Use the .yaml file extension for all YAML files

collections/requirements.yaml

@@ -0,0 +1,3 @@
+---
+collections:
+ - community.general

inventories/z9/host_vars/audio.yaml

@@ -0,0 +1,3 @@
+hifiberry__device: hifiberry-dac
+bluetooth_audio_sink__name: Audio Pi
+shairport_sync__config: "{{ lookup('ansible.builtin.file', 'configs/audio/shairport-sync/shairport-sync.conf') }}"

inventories/z9/host_vars/automation.yaml

@@ -0,0 +1,4 @@
+mosquitto__mosquitto_conf_content: "{{ lookup('ansible.builtin.file', 'configs/automation/mosquitto/mosquitto.conf') }}"
+mosquitto__configs:
+  - name: winkekatz
+    content: "{{ lookup('ansible.builtin.file', 'configs/automation/mosquitto/winkekatz.conf') }}"

inventories/z9/host_vars/esphome.yaml

@@ -0,0 +1,5 @@
+esphome__version: "2023.3.2"
+nginx__version_spec: ""
+nginx__configurations:
+  - name: esphome
+    content: "{{ lookup('ansible.builtin.file', 'configs/esphome/nginx/esphome.conf') }}"

inventories/z9/host_vars/light.yaml

@@ -0,0 +1,57 @@
+ola__configs:
+  - name: ola-artnet
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-artnet.conf') }}"
+  - name: ola-dummy
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-dummy.conf') }}"
+  - name: ola-e131
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-e131.conf') }}"
+  - name: ola-espnet
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-espnet.conf') }}"
+  - name: ola-ftdidmx
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-ftdidmx.conf') }}"
+  - name: ola-gpio
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-gpio.conf') }}"
+  - name: ola-karate
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-karate.conf') }}"
+  - name: ola-kinet
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-kinet.conf') }}"
+  - name: ola-milinst
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-milinst.conf') }}"
+  - name: ola-opendmx
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-opendmx.conf') }}"
+  - name: ola-openpixelcontrol
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-openpixelcontrol.conf') }}"
+  - name: ola-osc
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-osc.conf') }}"
+  - name: ola-pathport
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-pathport.conf') }}"
+  - name: ola-port
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-port.conf') }}"
+  - name: ola-renard
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-renard.conf') }}"
+  - name: ola-sandnet
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-sandnet.conf') }}"
+  - name: ola-server
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-server.conf') }}"
+  - name: ola-shownet
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-shownet.conf') }}"
+  - name: ola-spi
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-spi.conf') }}"
+  - name: ola-stageprofi
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-stageprofi.conf') }}"
+  - name: ola-uartdmx
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-uartdmx.conf') }}"
+  - name: ola-universe
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-universe.conf') }}"
+  - name: ola-usbdmx
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-usbdmx.conf') }}"
+  - name: ola-usbserial
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-usbserial.conf') }}"
+foobazdmx__art_net_host: localhost
+nginx__version_spec: ""
+nginx__deploy_redirect_conf: false
+nginx__configurations:
+  - name: light.ccchh.net
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/nginx/light.ccchh.net.conf') }}"
+  - name: http_handler
+    content: "{{ lookup('ansible.builtin.file', 'configs/light/nginx/http_handler.conf') }}"

inventories/z9/host_vars/wiki.yaml

@@ -0,0 +1,13 @@
+nginx__version_spec: ""
+nginx__deploy_redirect_conf: false
+nginx__configurations:
+  - name: http_handler
+    content: "{{ lookup('ansible.builtin.file', 'configs/wiki/nginx/http_handler.conf') }}"
+  - name: wiki.ccchh.net
+    content: "{{ lookup('ansible.builtin.file', 'configs/wiki/nginx/wiki.ccchh.net.conf') }}"
+
+cert__acme_account_email: j+letsencrypt-ccchh@jsts.xyz
+cert__domains:
+  - "wiki.ccchh.net"
+cert__bind_9_host: authoritative-dns
+cert__bind_9_zone: ccchh.net

inventories/z9/host_vars/zigbee2mqtt.yaml

@@ -0,0 +1,16 @@
+zigbee2mqtt__version: "1.30.3"
+zigbee2mqtt__network_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          61633839396136633962393266643139333961613566396231343061383363393132393333313230
+          6461656564363565623730353138613537643266323438390a363937616136353334333732366233
+          65316234656235333931373135366665353763393439633866373336656266363761383262386534
+          6461396438316236340a323365373739633235356266653864366434386234653235333036346235
+          33633834326534313965626231336633623036613433306436613038363333306432393662653737
+          63343465333062636637313130306434623565623561303835303934306239623035323333323333
+          30303031306635313764323434333465353465366633376432326563666264386431623335613636
+          64643434666433363865
+zigbee2mqtt__config: "{{ lookup('ansible.builtin.template', 'configs/zigbee2mqtt/zigbee2mqtt/configuration.yaml.j2') }}"
+nginx__version_spec: ""
+nginx__configurations:
+  - name: zigbee2mqtt
+    content: "{{ lookup('ansible.builtin.file', 'configs/zigbee2mqtt/nginx/zigbee2mqtt.conf') }}"

inventories/z9/hosts.yaml

@@ -0,0 +1,29 @@
+all:
+  children:
+    debian_11:
+      hosts:
+        light:
+          ansible_host: light.z9.ccchh.net
+          ansible_user: root
+        automation:
+          ansible_host: automation.z9.ccchh.net
+        esphome:
+          ansible_host: esphome.z9.ccchh.net
+        zigbee2mqtt:
+          ansible_host: zigbee2mqtt.z9.ccchh.net
+        printserver:
+          ansible_host: printserver.z9.ccchh.net
+        audio:
+          ansible_host: audio.z9.ccchh.net
+        public-reverse-proxy:
+          ansible_host: public-reverse-proxy.z9.ccchh.net
+          ansible_user: chaos
+        wiki:
+          ansible_host: wiki.z9.ccchh.net
+          ansible_user: chaos
+        authoritative-dns:
+          ansible_host: authoritative-dns.z9.ccchh.net
+          ansible_user: chaos
+        keycloak:
+          ansible_host: keycloak.z9.ccchh.net
+          ansible_user: chaos

playbooks/deploy_audio_pi.yaml

@@ -0,0 +1,8 @@
+---
+- name: Configure audio.z9 as a bluetooth audio sink and AirPlay server
+  become: true
+  hosts: audio
+  roles:
+    - hifiberry
+    - bluetooth_audio_sink
+    - shairport_sync

playbooks/deploy_automation.yaml

@@ -0,0 +1,6 @@
+---
+- name: Deploy mosquitto MQTT broker on automation.z9
+  become: true
+  hosts: automation
+  roles:
+    - mosquitto

playbooks/deploy_dokuwiki.yaml

@@ -0,0 +1,39 @@
+---
+- name: Configure wiki.z9 with dokuwiki
+  become: true
+  hosts: wiki
+  roles:
+    - nginx
+    - cert
+  tasks:
+    # TODO: make this a role
+    - name: Install php-fpm
+      ansible.builtin.apt:
+        name:
+          - php-fpm
+          - php-xml
+          - php-mbstring
+          - php-zip
+          - php-intl
+          - php-gd
+      diff: false
+    - name: Make sure php-fpm is enabled
+      ansible.builtin.systemd:
+        service: php7.4-fpm.service
+        enabled: true
+
+    # place dokuwiki zip into /var/www/dokuwiki manually!
+    - name: Create www dir
+      become: true
+      ansible.builtin.file:
+        path: /var/www
+        state: directory
+        owner: nginx
+        group: nginx
+        mode: "0755"
+    - name: Custom php-fpm config
+      become: true
+      ansible.builtin.copy:
+        src: configs/wiki/php-fpm-dokuwiki.conf
+        dest: /etc/php/7.4/fpm/pool.d/dokuwiki.conf
+        mode: "0755"

playbooks/deploy_esphome.yaml

@@ -0,0 +1,7 @@
+---
+- name: Deploy esphome on esphome.z9
+  become: true
+  hosts: esphome
+  roles:
+    - esphome
+    - nginx

playbooks/deploy_light.yaml

@@ -0,0 +1,8 @@
+---
+- name: Deploy ola and foobazdmx on light.z9
+  become: true
+  hosts: light
+  roles:
+    - ola
+    - foobazdmx
+    - nginx

playbooks/deploy_zigbee2mqtt.yaml

@@ -0,0 +1,7 @@
+---
+- name: Deploy zigbee2mqtt on zigbee2mqtt.z9
+  become: true
+  hosts: zigbee2mqtt
+  roles:
+    - zigbee2mqtt
+    - nginx

playbooks/roles/add_apt_repository/meta/argument_specs.yaml

@@ -0,0 +1,25 @@
+---
+argument_specs:
+  main:
+    short_description: Add a 3rd party apt repository to the system
+    options:
+      add_apt_repository__https_repo:
+        description: The repository URL uses HTTPS
+        required: true
+        type: bool
+      add_apt_repository__keyring_url:
+        description: URL to the repository's keyring
+        required: false
+        type: str
+      add_apt_repository__keyring_path:
+        description: Path where to store the keyring
+        required: false
+        type: str
+      add_apt_repository__repo:
+        description: The apt source line
+        required: true
+        type: str
+      add_apt_repository__filename:
+        description: Filename in /etc/apt/sources.list.d/
+        required: true
+        type: str

playbooks/roles/add_apt_repository/tasks/main.yaml

@@ -0,0 +1,25 @@
+---
+- name: Check OS family
+  ansible.builtin.fail:
+    msg: "Can only add apt repositories on Debian-based systems!"
+  when: ansible_facts.os_family != "Debian"
+- name: Install required apt packages for adding an apt repository
+  ansible.builtin.apt:
+    name:
+      - ca-certificates
+      - gnupg
+- name: Install apt-transport-https if https repository
+  ansible.builtin.apt:
+    name: apt-transport-https
+  when: add_apt_repository__https_repo
+- name: Add repository signing key to keychain
+  when: add_apt_repository__keyring_url is defined and add_apt_repository__keyring_path is defined
+  ansible.builtin.apt_key:
+    url: "{{ add_apt_repository__keyring_url }}"
+    keyring: "{{ add_apt_repository__keyring_path }}"
+    state: present
+- name: Add repository and update cache
+  ansible.builtin.apt_repository:
+    repo: "{{ add_apt_repository__repo }}"
+    filename: "{{ add_apt_repository__filename }}"
+    update_cache: true

playbooks/roles/bluetooth_audio_sink/handlers/main.yaml

@@ -0,0 +1,14 @@
+---
+- name: Restart bluetooth service
+  ansible.builtin.systemd:
+    service: bluetooth.service
+    state: restarted
+- name: Restart speaker-agent service
+  become_user: audiosink
+  ansible.builtin.systemd:
+    service: speaker-agent.service
+    state: restarted
+    scope: user
+    daemon_reload: true
+- name: Reboot host
+  ansible.builtin.reboot:

playbooks/roles/bluetooth_audio_sink/meta/argument_specs.yaml

@@ -0,0 +1,8 @@
+---
+argument_specs:
+  main:
+    options:
+      bluetooth_audio_sink__name:
+        description: Name the bluetooth device should have
+        type: str
+        required: true

playbooks/roles/bluetooth_audio_sink/meta/main.yaml

@@ -0,0 +1,8 @@
+---
+dependencies:
+  - role: distribution_check
+    vars:
+      distribution_check__supported_distributions:
+        - name: Debian
+          versions:
+            - "11"

playbooks/roles/bluetooth_audio_sink/tasks/main.yaml

@@ -0,0 +1,141 @@
+---
+- name: Ensure acl is installed
+  ansible.builtin.apt:
+    name: acl
+- name: Ensure machine-info file is deployed
+  ansible.builtin.template:
+    src: machine-info.j2
+    dest: /etc/machine-info
+    mode: 0644
+    owner: root
+    group: root
+  notify: Restart bluetooth service
+- name: Ensure bluetooth config is deployed
+  ansible.builtin.template:
+    src: main.conf.j2
+    dest: /etc/bluetooth/main.conf
+    mode: 0644
+    owner: root
+    group: root
+  notify: Restart bluetooth service
+- name: Ensure bluetooth service is enabled and started
+  ansible.builtin.systemd:
+    service: bluetooth.service
+    state: started
+    enabled: true
+- name: Ensure audiosink user exists
+  ansible.builtin.user:
+    name: audiosink
+    groups:
+      - audio
+- name: Ensure user services are started without needing to login
+  ansible.builtin.command:
+    cmd: loginctl enable-linger audiosink
+  changed_when: false
+- name: Detect if on Raspberry Pi # noqa ignore-errors
+  ansible.builtin.include_role:
+    name: raspberry_pi_check
+  ignore_errors: true
+- name: Ensure debian archive keyring is installed # noqa no-handler
+  when: raspberry_pi_check__cpuinfo.found
+  ansible.builtin.apt:
+    deb: https://ftp.debian.org/debian/pool/main/d/debian-archive-keyring/debian-archive-keyring_2021.1.1_all.deb
+- name: Ensure debian backports repository is enabled
+  ansible.builtin.include_role:
+    name: add_apt_repository
+  vars:
+    add_apt_repository__https_repo: false
+    add_apt_repository__repo: "deb http://deb.debian.org/debian {{ ansible_facts.lsb.codename }}-backports main contrib non-free"
+    add_apt_repository__filename: "{{ ansible_facts.lsb.codename }}-backports.list"
+- name: Ensure pipewire, wireplumber and libspa-0.2-bluetooth are installed
+  ansible.builtin.apt:
+    name:
+      - pipewire
+      - wireplumber
+      - libspa-0.2-bluetooth
+    default_release: "{{ ansible_facts.lsb.codename }}-backports"
+- name: Ensure pipewire user service is enabled and started
+  become_user: audiosink
+  ansible.builtin.systemd:
+    name: pipewire.service
+    state: started
+    enabled: true
+    scope: user
+- name: Ensure pipewire-pulse user service is enabled and started
+  become_user: audiosink
+  ansible.builtin.systemd:
+    name: pipewire-pulse.service
+    state: started
+    enabled: true
+    scope: user
+- name: Ensure wireplumber user service is enabled
+  become_user: audiosink
+  ansible.builtin.systemd:
+    name: wireplumber.service
+    enabled: true
+    scope: user
+- name: Ensure speaker-agent dependencies are installed
+  ansible.builtin.apt:
+    name:
+      - git
+      - python3-dbus
+- name: Ensure speaker-agent repository is cloned
+  ansible.builtin.git:
+    repo: https://github.com/fdanis-oss/pw_wp_bluetooth_rpi_speaker.git
+    dest: /opt/speaker-agent
+    version: 9a939a23865ea020816017e06fd2290f301c35f9
+- name: Ensure .config directory exists
+  become_user: audiosink
+  ansible.builtin.file:
+    path: /home/audiosink/.config
+    state: directory
+    mode: 0700
+    owner: audiosink
+    group: audiosink
+- name: Ensure .config/systemd directory exists
+  become_user: audiosink
+  ansible.builtin.file:
+    path: /home/audiosink/.config/systemd
+    state: directory
+    mode: 0755
+    owner: audiosink
+    group: audiosink
+- name: Ensure .config/systemd/user directory exists
+  become_user: audiosink
+  ansible.builtin.file:
+    path: /home/audiosink/.config/systemd/user
+    state: directory
+    mode: 0755
+    owner: audiosink
+    group: audiosink
+- name: Ensure speaker-agent service file is deployed
+  become_user: audiosink
+  ansible.builtin.copy:
+    src: speaker-agent.service
+    dest: /home/audiosink/.config/systemd/user/speaker-agent.service
+    mode: 0644
+    owner: audiosink
+    group: audiosink
+  notify: Restart speaker-agent service
+- name: Ensure speaker-agent service is enabled and started
+  become_user: audiosink
+  ansible.builtin.systemd:
+    name: speaker-agent.service
+    state: started
+    enabled: true
+    scope: user
+# This part is janky, but I don't know how to make the bluetooth service, wireplumber and pipewire
+# work with each other without being logged in.
+- name: Ensure getty@tty1 override file is deployed
+  ansible.builtin.copy:
+    src: override.conf
+    dest: /etc/systemd/system/getty@tty1.service.d/override.conf
+    mode: 0644
+    owner: root
+    group: root
+  notify: Reboot host
+- name: Ensure autologin for audiosink user is enabled
+  ansible.builtin.systemd:
+    service: getty@tty1.service
+    enabled: true
+  notify: Reboot host