Adding orangepi3lts to uptime_kuma/docker; Updating docker playbook to include uptime_kuma group

.ansible-lint.yml

@@ -0,0 +1,19 @@
+# .ansible-lint
+---
+# Exclude paths from linting
+exclude_paths:
+  - .cache/
+  - .github/
+  - tests/
+  - molecule/
+  - roles/
+
+# Enable specific profiles (min, basic, moderate, safety, shared, production)
+profile: moderate
+
+warn_list:
+  - skip_this_tag
+  - experimental
+
+# Set the project directory
+project_dir: .

.woodpecker.yml

@@ -0,0 +1,10 @@
+when:
+  - event: [pull_request, push]
+    branch: [main]
+
+steps:
+  - name: ansible-lint
+    image: ghcr.io/ansible/community-ansible-dev-tools:latest
+    commands:
+      - git config --global --add safe.directory "$CI_WORKSPACE"
+      - ansible-lint --force-color

inventory/group_vars/all.yml

@@ -1,4 +1,5 @@
 ---
+ansible_user: xadmin
 
 packages_common:
   - 'bash'
@@ -24,8 +25,8 @@ apache_vhosts: >-
     + (apache_vhosts_munin | default([]))
   }}
 
-docker_add_repo: True
-docker_install_compose_plugin: False
+docker_add_repo: true
+docker_install_compose_plugin: false
 docker_users:
   - 'gballan'
 
@@ -43,13 +44,13 @@ munin_node_plugins:
   - name: 'uptime'
   - name: 'users'
 
-ntp_enabled: True
+ntp_enabled: true
 ntp_timezone: 'America/New_York'
 ntp_package: 'chrony'
 ntp_daemon: 'chronyd'
 ntp_config_file: '/etc/chrony/chrony.conf'
 ntp_driftfile: '/var/lib/chrony/chrony.drift'
-ntp_manage_config: True
+ntp_manage_config: true
 ntp_servers:
   - 'virginia.time.system76.com iburst'
   - 'ohio.time.system76.com iburst'
@@ -58,9 +59,27 @@ ntp_restrict:
   - '127.0.0.1'
   - '::1'
 
+# SSSD & OpenLDAP core settings
+sssd_nss_homedir_substring: '/nfs/users'
+sssd_domain_name: "metaunix"
+openldap_host: "ldap.int.metaunix.net"
+openldap_port: 636
+openldap_use_starttls: false
+openldap_search_base: "dc=metaunix,dc=net"
+openldap_schema: "rfc2307"
+
+# TLS / Certificate validation
+sssd_disable_tls_verify: true
+
+# Behavior & Performance
+sssd_enable_mkhomedir: true
+sssd_cache_credentials: true
+sssd_enumerate: false
+sssd_default_shell: "/bin/bash"
+
 sudoers_sudoers:
   privileges:
     - name: '%sudo'
       entry: 'ALL=NOPASSWD:ALL'
     - name: '%linuxadmins'
-      entry: 'ALL=(ALL) ALL'
+      entry: 'ALL=NOPASSWD:ALL'

inventory/group_vars/ci_runners.yml

@@ -0,0 +1,15 @@
+---
+
+podman_containers:
+  woodpecker_agent:
+    image: docker.io/woodpeckerci/woodpecker-agent:v3.16
+    state: started
+    volumes:
+      - '/var/run/docker.sock:/var/run/docker.sock'
+    env:
+      WOODPECKER_BACKEND=docker
+      WOODPECKER_SERVER=10.7.10.84:9000
+      WOODPECKER_AGENT_SECRET=af2c22a8f27fe2c22249d3b1e42f92df
+    generate_systemd:
+      restart_policy: always
+      names: true

inventory/group_vars/gitea_servers.yml

@@ -7,14 +7,14 @@ gitea_data_dir: /var/lib/gitea
 # use the default SSH server for git operations, not Gitea's built-in one
 gitea_ssh_port: 22
 gitea_user: git
-gitea_start_ssh: False
+gitea_start_ssh: false
 
-gitea_disable_registration: True
-gitea_show_registration_button: False
-gitea_require_signin: False
+gitea_disable_registration: true
+gitea_show_registration_button: false
+gitea_require_signin: false
 
-gitea_enable_push_create_org: True
-gitea_enable_push_create_user: True
+gitea_enable_push_create_org: true
+gitea_enable_push_create_user: true
 
 # Apache reverse proxy config
 apache_mods_enabled_gitea:

inventory/group_vars/gl_servers.yml

@@ -1,9 +1,9 @@
 ---
 
-git_install_from_source: False
+git_install_from_source: false
 
-ruby_install_from_source: False
-ruby_install_bundler: True
+ruby_install_from_source: false
+ruby_install_bundler: true
 
 nodejs_version: '24.x'
 

inventory/group_vars/monitoring_server.yml

@@ -0,0 +1,28 @@
+---
+
+prometheus_prometheus_targets:
+  - "localhost:9090"
+
+prometheus_node_exporter_targets:
+  - "10.7.10.15:9100"
+  - "10.7.10.16:9100"
+  - "10.7.10.26:9100"
+  - "10.7.10.96:9100"
+  - "10.7.10.97:9100"
+  - "10.7.10.101:9100"
+  - "10.7.10.102:9100"
+  - "10.7.10.105:9100"
+  - "10.7.10.106:9100"
+  - "10.7.10.107:9100"
+  - "10.7.20.65:9100"
+  - "10.7.20.66:9100"
+  - "10.7.20.67:9100"
+  - "10.7.20.68:9100"
+  - "10.7.20.69:9100"
+  - "ci-v2-arm1.int.metaunix.net:9100"
+  - "ci-v2-arm2.int.metaunix.net:9100"
+  - "ci-v2-arm3.int.metaunix.net:9100"
+  - "ks-v2.int.metaunix.net:9100"
+  - "lb-v3.int.metaunix.net:9100"
+  - "ns3.int.metaunix.net:9100"
+  - "ns4.int.metaunix.net:9100"

inventory/group_vars/munin_masters.yml

@@ -25,7 +25,7 @@ apache_vhosts_munin:
 
       DirectoryIndex index.html
 
-munin_local_conf_remove: True
+munin_local_conf_remove: true
 munin_html_strategy: 'cgi'
 munin_graph_strategy: 'cgi'
 munin_max_processes: 4

inventory/group_vars/web_servers.yml

@@ -0,0 +1,123 @@
+---
+
+### PHP config ###
+php_install_composer: true
+php_enable_php_fpm: true
+php_webserver_daemon: "nginx"
+
+# Ensure the socket directory and permissions allow Nginx access
+php_fpm_pool_user: "nginx"
+php_fpm_pool_group: "nginx"
+php_fpm_listen_owner: "nginx"
+php_fpm_listen_group: "nginx"
+
+# Default Unix socket location on RHEL
+php_fpm_listen: "/run/php-fpm/www.sock"
+
+php_packages:
+  - php-cli
+  - php-common
+  - php-fpm
+  - php-gd
+  - php-ldap
+  - php-mbstring
+  - php-mysqlnd
+  - php-pdo
+  - php-pgsql
+  - php-xml
+  - php-pecl-zip
+
+### Nginx config ###
+nginx_vhosts:
+  # ----------------------------------------
+  # metaunix.net (Default Server)
+  # ----------------------------------------
+  - listen: "80 default_server"
+    server_name: "{{ ansible_fqdn }} metaunix.net www.metaunix.net www.int.metaunix.net"
+    root: "/nfs/web/www"
+    index: "index.html"
+    extra_parameters: |
+      location / {
+          try_files $uri $uri/ =404;
+      }
+
+      location ~ .well-known/acme-challenge/ {
+          root /nfs/web/acme;
+          try_files $uri =404;
+      }
+
+  # ----------------------------------------
+  # wiki.bitgoblin.tech (DokuWiki)
+  # ----------------------------------------
+  - listen: "80"
+    server_name: "wiki.bitgoblin.tech"
+    root: "/nfs/web/dokuwiki"
+    index: "index.php"
+    extra_parameters: |
+      location / {
+          index doku.php;
+          try_files $uri $uri/ @dokuwiki;
+      }
+
+      location @dokuwiki {
+          rewrite ^/_media/(.*) /lib/exe/fetch.php?media=$1 last;
+          rewrite ^/_detail/(.*) /lib/exe/detail.php?media=$1 last;
+          rewrite ^/_export/([^/]+)/(.*) /doku.php?do=export_$1&id=$2 last;
+          rewrite ^/(.*) /doku.php?id=$1 last;
+      }
+
+      location ~ ^/lib.*\.(gif|png|ico|jpg)$ {
+          expires 30d;
+      }
+
+      location ^~ /conf/ {
+          return 403;
+      }
+
+      location ^~ /data/ {
+          return 403;
+      }
+
+      location ~ \.php$ {
+          fastcgi_split_path_info ^(.+\.php)(/.+)$;
+          fastcgi_pass unix:{{ php_fpm_listen }};
+          fastcgi_index index.php;
+          include fastcgi_params;
+          fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+          fastcgi_param HTTPS on;
+          fastcgi_param SERVER_PORT 443;
+          fastcgi_param HTTP_X_FORWARDED_PROTO $http_x_forwarded_proto;
+          fastcgi_param HTTP_X_FORWARDED_SSL on;
+          fastcgi_param REDIRECT_STATUS 200;
+      }
+
+      location ~ .well-known/acme-challenge/ {
+          root /nfs/web/acme;
+          try_files $uri =404;
+      }
+
+  # ----------------------------------------
+  # yourls.bitgoblin.tech
+  # ----------------------------------------
+  - listen: "80"
+    server_name: "yourls.bitgoblin.tech u.bitgoblin.tech"
+    root: "/nfs/web/yourls"
+    index: "index.php"
+    extra_parameters: |
+      location / {
+          try_files $uri $uri/ /yourls-loader.php$is_args$args;
+      }
+
+      location ~ \.php$ {
+          fastcgi_split_path_info ^(.+\.php)(/.+)$;
+          fastcgi_pass unix:{{ php_fpm_listen }};
+          fastcgi_index index.php;
+          include fastcgi.conf;
+          fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+          fastcgi_param REDIRECT_STATUS 200;
+      }
+
+      location ~ .well-known/acme-challenge/ {
+          root /nfs/web/acme;
+          try_files $uri =404;
+      }

inventory/hosts.ini

@@ -21,22 +21,58 @@ lb-v3 ansible_host=lb-v3.int.metaunix.net
 [kickstart_servers]
 ks-v2 ansible_host=ks-v2.int.metaunix.net
 
+[monitoring_server]
+pi5b2g ansible_host=10.7.10.106
+
 [munin_masters]
 munin-v1 ansible_host=munin-v1.int.metaunix.net
 
 [nameservers]
-#ns1 ansible_host=ns1.int.metaunix.net
-#ns2 ansible_host=ns2.int.metaunix.net
+ns1 ansible_host=ns1.int.metaunix.net
+ns2 ansible_host=ns2.int.metaunix.net
 ns3 ansible_host=ns3.int.metaunix.net
 ns4 ansible_host=ns4.int.metaunix.net
 
+[orangepi]
+orangepi3lts ansible_host=10.7.10.97
+orangepi3zerow ansible_host=10.7.10.96
+
+[raspberrypi]
+backup-v2 ansible_host=10.7.10.26
+ci-v2-arm1 ansible_host=ci-v2-arm1.int.metaunix.net
+ci-v2-arm2 ansible_host=ci-v2-arm2.int.metaunix.net
+ci-v2-arm3 ansible_host=ci-v2-arm3.int.metaunix.net
+ks-v2 ansible_host=ks-v2.int.metaunix.net
+lb-v3 ansible_host=lb-v3.int.metaunix.net
+ns3 ansible_host=ns3.int.metaunix.net
+ns4 ansible_host=ns4.int.metaunix.net
+pitty-v1-pico ansible_host=10.7.10.16
+pitty-v1-sw ansible_host=10.7.10.15
+pi1b-1 ansible_host=10.7.10.101
+pi1b-2 ansible_host=10.7.10.102
+#pi1b-3 ansible_host=10.7.10.103
+pi3b ansible_host=10.7.10.104
+pi4b4g ansible_host=10.7.10.105
+pi5b2g ansible_host=10.7.10.106
+picm5-1 ansible_host=10.7.10.107
+picam-1 ansible_host=10.7.20.65
+pimusic-1 ansible_host=10.7.20.66
+pimusic-2 ansible_host=10.7.20.67
+pizero1 ansible_host=10.7.20.68
+pi5b1g ansible_host=10.7.20.69
+
 [serial_ttyd]
-pitty ansible_host=10.7.10.175
+pitty-v1-sw ansible_host=10.7.10.15
+pitty-v1-pico ansible_host=10.7.10.16
 
 [smtp_servers]
 smtp1 ansible_host=smtp1.int.metaunix.net
 smtp2 ansible_host=smtp2.int.metaunix.net
 
+[uptime_kuma]
+orangepi3lts ansible_host=10.7.10.97
+pi5b1g ansible_host=10.7.20.69
+
 [web_servers]
 www3 ansible_host=www3.int.metaunix.net
 www4 ansible_host=www4.int.metaunix.net

playbooks/apache.yml

@@ -4,7 +4,7 @@
   hosts:
     - gitea_servers
     - munin_masters
-  become: True
+  become: true
 
   roles:
     - geerlingguy.apache

playbooks/auth.yml

@@ -1,8 +1,15 @@
 ---
 
+- name: Install and configure SSSD
+  hosts: all
+  become: true
+
+  roles:
+    - gballan.sssd
+
 - name: Configure sudoers
   hosts: all
-  become: True
+  become: true
 
   roles:
     - arillso.sudoers

playbooks/base.yml

@@ -2,28 +2,28 @@
 
 - name: Uninstall Puppet/OpenVox packages
   hosts: all
-  become: yes
+  become: true
   tasks:
     - name: Uninstall puppet package
-      package:
+      ansible.builtin.package:
         name: 'puppet-agent'
         state: absent
     - name: Uninstall puppet-release package
-      package:
+      ansible.builtin.package:
         name: 'puppet8-release'
         state: absent
     - name: Uninstall openvox package
-      package:
+      ansible.builtin.package:
         name: 'openvox-agent'
         state: absent
     - name: Uninstall openvox-release package
-      package:
+      ansible.builtin.package:
         name: 'openvox8-release'
         state: absent
 
 - name: Disable Puppet Service if present
   hosts: all
-  become: yes
+  become: true
   tasks:
     - name: Check if Puppet service exists
       ansible.builtin.service_facts:
@@ -32,5 +32,5 @@
       ansible.builtin.service:
         name: puppet
         state: stopped
-        enabled: False
+        enabled: false
       when: "'puppet.service' in services or 'puppet' in services"

playbooks/benchmark/sysbench.yml

@@ -0,0 +1,32 @@
+---
+
+- name: Run Sysbench Suite
+  hosts: all
+  become: true
+  tasks:
+    - name: Ensure sysbench is installed
+      ansible.builtin.package:
+        name: sysbench
+        state: present
+      tags: [always]
+
+    - name: CPU Benchmarks
+      tags: [cpu, sysbench_cpu]
+      block:
+        - name: Sysbench CPU (Single-thread)
+          ansible.builtin.command: sysbench cpu --cpu-max-prime=20000 --threads=1 run
+          register: sysbench_cpu_single
+          changed_when: false
+
+        - name: Sysbench CPU (Multi-thread)
+          ansible.builtin.command: sysbench cpu --cpu-max-prime=20000 --threads={{ ansible_processor_vcpus }} run
+          register: sysbench_cpu_multi
+          changed_when: false
+
+    - name: Memory Benchmarks
+      tags: [memory, sysbench_memory]
+      block:
+        - name: Sysbench Memory (Write throughput)
+          ansible.builtin.command: sysbench memory --memory-block-size=1M --memory-total-size=10G --memory-oper=write run
+          register: sysbench_mem_write
+          changed_when: false

playbooks/dev.yml

@@ -2,18 +2,18 @@
 
 - name: Install Git
   hosts: gl_servers
-  become: True
+  become: true
   roles:
     - geerlingguy.git
 
 - name: Install Ruby
   hosts: gl_servers
-  become: True
+  become: true
   roles:
     - geerlingguy.ruby
 
 - name: Install Node.js
   hosts: gl_servers
-  become: True
+  become: true
   roles:
     - geerlingguy.nodejs

playbooks/docker.yml

@@ -3,8 +3,20 @@
 - name: Install and configure Docker
   hosts:
     - ci_servers
-    - ci_runners
-  become: True
+    - uptime_kuma
+  become: true
 
   roles:
     - geerlingguy.docker
+
+- name: Ensure python3-docker is installed
+  hosts:
+    - ci_servers
+    - uptime_kuma
+  become: true
+  tasks:
+    - name: Install python3-docker
+      ansible.builtin.package:
+        name:
+          - python3-docker
+        state: present

playbooks/exporters.yml

@@ -0,0 +1,10 @@
+---
+
+- name: Deploy node_exporter across all fleet hosts
+  hosts: all
+  become: true
+
+  roles:
+    - role: prometheus.prometheus.node_exporter
+      vars:
+        node_exporter_web_listen_address: "0.0.0.0:9100"

playbooks/gitea.yml

@@ -2,7 +2,7 @@
 
 - name: Install Gitea
   hosts: gitea_servers
-  become: True
+  become: true
 
   roles:
     - roles-ansible.gitea

playbooks/grafana.yml

@@ -0,0 +1,67 @@
+---
+
+- name: Deploy standalone Prometheus on Raspberry Pi 5
+  hosts: monitoring_server
+  become: true
+
+  vars:
+    # Bind to all interfaces on default port
+    prometheus_web_listen_address: "0.0.0.0:9090"
+
+    # Reduce retention to save storage/microSD wear (default is 15d)
+    prometheus_storage_retention: "60d"
+
+    # Self-scrape configuration
+    prometheus_scrape_configs:
+      - job_name: "prometheus"
+        metrics_path: "/metrics"
+        static_configs:
+          - targets: "{{ prometheus_prometheus_targets }}"
+      - job_name: "node_exporter"
+        metrics_path: "/metrics"
+        static_configs:
+          - targets: "{{ prometheus_node_exporter_targets }}"
+
+  roles:
+    - role: prometheus.prometheus.prometheus
+
+- name: Deploy Grafana on Raspberry Pi 5
+  hosts: monitoring_server
+  become: true
+
+  pre_tasks:
+    - name: Ensure python3-debian is present for deb822 repository support
+      ansible.builtin.apt:
+        name: python3-debian
+        state: present
+        update_cache: true
+
+  roles:
+    - role: grafana.grafana.grafana
+      vars:
+        grafana_version: "latest"
+
+        # All grafana.ini sections now live under grafana_ini
+        grafana_ini:
+          server:
+            http_port: 3000
+            http_addr: "0.0.0.0"
+          security:
+            admin_user: "admin"
+            admin_password: "LimpBizkit6"
+          analytics:
+            reporting_enabled: false
+            check_for_updates: false
+
+        # Provision datasources directly
+        grafana_datasources:
+          - name: "Prometheus"
+            type: "prometheus"
+            access: "proxy"
+            url: "http://localhost:9090"
+            isDefault: true
+            editable: true
+
+        # Optional: install community plugins automatically
+        # grafana_plugins:
+        #   - grafana-piechart-panel

playbooks/munin.yml

@@ -2,14 +2,14 @@
 
 - name: Install Munin master
   hosts: munin_masters
-  become: True
+  become: true
 
   roles:
     - geerlingguy.munin
 
 - name: Install Munin node
   hosts: all
-  become: True
+  become: true
 
   roles:
     - geerlingguy.munin-node

playbooks/nfs_client.yml

@@ -0,0 +1,20 @@
+---
+
+- name: Setup and mount NFS share
+  hosts: all
+  become: true
+  gather_facts: true
+
+  tasks:
+    - name: Ensure NFS client packages are installed
+      ansible.builtin.package:
+        name: "{{ 'nfs-common' if ansible_facts['os_family'] == 'Debian' else 'nfs-utils' }}"
+        state: present
+
+    - name: Ensure NFS share is mounted and persistent in fstab
+      ansible.posix.mount:
+        path: /nfs
+        src: nfs-v4.int.metaunix.net:/export/nfs
+        fstype: nfs
+        opts: rw,vers=4,_netdev,sync,hard,intr,rsize=8192,wsize=8192
+        state: mounted

playbooks/nginx.yml

@@ -2,7 +2,7 @@
 
 - name: Install Nginx
   hosts: web_servers
-  become: True
+  become: true
 
   roles:
     - geerlingguy.nginx

playbooks/ntp.yml

@@ -2,7 +2,7 @@
 
 - name: Install NTP
   hosts: all
-  become: True
+  become: true
 
   roles:
     - geerlingguy.ntp

playbooks/os_patching.yml

@@ -11,36 +11,36 @@
   tasks:
     - name: Update apt cache (Debian)
       ansible.builtin.apt:
-        update_cache: yes
+        update_cache: true
         cache_valid_time: 3600
-      when: ansible_os_family == "Debian"
+      when: ansible_facts['os_family'] == "Debian"
 
     - name: Upgrade all packages (Debian)
       ansible.builtin.apt:
         upgrade: dist
-        autoremove: yes
-        autoclean: yes
-      when: ansible_os_family == "Debian"
+        autoremove: true
+        autoclean: true
+      when: ansible_facts['os_family'] == "Debian"
 
-    - name: Upgrade all packages (RedHat)
+    - name: Upgrade all packages (RedHat) # noqa: package-latest
       ansible.builtin.dnf:
         name: "*"
         state: latest
-        update_cache: yes
-      when: ansible_os_family == "RedHat"
+        update_cache: true
+      when: ansible_facts['os_family'] == "RedHat"
 
     - name: Check if reboot is required (Debian)
       ansible.builtin.stat:
         path: /var/run/reboot-required
       register: reboot_required_debian
-      when: ansible_os_family == "Debian"
+      when: ansible_facts['os_family'] == "Debian"
 
     - name: Check if reboot is required (RedHat)
       ansible.builtin.command: needs-restarting -r
       register: reboot_required_redhat
-      failed_when: False
-      changed_when: False
-      when: ansible_os_family == "RedHat"
+      failed_when: false
+      changed_when: false
+      when: ansible_facts['os_family'] == "RedHat"
 
     - name: Reboot Debian systems if required
       ansible.builtin.reboot:
@@ -48,7 +48,7 @@
         reboot_timeout: 600
       when:
         - reboot_if_required
-        - ansible_os_family == "Debian"
+        - ansible_facts['os_family'] == "Debian"
         - reboot_required_debian.stat.exists
 
     - name: Reboot RedHat systems if required
@@ -57,5 +57,5 @@
         reboot_timeout: 600
       when:
         - reboot_if_required
-        - ansible_os_family == "RedHat"
+        - ansible_facts['os_family'] == "RedHat"
         - reboot_required_redhat.rc == 1

playbooks/packages.yml

@@ -1,17 +1,15 @@
 ---
 
-- hosts: all
-  become: True
+- name: Install common packages
+  hosts: all
+  become: true
   tasks:
     - name: Install common packages on all hosts
-      package:
+      ansible.builtin.package:
         name: "{{ packages_common }}"
         state: present
 
-- hosts: all
-  become: True
-  tasks:
     - name: Install extra packages if listed
-      package:
+      ansible.builtin.package:
         name: "{{ packages_extra | default([]) }}"
         state: present

playbooks/php.yml

@@ -0,0 +1,8 @@
+---
+
+- name: Install PHP
+  hosts: web_servers
+  become: true
+
+  roles:
+    - geerlingguy.php

playbooks/ping.yml

@@ -1,3 +1,5 @@
+---
+
 - name: Test connectivity
   hosts: all
 

playbooks/podman.yml

@@ -0,0 +1,103 @@
+---
+
+- name: Install and configure Podman
+  hosts: ci_runners
+  become: true
+
+  vars:
+    # Packages common to both Debian and RHEL families
+    podman_base_packages:
+      - podman
+      - podman-docker
+
+    # Debian/Ubuntu specific packages
+    podman_debian_packages:
+      - podman-compose
+
+    # RHEL-family specific packages (adjust or add epel-release if compose is needed)
+    podman_rhel_packages: []
+
+    # Set to true if you need the Docker-compatible API socket (e.g., for Woodpecker CI)
+    podman_enable_socket: true
+
+  tasks:
+    - name: Gather distribution-specific facts
+      ansible.builtin.setup:
+        gather_subset:
+          - "!all"
+          - distribution
+          - os_family
+
+    - name: Install Podman packages on Debian/Ubuntu
+      ansible.builtin.apt:
+        name: "{{ podman_base_packages + podman_debian_packages }}"
+        state: present
+        update_cache: true
+        cache_valid_time: 3600
+      when: ansible_facts['os_family'] == 'Debian'
+
+    - name: Install Podman packages on RHEL/Rocky/AlmaLinux/CentOS
+      ansible.builtin.dnf:
+        name: "{{ podman_base_packages + podman_rhel_packages }}"
+        state: present
+      when: ansible_facts['os_family'] == 'RedHat'
+
+    - name: Enable and start system-wide Podman socket
+      ansible.builtin.systemd:
+        name: podman.socket
+        state: started
+        enabled: true
+      when: podman_enable_socket
+
+    - name: Verify Podman installation
+      ansible.builtin.command: podman --version
+      register: podman_version_output
+      changed_when: false
+
+- name: Run Podman containers
+  hosts: ci_runners
+  become: true
+  tasks:
+    - name: Determine mount host paths
+      ansible.builtin.set_fact:
+        _mount_paths: >-
+          {{
+            _mount_paths | default([]) +
+            (item.value.volumes | map('regex_replace', ':.*$', '') | list)
+          }}
+      loop: "{{ podman_containers | default({}) | dict2items }}"
+      when:
+        - item.value.volumes is defined
+        - item.value.state | default('started') != 'absent'
+
+    - name: Check status of mount paths on host
+      ansible.builtin.stat:
+        path: "{{ item }}"
+      loop: "{{ _mount_paths | default([]) | unique }}"
+      register: _mount_stats
+
+    - name: Ensure container mount directories exist
+      ansible.builtin.file:
+        # If the target path exists and is a file/socket/link, create its parent dir.
+        # If it doesn't exist at all, create it as a directory.
+        path: "{{ (item.stat.exists and not item.stat.isdir) | ternary(item.item | dirname, item.item) }}"
+        state: directory
+        mode: "0755"
+      loop: "{{ _mount_stats.results }}"
+      # Skip creating anything if the file/socket already exists
+      when: not (item.stat.exists and not item.stat.isdir)
+
+    - name: Manage Podman containers
+      containers.podman.podman_container:
+        name: "{{ item.key }}"
+        image: "{{ item.value.image | default(omit) }}"
+        state: "{{ item.value.state | default('started') }}"
+        command: "{{ item.value.command | default(omit) }}"
+        ports: "{{ item.value.ports | default(omit) }}"
+        volumes: "{{ item.value.volumes | default(omit) }}"
+        env: "{{ item.value.env | default(omit) }}"
+        network: "{{ item.value.network | default(omit) }}"
+        privileged: "{{ item.value.privileged | default(false) }}"
+        recreate: "{{ item.value.recreate | default(false) }}"
+        generate_systemd: "{{ item.value.generate_systemd | default(omit) }}"
+      loop: "{{ podman_containers | default({}) | dict2items }}"

playbooks/site.yml

@@ -1,12 +1,32 @@
 ---
 
-- import_playbook: ntp.yml
-- import_playbook: base.yml
-- import_playbook: auth.yml
-- import_playbook: packages.yml
-- import_playbook: munin.yml
-- import_playbook: gitea.yml
-- import_playbook: docker.yml
-- import_playbook: apache.yml
-- import_playbook: nginx.yml
-- import_playbook: dev.yml
+- name: NTP
+  import_playbook: ntp.yml
+- name: Base states
+  import_playbook: base.yml
+- name: Authentication
+  import_playbook: auth.yml
+- name: NFS Client
+  import_playbook: nfs_client.yml
+- name: Packages
+  import_playbook: packages.yml
+- name: Grafana / Prometheus
+  import_playbook: grafana.yml
+- name: node_exporter and others for Prometheus
+  import_playbook: exporters.yml
+- name: Munin
+  import_playbook: munin.yml
+- name: Gitea
+  import_playbook: gitea.yml
+- name: Podman
+  import_playbook: podman.yml
+- name: Docker
+  import_playbook: docker.yml
+- name: PHP
+  import_playbook: php.yml
+- name: Apache
+  import_playbook: apache.yml
+- name: Nginx
+  import_playbook: nginx.yml
+- name: Development playbook
+  import_playbook: dev.yml

playbooks/sysinfo.yml

@@ -0,0 +1,40 @@
+---
+
+- name: CPU Info
+  hosts: all
+  become: true
+  tasks:
+    - name: Show system CPU info
+      ansible.builtin.command: lscpu
+      register: cmd_output
+      changed_when: false
+
+    - name: Print stdout to terminal
+      ansible.builtin.debug:
+        var: cmd_output.stdout_lines
+
+- name: RAM Info
+  hosts: all
+  become: true
+  tasks:
+    - name: Show free and used memory
+      ansible.builtin.command: free -h
+      register: cmd_output
+      changed_when: false
+
+    - name: Print stdout to terminal
+      ansible.builtin.debug:
+        var: cmd_output.stdout_lines
+
+- name: Disk Info
+  hosts: all
+  become: true
+  tasks:
+    - name: Show mounted disks and their usage
+      ansible.builtin.command: df -h
+      register: cmd_output
+      changed_when: false
+
+    - name: Print stdout to terminal
+      ansible.builtin.debug:
+        var: cmd_output.stdout_lines

playbooks/uptime_kuma.yml

@@ -0,0 +1,23 @@
+---
+
+- name: Deploy Uptime Kuma 2
+  hosts: uptime_kuma
+  become: true
+
+  tasks:
+    - name: Ensure named Docker volume exists
+      community.docker.docker_volume:
+        name: uptime-kuma
+        state: present
+
+    - name: Run Uptime Kuma container
+      community.docker.docker_container:
+        name: uptime-kuma
+        image: louislam/uptime-kuma:2
+        state: started
+        restart_policy: unless-stopped
+        published_ports:
+          - "3001:3001"
+        volumes:
+          - uptime-kuma:/app/data
+        pull: true

requirements.yml

@@ -1,12 +1,29 @@
 collections:
   - name: ansible.posix
+    version: 2.2.2
   - name: community.general
+    version: 13.4.0
+  - name: community.docker
+    version: 5.3.0
+  - name: containers.podman
+    version: 1.20.2
+  - name: grafana.grafana
+    version: 6.1.0
+  - name: prometheus.prometheus
+    version: 0.30.1
 
 roles:
+  - name: gballan.sssd
+    src: gitea@git.metaunix.net:gballan/ansible-role-sssd.git
+    scm: git
+    version: v0.1.7
+
   - src: arillso.sudoers
     version: 2.3.0
   - src: geerlingguy.apache
     version: 4.2.0
+  - src: geerlingguy.docker
+    version: 8.0.0
   - src: geerlingguy.git
     version: 3.0.1
   - src: geerlingguy.munin
@@ -17,6 +34,8 @@ roles:
     version: 3.3.0
   - src: geerlingguy.nodejs
     version: 7.1.0
+  - src: geerlingguy.php
+    version: 6.1.0
   - src: geerlingguy.ntp
     version: 4.0.0
   - src: geerlingguy.ruby