sync all

ansible/playbooks/add_dhcp_entry.yml

@@ -1,39 +0,0 @@
----
-- name: Add entry to DNSMasq
-  hosts: all
-  gather_facts: false
-
-  tasks:
-    - name: Retrieve information about specific VM by name and get current configuration
-      delegate_to: "localhost"
-      community.proxmox.proxmox_vm_info:
-        api_user: "{{ proxmox_user }}"
-        api_password: "{{ proxmox_password }}"
-        api_host: "{{ proxmox_host }}"
-        name: "{{ inventory_hostname }}"
-        config: current
-      register: proxmox_vm_info
-
-    - name: Extract net0 information
-      ansible.builtin.set_fact:
-        vm_net0: "{{ proxmox_vm_info.proxmox_vms[0].config.net0 }}"
-
-    - name: Extract MAC address using regex
-      ansible.builtin.set_fact:
-        vm_mac_address: "{{ vm_net0 | regex_search('([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}') }}"
-
-    - name: Add line to hosts file
-      delegate_to: "{{ groups['dhcp_server'][0] }}"
-      become: true
-      ansible.builtin.lineinfile:
-        path: /etc/dnsmasq.d/hosts.conf
-        regexp: "# {{ inventory_hostname }}$"
-        line: "dhcp-host={{ vm_mac_address | lower }},{{ ip_address }} # {{ inventory_hostname }}"
-        state: present
-    # restart dnsmasq service
-    - name: Restart service dnsmasq
-      delegate_to: "{{ groups['dhcp_server'][0] }}"
-      become: true
-      ansible.builtin.service:
-        name: dnsmasq
-        state: restarted

ansible/playbooks/add_dhcp_reservation.yml

@@ -0,0 +1,84 @@
+---
+- name: Bind VM MAC address to IP address on Ubiquiti
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Set VM MAC address (if defined in vars)
+      delegate_to: "localhost"
+      community.proxmox.proxmox_kvm:
+        api_user: "{{ proxmox_user }}"
+        api_password: "{{ proxmox_password }}"
+        api_host: "{{ proxmox_host }}"
+        node: "{{ proxmox_clone_node }}"
+        vmid: "{{ vm_id }}"
+        net:
+          net0: "virtio={{ vm_mac_address }},bridge=vmbr0,firewall=1"
+        update: true
+        update_unsafe: true
+      when: vm_mac_address is defined
+
+    - name: Get VM MAC address from Proxmox (not defined in vars)
+      when: vm_mac_address is not defined
+      block:
+        - name: Retrieve information about specific VM by name and get current configuration
+          delegate_to: "localhost"
+          community.proxmox.proxmox_vm_info:
+            api_user: "{{ proxmox_user }}"
+            api_password: "{{ proxmox_password }}"
+            api_host: "{{ proxmox_host }}"
+            name: "{{ inventory_hostname }}"
+            config: current
+          register: proxmox_vm_info
+
+        - name: Extract net0 information
+          ansible.builtin.set_fact:
+            vm_net0: "{{ proxmox_vm_info.proxmox_vms[0].config.net0 }}"
+
+        - name: Extract MAC address using regex
+          ansible.builtin.set_fact:
+            vm_mac_address: "{{ vm_net0 | regex_search('([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}') }}"
+
+    - name: Assign VM MAC address to IP address on Ubiquiti with Terraform
+      when: vm_mac_address is defined
+      delegate_to: "{{ groups['terraform_server'][0] }}"
+      block:
+        - name: Create a directory if it does not exist
+          ansible.builtin.file:
+            path: "~/homelab/terraform/unifi-dhcp"
+            state: directory
+            mode: '0755'
+
+        - name: Create Unifi provider file from template
+          ansible.builtin.template:
+            src: templates/unifi_provider.tf.j2
+            dest: ~/homelab/terraform/unifi-dhcp/provider.tf
+            mode: '0644'
+
+        - name: Create Unifi user (host) file from template
+          ansible.builtin.template:
+            src: templates/unifi-user.tf.j2
+            dest: ~/homelab/terraform/unifi-dhcp/{{ inventory_hostname }}.tf
+            mode: '0644'
+
+        - name: Configure Unifi via Terraform
+          community.general.terraform:
+            project_path: ~/homelab/terraform/unifi-dhcp
+            state: present
+            force_init: true
+
+    # - name: Add line to hosts file
+    #   delegate_to: "{{ groups['dhcp_server'][0] }}"
+    #   become: true
+    #   ansible.builtin.lineinfile:
+    #     path: /etc/dnsmasq.d/hosts.conf
+    #     regexp: "# {{ inventory_hostname }}$"
+    #     line: "dhcp-host={{ vm_mac_address | lower }},{{ ip_address }} # {{ inventory_hostname }}"
+    #     state: present
+    # # restart dnsmasq service
+    # - name: Restart service dnsmasq
+    #   delegate_to: "{{ groups['dhcp_server'][0] }}"
+    #   become: true
+    #   ansible.builtin.service:
+    #     name: dnsmasq
+    #     state: restarted

ansible/playbooks/add_technitium_dns_entry.yml

@@ -0,0 +1,18 @@
+---
+- name: Add entry to Technitium DNS
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: "Create DNS entry for {{ inventory_hostname }}"
+      delegate_to: localhost
+      effectivelywild.technitium_dns.technitium_dns_add_record:
+        api_url: "http://{{ dns_server }}.{{ base_domain }}"
+        api_token: "{{ vault_technitium_api_key }}"
+        zone: "{{ base_domain }}"
+        name: "{{ inventory_hostname }}.{{ base_domain }}"
+        type: "A"
+        ipAddress: "{{ ip_address }}"
+        ptr: true
+        ttl: 360
+#        validate_certs: false

ansible/playbooks/create_vm_from_clone.yml

@@ -3,19 +3,18 @@
   hosts: all
   gather_facts: false
 
-- name: Proxmox Clone Ubuntu VM Playbook
-  ansible.builtin.import_playbook: proxmox_clone_ubuntu_vm.yml
-  when: vm_os_distribution == "ubuntu" and platform == "proxmox"
+- name: Proxmox Clone VM Playbook
+  ansible.builtin.import_playbook: proxmox_clone_vm.yml
 
-- name: Proxmox Clone Fedora VM Playbook
-  ansible.builtin.import_playbook: proxmox_clone_fedora_vm.yml
-  when: vm_os_distribution == "fedora" and platform == "proxmox"
+- name: Set cloud-init network
+  ansible.builtin.import_playbook: populate_cloud_init.yml
+  when: vm_os_distribution == "ubuntu"
 
-# - name: DNS Playbook
-#   ansible.builtin.import_playbook: add_dns_entry.yml
+- name: DNS Playbook
+  ansible.builtin.import_playbook: add_technitium_dns_entry.yml
 
-# - name: DHCP Playbook
-#   ansible.builtin.import_playbook: add_dhcp_entry.yml
+- name: DHCP Playbook
+  ansible.builtin.import_playbook: add_dhcp_reservation.yml
 
 - name: Start VM Playbook
   ansible.builtin.import_playbook: proxmox_start_vm.yml

ansible/playbooks/deploy-fastpass-4step.yml

@@ -6,40 +6,38 @@
   roles:
     - role: kubernetes-prerequisites
 
-- name: Step 2 - Deploy First Control Plane Node
-  hosts: fastpass_control_plane[0]
-  become: true
-  gather_facts: false
-  roles:
-    - role: fastpass-first-control-plane
+# - name: Step 2 - Deploy First Control Plane Node
+#   hosts: fastpass_control_plane[0]
+#   become: true
+#   gather_facts: false
+#   roles:
+#     - role: fastpass-first-control-plane
 
-- name: Step 3 - Deploy Additional Control Plane Nodes
-  hosts: fastpass_control_plane[1:]
-  become: true
-  gather_facts: false
-  roles:
-    - role: fastpass-additional-control-plane
+# - name: Step 3 - Deploy Additional Control Plane Nodes
+#   hosts: fastpass_control_plane[1:]
+#   become: true
+#   gather_facts: false
+#   roles:
+#     - role: fastpass-additional-control-plane
 
-- name: Step 4 - Deploy Worker Nodes
-  hosts: fastpass_workers
-  become: true
-  gather_facts: false
-  roles:
-    - role: fastpass-workers
-
-- name: Final Cluster Validation
-  hosts: fastpass_control_plane[0]
-  become: false
-  gather_facts: false
-  environment:
-    KUBECONFIG: "{{ kubeconfig_path }}"
-  tasks:
-    - name: Display cluster status
-      ansible.builtin.command: kubectl get nodes
-      delegate_to: localhost
-
-    - name: Display all pods
-      ansible.builtin.command: kubectl get pods -A
-      delegate_to: localhost
+# - name: Step 4 - Deploy Worker Nodes
+#   hosts: fastpass_workers
+#   become: true
+#   gather_facts: false
+#   roles:
+#     - role: fastpass-workers
 
+# - name: Final Cluster Validation
+#   hosts: fastpass_control_plane[0]
+#   become: false
+#   gather_facts: false
+#   environment:
+#     KUBECONFIG: "{{ kubeconfig_path }}"
+#   tasks:
+#     - name: Display cluster status
+#       ansible.builtin.command: kubectl get nodes
+#       delegate_to: localhost
 
+#     - name: Display all pods
+#       ansible.builtin.command: kubectl get pods -A
+#       delegate_to: localhost

ansible/playbooks/deploy_n8n_server.yml

@@ -0,0 +1,5 @@
+- name: 1. Deploy n8n server
+  hosts: n8n_server
+  gather_facts: true
+  roles:
+    - role: n8n

ansible/playbooks/populate_cloud_init.yml

@@ -4,28 +4,20 @@
   gather_facts: false
 
   tasks:
-    - name: Create Proxmox VMs
+    - name: Modify Proxmox Ubuntu VM
       delegate_to: "localhost"
       when: platform is defined and platform == "proxmox"
       block:
-        - name: Create VM ID from IP address
-          ansible.builtin.set_fact:
-            vm_id: "{{ ip_address.split('.')[-2] }}{{ '%03d' % (ip_address.split('.')[-1] | int) }}"
-
-        - name: Clone VM with source vmid and target newid and raw format
+        - name: Update cloud-init file
           community.proxmox.proxmox_kvm:
             api_user: "{{ proxmox_user }}"
             api_password: "{{ proxmox_password }}"
             api_host: "{{ proxmox_host }}"
-            clone: "{{ vm_clone_source }}"
-            newid: "{{ vm_id }}"
-            name: "{{ inventory_hostname }}"
             node: "{{ proxmox_clone_node }}"
-            storage: "{{ vm_storage }}"
-            format: qcow2 # raw
-            timeout: 600
+            vmid: "{{ vm_id }}"
             ipconfig:
-              ipconfig0: 'ip=dhcp'
+              ipconfig0: "ip=dhcp"
+            update: true
 
         # - name: Add VM to HA group
         #   community.proxmox.proxmox_cluster_ha_resources:

ansible/playbooks/roles/kubernetes-prerequisites/defaults/main.yml

@@ -2,7 +2,7 @@
 # Kubernetes Prerequisites Role Defaults
 
 # Kubernetes version to install (should be overridden in group_vars)
-kubernetes_version: "v1.33"
+kubernetes_version: "v1.30"
 
 # Container runtime (containerd is default)
 container_runtime: "containerd"
@@ -13,15 +13,9 @@ cni_plugin: "calico"
 # Firewall configuration
 configure_firewall: true
 
-# Time synchronization
-configure_ntp: true
-
 # SELinux configuration
 selinux_state: "permissive"
 
-# Swap configuration
-disable_swap: true
-
 # Kernel modules to load
 required_kernel_modules:
   - overlay
@@ -29,9 +23,9 @@ required_kernel_modules:
 
 # Sysctl parameters for Kubernetes
 k8s_sysctl_params:
-  net.bridge.bridge-nf-call-iptables: 1
-  net.bridge.bridge-nf-call-ip6tables: 1
-  net.ipv4.ip_forward: 1
+  - "net.bridge.bridge-nf-call-iptables: 1"
+  - "net.bridge.bridge-nf-call-ip6tables: 1"
+  - "net.ipv4.ip_forward: 1"
 
 # Kubernetes firewall ports
 k8s_firewall_ports:

ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml

@@ -1,30 +1,22 @@
 ---
-- name: Set Kubernetes-compatible hostname
+# Role to set/install Kubernetes prerequisites
+
+- name: 1. Set Kubernetes-compatible hostname
   ansible.builtin.hostname:
     name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}"
 
-- name: Remove zram-generator-defaults
-  ansible.builtin.file:
-    path: /etc/systemd/zram-generator.conf
-    state: absent
+- name: 2. Disable swap
+  ansible.builtin.include_role:
+    name: no-swap
 
-- name: Disable swap
-  ansible.builtin.shell: swapoff -a
-  when: disable_swap | default(true)
-
-- name: Persist swap off by commenting out swap in fstab
-  ansible.builtin.replace:
-    path: /etc/fstab
-    regexp: '^([^#].*?\sswap\s+sw\s+.*)$'
-    replace: '# \1'
-  when: disable_swap | default(true)
-
-- name: Load required kernel modules
+- name: 3.1 Load required kernel modules
+  become: true
   ansible.builtin.modprobe:
     name: "{{ item }}"
   loop: "{{ required_kernel_modules }}"
 
-- name: Persist kernel modules on boot
+- name: 3.2 Persist kernel modules on boot
+  become: true
   ansible.builtin.copy:
     dest: /etc/modules-load.d/k8s.conf
     content: "{{ required_kernel_modules | join('\n') }}"
@@ -32,179 +24,198 @@
     group: root
     mode: '0644'
 
-- name: Configure required sysctl params for Kubernetes
-  ansible.builtin.template:
-    dest: /etc/sysctl.d/k8s.conf
-    src: k8s-sysctl.conf.j2
+- name: 3.3 Configure required sysctl params for Kubernetes
+  become: true
+  ansible.builtin.copy:
+    dest: /etc/sysctl.d/kubernetes.conf
+    content: "{{ k8s_sysctl_params | join('\n') }}"
     owner: root
     group: root
     mode: '0644'
 
-- name: Apply sysctl params without reboot
+- name: 3.4 Apply sysctl params without reboot
+  become: true
   ansible.builtin.shell: sysctl --system
 
-- name: Install python3-libselinux for managing selinux
-  ansible.builtin.dnf:
-    name: python3-libselinux
-    state: present
+- name: 3.5 Manage SELinux
+  become: true
+  when: ansible_os_family == "RedHat"
+  block:
+    - name: 3.5.1 Install python3-libselinux for managing selinux
+      ansible.builtin.dnf:
+        name: python3-libselinux
+        state: present
 
-- name: Set SELinux to permissive mode
-  ansible.posix.selinux:
-    policy: targeted
-    state: "{{ selinux_state }}"
+    - name: 3.5.2 Set SELinux to permissive mode
+      ansible.posix.selinux:
+        policy: targeted
+        state: "{{ selinux_state }}"
 
-- name: Install and configure chrony for time synchronization
-  ansible.builtin.dnf:
-    name: chrony
-    state: present
-  when: configure_ntp | default(true)
+- name: 4 Manage Time Synchronization
+  become: true
+  block:
+    - name: Check if ntp is installed
+      ansible.builtin.package: rpm -q ntp
+      register: ntp_installed
+      changed_when: false
 
-- name: Start and enable chronyd
-  ansible.builtin.systemd:
-    name: chronyd
-    state: started
-    enabled: true
-  when: configure_ntp | default(true)
+    - name: 4.1 Remove the ntp package
+      ansible.builtin.package:
+        name: ntp
+        state: absent
 
-- name: Force time synchronization
-  ansible.builtin.shell: chronyc makestep
-  ignore_errors: true
-  when: configure_ntp | default(true)
+    - name: 4.2 Install the chrony package
+      ansible.builtin.package:
+        name: chrony
+        state: present
 
-- name: Install firewalld
-  ansible.builtin.dnf:
-    name: firewalld
-    state: present
-  when: configure_firewall | default(true)
 
-- name: Start and enable firewalld
-  ansible.builtin.systemd:
-    name: firewalld
-    state: started
-    enabled: true
-  when: configure_firewall | default(true)
+# - name: Start and enable chronyd
+#   ansible.builtin.systemd:
+#     name: chronyd
+#     state: started
+#     enabled: true
+#   when: configure_ntp | default(true)
 
-- name: Create Kubernetes service definition
-  ansible.builtin.template:
-    dest: /etc/firewalld/services/kubernetes.xml
-    owner: root
-    group: root
-    mode: '0644'
-    src: kubernetes-firewall-service.xml.j2
-  when: configure_firewall | default(true)
+# - name: Force time synchronization
+#   ansible.builtin.shell: chronyc makestep
+#   ignore_errors: true
+#   when: configure_ntp | default(true)
 
-- name: Reload firewalld to load new service
-  ansible.builtin.shell: firewall-cmd --reload
-  when: configure_firewall | default(true)
+# - name: Install firewalld
+#   ansible.builtin.dnf:
+#     name: firewalld
+#     state: present
+#   when: configure_firewall | default(true)
 
-- name: Add Kubernetes service to default zone
-  ansible.builtin.shell: firewall-cmd --permanent --add-service=kubernetes
-  when: configure_firewall | default(true)
+# - name: Start and enable firewalld
+#   ansible.builtin.systemd:
+#     name: firewalld
+#     state: started
+#     enabled: true
+#   when: configure_firewall | default(true)
 
-- name: Add SSH service to default zone (ensure SSH access)
-  ansible.builtin.shell: firewall-cmd --permanent --add-service=ssh
-  when: configure_firewall | default(true)
+# - name: Create Kubernetes service definition
+#   ansible.builtin.template:
+#     dest: /etc/firewalld/services/kubernetes.xml
+#     owner: root
+#     group: root
+#     mode: '0644'
+#     src: kubernetes-firewall-service.xml.j2
+#   when: configure_firewall | default(true)
 
-- name: Reload firewalld to apply changes
-  ansible.builtin.shell: firewall-cmd --reload
-  when: configure_firewall | default(true)
+# - name: Reload firewalld to load new service
+#   ansible.builtin.shell: firewall-cmd --reload
+#   when: configure_firewall | default(true)
 
-- name: Verify Kubernetes service is active
-  ansible.builtin.shell: firewall-cmd --list-services
-  register: active_services
-  when: configure_firewall | default(true)
+# - name: Add Kubernetes service to default zone
+#   ansible.builtin.shell: firewall-cmd --permanent --add-service=kubernetes
+#   when: configure_firewall | default(true)
 
-- name: Display active firewall services
-  ansible.builtin.debug:
-    msg: "Active firewall services: {{ active_services.stdout }}"
-  when: configure_firewall | default(true)
+# - name: Add SSH service to default zone (ensure SSH access)
+#   ansible.builtin.shell: firewall-cmd --permanent --add-service=ssh
+#   when: configure_firewall | default(true)
 
-- name: Install DNF plugins core for managing repositories
-  ansible.builtin.dnf:
-    name: dnf-plugins-core
-    state: present
+# - name: Reload firewalld to apply changes
+#   ansible.builtin.shell: firewall-cmd --reload
+#   when: configure_firewall | default(true)
 
-- name: Add Docker CE repository
-  ansible.builtin.shell: |
-    curl -fsSL https://download.docker.com/linux/fedora/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo
+# - name: Verify Kubernetes service is active
+#   ansible.builtin.shell: firewall-cmd --list-services
+#   register: active_services
+#   when: configure_firewall | default(true)
 
-- name: Install containerd
-  ansible.builtin.dnf:
-    name: containerd
-    state: present
+# - name: Display active firewall services
+#   ansible.builtin.debug:
+#     msg: "Active firewall services: {{ active_services.stdout }}"
+#   when: configure_firewall | default(true)
 
-- name: Create containerd config directory
-  ansible.builtin.file:
-    path: /etc/containerd
-    state: directory
-    owner: root
-    group: root
-    mode: '0755'
+# - name: Install DNF plugins core for managing repositories
+#   ansible.builtin.dnf:
+#     name: dnf-plugins-core
+#     state: present
 
-- name: Generate default containerd config and enable SystemdCgroup
-  ansible.builtin.shell: |
-    containerd config default > /etc/containerd/config.toml
-    sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
+# - name: Add Docker CE repository
+#   ansible.builtin.shell: |
+#     curl -fsSL https://download.docker.com/linux/fedora/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo
 
-- name: Restart and enable containerd service
-  ansible.builtin.systemd:
-    name: containerd
-    state: restarted
-    enabled: true
+# - name: Install containerd
+#   ansible.builtin.dnf:
+#     name: containerd
+#     state: present
 
-- name: Add Kubernetes repository
-  ansible.builtin.template:
-    dest: /etc/yum.repos.d/kubernetes.repo
-    owner: root
-    group: root
-    mode: '0644'
-    src: kubernetes.repo.j2
+# - name: Create containerd config directory
+#   ansible.builtin.file:
+#     path: /etc/containerd
+#     state: directory
+#     owner: root
+#     group: root
+#     mode: '0755'
 
-- name: Install Kubernetes packages
-  ansible.builtin.dnf:
-    name:
-      - kubelet
-      - kubeadm
-      - kubectl
-      - kubernetes-cni
-    state: present
+# - name: Generate default containerd config and enable SystemdCgroup
+#   ansible.builtin.shell: |
+#     containerd config default > /etc/containerd/config.toml
+#     sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
 
-- name: Create kubelet config directory
-  ansible.builtin.file:
-    path: /var/lib/kubelet
-    state: directory
-    owner: root
-    group: root
-    mode: '0755'
+# - name: Restart and enable containerd service
+#   ansible.builtin.systemd:
+#     name: containerd
+#     state: restarted
+#     enabled: true
 
-- name: Create initial kubelet config file
-  ansible.builtin.copy:
-    dest: /var/lib/kubelet/config.yaml
-    owner: root
-    group: root
-    mode: '0644'
-    content: |
-      apiVersion: kubelet.config.k8s.io/v1beta1
-      kind: KubeletConfiguration
-      cgroupDriver: systemd
-      containerRuntimeEndpoint: unix:///run/containerd/containerd.sock
+# - name: Add Kubernetes repository
+#   ansible.builtin.template:
+#     dest: /etc/yum.repos.d/kubernetes.repo
+#     owner: root
+#     group: root
+#     mode: '0644'
+#     src: kubernetes.repo.j2
 
-- name: Install CNI plugins via dnf
-  ansible.builtin.dnf:
-    name: containernetworking-plugins
-    state: present
+# - name: Install Kubernetes packages
+#   ansible.builtin.dnf:
+#     name:
+#       - kubelet
+#       - kubeadm
+#       - kubectl
+#       - kubernetes-cni
+#     state: present
 
-- name: Verify CNI plugins installation
-  ansible.builtin.shell: ls -la /opt/cni/bin/ || echo "CNI plugins not found in /opt/cni/bin/"
-  register: cni_plugins
-  ignore_errors: true
+# - name: Create kubelet config directory
+#   ansible.builtin.file:
+#     path: /var/lib/kubelet
+#     state: directory
+#     owner: root
+#     group: root
+#     mode: '0755'
 
-- name: Display installed CNI plugins
-  ansible.builtin.debug:
-    msg: "CNI plugins status: {{ cni_plugins.stdout }}"
+# - name: Create initial kubelet config file
+#   ansible.builtin.copy:
+#     dest: /var/lib/kubelet/config.yaml
+#     owner: root
+#     group: root
+#     mode: '0644'
+#     content: |
+#       apiVersion: kubelet.config.k8s.io/v1beta1
+#       kind: KubeletConfiguration
+#       cgroupDriver: systemd
+#       containerRuntimeEndpoint: unix:///run/containerd/containerd.sock
 
-- name: Enable kubelet service (but don't start yet)
-  ansible.builtin.systemd:
-    name: kubelet
-    enabled: true
-    state: stopped
+# - name: Install CNI plugins via dnf
+#   ansible.builtin.dnf:
+#     name: containernetworking-plugins
+#     state: present
+
+# - name: Verify CNI plugins installation
+#   ansible.builtin.shell: ls -la /opt/cni/bin/ || echo "CNI plugins not found in /opt/cni/bin/"
+#   register: cni_plugins
+#   ignore_errors: true
+
+# - name: Display installed CNI plugins
+#   ansible.builtin.debug:
+#     msg: "CNI plugins status: {{ cni_plugins.stdout }}"
+
+# - name: Enable kubelet service (but don't start yet)
+#   ansible.builtin.systemd:
+#     name: kubelet
+#     enabled: true
+#     state: stopped

ansible/playbooks/roles/n8n/tasks/main.yml

@@ -0,0 +1,100 @@
+---
+# Role to install and configure a n8n server
+
+- name: 1. Pre-install system updates
+  become: true
+  ansible.builtin.apt:
+    name: '*'
+    state: present
+    update_cache: true
+
+- name: 2. Install required packages
+  become: true
+  ansible.builtin.package:
+    name: "{{ item }}"
+    state: present
+  loop:
+    - curl
+    - wget
+    - gnupg
+    - lsb-release
+    - ca-certificates
+    - software-properties-common
+
+# firewall
+# sudo ufw enable
+# sudo ufw allow ssh
+# sudo ufw allow 5678/tcp
+
+- name: 3. Enable UFW
+  become: true
+  community.general.ufw:
+    state: enabled
+
+- name: 4. Open firewall ports for n8n
+  become: true
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop:
+    - 22
+    - 5678
+
+- name: 5. Download node installer
+#  become: true
+  ansible.builtin.get_url:
+    url: 'https://deb.nodesource.com/setup_lts.x'
+    dest: '/tmp/setup_lts.x'
+    mode: '0755'
+
+- name: 6. Run node installer
+  become: true
+  ansible.builtin.shell:
+    cmd: '/tmp/setup_lts.x'
+
+- name: 7. Install Node.js and npm
+  become: true
+  ansible.builtin.package:
+    name: nodejs
+    state: present
+
+- name: 8. Install npm@latest
+  become: true
+  ansible.builtin.shell:
+    cmd: 'sudo npm install -g npm@latest'
+
+- name: 9. Install "n8n" node.js package globally.
+  become: true
+  community.general.npm:
+    name: n8n
+    global: true
+
+- name: 10. Copy n8n.service to /etc/systemd/system
+  become: true
+  ansible.builtin.template:
+    dest: /etc/systemd/system/n8n.service
+    owner: root
+    group: root
+    mode: '0644'
+    src: n8n.service.j2
+
+- name: 11. Create n8n user
+  become: true
+  ansible.builtin.user:
+    name: n8n
+    state: present
+    shell: /bin/bash
+    home: /home/n8n
+    createhome: true
+
+- name: 12. Reload systemd to re-read configs
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+
+- name: 13. Start n8n service
+  become: true
+  ansible.builtin.systemd:
+    name: n8n.service
+    state: restarted
+    enabled: true

ansible/playbooks/roles/n8n/templates/n8n.service.j2

@@ -0,0 +1,22 @@
+[Unit]
+Description=n8n - Workflow Automation Tool
+After=network.target
+
+[Service]
+Type=simple
+User=n8n
+Group=n8n
+ExecStart=/usr/local/bin/n8n
+WorkingDirectory=/home/n8n
+Environment=NODE_ENV=production
+Environment=N8N_BASIC_AUTH_ACTIVE=true
+Environment=N8N_BASIC_AUTH_USER=admin
+#Environment=N8N_BASIC_AUTH_PASSWORD=your_secure_password
+Environment=N8N_HOST=0.0.0.0
+Environment=N8N_PORT=5678
+Environment=N8N_PROTOCOL=http
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target

ansible/playbooks/roles/no-swap/tasks/main.yml

@@ -0,0 +1,34 @@
+---
+# Role to disable swap
+
+- name: 1. Check if swap is enabled
+  ansible.builtin.shell: swapon --show=NAME --noheadings
+  register: swap_status
+  changed_when: false
+
+- name: 2. Disable swap
+  become: true
+  when: swap_status.stdout != ''
+  block:
+    - name: 2.1 Disable swap
+      ansible.builtin.shell: swapoff -a
+
+    - name: 2.2 Persist swap off by commenting out swap in fstab
+      ansible.builtin.replace:
+        path: /etc/fstab
+        regexp: '^([^#].*?\sswap\s+sw\s+.*)$'
+        replace: '# \1'
+        backup: true
+
+    - name: 2.3 Remove swap file
+      become: true
+      ansible.builtin.file:
+        path: "{{ swap_status.stdout }}"
+        state: absent
+
+    - name: 2.4 Remove zram-generator-defaults
+      become: true
+      when: ansible_os_family == "RedHat"
+      ansible.builtin.file:
+        path: /etc/systemd/zram-generator.conf
+        state: absent

ansible/playbooks/roles/ntp-server/tasks/main.yml

@@ -43,4 +43,4 @@
     service: ntp
     permanent: true
     immediate: true
-    state: enabled
+    state: enabled

ansible/playbooks/templates/unifi-user.tf.j2

@@ -0,0 +1,8 @@
+resource "unifi_user" "{{ inventory_hostname }}" {
+  mac  = "{{ vm_mac_address }}"
+  name = "{{ inventory_hostname }}"
+#  note = "my note"
+
+  fixed_ip   = "{{ ip_address }}"
+  allow_existing         = true
+}

ansible/playbooks/templates/unifi_provider.tf.j2

@@ -0,0 +1,22 @@
+// Configure the unifi provider
+terraform {
+  required_providers {
+    unifi = {
+      source = "paultyng/unifi"
+      version = "0.41.0"
+    }
+  }
+}
+
+provider "unifi" {
+  username = "terraform" # optionally use UNIFI_USERNAME env var
+  password = "{{ vault_unifi_password }}" # optionally use UNIFI_PASSWORD env var
+  api_url  = "https://192.168.1.1"  # optionally use UNIFI_API env var
+
+  # you may need to allow insecure TLS communications unless you have configured
+  # certificates for your controller
+  allow_insecure = "true" # optionally use UNIFI_INSECURE env var
+
+  # if you are not configuring the default site, you can change the site
+  # site = "world-drive" # or optionally use UNIFI_SITE env var
+}