59 lines
1.6 KiB
YAML
59 lines
1.6 KiB
YAML
---
|
|
- name: Install sandbox base packages
|
|
ansible.builtin.apt:
|
|
name: "{{ sandbox_base_packages }}"
|
|
state: present
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
|
|
- name: Fetch the homelab internal CA
|
|
ansible.builtin.uri:
|
|
url: "{{ sandbox_internal_ca_url }}"
|
|
return_content: true
|
|
validate_certs: true
|
|
register: sandbox_internal_ca
|
|
changed_when: false
|
|
retries: 3
|
|
delay: 5
|
|
until: sandbox_internal_ca is succeeded
|
|
|
|
- name: Validate the homelab internal CA response
|
|
ansible.builtin.assert:
|
|
that:
|
|
- "'BEGIN CERTIFICATE' in sandbox_internal_ca.content"
|
|
fail_msg: OpenBao did not return a PEM certificate
|
|
quiet: true
|
|
|
|
- name: Install the homelab internal CA
|
|
ansible.builtin.copy:
|
|
dest: /usr/local/share/ca-certificates/ddupan-internal-ca.crt
|
|
content: "{{ sandbox_internal_ca.content }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Update sandbox CA certificates
|
|
|
|
- name: Enable the SSH service
|
|
ansible.builtin.service:
|
|
name: ssh
|
|
enabled: true
|
|
state: started
|
|
|
|
# LXC does not expose the host kernel log device. Kubelet only needs a writable
|
|
# kmsg-compatible character device, and the container console is the established
|
|
# LXC mapping for this purpose. tmpfiles recreates the link after every boot.
|
|
- name: Persist the LXC kubelet kmsg mapping
|
|
ansible.builtin.copy:
|
|
dest: /etc/tmpfiles.d/kmsg.conf
|
|
content: "L+ /dev/kmsg - - - - /dev/console\n"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Expose the LXC console as kmsg
|
|
ansible.builtin.file:
|
|
src: /dev/console
|
|
dest: /dev/kmsg
|
|
state: link
|
|
force: true
|