sync all

ansible/playbooks/roles/kubernetes-prerequisites/defaults/main.yml

@@ -2,7 +2,7 @@
 # Kubernetes Prerequisites Role Defaults
 
 # Kubernetes version to install (should be overridden in group_vars)
-kubernetes_version: "v1.33"
+kubernetes_version: "v1.30"
 
 # Container runtime (containerd is default)
 container_runtime: "containerd"
@@ -13,15 +13,9 @@ cni_plugin: "calico"
 # Firewall configuration
 configure_firewall: true
 
-# Time synchronization
-configure_ntp: true
-
 # SELinux configuration
 selinux_state: "permissive"
 
-# Swap configuration
-disable_swap: true
-
 # Kernel modules to load
 required_kernel_modules:
   - overlay
@@ -29,9 +23,9 @@ required_kernel_modules:
 
 # Sysctl parameters for Kubernetes
 k8s_sysctl_params:
-  net.bridge.bridge-nf-call-iptables: 1
-  net.bridge.bridge-nf-call-ip6tables: 1
-  net.ipv4.ip_forward: 1
+  - "net.bridge.bridge-nf-call-iptables: 1"
+  - "net.bridge.bridge-nf-call-ip6tables: 1"
+  - "net.ipv4.ip_forward: 1"
 
 # Kubernetes firewall ports
 k8s_firewall_ports:

ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml

@@ -1,30 +1,22 @@
 ---
-- name: Set Kubernetes-compatible hostname
+# Role to set/install Kubernetes prerequisites
+
+- name: 1. Set Kubernetes-compatible hostname
   ansible.builtin.hostname:
     name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}"
 
-- name: Remove zram-generator-defaults
-  ansible.builtin.file:
-    path: /etc/systemd/zram-generator.conf
-    state: absent
+- name: 2. Disable swap
+  ansible.builtin.include_role:
+    name: no-swap
 
-- name: Disable swap
-  ansible.builtin.shell: swapoff -a
-  when: disable_swap | default(true)
-
-- name: Persist swap off by commenting out swap in fstab
-  ansible.builtin.replace:
-    path: /etc/fstab
-    regexp: '^([^#].*?\sswap\s+sw\s+.*)$'
-    replace: '# \1'
-  when: disable_swap | default(true)
-
-- name: Load required kernel modules
+- name: 3.1 Load required kernel modules
+  become: true
   ansible.builtin.modprobe:
     name: "{{ item }}"
   loop: "{{ required_kernel_modules }}"
 
-- name: Persist kernel modules on boot
+- name: 3.2 Persist kernel modules on boot
+  become: true
   ansible.builtin.copy:
     dest: /etc/modules-load.d/k8s.conf
     content: "{{ required_kernel_modules | join('\n') }}"
@@ -32,179 +24,198 @@
     group: root
     mode: '0644'
 
-- name: Configure required sysctl params for Kubernetes
-  ansible.builtin.template:
-    dest: /etc/sysctl.d/k8s.conf
-    src: k8s-sysctl.conf.j2
+- name: 3.3 Configure required sysctl params for Kubernetes
+  become: true
+  ansible.builtin.copy:
+    dest: /etc/sysctl.d/kubernetes.conf
+    content: "{{ k8s_sysctl_params | join('\n') }}"
     owner: root
     group: root
     mode: '0644'
 
-- name: Apply sysctl params without reboot
+- name: 3.4 Apply sysctl params without reboot
+  become: true
   ansible.builtin.shell: sysctl --system
 
-- name: Install python3-libselinux for managing selinux
-  ansible.builtin.dnf:
-    name: python3-libselinux
-    state: present
+- name: 3.5 Manage SELinux
+  become: true
+  when: ansible_os_family == "RedHat"
+  block:
+    - name: 3.5.1 Install python3-libselinux for managing selinux
+      ansible.builtin.dnf:
+        name: python3-libselinux
+        state: present
 
-- name: Set SELinux to permissive mode
-  ansible.posix.selinux:
-    policy: targeted
-    state: "{{ selinux_state }}"
+    - name: 3.5.2 Set SELinux to permissive mode
+      ansible.posix.selinux:
+        policy: targeted
+        state: "{{ selinux_state }}"
 
-- name: Install and configure chrony for time synchronization
-  ansible.builtin.dnf:
-    name: chrony
-    state: present
-  when: configure_ntp | default(true)
+- name: 4 Manage Time Synchronization
+  become: true
+  block:
+    - name: Check if ntp is installed
+      ansible.builtin.package: rpm -q ntp
+      register: ntp_installed
+      changed_when: false
 
-- name: Start and enable chronyd
-  ansible.builtin.systemd:
-    name: chronyd
-    state: started
-    enabled: true
-  when: configure_ntp | default(true)
+    - name: 4.1 Remove the ntp package
+      ansible.builtin.package:
+        name: ntp
+        state: absent
 
-- name: Force time synchronization
-  ansible.builtin.shell: chronyc makestep
-  ignore_errors: true
-  when: configure_ntp | default(true)
+    - name: 4.2 Install the chrony package
+      ansible.builtin.package:
+        name: chrony
+        state: present
 
-- name: Install firewalld
-  ansible.builtin.dnf:
-    name: firewalld
-    state: present
-  when: configure_firewall | default(true)
 
-- name: Start and enable firewalld
-  ansible.builtin.systemd:
-    name: firewalld
-    state: started
-    enabled: true
-  when: configure_firewall | default(true)
+# - name: Start and enable chronyd
+#   ansible.builtin.systemd:
+#     name: chronyd
+#     state: started
+#     enabled: true
+#   when: configure_ntp | default(true)
 
-- name: Create Kubernetes service definition
-  ansible.builtin.template:
-    dest: /etc/firewalld/services/kubernetes.xml
-    owner: root
-    group: root
-    mode: '0644'
-    src: kubernetes-firewall-service.xml.j2
-  when: configure_firewall | default(true)
+# - name: Force time synchronization
+#   ansible.builtin.shell: chronyc makestep
+#   ignore_errors: true
+#   when: configure_ntp | default(true)
 
-- name: Reload firewalld to load new service
-  ansible.builtin.shell: firewall-cmd --reload
-  when: configure_firewall | default(true)
+# - name: Install firewalld
+#   ansible.builtin.dnf:
+#     name: firewalld
+#     state: present
+#   when: configure_firewall | default(true)
 
-- name: Add Kubernetes service to default zone
-  ansible.builtin.shell: firewall-cmd --permanent --add-service=kubernetes
-  when: configure_firewall | default(true)
+# - name: Start and enable firewalld
+#   ansible.builtin.systemd:
+#     name: firewalld
+#     state: started
+#     enabled: true
+#   when: configure_firewall | default(true)
 
-- name: Add SSH service to default zone (ensure SSH access)
-  ansible.builtin.shell: firewall-cmd --permanent --add-service=ssh
-  when: configure_firewall | default(true)
+# - name: Create Kubernetes service definition
+#   ansible.builtin.template:
+#     dest: /etc/firewalld/services/kubernetes.xml
+#     owner: root
+#     group: root
+#     mode: '0644'
+#     src: kubernetes-firewall-service.xml.j2
+#   when: configure_firewall | default(true)
 
-- name: Reload firewalld to apply changes
-  ansible.builtin.shell: firewall-cmd --reload
-  when: configure_firewall | default(true)
+# - name: Reload firewalld to load new service
+#   ansible.builtin.shell: firewall-cmd --reload
+#   when: configure_firewall | default(true)
 
-- name: Verify Kubernetes service is active
-  ansible.builtin.shell: firewall-cmd --list-services
-  register: active_services
-  when: configure_firewall | default(true)
+# - name: Add Kubernetes service to default zone
+#   ansible.builtin.shell: firewall-cmd --permanent --add-service=kubernetes
+#   when: configure_firewall | default(true)
 
-- name: Display active firewall services
-  ansible.builtin.debug:
-    msg: "Active firewall services: {{ active_services.stdout }}"
-  when: configure_firewall | default(true)
+# - name: Add SSH service to default zone (ensure SSH access)
+#   ansible.builtin.shell: firewall-cmd --permanent --add-service=ssh
+#   when: configure_firewall | default(true)
 
-- name: Install DNF plugins core for managing repositories
-  ansible.builtin.dnf:
-    name: dnf-plugins-core
-    state: present
+# - name: Reload firewalld to apply changes
+#   ansible.builtin.shell: firewall-cmd --reload
+#   when: configure_firewall | default(true)
 
-- name: Add Docker CE repository
-  ansible.builtin.shell: |
-    curl -fsSL https://download.docker.com/linux/fedora/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo
+# - name: Verify Kubernetes service is active
+#   ansible.builtin.shell: firewall-cmd --list-services
+#   register: active_services
+#   when: configure_firewall | default(true)
 
-- name: Install containerd
-  ansible.builtin.dnf:
-    name: containerd
-    state: present
+# - name: Display active firewall services
+#   ansible.builtin.debug:
+#     msg: "Active firewall services: {{ active_services.stdout }}"
+#   when: configure_firewall | default(true)
 
-- name: Create containerd config directory
-  ansible.builtin.file:
-    path: /etc/containerd
-    state: directory
-    owner: root
-    group: root
-    mode: '0755'
+# - name: Install DNF plugins core for managing repositories
+#   ansible.builtin.dnf:
+#     name: dnf-plugins-core
+#     state: present
 
-- name: Generate default containerd config and enable SystemdCgroup
-  ansible.builtin.shell: |
-    containerd config default > /etc/containerd/config.toml
-    sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
+# - name: Add Docker CE repository
+#   ansible.builtin.shell: |
+#     curl -fsSL https://download.docker.com/linux/fedora/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo
 
-- name: Restart and enable containerd service
-  ansible.builtin.systemd:
-    name: containerd
-    state: restarted
-    enabled: true
+# - name: Install containerd
+#   ansible.builtin.dnf:
+#     name: containerd
+#     state: present
 
-- name: Add Kubernetes repository
-  ansible.builtin.template:
-    dest: /etc/yum.repos.d/kubernetes.repo
-    owner: root
-    group: root
-    mode: '0644'
-    src: kubernetes.repo.j2
+# - name: Create containerd config directory
+#   ansible.builtin.file:
+#     path: /etc/containerd
+#     state: directory
+#     owner: root
+#     group: root
+#     mode: '0755'
 
-- name: Install Kubernetes packages
-  ansible.builtin.dnf:
-    name:
-      - kubelet
-      - kubeadm
-      - kubectl
-      - kubernetes-cni
-    state: present
+# - name: Generate default containerd config and enable SystemdCgroup
+#   ansible.builtin.shell: |
+#     containerd config default > /etc/containerd/config.toml
+#     sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
 
-- name: Create kubelet config directory
-  ansible.builtin.file:
-    path: /var/lib/kubelet
-    state: directory
-    owner: root
-    group: root
-    mode: '0755'
+# - name: Restart and enable containerd service
+#   ansible.builtin.systemd:
+#     name: containerd
+#     state: restarted
+#     enabled: true
 
-- name: Create initial kubelet config file
-  ansible.builtin.copy:
-    dest: /var/lib/kubelet/config.yaml
-    owner: root
-    group: root
-    mode: '0644'
-    content: |
-      apiVersion: kubelet.config.k8s.io/v1beta1
-      kind: KubeletConfiguration
-      cgroupDriver: systemd
-      containerRuntimeEndpoint: unix:///run/containerd/containerd.sock
+# - name: Add Kubernetes repository
+#   ansible.builtin.template:
+#     dest: /etc/yum.repos.d/kubernetes.repo
+#     owner: root
+#     group: root
+#     mode: '0644'
+#     src: kubernetes.repo.j2
 
-- name: Install CNI plugins via dnf
-  ansible.builtin.dnf:
-    name: containernetworking-plugins
-    state: present
+# - name: Install Kubernetes packages
+#   ansible.builtin.dnf:
+#     name:
+#       - kubelet
+#       - kubeadm
+#       - kubectl
+#       - kubernetes-cni
+#     state: present
 
-- name: Verify CNI plugins installation
-  ansible.builtin.shell: ls -la /opt/cni/bin/ || echo "CNI plugins not found in /opt/cni/bin/"
-  register: cni_plugins
-  ignore_errors: true
+# - name: Create kubelet config directory
+#   ansible.builtin.file:
+#     path: /var/lib/kubelet
+#     state: directory
+#     owner: root
+#     group: root
+#     mode: '0755'
 
-- name: Display installed CNI plugins
-  ansible.builtin.debug:
-    msg: "CNI plugins status: {{ cni_plugins.stdout }}"
+# - name: Create initial kubelet config file
+#   ansible.builtin.copy:
+#     dest: /var/lib/kubelet/config.yaml
+#     owner: root
+#     group: root
+#     mode: '0644'
+#     content: |
+#       apiVersion: kubelet.config.k8s.io/v1beta1
+#       kind: KubeletConfiguration
+#       cgroupDriver: systemd
+#       containerRuntimeEndpoint: unix:///run/containerd/containerd.sock
 
-- name: Enable kubelet service (but don't start yet)
-  ansible.builtin.systemd:
-    name: kubelet
-    enabled: true
-    state: stopped
+# - name: Install CNI plugins via dnf
+#   ansible.builtin.dnf:
+#     name: containernetworking-plugins
+#     state: present
+
+# - name: Verify CNI plugins installation
+#   ansible.builtin.shell: ls -la /opt/cni/bin/ || echo "CNI plugins not found in /opt/cni/bin/"
+#   register: cni_plugins
+#   ignore_errors: true
+
+# - name: Display installed CNI plugins
+#   ansible.builtin.debug:
+#     msg: "CNI plugins status: {{ cni_plugins.stdout }}"
+
+# - name: Enable kubelet service (but don't start yet)
+#   ansible.builtin.systemd:
+#     name: kubelet
+#     enabled: true
+#     state: stopped

ansible/playbooks/roles/n8n/tasks/main.yml

@@ -0,0 +1,100 @@
+---
+# Role to install and configure a n8n server
+
+- name: 1. Pre-install system updates
+  become: true
+  ansible.builtin.apt:
+    name: '*'
+    state: present
+    update_cache: true
+
+- name: 2. Install required packages
+  become: true
+  ansible.builtin.package:
+    name: "{{ item }}"
+    state: present
+  loop:
+    - curl
+    - wget
+    - gnupg
+    - lsb-release
+    - ca-certificates
+    - software-properties-common
+
+# firewall
+# sudo ufw enable
+# sudo ufw allow ssh
+# sudo ufw allow 5678/tcp
+
+- name: 3. Enable UFW
+  become: true
+  community.general.ufw:
+    state: enabled
+
+- name: 4. Open firewall ports for n8n
+  become: true
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop:
+    - 22
+    - 5678
+
+- name: 5. Download node installer
+#  become: true
+  ansible.builtin.get_url:
+    url: 'https://deb.nodesource.com/setup_lts.x'
+    dest: '/tmp/setup_lts.x'
+    mode: '0755'
+
+- name: 6. Run node installer
+  become: true
+  ansible.builtin.shell:
+    cmd: '/tmp/setup_lts.x'
+
+- name: 7. Install Node.js and npm
+  become: true
+  ansible.builtin.package:
+    name: nodejs
+    state: present
+
+- name: 8. Install npm@latest
+  become: true
+  ansible.builtin.shell:
+    cmd: 'sudo npm install -g npm@latest'
+
+- name: 9. Install "n8n" node.js package globally.
+  become: true
+  community.general.npm:
+    name: n8n
+    global: true
+
+- name: 10. Copy n8n.service to /etc/systemd/system
+  become: true
+  ansible.builtin.template:
+    dest: /etc/systemd/system/n8n.service
+    owner: root
+    group: root
+    mode: '0644'
+    src: n8n.service.j2
+
+- name: 11. Create n8n user
+  become: true
+  ansible.builtin.user:
+    name: n8n
+    state: present
+    shell: /bin/bash
+    home: /home/n8n
+    createhome: true
+
+- name: 12. Reload systemd to re-read configs
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+
+- name: 13. Start n8n service
+  become: true
+  ansible.builtin.systemd:
+    name: n8n.service
+    state: restarted
+    enabled: true

ansible/playbooks/roles/n8n/templates/n8n.service.j2

@@ -0,0 +1,22 @@
+[Unit]
+Description=n8n - Workflow Automation Tool
+After=network.target
+
+[Service]
+Type=simple
+User=n8n
+Group=n8n
+ExecStart=/usr/local/bin/n8n
+WorkingDirectory=/home/n8n
+Environment=NODE_ENV=production
+Environment=N8N_BASIC_AUTH_ACTIVE=true
+Environment=N8N_BASIC_AUTH_USER=admin
+#Environment=N8N_BASIC_AUTH_PASSWORD=your_secure_password
+Environment=N8N_HOST=0.0.0.0
+Environment=N8N_PORT=5678
+Environment=N8N_PROTOCOL=http
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target

ansible/playbooks/roles/no-swap/tasks/main.yml

@@ -0,0 +1,34 @@
+---
+# Role to disable swap
+
+- name: 1. Check if swap is enabled
+  ansible.builtin.shell: swapon --show=NAME --noheadings
+  register: swap_status
+  changed_when: false
+
+- name: 2. Disable swap
+  become: true
+  when: swap_status.stdout != ''
+  block:
+    - name: 2.1 Disable swap
+      ansible.builtin.shell: swapoff -a
+
+    - name: 2.2 Persist swap off by commenting out swap in fstab
+      ansible.builtin.replace:
+        path: /etc/fstab
+        regexp: '^([^#].*?\sswap\s+sw\s+.*)$'
+        replace: '# \1'
+        backup: true
+
+    - name: 2.3 Remove swap file
+      become: true
+      ansible.builtin.file:
+        path: "{{ swap_status.stdout }}"
+        state: absent
+
+    - name: 2.4 Remove zram-generator-defaults
+      become: true
+      when: ansible_os_family == "RedHat"
+      ansible.builtin.file:
+        path: /etc/systemd/zram-generator.conf
+        state: absent

ansible/playbooks/roles/ntp-server/tasks/main.yml

@@ -43,4 +43,4 @@
     service: ntp
     permanent: true
     immediate: true
-    state: enabled
+    state: enabled