mirror of
https://github.com/fscotto/infra.git
synced 2026-09-27 19:03:47 +00:00
160d63c02d
* Add Atlas media and storage services * Document Atlas backend phase one and WireGuard deployment * Enable Atlas NAS management and document bootstrap workflow * Harden Atlas network, SSH, firewall, and sharing * Rotate Ansible Vault secrets * Allow configurable Aegis SSH users and authorized keys * Manage Aegis SSH authorized key fragments * Manage SSH authorized key fragments for infrastructure hosts * Harden Rocky storage and sharing configuration * Verify WireGuard handshakes and restore Podman networking
141 lines
4.1 KiB
YAML
141 lines
4.1 KiB
YAML
---
|
|
- name: Require completed Atlas media-stack configuration
|
|
tags: [atlas, containers, immich]
|
|
ansible.builtin.assert:
|
|
that:
|
|
- atlas_manage_storage | bool
|
|
- atlas_zfs_pool != 'CHANGEME_ZFS_POOL'
|
|
- atlas_mount_root != '/CHANGEME_ATLAS_MOUNT_ROOT'
|
|
- atlas_immich_db_password | length > 0
|
|
- atlas_npm_admin_bind_address == '127.0.0.1'
|
|
fail_msg: >-
|
|
Enable and configure Atlas storage, provide vault_atlas_immich_db_password,
|
|
and keep the NPM administration port bound to loopback before enabling the media stack.
|
|
no_log: true
|
|
when: atlas_manage_media_stack | bool
|
|
|
|
- name: Check Atlas Intel graphics device
|
|
tags: [atlas, containers, immich]
|
|
ansible.builtin.stat:
|
|
path: /dev/dri
|
|
register: atlas_dri_device
|
|
when: atlas_manage_media_stack | bool
|
|
|
|
- name: Require Atlas Intel graphics device
|
|
tags: [atlas, containers, immich]
|
|
ansible.builtin.assert:
|
|
that:
|
|
- atlas_dri_device.stat.isdir | default(false)
|
|
fail_msg: /dev/dri is required for Immich QuickSync and OpenVINO acceleration.
|
|
when: atlas_manage_media_stack | bool
|
|
|
|
- name: Create Atlas rootful Quadlet directory
|
|
tags: [atlas, containers]
|
|
ansible.builtin.file:
|
|
path: "{{ atlas_container_quadlet_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
when: atlas_manage_media_stack | bool
|
|
|
|
- name: Create Atlas Immich configuration directory
|
|
tags: [atlas, containers, immich]
|
|
ansible.builtin.file:
|
|
path: /etc/immich
|
|
state: directory
|
|
owner: root
|
|
group: "{{ atlas_immich_group }}"
|
|
mode: "0750"
|
|
when: atlas_manage_media_stack | bool
|
|
|
|
- name: Create Atlas Immich persistent directories
|
|
tags: [atlas, containers, immich]
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "{{ atlas_immich_username }}"
|
|
group: "{{ atlas_immich_group }}"
|
|
mode: "0750"
|
|
loop:
|
|
- "{{ atlas_immich_upload_dir }}"
|
|
- "{{ atlas_immich_model_cache_dir }}"
|
|
- "{{ atlas_immich_machine_learning_config_dir }}"
|
|
- "{{ atlas_immich_machine_learning_cache_dir }}"
|
|
- "{{ atlas_immich_redis_data_dir }}"
|
|
- "{{ atlas_immich_postgres_data_dir }}"
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
when: atlas_manage_media_stack | bool
|
|
|
|
- name: Create Atlas NPM persistent directories
|
|
tags: [atlas, containers, npm]
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
loop:
|
|
- "{{ atlas_npm_data_dir }}"
|
|
- "{{ atlas_npm_letsencrypt_dir }}"
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
when: atlas_manage_media_stack | bool
|
|
|
|
- name: Allow confined containers to use Atlas graphics devices
|
|
tags: [atlas, containers, immich]
|
|
ansible.posix.seboolean:
|
|
name: container_use_devices
|
|
state: true
|
|
persistent: true
|
|
when:
|
|
- atlas_manage_media_stack | bool
|
|
- (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'
|
|
|
|
- name: Render Vault-backed Immich environment
|
|
tags: [atlas, containers, immich]
|
|
ansible.builtin.template:
|
|
src: immich.env.j2
|
|
dest: /etc/immich/immich.env
|
|
owner: root
|
|
group: "{{ atlas_immich_group }}"
|
|
mode: "0640"
|
|
no_log: true
|
|
diff: false
|
|
notify: Restart Atlas media Quadlets
|
|
when: atlas_manage_media_stack | bool
|
|
|
|
- name: Render Atlas media Quadlets
|
|
tags: [atlas, containers]
|
|
ansible.builtin.template:
|
|
src: "{{ item }}.j2"
|
|
dest: "{{ atlas_container_quadlet_dir }}/{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop:
|
|
- atlas-media.network
|
|
- atlas-immich-redis.container
|
|
- atlas-immich-postgres.container
|
|
- atlas-immich-machine-learning.container
|
|
- atlas-immich-server.container
|
|
- atlas-npm.container
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
notify: Restart Atlas media Quadlets
|
|
when: atlas_manage_media_stack | bool
|
|
|
|
- name: Start Atlas media Quadlet services
|
|
tags: [atlas, containers, services]
|
|
ansible.builtin.systemd:
|
|
name: "{{ item }}"
|
|
state: started
|
|
daemon_reload: true
|
|
loop: "{{ atlas_media_quadlet_services }}"
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
when:
|
|
- atlas_manage_media_stack | bool
|
|
- not ansible_check_mode
|