pluto
b9be45dc71
Complete IaC covering: - 14 roles: common, docker, traefik, vaultwarden, monitoring, media, matrix, home_assistant, frigate, adguard, gitea, semaphore, openclaw, security, backup - Inventory for all hosts (Peggy, Bart, Yoda, NAS, Firewalla) - Stack playbooks: core-infrastructure, monitoring, media, communication, automation, smarthome, security-hardening - Maintenance playbooks: update-containers, backup, health-check - Production Docker Compose templates with Traefik labels - Security hardening (sysctl, auditd, UFW, fail2ban) - Automated backups with retention policy
81 lines
2.6 KiB
Markdown
81 lines
2.6 KiB
Markdown
# Ansible Homelab - hobbs.farm
|
|
|
|
Infrastructure-as-Code for the hobbs.farm homelab environment.
|
|
|
|
## Architecture
|
|
|
|
| Host | IP | Role | OS |
|
|
|------|-----|------|-----|
|
|
| Peggy | 192.168.86.45 | Primary Docker host (48+ containers) | Ubuntu 24.04 |
|
|
| Bart | 192.168.86.181 | Frigate NVR | Ubuntu |
|
|
| Yoda | 192.168.86.31 | BlueIris NVR | Windows |
|
|
| NAS | 192.168.86.30 | 16TB storage (SMB/NFS) | Synology |
|
|
| Firewalla | 192.168.86.1 | Gateway / Firewall | Firewalla |
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
# Install Galaxy requirements
|
|
ansible-galaxy install -r requirements.yml
|
|
|
|
# Test connectivity
|
|
ansible all -m ping
|
|
|
|
# Full deployment
|
|
ansible-playbook playbooks/site.yml
|
|
|
|
# Deploy specific stack
|
|
ansible-playbook playbooks/core-infrastructure.yml
|
|
ansible-playbook playbooks/monitoring.yml
|
|
ansible-playbook playbooks/media.yml
|
|
|
|
# Maintenance
|
|
ansible-playbook playbooks/maintenance/health-check.yml
|
|
ansible-playbook playbooks/maintenance/update-containers.yml
|
|
ansible-playbook playbooks/maintenance/backup.yml
|
|
```
|
|
|
|
## Tags
|
|
|
|
All playbooks support selective execution via tags:
|
|
|
|
```bash
|
|
ansible-playbook playbooks/site.yml --tags traefik
|
|
ansible-playbook playbooks/site.yml --tags monitoring
|
|
ansible-playbook playbooks/site.yml --tags media
|
|
```
|
|
|
|
Available tags: `common`, `docker`, `traefik`, `vaultwarden`, `monitoring`, `grafana`, `prometheus`, `alertmanager`, `media`, `jellyfin`, `sonarr`, `radarr`, `matrix`, `homeassistant`, `esphome`, `frigate`, `adguard`, `gitea`, `semaphore`, `openclaw`, `security`, `backup`
|
|
|
|
## Vault
|
|
|
|
Sensitive variables are referenced via `vault_` prefix and should be stored in an encrypted vault file:
|
|
|
|
```bash
|
|
ansible-vault create inventory/group_vars/vault.yml
|
|
ansible-vault edit inventory/group_vars/vault.yml
|
|
```
|
|
|
|
Required vault variables:
|
|
- `vault_acme_email` - Let's Encrypt email
|
|
- `vault_cloudflare_api_token` - Cloudflare DNS API token
|
|
- `vault_grafana_admin_password` - Grafana admin password
|
|
- `vault_vaultwarden_admin_token` - Vaultwarden admin token
|
|
- `vault_matrix_shared_secret` - Matrix Synapse registration secret
|
|
- `vault_smtp_host` - SMTP relay host
|
|
- `vault_slack_webhook` - Slack/Discord webhook for alerts
|
|
- `vault_gitea_db_password` - Gitea PostgreSQL password
|
|
- `vault_semaphore_db_password` - Semaphore DB password
|
|
- `vault_nas_smb_password` - NAS SMB credentials
|
|
|
|
## Directory Structure
|
|
|
|
```
|
|
├── ansible.cfg # Ansible configuration
|
|
├── requirements.yml # Galaxy dependencies
|
|
├── inventory/ # Hosts and variables
|
|
├── playbooks/ # Orchestration playbooks
|
|
│ └── maintenance/ # Maintenance tasks
|
|
└── roles/ # Reusable roles
|
|
```
|