Enable Atlas NAS management and document bootstrap workflow

ansible/inventory/host_vars/atlas.yml

@@ -1,5 +1,5 @@
 ---
-# Keep Atlas management gates disabled until the NAS and required Vault inputs are ready.
+# Atlas declares its intended steady state; set a feature flag false only for a deliberate suspension.
 hostname: atlas
 ansible_host: 192.168.178.55
 ansible_user: "{{ atlas_connection_username }}"
@@ -17,9 +17,13 @@ atlas_admin_password_hash: "{{ vault_atlas_admin_password_hash | default('!') }}
 
 atlas_lan_subnet: 192.168.178.0/24
 atlas_aegis_ip: 192.168.178.54
-atlas_manage_firewall: false
+atlas_manage_firewall: true
 atlas_firewalld_zone: public
 atlas_zfs_pool: zpool
+# Populate only for the first pool bootstrap with four real persistent disk paths.
+# Example: /dev/disk/by-id/ata-Seagate_IronWolf_...
+atlas_zpool_disks: []
+atlas_create_pool: false
 atlas_zfs_dataset_work: work
 atlas_zfs_dataset_archive: archive
 atlas_zfs_dataset_app_data: archive/app_data
@@ -32,10 +36,11 @@ atlas_zfs_dataset_photobook: media/photobook
 atlas_zfs_dataset_backups: backups
 atlas_zfs_dataset_service_backups: backups/services
 atlas_mount_root: /zpool
-atlas_manage_storage: false
+atlas_manage_storage: true
+atlas_manage_sharing: true
 atlas_manage_media_stack: false
 
-wireguard_overlay_enabled: false
+wireguard_overlay_enabled: true
 wireguard_address: 10.0.0.2/24
 wireguard_peers:
   - name: prometheus
@@ -45,7 +50,7 @@ wireguard_peers:
       - 10.0.0.0/24
     persistent_keepalive: 25
 
-backend_phase1_enabled: false
+backend_phase1_enabled: true
 backend_phase1_start_services: false
 backend_phase1_wireguard_address: 10.0.0.2
 

ansible/inventory/host_vars/prometheus.yml

@@ -8,7 +8,7 @@ ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519
 server_username: rocky
 server_duckdns_domain: fscotto
 
-wireguard_overlay_enabled: false
+wireguard_overlay_enabled: true
 wireguard_address: 10.0.0.1/24
 wireguard_listen_port: 51820
 wireguard_enable_ipv4_forwarding: true

ansible/roles/profile_atlas/defaults/main.yml

@@ -1,5 +1,9 @@
 ---
 atlas_manage_storage: false
+atlas_manage_sharing: false
+# Destructive first-boot action; normally false once the pool exists.
+atlas_create_pool: false
+atlas_zpool_disks: []
 atlas_admin_username: CHANGEME_ATLAS_ADMIN
 atlas_admin_group: "{{ atlas_admin_username }}"
 atlas_admin_home: "/home/{{ atlas_admin_username }}"

ansible/roles/profile_atlas/tasks/main.yml

@@ -5,6 +5,9 @@
 - name: Import Atlas 45Drives tasks
   ansible.builtin.import_tasks: cockpit.yml
 
+- name: Import Atlas pool bootstrap tasks
+  ansible.builtin.import_tasks: pool.yml
+
 - name: Import Atlas storage tasks
   ansible.builtin.import_tasks: storage.yml
 

ansible/roles/profile_atlas/tasks/pool.yml

@@ -0,0 +1,56 @@
+---
+- name: Bootstrap Atlas ZFS pool
+  tags: [atlas, storage, pool]
+  when: atlas_create_pool | bool
+  block:
+    - name: Validate Atlas pool bootstrap inputs
+      ansible.builtin.assert:
+        that:
+          - atlas_zpool_disks | length == 4
+          - atlas_zpool_disks | unique | length == 4
+          - atlas_zpool_disks | select('match', '^/dev/disk/by-id/') | list | length == 4
+        fail_msg: >-
+          Set exactly four distinct persistent /dev/disk/by-id paths in
+          atlas_zpool_disks before creating the RAIDZ2 pool.
+
+    - name: Inspect declared Atlas pool disks
+      ansible.builtin.stat:
+        path: "{{ item }}"
+      loop: "{{ atlas_zpool_disks }}"
+      loop_control:
+        label: "{{ item }}"
+      register: atlas_zpool_disk_stats
+
+    - name: Require every declared Atlas pool disk
+      ansible.builtin.assert:
+        that:
+          - item.stat.exists
+          - item.stat.isblk | default(false)
+        fail_msg: "Declared Atlas pool disk is unavailable or is not a block device: {{ item.item }}"
+      loop: "{{ atlas_zpool_disk_stats.results }}"
+      loop_control:
+        label: "{{ item.item }}"
+
+    - name: Check whether the Atlas ZFS pool already exists
+      ansible.builtin.command:
+        argv:
+          - zpool
+          - list
+          - -H
+          - -o
+          - name
+          - "{{ atlas_zfs_pool }}"
+      register: atlas_zpool_bootstrap_check
+      changed_when: false
+      failed_when: atlas_zpool_bootstrap_check.rc not in [0, 1]
+
+    - name: Create the Atlas RAIDZ2 pool when absent
+      community.general.zpool:
+        name: "{{ atlas_zfs_pool }}"
+        state: present
+        mountpoint: "{{ atlas_mount_root }}"
+        force: false
+        vdevs:
+          - type: raidz2
+            disks: "{{ atlas_zpool_disks }}"
+      when: atlas_zpool_bootstrap_check.rc == 1

ansible/roles/profile_atlas/tasks/sharing.yml

@@ -8,7 +8,7 @@
     group: root
     mode: "0644"
   notify: Reload NFS exports
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Enable Atlas file-sharing services
   tags: [atlas, sharing, services]
@@ -21,7 +21,7 @@
     - smb.service
   loop_control:
     label: "{{ item }}"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Configure Atlas NFSv4-only service
   tags: [atlas, sharing]
@@ -32,7 +32,7 @@
     group: root
     mode: "0644"
   notify: Restart NFS server
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Mask Atlas NFSv3 RPC services
   tags: [atlas, sharing, services]
@@ -47,7 +47,7 @@
     - rpcbind.socket
   loop_control:
     label: "{{ item }}"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Ensure Atlas NFS mount daemon drop-in directory exists
   tags: [atlas, sharing, services]
@@ -57,7 +57,7 @@
     owner: root
     group: root
     mode: "0755"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Disable Atlas NFSv3 mount daemon listeners
   tags: [atlas, sharing, services]
@@ -68,7 +68,7 @@
     group: root
     mode: "0644"
   notify: Restart NFS mount daemon
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Enable SELinux access for Atlas file sharing
   tags: [atlas, sharing, services]
@@ -80,7 +80,7 @@
   loop_control:
     label: "{{ item }}"
   when:
-    - atlas_manage_storage | bool
+    - atlas_manage_sharing | bool
     - (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'
 
 - name: Render Atlas Samba configuration
@@ -93,7 +93,7 @@
     mode: "0644"
     validate: "testparm --suppress-prompt %s"
   notify: Restart Samba service
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Require Vault-backed Atlas Samba accounts
   tags: [atlas, sharing]
@@ -109,7 +109,7 @@
       - atlas_samba_accounts | selectattr('password', 'equalto', '') | list | length == 0
     fail_msg: Define every authorized Samba account and its Vault-backed password.
   no_log: true
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Ensure Atlas Samba private state directory exists
   tags: [atlas, sharing]
@@ -119,7 +119,7 @@
     owner: root
     group: root
     mode: "0700"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Manage Vault-backed Atlas Samba credentials
   tags: [atlas, sharing]
@@ -129,7 +129,7 @@
     loop_var: atlas_samba_account
     label: "{{ atlas_samba_account.username }}"
   no_log: true
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Require completed Atlas firewall placeholders
   tags: [atlas, sharing, services]