Add Atlas media and storage services

ansible/inventory/host_vars/atlas.yml

@@ -1,10 +1,10 @@
 ---
-# Replace every CHANGEME value before enabling Atlas storage management.
+# Keep Atlas management gates disabled until the NAS and required Vault inputs are ready.
 hostname: atlas
-ansible_host: CHANGEME_ATLAS_HOST
+ansible_host: 192.168.178.55
 ansible_user: "{{ atlas_connection_username }}"
 ansible_port: 22
-ansible_ssh_private_key_file: CHANGEME_ATLAS_SSH_PRIVATE_KEY_PATH
+ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519
 
 atlas_admin_username: admin
 atlas_connection_username: "{{ atlas_admin_username }}"
@@ -15,46 +15,67 @@ atlas_admin_gid: 1000
 atlas_admin_ssh_keys: "{{ vault_atlas_authorized_ssh_keys | default([]) }}"
 atlas_admin_password_hash: "{{ vault_atlas_admin_password_hash | default('!') }}"
 
-atlas_lan_subnet: CHANGEME_LAN_SUBNET
+atlas_lan_subnet: 192.168.178.0/24
+atlas_aegis_ip: 192.168.178.54
 atlas_manage_firewall: false
 atlas_firewalld_zone: public
-atlas_zfs_pool: CHANGEME_ZFS_POOL
+atlas_zfs_pool: zpool
 atlas_zfs_dataset_work: work
+atlas_zfs_dataset_archive: archive
+atlas_zfs_dataset_music: media/music
 atlas_zfs_dataset_syncthing: syncthing
 atlas_zfs_dataset_backup_prometheus: backup_prometheus
-atlas_zfs_dataset_icloud_photos: icloud_photos
-atlas_mount_root: /CHANGEME_ATLAS_MOUNT_ROOT
+atlas_zfs_dataset_icloud_photos: media/icloud_photos
+atlas_zfs_dataset_service_backups: backups/services
+atlas_mount_root: /zpool
 atlas_manage_storage: false
+atlas_manage_media_stack: false
 
 rocky_manage_openzfs_repo: true
 rocky_manage_syncthing_binary: true
+rocky_manage_podman: true
+rocky_podman_packages:
+  - podman
 
 host_packages:
   - cockpit
   - nfs-utils
   - policycoreutils-python-utils
   - samba
+  - samba-client
+  - samba-common-tools
   - zfs
 
 atlas_nfs_exports:
-  - path: "{{ atlas_work_mountpoint }}"
-    clients: "{{ atlas_lan_subnet }}(rw,sync,no_subtree_check,root_squash)"
+  - path: "{{ atlas_icloud_photos_mountpoint }}"
+    client: "{{ atlas_aegis_ip }}"
+    options:
+      - rw
+      - sync
+      - no_subtree_check
+      - all_squash
+      - "anonuid={{ atlas_immich_uid }}"
+      - "anongid={{ atlas_immich_gid }}"
 
-atlas_samba_share_name: work
+atlas_samba_share_name: Archive
 atlas_samba_workgroup: WORKGROUP
-atlas_samba_valid_users:
-  - "{{ atlas_admin_username }}"
-atlas_samba_password: "{{ vault_atlas_samba_password | default('') }}"
+# Append any pre-existing laptop Unix account here and keep its Samba password in Vault.
+atlas_samba_accounts:
+  - username: "{{ atlas_admin_username }}"
+    password: "{{ vault_atlas_samba_password | default('') }}"
+atlas_samba_valid_users: "{{ atlas_samba_accounts | map(attribute='username') | list }}"
+
+atlas_immich_db_password: "{{ vault_atlas_immich_db_password | default('') }}"
 
 atlas_firewalld_rich_rules:
   - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="ssh" accept'
   - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="cockpit" accept'
-  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="2049" protocol="tcp" accept'
+  - 'rule family="ipv4" source address="{{ atlas_aegis_ip }}" service name="nfs" accept'
   - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="samba" accept'
+  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="http" accept'
+  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="https" accept'
 
 host_enabled_services:
   - sshd
   - cockpit.socket
-  - nfs-server
-  - smb
   - zfs.target