new files from source

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/base_users/tasks/main.yml

@@ -0,0 +1,15 @@
+---
+- name: Configure default home directory and shell for system users
+  block:
+    - name: Set default home directory and shell for system users
+      ansible.builtin.lineinfile:
+        path: /etc/default/useradd
+        regexp: "^{{ setting.key }}="
+        line: "{{ setting.key }}={{ setting.value }}"
+        create: yes
+        backup: yes
+      loop:
+        - { key: "HOME", value: "/nonexistent" }
+        - { key: "SHELL", value: "/sbin/nologin" }
+      loop_control:
+        loop_var: setting

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/disk_resize/tasks/main.yml

@@ -0,0 +1,28 @@
+- name: Expand disk and root filesystem
+  block:
+    - name: Attempt to grow partition (safe if already full)
+      command: growpart /dev/sda 2
+      register: growpart_result
+      ignore_errors: true
+
+    - name: Determine if partition actually grew
+      set_fact:
+        partition_grew: >-
+          {{ growpart_result.rc == 0 and
+             (growpart_result.stdout is defined and 'NOCHANGE' not in growpart_result.stdout) }}
+
+    - name: Resize LVM physical volume if needed
+      command: pvresize /dev/sda2
+      when: partition_grew
+      register: pvresize_result
+      changed_when: "'Physical volume' in pvresize_result.stdout and 'resized' in pvresize_result.stdout"
+
+    - name: Extend logical volume if needed
+      command: lvextend -l +100%FREE /dev/mapper/rocky-lv_root
+      when: partition_grew
+      register: lvextend_result
+      changed_when: lvextend_result.rc == 0 and "'0 extents found" not in lvextend_result.stderr
+
+    - name: Grow the XFS filesystem if needed
+      command: xfs_growfs /
+      when: partition_grew and (lvextend_result is changed or lvextend_result is not defined)

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/docker_gitlab_setup/defaults/main.yml

@@ -0,0 +1,23 @@
+---
+docker_old_root: "/var/lib/docker"
+docker_new_root_base: "/opt/docker/docker_data"
+docker_new_root: "{{ docker_new_root_base }}/docker"
+
+docker_volumes_dir: "/opt/docker/docker_volumes"
+docker_homelab_dir: "/opt/docker/homelab"
+
+docker_volumes_owner: "user"
+docker_volumes_group: "group"
+
+git_repo_url: "[email protected]:USER/REPO.git"
+git_repo_version: "main"
+
+ssh_key_path: "/home/USER/.ssh/id_rsa"
+git_repo_owner: "user"
+git_repo_group: "group"
+
+docker_daemon_conf: "/etc/docker/daemon.json"
+daemon_json_template: |
+  {
+    "data-root": "{{ docker_new_root }}"
+  }

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/docker_gitlab_setup/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart docker
+  service:
+    name: docker
+    state: restarted

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/docker_gitlab_setup/tasks/main.yml

@@ -0,0 +1,75 @@
+---
+# 1. Ensure SSH key exists so git clone works
+- name: Ensure .ssh directory exists
+  file:
+    path: "{{ ssh_key_path | dirname }}"
+    state: directory
+    owner: "user"
+    group: "user"
+    mode: "0700"
+
+- name: Ensure SSH key exists (don't overwrite)
+  copy:
+    src: "{{ ssh_key_path }}"
+    dest: "{{ ssh_key_path }}"
+    owner: "user"
+    group: "user"
+    mode: "0600"
+
+# 2. Ensure docker_data directory exists
+- name: Ensure new Docker data root base exists
+  file:
+    path: "{{ docker_new_root_base }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+# 3. Stop Docker ONLY if /var/lib/docker still exists
+- name: Stop Docker if old root exists
+  service:
+    name: docker
+    state: stopped
+  when: docker_old_root is exists
+
+# 4. Move /var/lib/docker → new location (idempotent)
+- name: Move Docker data root to new location
+  command: "mv {{ docker_old_root }} {{ docker_new_root }}"
+  args:
+    creates: "{{ docker_new_root }}"
+  when: docker_old_root is exists
+
+# 5. Ensure daemon.json points to new data-root
+- name: Configure Docker daemon.json
+  copy:
+    dest: "{{ docker_daemon_conf }}"
+    content: "{{ daemon_json_template }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart docker
+
+# 6. Ensure docker_volumes exists
+- name: Ensure docker_volumes directory exists
+  file:
+    path: "{{ docker_volumes_dir }}"
+    state: directory
+    owner: "{{ docker_volumes_owner }}"
+    group: "{{ docker_volumes_group }}"
+    mode: "0755"
+
+# 7. Ensure homelab directory exists
+- name: Ensure homelab directory exists
+  file:
+    path: "{{ docker_homelab_dir }}"
+    state: directory
+    owner: "{{ git_repo_owner }}"
+    group: "{{ git_repo_group }}"
+    mode: "0755"
+
+# 8. Start Docker if it was stopped
+- name: Start Docker
+  service:
+    name: docker
+    state: started
+  when: docker_new_root is exists

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/endlessh/defaults/main.yml

@@ -0,0 +1,4 @@
+---
+endlessh_port: 22
+endlessh_repo: https://github.com/skeeto/endlessh.git
+endlessh_clone_path: /usr/local/src/endlessh

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/endlessh/tasks/main.yml

@@ -0,0 +1,67 @@
+---
+- name: Ensure endlessh group exists
+  ansible.builtin.group:
+    name: endlessh
+    system: true
+
+- name: Ensure endlessh user exists
+  ansible.builtin.user:
+    name: endlessh
+    group: endlessh
+    system: true
+    shell: /usr/sbin/nologin
+    create_home: false
+
+- name: Ensure Endlessh repo is cloned and updated
+  ansible.builtin.git:
+    repo: "{{ endlessh_repo }}"
+    dest: "{{ endlessh_clone_path }}"
+    version: master
+    update: yes
+  register: git_result
+
+- name: Build Endlessh if repo was updated
+  ansible.builtin.command: make
+  args:
+    chdir: "{{ endlessh_clone_path }}"
+  when: git_result.after != git_result.before
+  register: make_result
+  # no changed_when needed; we'll rely on the copy step to track changes
+
+- name: Copy Endlessh binary to /usr/local/bin if updated
+  ansible.builtin.copy:
+    src: "{{ endlessh_clone_path }}/endlessh"
+    dest: /usr/local/bin/endlessh
+    mode: "0755"
+    remote_src: true
+  when: git_result.after != git_result.before
+  register: copy_result
+
+- name: Create Endlessh config directory
+  ansible.builtin.file:
+    path: /etc/endlessh
+    state: directory
+    mode: "0755"
+
+- name: Deploy Endlessh config
+  ansible.builtin.template:
+    src: endlessh_config.j2
+    dest: /etc/endlessh/config
+    mode: "0644"
+
+- name: Deploy Endlessh systemd service
+  ansible.builtin.template:
+    src: endlessh.service.j2
+    dest: /etc/systemd/system/endlessh.service
+    mode: "0644"
+
+- name: Reload systemd daemon
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Restart Endlessh if binary updated
+  ansible.builtin.systemd:
+    name: endlessh
+    enabled: true
+    state: restarted
+  when: copy_result is changed

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/endlessh/templates/endlessh.service.j2

@@ -0,0 +1,20 @@
+[Unit]
+Description=Endlessh SSH Tarpit
+After=network.target
+
+[Service]
+ExecStart=/usr/local/bin/endlessh -f /etc/endlessh/config
+Restart=always
+User=endlessh
+Group=endlessh
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+NoNewPrivileges=true
+ProtectSystem=full
+ProtectHome=true
+PrivateTmp=true
+RestrictAddressFamilies=AF_INET AF_INET6
+ReadWritePaths=/etc/endlessh
+LockPersonality=true
+
+[Install]
+WantedBy=multi-user.target

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/endlessh/templates/endlessh_config.j2

@@ -0,0 +1,5 @@
+Port {{ endlessh_port }}
+Delay 10000
+MaxLineLength 32
+MaxClients 4096
+LogLevel 1

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/firewall_ssh/defaults/main.yml

@@ -0,0 +1,4 @@
+---
+# Customize if needed; this defaults to port 22 for endlessh
+endlessh_port: 22
+# The SSH port will be dynamically computed as: 10000 + (vmid % 100)

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/firewall_ssh/tasks/main.yml

@@ -0,0 +1,69 @@
+---
+- name: Configure firewall and SSH port
+  block:
+    - name: Fail if vmid is not defined
+      ansible.builtin.fail:
+        msg: "'vmid' must be defined to calculate dynamic SSH port"
+      when: vmid is not defined
+
+    - name: Calculate SSH port from vmid
+      ansible.builtin.set_fact:
+        ssh_port: "{{ 10000 + (vmid | int % 100) }}"
+
+    - name: Enable and start firewalld
+      ansible.builtin.service:
+        name: firewalld
+        state: started
+        enabled: true
+
+    - name: Set firewalld default zone to drop
+      ansible.posix.firewalld:
+        zone: public
+        state: enabled
+        permanent: yes
+        target: DROP
+
+    - name: Reload firewalld to apply permanent changes
+      ansible.builtin.command: firewall-cmd --reload
+
+    - name: Allow custom SSH port in firewalld
+      ansible.posix.firewalld:
+        port: "{{ ssh_port }}/tcp"
+        permanent: true
+        state: enabled
+        immediate: true
+
+    - name: Allow Endlessh port in firewalld
+      ansible.posix.firewalld:
+        port: "{{ endlessh_port }}/tcp"
+        permanent: true
+        state: enabled
+        immediate: true
+
+    - name: Ensure custom SSH port is set in sshd_config
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?Port\s+'
+        line: "Port {{ ssh_port }}"
+        backup: yes
+        validate: "/usr/sbin/sshd -T -f %s"
+      register: sshd_config_changed
+
+    - name: Gather SELinux facts
+      ansible.builtin.setup:
+        filter: ansible_selinux
+
+    - name: Allow SSH to use custom port in SELinux
+      ansible.builtin.command: >
+        semanage port -a -t ssh_port_t -p tcp {{ ssh_port }}
+      register: semanage_result
+      failed_when: semanage_result.rc not in [0, 1]
+      changed_when: semanage_result.rc == 0
+      when: ansible_selinux.status == "enabled"
+
+    - name: Restart and enable sshd service if needed
+      ansible.builtin.service:
+        name: sshd
+        state: restarted
+        enabled: true
+      when: sshd_config_changed is changed

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/hostname_network/tasks/main.yml

@@ -0,0 +1,29 @@
+---
+- name: Set hostname and update /etc/hosts
+  vars:
+    default_domain: subdomain.domain
+  block:
+    - name: Set hostname fact
+      ansible.builtin.set_fact:
+        short_hostname: "{{ vm_name }}"
+        custom_hostname: "{{ vm_name }}.{{ default_domain }}"
+
+    - name: Set system hostname
+      ansible.builtin.hostname:
+        name: "{{ custom_hostname }}"
+
+    - name: Ensure /etc/hosts contains loopback entry for hostname
+      ansible.builtin.lineinfile:
+        path: /etc/hosts
+        regexp: '^127\.0\.1\.1\s+'
+        line: "127.0.1.1 {{ custom_hostname }} {{ short_hostname }}"
+        state: present
+        create: yes
+
+    - name: Ensure /etc/hosts contains primary network IP entry
+      ansible.builtin.lineinfile:
+        path: /etc/hosts
+        regexp: '^{{ ip }}\s+'
+        line: "{{ ip }} {{ custom_hostname }} {{ short_hostname }}"
+        state: present
+        create: yes

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/packages/defaults/main.yml

@@ -0,0 +1,10 @@
+---
+base_packages:
+  - firewalld
+  - policycoreutils-python-utils
+  - git
+  - make
+  - gcc
+  - cloud-utils-growpart
+  - lvm2
+  - xfsprogs

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/packages/tasks/main.yml

@@ -0,0 +1,32 @@
+---
+- name: Package management tasks
+  tags: [packages]
+  block:
+    - name: Clean all cached metadata
+      ansible.builtin.command: dnf clean all
+      become: true
+
+    - name: Rebuild the DNF cache
+      ansible.builtin.command: dnf makecache
+      become: true
+
+    - name: Update all packages to latest
+      ansible.builtin.dnf:
+        name: "*"
+        state: latest
+        update_cache: true
+      become: true
+
+    - name: Reboot if kernel was upgraded
+      ansible.builtin.reboot:
+        reboot_timeout: 120
+        pre_reboot_delay: 10
+      when: ansible_facts.packages['kernel'] is defined
+      become: true
+
+    - name: Install base system packages
+      ansible.builtin.package:
+        name: "{{ base_packages }}"
+        state: present
+        update_cache: true
+      become: true

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/portainer_agent/tasks/main.yml

@@ -0,0 +1,39 @@
+---
+- name: Set Portainer Agent installation directory
+  vars:
+    portainer_agent_dir: /opt/portainer-agent
+  block:
+    - name: Create Portainer Agent directory
+      become: true
+      ansible.builtin.file:
+        path: "{{ portainer_agent_dir }}"
+        state: directory
+        owner: user
+        group: user
+        mode: "0755"
+
+    - name: Create Portainer Agent docker-compose file
+      become: true
+      ansible.builtin.copy:
+        dest: "{{ portainer_agent_dir }}/docker-compose.yml"
+        owner: user
+        group: user
+        mode: "0644"
+        content: |
+          services:
+            agent:
+              image: portainer/agent:latest
+              container_name: portainer_agent
+              restart: always
+              ports:
+                - "9001:9001"
+              volumes:
+                - /var/run/docker.sock:/var/run/docker.sock
+                - /var/lib/docker/volumes:/var/lib/docker/volumes
+
+    - name: Ensure Portainer Agent is running
+      become: true
+      community.docker.docker_compose_v2:
+        project_src: "{{ portainer_agent_dir }}"
+        state: present # ensures containers exist
+        recreate: always # recreates if the definition changed

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/root_password/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+root_password_plain: "{{ lookup('env', 'ROOT_PASSWORD') }}"

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/root_password/tasks/main.yml

@@ -0,0 +1,16 @@
+---
+- name: Set root password
+  block:
+    - name: Fail if root password is not defined
+      fail:
+        msg: "The variable 'root_password_plain' must be provided (e.g., via GitLab CI/CD Variable)"
+      when: root_password_plain is not defined
+
+    - name: Generate root password hash
+      set_fact:
+        root_password_hash: "{{ root_password_plain | password_hash('sha512') }}"
+
+    - name: Set root user password
+      user:
+        name: root
+        password: "{{ root_password_hash }}"

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/zsh_custom/tasks/main.yml

@@ -0,0 +1,82 @@
+---
+- name: Customize Zsh for users
+  vars:
+    zsh_users:
+      - user
+
+  block:
+    - name: Ensure parent home directory exists (safety)
+      ansible.builtin.file:
+        path: "/home/{{ user }}"
+        state: directory
+        owner: "{{ user }}"
+        group: "{{ user }}"
+        mode: "0755"
+      loop: "{{ zsh_users }}"
+      loop_control:
+        loop_var: user
+      become: true
+
+    - name: Remove any old oh-my-zsh
+      ansible.builtin.file:
+        path: "/home/{{ user }}/.oh-my-zsh"
+        state: absent
+      loop: "{{ zsh_users }}"
+      loop_control:
+        loop_var: user
+      become: true
+
+    - name: Clone Oh My Zsh as root
+      ansible.builtin.git:
+        repo: "https://github.com/ohmyzsh/ohmyzsh.git"
+        dest: "/home/{{ user }}/.oh-my-zsh"
+        version: master
+        update: yes
+        force: yes
+      loop: "{{ zsh_users }}"
+      loop_control:
+        loop_var: user
+      become: true
+
+    - name: Add trusted safe.directory system-wide for Oh My Zsh
+      ansible.builtin.command:
+        cmd: git config --system --add safe.directory /home/{{ user }}/.oh-my-zsh
+      loop: "{{ zsh_users }}"
+      loop_control:
+        loop_var: user
+      become: true
+
+    - name: Install syntax-highlighting plugin
+      ansible.builtin.git:
+        repo: "https://github.com/zsh-users/zsh-syntax-highlighting.git"
+        dest: "/home/{{ user }}/.oh-my-zsh/custom/plugins/zsh-syntax-highlighting"
+        version: master
+        update: yes
+        force: yes
+      loop: "{{ zsh_users }}"
+      loop_control:
+        loop_var: user
+      become: true
+
+    - name: Deploy customized .zshrc
+      ansible.builtin.template:
+        src: zshrc.j2
+        dest: "/home/{{ user }}/.zshrc"
+        owner: "{{ user }}"
+        group: "{{ user }}"
+        mode: "0644"
+      loop: "{{ zsh_users }}"
+      loop_control:
+        loop_var: user
+      become: true
+
+    - name: Fix ownership recursively for Oh My Zsh directory
+      ansible.builtin.file:
+        path: "/home/{{ user }}/.oh-my-zsh"
+        owner: "{{ user }}"
+        group: "{{ user }}"
+        recurse: yes
+      loop: "{{ zsh_users }}"
+      loop_control:
+        loop_var: user
+      become: true

Infrastrucutre as Code/Ansible/roles/bootstrap_roles/zsh_custom/templates/zshrc.j2

@@ -0,0 +1,21 @@
+export ZSH="\$HOME/.oh-my-zsh"
+ZSH_THEME="robbyrussell"
+plugins=(git zsh-autosuggestions zsh-syntax-highlighting)
+source \$ZSH/oh-my-zsh.sh
+
+# Where to save history and how much to keep
+HISTFILE=~/.zsh_history
+HISTSIZE=10000       # In-memory history
+SAVEHIST=10000       # Lines to save to file
+
+# Recommended options
+setopt APPEND_HISTORY             # Don’t overwrite history file; append to it
+setopt SHARE_HISTORY              # Share history across all sessions
+setopt HIST_IGNORE_DUPS           # Don’t record duplicate commands
+setopt HIST_IGNORE_SPACE          # Ignore commands starting with a space
+setopt HIST_VERIFY                # Edit a command before running from history
+setopt INC_APPEND_HISTORY         # Write history incrementally as commands are run
+
+
+PS1='%F{51}%n%F{255}@%F{227}%m %F{84}%~%f %F{15}$ '
+fastfetch