152 lines
4.5 KiB
YAML
152 lines
4.5 KiB
YAML
---
|
|
- name: Install and Initialize Incus from Zabbly Stable Repository
|
|
hosts: localhost
|
|
become: yes
|
|
|
|
vars:
|
|
zabbly_key_url: "https://pkgs.zabbly.com/key.asc"
|
|
keyring_dir: "/etc/apt/keyrings"
|
|
keyring_asc: "/etc/apt/keyrings/zabbly.asc"
|
|
keyring_gpg: "/etc/apt/keyrings/zabbly.gpg"
|
|
repo_file: "/etc/apt/sources.list.d/zabbly-incus-stable.sources"
|
|
os_codename: "{{ ansible_lsb.codename }}"
|
|
arch: "{{ 'amd64' if ansible_architecture == 'x86_64' else ansible_architecture }}"
|
|
target_user: "{{ lookup('env', 'SUDO_USER') | default(lookup('env', 'USER'), true) }}"
|
|
|
|
tasks:
|
|
- name: Ensure required tools are installed
|
|
apt:
|
|
name: [curl, gnupg, lsb-release]
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Ensure ZFS support is installed
|
|
apt:
|
|
name: zfsutils-linux
|
|
state: present
|
|
|
|
- name: Create APT keyring directory
|
|
file:
|
|
path: "{{ keyring_dir }}"
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Download Zabbly GPG key (ASCII)
|
|
get_url:
|
|
url: "{{ zabbly_key_url }}"
|
|
dest: "{{ keyring_asc }}"
|
|
mode: '0644'
|
|
|
|
- name: Convert ASCII key to GPG format
|
|
command: gpg --dearmor -o "{{ keyring_gpg }}" "{{ keyring_asc }}"
|
|
args:
|
|
creates: "{{ keyring_gpg }}"
|
|
|
|
- name: Add Zabbly Incus Stable APT repository
|
|
copy:
|
|
dest: "{{ repo_file }}"
|
|
content: |
|
|
Enabled: yes
|
|
Types: deb
|
|
URIs: https://pkgs.zabbly.com/incus/stable
|
|
Suites: {{ os_codename }}
|
|
Components: main
|
|
Architectures: {{ arch }}
|
|
Signed-By: {{ keyring_gpg }}
|
|
register: repo_added
|
|
|
|
- name: Update APT cache if repository was added
|
|
apt:
|
|
update_cache: yes
|
|
when: repo_added.changed
|
|
|
|
- name: Install Incus and UFW packages
|
|
apt:
|
|
name: [incus, incus-client, incus-ui-canonical, ufw]
|
|
state: present
|
|
|
|
- name: Check if Incus storage pool 'default' exists
|
|
command: incus storage show default
|
|
register: incus_check
|
|
failed_when: false
|
|
changed_when: false
|
|
|
|
- name: Check if Incus bridge 'incusbr0' exists
|
|
command: incus network show incusbr0
|
|
register: net_check
|
|
failed_when: false
|
|
changed_when: false
|
|
|
|
- name: Check if default profile exists
|
|
command: incus profile show default
|
|
register: profile_check
|
|
failed_when: false
|
|
changed_when: false
|
|
|
|
- name: Initialize Incus daemon with preseed file (if not already initialized)
|
|
script: init-incus.sh
|
|
args:
|
|
chdir: "{{ playbook_dir }}"
|
|
when: incus_check.rc != 0 and net_check.rc != 0 and profile_check.rc != 0
|
|
|
|
- name: Add target user to the incus-admin group for passwordless access
|
|
user:
|
|
name: "{{ target_user }}"
|
|
groups: incus-admin
|
|
append: yes
|
|
|
|
- name: Enable UFW and allow SSH to avoid getting locked out
|
|
community.general.ufw:
|
|
state: enabled
|
|
policy: deny
|
|
rule: allow
|
|
name: OpenSSH
|
|
comment: 'Allow SSH to prevent lockout'
|
|
|
|
- name: Enable IP forwarding for UFW (required for container internet access)
|
|
lineinfile:
|
|
path: /etc/ufw/sysctl.conf
|
|
regexp: '^#?net/ipv4/ip_forward=1'
|
|
line: 'net/ipv4/ip_forward=1'
|
|
state: present
|
|
notify: Reload UFW
|
|
|
|
- name: Allow INCOMING traffic on the Incus bridge interface
|
|
community.general.ufw:
|
|
rule: allow
|
|
interface: incusbr0
|
|
direction: in
|
|
comment: 'Allow incoming traffic to containers'
|
|
|
|
- name: Allow OUTGOING traffic on the Incus bridge interface
|
|
community.general.ufw:
|
|
rule: allow
|
|
interface: incusbr0
|
|
direction: out
|
|
comment: 'Allow outgoing traffic from containers'
|
|
|
|
- name: Allow ROUTED INBOUND traffic on incusbr0
|
|
community.general.ufw:
|
|
route: yes
|
|
rule: allow
|
|
interface: incusbr0
|
|
direction: in
|
|
comment: 'Allow routed traffic into the container network'
|
|
|
|
- name: Allow ROUTED OUTBOUND traffic on incusbr0
|
|
community.general.ufw:
|
|
route: yes
|
|
rule: allow
|
|
interface: incusbr0
|
|
direction: out
|
|
comment: 'Allow routed traffic out of the container network'
|
|
|
|
- name: Post Installation Instructions
|
|
debug:
|
|
msg:
|
|
- "SUCCESS: Incus installation and configuration complete."
|
|
- "Post Installation Instructions: https://git.marmattheo.com/marmattheo/LXC-Incus-stable-playbook/src/branch/master/README.md"
|
|
|
|
handlers:
|
|
- name: Reload UFW
|
|
command: ufw reload |