Clément Désiles
118 lines
3.4 KiB
YAML
118 lines
3.4 KiB
YAML
---
|
|
- name: Validate required variables are set
|
|
ansible.builtin.assert:
|
|
that:
|
|
- unifi_bind_address is defined
|
|
- unifi_bind_address | length > 0
|
|
fail_msg: |
|
|
unifi_bind_address is required (IP of the interface to bind to).
|
|
See roles/unifi/defaults/main.yml for configuration instructions.
|
|
success_msg: "Variable validation passed"
|
|
|
|
- name: Create unifi project directory
|
|
ansible.builtin.file:
|
|
path: "{{ podman_projects_dir | default('/opt/podman') }}/unifi"
|
|
state: directory
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0755"
|
|
|
|
- name: Create unifi data directory
|
|
ansible.builtin.file:
|
|
path: "{{ unifi_data_dir }}"
|
|
state: directory
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0755"
|
|
|
|
- name: Pull UniFi container image
|
|
ansible.builtin.command: "podman pull {{ unifi_image }}:{{ unifi_version }}"
|
|
changed_when: pull_result.stdout is search('Writing manifest')
|
|
register: pull_result
|
|
become: false
|
|
become_user: "{{ ansible_user }}"
|
|
|
|
- name: Deploy Kubernetes YAML for unifi
|
|
ansible.builtin.template:
|
|
src: unifi.yaml.j2
|
|
dest: "{{ podman_projects_dir | default('/opt/podman') }}/unifi/unifi.yaml"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0644"
|
|
notify: Restart unifi
|
|
|
|
- name: Get home directory for {{ ansible_user }}
|
|
ansible.builtin.getent:
|
|
database: passwd
|
|
key: "{{ ansible_user }}"
|
|
|
|
- name: Set user home directory fact
|
|
ansible.builtin.set_fact:
|
|
user_home_dir: "{{ ansible_facts['getent_passwd'][ansible_user][4] }}"
|
|
|
|
- name: Create systemd user directory for unifi
|
|
ansible.builtin.file:
|
|
path: "{{ user_home_dir }}/.config/systemd/user"
|
|
state: directory
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0755"
|
|
|
|
- name: Create systemd service for unifi (user scope)
|
|
ansible.builtin.template:
|
|
src: unifi.service.j2
|
|
dest: "{{ user_home_dir }}/.config/systemd/user/unifi.service"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0644"
|
|
notify: Reload systemd user
|
|
|
|
- name: Enable lingering for user {{ ansible_user }}
|
|
ansible.builtin.command: "loginctl enable-linger {{ ansible_user }}"
|
|
when: ansible_user != 'root'
|
|
|
|
- name: Setup firewall rules for UniFi (TCP)
|
|
community.general.ufw:
|
|
rule: allow
|
|
src: "{{ item.0 }}"
|
|
port: "{{ item.1.port }}"
|
|
proto: tcp
|
|
direction: in
|
|
comment: "UniFi {{ item.1.name }}"
|
|
loop: "{{ unifi_firewall_allowed_sources | product(unifi_tcp_ports) }}"
|
|
vars:
|
|
unifi_tcp_ports:
|
|
- { port: "8080", name: "device inform" }
|
|
- { port: "8443", name: "web interface" }
|
|
retries: 5
|
|
delay: 2
|
|
register: ufw_result
|
|
until: ufw_result is succeeded
|
|
|
|
- name: Setup firewall rules for UniFi (UDP)
|
|
community.general.ufw:
|
|
rule: allow
|
|
src: "{{ item.0 }}"
|
|
port: "{{ item.1.port }}"
|
|
proto: udp
|
|
direction: in
|
|
comment: "UniFi {{ item.1.name }}"
|
|
loop: "{{ unifi_firewall_allowed_sources | product(unifi_udp_ports) }}"
|
|
vars:
|
|
unifi_udp_ports:
|
|
- { port: "3478", name: "STUN" }
|
|
- { port: "10001", name: "device discovery" }
|
|
retries: 5
|
|
delay: 2
|
|
register: ufw_result
|
|
until: ufw_result is succeeded
|
|
|
|
- name: Enable and start unifi service (user scope)
|
|
ansible.builtin.systemd:
|
|
name: unifi.service
|
|
enabled: true
|
|
state: started
|
|
scope: user
|
|
become: false
|
|
become_user: "{{ ansible_user }}"
|