-- hosts: podman_nodes
-  become: true
-  become_method: sudo
-  become_user: root
-  vars:
-    dev_device: "/dev/vdb"
-    vg_name: "vg_podman"
-    lv_name: "lv_containers"
-    containers_directory: "/var/lib/containers"
-  tasks:
-    - name: Setup container directory volume group
-      community.general.lvg:
-        vg: "{{ vg_name }}"
-        pvs: "{{ dev_device }}"
-
-    - name: Setup container directory logical volume
-      community.general.lvol:
-        vg: "{{ vg_name }}"
-        lv: "{{ lv_name }}"
-        size: 100%FREE
-
-    - name: Create xfs filesystem on lib_containers logical volume
-      community.general.filesystem:
-        fstype: xfs
-        dev: /dev/mapper/{{ vg_name }}-{{ lv_name }}
-
-    - name: Create the containers directory
-      ansible.builtin.file:
-        path: "{{ containers_directory }}"
-        state: directory
-        mode: '0755'
-
-    - name: Setup containers directory mount
-      ansible.posix.mount:
-        path: "{{ containers_directory }}"
-        src: "/dev/mapper/{{ vg_name }}-{{ lv_name }}"
-        fstype: xfs
-        state: mounted
-
-    - name: Install podman
-      ansible.builtin.yum:
-        name: podman
-        state: latest
-      async: 1200
-      poll: 60
-
+---
+- hosts: podman_nodes
+  become: true
+  become_method: sudo
+  become_user: root
+  vars:
+    dev_device: "/dev/vdb"
+    vg_name: "vg_podman"
+    lv_name: "lv_containers"
+    containers_directory: "/var/lib/containers"
+  tasks:
+    - name: Setup container directory volume group
+      community.general.lvg:
+        vg: "{{ vg_name }}"
+        pvs: "{{ dev_device }}"
+
+    - name: Setup container directory logical volume
+      community.general.lvol:
+        vg: "{{ vg_name }}"
+        lv: "{{ lv_name }}"
+        size: 100%FREE
+
+    - name: Create xfs filesystem on lib_containers logical volume
+      community.general.filesystem:
+        fstype: xfs
+        dev: /dev/mapper/{{ vg_name }}-{{ lv_name }}
+
+    - name: Create the containers directory
+      ansible.builtin.file:
+        path: "{{ containers_directory }}"
+        state: directory
+        mode: '0755'
+
+    - name: Setup containers directory mount
+      ansible.posix.mount:
+        path: "{{ containers_directory }}"
+        src: "/dev/mapper/{{ vg_name }}-{{ lv_name }}"
+        fstype: xfs
+        state: mounted
+
+    - name: Install podman and components
+      ansible.builtin.yum:
+        name: 
+          - podman
+          - passt
+          - shadow-utils
+          - systemd-container
+        state: latest
+      async: 1200
+      poll: 60
+
+    - name: Force reinstall container-selinux
+      ansible.builtin.yum:
+        name: container-selinux
+        state: reinstall
+      async: 1200
+      poll: 60
+
     

playbooks/roles/docker_backup/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

playbooks/roles/docker_backup/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+backup_rules: ""

playbooks/roles/docker_backup/meta/main.yml

@@ -0,0 +1,52 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.1
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

playbooks/roles/docker_backup/tasks/main.yml

@@ -0,0 +1,63 @@
+---
+- name: Ensure backup rules contains the necessary fields
+  ansible.builtin.fail:
+    msg: "You must define {{ backup_rule_checker }} in the backup ruleset"
+  when: not backup_rules[backup_rule_checker] is defined
+  loop:
+    - container_name
+    - directories_to_backup
+    - backup_dir
+    - backup_name_prefix
+    - max_backups_kept
+  loop_control:
+    loop_var: backup_rule_checker
+
+- name: Make sure backup dir exists
+  ansible.builtin.file:
+    path: "{{ backup_rules['backup_dir'] }}"
+    state: directory
+    recurse: true
+
+- name: Stop the running container
+  community.docker.docker_container:
+    name: "{{ backup_rules.container_name }}"
+    state: stopped
+
+- name: Archive necessary directories
+  community.general.archive:
+    path: "{{ backup_rules.directories_to_backup }}"
+    dest: >-
+      {{ backup_rules.backup_dir }}/{{ backup_rules.backup_name_prefix }}_{{ now().strftime("%Y%m%d%H%M%S") }}.tar.gz
+    format: gz
+  async: 3600
+  poll: 60
+
+- name: Start the stopped container
+  community.docker.docker_container:
+    name: "{{ backup_rules.container_name }}"
+    state: started
+
+- name: Find all files that start with the backup_name_prefix
+  ansible.builtin.find:
+    paths: "{{ backup_rules.backup_dir }}"
+    patterns: "{{ backup_rules.backup_name_prefix }}*"
+  register: all_backup_files
+
+- name: If too many backups kept
+  when: all_backup_files.files | length > backup_rules.max_backups_kept
+  block:
+    - name: Get the oldest file paths
+      ansible.builtin.set_fact:
+        oldest_file_paths: >-
+          {{ (all_backup_files.files | sort(attribute='mtime'))[:all_backup_files.files | length - backup_rules.max_backups_kept] |
+              map(attribute='path') | list }}
+      
+    - name: Remove the files
+      ansible.builtin.file:
+        path: "{{ old_file_to_delete }}"
+        state: absent
+      loop: "{{ oldest_file_paths }}"
+      loop_control:
+        loop_var: old_file_to_delete
+
+

playbooks/roles/make_lvm_mount/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

playbooks/roles/make_lvm_mount/defaults/main.yml

@@ -0,0 +1,12 @@
+---
+device_name: ""
+vg_name: ""
+lvs:
+  - lv_name: ""
+    lv_size: ""
+directories:
+  - name: ""
+    owner: ""
+    group: ""
+    mode: ""
+    lv: ""

playbooks/roles/make_lvm_mount/meta/main.yml

@@ -0,0 +1,53 @@
+galaxy_info:
+  author: your name
+  description: your description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.4
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.
+  

playbooks/roles/make_lvm_mount/tasks/main.yml

@@ -0,0 +1,44 @@
+---
+- name: Setup volume group
+  community.general.lvg:
+    vg: "{{ vg_name }}"
+    pvs: "{{ device_name }}"
+
+- name: Setup logical volumes
+  community.general.lvol:
+    vg: "{{ vg_name }}"
+    lv: "{{ item.lv_name }}"
+    size: "{{ item.lv_size }}"
+  loop: "{{ lvs }}"
+
+- name: Create xfs filesystem on lv
+  community.general.filesystem:
+    fstype: xfs
+    dev: "/dev/mapper/{{ vg_name }}-{{ item.lv_name }}"
+  loop: "{{ lvs }}"
+
+- name: Create data directories
+  ansible.builtin.file:
+    path: "{{ item.name }}"
+    state: directory
+    owner: "{{ item.owner }}"
+    group: "{{ item.group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ directories }}"
+
+- name: Setup mounts
+  ansible.posix.mount:
+    path: "{{ item.name }}"
+    src: "/dev/mapper/{{ vg_name }}-{{ item.lv }}"
+    fstype: xfs
+    state: mounted
+  loop: "{{ directories }}"
+
+- name: Ensure data directories have the right permissions
+  ansible.builtin.file:
+    path: "{{ item.name }}"
+    state: directory
+    owner: "{{ item.owner }}"
+    group: "{{ item.group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ directories }}"

playbooks/update_user_password.yml

@@ -0,0 +1,52 @@
+---
+- hosts: all
+  vars:
+    password_salt: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          38386463386336393336643934393736633235623939306263663737303130316438343037353135
+          6535633737343438393239636230666664666331346564380a613161376237323262613164316564
+          65643733373739666165313065383030353664656161393261623762623733353938333964346536
+          3064316661323964390a326564613734316162613432396432363737376438323664656666613035
+          30386662653266373766613837373534616639383866383732646336373037653430
+  tasks:
+    - name: "Fail if what_user is not set"
+      ansible.builtin.fail:
+        msg: "You have to specify the what_user variable"
+      when: not what_user is defined
+      run_once: true
+      delegate_to: 127.0.0.1
+    
+    - name: "Fail if what_password is not set"
+      ansible.builtin.fail:
+        msg: "You have to specify the what_password variable"
+      when: not what_user is defined
+      run_once: true
+      delegate_to: 127.0.0.1
+
+    - name: Fail if user specified does not exist
+      ansible.builtin.getent:
+        database: passwd
+        key: "{{ what_user }}"
+
+    - name: Ensure passlib is installed locally
+      ansible.builtin.pip:
+        name: passlib
+        extra_args: "--user"
+      run_once: true
+      delegate_to: 127.0.0.1
+
+    - name: Generate password outside root context
+      ansible.builtin.set_fact:
+        hashed_pass: "{{ what_password | password_hash('sha512', password_salt) }}"
+      run_once: true
+      delegate_to: 127.0.0.1
+
+    - name: Update user password
+      ansible.builtin.user:
+        name: "{{ what_user }}"
+        password: "{{ what_password | password_hash('sha512', password_salt) }}"
+      become: true
+      become_method: sudo
+      become_user: root
+      
+