diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3f7db3c36..962bff6fb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Cloning the repository repo... - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 fetch-tags: true diff --git a/nova/core/galaxy.yml b/nova/core/galaxy.yml index acd2b6273..b4a78842f 100644 --- a/nova/core/galaxy.yml +++ b/nova/core/galaxy.yml @@ -1,6 +1,6 @@ namespace: nova name: core -version: 11.0.0 +version: 11.0.1 readme: README.md authors: - https://github.com/novateams diff --git a/nova/core/roles/accounts/tasks/unix_create.yml b/nova/core/roles/accounts/tasks/unix_create.yml index fdb9a2636..1b896acf6 100644 --- a/nova/core/roles/accounts/tasks/unix_create.yml +++ b/nova/core/roles/accounts/tasks/unix_create.yml @@ -123,7 +123,7 @@ become: true - name: Restarting SSHD... # noqa: no-handler - ansible.builtin.systemd: + ansible.builtin.service: name: "{{ accounts_os_family_service_name[ansible_facts.os_family] | default('sshd') }}" state: restarted when: maxauthtries.changed diff --git a/nova/core/roles/caddy/tasks/install.yml b/nova/core/roles/caddy/tasks/install.yml index dfc91271f..c08fd69f1 100644 --- a/nova/core/roles/caddy/tasks/install.yml +++ b/nova/core/roles/caddy/tasks/install.yml @@ -23,7 +23,6 @@ state: directory recurse: true loop: - - "{{ caddy_config_folder }}" - "{{ caddy_config_folder }}/etc" - "{{ caddy_config_folder }}/data" - "{{ caddy_config_folder }}/config" @@ -33,7 +32,7 @@ - name: Templating Caddy configuration files for {{ inventory_hostname }}... ansible.builtin.template: - src: caddy.yml + src: docker-compose.yml dest: "{{ caddy_config_folder }}/docker-compose.yml" mode: "0644" lstrip_blocks: true diff --git a/nova/core/roles/caddy/templates/caddy.yml b/nova/core/roles/caddy/templates/caddy.yml deleted file mode 100644 index 1275ceab2..000000000 --- a/nova/core/roles/caddy/templates/caddy.yml +++ /dev/null @@ -1,34 +0,0 @@ ---- -services: - caddy: - image: caddy:{{ caddy_version }} - hostname: caddy - container_name: caddy - restart: unless-stopped - {% if caddy_enable_api %} - command: caddy run --resume - environment: - - CADDY_ADMIN=0.0.0.0:2019 - {% endif %} - ports: - {% if caddy_enable_api %} - {% for port in caddy_api_container_ports %} - - "{{ port }}" - {% endfor %} - {% else %} - {% for port in caddy_container_ports %} - - "{{ port }}" - {% endfor %} - {% endif %} - volumes: - - /srv/caddy/etc:/etc/caddy - - /srv/caddy/data:/data/caddy - - /srv/caddy/config:/config/caddy - - /srv/caddy/logs:/srv/logs - - /srv/caddy/www:/srv/www - - "{{ caddy_certificates_folder }}:/srv/certs" - - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt -networks: - default: - name: "{{ caddy_docker_network }}" - external: true diff --git a/nova/core/roles/caddy/templates/docker-compose.yml b/nova/core/roles/caddy/templates/docker-compose.yml new file mode 100644 index 000000000..831d8642c --- /dev/null +++ b/nova/core/roles/caddy/templates/docker-compose.yml @@ -0,0 +1,78 @@ +--- +services: + caddy: + image: caddy:{{ caddy_version }} + hostname: caddy + container_name: caddy + restart: unless-stopped + {% if caddy_enable_api %} + command: caddy run --resume + environment: + - CADDY_ADMIN=0.0.0.0:2019 + {% endif %} + ports: + {% if caddy_enable_api %} + {% for port in caddy_api_container_ports %} + - "{{ port }}" + {% endfor %} + {% else %} + {% for port in caddy_container_ports %} + - "{{ port }}" + {% endfor %} + {% endif %} + volumes: + - caddy_etc:/etc/caddy + - caddy_data:/data/caddy + - caddy_config:/config/caddy + - caddy_logs:/srv/logs + - caddy_www:/srv/www + - caddy_certs:/srv/certs + - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt + +volumes: + caddy_etc: + driver: local + driver_opts: + type: none + o: bind + device: "{{ caddy_config_folder }}/etc" + + caddy_data: + driver: local + driver_opts: + type: none + o: bind + device: "{{ caddy_config_folder }}/data" + + caddy_config: + driver: local + driver_opts: + type: none + o: bind + device: "{{ caddy_config_folder }}/config" + + caddy_logs: + driver: local + driver_opts: + type: none + o: bind + device: "{{ caddy_config_folder }}/logs" + + caddy_www: + driver: local + driver_opts: + type: none + o: bind + device: "{{ caddy_config_folder }}/www" + + caddy_certs: + driver: local + driver_opts: + type: none + o: bind + device: "{{ caddy_certificates_folder }}" + +networks: + default: + name: "{{ caddy_docker_network }}" + external: true diff --git a/nova/core/roles/configure_networking/tasks/vsphere/interfaces_alpine.yml b/nova/core/roles/configure_networking/tasks/vsphere/interfaces_alpine.yml index 96b70d028..4289a3dd7 100644 --- a/nova/core/roles/configure_networking/tasks/vsphere/interfaces_alpine.yml +++ b/nova/core/roles/configure_networking/tasks/vsphere/interfaces_alpine.yml @@ -126,9 +126,29 @@ keys_send: - ENTER + - name: Detecting DHCP address for {{ custom_vm_name | default(vm_name) }}... + community.vmware.vmware_guest_info: + datacenter: "{{ datacenter }}" + name: "{{ custom_vm_name | default(vm_name) }}" + folder: "{{ folder }}" + properties: + - guest.ipAddress + schema: vsphere + delegate_to: localhost + become: false + register: detect_dhcp + until: + - detect_dhcp.instance.guest.ipAddress != none + - detect_dhcp.instance.guest.ipAddress != "0.0.0.0" + - not (detect_dhcp.instance.guest.ipAddress | regex_search('169.254.*')) # Protection against APIPA address + - not (detect_dhcp.instance.guest.ipAddress | ansible.utils.ipv6) # Protection against IPv6 link-local address + retries: 60 + delay: 5 + when: connection_mode in ['ipv4_dhcp', 'ipv6_dhcp', 'ipv6_slaac'] + - name: Waiting for the network to be configured... ansible.builtin.wait_for: - host: "{{ connection_address }}" + host: "{{ detect_dhcp.instance.guest.ipAddress | default(connection_address) }}" port: 22 timeout: 60 diff --git a/nova/core/roles/connection/tasks/vmware_workstation.yml b/nova/core/roles/connection/tasks/vmware_workstation.yml index e9042cfcd..fa64f1224 100644 --- a/nova/core/roles/connection/tasks/vmware_workstation.yml +++ b/nova/core/roles/connection/tasks/vmware_workstation.yml @@ -1,7 +1,9 @@ --- - name: - Connecting as {{ template_username if fresh_deploy else ansible_deployer_username }} to {{ inventory_hostname }} using {{ ansible_connection - | upper }} over {{ ansible_host }}... # noqa: name[template] + Connecting as {{ template_username if fresh_deploy else ansible_deployer_username }} + to {{ inventory_hostname }} + using {{ ansible_connection | default('ssh') | upper }} + over {{ ansible_host }}... ansible.builtin.set_fact: ansible_user: "{{ template_username if fresh_deploy else ansible_deployer_username }}" ansible_password: "{{ omit if connection_no_password else template_password if fresh_deploy else ansible_deployer_password }}" diff --git a/nova/core/roles/connection/tasks/vsphere.yml b/nova/core/roles/connection/tasks/vsphere.yml index ec4d66a51..6a7254a19 100644 --- a/nova/core/roles/connection/tasks/vsphere.yml +++ b/nova/core/roles/connection/tasks/vsphere.yml @@ -32,7 +32,7 @@ Connecting as {{ template_username if fresh_deploy else ansible_deployer_username }} to {{ inventory_hostname }} using {{ ansible_connection | default('ssh') | upper }} - over {{ connection_address_custom | default(detect_dhcp.instance.guest.ipAddress) | default(connection_address) }}... # noqa: name[template] + over {{ connection_address_custom | default(detect_dhcp.instance.guest.ipAddress) | default(connection_address) }}... ansible.builtin.set_fact: ansible_host: "{{ connection_address_custom | default(detect_dhcp.instance.guest.ipAddress) | default(connection_address) }}" ansible_user: "{{ template_username if fresh_deploy else ansible_deployer_username }}" diff --git a/nova/core/roles/deploy_vars/tasks/main.yml b/nova/core/roles/deploy_vars/tasks/main.yml index 9ac555f22..afff877c9 100644 --- a/nova/core/roles/deploy_vars/tasks/main.yml +++ b/nova/core/roles/deploy_vars/tasks/main.yml @@ -48,4 +48,4 @@ - aws_defaults.secret_key is ansible.builtin.truthy # # Uncomment to debug variables # - ansible.builtin.debug: msg="{{ }}" -# - meta: end_play +# - meta: end_host diff --git a/nova/core/roles/gitlab/defaults/main.yml b/nova/core/roles/gitlab/defaults/main.yml index 28c30693b..d467407aa 100644 --- a/nova/core/roles/gitlab/defaults/main.yml +++ b/nova/core/roles/gitlab/defaults/main.yml @@ -1,6 +1,6 @@ --- ### gitlab general -gitlab_version: 19.0.1-ee.0 +gitlab_version: 19.1.1-ee.0 gitlab_ssh_port: 10022 # Increase gitlab ssh MaxAuthTries to avoid connection issues for users with more than 6 keys in their SSH agent set to {} to disable gitlab_ssh_max_auth_tries: 20 diff --git a/nova/core/roles/gitlab/tasks/install.yml b/nova/core/roles/gitlab/tasks/install.yml index cdee860a7..486e46b65 100644 --- a/nova/core/roles/gitlab/tasks/install.yml +++ b/nova/core/roles/gitlab/tasks/install.yml @@ -90,5 +90,5 @@ status_code: 200 register: gitlab_uri until: gitlab_uri.status == 200 - retries: 12 - delay: 5 + retries: 18 + delay: 10 diff --git a/nova/core/roles/machine_operations/tasks/proxmox/create.yml b/nova/core/roles/machine_operations/tasks/proxmox/create.yml index 23db01fd7..8bb578963 100644 --- a/nova/core/roles/machine_operations/tasks/proxmox/create.yml +++ b/nova/core/roles/machine_operations/tasks/proxmox/create.yml @@ -237,6 +237,34 @@ timeout: "{{ proxmox_machine_operations_operation_timeout }}" when: proxmox_ha_resource.json.data | selectattr('sid', 'equalto', 'vm:' ~ machine_operations_proxmox_ha_configuration.sid) == [] + - name: Applying pending configuration for {{ custom_vm_name | default(vm_name) }} VM... + when: + - machine_operations_reconfigure_vm_on_deploy + - not fresh_deploy + block: + # Using API instead of community.proxmox.proxmox_vm_info module since it reports incorrectly + - name: Checking if {{ custom_vm_name | default(vm_name) }} has pending configuration... + ansible.builtin.uri: + url: + "{{ proxmox_api_url }}/nodes/{{ proxmox_vm_exists.proxmox_vms[0].node }}/qemu/{{ + proxmox_vm_exists.proxmox_vms[0].vmid | default(machine_operations_proxmox_vmid) }}/pending" + headers: + Authorization: PVEAPIToken={{ proxmox_defaults.api_user }}!{{ proxmox_defaults.api_token_id }}={{ proxmox_defaults.api_token_secret }} + method: GET + validate_certs: "{{ proxmox_defaults.validate_certs }}" + timeout: "{{ proxmox_machine_operations_operation_timeout }}" + register: proxmox_vm_pending_info + until: proxmox_vm_pending_info is not failed + retries: 5 + delay: 3 + + - name: Restarting {{ custom_vm_name | default(vm_name) }} to apply the pending configuration... + community.proxmox.proxmox_kvm: + name: "{{ custom_vm_name | default(vm_name) }}" + state: restarted + timeout: "{{ proxmox_machine_operations_operation_timeout }}" + when: (proxmox_vm_pending_info.json.data | selectattr('pending', 'defined') | list | length) > 0 + - name: Starting {{ custom_vm_name | default(vm_name) }} VM... # noqa: no-handler community.proxmox.proxmox_kvm: name: "{{ custom_vm_name | default(vm_name) }}" diff --git a/nova/core/roles/machine_operations/tasks/proxmox/remove.yml b/nova/core/roles/machine_operations/tasks/proxmox/remove.yml index e57d2f6cb..41011388f 100644 --- a/nova/core/roles/machine_operations/tasks/proxmox/remove.yml +++ b/nova/core/roles/machine_operations/tasks/proxmox/remove.yml @@ -37,7 +37,44 @@ purge: true state: absent timeout: 30 - retries: 3 + retries: 5 + +- name: Removing unreferenced disks... + become: false + delegate_to: localhost + block: + # Sometimes during high load the unreferenced disk cleanup can fail in the previous task + # So checking if there are unreferenced disks and trying to remove them before finishing the play + - name: Listing {{ custom_vm_name | default(vm_name) }} unreferenced disks... + community.proxmox.proxmox_storage_contents_info: + storage: "{{ proxmox_storage }}" + node: "{{ proxmox_vm_exists.proxmox_vms[0].node | default(proxmox_node) }}" + vmid: "{{ proxmox_vm_exists.proxmox_vms[0].vmid | default(machine_operations_proxmox_vmid) }}" + validate_certs: "{{ proxmox_validate_certs }}" + retries: 12 + delay: 5 + register: proxmox_unreferenced_disks + + - name: Removing following {{ custom_vm_name | default(vm_name) }} unreferenced disks... + ansible.builtin.uri: + url: + "{{ proxmox_api_url }}/nodes/{{ proxmox_vm_exists.proxmox_vms[0].node + | default(proxmox_node) }}/storage/{{ proxmox_storage }}/content/{{ disk.volid }}" + headers: + Authorization: PVEAPIToken={{ proxmox_defaults.api_user }}!{{ proxmox_defaults.api_token_id }}={{ proxmox_defaults.api_token_secret }} + method: DELETE + validate_certs: "{{ proxmox_validate_certs }}" + loop_control: + loop_var: disk + label: "{{ disk.volid }}" + loop: "{{ proxmox_unreferenced_disks.proxmox_storage_content }}" + when: proxmox_unreferenced_disks.proxmox_storage_content != [] + retries: 12 + delay: 5 + + - name: Re-including remove tasks... + ansible.builtin.include_tasks: remove.yml + when: proxmox_unreferenced_disks.proxmox_storage_content != [] - name: Stopping play... ansible.builtin.meta: end_host diff --git a/nova/core/roles/template_os_configuration/tasks/windows.yml b/nova/core/roles/template_os_configuration/tasks/windows.yml index 8f3e59d4f..9b452a8ee 100644 --- a/nova/core/roles/template_os_configuration/tasks/windows.yml +++ b/nova/core/roles/template_os_configuration/tasks/windows.yml @@ -237,6 +237,7 @@ line: "{{ sshd_config_item.line }}" loop_control: loop_var: sshd_config_item + label: "{{ sshd_config_item.regexp }}" loop: - regexp: ^.*Match Group administrators$ line: "#Match Group administrators" diff --git a/nova/core/roles/vault/defaults/main.yml b/nova/core/roles/vault/defaults/main.yml index f8f20d2cc..a65c42099 100644 --- a/nova/core/roles/vault/defaults/main.yml +++ b/nova/core/roles/vault/defaults/main.yml @@ -10,7 +10,7 @@ vault_configure: false # Run the initial default configuration for Vault vault_configure_ldap: false # Configuring LDAP authentication for Vault vault_configuration_uri: "https://{{ fqdn }}" # Defined separately for when configuring multiple Vaults vault_config_folder: /srv/vault -vault_version: 2.0.2 # Default Vault Docker image version +vault_version: 2.0.3 # Default Vault Docker image version vault_container_name: vault vault_server_log_level: debug # Debug gives better info about LDAP login failures and their reasons vault_audit_logging: false # Enable Vault audit logging