Dan V
deb6c38d7b
- Add .gitignore: exclude compiled binaries, build artifacts, and Helm values files containing real secrets (authentik, prometheus) - Add all Kubernetes deployment manifests (deployment/) - Add services source code: ha-sync, device-inventory, games-console, paperclip, parts-inventory - Add Ansible orchestration: playbooks, roles, inventory, cloud-init - Add hardware specs, execution plans, scripts, HOMELAB.md - Add skills/homelab/SKILL.md + skills/install.sh to preserve Copilot skill - Remove previously-tracked inventory-cli binary from git index Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
133 lines
3.6 KiB
Markdown
133 lines
3.6 KiB
Markdown
# Homelab SSH Orchestration (Ansible)
|
|
|
|
This setup gives you a **centralized, SSH-managed orchestration engine** for your homelab.
|
|
|
|
Control plane expectation: run Ansible from a dedicated Proxmox VM (`ansible-control`), not from your laptop.
|
|
|
|
## Why this stack
|
|
- Agentless (no daemon required on targets)
|
|
- Centrally managed from one control node
|
|
- Native SSH workflow (fits your existing key-based access)
|
|
|
|
## Layout
|
|
- `ansible.cfg` - controller defaults
|
|
- `inventory/hosts.yml` - your homelab hosts and groups
|
|
- `group_vars/all.yml` - common variables (key path, packages, timezone)
|
|
- `playbooks/ping.yml` - connectivity validation
|
|
- `playbooks/baseline.yml` - baseline hardening and package setup
|
|
|
|
## 1) Bootstrap control node
|
|
From this directory on the control node:
|
|
|
|
```bash
|
|
cd /Users/dan/work/homelab/orchestration/ansible
|
|
./scripts/bootstrap-control-node.sh
|
|
```
|
|
|
|
If needed, add local Python bin to PATH (script prints the exact line).
|
|
|
|
## 0) Create dedicated control VM in Proxmox
|
|
|
|
From any machine that can SSH to Proxmox root:
|
|
|
|
```bash
|
|
cd /Users/dan/work/homelab/orchestration/ansible
|
|
chmod +x scripts/create-ansible-control-vm.sh
|
|
./scripts/create-ansible-control-vm.sh
|
|
```
|
|
|
|
This creates `ansible-control` (VMID `105`) on `192.168.2.193` using Ubuntu 24.04 ISO.
|
|
|
|
After Ubuntu install in Proxmox console, ensure:
|
|
- static IP is `192.168.2.105`
|
|
- SSH key login works for user `dan`
|
|
- `sudo` is available for `dan`
|
|
|
|
## 0.5) Establish Proxmox cloud-init SSH key baseline
|
|
|
|
Goal: ensure a predefined key set is injected by cloud-init for Linux VMs.
|
|
|
|
1. Put your public keys (one per line) in:
|
|
- `cloud-init/authorized_keys`
|
|
2. Run setup:
|
|
|
|
```bash
|
|
cd /Users/dan/work/homelab/orchestration/ansible
|
|
chmod +x scripts/proxmox-cloudinit-setup.sh
|
|
./scripts/proxmox-cloudinit-setup.sh
|
|
```
|
|
|
|
Defaults:
|
|
- Proxmox host: `root@192.168.2.193`
|
|
- VM targets: `100 102 103 104 105`
|
|
- Cloud-init user: `dan`
|
|
|
|
Override example:
|
|
|
|
```bash
|
|
VMIDS="100 104 105" CI_USER="dan" ./scripts/proxmox-cloudinit-setup.sh
|
|
```
|
|
|
|
Notes:
|
|
- Windows guests are skipped automatically.
|
|
- For existing Linux guests, cloud-init changes typically take effect after reboot.
|
|
|
|
## 2) Validate SSH orchestration
|
|
|
|
```bash
|
|
ansible --version
|
|
ansible-inventory --graph
|
|
ansible all -m ping
|
|
ansible-playbook playbooks/ping.yml
|
|
```
|
|
|
|
## 3) Apply baseline config
|
|
|
|
```bash
|
|
ansible-playbook playbooks/baseline.yml
|
|
```
|
|
|
|
## 4) Run targeted orchestration examples
|
|
|
|
```bash
|
|
# Reboot only workers
|
|
ansible workers -a "sudo reboot" -f 2
|
|
|
|
# Update package metadata everywhere except proxmox host
|
|
ansible 'all:!proxmox' -m apt -a "update_cache=true" -b
|
|
|
|
# Check uptime of control-plane nodes
|
|
ansible control_plane -a "uptime"
|
|
```
|
|
|
|
## 5) Deploy/redeploy Paperclip on openclaw
|
|
|
|
Playbook:
|
|
|
|
```bash
|
|
ansible-playbook playbooks/paperclip-openclaw.yml -l openclaw
|
|
```
|
|
|
|
One-command helper (from this directory):
|
|
|
|
```bash
|
|
chmod +x scripts/deploy-paperclip-openclaw.sh
|
|
./scripts/deploy-paperclip-openclaw.sh
|
|
```
|
|
|
|
Post-deploy quick checks:
|
|
|
|
```bash
|
|
ansible openclaw -m shell -a "systemctl is-enabled paperclip; systemctl is-active paperclip; ss -lntp | grep 3100"
|
|
curl -sS http://192.168.2.88:3100/api/health
|
|
```
|
|
|
|
## Notes
|
|
- Inventory includes your known hosts:
|
|
- `kube-node-1` (`192.168.2.100`, user `dan`)
|
|
- `kube-node-2` (`192.168.2.195`, user `dan`)
|
|
- `kube-node-3` (`192.168.2.196`, user `dan`)
|
|
- `kube-arbiter` (`192.168.2.200`, user `dan`)
|
|
- `hp-proliant-proxmox` (`192.168.2.193`, user `root`)
|
|
- Proxmox is split into its own group to avoid accidentally running Linux baseline hardening tasks against it.
|
|
- If a host uses a different key path, override `ansible_ssh_private_key_file` in inventory host vars.
|