LXC-Incus-stable-setup/playbook.yml
2025-06-10 13:40:55 +08:00

122 lines
3.9 KiB
YAML

---
- name: Install and Configure Incus (Stable) on Localhost
hosts: localhost
connection: local
become: true
vars:
# ==> User Configuration
# The user to grant Incus admin privileges.
# 'ansible_user' resolves to the user running the playbook (e.g., 'ubuntu', 'your_user').
incus_admin_user: "{{ ansible_user }}"
# ==> Incus Initialization (Preseed) Configuration
# Name for the default storage pool
incus_storage_pool_name: "default"
# Storage driver. 'zfs' is recommended. 'dir' is a fallback.
incus_storage_driver: "zfs"
# Network bridge name
incus_network_bridge: "incusbr0"
# IPv4 address and subnet for the bridge
incus_ipv4_addr: "10.0.5.1/24"
# IPv6 address and subnet for the bridge
incus_ipv6_addr: "fd42:5c6b:76c3:513::1/64"
tasks:
- name: 1. Install prerequisite packages
ansible.builtin.apt:
name:
- curl
- gnupg
- ufw # Ensure ufw is installed for firewall rules
state: present
update_cache: true
- name: 2. Create APT keyrings directory
ansible.builtin.file:
path: /etc/apt/keyrings
state: directory
mode: '0755'
- name: 3. Add Zabbly GPG key
ansible.builtin.get_url:
url: https://pkgs.zabbly.com/key.asc
dest: /etc/apt/keyrings/zabbly.asc
mode: '0644'
force: true
- name: 4. Add Zabbly Incus Stable repository
ansible.builtin.template:
src: templates/zabbly-incus-stable.sources.j2
dest: /etc/apt/sources.list.d/zabbly-incus-stable.sources
mode: '0644'
notify: Update APT Cache
- name: Handler to update APT cache
meta: flush_handlers
- name: 5. Install Incus packages (with ZFS)
ansible.builtin.apt:
name:
- incus
- incus-client
- incus-ui-canonical
- zfsutils-linux
state: present
when: incus_storage_driver == 'zfs'
- name: 5. Install Incus packages (non-ZFS)
ansible.builtin.apt:
name:
- incus
- incus-client
- incus-ui-canonical
state: present
when: incus_storage_driver != 'zfs'
- name: 6. Add user to the 'incus-admin' group
ansible.builtin.user:
name: "{{ incus_admin_user }}"
groups: incus-admin
append: yes
- name: 7. Template the Incus preseed configuration file
ansible.builtin.template:
src: templates/incus-preseed.yml.j2
dest: /tmp/incus-preseed.yml
mode: '0600'
- name: 8. Initialize Incus using preseed configuration
ansible.builtin.command:
cmd: incus admin init --preseed < /tmp/incus-preseed.yml
args:
# This task will only run if the storage pool doesn't already exist, making it idempotent.
creates: /var/lib/incus/storage-pools/{{ incus_storage_pool_name }}
- name: 9. Configure Incus to listen for Web UI access
ansible.builtin.command:
cmd: incus config set core.https_address :8443
changed_when: false # This command is idempotent
- name: 10. Configure UFW firewall rules for Incus bridge
community.general.ufw:
rule: "{{ item.rule }}"
direction: "{{ item.direction | default(omit) }}"
interface: "{{ incus_network_bridge }}"
route: "{{ item.route | default(omit) }}"
loop:
- { rule: 'allow', direction: 'in' }
- { rule: 'allow', route: 'yes', direction: 'in' }
- { rule: 'allow', route: 'yes', direction: 'out' }
- name: Display post-installation instructions
ansible.builtin.debug:
msg:
- "Incus installation and configuration is complete!"
- "IMPORTANT: To manage Incus without 'sudo', you must LOG OUT and LOG BACK IN, or run 'newgrp incus-admin' in your current shell."
- "Access the Web UI at: https://localhost:8443"
handlers:
- name: Update APT Cache
ansible.builtin.apt:
update_cache: true