mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-11-01 03:21:02 +00:00
Rasmus "Pez" Wejlgaard
08f7b7276d
* Re-enable london-b's third-party apt repos from Ansible The lunar -> noble upgrade disabled every third-party repo on london-b, so tailscale, jellyfin and plex have been frozen since. The common role can now manage deb822 repos and clean up stale source/keyring files per host, and london-b uses it for tailscale, jellyfin and plex (now on repo.plex.tv with the v2 key). The dead sonarr v3, mono, nvidia, datadog and PPA leftovers go. * Drop the explanatory comments from the apt repo change
77 lines
2.8 KiB
YAML
77 lines
2.8 KiB
YAML
---
|
|
host_role: storage
|
|
host_description: "Primary storage (ZFS), Docker services"
|
|
host_location: "London"
|
|
prometheus_location: london
|
|
|
|
docker_services:
|
|
- jellyseerr
|
|
- navidrome
|
|
- slskd
|
|
- smartctl-exporter
|
|
- plex-exporter
|
|
- bookshelf
|
|
|
|
# Snap-managed services (deployed by media_stack role)
|
|
snap_services:
|
|
- overseerr
|
|
|
|
# APT-managed user services (deployed by media_stack role)
|
|
apt_user_services:
|
|
- syncthing@pez
|
|
|
|
common_apt_repositories:
|
|
- name: tailscale
|
|
uris: https://pkgs.tailscale.com/stable/ubuntu
|
|
suites: "{{ ansible_facts['distribution_release'] }}"
|
|
components: main
|
|
signed_by: "https://pkgs.tailscale.com/stable/ubuntu/{{ ansible_facts['distribution_release'] }}.noarmor.gpg"
|
|
- name: jellyfin
|
|
uris: https://repo.jellyfin.org/ubuntu
|
|
suites: "{{ ansible_facts['distribution_release'] }}"
|
|
components: main
|
|
signed_by: https://repo.jellyfin.org/jellyfin_team.gpg.key
|
|
- name: plexmediaserver
|
|
uris: https://repo.plex.tv/deb
|
|
suites: public
|
|
components: main
|
|
signed_by: https://downloads.plex.tv/plex-keys/PlexSign.v2.key
|
|
|
|
common_apt_cleanup_files:
|
|
- /etc/apt/sources.list.d/datadog.list.distUpgrade
|
|
- /etc/apt/sources.list.d/graphics-drivers-ubuntu-ppa-lunar.list.distUpgrade
|
|
- /etc/apt/sources.list.d/graphics-drivers-ubuntu-ppa-lunar.sources
|
|
- /etc/apt/sources.list.d/jcfp-ubuntu-nobetas-lunar.list.distUpgrade
|
|
- /etc/apt/sources.list.d/jcfp-ubuntu-nobetas-lunar.sources
|
|
- /etc/apt/sources.list.d/jellyfin.sources.distUpgrade
|
|
- /etc/apt/sources.list.d/mediaarea.list.distUpgrade
|
|
- /etc/apt/sources.list.d/mediaarea.sources
|
|
- /etc/apt/sources.list.d/mono-official-stable.list.distUpgrade
|
|
- /etc/apt/sources.list.d/nvidia-container-toolkit.list.distUpgrade
|
|
- /etc/apt/sources.list.d/plexmediaserver.list.distUpgrade
|
|
- /etc/apt/sources.list.d/sonarr.list.distUpgrade
|
|
- /etc/apt/sources.list.d/tailscale.list.distUpgrade
|
|
- /etc/apt/keyrings/jellyfin.gpg
|
|
- /usr/share/keyrings/plexmediaserver.gpg
|
|
- /usr/share/keyrings/mono-official-archive-keyring.gpg
|
|
- /usr/share/keyrings/mono-official-archive-keyring.gpg~
|
|
- /usr/share/keyrings/sonarr-keyring.gpg
|
|
- /usr/share/keyrings/sonarr-keyring.gpg~
|
|
- /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
|
|
|
|
zfs_pools:
|
|
- hdd
|
|
|
|
docker_daemon_extra:
|
|
metrics-addr: "0.0.0.0:9323"
|
|
data-root: "/hdd/docker"
|
|
storage-driver: "zfs"
|
|
|
|
common_ufw_allowed_ports:
|
|
- { port: 32400, proto: tcp, comment: "Plex Media Server" }
|
|
- { port: 6881, proto: tcp, comment: "BitTorrent" }
|
|
- { port: 6881, proto: udp, comment: "BitTorrent" }
|
|
# SMB is reachable over Tailscale via the tailscale0 allow-all rule; this
|
|
# entry additionally allows the local London LAN. Deliberately NOT open to
|
|
# the public internet (see PESO-145).
|
|
- { port: 445, proto: tcp, from_ip: "192.168.1.0/24", comment: "Samba (LAN only)" }
|