mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-10-31 19:11:03 +00:00
Rasmus "Pez" Wejlgaard
f1421c6946
The first scheduled deploy failed on london-b because GitHub's gh apt signing key expired on 2026-09-05. The common role now refreshes the keyring from upstream wherever the github-cli repo is configured. The proxmox_ve role was still writing a bookworm no-subscription source onto hosts that are now trixie / PVE 9. I've switched it to a deb822 proxmox.sources using the host's release, and it cleans up the old .list plus the enterprise repos in both formats.
82 lines
2.7 KiB
YAML
82 lines
2.7 KiB
YAML
---
|
|
# Configure Proxmox VE apt sources for the no-subscription tier.
|
|
# Removes the enterprise repos (require a paid subscription) and enables
|
|
# the free no-subscription repo so apt update works without credentials.
|
|
|
|
# PVE 9 (trixie) uses deb822 .sources files. Clear out the enterprise repos in
|
|
# both formats, plus the old one-line no-subscription .list this role used to
|
|
# write with a hardcoded bookworm suite (mixing suites on a trixie host).
|
|
- name: Remove enterprise and legacy Proxmox apt sources
|
|
ansible.builtin.file:
|
|
path: "/etc/apt/sources.list.d/{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- pve-enterprise.list
|
|
- pve-enterprise.sources
|
|
- ceph.list
|
|
- ceph.sources
|
|
- pve.sources
|
|
- pve-no-subscription.list
|
|
notify: Update apt cache
|
|
|
|
- name: Add PVE no-subscription apt source
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/sources.list.d/proxmox.sources
|
|
content: |
|
|
Types: deb
|
|
URIs: http://download.proxmox.com/debian/pve
|
|
Suites: {{ ansible_facts['distribution_release'] }}
|
|
Components: pve-no-subscription
|
|
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Update apt cache
|
|
|
|
- name: Update apt cache
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
|
|
# Patch is re-applied automatically on each Ansible run, which handles pve-manager package updates
|
|
# reverting the file.
|
|
- name: Suppress Proxmox subscription nag dialog
|
|
ansible.builtin.replace:
|
|
path: /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js
|
|
regexp: "if \\(res === null \\|\\| res === undefined \\|\\| !res \\|\\| res\\.data\\.status\\.toLowerCase\\(\\) !== 'active'\\)"
|
|
replace: "if (false)"
|
|
notify: Restart pveproxy
|
|
|
|
- name: Allow Proxmox web UI on Tailscale only
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "8006"
|
|
proto: tcp
|
|
interface: tailscale0
|
|
direction: in
|
|
comment: "Proxmox web UI - Tailscale only"
|
|
notify: Reload ufw
|
|
|
|
# --- Storage ---
|
|
# london-b's CIFS share is only mounted for hosts on the same LAN (london-a) —
|
|
# it's not worth mounting over the WAN/Tailscale for a Copenhagen host.
|
|
|
|
- name: Check if hdd CIFS storage is configured
|
|
ansible.builtin.command: pvesh get /storage/hdd
|
|
register: proxmox_ve_hdd_check
|
|
changed_when: false
|
|
failed_when: false
|
|
when: proxmox_ve_mount_cifs_storage | default(true)
|
|
|
|
- name: Add hdd CIFS storage (london-b /pve share)
|
|
ansible.builtin.command: >-
|
|
pvesm add cifs hdd
|
|
--server 100.84.65.101
|
|
--share pve
|
|
--username {{ proxmox_ve_smb_user }}
|
|
--password {{ proxmox_ve_smb_password }}
|
|
--content images,backup,import,snippets,vztmpl,rootdir,iso
|
|
no_log: true
|
|
changed_when: true
|
|
when:
|
|
- proxmox_ve_mount_cifs_storage | default(true)
|
|
- proxmox_ve_hdd_check.rc != 0
|