Add baldur playbook

inventory/baldur_production

@@ -0,0 +1,22 @@
+[all:vars]
+the_nine_worlds_production=true
+
+# --------------------------------------------------------------------------------------------------
+# Functionality.
+# --------------------------------------------------------------------------------------------------
+
+# Service running hosts.
+[asgard]
+baldur
+
+# Hosts with restic backups.
+[restic]
+baldur
+
+# --------------------------------------------------------------------------------------------------
+# Network.
+# --------------------------------------------------------------------------------------------------
+
+# Hosts remote to the home LAN.
+[remote]
+baldur

inventory/baldur_testing

@@ -0,0 +1,24 @@
+baldur ansible_host=baldur-virt
+
+[all:vars]
+the_nine_worlds_production=false
+
+# --------------------------------------------------------------------------------------------------
+# Functionality.
+# --------------------------------------------------------------------------------------------------
+
+# Service running hosts.
+[asgard]
+baldur
+
+# Hosts with restic backups.
+[restic]
+baldur
+
+# --------------------------------------------------------------------------------------------------
+# Network.
+# --------------------------------------------------------------------------------------------------
+
+# Hosts remote to the home LAN.
+[remote]
+baldur

inventory/host_vars/baldur/vars.yml

@@ -0,0 +1,32 @@
+---
+# --------------------------------------------------------------------------------------------------
+# system:base
+# --------------------------------------------------------------------------------------------------
+system_base_ssh_user: "{{ vault_system_base_ssh_user }}"
+
+# --------------------------------------------------------------------------------------------------
+# vpn
+# --------------------------------------------------------------------------------------------------
+vpn_subnet_id: 3
+
+# --------------------------------------------------------------------------------------------------
+# services
+# --------------------------------------------------------------------------------------------------
+services_hostname: "baldur"
+services_resolv_host: "baldur"
+
+services_host_services:
+  lrproxy:
+    address: "{{ vpn_bridge_prefix }}.2"
+    tcp: [80, 443]
+  database:
+    address: "{{ vpn_bridge_prefix }}.3"
+  cloud:
+    address: "{{ vpn_bridge_prefix }}.4"
+  git:
+    address: "{{ vpn_bridge_prefix }}.5"
+    tcp: ["{{ services.git.ssh_port }}"]
+  notes:
+    address: "{{ vpn_bridge_prefix }}.6"
+  www:
+    address: "{{ vpn_bridge_prefix }}.7"

playbooks/baldur.yml

@@ -0,0 +1,120 @@
+---
+- name: "all"
+  hosts: "all"
+
+  tasks:
+    - name: "block domains"
+      ansible.builtin.lineinfile:
+        path: "/etc/hosts"
+        line: "{{ address }} {{ item }}"
+      vars:
+        - address: "{{ hostvars[item.split('.')[0]].ansible_default_ipv4.address |
+                       default('127.0.0.1') }}"
+      loop: "{{ [system_mail_smtp_server | default([])] |
+                union( [vpn_wireguard_server_address | default([])] ) |
+                union( [services_backups_restic_aws_bucket_endpoint | default([])] ) |
+                flatten }}"
+      when: not (the_nine_worlds_production | bool)
+      tags: "always"
+
+- name: "baldur"
+  hosts: "baldur"
+  roles:
+    # ----------------------------------------------------------------------------------------------
+    # system
+    # ----------------------------------------------------------------------------------------------
+    - role: "system/base/nftables"
+      tags:
+        - "system:base"
+        - "system:base:nftables"
+    - role: "system/base/sshd"
+      tags:
+        - "system:base"
+        - "system:base:sshd"
+    - role: "system/base/ntp"
+      tags:
+        - "system:base"
+        - "system:base:ntp"
+    - role: "system/base/fail2ban"
+      tags:
+        - "system:base"
+        - "system:base:fail2ban"
+    - role: "system/base/utils"
+      tags:
+        - "system:base"
+        - "system:base:utils"
+    - role: "system/base/root"
+      tags:
+        - "system:base"
+        - "system:base:root"
+    - role: "system/base/user"
+      tags:
+        - "system:base"
+        - "system:base:user"
+
+    # ----------------------------------------------------------------------------------------------
+    # vpn
+    # ----------------------------------------------------------------------------------------------
+    - role: "vpn/base"
+      tags: "vpn:base"
+    - role: "vpn/bridge"
+      tags: "vpn:bridge"
+
+    # ----------------------------------------------------------------------------------------------
+    # backups
+    # ----------------------------------------------------------------------------------------------
+    - role: "backups/restic/setup"
+      tags: "backups:restic:setup"
+
+    # ----------------------------------------------------------------------------------------------
+    # services
+    # ----------------------------------------------------------------------------------------------
+    - role: "services/setup/system"
+      tags:
+        - "services:setup"
+        - "services:setup:system"
+
+  tasks:
+    - name: "setup : user"
+      ansible.builtin.include_role:
+        name: "services/setup/user"
+        apply:
+          tags:
+            - "services:{{ services_service_name }}"
+            - "services:setup"
+            - "services:setup:user"
+            - "services:setup:user:{{ services_service_name }}"
+            - "services:{{ services_service_name }}:setup:user"
+      loop: "{{ services_host_services | dict2items | map(attribute='key') }}"
+      loop_control:
+        loop_var: "services_service_name"
+      tags: "always"
+
+    - name: "deploy"
+      ansible.builtin.include_role:
+        name: "services/deploy/{{ services_service_name }}"
+        apply:
+          tags:
+            - "services:{{ services_service_name }}"
+            - "services:deploy"
+            - "services:deploy:{{ services_service_name }}"
+            - "services:{{ services_service_name }}:deploy"
+      loop: "{{ services_host_services | dict2items | map(attribute='key') }}"
+      loop_control:
+        loop_var: "services_service_name"
+      tags: "always"
+
+    - name: "backups : restic"
+      ansible.builtin.include_role:
+        name: "services/backups/restic"
+        apply:
+          tags:
+            - "services:{{ services_service_name }}"
+            - "services:backups"
+            - "services:backups:restic"
+            - "services:backups:restic:{{ services_service_name }}"
+            - "services:{{ services_service_name }}:backups:restic"
+      loop: "{{ services_host_services | dict2items | map(attribute='key') }}"
+      loop_control:
+        loop_var: "services_service_name"
+      tags: "always"