Merge branch 'main' of https://gitea.fenix-dev.com/fenix-gitea-admin/iac-ansible-private

playbook.yml

@@ -21,5 +21,8 @@
   become: yes
   roles:
     - stolon
+    - cloudflared
     - qbittorrent
     - prowlarr
+    - sonarr
+    - jellyfin

roles/cloudflared/files/cloudflare-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cloudflare

roles/cloudflared/files/cloudflared-tunnel-deployment.yaml

@@ -0,0 +1,49 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cloudflared-tunnel
+  namespace: cloudflare
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: cloudflared
+  template:
+    metadata:
+      labels:
+        app: cloudflared
+    spec:
+      securityContext:
+        sysctls:
+        # Allows ICMP traffic (ping, traceroute) to resources behind cloudflared.
+          - name: net.ipv4.ping_group_range
+            value: "65532 65532"
+      containers:
+        - image: cloudflare/cloudflared:latest
+          name: cloudflared
+          env:
+            # Defines an environment variable for the tunnel token.
+            - name: TUNNEL_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: tunnel-token-secret
+                  key: token
+          command:
+            # Configures tunnel run parameters
+            - cloudflared
+            - tunnel
+            - --no-autoupdate
+            - --loglevel
+            - debug
+            - --metrics
+            - 0.0.0.0:2000
+            - run
+          livenessProbe:
+            httpGet:
+              # Cloudflared has a /ready endpoint which returns 200 if and only if
+              # it has an active connection to Cloudflare's network.
+              path: /ready
+              port: 2000
+            failureThreshold: 1
+            initialDelaySeconds: 10
+            periodSeconds: 10

roles/cloudflared/files/tunnel-token-secret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: tunnel-token-secret
+    namespace: cloudflare
+type: Opaque
+data:
+    token: <CLOUDFLARE_TUNNEL_TOKEN>

roles/cloudflared/tasks/main.yml

@@ -0,0 +1,51 @@
+- name: Remover o diretório /tmp/cloudflare/kubernetes-files
+  ansible.builtin.file:
+    path: /tmp/cloudflare/kubernetes-files
+    state: absent
+
+- name: Criar diretório temporário no remoto
+  file:
+    path: /tmp/cloudflare/kubernetes-files
+    state: directory
+    mode: '0755'
+
+- name: Copy file with owner and permissions
+  ansible.builtin.copy:
+    src: ../files
+    dest: /tmp/cloudflare/kubernetes-files
+    owner: fenix
+    group: root
+    mode: '0644'
+
+
+- name: Obter várias notas do Bitwarden
+  shell: |
+    echo "unlock"
+    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
+    echo "get item"
+    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
+  loop:
+    - { id: "iac.ansible.cloudflare.tunnel.secret", dest: "/tmp/cloudflare/kubernetes-files/files/tunnel-token-secret.yaml" }
+  args:
+    executable: /bin/bash
+  environment:
+    BW_PASSWORD: "{{ BW_PASSWORD }}"
+
+
+- name: Listar conteúdo do diretório remoto
+  shell: ls -l /tmp/cloudflare/kubernetes-files/files
+  register: resultado_ls
+
+
+- name: Mostrar resultado do ls
+  debug:
+    var: resultado_ls.stdout_lines
+
+
+- name: Aplicar o stolon
+  become: yes
+  become_user: fenix 
+  shell: |
+    kubectl apply -f /tmp/cloudflare/kubernetes-files/files/
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config

roles/cloudflared/vars/main.yml

@@ -0,0 +1,4 @@
+bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
+VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
+BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
+BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/jellyfin/files/jellyfin-deployment.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jellyfin
+  namespace: stack-arr
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: jellyfin
+  template:
+    metadata:
+      labels:
+        app: jellyfin
+    spec:
+      imagePullSecrets:
+      - name: regcred
+      containers:
+      - name: jellyfin
+        image: lscr.io/linuxserver/jellyfin:10.11.2
+        securityContext:
+          capabilities:
+            add:
+              - NET_ADMIN
+        ports:
+          - containerPort: 8096
+            name: webui
+          - containerPort: 8920
+            name: webuihttps
+          - containerPort: 1900
+            name: dlnaudp
+          - containerPort: 7359
+            name: discoveryudp
+        env:
+        - name: PUID
+          value: "1013"
+        - name: PGID
+          value: "1013"
+        - name: TZ
+          value: 'Etc/UTC'
+        volumeMounts:
+        - name: config
+          mountPath: /config
+        - name: videos
+          mountPath: /videos
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: jellyfin-config-pvc
+      - name: videos
+        persistentVolumeClaim:
+          claimName: jellyfin-videos-pvc
+
+
+
+

roles/jellyfin/files/jellyfin-nfs-csi.yaml

@@ -0,0 +1,23 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: jellyfin-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/jellyfin
+allowVolumeExpansion: true
+reclaimPolicy: Retain
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: jellyfin-videos-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series
+allowVolumeExpansion: true
+reclaimPolicy: Retain

roles/jellyfin/files/jellyfin-pvcs.yaml

@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: jellyfin-config-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 2Gi
+  storageClassName: jellyfin-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/jellyfin/config
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-config-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: jellyfin-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: jellyfin-config-pv
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: jellyfin-videos-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 150Gi
+  storageClassName: jellyfin-videos-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-videos-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: jellyfin-videos-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: jellyfin-videos-pv
+  resources:
+    requests:
+      storage: 150Gi
+---

roles/jellyfin/files/jellyfin-service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: jellyfin-service
+  namespace: stack-arr
+spec:
+  ports:
+    - port: 8096
+      targetPort: 8096
+      name: webui
+    - port: 8920
+      targetPort: 8920
+      name: webuihttps
+    - port: 1900
+      targetPort: 1900
+      name: dlnaudp
+    - port: 7359
+      targetPort: 7359
+      name: discoveryudp
+  selector:
+    app: jellyfin
+  type: ClusterIP

roles/jellyfin/tasks/main.yml

@@ -0,0 +1,51 @@
+- name: Remover o diretório /tmp/stack-arr/jellyfin/kubernetes-files
+  ansible.builtin.file:
+    path: /tmp/stack-arr/jellyfin/kubernetes-files
+    state: absent
+
+- name: Criar diretório temporário no remoto
+  file:
+    path: /tmp/stack-arr/jellyfin/kubernetes-files
+    state: directory
+    mode: '0755'
+
+- name: Copy file with owner and permissions
+  ansible.builtin.copy:
+    src: ../files
+    dest: /tmp/stack-arr/jellyfin/kubernetes-files
+    owner: fenix
+    group: root
+    mode: '0644'
+
+
+#- name: Obter várias notas do Bitwarden
+#  shell: |
+#    echo "unlock"
+#    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
+#    echo "get item"
+#    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
+#  loop:
+#    - { id: "iac.ansible.stackarr.jellyfin.secret", dest: "/tmp/stack-arr/jellyfin/kubernetes-files/files/jelly-secret.yaml" }
+#  args:
+#    executable: /bin/bash
+#  environment:
+#    BW_PASSWORD: "{{ BW_PASSWORD }}"
+
+
+- name: Listar conteúdo do diretório remoto
+  shell: ls -l /tmp/stack-arr/jellyfin/kubernetes-files/files
+  register: resultado_ls
+
+
+- name: Mostrar resultado do ls
+  debug:
+    var: resultado_ls.stdout_lines
+
+
+- name: Aplicar o stolon
+  become: yes
+  become_user: fenix 
+  shell: |
+    kubectl apply -f /tmp/stack-arr/jellyfin/kubernetes-files/files/
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config

roles/jellyfin/vars/main.yml

@@ -0,0 +1,4 @@
+bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
+VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
+BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
+BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/prowlarr/files/prowlarr-deployment.yaml

@@ -17,7 +17,7 @@ spec:
       - name: regcred
       containers:
       - name: prowlarr
-        image: lscr.io/linuxserver/prowlarr:latest
+        image: lscr.io/linuxserver/prowlarr:2.1.5
         securityContext:
           capabilities:
             add:

roles/prowlarr/tasks/main.yml

@@ -25,7 +25,7 @@
     echo "get item"
     bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
   loop:
-    - { id: "iac.ansible.stackarr.prowlarr.secret", dest: "/tmp/stack-arr/prowlarr/kubernetes-files/files/vpn-secret.yaml" }
+    - { id: "iac.ansible.stackarr.prowlarr.secret", dest: "/tmp/stack-arr/prowlarr/kubernetes-files/files/prowlarr-secret.yaml" }
   args:
     executable: /bin/bash
   environment:

roles/sonarr/files/sonarr-deployment.yaml

@@ -0,0 +1,77 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sonarr
+  namespace: stack-arr
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sonarr
+  template:
+    metadata:
+      labels:
+        app: sonarr
+    spec:
+      imagePullSecrets:
+      - name: regcred
+      containers:
+      - name: sonarr
+        image: lscr.io/linuxserver/sonarr:4.0.16
+        securityContext:
+          capabilities:
+            add:
+              - NET_ADMIN
+        ports:
+          - containerPort: 8989
+            name: webui
+        env:
+        - name: PUID
+          value: "1013"
+        - name: PGID
+          value: "1013"
+        - name: TZ
+          value: 'Etc/UTC'
+        - name: SONARR__POSTGRES__HOST
+          value: 'stolon-proxy-service.postgresql.svc.cluster.local'
+        - name: SONARR__POSTGRES__USER
+          valueFrom:
+            secretKeyRef:
+              name: sonarr-secret
+              key: username
+        - name: SONARR__POSTGRES__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: sonarr-secret
+              key: password
+        - name: SONARR__POSTGRES__MAINDB
+          valueFrom:
+            secretKeyRef:
+              name: sonarr-secret
+              key: maindb
+        - name: SONARR__POSTGRES__LOGDB
+          valueFrom:
+            secretKeyRef:
+              name: sonarr-secret
+              key: logsdb
+        volumeMounts:
+        - name: config
+          mountPath: /config
+        - name: downloads
+          mountPath: /downloads
+        - name: tv
+          mountPath: /tv
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: sonarr-config-pvc
+      - name: downloads
+        persistentVolumeClaim:
+          claimName: qbittorrent-downloads-pvc
+      - name: tv
+        persistentVolumeClaim:
+          claimName: sonarr-tv-pvc
+
+
+
+

roles/sonarr/files/sonarr-nfs-csi.yaml

@@ -0,0 +1,23 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: sonarr-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/sonarr
+allowVolumeExpansion: true
+reclaimPolicy: Retain
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: sonarr-tv-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series/TV
+allowVolumeExpansion: true
+reclaimPolicy: Retain

roles/sonarr/files/sonarr-pvcs.yaml

@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: sonarr-config-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 2Gi
+  storageClassName: sonarr-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/sonarr/config
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sonarr-config-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: sonarr-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: sonarr-config-pv
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: sonarr-tv-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 50Gi
+  storageClassName: sonarr-tv-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series/TV
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sonarr-tv-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: sonarr-tv-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: sonarr-tv-pv
+  resources:
+    requests:
+      storage: 50Gi
+---

roles/sonarr/files/sonarr-secret.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name:  sonarr-secret
+    namespace: stack-arr
+type: Opaque
+data:
+    username: dXNlcm5hbWU=
+    password: cGFzc3dvcmQ=
+    maindb: bWFpbmRiLXByb3dsYXJy
+    logsdb: bG9nZGItcHJvd2xhcnI=

roles/sonarr/files/sonarr-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: sonarr-service
+  namespace: stack-arr
+spec:
+  ports:
+    - port: 8989
+      targetPort: 8989
+  selector:
+    app: sonarr
+  type: ClusterIP

roles/sonarr/tasks/main.yml

@@ -0,0 +1,51 @@
+- name: Remover o diretório /tmp/stack-arr/sonarr/kubernetes-files
+  ansible.builtin.file:
+    path: /tmp/stack-arr/sonarr/kubernetes-files
+    state: absent
+
+- name: Criar diretório temporário no remoto
+  file:
+    path: /tmp/stack-arr/sonarr/kubernetes-files
+    state: directory
+    mode: '0755'
+
+- name: Copy file with owner and permissions
+  ansible.builtin.copy:
+    src: ../files
+    dest: /tmp/stack-arr/sonarr/kubernetes-files
+    owner: fenix
+    group: root
+    mode: '0644'
+
+
+- name: Obter várias notas do Bitwarden
+  shell: |
+    echo "unlock"
+    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
+    echo "get item"
+    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
+  loop:
+    - { id: "iac.ansible.stackarr.sonarr.secret", dest: "/tmp/stack-arr/sonarr/kubernetes-files/files/sonarr-secret.yaml" }
+  args:
+    executable: /bin/bash
+  environment:
+    BW_PASSWORD: "{{ BW_PASSWORD }}"
+
+
+- name: Listar conteúdo do diretório remoto
+  shell: ls -l /tmp/stack-arr/sonarr/kubernetes-files/files
+  register: resultado_ls
+
+
+- name: Mostrar resultado do ls
+  debug:
+    var: resultado_ls.stdout_lines
+
+
+- name: Aplicar o stolon
+  become: yes
+  become_user: fenix 
+  shell: |
+    kubectl apply -f /tmp/stack-arr/sonarr/kubernetes-files/files/
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config

roles/sonarr/vars/main.yml

@@ -0,0 +1,4 @@
+bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
+VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
+BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
+BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/stolon/tasks/main.yml

@@ -51,22 +51,13 @@
   environment:
     KUBECONFIG:  /home/fenix/.kube/config
 
-- name: Verificar se o cluster Stolon já existe
+
-  shell: kubectl get configmap -n postgresql kube-stolon
+- name: reabilitar database stolon
-  register: stolon_cluster_check
+  become: yes
-  failed_when: false
-  changed_when: false
   become_user: fenix 
+  shell: |
+    kubectl run -i -n=postgresql -t stolonctl --image=sorintlab/stolon:master-pg15 --restart=Never --rm -- /usr/local/bin/stolonctl  --cluster-name kube-stolon --store-backend kubernetes --kube-resource-kind=configmap init -y '{"initMode":"existing","existingConfig": {"keeperUID": "keeper0","followersUIDs": ["keeper1","keeper2"]}}'
+    # run this if first time setting up database
+    #    kubectl run -i -n=postgresql -t stolonctl --image=sorintlab/stolon:master-pg15 --restart=Never --rm -- /usr/local/bin/stolonctl --cluster-name=kube-stolon --store-backend=kubernetes --kube-resource-kind=configmap init --yes
   environment:
     KUBECONFIG:  /home/fenix/.kube/config
-
-
-#run this if first time setting up database
-#- name: Aplicar o stolon
-#  become: yes
-#  become_user: fenix 
-#  shell: |
-#    kubectl run -i -n=postgresql -t stolonctl --image=sorintlab/stolon:master-pg15 --restart=Never --rm -- /usr/local/bin/stolonctl --cluster-name=kube-stolon --store-backend=kubernetes --kube-resource-kind=configmap init --yes
-#  when: stolon_cluster_check.rc != 0
-#  environment:
-#    KUBECONFIG:  /home/fenix/.kube/config