Update .gitea/workflows/deploy-k8s.yml

.gitea/workflows/deploy-k8s.yml

@@ -2,7 +2,7 @@ name: IACAnsible
 
 on: 
   push:
-    branches: [ main ]
+    branches: [ kubernetes-vazio ]
   workflow_dispatch:
 
 jobs:
@@ -35,7 +35,7 @@ jobs:
           bw login --apikey
           echo "session"
           BW_SESSION=$(bw unlock "$BW_PASSWORD" --raw)
-          echo "BW_SESSION=$BW_SESSION" >> $GITEA_ENV
+          
 
       - name: Cloning ansible repository
         uses: actions/checkout@v4
@@ -55,6 +55,4 @@ jobs:
       - name: Run Ansible Playbook
         working-directory: ansible/iac
         run: |
-          ansible-playbook -i inventory.ini playbook.yml -e "BW_CLIENTID=$BW_CLIENTID BW_CLIENTSECRET=$BW_CLIENTSECRET BW_PASSWORD=$BW_PASSWORD BW_EMAIL=$BW_EMAIL"
+          ansible-playbook -i inventory.ini playbook.yml
-        env:
-          BW_SESSION: ${{ env.BW_SESSION }}

README.md

@@ -1,9 +1,3 @@
 # iac-ansible-private
 
 iac-ansible-private
-
-stolon comes from https://github.com/sorintlab/stolon/blob/master/examples/kubernetes/README.md
-qbittorrent comes from https://github.com/j4ym0/pia-qbittorrent-docker?tab=readme-ov-file
-prowlarr comes from https://docs.linuxserver.io/images/docker-prowlarr/#docker-mods 
-                and https://wiki.servarr.com/prowlarr/environment-variables
-

playbook.yml

@@ -3,7 +3,6 @@
   become: yes
   roles:
     - common
-    - vaultwarden
     - kubernetes
     - kube-master
 
@@ -12,17 +11,5 @@
   become: yes
   roles:
     - common
-    - vaultwarden
     - kubernetes
     - kube-node
-
-- name: Configure Kubernetes Data
-  hosts: master
-  become: yes
-  roles:
-    - stolon
-    - cloudflared
-    - qbittorrent
-    - prowlarr
-    - sonarr
-    - jellyfin

roles/cloudflared/files/cloudflare-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cloudflare

roles/cloudflared/files/cloudflared-tunnel-deployment.yaml

@@ -1,49 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cloudflared-tunnel
-  namespace: cloudflare
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: cloudflared
-  template:
-    metadata:
-      labels:
-        app: cloudflared
-    spec:
-      securityContext:
-        sysctls:
-        # Allows ICMP traffic (ping, traceroute) to resources behind cloudflared.
-          - name: net.ipv4.ping_group_range
-            value: "65532 65532"
-      containers:
-        - image: cloudflare/cloudflared:latest
-          name: cloudflared
-          env:
-            # Defines an environment variable for the tunnel token.
-            - name: TUNNEL_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: tunnel-token-secret
-                  key: token
-          command:
-            # Configures tunnel run parameters
-            - cloudflared
-            - tunnel
-            - --no-autoupdate
-            - --loglevel
-            - debug
-            - --metrics
-            - 0.0.0.0:2000
-            - run
-          livenessProbe:
-            httpGet:
-              # Cloudflared has a /ready endpoint which returns 200 if and only if
-              # it has an active connection to Cloudflare's network.
-              path: /ready
-              port: 2000
-            failureThreshold: 1
-            initialDelaySeconds: 10
-            periodSeconds: 10

roles/cloudflared/files/tunnel-token-secret.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: tunnel-token-secret
-    namespace: cloudflare
-type: Opaque
-data:
-    token: <CLOUDFLARE_TUNNEL_TOKEN>

roles/cloudflared/tasks/main.yml

@@ -1,51 +0,0 @@
-- name: Remover o diretório /tmp/cloudflare/kubernetes-files
-  ansible.builtin.file:
-    path: /tmp/cloudflare/kubernetes-files
-    state: absent
-
-- name: Criar diretório temporário no remoto
-  file:
-    path: /tmp/cloudflare/kubernetes-files
-    state: directory
-    mode: '0755'
-
-- name: Copy file with owner and permissions
-  ansible.builtin.copy:
-    src: ../files
-    dest: /tmp/cloudflare/kubernetes-files
-    owner: fenix
-    group: root
-    mode: '0644'
-
-
-- name: Obter várias notas do Bitwarden
-  shell: |
-    echo "unlock"
-    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
-    echo "get item"
-    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
-  loop:
-    - { id: "iac.ansible.cloudflare.tunnel.secret", dest: "/tmp/cloudflare/kubernetes-files/files/tunnel-token-secret.yaml" }
-  args:
-    executable: /bin/bash
-  environment:
-    BW_PASSWORD: "{{ BW_PASSWORD }}"
-
-
-- name: Listar conteúdo do diretório remoto
-  shell: ls -l /tmp/cloudflare/kubernetes-files/files
-  register: resultado_ls
-
-
-- name: Mostrar resultado do ls
-  debug:
-    var: resultado_ls.stdout_lines
-
-
-- name: Aplicar o stolon
-  become: yes
-  become_user: fenix 
-  shell: |
-    kubectl apply -f /tmp/cloudflare/kubernetes-files/files/
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config

roles/cloudflared/vars/main.yml

@@ -1,4 +0,0 @@
-bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
-VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
-BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
-BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/jellyfin/files/jellyfin-deployment.yaml

@@ -1,56 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: jellyfin
-  namespace: stack-arr
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: jellyfin
-  template:
-    metadata:
-      labels:
-        app: jellyfin
-    spec:
-      imagePullSecrets:
-      - name: regcred
-      containers:
-      - name: jellyfin
-        image: lscr.io/linuxserver/jellyfin:10.11.2
-        securityContext:
-          capabilities:
-            add:
-              - NET_ADMIN
-        ports:
-          - containerPort: 8096
-            name: webui
-          - containerPort: 8920
-            name: webuihttps
-          - containerPort: 1900
-            name: dlnaudp
-          - containerPort: 7359
-            name: discoveryudp
-        env:
-        - name: PUID
-          value: "1013"
-        - name: PGID
-          value: "1013"
-        - name: TZ
-          value: 'Etc/UTC'
-        volumeMounts:
-        - name: config
-          mountPath: /config
-        - name: videos
-          mountPath: /videos
-      volumes:
-      - name: config
-        persistentVolumeClaim:
-          claimName: jellyfin-config-pvc
-      - name: videos
-        persistentVolumeClaim:
-          claimName: jellyfin-videos-pvc
-
-
-
-

roles/jellyfin/files/jellyfin-nfs-csi.yaml

@@ -1,23 +0,0 @@
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: jellyfin-nfs-csi
-  namespace: stack-arr
-provisioner: nfs.csi.k8s.io
-parameters:
-  server: 192.168.1.22
-  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/jellyfin
-allowVolumeExpansion: true
-reclaimPolicy: Retain
----
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: jellyfin-videos-nfs-csi
-  namespace: stack-arr
-provisioner: nfs.csi.k8s.io
-parameters:
-  server: 192.168.1.22
-  share: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series
-allowVolumeExpansion: true
-reclaimPolicy: Retain

roles/jellyfin/files/jellyfin-pvcs.yaml

@@ -1,60 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: jellyfin-config-pv
-  namespace: stack-arr
-spec:
-  capacity:
-    storage: 2Gi
-  storageClassName: jellyfin-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  nfs:
-    server: 192.168.1.22
-    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/jellyfin/config
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-config-pvc
-  namespace: stack-arr
-spec:
-  storageClassName: jellyfin-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  volumeName: jellyfin-config-pv
-  resources:
-    requests:
-      storage: 2Gi
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: jellyfin-videos-pv
-  namespace: stack-arr
-spec:
-  capacity:
-    storage: 150Gi
-  storageClassName: jellyfin-videos-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  nfs:
-    server: 192.168.1.22
-    path: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-videos-pvc
-  namespace: stack-arr
-spec:
-  storageClassName: jellyfin-videos-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  volumeName: jellyfin-videos-pv
-  resources:
-    requests:
-      storage: 150Gi
----

roles/jellyfin/files/jellyfin-service.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: jellyfin-service
-  namespace: stack-arr
-spec:
-  ports:
-    - port: 8096
-      targetPort: 8096
-      name: webui
-    - port: 8920
-      targetPort: 8920
-      name: webuihttps
-    - port: 1900
-      targetPort: 1900
-      name: dlnaudp
-    - port: 7359
-      targetPort: 7359
-      name: discoveryudp
-  selector:
-    app: jellyfin
-  type: ClusterIP

roles/jellyfin/tasks/main.yml

@@ -1,51 +0,0 @@
-- name: Remover o diretório /tmp/stack-arr/jellyfin/kubernetes-files
-  ansible.builtin.file:
-    path: /tmp/stack-arr/jellyfin/kubernetes-files
-    state: absent
-
-- name: Criar diretório temporário no remoto
-  file:
-    path: /tmp/stack-arr/jellyfin/kubernetes-files
-    state: directory
-    mode: '0755'
-
-- name: Copy file with owner and permissions
-  ansible.builtin.copy:
-    src: ../files
-    dest: /tmp/stack-arr/jellyfin/kubernetes-files
-    owner: fenix
-    group: root
-    mode: '0644'
-
-
-#- name: Obter várias notas do Bitwarden
-#  shell: |
-#    echo "unlock"
-#    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
-#    echo "get item"
-#    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
-#  loop:
-#    - { id: "iac.ansible.stackarr.jellyfin.secret", dest: "/tmp/stack-arr/jellyfin/kubernetes-files/files/jelly-secret.yaml" }
-#  args:
-#    executable: /bin/bash
-#  environment:
-#    BW_PASSWORD: "{{ BW_PASSWORD }}"
-
-
-- name: Listar conteúdo do diretório remoto
-  shell: ls -l /tmp/stack-arr/jellyfin/kubernetes-files/files
-  register: resultado_ls
-
-
-- name: Mostrar resultado do ls
-  debug:
-    var: resultado_ls.stdout_lines
-
-
-- name: Aplicar o stolon
-  become: yes
-  become_user: fenix 
-  shell: |
-    kubectl apply -f /tmp/stack-arr/jellyfin/kubernetes-files/files/
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config

roles/jellyfin/vars/main.yml

@@ -1,4 +0,0 @@
-bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
-VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
-BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
-BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/kube-master/tasks/main.yml

@@ -22,7 +22,7 @@
   replace:
     path: /tmp/kube-flannel.yml
     regexp: '10\.244\.0\.0/16'
-    replace: '10.240.0.0/16' # .3.
+    replace: '10.244.0.0/16' # .3.
 
 - name: Corrigir net-conf.json no manifest do Flannel
   become: true
@@ -55,9 +55,8 @@
     argv:
       - kubeadm
       - init
-      - --pod-network-cidr=10.240.0.0/16 # .3. 
+      - --pod-network-cidr=10.244.0.0/16 # .3. 
-      - --apiserver-advertise-address=192.168.1.50
+      - --apiserver-advertise-address=192.168.1.150
-      - --service-cidr=10.95.0.0/16
     creates: /etc/kubernetes/admin.conf 
 
 
@@ -103,37 +102,6 @@
   delay: 6
   become: yes
 
-
-- name: kubernetes untaint node-role.kubernetes.io/control-plane:NoSchedule
-  become: true
-  shell: |
-      kubectl taint nodes --all node-role.kubernetes.io/control-plane:NoSchedule-
-  become_user: fenix 
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config
-  ignore_errors: yes
-
-
-- name: kubernetes unlabel node-role.kubernetes.io/control-plane
-  become: true
-  shell: |
-      kubectl label nodes --all node-role.kubernetes.io/control-plane-
-  become_user: fenix 
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config
-  ignore_errors: yes
-
-- name: kubernetes unlabel node.kubernetes.io/exclude-from-external-load-balancers
-  become: true
-  shell: |
-      kubectl label nodes --all node.kubernetes.io/exclude-from-external-load-balancers-
-  become_user: fenix 
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config
-  ignore_errors: yes
-
-
-
 - name: cat flannel
   become: true
   shell: |
@@ -165,81 +133,6 @@
   delay: 6
   become: yes
 
-- name: Instalar Helm no nó master
-  become: true
-  shell: |
-    curl -fsSL https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
-  args:
-    creates: /usr/local/bin/helm
-    
-- name: Adicionar repositório Helm do CSI NFS
-  command: >
-    helm repo add csi-driver-nfs https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
-  args:
-    creates: /root/.cache/helm/repository/csi-driver-nfs-index.yaml
-
-- name: Atualizar repositórios Helm
-  command: helm repo update
-  
-- name: Instalar CSI NFS Driver via Helm
-  command: helm upgrade --install csi-driver-nfs csi-driver-nfs/csi-driver-nfs --namespace kube-system --version 4.12.0
-  register: resultado_nfs
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config
-
- 
-- name: Mostrar resultado do nfs csi driver
-  debug:
-    var: resultado_nfs.stdout_lines
-
-
-- name: Instalar MetalLB (manifest oficial)
-  shell: kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.13.9/config/manifests/metallb-native.yaml
-  become_user: fenix 
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config
-
-- name: Esperar pelo webhook do MetalLB
-  shell: kubectl get endpoints webhook-service -n metallb-system -o jsonpath='{.subsets[*].addresses[*].ip}'
-  register: webhook_ready
-  until: webhook_ready.stdout != ""
-  retries: 10
-  delay: 10
-  become_user: fenix 
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config
-
-- name: Criar IP pool
-  shell: |
-    cat <<EOF | kubectl apply -f -
-    apiVersion: metallb.io/v1beta1
-    kind: IPAddressPool
-    metadata:
-      name: local-pool
-      namespace: metallb-system
-    spec:
-      addresses:
-        - 10.240.0.100-10.240.0.250
-    EOF
-  become_user: fenix 
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config
-
-- name: Criar anúncio L2
-  shell: |
-    cat <<EOF | kubectl apply -f -
-    apiVersion: metallb.io/v1beta1
-    kind: L2Advertisement
-    metadata:
-      name: advert
-      namespace: metallb-system
-    EOF
-  become_user: fenix 
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config
-
-
-
 - name: Get kubeadm join command
   become: true
   shell: kubeadm token create --print-join-command

roles/kube-master/tasks/patch_netconf.py

@@ -10,7 +10,7 @@ with open("/tmp/kube-flannel.yml", "r") as f:
 for doc in docs:
     if doc.get("kind") == "ConfigMap" and doc.get("metadata", {}).get("name") == "kube-flannel-cfg":
         doc["data"]["net-conf.json"] = '''{
-  "Network": "10.240.0.0/16",
+  "Network": "10.244.0.0/16",
   "Backend": {
     "Type": "vxlan"
   },

roles/kubernetes/tasks/main.yml

@@ -88,7 +88,6 @@
       - kubelet
       - kubeadm
       - kubectl
-      - nfs-common
     state: present
     update_cache: yes
 
@@ -162,5 +161,3 @@
     owner: root
     group: root
     mode: '0644'
-
-

roles/prowlarr/files/prowlarr-deployment.yaml

@@ -1,67 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: prowlarr
-  namespace: stack-arr
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: prowlarr
-  template:
-    metadata:
-      labels:
-        app: prowlarr
-    spec:
-      imagePullSecrets:
-      - name: regcred
-      containers:
-      - name: prowlarr
-        image: lscr.io/linuxserver/prowlarr:2.1.5
-        securityContext:
-          capabilities:
-            add:
-              - NET_ADMIN
-        ports:
-          - containerPort: 9696
-            name: webui
-        env:
-        - name: PUID
-          value: "1013"
-        - name: PGID
-          value: "1013"
-        - name: TZ
-          value: 'Etc/UTC'
-        - name: PROWLARR__POSTGRES__HOST
-          value: 'stolon-proxy-service.postgresql.svc.cluster.local'
-        - name: PROWLARR__POSTGRES__USER
-          valueFrom:
-            secretKeyRef:
-              name: prowlarr-secret
-              key: username
-        - name: PROWLARR__POSTGRES__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: prowlarr-secret
-              key: password
-        - name: PROWLARR__POSTGRES__MAINDB
-          valueFrom:
-            secretKeyRef:
-              name: prowlarr-secret
-              key: maindb
-        - name: PROWLARR__POSTGRES__LOGDB
-          valueFrom:
-            secretKeyRef:
-              name: prowlarr-secret
-              key: logsdb
-        volumeMounts:
-        - name: config
-          mountPath: /config
-      volumes:
-      - name: config
-        persistentVolumeClaim:
-          claimName: prowlarr-config-pvc
-
-
-
-

roles/prowlarr/files/prowlarr-nfs-csi.yaml

@@ -1,11 +0,0 @@
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: prowlarr-nfs-csi
-  namespace: stack-arr
-provisioner: nfs.csi.k8s.io
-parameters:
-  server: 192.168.1.22
-  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/prowlarr
-allowVolumeExpansion: true
-reclaimPolicy: Retain

roles/prowlarr/files/prowlarr-pvcs.yaml

@@ -1,30 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: prowlarr-config-pv
-  namespace: stack-arr
-spec:
-  capacity:
-    storage: 2Gi
-  storageClassName: prowlarr-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  nfs:
-    server: 192.168.1.22
-    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/prowlarr/config
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: prowlarr-config-pvc
-  namespace: stack-arr
-spec:
-  storageClassName: prowlarr-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  volumeName: prowlarr-config-pv
-  resources:
-    requests:
-      storage: 2Gi
----

roles/prowlarr/files/prowlarr-secret.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name:  prowlarr-secret
-    namespace: stack-arr
-type: Opaque
-data:
-    username: dXNlcm5hbWU=
-    password: cGFzc3dvcmQ=
-    maindb: bWFpbmRiLXByb3dsYXJy
-    logsdb: bG9nZGItcHJvd2xhcnI=

roles/prowlarr/files/prowlarr-service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: prowlarr-service
-  namespace: stack-arr
-spec:
-  ports:
-    - port: 9696
-      targetPort: 9696
-  selector:
-    app: prowlarr
-  type: ClusterIP

roles/prowlarr/tasks/main.yml

@@ -1,51 +0,0 @@
-- name: Remover o diretório /tmp/stack-arr/prowlarr/kubernetes-files
-  ansible.builtin.file:
-    path: /tmp/stack-arr/prowlarr/kubernetes-files
-    state: absent
-
-- name: Criar diretório temporário no remoto
-  file:
-    path: /tmp/stack-arr/prowlarr/kubernetes-files
-    state: directory
-    mode: '0755'
-
-- name: Copy file with owner and permissions
-  ansible.builtin.copy:
-    src: ../files
-    dest: /tmp/stack-arr/prowlarr/kubernetes-files
-    owner: fenix
-    group: root
-    mode: '0644'
-
-
-- name: Obter várias notas do Bitwarden
-  shell: |
-    echo "unlock"
-    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
-    echo "get item"
-    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
-  loop:
-    - { id: "iac.ansible.stackarr.prowlarr.secret", dest: "/tmp/stack-arr/prowlarr/kubernetes-files/files/prowlarr-secret.yaml" }
-  args:
-    executable: /bin/bash
-  environment:
-    BW_PASSWORD: "{{ BW_PASSWORD }}"
-
-
-- name: Listar conteúdo do diretório remoto
-  shell: ls -l /tmp/stack-arr/prowlarr/kubernetes-files/files
-  register: resultado_ls
-
-
-- name: Mostrar resultado do ls
-  debug:
-    var: resultado_ls.stdout_lines
-
-
-- name: Aplicar o stolon
-  become: yes
-  become_user: fenix 
-  shell: |
-    kubectl apply -f /tmp/stack-arr/prowlarr/kubernetes-files/files/
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config

roles/prowlarr/vars/main.yml

@@ -1,4 +0,0 @@
-bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
-VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
-BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
-BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/qbittorrent/files/docker-secrets.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: regcred
-  namespace: stack-arr
-data:
-  .dockerconfigjson: >-
-    eyJhdXRocyI6eyJodHRwczovL2luZGV4LmRvY2tlci5pby92MS8iOnsidXNlcm5hbWUiOiJ1c2VyIiwicGFzc3dvcmQiOiJwYXNzIiwiYXV0aCI6ImRmamlla2ZlcldFS1dFa29mY2RrbzM0MzUzZmQ9In19fQ==
-type: kubernetes.io/dockerconfigjson

roles/qbittorrent/files/qbittorrent-deployment.yaml

@@ -1,67 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: qbittorrentvpn
-  namespace: stack-arr
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: qbittorrentvpn
-  template:
-    metadata:
-      labels:
-        app: qbittorrentvpn
-    spec:
-      imagePullSecrets:
-      - name: regcred
-      containers:
-      - name: qbittorrentvpn
-        image: j4ym0/pia-qbittorrent:5.1.2-ubuntu
-        securityContext:
-          capabilities:
-            add:
-              - NET_ADMIN
-        ports:
-          - containerPort: 8080
-            name: webui
-          - containerPort: 51413
-            name: torrent-tcp
-          - containerPort: 51413
-            name: torrent-udp
-            protocol: UDP
-        env:
-        - name: USER
-          valueFrom:
-            secretKeyRef:
-              name: vpn-secret
-              key: username
-        - name: PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: vpn-secret
-              key: password
-        - name: REGION
-          value: "us_east"  # ou outro servidor PIA
-        - name: WEBUI_PORT
-          value: "8080"
-        - name: DNS_SERVERS
-          value: "1.1.1.1,1.0.0.1"
-        - name: UID
-          value: "1013"
-        - name: GID
-          value: "1013"
-        - name: HOSTHEADERVALIDATION
-          value: 'false'
-        volumeMounts:
-        - name: config
-          mountPath: /config
-        - name: downloads
-          mountPath: /downloads
-      volumes:
-      - name: config
-        persistentVolumeClaim:
-          claimName: qbittorrent-config-pvc
-      - name: downloads
-        persistentVolumeClaim:
-          claimName: qbittorrent-downloads-pvc

roles/qbittorrent/files/qbittorrent-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: stack-arr

roles/qbittorrent/files/qbittorrent-nfs-csi.yaml

@@ -1,11 +0,0 @@
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: qbittorrent-nfs-csi
-  namespace: stack-arr
-provisioner: nfs.csi.k8s.io
-parameters:
-  server: 192.168.1.22
-  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/bittorrent
-allowVolumeExpansion: true
-reclaimPolicy: Retain

roles/qbittorrent/files/qbittorrent-pvcs.yaml

@@ -1,60 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: qbittorrent-config-pv
-  namespace: stack-arr
-spec:
-  capacity:
-    storage: 2Gi
-  storageClassName: qbittorrent-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  nfs:
-    server: 192.168.1.22
-    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/bittorrent/config
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: qbittorrent-config-pvc
-  namespace: stack-arr
-spec:
-  storageClassName: qbittorrent-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  volumeName: qbittorrent-config-pv
-  resources:
-    requests:
-      storage: 2Gi
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: qbittorrent-downloads-pv
-  namespace: stack-arr
-spec:
-  capacity:
-    storage: 10Gi
-  storageClassName: qbittorrent-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  nfs:
-    server: 192.168.1.22
-    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/bittorrent/downloads
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: qbittorrent-downloads-pvc
-  namespace: stack-arr
-spec:
-  storageClassName: qbittorrent-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  volumeName: qbittorrent-downloads-pv
-  resources:
-    requests:
-      storage: 10Gi
----

roles/qbittorrent/files/qbittorrent-service.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: qbittorrent-service
-  namespace: stack-arr
-spec:
-  ports:
-    - port: 8080
-      targetPort: 8080
-  selector:
-    app: qbittorrentvpn
-  type: LoadBalancer
-  loadBalancerIP: 10.240.0.101

roles/qbittorrent/files/vpn-secret.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name:  vpn-secret
-    namespace: stack-arr
-type: Opaque
-data:
-    username: dXNlcm5hbWU=
-    password: cGFzc3dvcmQ=

roles/qbittorrent/tasks/main.yml

@@ -1,51 +0,0 @@
-- name: Remover o diretório /tmp/stack-arr/qbittorrent/kubernetes-files
-  ansible.builtin.file:
-    path: /tmp/stack-arr/qbittorrent/kubernetes-files
-    state: absent
-
-- name: Criar diretório temporário no remoto
-  file:
-    path: /tmp/stack-arr/qbittorrent/kubernetes-files
-    state: directory
-    mode: '0755'
-
-- name: Copy file with owner and permissions
-  ansible.builtin.copy:
-    src: ../files
-    dest: /tmp/stack-arr/qbittorrent/kubernetes-files
-    owner: fenix
-    group: root
-    mode: '0644'
-
-- name: Obter várias notas do Bitwarden
-  shell: |
-    echo "unlock"
-    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
-    echo "get item"
-    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
-  loop:
-    - { id: "iac.ansible.stackarr.qbittorrent.dockersecrets", dest: "/tmp/stack-arr/qbittorrent/kubernetes-files/files/docker-secrets.yaml" }
-    - { id: "iac.ansible.stackarr.qbittorrent.secret", dest: "/tmp/stack-arr/qbittorrent/kubernetes-files/files/vpn-secret.yaml" }
-  args:
-    executable: /bin/bash
-  environment:
-    BW_PASSWORD: "{{ BW_PASSWORD }}"
-
-
-- name: Listar conteúdo do diretório remoto
-  shell: ls -l /tmp/stack-arr/qbittorrent/kubernetes-files/files
-  register: resultado_ls
-
-- name: Mostrar resultado do ls
-  debug:
-    var: resultado_ls.stdout_lines
-
-
-- name: Aplicar o qbittorrent
-  become: yes
-  become_user: fenix 
-  shell: |
-    kubectl apply -f /tmp/stack-arr/qbittorrent/kubernetes-files/files/qbittorrent-namespace.yaml
-    kubectl apply -f /tmp/stack-arr/qbittorrent/kubernetes-files/files/
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config

roles/qbittorrent/vars/main.yml

@@ -1,4 +0,0 @@
-bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
-VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
-BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
-BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/sonarr/files/sonarr-deployment.yaml

@@ -1,77 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: sonarr
-  namespace: stack-arr
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: sonarr
-  template:
-    metadata:
-      labels:
-        app: sonarr
-    spec:
-      imagePullSecrets:
-      - name: regcred
-      containers:
-      - name: sonarr
-        image: lscr.io/linuxserver/sonarr:4.0.16
-        securityContext:
-          capabilities:
-            add:
-              - NET_ADMIN
-        ports:
-          - containerPort: 8989
-            name: webui
-        env:
-        - name: PUID
-          value: "1013"
-        - name: PGID
-          value: "1013"
-        - name: TZ
-          value: 'Etc/UTC'
-        - name: SONARR__POSTGRES__HOST
-          value: 'stolon-proxy-service.postgresql.svc.cluster.local'
-        - name: SONARR__POSTGRES__USER
-          valueFrom:
-            secretKeyRef:
-              name: sonarr-secret
-              key: username
-        - name: SONARR__POSTGRES__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: sonarr-secret
-              key: password
-        - name: SONARR__POSTGRES__MAINDB
-          valueFrom:
-            secretKeyRef:
-              name: sonarr-secret
-              key: maindb
-        - name: SONARR__POSTGRES__LOGDB
-          valueFrom:
-            secretKeyRef:
-              name: sonarr-secret
-              key: logsdb
-        volumeMounts:
-        - name: config
-          mountPath: /config
-        - name: downloads
-          mountPath: /downloads
-        - name: tv
-          mountPath: /tv
-      volumes:
-      - name: config
-        persistentVolumeClaim:
-          claimName: sonarr-config-pvc
-      - name: downloads
-        persistentVolumeClaim:
-          claimName: qbittorrent-downloads-pvc
-      - name: tv
-        persistentVolumeClaim:
-          claimName: sonarr-tv-pvc
-
-
-
-

roles/sonarr/files/sonarr-nfs-csi.yaml

@@ -1,23 +0,0 @@
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: sonarr-nfs-csi
-  namespace: stack-arr
-provisioner: nfs.csi.k8s.io
-parameters:
-  server: 192.168.1.22
-  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/sonarr
-allowVolumeExpansion: true
-reclaimPolicy: Retain
----
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: sonarr-tv-nfs-csi
-  namespace: stack-arr
-provisioner: nfs.csi.k8s.io
-parameters:
-  server: 192.168.1.22
-  share: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series/TV
-allowVolumeExpansion: true
-reclaimPolicy: Retain

roles/sonarr/files/sonarr-pvcs.yaml

@@ -1,60 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: sonarr-config-pv
-  namespace: stack-arr
-spec:
-  capacity:
-    storage: 2Gi
-  storageClassName: sonarr-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  nfs:
-    server: 192.168.1.22
-    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/sonarr/config
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sonarr-config-pvc
-  namespace: stack-arr
-spec:
-  storageClassName: sonarr-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  volumeName: sonarr-config-pv
-  resources:
-    requests:
-      storage: 2Gi
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: sonarr-tv-pv
-  namespace: stack-arr
-spec:
-  capacity:
-    storage: 50Gi
-  storageClassName: sonarr-tv-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  nfs:
-    server: 192.168.1.22
-    path: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series/TV
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sonarr-tv-pvc
-  namespace: stack-arr
-spec:
-  storageClassName: sonarr-tv-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  volumeName: sonarr-tv-pv
-  resources:
-    requests:
-      storage: 50Gi
----

roles/sonarr/files/sonarr-secret.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name:  sonarr-secret
-    namespace: stack-arr
-type: Opaque
-data:
-    username: dXNlcm5hbWU=
-    password: cGFzc3dvcmQ=
-    maindb: bWFpbmRiLXByb3dsYXJy
-    logsdb: bG9nZGItcHJvd2xhcnI=

roles/sonarr/files/sonarr-service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: sonarr-service
-  namespace: stack-arr
-spec:
-  ports:
-    - port: 8989
-      targetPort: 8989
-  selector:
-    app: sonarr
-  type: ClusterIP

roles/sonarr/tasks/main.yml

@@ -1,51 +0,0 @@
-- name: Remover o diretório /tmp/stack-arr/sonarr/kubernetes-files
-  ansible.builtin.file:
-    path: /tmp/stack-arr/sonarr/kubernetes-files
-    state: absent
-
-- name: Criar diretório temporário no remoto
-  file:
-    path: /tmp/stack-arr/sonarr/kubernetes-files
-    state: directory
-    mode: '0755'
-
-- name: Copy file with owner and permissions
-  ansible.builtin.copy:
-    src: ../files
-    dest: /tmp/stack-arr/sonarr/kubernetes-files
-    owner: fenix
-    group: root
-    mode: '0644'
-
-
-- name: Obter várias notas do Bitwarden
-  shell: |
-    echo "unlock"
-    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
-    echo "get item"
-    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
-  loop:
-    - { id: "iac.ansible.stackarr.sonarr.secret", dest: "/tmp/stack-arr/sonarr/kubernetes-files/files/sonarr-secret.yaml" }
-  args:
-    executable: /bin/bash
-  environment:
-    BW_PASSWORD: "{{ BW_PASSWORD }}"
-
-
-- name: Listar conteúdo do diretório remoto
-  shell: ls -l /tmp/stack-arr/sonarr/kubernetes-files/files
-  register: resultado_ls
-
-
-- name: Mostrar resultado do ls
-  debug:
-    var: resultado_ls.stdout_lines
-
-
-- name: Aplicar o stolon
-  become: yes
-  become_user: fenix 
-  shell: |
-    kubectl apply -f /tmp/stack-arr/sonarr/kubernetes-files/files/
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config

roles/sonarr/vars/main.yml

@@ -1,4 +0,0 @@
-bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
-VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
-BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
-BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/stolon/files/docker-secrets.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: regcred
-  namespace: postgresql
-data:
-  .dockerconfigjson: >-
-    eyJhdXRocyI6eyJodHRwczovL2luZGV4LmRvY2tlci5pby92MS8iOnsidXNlcm5hbWUiOiJ1c2VyIiwicGFzc3dvcmQiOiJwYXNzIiwiYXV0aCI6ImRmamlla2ZlcldFS1dFa29mY2RrbzM0MzUzZmQ9In19fQ==
-type: kubernetes.io/dockerconfigjson

roles/stolon/files/stolon-keeper.yaml

@@ -1,126 +0,0 @@
-# PetSet was renamed to StatefulSet in k8s 1.5
-# apiVersion: apps/v1alpha1
-# kind: PetSet
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: stolon-keeper
-  namespace: postgresql
-spec:
-  serviceName: "stolon-keeper"
-  replicas: 3
-  selector:
-    matchLabels:
-      component: stolon-keeper
-      stolon-cluster: kube-stolon
-  template:
-    metadata:
-      labels:
-        component: stolon-keeper
-        stolon-cluster: kube-stolon
-      annotations:
-        pod.alpha.kubernetes.io/initialized: "true"
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8080"
-    spec:
-      imagePullSecrets:
-      - name: regcred
-      terminationGracePeriodSeconds: 10
-      containers:
-        - name: stolon-keeper
-          image: sorintlab/stolon:master-pg15
-          command:
-            - "/bin/bash"
-            - "-ec"
-            - |
-
-              echo "COMECANDO com user 1013"
-              useradd -u 1013 -r -s /usr/sbin/nologin fenixuser
-              id
-              id stolon
-              # Generate our keeper uid using the pod index
-              IFS='-' read -ra ADDR <<< "$(hostname)"
-              export STKEEPER_UID="keeper${ADDR[-1]}"
-              export POD_IP=$(hostname -i)
-              export STKEEPER_PG_LISTEN_ADDRESS=$POD_IP
-              
-              which psql
-              which postgres
-              which pg_ctl
-
-
-              export STOLON_DATA=/stolon-data/data
-              mkdir -p $STOLON_DATA
-
-
-              ls -la $STOLON_DATA
-
-              exec gosu 1013 stolon-keeper --data-dir $STOLON_DATA
-
-
-
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: STKEEPER_CLUSTER_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.labels['stolon-cluster']
-            - name: STKEEPER_STORE_BACKEND
-              value: "kubernetes"
-            - name: STKEEPER_KUBE_RESOURCE_KIND
-              value: "configmap"
-            - name: STKEEPER_PG_REPL_USERNAME
-              #value: "repluser"
-              valueFrom:
-                secretKeyRef:
-                  name: stolon-repl-secret
-                  key: username
-            - name: STKEEPER_PG_REPL_PASSWORD
-              #value: "replpassword"
-              valueFrom:
-                secretKeyRef:
-                  name: stolon-repl-secret
-                  key: password
-            - name: STKEEPER_PG_SU_USERNAME
-              #value: "stolon"
-              valueFrom:
-                secretKeyRef:
-                  name: stolon-secret
-                  key: username
-            - name: STKEEPER_PG_SU_PASSWORDFILE
-              value: "/etc/secrets/stolon/password"
-            - name: STKEEPER_METRICS_LISTEN_ADDRESS
-              value: "0.0.0.0:8080"
-            # Uncomment this to enable debug logs
-            #- name: STKEEPER_DEBUG
-            #  value: "true"
-          ports:
-            - containerPort: 5432
-            - containerPort: 8080
-          volumeMounts:
-            - mountPath: /stolon-data
-              name: stolon-data
-            - mountPath: /etc/secrets/stolon
-              name: stolon
-      volumes:
-        - name: stolon
-          secret:
-            secretName: stolon-secret
-  volumeClaimTemplates:
-    - kind: PersistentVolumeClaim
-      apiVersion: v1
-      metadata:
-        name: stolon-data
-        namespace: postgresql
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: 10Gi
-        selector:
-          matchLabels:
-            postgres-id: "stolon-0" 

roles/stolon/files/stolon-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: postgresql

roles/stolon/files/stolon-nfs-csi.yaml

@@ -1,11 +0,0 @@
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: stolon-nfs-csi
-  namespace: postgresql
-provisioner: nfs.csi.k8s.io
-parameters:
-  server: 192.168.1.22
-  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/postgresql-stolon
-allowVolumeExpansion: true
-reclaimPolicy: Retain

roles/stolon/files/stolon-proxy-service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: stolon-proxy-service
-  namespace: postgresql
-spec:
-  ports:
-    - port: 5432
-      targetPort: 5432
-  selector:
-    component: stolon-proxy
-    stolon-cluster: kube-stolon
-  type: LoadBalancer
-  loadBalancerIP: 10.240.0.100

roles/stolon/files/stolon-proxy.yaml

@@ -1,58 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: stolon-proxy
-  namespace: postgresql
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      component: stolon-proxy
-      stolon-cluster: kube-stolon
-  template:
-    metadata:
-      labels:
-        component: stolon-proxy
-        stolon-cluster: kube-stolon
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8080"
-    spec:
-      imagePullSecrets:
-      - name: regcred
-      containers:
-        - name: stolon-proxy
-          image: sorintlab/stolon:master-pg10
-          command:
-            - "/bin/bash"
-            - "-ec"
-            - |
-              exec gosu stolon stolon-proxy
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: STPROXY_CLUSTER_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.labels['stolon-cluster']
-            - name: STPROXY_STORE_BACKEND
-              value: "kubernetes"
-            - name: STPROXY_KUBE_RESOURCE_KIND
-              value: "configmap"
-            - name: STPROXY_LISTEN_ADDRESS
-              value: "0.0.0.0"
-            - name: STPROXY_METRICS_LISTEN_ADDRESS
-              value: "0.0.0.0:8080"
-            ## Uncomment this to enable debug logs
-            #- name: STPROXY_DEBUG
-            #  value: "true"
-          ports:
-            - containerPort: 5432
-            - containerPort: 8080
-          readinessProbe:
-            tcpSocket:
-              port: 5432
-            initialDelaySeconds: 10
-            timeoutSeconds: 5

roles/stolon/files/stolon-pvcs.yaml

@@ -1,111 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: stolon-pv-0
-  namespace: postgresql
-  labels:
-    postgres-id: "stolon-0"
-spec:
-  capacity:
-    storage: 10Gi
-  storageClassName: stolon-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  nfs:
-    server: 192.168.1.22
-    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/postgresql-stolon/keeper-0
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: stolon-pv-1
-  namespace: postgresql
-  labels:
-    postgres-id: "stolon-0"
-spec:
-  capacity:
-    storage: 10Gi
-  storageClassName: stolon-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  nfs:
-    server: 192.168.1.22
-    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/postgresql-stolon/keeper-1
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: stolon-pv-2
-  namespace: postgresql
-  labels:
-    postgres-id: "stolon-0"
-spec:
-  capacity:
-    storage: 10Gi
-  storageClassName: stolon-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  nfs:
-    server: 192.168.1.22
-    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/postgresql-stolon/keeper-2
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: stolon-data-stolon-keeper-0
-  namespace: postgresql
-  labels:
-    postgres-id: "stolon-0"
-spec:
-  storageClassName: stolon-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  volumeName: stolon-pv-0
-  resources:
-    requests:
-      storage: 10Gi
-  selector:
-    matchLabels:
-      postgres-id: "stolon-0"
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: stolon-data-stolon-keeper-1
-  namespace: postgresql
-  labels:
-    postgres-id: "stolon-0"
-spec:
-  storageClassName: stolon-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  volumeName: stolon-pv-1
-  resources:
-    requests:
-      storage: 10Gi
-  selector:
-    matchLabels:
-      postgres-id: "stolon-0"
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: stolon-data-stolon-keeper-2
-  namespace: postgresql
-  labels:
-    postgres-id: "stolon-0"
-spec:
-  storageClassName: stolon-nfs-csi
-  accessModes:
-    - ReadWriteOnce
-  volumeName: stolon-pv-2
-  resources:
-    requests:
-      storage: 10Gi
-  selector:
-    matchLabels:
-      postgres-id: "stolon-0"
----

roles/stolon/files/stolon-repl-secret.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: stolon-repl-secret
-    namespace: postgresql
-type: Opaque
-data:
-    username: asOndDQ5aWZqa2w0aW85
-    password: asOndDQ5aWZqa2w0aW85

roles/stolon/files/stolon-role-binding.yaml

@@ -1,13 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: stolon-role-binding
-  namespace: postgresql
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: stolon-role
-subjects:
-- kind: ServiceAccount
-  name: default
-  namespace: postgresql

roles/stolon/files/stolon-role.yaml

@@ -1,14 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: stolon-role
-  namespace: postgresql
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - configmaps
-  - events
-  verbs:
-  - "*"

roles/stolon/files/stolon-secret.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: stolon-secret
-    namespace: postgresql
-type: Opaque
-data:
-    username: asOndDQ5aWZqa2w0aW85
-    password: asOndDQ5aWZqa2w0aW85

roles/stolon/files/stolon-sentinel.yaml

@@ -1,50 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: stolon-sentinel
-  namespace: postgresql
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      component: stolon-sentinel
-      stolon-cluster: kube-stolon
-  template:
-    metadata:
-      labels:
-        component: stolon-sentinel
-        stolon-cluster: kube-stolon
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8080"
-    spec:
-      imagePullSecrets:
-      - name: regcred
-      containers:
-        - name: stolon-sentinel
-          image: sorintlab/stolon:master-pg10
-          command:
-            - "/bin/bash"
-            - "-ec"
-            - |
-              exec gosu stolon stolon-sentinel
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: STSENTINEL_CLUSTER_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.labels['stolon-cluster']
-            - name: STSENTINEL_STORE_BACKEND
-              value: "kubernetes"
-            - name: STSENTINEL_KUBE_RESOURCE_KIND
-              value: "configmap"
-            - name: STSENTINEL_METRICS_LISTEN_ADDRESS
-              value: "0.0.0.0:8080"
-            ## Uncomment this to enable debug logs
-            #- name: STSENTINEL_DEBUG
-            #  value: "true"
-          ports:
-            - containerPort: 8080

roles/stolon/tasks/main.yml

@@ -1,63 +0,0 @@
-- name: Remover o diretório /tmp/stolon/kubernetes-files
-  ansible.builtin.file:
-    path: /tmp/stolon/kubernetes-files
-    state: absent
-
-- name: Criar diretório temporário no remoto
-  file:
-    path: /tmp/stolon/kubernetes-files
-    state: directory
-    mode: '0755'
-
-- name: Copy file with owner and permissions
-  ansible.builtin.copy:
-    src: ../files
-    dest: /tmp/stolon/kubernetes-files
-    owner: fenix
-    group: root
-    mode: '0644'
-
-- name: Listar conteúdo do diretório remoto
-  shell: ls -l /tmp/stolon/kubernetes-files/files
-  register: resultado_ls
-
-
-- name: Obter várias notas do Bitwarden
-  shell: |
-    echo "unlock"
-    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
-    echo "get item"
-    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
-  loop:
-    - { id: "iac.ansible.dockersecrets", dest: "/tmp/stolon/kubernetes-files/files/docker-secrets.yaml" }
-    - { id: "iac.ansible.stolon.repl.secret", dest: "/tmp/stolon/kubernetes-files/files/stolon-repl-secret.yaml" }
-    - { id: "iac.ansible.stolon.keeper.secret", dest: "/tmp/stolon/kubernetes-files/files/stolon-secret.yaml" }
-  args:
-    executable: /bin/bash
-  environment:
-    BW_PASSWORD: "{{ BW_PASSWORD }}"
-
-
-- name: Mostrar resultado do ls
-  debug:
-    var: resultado_ls.stdout_lines
-
-- name: Aplicar o stolon
-  become: yes
-  become_user: fenix 
-  shell: |
-    kubectl apply -f /tmp/stolon/kubernetes-files/files/stolon-namespace.yaml
-    kubectl apply -f /tmp/stolon/kubernetes-files/files/
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config
-
-
-- name: reabilitar database stolon
-  become: yes
-  become_user: fenix 
-  shell: |
-    kubectl run -i -n=postgresql -t stolonctl --image=sorintlab/stolon:master-pg15 --restart=Never --rm -- /usr/local/bin/stolonctl  --cluster-name kube-stolon --store-backend kubernetes --kube-resource-kind=configmap init -y '{"initMode":"existing","existingConfig": {"keeperUID": "keeper0","followersUIDs": ["keeper1","keeper2"]}}'
-    # run this if first time setting up database
-    #    kubectl run -i -n=postgresql -t stolonctl --image=sorintlab/stolon:master-pg15 --restart=Never --rm -- /usr/local/bin/stolonctl --cluster-name=kube-stolon --store-backend=kubernetes --kube-resource-kind=configmap init --yes
-  environment:
-    KUBECONFIG:  /home/fenix/.kube/config

roles/stolon/vars/main.yml

@@ -1,4 +0,0 @@
-bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
-VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
-BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
-BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/vaultwarden/tasks/main.yml

@@ -1,77 +0,0 @@
-- name: Atualizar pacotes e instalar dependências básicas
-  become: true
-  apt:
-    name:
-      - curl
-      - git
-      - unzip
-      - jq
-      - gnupg
-      - ca-certificates
-    state: present
-    update_cache: true
-
-- name: Adicionar repositório NodeSource para Node.js 20
-  become: true
-  shell: curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
-  args:
-    executable: /bin/bash
-
-- name: Instalar Node.js 20
-  become: true
-  apt:
-    name: nodejs
-    state: present
-    update_cache: true
-
-- name: Verificar versão do Node.js
-  command: node -v
-  register: node_version
-  changed_when: false
-
-- name: Verificar versão do npm
-  command: npm -v
-  register: npm_version
-  changed_when: false
-  
-- name: Instalar Bitwarden CLI via npm
-  become: true
-  shell: npm install -g @bitwarden/cli
-  args:
-    executable: /bin/bash
-
-- name: Verificar instalação do Bitwarden CLI
-  command: bw --version
-  register: bw_version
-  failed_when: bw_version.rc != 0
-
-- name: Garantir logout do Bitwarden antes de configurar
-  shell: bw logout
-  ignore_errors: true
-
-- name: Fazer login no Bitwarden
-  shell: | 
-    echo "config"
-    echo "VAULTWARDEN_LINK: {{ VAULTWARDEN_LINK }}"
-    bw config server {{ VAULTWARDEN_LINK }}
-    echo $BW_CLIENTID
-    echo $BW_CLIENTSECRET
-    echo "login"
-    bw login --apikey
-  environment:
-    BW_CLIENTID: "{{ BW_CLIENTID }}"
-    BW_CLIENTSECRET: "{{ BW_CLIENTSECRET }}"
-    VAULTWARDEN_LINK: "{{ VAULTWARDEN_LINK }}"
-  args:
-    executable: /bin/bash
-  register: bw_login
-
-- name: Desbloquear cofre e guardar sessão
-  shell: bw unlock {{ bw_password }} --raw
-  register: bw_session
-  environment:
-    BW_PASSWORD: "{{ BW_PASSWORD }}"
-
-- name: Exportar sessão para ambiente local
-  shell: echo "export BW_SESSION={{ bw_session.stdout }}" >> /etc/profile.d/bw-session.sh
-  become: true

roles/vaultwarden/vars/main.yml

@@ -1,4 +0,0 @@
-bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
-VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
-BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
-BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"