Initial Lab Setup

2026-07-06 16:45:51 +02:00
commit 05184d778d
52 changed files with 2526 additions and 0 deletions
@@ -0,0 +1,200 @@
+---
+
+# FIX: InfluxData GPG Key Rotation (Required for Debian Trixie/sqv)
+- name: InfluxData GPG Key Repair
+  become: true
+  tags: [maintenance, setup]
+  block:
+    - name: Remove known bad/expired Influx list files
+      ansible.builtin.file:
+        path: "/etc/apt/sources.list.d/{{ item }}"
+        state: absent
+      loop:
+        - repos_influxdata_com_debian.list
+        - influxdb.list
+
+    - name: Download the 2026-valid InfluxData archive key
+      ansible.builtin.get_url:
+        url: https://repos.influxdata.com/influxdata-archive.key
+        dest: /tmp/influxdata-archive.key
+        mode: '0644'
+
+    - name: Dearmor key for sqv (Sequoia-PGP) compatibility
+      ansible.builtin.shell: |
+        cat /tmp/influxdata-archive.key | gpg --dearmor > /usr/share/keyrings/influxdata-archive.gpg
+      args:
+        creates: /usr/share/keyrings/influxdata-archive.gpg
+
+    - name: Write clean InfluxData source list with signed-by flag
+      ansible.builtin.copy:
+        dest: /etc/apt/sources.list.d/influxdata.list
+        content: "deb [signed-by=/usr/share/keyrings/influxdata-archive.gpg] https://repos.influxdata.com/debian stable main"
+        mode: '0644'
+
+
+- name: Ensure Proxmox GPG key is present (for Raspberry Pi/PBS)
+  ansible.builtin.get_url:
+    url: https://enterprise.proxmox.com/debian/proxmox-release-trixie.gpg
+    dest: /etc/apt/trusted.gpg.d/proxmox-release-trixie.gpg
+    mode: '0644'
+  become: yes
+  when: ansible_distribution == 'Debian'
+  tags: [setup]
+
+- name: Set hostname
+  ansible.builtin.hostname:
+    name: "{{ inventory_hostname }}"
+  become: yes
+  tags: [identity]
+
+- name: Update /etc/hosts for FQDN resolution
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    regexp: '^127\.0\.1\.1'
+    line: "127.0.1.1 {{ inventory_hostname }}.{{ domain_name }} {{ inventory_hostname }}"
+  become: yes
+  tags: [identity]
+
+- name: Check for NetworkManager
+  ansible.builtin.command: systemctl is-active NetworkManager
+  register: nm_status
+  failed_when: false
+  changed_when: false
+  tags: [identity, network]
+
+- name: Configure NetworkManager Search Domain (Raspberry Pi/mDNS Style)
+  when: nm_status.rc == 0
+  tags: [identity, network]
+  block:
+    - name: Get active connection name
+      ansible.builtin.shell: "nmcli -t -f NAME connection show --active | head -n 1"
+      register: active_conn
+      changed_when: false
+
+    - name: Apply search domain via nmcli
+      ansible.builtin.command: "nmcli connection modify '{{ active_conn.stdout }}' ipv4.dns-search '{{ domain_name }}'"
+      when: active_conn.stdout != ""
+      notify: Reload NetworkManager
+
+- name: Configure systemd-resolved Search Domain (Vanilla Debian Style)
+  ansible.builtin.ini_file:
+    path: /etc/systemd/resolved.conf
+    section: Resolve
+    option: Domains
+    value: "{{ domain_name }}"
+  become: yes
+  notify: Restart systemd-resolved
+  when: nm_status.rc != 0
+  tags: [identity, network]
+
+- name: Ensure the terminal is always functional
+  ansible.builtin.lineinfile:
+    path: /etc/profile
+    line: 'export TERM=xterm-256color'
+    state: present
+  become: yes
+
+- name: Set system timezone
+  community.general.timezone:
+    name: Europe/Berlin
+  become: yes
+  tags: [localization]
+
+- name: Generate required locales
+  ansible.builtin.locale_gen:
+    name: "{{ item }}"
+    state: present
+  become: yes
+  loop:
+    - en_US.UTF-8
+    - en_DK.UTF-8  # Required for the 24h clock format
+  tags: [localization]
+
+- name: Force system-wide locale and 24h clock
+  ansible.builtin.command: update-locale LANG=en_US.UTF-8 LC_TIME=en_DK.UTF-8
+  become: yes
+  changed_when: true
+  tags: [localization]
+
+- name: Flush handlers to apply DNS changes immediately
+  ansible.builtin.meta: flush_handlers
+
+- name: Wait for DNS to be functional
+  ansible.builtin.command: getent hosts google.com
+  register: dns_check
+  until: dns_check.rc == 0
+  retries: 3
+  delay: 5
+  changed_when: false
+  tags: [identity, network]
+
+- name: Install baseline packages (Unified list)
+  ansible.builtin.apt:
+    name: "{{ common_packages }}"
+    state: present
+    update_cache: yes
+    cache_valid_time: 3600
+  become: yes
+  tags: [packages]
+
+- name: Install fastfetch (Optional - may not be in legacy repos)
+  ansible.builtin.apt:
+    name:
+      - fastfetch
+      - btm
+    state: present
+  become: yes
+  ignore_errors: yes
+  tags: [packages]
+
+- name: Configure needrestart for non-interactive automation
+  ansible.builtin.lineinfile:
+    path: /etc/needrestart/needrestart.conf
+    regexp: '^#?\$nrconf{restart}'
+    line: "$nrconf{restart} = 'a';"
+  become: yes
+  tags: [packages, config]
+
+- name: Ensure discovery services are enabled and running
+  ansible.builtin.service:
+    name: "{{ item }}"
+    state: started
+    enabled: yes
+  loop:
+    - avahi-daemon
+    - lldpd
+  become: yes
+  tags: [services]
+
+- name: Include maintenance tasks
+  ansible.builtin.include_tasks: maintenance.yml
+  tags: [maintenance]
+
+- name: Ensure console getty is running (for Proxmox WebUI access)
+  ansible.builtin.systemd:
+    name: getty@tty1.service
+    state: started
+    enabled: yes
+  become: yes
+  tags: [services, setup]
+
+- name: Ensure Node Exporter is running for monitoring
+  ansible.builtin.systemd:
+    name: prometheus-node-exporter
+    state: started
+    enabled: yes
+  become: yes
+  tags: [monitoring, services]
+
+
+- name: Fix Vim mouse behavior for easy copy-paste
+  ansible.builtin.copy:
+    dest: /etc/vim/vimrc.local
+    content: |
+      set mouse=
+      syntax on
+      set number
+    owner: root
+    group: root
+    mode: '0644'
+  become: yes