feat: improce variable management

ansible/group_vars/NAS/ftp

@@ -0,0 +1,3 @@
+vsftpd_config:
+    local_root: "/var/local/volume1"
+    seccomp_sandbox: False

ansible/group_vars/NAS/nfs

@@ -13,6 +13,3 @@ nfs_exports:
     - "/var/local/volume1/CardDav {{nfs_cluster_list}}"
 
 
-vsftpd_config:
-    local_root: "/var/local/volume1"
-    seccomp_sandbox: False

ansible/group_vars/NAS/nomad

@@ -0,0 +1 @@
+nomad_node_class: 'NAS'

ansible/group_vars/cluster/nomad

@@ -0,0 +1 @@
+nomad_node_class: 'cluster'

ansible/group_vars/production

@@ -3,6 +3,9 @@ domain:
 consul_bootstrap_expect: 3
 consul_domain: "consul"
 nomad_bootstrap_expect: 3
+nomad_client_meta: 
+  - name: "env"
+    value: "production"
 vault_unseal_keys_dir_output: "~/vaultUnseal/production"
 env_default_nfs_path: "/volume2"
 env_media_nfs_path: "/volume1"

ansible/group_vars/staging

@@ -5,6 +5,10 @@ domain:
 consul_bootstrap_expect: 2
 consul_domain: "consul"
 nomad_bootstrap_expect: 2
+nomad_client_meta: 
+  - name: "env"
+    value: "staging"
+
 vault_unseal_keys_dir_output: "~/vaultUnseal/staging"
 hosts_entries:
     - ip: "{{ hostvars['nas-dev']['ansible_default_ipv4']['address'] }}"

ansible/playbooks/HashicorpStack.yml

@@ -5,18 +5,26 @@
     - role: ansible-hashicorp-vault
       become: true
   post_tasks:
+    - name: Reading root contents
+      ansible.builtin.command: cat "{{ vault_unseal_keys_dir_output }}/rootkey"
+      register: root_token
+      delegate_to: localhost
+      changed_when: false
+    - name: debug
+      ansible.builtin.debug:
+        var: root_token
     - name: Generate nomad token
       community.hashi_vault.vault_token_create:
         renewable: true
         policies: "nomad-server-policy"
         period: 72h
         no_parent: true
-        token: "{{ vault_init_parsed.root_token }}"
+        token: "{{ root_token.stdout }}"
         url: http://{{ ansible_default_ipv4.address }}:8200
         retries: 4
       run_once: true
       delegate_to: localhost
-      when: vault_init_parsed.root_token is defined
+      when: root_token.stdout is defined
       register: nomad_token_data
 
     - name: Gather nomad token

ansible/production

@@ -21,12 +21,18 @@ bleys
 [wireguard:children]
 production
 
+[NAS]
+nas
 
-
-[homelab]
+[cluster]
 oscar
-bleys
 gerard
+bleys
+
+
+[homelab:children]
+NAS
+cluster
 
 [VPS]
 corwin

ansible/staging

@@ -13,10 +13,17 @@ database_standby
 [wireguard:children]
 staging
 
-[homelab]
+[NAS]
+nas-dev
+
+[cluster]
 oscar-dev
 gerard-dev
 
+[homelab:children]
+NAS
+cluster
+
 [VPS]
 merlin-dev
 
@@ -25,8 +32,7 @@ homelab
 VPS
 staging
 
-[NAS]
-nas-dev
+
 
 [staging]
 oscar-dev

nomad-job/borgmatic.nomad

@@ -7,9 +7,9 @@ job "borgmatic" {
     forcedeploy = "0"
   }
   constraint {
-    attribute = "${node.unique.name}"
+    attribute = "${node.class}"
     operator = "set_contains"
-    value = "nas"
+    value = "NAS"
   }
 
   group "borgmatic"{
@@ -65,7 +65,8 @@ location:
     - /volume1/photo
 
     repositories:
-    - u304977@u304977.your-storagebox.de:backup_syno
+    - u304977@u304977.your-storagebox.de:{{if eq "production"  (env "meta.env") }}backup_hamelab{{else}}backup_homelab_dev{{end}}
+
     exclude_patterns:
         - '*/nomad/jellyfin/cache'
         - '*/loki/chunks'
@@ -207,6 +208,7 @@ consistency:
 {{end}}
           EOH
         destination = "secret/id_rsa"
+        perms= "700"
       }
       resources {
         memory = 300