Adding uptime kuma config

inventory/group_vars/all.yml

@@ -59,9 +59,27 @@ ntp_restrict:
   - '127.0.0.1'
   - '::1'
 
+# SSSD & OpenLDAP core settings
+sssd_nss_homedir_substring: '/nfs/users'
+sssd_domain_name: "metaunix"
+openldap_host: "ldap.int.metaunix.net"
+openldap_port: 636
+openldap_use_starttls: false
+openldap_search_base: "dc=metaunix,dc=net"
+openldap_schema: "rfc2307"
+
+# TLS / Certificate validation
+sssd_disable_tls_verify: true
+
+# Behavior & Performance
+sssd_enable_mkhomedir: true
+sssd_cache_credentials: true
+sssd_enumerate: false
+sssd_default_shell: "/bin/bash"
+
 sudoers_sudoers:
   privileges:
     - name: '%sudo'
       entry: 'ALL=NOPASSWD:ALL'
     - name: '%linuxadmins'
-      entry: 'ALL=(ALL) ALL'
+      entry: 'ALL=NOPASSWD:ALL'

inventory/group_vars/ci_runners.yml

@@ -0,0 +1,15 @@
+---
+
+podman_containers:
+  woodpecker_agent:
+    image: docker.io/woodpeckerci/woodpecker-agent:v3.16
+    state: started
+    volumes:
+      - '/var/run/docker.sock:/var/run/docker.sock'
+    env:
+      WOODPECKER_BACKEND=docker
+      WOODPECKER_SERVER=10.7.10.84:9000
+      WOODPECKER_AGENT_SECRET=af2c22a8f27fe2c22249d3b1e42f92df
+    generate_systemd:
+      restart_policy: always
+      names: true

inventory/group_vars/monitoring_server.yml

@@ -0,0 +1,28 @@
+---
+
+prometheus_prometheus_targets:
+  - "localhost:9090"
+
+prometheus_node_exporter_targets:
+  - "10.7.10.15:9100"
+  - "10.7.10.16:9100"
+  - "10.7.10.26:9100"
+  - "10.7.10.96:9100"
+  - "10.7.10.97:9100"
+  - "10.7.10.101:9100"
+  - "10.7.10.102:9100"
+  - "10.7.10.105:9100"
+  - "10.7.10.106:9100"
+  - "10.7.10.107:9100"
+  - "10.7.20.65:9100"
+  - "10.7.20.66:9100"
+  - "10.7.20.67:9100"
+  - "10.7.20.68:9100"
+  - "10.7.20.69:9100"
+  - "ci-v2-arm1.int.metaunix.net:9100"
+  - "ci-v2-arm2.int.metaunix.net:9100"
+  - "ci-v2-arm3.int.metaunix.net:9100"
+  - "ks-v2.int.metaunix.net:9100"
+  - "lb-v3.int.metaunix.net:9100"
+  - "ns3.int.metaunix.net:9100"
+  - "ns4.int.metaunix.net:9100"

inventory/hosts.ini

@@ -21,12 +21,15 @@ lb-v3 ansible_host=lb-v3.int.metaunix.net
 [kickstart_servers]
 ks-v2 ansible_host=ks-v2.int.metaunix.net
 
+[monitoring_server]
+pi5b2g ansible_host=10.7.10.106
+
 [munin_masters]
 munin-v1 ansible_host=munin-v1.int.metaunix.net
 
 [nameservers]
-#ns1 ansible_host=ns1.int.metaunix.net
+ns1 ansible_host=ns1.int.metaunix.net
-#ns2 ansible_host=ns2.int.metaunix.net
+ns2 ansible_host=ns2.int.metaunix.net
 ns3 ansible_host=ns3.int.metaunix.net
 ns4 ansible_host=ns4.int.metaunix.net
 
@@ -34,13 +37,41 @@ ns4 ansible_host=ns4.int.metaunix.net
 orangepi3lts ansible_host=10.7.10.97
 orangepi3zerow ansible_host=10.7.10.96
 
+[raspberrypi]
+backup-v2 ansible_host=10.7.10.26
+ci-v2-arm1 ansible_host=ci-v2-arm1.int.metaunix.net
+ci-v2-arm2 ansible_host=ci-v2-arm2.int.metaunix.net
+ci-v2-arm3 ansible_host=ci-v2-arm3.int.metaunix.net
+ks-v2 ansible_host=ks-v2.int.metaunix.net
+lb-v3 ansible_host=lb-v3.int.metaunix.net
+ns3 ansible_host=ns3.int.metaunix.net
+ns4 ansible_host=ns4.int.metaunix.net
+pitty-v1-pico ansible_host=10.7.10.16
+pitty-v1-sw ansible_host=10.7.10.15
+pi1b-1 ansible_host=10.7.10.101
+pi1b-2 ansible_host=10.7.10.102
+#pi1b-3 ansible_host=10.7.10.103
+pi3b ansible_host=10.7.10.104
+pi4b4g ansible_host=10.7.10.105
+pi5b2g ansible_host=10.7.10.106
+picm5-1 ansible_host=10.7.10.107
+picam-1 ansible_host=10.7.20.65
+pimusic-1 ansible_host=10.7.20.66
+pimusic-2 ansible_host=10.7.20.67
+pizero1 ansible_host=10.7.20.68
+pi5b1g ansible_host=10.7.20.69
+
 [serial_ttyd]
-pitty ansible_host=10.7.10.175
+pitty-v1-sw ansible_host=10.7.10.15
+pitty-v1-pico ansible_host=10.7.10.16
 
 [smtp_servers]
 smtp1 ansible_host=smtp1.int.metaunix.net
 smtp2 ansible_host=smtp2.int.metaunix.net
 
+[uptime_kuma]
+pi5b1g ansible_host=10.7.20.69
+
 [web_servers]
 www3 ansible_host=www3.int.metaunix.net
 www4 ansible_host=www4.int.metaunix.net

playbooks/auth.yml

@@ -1,5 +1,12 @@
 ---
 
+- name: Install and configure SSSD
+  hosts: all
+  become: true
+
+  roles:
+    - gballan.sssd
+
 - name: Configure sudoers
   hosts: all
   become: true

playbooks/benchmark/sysbench.yml

@@ -0,0 +1,32 @@
+---
+
+- name: Run Sysbench Suite
+  hosts: all
+  become: true
+  tasks:
+    - name: Ensure sysbench is installed
+      ansible.builtin.package:
+        name: sysbench
+        state: present
+      tags: [always]
+
+    - name: CPU Benchmarks
+      tags: [cpu, sysbench_cpu]
+      block:
+        - name: Sysbench CPU (Single-thread)
+          ansible.builtin.command: sysbench cpu --cpu-max-prime=20000 --threads=1 run
+          register: sysbench_cpu_single
+          changed_when: false
+
+        - name: Sysbench CPU (Multi-thread)
+          ansible.builtin.command: sysbench cpu --cpu-max-prime=20000 --threads={{ ansible_processor_vcpus }} run
+          register: sysbench_cpu_multi
+          changed_when: false
+
+    - name: Memory Benchmarks
+      tags: [memory, sysbench_memory]
+      block:
+        - name: Sysbench Memory (Write throughput)
+          ansible.builtin.command: sysbench memory --memory-block-size=1M --memory-total-size=10G --memory-oper=write run
+          register: sysbench_mem_write
+          changed_when: false

playbooks/docker.yml

@@ -3,8 +3,18 @@
 - name: Install and configure Docker
   hosts:
     - ci_servers
-    - ci_runners
+    - uptime_kuma
   become: true
 
   roles:
     - geerlingguy.docker
+
+- name: Ensure python3-docker is installed
+  hosts: ci_servers
+  become: true
+  tasks:
+    - name: Install python3-docker
+      ansible.builtin.package:
+        name:
+          - python3-docker
+        state: present

playbooks/exporters.yml

@@ -0,0 +1,10 @@
+---
+
+- name: Deploy node_exporter across all fleet hosts
+  hosts: all
+  become: true
+
+  roles:
+    - role: prometheus.prometheus.node_exporter
+      vars:
+        node_exporter_web_listen_address: "0.0.0.0:9100"

playbooks/grafana.yml

@@ -0,0 +1,67 @@
+---
+
+- name: Deploy standalone Prometheus on Raspberry Pi 5
+  hosts: monitoring_server
+  become: true
+
+  vars:
+    # Bind to all interfaces on default port
+    prometheus_web_listen_address: "0.0.0.0:9090"
+
+    # Reduce retention to save storage/microSD wear (default is 15d)
+    prometheus_storage_retention: "60d"
+
+    # Self-scrape configuration
+    prometheus_scrape_configs:
+      - job_name: "prometheus"
+        metrics_path: "/metrics"
+        static_configs:
+          - targets: "{{ prometheus_prometheus_targets }}"
+      - job_name: "node_exporter"
+        metrics_path: "/metrics"
+        static_configs:
+          - targets: "{{ prometheus_node_exporter_targets }}"
+
+  roles:
+    - role: prometheus.prometheus.prometheus
+
+- name: Deploy Grafana on Raspberry Pi 5
+  hosts: monitoring_server
+  become: true
+
+  pre_tasks:
+    - name: Ensure python3-debian is present for deb822 repository support
+      ansible.builtin.apt:
+        name: python3-debian
+        state: present
+        update_cache: true
+
+  roles:
+    - role: grafana.grafana.grafana
+      vars:
+        grafana_version: "latest"
+
+        # All grafana.ini sections now live under grafana_ini
+        grafana_ini:
+          server:
+            http_port: 3000
+            http_addr: "0.0.0.0"
+          security:
+            admin_user: "admin"
+            admin_password: "LimpBizkit6"
+          analytics:
+            reporting_enabled: false
+            check_for_updates: false
+
+        # Provision datasources directly
+        grafana_datasources:
+          - name: "Prometheus"
+            type: "prometheus"
+            access: "proxy"
+            url: "http://localhost:9090"
+            isDefault: true
+            editable: true
+
+        # Optional: install community plugins automatically
+        # grafana_plugins:
+        #   - grafana-piechart-panel

playbooks/nfs_client.yml

@@ -0,0 +1,20 @@
+---
+
+- name: Setup and mount NFS share
+  hosts: all
+  become: true
+  gather_facts: true
+
+  tasks:
+    - name: Ensure NFS client packages are installed
+      ansible.builtin.package:
+        name: "{{ 'nfs-common' if ansible_facts['os_family'] == 'Debian' else 'nfs-utils' }}"
+        state: present
+
+    - name: Ensure NFS share is mounted and persistent in fstab
+      ansible.posix.mount:
+        path: /nfs
+        src: nfs-v4.int.metaunix.net:/export/nfs
+        fstype: nfs
+        opts: rw,vers=4,_netdev,sync,hard,intr,rsize=8192,wsize=8192
+        state: mounted

playbooks/podman.yml

@@ -0,0 +1,103 @@
+---
+
+- name: Install and configure Podman
+  hosts: ci_runners
+  become: true
+
+  vars:
+    # Packages common to both Debian and RHEL families
+    podman_base_packages:
+      - podman
+      - podman-docker
+
+    # Debian/Ubuntu specific packages
+    podman_debian_packages:
+      - podman-compose
+
+    # RHEL-family specific packages (adjust or add epel-release if compose is needed)
+    podman_rhel_packages: []
+
+    # Set to true if you need the Docker-compatible API socket (e.g., for Woodpecker CI)
+    podman_enable_socket: true
+
+  tasks:
+    - name: Gather distribution-specific facts
+      ansible.builtin.setup:
+        gather_subset:
+          - "!all"
+          - distribution
+          - os_family
+
+    - name: Install Podman packages on Debian/Ubuntu
+      ansible.builtin.apt:
+        name: "{{ podman_base_packages + podman_debian_packages }}"
+        state: present
+        update_cache: true
+        cache_valid_time: 3600
+      when: ansible_facts['os_family'] == 'Debian'
+
+    - name: Install Podman packages on RHEL/Rocky/AlmaLinux/CentOS
+      ansible.builtin.dnf:
+        name: "{{ podman_base_packages + podman_rhel_packages }}"
+        state: present
+      when: ansible_facts['os_family'] == 'RedHat'
+
+    - name: Enable and start system-wide Podman socket
+      ansible.builtin.systemd:
+        name: podman.socket
+        state: started
+        enabled: true
+      when: podman_enable_socket
+
+    - name: Verify Podman installation
+      ansible.builtin.command: podman --version
+      register: podman_version_output
+      changed_when: false
+
+- name: Run Podman containers
+  hosts: ci_runners
+  become: true
+  tasks:
+    - name: Determine mount host paths
+      ansible.builtin.set_fact:
+        _mount_paths: >-
+          {{
+            _mount_paths | default([]) +
+            (item.value.volumes | map('regex_replace', ':.*$', '') | list)
+          }}
+      loop: "{{ podman_containers | default({}) | dict2items }}"
+      when:
+        - item.value.volumes is defined
+        - item.value.state | default('started') != 'absent'
+
+    - name: Check status of mount paths on host
+      ansible.builtin.stat:
+        path: "{{ item }}"
+      loop: "{{ _mount_paths | default([]) | unique }}"
+      register: _mount_stats
+
+    - name: Ensure container mount directories exist
+      ansible.builtin.file:
+        # If the target path exists and is a file/socket/link, create its parent dir.
+        # If it doesn't exist at all, create it as a directory.
+        path: "{{ (item.stat.exists and not item.stat.isdir) | ternary(item.item | dirname, item.item) }}"
+        state: directory
+        mode: "0755"
+      loop: "{{ _mount_stats.results }}"
+      # Skip creating anything if the file/socket already exists
+      when: not (item.stat.exists and not item.stat.isdir)
+
+    - name: Manage Podman containers
+      containers.podman.podman_container:
+        name: "{{ item.key }}"
+        image: "{{ item.value.image | default(omit) }}"
+        state: "{{ item.value.state | default('started') }}"
+        command: "{{ item.value.command | default(omit) }}"
+        ports: "{{ item.value.ports | default(omit) }}"
+        volumes: "{{ item.value.volumes | default(omit) }}"
+        env: "{{ item.value.env | default(omit) }}"
+        network: "{{ item.value.network | default(omit) }}"
+        privileged: "{{ item.value.privileged | default(false) }}"
+        recreate: "{{ item.value.recreate | default(false) }}"
+        generate_systemd: "{{ item.value.generate_systemd | default(omit) }}"
+      loop: "{{ podman_containers | default({}) | dict2items }}"

playbooks/site.yml

@@ -6,12 +6,20 @@
   import_playbook: base.yml
 - name: Authentication
   import_playbook: auth.yml
+- name: NFS Client
+  import_playbook: nfs_client.yml
 - name: Packages
   import_playbook: packages.yml
+- name: Grafana / Prometheus
+  import_playbook: grafana.yml
+- name: node_exporter and others for Prometheus
+  import_playbook: exporters.yml
 - name: Munin
   import_playbook: munin.yml
 - name: Gitea
   import_playbook: gitea.yml
+- name: Podman
+  import_playbook: podman.yml
 - name: Docker
   import_playbook: docker.yml
 - name: Apache

playbooks/sysinfo.yml

@@ -5,36 +5,36 @@
   become: true
   tasks:
     - name: Show system CPU info
-      ansible.builtin.shell: lscpu
+      ansible.builtin.command: lscpu
-      register: shell_result
+      register: cmd_output
       changed_when: false
 
     - name: Print stdout to terminal
       ansible.builtin.debug:
-        var: shell_result.stdout_lines
+        var: cmd_output.stdout_lines
 
 - name: RAM Info
   hosts: all
   become: true
   tasks:
     - name: Show free and used memory
-      ansible.builtin.shell: free -h
+      ansible.builtin.command: free -h
-      register: shell_result
+      register: cmd_output
       changed_when: false
 
     - name: Print stdout to terminal
       ansible.builtin.debug:
-        var: shell_result.stdout_lines
+        var: cmd_output.stdout_lines
 
 - name: Disk Info
   hosts: all
   become: true
   tasks:
     - name: Show mounted disks and their usage
-      ansible.builtin.shell: df -h
+      ansible.builtin.command: df -h
-      register: shell_result
+      register: cmd_output
       changed_when: false
 
     - name: Print stdout to terminal
       ansible.builtin.debug:
-        var: shell_result.stdout_lines
+        var: cmd_output.stdout_lines

playbooks/uptime_kuma.yml

@@ -0,0 +1,23 @@
+---
+
+- name: Deploy Uptime Kuma 2
+  hosts: uptime_kuma
+  become: true
+
+  tasks:
+    - name: Ensure named Docker volume exists
+      community.docker.docker_volume:
+        name: uptime-kuma
+        state: present
+
+    - name: Run Uptime Kuma container
+      community.docker.docker_container:
+        name: uptime-kuma
+        image: louislam/uptime-kuma:2
+        state: started
+        restart_policy: unless-stopped
+        published_ports:
+          - "3001:3001"
+        volumes:
+          - uptime-kuma:/app/data
+        pull: true

requirements.yml

@@ -1,8 +1,23 @@
 collections:
   - name: ansible.posix
+    version: 2.2.2
   - name: community.general
+    version: 13.4.0
+  - name: community.docker
+    version: 5.3.0
+  - name: containers.podman
+    version: 1.20.2
+  - name: grafana.grafana
+    version: 6.1.0
+  - name: prometheus.prometheus
+    version: 0.30.1
 
 roles:
+  - name: gballan.sssd
+    src: gitea@git.metaunix.net:gballan/ansible-role-sssd.git
+    scm: git
+    version: v0.1.7
+
   - src: arillso.sudoers
     version: 2.3.0
   - src: geerlingguy.apache