Add dormant Rocky server profile

2026-09-27 19:03:47 +00:00 · 2026-08-31 21:32:03 +02:00
parent 45340103d0
commit e0a81d6a70
12 changed files with 263 additions and 31 deletions
--- a/ansible/inventory/group_vars/platform_rocky.yml
+++ b/ansible/inventory/group_vars/platform_rocky.yml
@@ -16,17 +16,39 @@ rocky_syncthing_archive_url: >-
    ~ '.tar.gz'
  }}

+rocky_manage_openzfs_repo: false
+rocky_manage_syncthing_binary: false
+rocky_manage_docker_repo: false
+rocky_manage_github_cli_repo: false
+
+rocky_docker_repo_url: https://download.docker.com/linux/rhel/docker-ce.repo
+rocky_docker_repo_file: /etc/yum.repos.d/docker-ce.repo
+rocky_github_cli_repo_url: https://cli.github.com/packages/rpm/gh-cli.repo
+rocky_github_cli_repo_file: /etc/yum.repos.d/gh-cli.repo
+
 enabled_services:
  - firewalld

+rocky_common_packages:
+  - bash-completion
+  - bat
+  - fzf
+  - git
+  - jq
+  - tree
+  - unzip
+  - vim-enhanced
+  - wget
+  - zip
+  - zoxide
+
 rocky_packages_base:
-  - cockpit
  - dnf-plugins-core
  - firewalld
-  - nfs-utils
  - openssh-server
-  - policycoreutils-python-utils
  - rsync
-  - samba
  - sudo
-  - zfs
+
+rocky_profile_packages: []
+rocky_docker_packages: []
+rocky_docker_conflicting_packages: []
--- a/ansible/inventory/group_vars/rocky_server.yml
+++ b/ansible/inventory/group_vars/rocky_server.yml
@@ -0,0 +1,57 @@
+---
+rocky_manage_docker_repo: true
+rocky_manage_github_cli_repo: true
+
+rocky_profile_packages:
+  - avahi
+  - curl
+  - dmidecode
+  - dosfstools
+  - gcc
+  - gcc-c++
+  - git-delta
+  - gh
+  - gnupg2
+  - htop
+  - make
+  - nmap-ncat
+  - nodejs
+  - parted
+  - pciutils
+  - pinentry
+  - ranger
+  - ripgrep
+
+rocky_docker_packages:
+  - containerd.io
+  - docker-buildx-plugin
+  - docker-ce
+  - docker-ce-cli
+  - docker-compose-plugin
+
+rocky_docker_conflicting_packages:
+  - docker
+  - docker-client
+  - docker-client-latest
+  - docker-common
+  - docker-engine
+  - docker-latest
+  - docker-latest-logrotate
+  - docker-logrotate
+  - podman
+  - runc
+
+enabled_services:
+  - firewalld
+  - docker
+
+server_firewall_backend: firewalld
+server_firewalld_zone: public
+server_firewalld_services:
+  - ssh
+server_firewalld_ports:
+  - 22000/tcp
+  - 22000/udp
+  - 21027/udp
+server_sshd_service_name: sshd
+server_compose_selinux_mount_option: Z
--- a/ansible/inventory/group_vars/ubuntu.yml
+++ b/ansible/inventory/group_vars/ubuntu.yml
@@ -31,6 +31,10 @@ enabled_services:
  - ufw
  - docker

+server_firewall_backend: ufw
+server_sshd_service_name: ssh
+server_compose_selinux_mount_option: ""
+
 ubuntu_dotfiles:
  - src: .bashrc.d/
    dest: .bashrc.d/
--- a/ansible/inventory/host_vars/atlas.yml
+++ b/ansible/inventory/host_vars/atlas.yml
@@ -26,6 +26,16 @@ atlas_zfs_dataset_icloud_photos: icloud_photos
 atlas_mount_root: /CHANGEME_ATLAS_MOUNT_ROOT
 atlas_manage_storage: false

+rocky_manage_openzfs_repo: true
+rocky_manage_syncthing_binary: true
+
+host_packages:
+  - cockpit
+  - nfs-utils
+  - policycoreutils-python-utils
+  - samba
+  - zfs
+
 atlas_nfs_exports:
  - path: "{{ atlas_work_mountpoint }}"
    clients: "{{ atlas_lan_subnet }}(rw,sync,no_subtree_check,root_squash)"
--- a/ansible/inventory/hosts.yml
+++ b/ansible/inventory/hosts.yml
@@ -19,6 +19,8 @@ all:
    platform_rocky:
      hosts:
        atlas:
+      children:
+        rocky_server:

    void:
      children:
@@ -76,6 +78,7 @@ all:

    server:
      children:
+        rocky_server:
        ubuntu_server:

    workstation_dev_fedora:
@@ -92,3 +95,6 @@ all:
      hosts:
        prometheus:
          ansible_connection: local
+
+    rocky_server:
+      hosts: {}
--- a/ansible/roles/packages_rocky/tasks/main.yml
+++ b/ansible/roles/packages_rocky/tasks/main.yml
@@ -32,6 +32,7 @@
  ansible.builtin.dnf:
    name: "{{ rocky_openzfs_release_rpm }}"
    state: present
+  when: rocky_manage_openzfs_repo | bool

 - name: Disable OpenZFS DKMS repository
  tags: [packages, storage]
@@ -39,6 +40,7 @@
    name:
      - zfs
    state: disabled
+  when: rocky_manage_openzfs_repo | bool

 - name: Enable OpenZFS kmod repository
  tags: [packages, storage]
@@ -46,6 +48,36 @@
    name:
      - zfs-kmod
    state: enabled
+  when: rocky_manage_openzfs_repo | bool
+
+- name: Configure official Docker RPM repository
+  tags: [packages, docker]
+  ansible.builtin.get_url:
+    url: "{{ rocky_docker_repo_url }}"
+    dest: "{{ rocky_docker_repo_file }}"
+    owner: root
+    group: root
+    mode: "0644"
+  when: rocky_manage_docker_repo | bool
+
+- name: Configure official GitHub CLI RPM repository
+  tags: [packages]
+  ansible.builtin.get_url:
+    url: "{{ rocky_github_cli_repo_url }}"
+    dest: "{{ rocky_github_cli_repo_file }}"
+    owner: root
+    group: root
+    mode: "0644"
+  when: rocky_manage_github_cli_repo | bool
+
+- name: Remove packages conflicting with Docker CE
+  tags: [packages, docker]
+  ansible.builtin.dnf:
+    name: "{{ rocky_docker_conflicting_packages }}"
+    state: absent
+  when:
+    - rocky_manage_docker_repo | bool
+    - rocky_docker_conflicting_packages | length > 0

 - name: Refresh Rocky package metadata
  tags: [packages]
@@ -58,20 +90,30 @@
    name: >-
      {{
        (
-          (common_packages | default([]))
+          (rocky_common_packages | default([]))
          + (rocky_packages_base | default([]))
-          + (profile_packages | default([]))
+          + (rocky_profile_packages | default([]))
+          + (rocky_docker_packages | default([]))
          + (host_packages | default([]))
        ) | unique
      }}
    state: present

+- name: Add Rocky user to docker group
+  tags: [packages, docker]
+  ansible.builtin.user:
+    name: "{{ effective_username }}"
+    groups: docker
+    append: true
+  when: rocky_docker_packages | length > 0
+
 - name: Require supported architecture for Syncthing
  tags: [packages, syncthing]
  ansible.builtin.assert:
    that:
      - ansible_facts['architecture'] == 'x86_64'
    fail_msg: The pinned Atlas Syncthing binary currently supports x86_64 only.
+  when: rocky_manage_syncthing_binary | bool

 - name: Read installed Syncthing version
  tags: [packages, syncthing]
@@ -83,6 +125,7 @@
  changed_when: false
  failed_when: false
  check_mode: false
+  when: rocky_manage_syncthing_binary | bool

 - name: Determine whether Syncthing must be installed
  tags: [packages, syncthing]
@@ -92,6 +135,7 @@
        ('syncthing v' ~ rocky_syncthing_version ~ ' ')
        not in (rocky_syncthing_version_check.stdout | default(''))
      }}
+  when: rocky_manage_syncthing_binary | bool

 - name: Create temporary Syncthing extraction directory
  tags: [packages, syncthing]
@@ -101,7 +145,9 @@
    owner: root
    group: root
    mode: "0755"
-  when: rocky_syncthing_install_required | bool
+  when:
+    - rocky_manage_syncthing_binary | bool
+    - rocky_syncthing_install_required | bool

 - name: Download pinned Syncthing release
  tags: [packages, syncthing]
@@ -112,7 +158,9 @@
    owner: root
    group: root
    mode: "0644"
-  when: rocky_syncthing_install_required | bool
+  when:
+    - rocky_manage_syncthing_binary | bool
+    - rocky_syncthing_install_required | bool

 - name: Extract pinned Syncthing release
  tags: [packages, syncthing]
@@ -120,7 +168,9 @@
    src: "/tmp/syncthing-{{ rocky_syncthing_version }}.tar.gz"
    dest: "/tmp/syncthing-{{ rocky_syncthing_version }}"
    remote_src: true
-  when: rocky_syncthing_install_required | bool
+  when:
+    - rocky_manage_syncthing_binary | bool
+    - rocky_syncthing_install_required | bool

 - name: Install pinned Syncthing binary
  tags: [packages, syncthing]
@@ -136,16 +186,20 @@
    owner: root
    group: root
    mode: "0755"
-  when: rocky_syncthing_install_required | bool
+  when:
+    - rocky_manage_syncthing_binary | bool
+    - rocky_syncthing_install_required | bool

 - name: Remove Syncthing release archive
  tags: [packages, syncthing]
  ansible.builtin.file:
    path: "/tmp/syncthing-{{ rocky_syncthing_version }}.tar.gz"
    state: absent
+  when: rocky_manage_syncthing_binary | bool

 - name: Remove Syncthing extraction directory
  tags: [packages, syncthing]
  ansible.builtin.file:
    path: "/tmp/syncthing-{{ rocky_syncthing_version }}"
    state: absent
+  when: rocky_manage_syncthing_binary | bool
--- a/ansible/roles/profile_server/handlers/main.yml
+++ b/ansible/roles/profile_server/handlers/main.yml
@@ -2,5 +2,5 @@
 - name: Reload SSH service
  tags: [services]
  ansible.builtin.service:
-    name: ssh
+    name: "{{ server_sshd_service_name }}"
    state: reloaded
--- a/ansible/roles/profile_server/tasks/main.yml
+++ b/ansible/roles/profile_server/tasks/main.yml
@@ -1,5 +1,13 @@
 ---

+- name: Require supported server firewall backend
+  tags: [services, packages]
+  ansible.builtin.assert:
+    that:
+      - server_firewall_backend in ['ufw', 'firewalld']
+    fail_msg: >-
+      server_firewall_backend must be either ufw or firewalld for the server profile.
+
 - name: Copy server dotfiles
  tags: [dotfiles, dotfiles:server]
  ansible.builtin.copy:
@@ -72,6 +80,7 @@
  tags: [services, packages]
  ansible.builtin.set_fact:
    server_ufw_rules_effective: "{{ server_ufw_rules | default([]) }}"
+  when: server_firewall_backend == 'ufw'

 - name: Apply server UFW rules
  tags: [services, packages]
@@ -89,12 +98,41 @@
    interface_out: "{{ item.interface_out | default(omit) }}"
    route: "{{ item.route | default(omit) }}"
    comment: "{{ item.comment | default(omit) }}"
-  loop: "{{ server_ufw_rules_effective }}"
+  loop: "{{ server_ufw_rules_effective | default([]) }}"
  loop_control:
    label: "{{ item.name | default(item.port) }}"
+  when: server_firewall_backend == 'ufw'

 - name: Enable UFW firewall on server
  tags: [services, packages]
  community.general.ufw:
    state: enabled
-  when: (server_ufw_rules_effective | default([])) | length > 0
+  when:
+    - server_firewall_backend == 'ufw'
+    - (server_ufw_rules_effective | default([])) | length > 0
+
+- name: Allow server services through firewalld
+  tags: [services, packages]
+  ansible.posix.firewalld:
+    service: "{{ item }}"
+    zone: "{{ server_firewalld_zone }}"
+    state: enabled
+    permanent: true
+    immediate: true
+  loop: "{{ server_firewalld_services | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+  when: server_firewall_backend == 'firewalld'
+
+- name: Allow server ports through firewalld
+  tags: [services, packages]
+  ansible.posix.firewalld:
+    port: "{{ item }}"
+    zone: "{{ server_firewalld_zone }}"
+    state: enabled
+    permanent: true
+    immediate: true
+  loop: "{{ server_firewalld_ports | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+  when: server_firewall_backend == 'firewalld'
--- a/ansible/site.yml
+++ b/ansible/site.yml
@@ -84,6 +84,14 @@
  roles:
    - profile_atlas

+- name: Configure Rocky Linux server
+  hosts: rocky_server
+  become: true
+
+  roles:
+    - dotfiles_common
+    - profile_server
+
 - name: Configure personal workstation role on Fedora
  hosts: platform_fedora:&role_personal_workstation
  become: true
--- a/ansible/templates/server/docker-compose.yml.j2
+++ b/ansible/templates/server/docker-compose.yml.j2
@@ -1,4 +1,5 @@
 ---
+{%- set selinux_volume_option = server_compose_selinux_mount_option | default('') %}
 version: "3.8"

 services:
@@ -14,8 +15,8 @@ services:
      ND_ENABLETRANSCODING: "true"

    volumes:
-      - "/opt/navidrome/data:/data"
-      - "/opt/music:/music:ro"
+      - "/opt/navidrome/data:/data{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
+      - "/opt/music:/music:ro{{ ',' ~ selinux_volume_option if selinux_volume_option else '' }}"
    user: "1000:1000"
    networks:
      - web
@@ -30,8 +31,8 @@ services:
      - "443:443"
      - "81:81"
    volumes:
-      - "/opt/npm/data:/data"
-      - "/opt/npm/letsencrypt:/etc/letsencrypt"
+      - "/opt/npm/data:/data{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
+      - "/opt/npm/letsencrypt:/etc/letsencrypt{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
    networks:
      - web
      - gitea
@@ -66,7 +67,7 @@ services:
      POSTGRES_PASSWORD: "{{ vault_postgres_root_password }}"

    volumes:
-      - "/opt/postgres/data:/var/lib/postgresql/data"
+      - "/opt/postgres/data:/var/lib/postgresql/data{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
    networks:
      - web
  gitea:
@@ -79,10 +80,10 @@ services:
    networks:
      - gitea
    volumes:
-      - /opt/gitea/data:/data
+      - /opt/gitea/data:/data{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
-      - /home/git/.ssh:/data/git/.ssh
+      - /home/git/.ssh:/data/git/.ssh{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}
    ports:
      - "3000:3000"
      - "127.0.0.1:222:22"
@@ -95,8 +96,8 @@ services:
    expose:
      - "8384"
    volumes:
-      - "/opt/syncthing/config:/var/syncthing"
-      - "/srv/syncthing/data:/data"
+      - "/opt/syncthing/config:/var/syncthing{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
+      - "/srv/syncthing/data:/data{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
    ports:
      - "22000:22000/tcp"
      - "22000:22000/udp"