Bluemedia/homelab
1
0
Fork 0
mirror of https://github.com/BluemediaGER/homelab.git synced 2024-09-07 19:36:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

Provisioning works now

Browse source
This commit is contained in:
Oliver Traber 2022-05-15 02:31:41 +02:00
parent c751a1e64d
commit 60df856435
Signed by: Bluemedia
GPG key ID: C0674B105057136C
16 changed files with 84 additions and 38 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
metal/README.md
View file

@ -3,4 +3,5 @@
- Download and extract Debian Bullseye netboot installer from the official repository.
- Render config files (PXE config, GRUB config, preseed files etc.) from their corresponding [templates](./roles/pxe-server/templates).
- Spin up an PXE environment (DHCP, TFTP and HTTP server) using Docker compose.
- Wake machines using WoL to install the OS via PXE. Machines will auto reboot into the finished preseeded OS after the installation is complete.
- Wake machines using WoL to install the OS via PXE. Machines will auto reboot into the finished preseeded OS after the installation is complete.
- Tear down the docker compose project for PXE.

3
metal/group_variables/all.yml
View file

@ -1,3 +0,0 @@
ansible_user: root
ansible_ssh_private_key_file: ~/.ssh/id_rsa
ssh_public_key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"

1
metal/group_vars/all/.gitignore vendored Normal file
View file

@ -0,0 +1 @@
vault.yml

14
metal/group_vars/all/all.yml Normal file
View file

@ -0,0 +1,14 @@
ansible_ssh_private_key_file: ~/.ssh/id_rsa
ssh_public_key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
# Network config
subnet: "192.168.6.0"
netmask: "255.255.255.0"
gateway: "192.168.6.1"
nameserver: "192.168.6.1"
domain: "lab.bluemedia.dev"
# User config from vault
user_fullname: "{{ vault_user_fullname }}"
ansible_user: "{{ vault_ansible_user }}"
ansible_become_password: "{{ vault_ansible_become_password }}"

4
metal/group_vars/all/vault.tmpl Normal file
View file

@ -0,0 +1,4 @@
# Copy this file to vault.yml, change the values below and encrypt it using ansible-vault.
vault_user_fullname: "Lab User"
vault_ansible_user: lab
vault_ansible_become_password: "insecure" # Become password will also be the users password.

8
metal/install-os.yml
View file

@ -7,4 +7,10 @@
hosts: metal
gather_facts: false
roles:
- wol-wake
- wol-wake
- name: Tear down PXE stack
hosts: localhost
gather_facts: false
roles:
- pxe-teardown

8
metal/inventories/lab.yml
View file

@ -2,9 +2,9 @@ metal:
children:
masters:
hosts:
lab-mini-1: {ansible_host: 192.168.1.21, mac: '4c:52:62:1c:bf:6c', disk: '/dev/nvme0n1'}
lab-mini-2: {ansible_host: 192.168.1.22, mac: '4c:52:62:0f:09:6d', disk: '/dev/nvme0n1'}
lab-mini-3: {ansible_host: 192.168.1.23, mac: '4c:52:62:0f:0a:23', disk: '/dev/nvme0n1'}
lab-mini-1: {ansible_host: 192.168.6.21, mac: '4c:52:62:1c:bf:6c', disk: '/dev/nvme0n1'}
lab-mini-2: {ansible_host: 192.168.6.22, mac: '4c:52:62:0f:09:6d', disk: '/dev/nvme0n1'}
lab-mini-3: {ansible_host: 192.168.6.23, mac: '4c:52:62:0f:0a:23', disk: '/dev/nvme0n1'}
workers:
hosts:
lab-mini-4: {ansible_host: 192.168.1.24, mac: '90:1b:0e:f8:e8:af', disk: '/dev/nvme0n1'}
lab-mini-4: {ansible_host: 192.168.6.24, mac: '90:1b:0e:f8:e8:af', disk: '/dev/nvme0n1'}

11
metal/roles/pxe-server/defaults/main.yml
View file

@ -1,11 +1,2 @@
os_download_url: "https://deb.debian.org/debian/dists/bullseye/main/installer-amd64/current/images/netboot/netboot.tar.gz"
os_download_checksum: "sha256:ec3b71964457f30a57061ea758c12394bf2b792b461c697e61cc2d47053c5878"
user_fullname: "Lab User"
username: "lab"
domain: "lab.bluemedia.dev"
subnet: "192.168.6.0"
netmask: "255.255.255.0"
gateway: "192.168.6.1"
nameserver: "192.168.6.1"
os_download_checksum: "sha256:ec3b71964457f30a57061ea758c12394bf2b792b461c697e61cc2d47053c5878"

16
metal/roles/pxe-server/files/docker-compose.yml
View file

@ -10,13 +10,15 @@ services:
build: ./tftp
network_mode: host
volumes:
- ./data/pxe-config/grub.cfg:/var/lib/tftpboot/grub.cfg
- ./data/os/debian-installer/amd64/grub:/var/lib/tftpboot/debian-installer/amd64/grub
- ./data/pxe-config/grub.cfg:/var/lib/tftpboot/debian-installer/amd64/grub/grub.cfg
- ./data/os/debian-installer/amd64/grubx64.efi:/var/lib/tftpboot/grubx64.efi
- ./data/os/debian-installer/amd64/initrd.gz:/var/lib/tftpboot/initrd.gz
- ./data/os/debian-installer/amd64/linux:/var/lib/tftpboot/linux
http:
image: nginx:latest
network_mode: host
volumes:
- ./data/os:/usr/share/nginx/html/os:ro
- ./data/preseed:/usr/share/nginx/html/preseed:ro
- ./data/preseed:/var/lib/tftpboot/preseed
#http:
# image: nginx:latest
# network_mode: host
# volumes:
# - ./data/os:/usr/share/nginx/html/os:ro
# - ./data/preseed:/usr/share/nginx/html/preseed:ro

1
metal/roles/pxe-server/tasks/main.yml
View file

@ -32,6 +32,7 @@
- name: Start PXE stack
docker_compose:
project_src: "{{ role_path }}/files"
project_name: "pxe"
state: present
restarted: true
build: true

9
metal/roles/pxe-server/templates/dhcpd.conf.j2
View file

@ -5,8 +5,17 @@ option pxelinux.pathprefix code 210 = text;
option pxelinux.reboottime code 211 = unsigned integer 32;
option architecture-type code 93 = unsigned integer 16;
{% for item in groups['metal'] %}
host {{ hostvars[item]['inventory_hostname'] }} {
hardware ethernet {{ hostvars[item]['mac'] }};
option host-name "{{ hostvars[item]['inventory_hostname'] }}";
}
{% endfor %}
subnet {{ subnet }} netmask {{ netmask }} {
option routers {{ gateway }};
option domain-name-servers {{ nameserver }};
option domain-name "{{ domain }}";
range {{ subnet | ansible.utils.ipmath(3) }} {{ subnet | ansible.utils.ipmath(254) }};
class "pxeclients" {

8
metal/roles/pxe-server/templates/grub.cfg.j2
View file

@ -2,9 +2,13 @@ set timeout=1
menuentry 'Auto install Debian Bullseye (PXE)' {
set background_color=black
set
linux linux \
vga=788 \
url=http://{{ ansible_default_ipv4.address }}/preseed/${net_default_mac}.conf \
--- auto quiet
auto=true \
url=tftp://{{ ansible_default_ipv4.address }}/preseed/${net_default_mac}.cfg \
priority=critical \
ipv6.disable=1 \
--- quiet
initrd initrd.gz
}

23
metal/roles/pxe-server/templates/preseed.cfg.j2
View file

@ -1,3 +1,4 @@
#_preseed_V1
# For documentation see: https://www.debian.org/releases/stable/example-preseed.txt
# Set default locale and keyboard layout
@ -7,6 +8,9 @@ d-i keyboard-configuration/xkb-keymap select {{ keyboard_layout | default('de')
# Set network interface used by default
d-i netcfg/choose_interface select auto
# Work around the problem that the network configuration is not applied, because the preseed file is loaded after it already completed. So we just run the network configuration again! :D
d-i preseed/early_command string kill-all-dhcp; netcfg
# Static network config
d-i netcfg/disable_autoconfig boolean true
d-i netcfg/dhcp_failed note
@ -40,9 +44,9 @@ d-i passwd/root-login boolean false
# Create new user
d-i passwd/user-fullname string {{ user_fullname | default('Debian User') }}
d-i passwd/username string {{ username | default('debian') }}
d-i passwd/user-password password {{ password | default('insecure') }}
d-i passwd/user-password-again password {{ password | default('insecure') }}
d-i passwd/username string {{ ansible_user | default('debian') }}
d-i passwd/user-password password {{ ansible_become_password | default('insecure') }}
d-i passwd/user-password-again password {{ ansible_become_password | default('insecure') }}
# Setup timezone and NTP server
d-i clock-setup/utc boolean true
@ -63,8 +67,7 @@ d-i apt-setup/cdrom/set-first boolean false
d-i apt-setup/disable-cdrom-entries boolean true
# Install openssh-server and basic system tools
d-i pkgsel/run_tasksel boolean false
d-i pkgsel/include string openssh-server build-essential
tasksel tasksel/first multiselect standard, ssh-server
d-i pkgsel/upgrade select safe-upgrade
# Disable package reporting
@ -74,5 +77,15 @@ popularity-contest popularity-contest/participate boolean false
d-i grub-installer/only_debian boolean true
d-i grub-installer/bootdev string {{ hostvars[item]['disk'] | default('/dev/sda') }}
# Configure openssh-server. Include public key, disable root login and passord based login.
d-i preseed/late_command string in-target mkdir -p /home/{{ ansible_user | default('debian') }}/.ssh/ ; \
in-target /bin/sh -c 'echo "{{ ssh_public_key }}" >> /home/{{ ansible_user | default('debian') }}/.ssh/authorized_keys' ; \
in-target chmod -R 700 /home/{{ ansible_user | default('debian') }}/.ssh/ ; \
in-target chown -R {{ ansible_user | default('debian') }}:{{ ansible_user | default('debian') }} /home/{{ ansible_user | default('debian') }}/.ssh/ ; \
in-target grep -q '^PermitRootLogin ' /etc/ssh/sshd_config || in-target sh -c 'echo "PermitRootLogin no" >> /etc/ssh/sshd_config' ; \
in-target sed 's/^PermitRootLogin .*/PermitRootLogin no/' -i /etc/ssh/sshd_config ; \
in-target grep -q '^PasswordAuthentication ' /etc/ssh/sshd_config || in-target sh -c 'echo "PasswordAuthentication no" >> /etc/ssh/sshd_config' ; \
in-target sed 's/^PasswordAuthentication .*/PasswordAuthentication no/' -i /etc/ssh/sshd_config
# Reboot to installed system without confirmation
d-i finish-install/reboot_in_progress note

5
metal/roles/pxe-teardown/tasks/main.yml Normal file
View file

@ -0,0 +1,5 @@
- name: Tear down PXE stack
docker_compose:
project_name: "pxe"
project_src: "{{ playbook_dir }}/roles/pxe-server/files/"
state: absent

6
scripts/pxe-log.sh
View file

@ -1,7 +1,7 @@
#!/bin/bash
docker-compose \
--project-directory ./metal/roles/pxe-server/files/ \
docker compose \
--project-name pxe \
logs \
--f \
--follow \
${@}

2
scripts/pxe-teardown.sh
View file

@ -1,2 +0,0 @@
#!/bin/bash
docker compose --project-directory metal/roles/pxe-server/files/ down