Update roles/stolon/tasks/main.yml

.gitea/workflows/deploy-k8s.yml

@@ -2,7 +2,7 @@ name: IACAnsible
 
 on: 
   push:
-    branches: [ kubernetes-vazio ]
+    branches: [ main ]
   workflow_dispatch:
 
 jobs:
@@ -35,7 +35,7 @@ jobs:
           bw login --apikey
           echo "session"
           BW_SESSION=$(bw unlock "$BW_PASSWORD" --raw)
-          
+          echo "BW_SESSION=$BW_SESSION" >> $GITEA_ENV
 
       - name: Cloning ansible repository
         uses: actions/checkout@v4
@@ -55,4 +55,6 @@ jobs:
       - name: Run Ansible Playbook
         working-directory: ansible/iac
         run: |
-          ansible-playbook -i inventory.ini playbook.yml
+          ansible-playbook -i inventory.ini playbook.yml -e "BW_CLIENTID=$BW_CLIENTID BW_CLIENTSECRET=$BW_CLIENTSECRET BW_PASSWORD=$BW_PASSWORD BW_EMAIL=$BW_EMAIL"
+        env:
+          BW_SESSION: ${{ env.BW_SESSION }}

README.md

@@ -1,3 +1,15 @@
 # iac-ansible-private
 
 iac-ansible-private
+
+stolon comes from https://github.com/sorintlab/stolon/blob/master/examples/kubernetes/README.md
+qbittorrent comes from https://github.com/j4ym0/pia-qbittorrent-docker?tab=readme-ov-file
+prowlarr comes from https://docs.linuxserver.io/images/docker-prowlarr/#docker-mods 
+                and https://wiki.servarr.com/prowlarr/environment-variables
+sonarr comes from https://wiki.servarr.com/sonarr/environment-variables
+                and https://docs.linuxserver.io/images/docker-sonarr/#supported-architectures
+jellyfin comes from https://docs.linuxserver.io/images/docker-jellyfin/
+flaresolverr comes from https://github.com/FlareSolverr/FlareSolverr
+jellyseer comes from https://hub.docker.com/r/fallenbagel/jellyseerr
+                and https://docs.seerr.dev/extending-jellyseerr/database-config
+decluttarr comes from https://github.com/ManiMatter/decluttarr

playbook.yml

@@ -3,6 +3,7 @@
   become: yes
   roles:
     - common
+    - vaultwarden
     - kubernetes
     - kube-master
 
@@ -11,5 +12,21 @@
   become: yes
   roles:
     - common
+    - vaultwarden
     - kubernetes
     - kube-node
+
+- name: Configure Kubernetes Data
+  hosts: master
+  become: yes
+  roles:
+    - stolon
+    - cloudflared
+    - qbittorrent
+    - prowlarr
+    - sonarr
+    - radarr
+    - jellyfin
+    - flaresolverr
+    - jellyseerr
+    - decluttarr

roles/cloudflared/files/cloudflare-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cloudflare

roles/cloudflared/files/cloudflared-tunnel-deployment.yaml

@@ -0,0 +1,49 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cloudflared-tunnel
+  namespace: cloudflare
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: cloudflared
+  template:
+    metadata:
+      labels:
+        app: cloudflared
+    spec:
+      securityContext:
+        sysctls:
+        # Allows ICMP traffic (ping, traceroute) to resources behind cloudflared.
+          - name: net.ipv4.ping_group_range
+            value: "65532 65532"
+      containers:
+        - image: cloudflare/cloudflared:latest
+          name: cloudflared
+          env:
+            # Defines an environment variable for the tunnel token.
+            - name: TUNNEL_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: tunnel-token-secret
+                  key: token
+          command:
+            # Configures tunnel run parameters
+            - cloudflared
+            - tunnel
+            - --no-autoupdate
+            - --loglevel
+            - debug
+            - --metrics
+            - 0.0.0.0:2000
+            - run
+          livenessProbe:
+            httpGet:
+              # Cloudflared has a /ready endpoint which returns 200 if and only if
+              # it has an active connection to Cloudflare's network.
+              path: /ready
+              port: 2000
+            failureThreshold: 1
+            initialDelaySeconds: 10
+            periodSeconds: 10

roles/cloudflared/files/tunnel-token-secret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: tunnel-token-secret
+    namespace: cloudflare
+type: Opaque
+data:
+    token: <CLOUDFLARE_TUNNEL_TOKEN>

roles/cloudflared/tasks/main.yml

@@ -0,0 +1,51 @@
+- name: Remover o diretório /tmp/cloudflare/kubernetes-files
+  ansible.builtin.file:
+    path: /tmp/cloudflare/kubernetes-files
+    state: absent
+
+- name: Criar diretório temporário no remoto
+  file:
+    path: /tmp/cloudflare/kubernetes-files
+    state: directory
+    mode: '0755'
+
+- name: Copy file with owner and permissions
+  ansible.builtin.copy:
+    src: ../files
+    dest: /tmp/cloudflare/kubernetes-files
+    owner: fenix
+    group: root
+    mode: '0644'
+
+
+- name: Obter várias notas do Bitwarden
+  shell: |
+    echo "unlock"
+    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
+    echo "get item"
+    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
+  loop:
+    - { id: "iac.ansible.cloudflare.tunnel.secret", dest: "/tmp/cloudflare/kubernetes-files/files/tunnel-token-secret.yaml" }
+  args:
+    executable: /bin/bash
+  environment:
+    BW_PASSWORD: "{{ BW_PASSWORD }}"
+
+
+- name: Listar conteúdo do diretório remoto
+  shell: ls -l /tmp/cloudflare/kubernetes-files/files
+  register: resultado_ls
+
+
+- name: Mostrar resultado do ls
+  debug:
+    var: resultado_ls.stdout_lines
+
+
+- name: Aplicar o stolon
+  become: yes
+  become_user: fenix 
+  shell: |
+    kubectl apply -f /tmp/cloudflare/kubernetes-files/files/
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config

roles/cloudflared/vars/main.yml

@@ -0,0 +1,4 @@
+bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
+VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
+BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
+BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/decluttarr/files/decluttarr-deployment.yaml

@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: decluttarr
+  namespace: stack-arr
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: decluttarr
+  template:
+    metadata:
+      labels:
+        app: decluttarr
+    spec:
+      imagePullSecrets:
+      - name: regcred
+      containers:
+      - name: decluttarr
+        image: ghcr.io/manimatter/decluttarr:v1.50.2
+        env:
+            - name: LOG_LEVEL
+              value: VERBOSE
+            - name: REMOVE_TIMER
+              value: '3'
+            - name: REMOVE_FAILED
+              value: 'True'
+            - name: REMOVE_FAILED_IMPORTS
+              value: 'False'
+            - name: REMOVE_METADATA_MISSING
+              value: 'True'
+            - name: REMOVE_MISSING_FILES
+              value: 'True'
+            - name: REMOVE_ORPHANS
+              value: 'True'
+            - name: REMOVE_SLOW
+              value: 'False'
+            - name: REMOVE_STALLED
+              value: 'True'
+            - name: REMOVE_UNMONITORED
+              value: 'False'
+            - name: MIN_DOWNLOAD_SPEED
+              value: '100'
+            - name: PERMITTED_ATTEMPTS
+              value: '3'
+            - name: SONARR_URL
+              value: http://sonarr-service.stack-arr.svc.cluster.local:8989
+            - name: SONARR_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: decluttarr-secret
+                  key: sonarrkey
+            - name: QBITTORRENT_URL
+              value: http://qbittorrent-service.stack-arr.svc.cluster.local:8080
+            - name: QBITTORRENT_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: decluttarr-secret
+                  key: qbittorrentuser
+            - name: QBITTORRENT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: decluttarr-secret
+                  key: qbittorrentpass
+        volumeMounts:
+        - name: config
+          mountPath: /config
+        - name: downloads
+          mountPath: /data/downloads
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: decluttarr-config-pvc
+      - name: downloads
+        persistentVolumeClaim:
+          claimName: qbittorrent-downloads-pvc
+
+
+

roles/decluttarr/files/decluttarr-nfs-csi.yaml

@@ -0,0 +1,12 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: decluttarr-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/decluttarr
+allowVolumeExpansion: true
+reclaimPolicy: Retain
+---

roles/decluttarr/files/decluttarr-pvcs.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: decluttarr-config-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 2Gi
+  storageClassName: decluttarr-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/decluttarr/config
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: decluttarr-config-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: decluttarr-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: decluttarr-config-pv
+  resources:
+    requests:
+      storage: 2Gi
+---

roles/decluttarr/files/decluttarr-secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name:  decluttarr-secret
+    namespace: stack-arr
+type: Opaque
+data:
+    sonarrkey: M2tkMDRscjk1bGY5M29lMDNsZTAzbGU=
+    qbittorrentuser: dXNlcg==
+    qbittorrentpass: cGFzcw==

roles/decluttarr/tasks/main.yml

@@ -0,0 +1,51 @@
+- name: Remover o diretório /tmp/stack-arr/decluttarr/kubernetes-files
+  ansible.builtin.file:
+    path: /tmp/stack-arr/decluttarr/kubernetes-files
+    state: absent
+
+- name: Criar diretório temporário no remoto
+  file:
+    path: /tmp/stack-arr/decluttarr/kubernetes-files
+    state: directory
+    mode: '0755'
+
+- name: Copy file with owner and permissions
+  ansible.builtin.copy:
+    src: ../files
+    dest: /tmp/stack-arr/decluttarr/kubernetes-files
+    owner: fenix
+    group: root
+    mode: '0644'
+
+
+- name: Obter várias notas do Bitwarden
+  shell: |
+    echo "unlock"
+    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
+    echo "get item"
+    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
+  loop:
+    - { id: "iac.ansible.stackarr.decluttarr.secret", dest: "/tmp/stack-arr/decluttarr/kubernetes-files/files/decluttarr-secret.yaml" }
+  args:
+    executable: /bin/bash
+  environment:
+    BW_PASSWORD: "{{ BW_PASSWORD }}"
+
+
+- name: Listar conteúdo do diretório remoto
+  shell: ls -l /tmp/stack-arr/decluttarr/kubernetes-files/files
+  register: resultado_ls
+
+
+- name: Mostrar resultado do ls
+  debug:
+    var: resultado_ls.stdout_lines
+
+
+- name: Aplicar o stolon
+  become: yes
+  become_user: fenix 
+  shell: |
+    kubectl apply -f /tmp/stack-arr/decluttarr/kubernetes-files/files/
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config

roles/decluttarr/vars/main.yml

@@ -0,0 +1,4 @@
+bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
+VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
+BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
+BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/flaresolverr/files/flaresolverr-deployment.yaml

@@ -0,0 +1,32 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: flaresolverr
+  namespace: stack-arr
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: flaresolverr
+  template:
+    metadata:
+      labels:
+        app: flaresolverr
+    spec:
+      imagePullSecrets:
+      - name: regcred
+      containers:
+      - name: flaresolverr
+        image: ghcr.io/flaresolverr/flaresolverr:latest
+        securityContext:
+          capabilities:
+            add:
+              - NET_ADMIN
+        ports:
+          - containerPort: 8191
+            name: porta
+        env:
+        - name: LOG_LEVEL
+          value: "info"
+
+

roles/flaresolverr/files/flaresolverr-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: flaresolverr-service
+  namespace: stack-arr
+spec:
+  ports:
+    - port: 8191
+      targetPort: 8191
+  selector:
+    app: flaresolverr
+  type: ClusterIP

roles/flaresolverr/tasks/main.yml

@@ -0,0 +1,51 @@
+- name: Remover o diretório /tmp/stack-arr/sonarr/kubernetes-files
+  ansible.builtin.file:
+    path: /tmp/stack-arr/sonarr/kubernetes-files
+    state: absent
+
+- name: Criar diretório temporário no remoto
+  file:
+    path: /tmp/stack-arr/sonarr/kubernetes-files
+    state: directory
+    mode: '0755'
+
+- name: Copy file with owner and permissions
+  ansible.builtin.copy:
+    src: ../files
+    dest: /tmp/stack-arr/sonarr/kubernetes-files
+    owner: fenix
+    group: root
+    mode: '0644'
+
+
+#- name: Obter várias notas do Bitwarden
+#  shell: |
+#    echo "unlock"
+#    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
+#    echo "get item"
+#    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
+#  loop:
+#    - { id: "iac.ansible.stackarr.sonarr.secret", dest: "/tmp/stack-arr/sonarr/kubernetes-files/files/sonarr-secret.yaml" }
+#  args:
+#    executable: /bin/bash
+#  environment:
+#    BW_PASSWORD: "{{ BW_PASSWORD }}"
+
+
+- name: Listar conteúdo do diretório remoto
+  shell: ls -l /tmp/stack-arr/sonarr/kubernetes-files/files
+  register: resultado_ls
+
+
+- name: Mostrar resultado do ls
+  debug:
+    var: resultado_ls.stdout_lines
+
+
+- name: Aplicar o stolon
+  become: yes
+  become_user: fenix 
+  shell: |
+    kubectl apply -f /tmp/stack-arr/sonarr/kubernetes-files/files/
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config

roles/flaresolverr/vars/main.yml

@@ -0,0 +1,4 @@
+bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
+VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
+BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
+BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/jellyfin/files/jellyfin-deployment.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jellyfin
+  namespace: stack-arr
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: jellyfin
+  template:
+    metadata:
+      labels:
+        app: jellyfin
+    spec:
+      imagePullSecrets:
+      - name: regcred
+      containers:
+      - name: jellyfin
+        image: lscr.io/linuxserver/jellyfin:10.11.2
+        securityContext:
+          capabilities:
+            add:
+              - NET_ADMIN
+        ports:
+          - containerPort: 8096
+            name: webui
+          - containerPort: 8920
+            name: webuihttps
+          - containerPort: 1900
+            name: dlnaudp
+          - containerPort: 7359
+            name: discoveryudp
+        env:
+        - name: PUID
+          value: "1013"
+        - name: PGID
+          value: "1013"
+        - name: TZ
+          value: 'Etc/UTC'
+        volumeMounts:
+        - name: config
+          mountPath: /config
+        - name: videos
+          mountPath: /videos
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: jellyfin-config-pvc
+      - name: videos
+        persistentVolumeClaim:
+          claimName: jellyfin-videos-pvc
+
+
+
+

roles/jellyfin/files/jellyfin-nfs-csi.yaml

@@ -0,0 +1,23 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: jellyfin-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/jellyfin
+allowVolumeExpansion: true
+reclaimPolicy: Retain
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: jellyfin-videos-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series
+allowVolumeExpansion: true
+reclaimPolicy: Retain

roles/jellyfin/files/jellyfin-pvcs.yaml

@@ -0,0 +1,63 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: jellyfin-config-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 2Gi
+  storageClassName: jellyfin-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/jellyfin/config
+  mountOptions:
+    - nolock
+    - nfsvers=3
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-config-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: jellyfin-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: jellyfin-config-pv
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: jellyfin-videos-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 150Gi
+  storageClassName: jellyfin-videos-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-videos-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: jellyfin-videos-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: jellyfin-videos-pv
+  resources:
+    requests:
+      storage: 150Gi
+---

roles/jellyfin/files/jellyfin-service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: jellyfin-service
+  namespace: stack-arr
+spec:
+  ports:
+    - port: 8096
+      targetPort: 8096
+      name: webui
+    - port: 8920
+      targetPort: 8920
+      name: webuihttps
+    - port: 1900
+      targetPort: 1900
+      name: dlnaudp
+    - port: 7359
+      targetPort: 7359
+      name: discoveryudp
+  selector:
+    app: jellyfin
+  type: ClusterIP

roles/jellyfin/tasks/main.yml

@@ -0,0 +1,51 @@
+- name: Remover o diretório /tmp/stack-arr/jellyfin/kubernetes-files
+  ansible.builtin.file:
+    path: /tmp/stack-arr/jellyfin/kubernetes-files
+    state: absent
+
+- name: Criar diretório temporário no remoto
+  file:
+    path: /tmp/stack-arr/jellyfin/kubernetes-files
+    state: directory
+    mode: '0755'
+
+- name: Copy file with owner and permissions
+  ansible.builtin.copy:
+    src: ../files
+    dest: /tmp/stack-arr/jellyfin/kubernetes-files
+    owner: fenix
+    group: root
+    mode: '0644'
+
+
+#- name: Obter várias notas do Bitwarden
+#  shell: |
+#    echo "unlock"
+#    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
+#    echo "get item"
+#    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
+#  loop:
+#    - { id: "iac.ansible.stackarr.jellyfin.secret", dest: "/tmp/stack-arr/jellyfin/kubernetes-files/files/jelly-secret.yaml" }
+#  args:
+#    executable: /bin/bash
+#  environment:
+#    BW_PASSWORD: "{{ BW_PASSWORD }}"
+
+
+- name: Listar conteúdo do diretório remoto
+  shell: ls -l /tmp/stack-arr/jellyfin/kubernetes-files/files
+  register: resultado_ls
+
+
+- name: Mostrar resultado do ls
+  debug:
+    var: resultado_ls.stdout_lines
+
+
+- name: Aplicar o stolon
+  become: yes
+  become_user: fenix 
+  shell: |
+    kubectl apply -f /tmp/stack-arr/jellyfin/kubernetes-files/files/
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config

roles/jellyfin/vars/main.yml

@@ -0,0 +1,4 @@
+bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
+VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
+BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
+BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/jellyseerr/files/jellyseerr-deployment.yaml

@@ -0,0 +1,62 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jellyseerr
+  namespace: stack-arr
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: jellyseerr
+  template:
+    metadata:
+      labels:
+        app: jellyseerr
+    spec:
+      imagePullSecrets:
+      - name: regcred
+      containers:
+      - name: jellyseerr
+        image: fallenbagel/jellyseerr:2.7.3
+        ports:
+          - containerPort: 5055
+            name: webui
+        env:
+        - name: TZ
+          value: 'Etc/UTC'
+        - name: LOG_LEVEL
+          value: 'debug'
+        - name: DB_TYPE
+          value: 'postgres'
+        - name: DB_HOST
+          value: 'stolon-proxy-service.postgresql.svc.cluster.local'
+        - name: DB_PORT
+          value: '5432'
+        - name: DB_USER
+          valueFrom:
+            secretKeyRef:
+              name: jellyseerr-secret
+              key: username
+        - name: DB_PASS
+          valueFrom:
+            secretKeyRef:
+              name: jellyseerr-secret
+              key: password
+        - name: DB_NAME
+          valueFrom:
+            secretKeyRef:
+              name: jellyseerr-secret
+              key: maindb
+        - name: DB_LOG_QUERIES
+          value: 'false'
+        volumeMounts:
+        - name: config
+          mountPath: /app/config
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: jellyseerr-config-pvc
+
+
+
+

roles/jellyseerr/files/jellyseerr-nfs-csi.yaml

@@ -0,0 +1,11 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: jellyseerr-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/jellyseerr
+allowVolumeExpansion: true
+reclaimPolicy: Retain

roles/jellyseerr/files/jellyseerr-pvcs.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: jellyseerr-config-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 2Gi
+  storageClassName: jellyseerr-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/jellyseerr/config
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyseerr-config-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: jellyseerr-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: jellyseerr-config-pv
+  resources:
+    requests:
+      storage: 2Gi
+---

roles/jellyseerr/files/jellyseerr-secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name:  jellyseerr-secret
+    namespace: stack-arr
+type: Opaque
+data:
+    username: dXNlcm5hbWU=
+    password: cGFzc3dvcmQ=
+    maindb: bWFpbmRiLXByb3dsYXJy

roles/jellyseerr/files/jellyseerr-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: jellyseerr-service
+  namespace: stack-arr
+spec:
+  ports:
+    - port: 5055
+      targetPort: 5055
+  selector:
+    app: jellyseerr
+  type: ClusterIP

roles/jellyseerr/tasks/main.yml

@@ -0,0 +1,51 @@
+- name: Remover o diretório /tmp/stack-arr/jellyseerr/kubernetes-files
+  ansible.builtin.file:
+    path: /tmp/stack-arr/jellyseerr/kubernetes-files
+    state: absent
+
+- name: Criar diretório temporário no remoto
+  file:
+    path: /tmp/stack-arr/jellyseerr/kubernetes-files
+    state: directory
+    mode: '0755'
+
+- name: Copy file with owner and permissions
+  ansible.builtin.copy:
+    src: ../files
+    dest: /tmp/stack-arr/jellyseerr/kubernetes-files
+    owner: fenix
+    group: root
+    mode: '0644'
+
+
+- name: Obter várias notas do Bitwarden
+  shell: |
+    echo "unlock"
+    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
+    echo "get item"
+    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
+  loop:
+    - { id: "iac.ansible.stackarr.jellyseerr.secret", dest: "/tmp/stack-arr/jellyseerr/kubernetes-files/files/jellyseerr-secret.yaml" }
+  args:
+    executable: /bin/bash
+  environment:
+    BW_PASSWORD: "{{ BW_PASSWORD }}"
+
+
+- name: Listar conteúdo do diretório remoto
+  shell: ls -l /tmp/stack-arr/jellyseerr/kubernetes-files/files
+  register: resultado_ls
+
+
+- name: Mostrar resultado do ls
+  debug:
+    var: resultado_ls.stdout_lines
+
+
+- name: Aplicar o stolon
+  become: yes
+  become_user: fenix 
+  shell: |
+    kubectl apply -f /tmp/stack-arr/jellyseerr/kubernetes-files/files/
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config

roles/jellyseerr/vars/main.yml

@@ -0,0 +1,4 @@
+bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
+VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
+BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
+BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/kube-master/tasks/main.yml

@@ -22,7 +22,7 @@
   replace:
     path: /tmp/kube-flannel.yml
     regexp: '10\.244\.0\.0/16'
-    replace: '10.244.0.0/16' # .3.
+    replace: '10.240.0.0/16' # .3.
 
 - name: Corrigir net-conf.json no manifest do Flannel
   become: true
@@ -55,8 +55,9 @@
     argv:
       - kubeadm
       - init
-      - --pod-network-cidr=10.244.0.0/16 # .3. 
+      - --pod-network-cidr=10.240.0.0/16 # .3. 
-      - --apiserver-advertise-address=192.168.1.150
+      - --apiserver-advertise-address=192.168.1.50
+      - --service-cidr=10.95.0.0/16
     creates: /etc/kubernetes/admin.conf 
 
 
@@ -102,6 +103,37 @@
   delay: 6
   become: yes
 
+
+- name: kubernetes untaint node-role.kubernetes.io/control-plane:NoSchedule
+  become: true
+  shell: |
+      kubectl taint nodes --all node-role.kubernetes.io/control-plane:NoSchedule-
+  become_user: fenix 
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config
+  ignore_errors: yes
+
+
+- name: kubernetes unlabel node-role.kubernetes.io/control-plane
+  become: true
+  shell: |
+      kubectl label nodes --all node-role.kubernetes.io/control-plane-
+  become_user: fenix 
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config
+  ignore_errors: yes
+
+- name: kubernetes unlabel node.kubernetes.io/exclude-from-external-load-balancers
+  become: true
+  shell: |
+      kubectl label nodes --all node.kubernetes.io/exclude-from-external-load-balancers-
+  become_user: fenix 
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config
+  ignore_errors: yes
+
+
+
 - name: cat flannel
   become: true
   shell: |
@@ -133,6 +165,81 @@
   delay: 6
   become: yes
 
+- name: Instalar Helm no nó master
+  become: true
+  shell: |
+    curl -fsSL https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
+  args:
+    creates: /usr/local/bin/helm
+    
+- name: Adicionar repositório Helm do CSI NFS
+  command: >
+    helm repo add csi-driver-nfs https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
+  args:
+    creates: /root/.cache/helm/repository/csi-driver-nfs-index.yaml
+
+- name: Atualizar repositórios Helm
+  command: helm repo update
+  
+- name: Instalar CSI NFS Driver via Helm
+  command: helm upgrade --install csi-driver-nfs csi-driver-nfs/csi-driver-nfs --namespace kube-system --version 4.12.0
+  register: resultado_nfs
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config
+
+ 
+- name: Mostrar resultado do nfs csi driver
+  debug:
+    var: resultado_nfs.stdout_lines
+
+
+- name: Instalar MetalLB (manifest oficial)
+  shell: kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.13.9/config/manifests/metallb-native.yaml
+  become_user: fenix 
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config
+
+- name: Esperar pelo webhook do MetalLB
+  shell: kubectl get endpoints webhook-service -n metallb-system -o jsonpath='{.subsets[*].addresses[*].ip}'
+  register: webhook_ready
+  until: webhook_ready.stdout != ""
+  retries: 10
+  delay: 10
+  become_user: fenix 
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config
+
+- name: Criar IP pool
+  shell: |
+    cat <<EOF | kubectl apply -f -
+    apiVersion: metallb.io/v1beta1
+    kind: IPAddressPool
+    metadata:
+      name: local-pool
+      namespace: metallb-system
+    spec:
+      addresses:
+        - 10.240.0.100-10.240.0.250
+    EOF
+  become_user: fenix 
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config
+
+- name: Criar anúncio L2
+  shell: |
+    cat <<EOF | kubectl apply -f -
+    apiVersion: metallb.io/v1beta1
+    kind: L2Advertisement
+    metadata:
+      name: advert
+      namespace: metallb-system
+    EOF
+  become_user: fenix 
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config
+
+
+
 - name: Get kubeadm join command
   become: true
   shell: kubeadm token create --print-join-command

roles/kube-master/tasks/patch_netconf.py

@@ -10,7 +10,7 @@ with open("/tmp/kube-flannel.yml", "r") as f:
 for doc in docs:
     if doc.get("kind") == "ConfigMap" and doc.get("metadata", {}).get("name") == "kube-flannel-cfg":
         doc["data"]["net-conf.json"] = '''{
-  "Network": "10.244.0.0/16",
+  "Network": "10.240.0.0/16",
   "Backend": {
     "Type": "vxlan"
   },

roles/kubernetes/tasks/main.yml

@@ -88,6 +88,7 @@
       - kubelet
       - kubeadm
       - kubectl
+      - nfs-common
     state: present
     update_cache: yes
 
@@ -161,3 +162,5 @@
     owner: root
     group: root
     mode: '0644'
+
+

roles/prowlarr/files/prowlarr-deployment.yaml

@@ -0,0 +1,67 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prowlarr
+  namespace: stack-arr
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: prowlarr
+  template:
+    metadata:
+      labels:
+        app: prowlarr
+    spec:
+      imagePullSecrets:
+      - name: regcred
+      containers:
+      - name: prowlarr
+        image: lscr.io/linuxserver/prowlarr:2.1.5
+        securityContext:
+          capabilities:
+            add:
+              - NET_ADMIN
+        ports:
+          - containerPort: 9696
+            name: webui
+        env:
+        - name: PUID
+          value: "1013"
+        - name: PGID
+          value: "1013"
+        - name: TZ
+          value: 'Etc/UTC'
+        - name: PROWLARR__POSTGRES__HOST
+          value: 'stolon-proxy-service.postgresql.svc.cluster.local'
+        - name: PROWLARR__POSTGRES__USER
+          valueFrom:
+            secretKeyRef:
+              name: prowlarr-secret
+              key: username
+        - name: PROWLARR__POSTGRES__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: prowlarr-secret
+              key: password
+        - name: PROWLARR__POSTGRES__MAINDB
+          valueFrom:
+            secretKeyRef:
+              name: prowlarr-secret
+              key: maindb
+        - name: PROWLARR__POSTGRES__LOGDB
+          valueFrom:
+            secretKeyRef:
+              name: prowlarr-secret
+              key: logsdb
+        volumeMounts:
+        - name: config
+          mountPath: /config
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: prowlarr-config-pvc
+
+
+
+

roles/prowlarr/files/prowlarr-nfs-csi.yaml

@@ -0,0 +1,11 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: prowlarr-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/prowlarr
+allowVolumeExpansion: true
+reclaimPolicy: Retain

roles/prowlarr/files/prowlarr-pvcs.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: prowlarr-config-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 2Gi
+  storageClassName: prowlarr-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/prowlarr/config
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: prowlarr-config-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: prowlarr-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: prowlarr-config-pv
+  resources:
+    requests:
+      storage: 2Gi
+---

roles/prowlarr/files/prowlarr-secret.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name:  prowlarr-secret
+    namespace: stack-arr
+type: Opaque
+data:
+    username: dXNlcm5hbWU=
+    password: cGFzc3dvcmQ=
+    maindb: bWFpbmRiLXByb3dsYXJy
+    logsdb: bG9nZGItcHJvd2xhcnI=

roles/prowlarr/files/prowlarr-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: prowlarr-service
+  namespace: stack-arr
+spec:
+  ports:
+    - port: 9696
+      targetPort: 9696
+  selector:
+    app: prowlarr
+  type: ClusterIP

roles/prowlarr/tasks/main.yml

@@ -0,0 +1,51 @@
+- name: Remover o diretório /tmp/stack-arr/prowlarr/kubernetes-files
+  ansible.builtin.file:
+    path: /tmp/stack-arr/prowlarr/kubernetes-files
+    state: absent
+
+- name: Criar diretório temporário no remoto
+  file:
+    path: /tmp/stack-arr/prowlarr/kubernetes-files
+    state: directory
+    mode: '0755'
+
+- name: Copy file with owner and permissions
+  ansible.builtin.copy:
+    src: ../files
+    dest: /tmp/stack-arr/prowlarr/kubernetes-files
+    owner: fenix
+    group: root
+    mode: '0644'
+
+
+- name: Obter várias notas do Bitwarden
+  shell: |
+    echo "unlock"
+    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
+    echo "get item"
+    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
+  loop:
+    - { id: "iac.ansible.stackarr.prowlarr.secret", dest: "/tmp/stack-arr/prowlarr/kubernetes-files/files/prowlarr-secret.yaml" }
+  args:
+    executable: /bin/bash
+  environment:
+    BW_PASSWORD: "{{ BW_PASSWORD }}"
+
+
+- name: Listar conteúdo do diretório remoto
+  shell: ls -l /tmp/stack-arr/prowlarr/kubernetes-files/files
+  register: resultado_ls
+
+
+- name: Mostrar resultado do ls
+  debug:
+    var: resultado_ls.stdout_lines
+
+
+- name: Aplicar o stolon
+  become: yes
+  become_user: fenix 
+  shell: |
+    kubectl apply -f /tmp/stack-arr/prowlarr/kubernetes-files/files/
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config

roles/prowlarr/vars/main.yml

@@ -0,0 +1,4 @@
+bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
+VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
+BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
+BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/qbittorrent/files/docker-secrets.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: regcred
+  namespace: stack-arr
+data:
+  .dockerconfigjson: >-
+    eyJhdXRocyI6eyJodHRwczovL2luZGV4LmRvY2tlci5pby92MS8iOnsidXNlcm5hbWUiOiJ1c2VyIiwicGFzc3dvcmQiOiJwYXNzIiwiYXV0aCI6ImRmamlla2ZlcldFS1dFa29mY2RrbzM0MzUzZmQ9In19fQ==
+type: kubernetes.io/dockerconfigjson

roles/qbittorrent/files/qbittorrent-deployment.yaml

@@ -0,0 +1,67 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: qbittorrentvpn
+  namespace: stack-arr
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: qbittorrentvpn
+  template:
+    metadata:
+      labels:
+        app: qbittorrentvpn
+    spec:
+      imagePullSecrets:
+      - name: regcred
+      containers:
+      - name: qbittorrentvpn
+        image: j4ym0/pia-qbittorrent:5.1.2-ubuntu
+        securityContext:
+          capabilities:
+            add:
+              - NET_ADMIN
+        ports:
+          - containerPort: 8080
+            name: webui
+          - containerPort: 51413
+            name: torrent-tcp
+          - containerPort: 51413
+            name: torrent-udp
+            protocol: UDP
+        env:
+        - name: USER
+          valueFrom:
+            secretKeyRef:
+              name: vpn-secret
+              key: username
+        - name: PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: vpn-secret
+              key: password
+        - name: REGION
+          value: "us_east"  # ou outro servidor PIA
+        - name: WEBUI_PORT
+          value: "8080"
+        - name: DNS_SERVERS
+          value: "1.1.1.1,1.0.0.1"
+        - name: UID
+          value: "1013"
+        - name: GID
+          value: "1013"
+        - name: HOSTHEADERVALIDATION
+          value: 'false'
+        volumeMounts:
+        - name: config
+          mountPath: /config
+        - name: downloads
+          mountPath: /downloads
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: qbittorrent-config-pvc
+      - name: downloads
+        persistentVolumeClaim:
+          claimName: qbittorrent-downloads-pvc

roles/qbittorrent/files/qbittorrent-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: stack-arr

roles/qbittorrent/files/qbittorrent-nfs-csi.yaml

@@ -0,0 +1,11 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: qbittorrent-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/bittorrent
+allowVolumeExpansion: true
+reclaimPolicy: Retain

roles/qbittorrent/files/qbittorrent-pvcs.yaml

@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: qbittorrent-config-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 2Gi
+  storageClassName: qbittorrent-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/bittorrent/config
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: qbittorrent-config-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: qbittorrent-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: qbittorrent-config-pv
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: qbittorrent-downloads-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 10Gi
+  storageClassName: qbittorrent-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/bittorrent/downloads
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: qbittorrent-downloads-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: qbittorrent-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: qbittorrent-downloads-pv
+  resources:
+    requests:
+      storage: 10Gi
+---

roles/qbittorrent/files/qbittorrent-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: qbittorrent-service
+  namespace: stack-arr
+spec:
+  ports:
+    - port: 8080
+      targetPort: 8080
+  selector:
+    app: qbittorrentvpn
+  type: LoadBalancer
+  loadBalancerIP: 10.240.0.101

roles/qbittorrent/files/vpn-secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name:  vpn-secret
+    namespace: stack-arr
+type: Opaque
+data:
+    username: dXNlcm5hbWU=
+    password: cGFzc3dvcmQ=

roles/qbittorrent/tasks/main.yml

@@ -0,0 +1,51 @@
+- name: Remover o diretório /tmp/stack-arr/qbittorrent/kubernetes-files
+  ansible.builtin.file:
+    path: /tmp/stack-arr/qbittorrent/kubernetes-files
+    state: absent
+
+- name: Criar diretório temporário no remoto
+  file:
+    path: /tmp/stack-arr/qbittorrent/kubernetes-files
+    state: directory
+    mode: '0755'
+
+- name: Copy file with owner and permissions
+  ansible.builtin.copy:
+    src: ../files
+    dest: /tmp/stack-arr/qbittorrent/kubernetes-files
+    owner: fenix
+    group: root
+    mode: '0644'
+
+- name: Obter várias notas do Bitwarden
+  shell: |
+    echo "unlock"
+    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
+    echo "get item"
+    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
+  loop:
+    - { id: "iac.ansible.stackarr.qbittorrent.dockersecrets", dest: "/tmp/stack-arr/qbittorrent/kubernetes-files/files/docker-secrets.yaml" }
+    - { id: "iac.ansible.stackarr.qbittorrent.secret", dest: "/tmp/stack-arr/qbittorrent/kubernetes-files/files/vpn-secret.yaml" }
+  args:
+    executable: /bin/bash
+  environment:
+    BW_PASSWORD: "{{ BW_PASSWORD }}"
+
+
+- name: Listar conteúdo do diretório remoto
+  shell: ls -l /tmp/stack-arr/qbittorrent/kubernetes-files/files
+  register: resultado_ls
+
+- name: Mostrar resultado do ls
+  debug:
+    var: resultado_ls.stdout_lines
+
+
+- name: Aplicar o qbittorrent
+  become: yes
+  become_user: fenix 
+  shell: |
+    kubectl apply -f /tmp/stack-arr/qbittorrent/kubernetes-files/files/qbittorrent-namespace.yaml
+    kubectl apply -f /tmp/stack-arr/qbittorrent/kubernetes-files/files/
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config

roles/qbittorrent/vars/main.yml

@@ -0,0 +1,4 @@
+bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
+VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
+BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
+BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/radarr/files/radarr-deployment.yaml

@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: radarr
+  namespace: stack-arr
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: radarr
+  template:
+    metadata:
+      labels:
+        app: radarr
+    spec:
+      imagePullSecrets:
+      - name: regcred
+      containers:
+      - name: radarr
+        image: lscr.io/linuxserver/radarr:5.28.0
+        securityContext:
+          capabilities:
+            add:
+              - NET_ADMIN
+        ports:
+          - containerPort: 7878
+            name: webui
+        env:
+        - name: PUID
+          value: "1013"
+        - name: PGID
+          value: "1013"
+        - name: TZ
+          value: 'Etc/UTC'
+        - name: RADARR__POSTGRES__HOST
+          value: 'stolon-proxy-service.postgresql.svc.cluster.local'
+        - name: RADARR__POSTGRES__USER
+          valueFrom:
+            secretKeyRef:
+              name: radarr-secret
+              key: username
+        - name: RADARR__POSTGRES__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: radarr-secret
+              key: password
+        - name: RADARR__POSTGRES__MAINDB
+          valueFrom:
+            secretKeyRef:
+              name: radarr-secret
+              key: maindb
+        - name: RADARR__POSTGRES__LOGDB
+          valueFrom:
+            secretKeyRef:
+              name: radarr-secret
+              key: logsdb
+        volumeMounts:
+        - name: config
+          mountPath: /config
+        - name: downloads
+          mountPath: /downloads
+        - name: movie
+          mountPath: /movie
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: radarr-config-pvc
+      - name: downloads
+        persistentVolumeClaim:
+          claimName: qbittorrent-downloads-pvc
+      - name: movie
+        persistentVolumeClaim:
+          claimName: radarr-movie-pvc
+
+

roles/radarr/files/radarr-nfs-csi.yaml

@@ -0,0 +1,23 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: radarr-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/radarr
+allowVolumeExpansion: true
+reclaimPolicy: Retain
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: radarr-movie-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series/Filmes
+allowVolumeExpansion: true
+reclaimPolicy: Retain

roles/radarr/files/radarr-pvcs.yaml

@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: radarr-config-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 2Gi
+  storageClassName: radarr-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/radarr/config
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: radarr-config-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: radarr-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: radarr-config-pv
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: radarr-movie-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 50Gi
+  storageClassName: radarr-movie-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series/Filmes
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: radarr-movie-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: radarr-movie-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: radarr-movie-pv
+  resources:
+    requests:
+      storage: 50Gi
+---

roles/radarr/files/radarr-secret.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name:  radarr-secret
+    namespace: stack-arr
+type: Opaque
+data:
+    username: dXNlcm5hbWU=
+    password: cGFzc3dvcmQ=
+    maindb: bWFpbmRiLXByb3dsYXJy
+    logsdb: bG9nZGItcHJvd2xhcnI=

roles/radarr/files/radarr-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: radarr-service
+  namespace: stack-arr
+spec:
+  ports:
+    - port: 7878
+      targetPort: 7878
+  selector:
+    app: radarr
+  type: ClusterIP

roles/radarr/tasks/main.yml

@@ -0,0 +1,51 @@
+- name: Remover o diretório /tmp/stack-arr/radarr/kubernetes-files
+  ansible.builtin.file:
+    path: /tmp/stack-arr/radarr/kubernetes-files
+    state: absent
+
+- name: Criar diretório temporário no remoto
+  file:
+    path: /tmp/stack-arr/radarr/kubernetes-files
+    state: directory
+    mode: '0755'
+
+- name: Copy file with owner and permissions
+  ansible.builtin.copy:
+    src: ../files
+    dest: /tmp/stack-arr/radarr/kubernetes-files
+    owner: fenix
+    group: root
+    mode: '0644'
+
+
+- name: Obter várias notas do Bitwarden
+  shell: |
+    echo "unlock"
+    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
+    echo "get item"
+    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
+  loop:
+    - { id: "iac.ansible.stackarr.radarr.secret", dest: "/tmp/stack-arr/radarr/kubernetes-files/files/radarr-secret.yaml" }
+  args:
+    executable: /bin/bash
+  environment:
+    BW_PASSWORD: "{{ BW_PASSWORD }}"
+
+
+- name: Listar conteúdo do diretório remoto
+  shell: ls -l /tmp/stack-arr/radarr/kubernetes-files/files
+  register: resultado_ls
+
+
+- name: Mostrar resultado do ls
+  debug:
+    var: resultado_ls.stdout_lines
+
+
+- name: Aplicar o stolon
+  become: yes
+  become_user: fenix 
+  shell: |
+    kubectl apply -f /tmp/stack-arr/radarr/kubernetes-files/files/
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config

roles/radarr/vars/main.yml

@@ -0,0 +1,4 @@
+bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
+VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
+BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
+BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/sonarr/files/sonarr-deployment.yaml

@@ -0,0 +1,82 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sonarr
+  namespace: stack-arr
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sonarr
+  template:
+    metadata:
+      labels:
+        app: sonarr
+    spec:
+      imagePullSecrets:
+      - name: regcred
+      containers:
+      - name: sonarr
+        image: lscr.io/linuxserver/sonarr:4.0.16
+        securityContext:
+          capabilities:
+            add:
+              - NET_ADMIN
+        ports:
+          - containerPort: 8989
+            name: webui
+        env:
+        - name: PUID
+          value: "1013"
+        - name: PGID
+          value: "1013"
+        - name: TZ
+          value: 'Etc/UTC'
+        - name: SONARR__POSTGRES__HOST
+          value: 'stolon-proxy-service.postgresql.svc.cluster.local'
+        - name: SONARR__POSTGRES__USER
+          valueFrom:
+            secretKeyRef:
+              name: sonarr-secret
+              key: username
+        - name: SONARR__POSTGRES__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: sonarr-secret
+              key: password
+        - name: SONARR__POSTGRES__MAINDB
+          valueFrom:
+            secretKeyRef:
+              name: sonarr-secret
+              key: maindb
+        - name: SONARR__POSTGRES__LOGDB
+          valueFrom:
+            secretKeyRef:
+              name: sonarr-secret
+              key: logsdb
+        volumeMounts:
+        - name: config
+          mountPath: /config
+        - name: downloads
+          mountPath: /downloads
+        - name: tv
+          mountPath: /tv
+        - name: anime
+          mountPath: /anime
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: sonarr-config-pvc
+      - name: downloads
+        persistentVolumeClaim:
+          claimName: qbittorrent-downloads-pvc
+      - name: tv
+        persistentVolumeClaim:
+          claimName: sonarr-tv-pvc
+      - name: anime
+        persistentVolumeClaim:
+          claimName: sonarr-anime-pvc
+
+
+
+

roles/sonarr/files/sonarr-nfs-csi.yaml

@@ -0,0 +1,35 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: sonarr-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/sonarr
+allowVolumeExpansion: true
+reclaimPolicy: Retain
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: sonarr-tv-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series/TV
+allowVolumeExpansion: true
+reclaimPolicy: Retain
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: sonarr-anime-nfs-csi
+  namespace: stack-arr
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series/Anime
+allowVolumeExpansion: true
+reclaimPolicy: Retain

roles/sonarr/files/sonarr-pvcs.yaml

@@ -0,0 +1,90 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: sonarr-config-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 2Gi
+  storageClassName: sonarr-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/stack-arr/sonarr/config
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sonarr-config-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: sonarr-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: sonarr-config-pv
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: sonarr-tv-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 50Gi
+  storageClassName: sonarr-tv-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series/TV
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sonarr-tv-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: sonarr-tv-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: sonarr-tv-pv
+  resources:
+    requests:
+      storage: 50Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: sonarr-anime-pv
+  namespace: stack-arr
+spec:
+  capacity:
+    storage: 50Gi
+  storageClassName: sonarr-anime-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/Filmes_e_Series/Anime
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sonarr-anime-pvc
+  namespace: stack-arr
+spec:
+  storageClassName: sonarr-anime-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: sonarr-anime-pv
+  resources:
+    requests:
+      storage: 50Gi
+---

roles/sonarr/files/sonarr-secret.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name:  sonarr-secret
+    namespace: stack-arr
+type: Opaque
+data:
+    username: dXNlcm5hbWU=
+    password: cGFzc3dvcmQ=
+    maindb: bWFpbmRiLXByb3dsYXJy
+    logsdb: bG9nZGItcHJvd2xhcnI=

roles/sonarr/files/sonarr-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: sonarr-service
+  namespace: stack-arr
+spec:
+  ports:
+    - port: 8989
+      targetPort: 8989
+  selector:
+    app: sonarr
+  type: ClusterIP

roles/sonarr/tasks/main.yml

@@ -0,0 +1,51 @@
+- name: Remover o diretório /tmp/stack-arr/sonarr/kubernetes-files
+  ansible.builtin.file:
+    path: /tmp/stack-arr/sonarr/kubernetes-files
+    state: absent
+
+- name: Criar diretório temporário no remoto
+  file:
+    path: /tmp/stack-arr/sonarr/kubernetes-files
+    state: directory
+    mode: '0755'
+
+- name: Copy file with owner and permissions
+  ansible.builtin.copy:
+    src: ../files
+    dest: /tmp/stack-arr/sonarr/kubernetes-files
+    owner: fenix
+    group: root
+    mode: '0644'
+
+
+- name: Obter várias notas do Bitwarden
+  shell: |
+    echo "unlock"
+    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
+    echo "get item"
+    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
+  loop:
+    - { id: "iac.ansible.stackarr.sonarr.secret", dest: "/tmp/stack-arr/sonarr/kubernetes-files/files/sonarr-secret.yaml" }
+  args:
+    executable: /bin/bash
+  environment:
+    BW_PASSWORD: "{{ BW_PASSWORD }}"
+
+
+- name: Listar conteúdo do diretório remoto
+  shell: ls -l /tmp/stack-arr/sonarr/kubernetes-files/files
+  register: resultado_ls
+
+
+- name: Mostrar resultado do ls
+  debug:
+    var: resultado_ls.stdout_lines
+
+
+- name: Aplicar o stolon
+  become: yes
+  become_user: fenix 
+  shell: |
+    kubectl apply -f /tmp/stack-arr/sonarr/kubernetes-files/files/
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config

roles/sonarr/vars/main.yml

@@ -0,0 +1,4 @@
+bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
+VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
+BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
+BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/stolon/files/docker-secrets.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: regcred
+  namespace: postgresql
+data:
+  .dockerconfigjson: >-
+    eyJhdXRocyI6eyJodHRwczovL2luZGV4LmRvY2tlci5pby92MS8iOnsidXNlcm5hbWUiOiJ1c2VyIiwicGFzc3dvcmQiOiJwYXNzIiwiYXV0aCI6ImRmamlla2ZlcldFS1dFa29mY2RrbzM0MzUzZmQ9In19fQ==
+type: kubernetes.io/dockerconfigjson

roles/stolon/files/stolon-keeper.yaml

@@ -0,0 +1,126 @@
+# PetSet was renamed to StatefulSet in k8s 1.5
+# apiVersion: apps/v1alpha1
+# kind: PetSet
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: stolon-keeper
+  namespace: postgresql
+spec:
+  serviceName: "stolon-keeper"
+  replicas: 3
+  selector:
+    matchLabels:
+      component: stolon-keeper
+      stolon-cluster: kube-stolon
+  template:
+    metadata:
+      labels:
+        component: stolon-keeper
+        stolon-cluster: kube-stolon
+      annotations:
+        pod.alpha.kubernetes.io/initialized: "true"
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8080"
+    spec:
+      imagePullSecrets:
+      - name: regcred
+      terminationGracePeriodSeconds: 10
+      containers:
+        - name: stolon-keeper
+          image: sorintlab/stolon:master-pg15
+          command:
+            - "/bin/bash"
+            - "-ec"
+            - |
+
+              echo "COMECANDO com user 1013"
+              useradd -u 1013 -r -s /usr/sbin/nologin fenixuser
+              id
+              id stolon
+              # Generate our keeper uid using the pod index
+              IFS='-' read -ra ADDR <<< "$(hostname)"
+              export STKEEPER_UID="keeper${ADDR[-1]}"
+              export POD_IP=$(hostname -i)
+              export STKEEPER_PG_LISTEN_ADDRESS=$POD_IP
+              
+              which psql
+              which postgres
+              which pg_ctl
+
+
+              export STOLON_DATA=/stolon-data/data
+              mkdir -p $STOLON_DATA
+
+
+              ls -la $STOLON_DATA
+
+              exec gosu 1013 stolon-keeper --data-dir $STOLON_DATA
+
+
+
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: STKEEPER_CLUSTER_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.labels['stolon-cluster']
+            - name: STKEEPER_STORE_BACKEND
+              value: "kubernetes"
+            - name: STKEEPER_KUBE_RESOURCE_KIND
+              value: "configmap"
+            - name: STKEEPER_PG_REPL_USERNAME
+              #value: "repluser"
+              valueFrom:
+                secretKeyRef:
+                  name: stolon-repl-secret
+                  key: username
+            - name: STKEEPER_PG_REPL_PASSWORD
+              #value: "replpassword"
+              valueFrom:
+                secretKeyRef:
+                  name: stolon-repl-secret
+                  key: password
+            - name: STKEEPER_PG_SU_USERNAME
+              #value: "stolon"
+              valueFrom:
+                secretKeyRef:
+                  name: stolon-secret
+                  key: username
+            - name: STKEEPER_PG_SU_PASSWORDFILE
+              value: "/etc/secrets/stolon/password"
+            - name: STKEEPER_METRICS_LISTEN_ADDRESS
+              value: "0.0.0.0:8080"
+            # Uncomment this to enable debug logs
+            #- name: STKEEPER_DEBUG
+            #  value: "true"
+          ports:
+            - containerPort: 5432
+            - containerPort: 8080
+          volumeMounts:
+            - mountPath: /stolon-data
+              name: stolon-data
+            - mountPath: /etc/secrets/stolon
+              name: stolon
+      volumes:
+        - name: stolon
+          secret:
+            secretName: stolon-secret
+  volumeClaimTemplates:
+    - kind: PersistentVolumeClaim
+      apiVersion: v1
+      metadata:
+        name: stolon-data
+        namespace: postgresql
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 10Gi
+        selector:
+          matchLabels:
+            postgres-id: "stolon-0" 

roles/stolon/files/stolon-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: postgresql

roles/stolon/files/stolon-nfs-csi.yaml

@@ -0,0 +1,11 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: stolon-nfs-csi
+  namespace: postgresql
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.22
+  share: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/postgresql-stolon
+allowVolumeExpansion: true
+reclaimPolicy: Retain

roles/stolon/files/stolon-proxy-service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: stolon-proxy-service
+  namespace: postgresql
+spec:
+  ports:
+    - port: 5432
+      targetPort: 5432
+  selector:
+    component: stolon-proxy
+    stolon-cluster: kube-stolon
+  type: LoadBalancer
+  loadBalancerIP: 10.240.0.100

roles/stolon/files/stolon-proxy.yaml

@@ -0,0 +1,58 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: stolon-proxy
+  namespace: postgresql
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      component: stolon-proxy
+      stolon-cluster: kube-stolon
+  template:
+    metadata:
+      labels:
+        component: stolon-proxy
+        stolon-cluster: kube-stolon
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8080"
+    spec:
+      imagePullSecrets:
+      - name: regcred
+      containers:
+        - name: stolon-proxy
+          image: sorintlab/stolon:master-pg10
+          command:
+            - "/bin/bash"
+            - "-ec"
+            - |
+              exec gosu stolon stolon-proxy
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: STPROXY_CLUSTER_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.labels['stolon-cluster']
+            - name: STPROXY_STORE_BACKEND
+              value: "kubernetes"
+            - name: STPROXY_KUBE_RESOURCE_KIND
+              value: "configmap"
+            - name: STPROXY_LISTEN_ADDRESS
+              value: "0.0.0.0"
+            - name: STPROXY_METRICS_LISTEN_ADDRESS
+              value: "0.0.0.0:8080"
+            ## Uncomment this to enable debug logs
+            #- name: STPROXY_DEBUG
+            #  value: "true"
+          ports:
+            - containerPort: 5432
+            - containerPort: 8080
+          readinessProbe:
+            tcpSocket:
+              port: 5432
+            initialDelaySeconds: 10
+            timeoutSeconds: 5

roles/stolon/files/stolon-pvcs.yaml

@@ -0,0 +1,111 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: stolon-pv-0
+  namespace: postgresql
+  labels:
+    postgres-id: "stolon-0"
+spec:
+  capacity:
+    storage: 10Gi
+  storageClassName: stolon-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/postgresql-stolon/keeper-0
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: stolon-pv-1
+  namespace: postgresql
+  labels:
+    postgres-id: "stolon-0"
+spec:
+  capacity:
+    storage: 10Gi
+  storageClassName: stolon-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/postgresql-stolon/keeper-1
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: stolon-pv-2
+  namespace: postgresql
+  labels:
+    postgres-id: "stolon-0"
+spec:
+  capacity:
+    storage: 10Gi
+  storageClassName: stolon-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.1.22
+    path: /mnt/fenix-main-nas-pool-0/data/k8s-Volumes/k8s-cluster-iac-deployed/postgresql-stolon/keeper-2
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: stolon-data-stolon-keeper-0
+  namespace: postgresql
+  labels:
+    postgres-id: "stolon-0"
+spec:
+  storageClassName: stolon-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: stolon-pv-0
+  resources:
+    requests:
+      storage: 10Gi
+  selector:
+    matchLabels:
+      postgres-id: "stolon-0"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: stolon-data-stolon-keeper-1
+  namespace: postgresql
+  labels:
+    postgres-id: "stolon-0"
+spec:
+  storageClassName: stolon-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: stolon-pv-1
+  resources:
+    requests:
+      storage: 10Gi
+  selector:
+    matchLabels:
+      postgres-id: "stolon-0"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: stolon-data-stolon-keeper-2
+  namespace: postgresql
+  labels:
+    postgres-id: "stolon-0"
+spec:
+  storageClassName: stolon-nfs-csi
+  accessModes:
+    - ReadWriteOnce
+  volumeName: stolon-pv-2
+  resources:
+    requests:
+      storage: 10Gi
+  selector:
+    matchLabels:
+      postgres-id: "stolon-0"
+---

roles/stolon/files/stolon-repl-secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: stolon-repl-secret
+    namespace: postgresql
+type: Opaque
+data:
+    username: asOndDQ5aWZqa2w0aW85
+    password: asOndDQ5aWZqa2w0aW85

roles/stolon/files/stolon-role-binding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: stolon-role-binding
+  namespace: postgresql
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: stolon-role
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: postgresql

roles/stolon/files/stolon-role.yaml

@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: stolon-role
+  namespace: postgresql
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - configmaps
+  - events
+  verbs:
+  - "*"

roles/stolon/files/stolon-secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: stolon-secret
+    namespace: postgresql
+type: Opaque
+data:
+    username: asOndDQ5aWZqa2w0aW85
+    password: asOndDQ5aWZqa2w0aW85

roles/stolon/files/stolon-sentinel.yaml

@@ -0,0 +1,50 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: stolon-sentinel
+  namespace: postgresql
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      component: stolon-sentinel
+      stolon-cluster: kube-stolon
+  template:
+    metadata:
+      labels:
+        component: stolon-sentinel
+        stolon-cluster: kube-stolon
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8080"
+    spec:
+      imagePullSecrets:
+      - name: regcred
+      containers:
+        - name: stolon-sentinel
+          image: sorintlab/stolon:master-pg10
+          command:
+            - "/bin/bash"
+            - "-ec"
+            - |
+              exec gosu stolon stolon-sentinel
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: STSENTINEL_CLUSTER_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.labels['stolon-cluster']
+            - name: STSENTINEL_STORE_BACKEND
+              value: "kubernetes"
+            - name: STSENTINEL_KUBE_RESOURCE_KIND
+              value: "configmap"
+            - name: STSENTINEL_METRICS_LISTEN_ADDRESS
+              value: "0.0.0.0:8080"
+            ## Uncomment this to enable debug logs
+            #- name: STSENTINEL_DEBUG
+            #  value: "true"
+          ports:
+            - containerPort: 8080

roles/stolon/tasks/main.yml

@@ -0,0 +1,63 @@
+- name: Remover o diretório /tmp/stolon/kubernetes-files
+  ansible.builtin.file:
+    path: /tmp/stolon/kubernetes-files
+    state: absent
+
+- name: Criar diretório temporário no remoto
+  file:
+    path: /tmp/stolon/kubernetes-files
+    state: directory
+    mode: '0755'
+
+- name: Copy file with owner and permissions
+  ansible.builtin.copy:
+    src: ../files
+    dest: /tmp/stolon/kubernetes-files
+    owner: fenix
+    group: root
+    mode: '0644'
+
+- name: Listar conteúdo do diretório remoto
+  shell: ls -l /tmp/stolon/kubernetes-files/files
+  register: resultado_ls
+
+
+- name: Obter várias notas do Bitwarden
+  shell: |
+    echo "unlock"
+    BW_SESSION=$(bw unlock {{ bw_password }} --raw)
+    echo "get item"
+    bw get item "{{ item.id }}" --session $BW_SESSION | jq -r '.notes' > {{ item.dest }}
+  loop:
+    - { id: "iac.ansible.dockersecrets", dest: "/tmp/stolon/kubernetes-files/files/docker-secrets.yaml" }
+    - { id: "iac.ansible.stolon.repl.secret", dest: "/tmp/stolon/kubernetes-files/files/stolon-repl-secret.yaml" }
+    - { id: "iac.ansible.stolon.keeper.secret", dest: "/tmp/stolon/kubernetes-files/files/stolon-secret.yaml" }
+  args:
+    executable: /bin/bash
+  environment:
+    BW_PASSWORD: "{{ BW_PASSWORD }}"
+
+
+- name: Mostrar resultado do ls
+  debug:
+    var: resultado_ls.stdout_lines
+
+- name: Aplicar o stolon
+  become: yes
+  become_user: fenix 
+  shell: |
+    kubectl apply -f /tmp/stolon/kubernetes-files/files/stolon-namespace.yaml
+    kubectl apply -f /tmp/stolon/kubernetes-files/files/
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config
+
+
+- name: reabilitar database stolon
+  become: yes
+  become_user: fenix 
+  shell: |
+    kubectl run -i -n=postgresql -t stolonctl --image=sorintlab/stolon:master-pg15 --restart=Never --rm --timeout=360s -- /usr/local/bin/stolonctl  --cluster-name kube-stolon --store-backend kubernetes --kube-resource-kind=configmap init -y '{"initMode":"existing","existingConfig": {"keeperUID": "keeper0","followersUIDs": ["keeper1","keeper2"]}}'
+    # run this if first time setting up database
+    #    kubectl run -i -n=postgresql -t stolonctl --image=sorintlab/stolon:master-pg15 --restart=Never --rm -- /usr/local/bin/stolonctl --cluster-name=kube-stolon --store-backend=kubernetes --kube-resource-kind=configmap init --yes
+  environment:
+    KUBECONFIG:  /home/fenix/.kube/config

roles/stolon/vars/main.yml

@@ -0,0 +1,4 @@
+bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
+VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
+BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
+BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"

roles/vaultwarden/tasks/main.yml

@@ -0,0 +1,77 @@
+- name: Atualizar pacotes e instalar dependências básicas
+  become: true
+  apt:
+    name:
+      - curl
+      - git
+      - unzip
+      - jq
+      - gnupg
+      - ca-certificates
+    state: present
+    update_cache: true
+
+- name: Adicionar repositório NodeSource para Node.js 20
+  become: true
+  shell: curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+  args:
+    executable: /bin/bash
+
+- name: Instalar Node.js 20
+  become: true
+  apt:
+    name: nodejs
+    state: present
+    update_cache: true
+
+- name: Verificar versão do Node.js
+  command: node -v
+  register: node_version
+  changed_when: false
+
+- name: Verificar versão do npm
+  command: npm -v
+  register: npm_version
+  changed_when: false
+  
+- name: Instalar Bitwarden CLI via npm
+  become: true
+  shell: npm install -g @bitwarden/cli
+  args:
+    executable: /bin/bash
+
+- name: Verificar instalação do Bitwarden CLI
+  command: bw --version
+  register: bw_version
+  failed_when: bw_version.rc != 0
+
+- name: Garantir logout do Bitwarden antes de configurar
+  shell: bw logout
+  ignore_errors: true
+
+- name: Fazer login no Bitwarden
+  shell: | 
+    echo "config"
+    echo "VAULTWARDEN_LINK: {{ VAULTWARDEN_LINK }}"
+    bw config server {{ VAULTWARDEN_LINK }}
+    echo $BW_CLIENTID
+    echo $BW_CLIENTSECRET
+    echo "login"
+    bw login --apikey
+  environment:
+    BW_CLIENTID: "{{ BW_CLIENTID }}"
+    BW_CLIENTSECRET: "{{ BW_CLIENTSECRET }}"
+    VAULTWARDEN_LINK: "{{ VAULTWARDEN_LINK }}"
+  args:
+    executable: /bin/bash
+  register: bw_login
+
+- name: Desbloquear cofre e guardar sessão
+  shell: bw unlock {{ bw_password }} --raw
+  register: bw_session
+  environment:
+    BW_PASSWORD: "{{ BW_PASSWORD }}"
+
+- name: Exportar sessão para ambiente local
+  shell: echo "export BW_SESSION={{ bw_session.stdout }}" >> /etc/profile.d/bw-session.sh
+  become: true

roles/vaultwarden/vars/main.yml

@@ -0,0 +1,4 @@
+bw_password: "{{ lookup('env', 'BW_PASSWORD') }}"
+VAULTWARDEN_LINK: "{{ lookup('env', 'VAULTWARDEN_LINK') }}"
+BW_CLIENTID: "{{ lookup('env', 'BW_CLIENTID') }}"
+BW_CLIENTSECRET : "{{ lookup('env', 'BW_CLIENTSECRET') }}"