playbooks/device_roles_workstation.yml

@@ -16,6 +16,7 @@
       vars:
         backup_s3backup_tar_args_extra: h
         backup_s3backup_list_extra:
+          - /etc/
           - /home/salt/.backup/
       tags: [ backup ]
 - hosts: dsk-ryzen-1.ws.mgmt.desu.ltd
@@ -27,3 +28,10 @@
         backup_s3backup_list_extra:
           - /home/salt/.backup/
       tags: [ backup ]
+#    - role: grub
+#      vars:
+#        grub_default: "saved"
+#        grub_disable_os_prober: "false"
+#        grub_timeout: 5
+#        grub_hidden_timeout: 5
+#      tags: [ desktop, grub ]

roles/docker-minecraft/defaults/main.yml

@@ -0,0 +1,35 @@
+#!/usr/bin/env ansible-playbook
+# vim:ft=ansible:
+# Overall app settings
+minecraft_name: generic
+#minecraft_pack_zip: "https://example.com/path/to/pack.zip"
+
+# Container settings
+minecraft_uid: 1520
+minecraft_gid: 1520
+minecraft_state: started
+# See the tags for this image for more versions
+minecraft_image: rehashedsalt/minecraft-forge:1.16.5-master
+minecraft_restart_policy: unless-stopped
+minecraft_timezone: "America/Chicago"
+# Container network settings
+minecraft_external_port: "25565"
+minecraft_data_prefix: "/data/minecraft/{{ minecraft_name }}"
+
+# Java settings
+minecraft_jvm_args: "-XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+DisableExplicitGC -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1"
+minecraft_jvm_extra_args: ""
+minecraft_xmx: "8G"
+minecraft_xms: "4G"
+# server.properties
+minecraft_server_properties:
+  allow-flight: true
+  difficulty: hard
+  gamemode: survival
+  level-name: world
+  level-type: default
+  max-players: 20
+  motd: A Minecraft Server
+  server-port: 25565
+  spawn-protection: 0
+  view-distance: 10

roles/docker-minecraft/handlers/main.yml

@@ -0,0 +1,7 @@
+#!/usr/bin/env ansible-playbook
+# vim:ft=ansible:
+- name: restart minecraft {{ minecraft_name }}
+  docker_container:
+    name: "minecraft-{{ minecraft_name }}"
+    state: started
+    restart: yes

roles/docker-minecraft/tasks/main.yml

@@ -0,0 +1,58 @@
+#!/usr/bin/env ansible-playbook
+# vim:ft=ansible:
+---
+- name: assure minecraft {{ minecraft_name }} directory structure
+  file:
+    state: directory
+    owner: "{{ minecraft_uid }}"
+    group: "{{ minecraft_gid }}"
+    mode: "0750"
+    path: "{{ item }}"
+    # We recurse here since these directories *and all of their contents*
+    # should be read-write by the container without exception.
+    recurse: yes
+  with_items:
+    - "{{ minecraft_data_prefix }}/backups"
+    - "{{ minecraft_data_prefix }}/logs"
+    - "{{ minecraft_data_prefix }}/world"
+- name: assure minecraft {{ minecraft_name }} files
+  file:
+    state: touch
+    owner: "{{ minecraft_uid }}"
+    group: "{{ minecraft_gid }}"
+    mode: "0640"
+    path: "{{ item }}"
+  with_items:
+    - "{{ minecraft_data_prefix }}/ops.json"
+    - "{{ minecraft_data_prefix }}/server.properties"
+- name: assure {{ minecraft_name }} server properties
+  lineinfile:
+    state: present
+    regexp: "^{{ item.key }}"
+    line: "{{ item.key }}={{ item.value }}"
+    path: "{{ minecraft_data_prefix }}/server.properties"
+  with_dict: "{{ minecraft_server_properties }}"
+  notify: "restart minecraft {{ minecraft_name }}"
+- name: assure minecraft {{ minecraft_name }} container
+  docker_container:
+    name: "minecraft-{{ minecraft_name }}"
+    state: "{{ minecraft_state }}"
+    image: "{{ minecraft_image }}"
+    restart_policy: "{{ minecraft_restart_policy }}"
+    pull: yes
+    user: "{{ minecraft_uid }}:{{ minecraft_gid }}"
+    env:
+      TZ: "{{ minecraft_timezone }}"
+      ARGS: "{{ minecraft_jvm_args }} {{ minecraft_jvm_extra_args }}"
+      JRE_XMX: "{{ minecraft_xmx }}"
+      JRE_XMS: "{{ minecraft_xms }}"
+      FORGE_PACK_ZIP: "{{ minecraft_pack_zip }}"
+    ports:
+      - "{{ minecraft_external_port }}:25565/tcp"
+      - "{{ minecraft_external_port }}:25565/udp"
+    volumes:
+      - "{{ minecraft_data_prefix }}/backups:/minecraft/backups"
+      - "{{ minecraft_data_prefix }}/logs:/minecraft/logs"
+      - "{{ minecraft_data_prefix }}/ops.json:/minecraft/ops.json"
+      - "{{ minecraft_data_prefix }}/server.properties:/minecraft/server.properties"
+      - "{{ minecraft_data_prefix }}/world:/minecraft/world"

roles/docker-minecraft/templates/server.properties

@@ -0,0 +1,4 @@
+{{ ansible_managed }}
+{% for property in minecraft_server_properties %}
+{{ property.key }}={{ property.value }}
+{% endfor %}

roles/docker-tes3mp/defaults/main.yml

@@ -0,0 +1,19 @@
+# vim:ft=ansible:
+# Overall app settings
+tes3mp_name: generic
+
+# Container settings
+tes3mp_uid: 0
+tes3mp_gid: 0
+tes3mp_state: started
+tes3mp_image: tes3mp/server:0.8.1
+tes3mp_restart_policy: unless-stopped
+tes3mp_timezone: "America/Chicago"
+# Container network settings
+tes3mp_external_port: 25565
+tes3mp_data_prefix: "/data/tes3mp/{{ tes3mp_name }}"
+
+# TES3MP settings
+tes3mp_server_maximum_players: "8"
+tes3mp_server_hostname: "Some Ansible-deployed server"
+tes3mp_server_password: "dicks"

roles/docker-tes3mp/tasks/main.yml

@@ -0,0 +1,36 @@
+#!/usr/bin/env ansible-playbook
+# vim:ft=ansible:
+- name: assure tes3mp {{ tes3mp_name }} directory structure
+  ansible.builtin.file:
+    state: directory
+    owner: "{{ tes3mp_uid }}"
+    group: "{{ tes3mp_gid }}"
+    mode: "0750"
+    path: "{{ item }}"
+    recurse: yes
+  with_items:
+    - "{{ tes3mp_data_prefix }}/data"
+    - "{{ tes3mp_data_prefix }}/backups"
+- name: assure tes3mp {{ tes3mp_name }} backup cronjob
+  ansible.builtin.cron:
+    user: root
+    name: "tes3mp-{{ tes3mp_name }}"
+    minute: "*/10"
+    job: "tar czvf \"{{ tes3mp_data_prefix }}/backups/tes3mp-$(date +%Y-%M-%d-%H%M).tgz\" \"{{ tes3mp_data_prefix }}/data\""
+- name: assure tes3mp {{ tes3mp_name }} container
+  docker_container:
+    name: "tes3mp-{{ tes3mp_name }}"
+    state: started
+    image: "{{ tes3mp_image }}"
+    restart_policy: "{{ tes3mp_restart_policy }}"
+    pull: yes
+    user: "{{ tes3mp_uid }}:{{ tes3mp_gid }}"
+    env:
+      TZ: "{{ tes3mp_timezone }}"
+      TES3MP_SERVER_MAXIMUM_PLAYERS: "{{ tes3mp_server_maximum_players }}"
+      TES3MP_SERVER_HOSTNAME: "{{ tes3mp_server_hostname }}"
+      TES3MP_SERVER_PASSWORD: "{{ tes3mp_server_password }}"
+    ports:
+      - "25565:25565/udp"
+    volumes:
+      - "{{ tes3mp_data_prefix }}/data:/server/data"

roles/grub/defaults/main.yml

@@ -0,0 +1,14 @@
+# vim:ft=ansible:
+# Defaults are for a super-simple pared-down instant GRUB
+grub_default: 0
+grub_hidden_timeout: 0
+grub_hidden_timeout_quiet: "true"
+grub_timeout: 0
+grub_timeout_style: hidden
+grub_recordfail_timeout: 0
+grub_distributor: "`lsb_release -i -s 2> /dev/null`"
+grub_cmdline_linux_default: "quiet splash"
+grub_cmdline_linux: ""
+
+# Workaroundies
+grub_disable_os_prober: "true"

roles/grub/handlers/main.yml

@@ -0,0 +1,5 @@
+#!/usr/bin/env ansible-playbook
+# vim:ft=ansible:
+- name: grub mkconfig
+  ansible.builtin.command: "grub-mkconfig -o /boot/grub/grub.cfg"
+  become: yes

roles/grub/tasks/main.yml

@@ -0,0 +1,8 @@
+#!/usr/bin/env ansible-playbook
+# vim:ft=ansible:
+---
+- name: configure grub
+  block:
+    - name: template out grub config
+      ansible.builtin.template: src=grub.conf dest=/etc/default/grub mode=0644
+      notify: grub mkconfig

roles/grub/templates/grub.conf

@@ -0,0 +1,13 @@
+# vim:ft=bash
+GRUB_DEFAULT="{{ grub_default }}"
+GRUB_SAVEDEFAULT=true
+GRUB_HIDDEN_TIMEOUT="{{ grub_hidden_timeout }}"
+GRUB_HIDDEN_TIMEOUT_QUIET="{{ grub_hidden_timeout_quiet }}"
+GRUB_TIMEOUT="{{ grub_timeout }}"
+GRUB_TIMEOUT_STYLE="{{ grub_timeout_style }}"
+GRUB_RECORDFAIL_TIMEOUT="{{ grub_recordfail_timeout }}"
+GRUB_DISTRIBUTOR="{{ grub_distributor }}"
+GRUB_CMDLINE_LINUX_DEFAULT="{{ grub_cmdline_linux_default }}"
+GRUB_CMDLINE_LINUX="{{ grub_cmdline_linux }}"
+# Work around probing for other OSs resetting timeout
+GRUB_DISABLE_OS_PROBER="{{ grub_disable_os_prober }}"

roles/keepalived/defaults/main.yml

@@ -0,0 +1,22 @@
+# vim:ft=ansible:
+
+# A list of stanzas to put in the keepalived.conf file
+keepalived_stanzas: []
+#keepalived_stanzas:
+#    # Name of the vrrp instance
+#  - name: VI_1
+#    # Node state. Should be "MASTER" on the master and "BACKUP" on backup machines
+#    state: BACKUP
+#    # The interface to assign the VIP to
+#    interface: eth0
+#    # The virtual router ID
+#    virtual_router_id: 51
+#    # Node priority. Should be assigned differently for each host
+#    priority: 100
+#    # Advertisement interval in seconds
+#    advert_int: 1
+#    # Keepalived authentication password
+#    auth_pass: mySuperSecretPassword
+#    # The VIP to pass around. Include the subnet mask like so:
+#    # 192.168.0.5/24
+#    vip: 1.2.3.4

roles/keepalived/handlers/main.yml

@@ -0,0 +1,6 @@
+#!/usr/bin/env ansible-playbook
+# vim:ft=ansible:
+---
+- name: restart keepalived
+  throttle: 1
+  systemd: name=keepalived state=restarted

roles/keepalived/tasks/main.yml

@@ -0,0 +1,11 @@
+#!/usr/bin/env ansible-playbook
+# vim:ft=ansible:
+---
+- name: install keepalived
+  apt: name=keepalived state=present
+  when: ansible_os_family == 'Debian'
+- name: template out config
+  template: src=keepalived.conf dest=/etc/keepalived/keepalived.conf mode="0640"
+  notify: restart keepalived
+- name: ensure keepalived is running
+  systemd: name=keepalived state=started enabled=yes

roles/keepalived/templates/keepalived.conf

@@ -0,0 +1,16 @@
+{% for stanza in keepalived_stanzas %}
+vrrp_instance {{ stanza.name }} {
+	state {{ stanza.state | default('BACKUP') }}
+	interface {{ stanza.interface }}
+	virtual_router_id {{ stanza.virtual_router_id }}
+	priority {{ stanza.priority }}
+	advert_int {{ stanza.advert_int | default('1') }}
+	authentication {
+		auth_type PASS
+		auth_pass {{ stanza.auth_pass }}
+	}
+	virtual_ipaddress {
+		{{ stanza.vip }}
+	}
+}
+{% endfor %}

roles/netplan-static-ip/defaults/main.yml

@@ -0,0 +1,5 @@
+# vim:ft=ansible:
+netplan_gateway: 192.168.1.1
+# Note: this is a string representing a YAML array
+# NOT a YAML array
+netplan_addresses: "[ 192.168.103.100, 192.168.103.101 ]"

roles/netplan-static-ip/tasks/main.yml

@@ -0,0 +1,31 @@
+#!/usr/bin/env ansible-playbook
+# vim:ft=ansible:
+---
+- name: disable cloud-init networking
+  copy:
+    dest: /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg
+    content: 'network: {config: disabled}'
+  # We don't apply network config after doing this because it doesn't actually
+  # matter. The next config comes after it and overrides it anyway.
+  # I just do this to make things cleaner.
+- name: remove 50-cloud-init.yaml
+  file: path=/etc/netplan/50-cloud-init.yaml state=absent
+- name: configure netplan static ip
+  copy:
+    dest: /etc/netplan/51-static-ip.yaml
+    # Note: some syntax highlighters will say the stanza below is yaml
+    # It's not. It's a heredoc
+    content: |
+      network:
+        ethernets:
+          eth0:
+            dhcp4: no
+            addresses:
+              - {{ static_ip }}
+            gateway4: {{ netplan_gateway }}
+            nameservers:
+              addresses: {{ netplan_addresses }}
+  register: netplan
+- name: apply netplan
+  command: netplan apply
+  when: netplan is changed

roles/pulseaudio/README.md

@@ -0,0 +1,11 @@
+# pulseaudio
+
+Role to configure Pulseaudio as a system-wide daemon *without* using Pulse in system mode.
+
+## What?
+
+Pulseaudio runs as its own server with control over the audio hardware in `pulseaudio.service`. It listens on a socket in `/tmp/pulse-server` responding to members of the `audio` group.
+
+## Why?
+
+It allows for clean, efficient multi-user setups.

roles/pulseaudio/defaults/main.yml

@@ -0,0 +1,24 @@
+# vim:ft=ansible:
+# Flat volumes are the behavior where Pulse uses one global audio slider
+# instead of allowing for per-application, per-sink control.
+pulse_flat_volumes: "no"
+# Sample rate; pretty self-explanatory
+# Consider setting to 96000 if you have high-quality headphones
+pulse_sample_rate: 96000
+pulse_sample_rate_alternate: 44100
+# For some reason, Pulse does 16-bit sampling by default. This fixes that
+pulse_sample_format: s32le
+# Sometimes Pulse has to resample; speex-float-5 is pretty solid
+pulse_resample_method: speex-float-5
+pulse_resample_avoid: "true"
+# Latency settings; increase if you get stuttering
+# "Size" is in milliseconds
+pulse_latency_fragments: 5
+pulse_latency_fragment_size: 10
+
+## You shouldn't have to mess with these settings
+
+# Should the process be marked as high-priority?
+pulse_high_priority: "yes"
+# What level should Pulse renice itself to on startup?
+pulse_nice_level: -19

roles/pulseaudio/tasks/main.yml

@@ -0,0 +1,21 @@
+#!/usr/bin/env ansible-playbook
+# vim:ft=ansible:
+- name: assure pulse package
+  ansible.builtin.apt: name=pulseaudio
+  when: ansible_os_family == 'Debian'
+- name: remove user pulseaudio services
+  ansible.builtin.file: state=absent path={{ item }}
+  loop:
+    - /etc/systemd/user/default.target.wants/pulseaudio.service
+    - /etc/systemd/user/sockets.target.wants/pulseaudio.socket
+- name: template out configs
+  ansible.builtin.template: src={{ item.src }} dest={{ item.dest }} mode=0644
+  loop:
+    - { src: "pulse-client.conf", dest: "/etc/pulse/client.conf" }
+    - { src: "pulse-daemon.conf", dest: "/etc/pulse/daemon.conf" }
+    - { src: "pulse-default.pa", dest: "/etc/pulse/default.pa" }
+    - { src: "pulseaudio.service", dest: "/etc/systemd/system/pulseaudio.service" }
+- name: assure pulse user
+  ansible.builtin.user: name=pulseaudio password="!" system=yes home=/var/lib/pulse groups=audio
+- name: enable pulse service
+  ansible.builtin.systemd: name=pulseaudio enabled=yes state=started daemon_reload=yes

roles/pulseaudio/templates/pulse-client.conf

@@ -0,0 +1,3 @@
+# {{ ansible_managed }}
+autospawn = no
+default-server = unix:/tmp/pulse-server

roles/pulseaudio/templates/pulse-daemon.conf

@@ -0,0 +1,22 @@
+# See pulse-daemon.conf(5) for more info
+# {{ ansible_managed }}
+
+# Bugfixes for my desktop's audio card
+realtime-scheduling = no # Fixes a weird stutter issue
+
+# Sanity
+flat-volumes = {{ pulse_flat_volumes }}
+
+# Audio Quality
+default-sample-format = {{ pulse_sample_format }} # Pulse does 16bit sampling by default for some reason
+default-sample-rate = {{ pulse_sample_rate }}
+alternate-sample-rate = {{ pulse_sample_rate_alternate }}
+resample-method = {{ pulse_resample_method }} # Increase resampling quality
+avoid-resampling = {{ pulse_resample_avoid }}
+
+default-fragments = {{ pulse_latency_fragments }} # Pulse, why are you so friggin latent by default?
+default-fragment-size-msec = {{ pulse_latency_fragment_size }}
+
+high-priority = {{ pulse_high_priority }}
+nice-level = {{ pulse_nice_level }}
+

roles/pulseaudio/templates/pulse-default.pa

@@ -0,0 +1,77 @@
+#!/usr/bin/pulseaudio -nF
+#!/usr/bin/pulseaudio -nF
+#
+.fail
+
+load-module module-device-restore
+load-module module-stream-restore
+load-module module-card-restore
+load-module module-augment-properties
+### Should be after module-*-restore but before module-*-detect
+load-module module-switch-on-port-available
+### Use hot-plugged devices like Bluetooth or USB automatically (LP: #1702794)
+.ifexists module-switch-on-connect.so
+load-module module-switch-on-connect
+.endif
+
+# Device detection
+.ifexists module-udev-detect.so
+load-module module-udev-detect
+.else
+load-module module-detect
+.endif
+
+# Bluetooth
+.ifexists module-bluetooth-policy.so
+load-module module-bluetooth-policy
+.endif
+.ifexists module-bluetooth-discover.so
+load-module module-bluetooth-discover
+.endif
+
+# Protocols
+.ifexists module-esound-protocol-unix.so
+load-module module-esound-protocol-unix
+.endif
+load-module module-native-protocol-unix auth-group=audio socket=/tmp/pulse-server
+
+# Load GSettings/paprefs modules
+.ifexists module-gsettings.so
+.nofail
+load-module module-gsettings
+.fail
+.endif
+
+load-module module-default-device-restore
+load-module module-always-sink
+load-module module-intended-roles
+load-module module-suspend-on-idle
+
+### If autoexit on idle is enabled we want to make sure we only quit
+### when no local session needs us anymore.
+.ifexists module-console-kit.so
+load-module module-console-kit
+.endif
+.ifexists module-systemd-login.so
+load-module module-systemd-login
+.endif
+
+# Enable positioned event sounds
+load-module module-position-event-sounds
+# Cork music/video streams when a phone stream is active
+load-module module-role-cork
+# Block audio recording for snap confined packages
+.ifexists module-snap-policy.so
+load-module module-snap-policy
+.endif
+
+load-module module-filter-heuristics
+load-module module-filter-apply
+
+## Gets around a weird audio skipping bug on my desktop
+.ifexists module-udev-detect.so
+load-module module-udev-detect tsched=0
+
+## My laptop gets sink suspension popping when using headphones
+unload-module module-suspend-on-idle
+

roles/pulseaudio/templates/pulseaudio.service

@@ -0,0 +1,24 @@
+# vim:ft=systemd
+# NOTE: This service is ONLY useful IF you have the following:
+#  * client.conf is set to not autospawn and listen to a socket instead
+#  * default.pa is configured to start such a socket
+# Using this unit file and complaining to me that it doesn't work without
+# the other configs in place will result in me not giving a shit
+
+## THIS UNIT DOES NOT START PULSE IN SYSTEM MODE
+## THIS UNIT DOES NOT START PULSE IN SYSTEM MODE
+## THIS UNIT DOES NOT START PULSE IN SYSTEM MODE
+## THIS UNIT DOES NOT START PULSE IN SYSTEM MODE
+## THIS UNIT DOES NOT START PULSE IN SYSTEM MODE
+[Unit]
+Description=Pulseaudio sound server
+
+[Service]
+User=pulseaudio
+Group=pulseaudio
+ExecStart=/usr/bin/pulseaudio --disallow-exit
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=always
+
+[Install]
+WantedBy=multi-user.target