provision-proxmox-lxc.yml

---
- name: Preliminary System Checks
  hosts: all
  gather_facts: no
  tasks:
    - name: Verify if target system is Proxmox VE
      ansible.builtin.script: '../../PCSMenu/src/Functions/Proxmox/Scripts/checkProxmox.sh'
      register: proxmox_check
      ignore_errors: yes

    - name: Halt if any target system is not Proxmox VE
      ansible.builtin.fail:
        msg: 'One or more targeted systems are not Proxmox VE. Process halted.'
      when: proxmox_check is failed

- name: Proxmox VE Node Preparation
  hosts: all
  become: yes
  gather_facts: yes
  tasks:
    - name: Update and Refresh apt cache
      ansible.builtin.apt:
        update_cache: yes
        cache_valid_time: 3600

    - name: Ensure Python3 and pip are Installed
      ansible.builtin.apt:
        name:
          - python3
          - python3-pip
        state: present

    - name: Install Proxmox API Utilities
      ansible.builtin.apt:
        name:
          - python3-proxmoxer
          - python3-requests
        state: present

- name: Debian 12 Template Verification and Installation
  hosts: all
  become: yes
  vars_files:
    - /opt/Wolflith/Temp/lxc_provisioning_vars.yml
  tasks:
    - name: Check for Debian 12 Template Presence and Install if Missing
      community.general.proxmox_template:
        node: '{{ node }}'
        api_host: '{{ api_host }}'
        api_user: '{{ api_user }}'
        api_password: '{{ api_password }}'
        storage: '{{ ct_storage }}'
        template: 'debian-12-standard_12.2-1_amd64.tar.zst'
        state: present

- name: LXC Container Provisioning
  hosts: all
  become: yes
  vars_files:
    - /opt/Wolflith/Temp/lxc_provisioning_vars.yml
  tasks:
    - name: Provision LXC Container with Debian 12 Template
      community.general.proxmox:
        api_user: '{{ api_user }}'
        api_password: '{{ api_password }}'
        api_host: '{{ api_host }}'
        node: '{{ node }}'
        hostname: '{{ hostname }}'
        ostemplate: '{{ ct_storage }}:vztmpl/debian-12-standard_12.2-1_amd64.tar.zst'
        password: '{{ lxc_root_password }}'
        cores: '{{ vCPU }}'
        memory: '{{ RAM }}'
        swap: '{{ RAM }}'
        disk: '{{ lxc_storage_name }}:{{ lxc_storage_amount }}'
        netif: '{{ netif }}'
        onboot: true
        unprivileged: true
        state: present
        features:
          - keyctl=1
          - nesting=1
      delegate_to: localhost
      register: provisioning_output

    - name: Extract and Set VMID from Provisioning Output
      set_fact:
        vmid: "{{ provisioning_output.msg | regex_search('VM (\\d+) from template', '\\1') | first }}"
      delegate_to: localhost

    - name: Update VMID in Local Configuration File
      ansible.builtin.lineinfile:
        path: /opt/Wolflith/Temp/lxc_provisioning_vars.yml
        regexp: '^vmid:.*$'
        line: 'vmid: {{ vmid }}'
        backrefs: yes
        create: yes
      delegate_to: localhost

- name: Check for CIFS Share Setup Requirements
  hosts: all
  become: yes
  vars_files:
    - /opt/Wolflith/Temp/lxc_provisioning_vars.yml
  tasks:
    - name: Set fact for CIFS setup based on cifs_share_details presence
      set_fact:
        cifs_setup_required: "{{ 'cifs_share_details' in lookup('file', '/opt/Wolflith/Temp/lxc_provisioning_vars.yml') | from_yaml }}"
      ignore_errors: yes

- name: CIFS Share Setup for LXC Container
  hosts: all
  become: yes
  vars_files:
    - /opt/Wolflith/Temp/provisioning_docker_service_vars.yml
    - /opt/Wolflith/Temp/lxc_provisioning_vars.yml
  tasks:
    - name: Configure LXC and PVE for CIFS share
      block:
        - name: Start LXC Container
          community.general.proxmox:
            api_user: '{{ api_user }}'
            api_password: '{{ api_password }}'
            api_host: '{{ api_host }}'
            node: '{{ node }}'
            vmid: '{{ vmid }}'
            unprivileged: true
            state: started

        - name: Install sudo and add a new user with sudo privileges in the LXC Container
          block:
            - name: Ensure sudo is installed in the LXC Container
              ansible.builtin.shell: |
                pct exec {{ vmid }} -- apt-get update &&
                pct exec {{ vmid }} -- apt-get install -y sudo

            - name: Create a new user with specified username and add to the sudo group
              ansible.builtin.shell: |
                pct exec {{ vmid }} -- useradd -m {{ selected_service }} -s /bin/bash &&
                pct exec {{ vmid }} -- bash -c "echo '{{ selected_service }}:{{ lxc_user_password }}' | chpasswd" &&
                pct exec {{ vmid }} -- usermod -aG sudo {{ selected_service }}
          ignore_errors: yes

        - name: Creating group 'lxc_shares' with GID=110000 in LXC
          ansible.builtin.shell: |
            pct exec {{ vmid }} -- groupadd -g 110000 lxc_shares
          ignore_errors: yes

        - name: Adding user to group 'lxc_shares' in LXC
          ansible.builtin.shell: |
            pct exec {{ vmid }} -- usermod -aG lxc_shares {{ cifs_share_details.lxc_username }}

        - name: Ensure CIFS utilities are installed on the Proxmox host
          ansible.builtin.package:
            name: cifs-utils
            state: present

        - name: Create mount point on PVE host
          ansible.builtin.file:
            path: '/mnt/lxc_shares/{{ cifs_share_details.folder_name }}'
            state: directory

        - name: Transfer the addCifsShare script to the target host
          ansible.builtin.copy:
            src: '../static/addCifsShare.sh'
            dest: '/tmp/addCifsShare.sh'
            mode: '0755'

        - name: Execute the addCifsShare script
          ansible.builtin.shell:
            cmd: >
              /tmp/addCifsShare.sh "{{ cifs_share_details.folder_name }}"
              "{{ cifs_share_details.cifs_host }}"
              "{{ cifs_share_details.share_name }}"
              "{{ cifs_share_details.smb_username }}"
              "{{ cifs_share_details.smb_password }}"
          ignore_errors: true

        - name: Remove the temporary addCifsShare script
          ansible.builtin.file:
            path: '/tmp/addCifsShare.sh'
            state: absent

        - name: Check if CIFS share line exists in LXC config
          ansible.builtin.shell:
            cmd: "grep -q 'mp0: /mnt/lxc_shares/{{ cifs_share_details.folder_name }}' /etc/pve/lxc/{{ vmid }}.conf"
          register: grep_lxc_config
          ignore_errors: true
          changed_when: false

        - name: Add a bind mount of the share to the LXC config if not already present
          ansible.builtin.lineinfile:
            path: '/etc/pve/lxc/{{ vmid }}.conf'
            line: 'mp0: /mnt/lxc_shares/{{ cifs_share_details.folder_name }},mp=/mnt/{{ cifs_share_details.folder_name }},shared=1'
            create: yes
          when: grep_lxc_config.rc != 0
      when: cifs_setup_required

- name: Docker Setup in Provisioned LXC Container
  hosts: all
  become: yes
  vars_files:
    - /opt/Wolflith/Temp/lxc_provisioning_vars.yml
  tasks:
    - name: Start LXC Container Before Docker Setup
      community.general.proxmox:
        api_user: '{{ api_user }}'
        api_password: '{{ api_password }}'
        api_host: '{{ api_host }}'
        node: '{{ node }}'
        vmid: '{{ vmid }}'
        unprivileged: true
        state: started

    - name: Update & Upgrade Packages inside LXC Container
      ansible.builtin.shell: |
        pct exec {{ vmid }} -- apt-get update &&
        pct exec {{ vmid }} -- apt-get upgrade -y

    - name: Install Docker and Dependencies in LXC Container
      ansible.builtin.shell: |
        pct exec {{ vmid }} -- bash -c "\
        export DEBIAN_FRONTEND=noninteractive && \
        apt-get update && \
        apt-get install -y ca-certificates curl gnupg lsb-release && \
        OS_ID=\$(grep ^ID= /etc/os-release | cut -d'=' -f2 | tr -d '\"') && \
        if [ \"\$OS_ID\" = 'ubuntu' ]; then REPO_DISTRO='ubuntu'; \
        elif [ \"\$OS_ID\" = 'debian' ]; then REPO_DISTRO='debian'; \
        elif [ \"\$OS_ID\" = 'raspbian' ]; then REPO_DISTRO='raspbian'; \
        else echo 'Unsupported OS' && exit 1; fi && \
        mkdir -p /etc/apt/keyrings && \
        curl -fsSL https://download.docker.com/linux/\$REPO_DISTRO/gpg -o /etc/apt/keyrings/docker.asc && \
        echo \"deb [arch=\$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/\$REPO_DISTRO \$(. /etc/os-release && echo \"\$VERSION_CODENAME\") stable\" | tee /etc/apt/sources.list.d/docker.list > /dev/null && \
        apt-get update && \
        apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin"

    - name: Reboot LXC Container Post Docker Installation
      community.general.proxmox:
        api_user: '{{ api_user }}'
        api_password: '{{ api_password }}'
        api_host: '{{ api_host }}'
        node: '{{ node }}'
        vmid: '{{ vmid }}'
        unprivileged: true
        state: restarted

- name: Final Configuration and Cleanup
  hosts: all
  become: yes
  vars_files:
    - /opt/Wolflith/Temp/provisioning_docker_service_vars.yml
    - /opt/Wolflith/Temp/lxc_provisioning_vars.yml
  tasks:
    - name: Docker Network and Directory Setup
      block:
        - name: Create Docker Network in the LXC Container
          ansible.builtin.shell: |
            pct exec {{ vmid }} -- docker network create {{ network_name }}
          ignore_errors: yes

        - name: Ensure Host Destination Directory Exists
          ansible.builtin.file:
            path: '/tmp/docker/{{ selected_service }}'
            state: directory
            mode: '0755'

        - name: Ensure LXC Container Destination Directories Exist
          ansible.builtin.shell: |
            pct exec {{ vmid }} -- mkdir -p /home/docker/{{ selected_service }}
            pct exec {{ vmid }} -- mkdir -p /tmp

        - name: Check if .env file exists for docker service
          ansible.builtin.stat:
            path: '{{ selected_service_path }}/.env'
          register: env_file_stat
          delegate_to: localhost

        - name: Set flag for .env file existence
          set_fact:
            env_file_exists: '{{ env_file_stat.stat.exists }}'
          delegate_to: localhost

        - name: Transfer Scripts and Configuration Files to Proxmox Host
          ansible.builtin.copy:
            src: '{{ item.src }}'
            dest: '{{ item.dest }}'
            mode: '0755'
          loop:
            - {
                src: '/opt/Wolflith/PCSMenu/src/Functions/Docker/Scripts/updateDockerComposeEnv.sh',
                dest: '/tmp/updateDockerComposeEnv.sh',
              }
            - {
                src: '/opt/Wolflith/Temp/provisioning_docker_service_vars.yml',
                dest: '/tmp/provisioning_docker_service_vars.yml',
              }
            - {
                src: '{{ selected_service_path }}/docker-compose.yml',
                dest: '/tmp/docker/{{ selected_service }}/docker-compose.yml',
              }

        - name: Transfer .env file to Proxmox Host if it exists
          ansible.builtin.copy:
            src: '{{ selected_service_path }}/.env'
            dest: '/tmp/docker/{{ selected_service }}/.env'
            mode: '0755'
          when: env_file_exists

        - name: Transfer Config Folder to Proxmox Host
          ansible.builtin.copy:
            src: '{{ selected_service_path }}/config/'
            dest: '/tmp/docker/{{ selected_service }}/config/'
            remote_src: yes
            mode: '0755'
            recursive: yes
          ignore_errors: yes

        - name: Push Files into the LXC Container
          ansible.builtin.shell: |
            pct push {{ vmid }} {{ item.src }} {{ item.dest }}
          loop:
            - { src: '/tmp/updateDockerComposeEnv.sh', dest: '/tmp/updateDockerComposeEnv.sh' }
            - {
                src: '/tmp/provisioning_docker_service_vars.yml',
                dest: '/tmp/provisioning_docker_service_vars.yml',
              }
            - {
                src: '/tmp/docker/{{ selected_service }}/docker-compose.yml',
                dest: '/home/docker/{{ selected_service }}/docker-compose.yml',
              }

        - name: Push .env file into the LXC Container if it exists
          ansible.builtin.shell:
            cmd: "pct push {{ vmid }} '/tmp/docker/{{ selected_service }}/.env' '/home/docker/{{ selected_service }}/.env'"
          when: env_file_exists

        - name: Find config files and directories to push
          ansible.builtin.find:
            paths: '/tmp/docker/{{ selected_service }}/config'
            recurse: yes
          register: config_files_and_dirs
          ignore_errors: yes

        - name: Ensure corresponding directories exist in the LXC Container
          ansible.builtin.shell: |
            pct exec {{ vmid }} -- mkdir -p /home/docker/{{ selected_service }}/config/{{ item.path | regex_replace('^/tmp/docker/{{ selected_service }}/config/','') | dirname }}
          loop: '{{ config_files_and_dirs.files }}'
          when: item.isdir
          ignore_errors: yes

        - name: Push Config files into the LXC Container
          ansible.builtin.shell: |
            pct push {{ vmid }} '{{ item.path }}' '/home/docker/{{ selected_service }}/config/{{ item.path | regex_replace('^/tmp/docker/{{ selected_service }}/config/','') }}'
          loop: '{{ config_files_and_dirs.files }}'
          when: item.isdir == false
          ignore_errors: yes

        - name: Script Execution and Docker Service Deployment
          block:
            - name: Set Execute Permission for the Script Inside LXC Container
              ansible.builtin.shell: |
                pct exec {{ vmid }} -- chmod +x /tmp/updateDockerComposeEnv.sh

            - name: Execute Script Inside LXC to update Docker Compose file
              ansible.builtin.shell: |
                pct exec {{ vmid }} -- bash -c "cd /tmp && ./updateDockerComposeEnv.sh {{ selected_service }}"

            - name: Deploy Docker Compose Service Inside LXC Container
              ansible.builtin.shell: |
                pct exec {{ vmid }} -- bash -c "cd /home/docker/{{ selected_service }} && docker compose up -d"

        - name: Cleanup Temporary Files and Directories
          block:
            - name: Remove Temporary Files from Proxmox Host
              ansible.builtin.file:
                path: '{{ item }}'
                state: absent
              loop:
                - '/tmp/updateDockerComposeEnv.sh'
                - '/tmp/docker'

            - name: Remove Temporary Files from LXC Container
              ansible.builtin.shell: |
                pct exec {{ vmid }} -- rm -f /tmp/{{ item }}
              loop:
                - 'updateDockerComposeEnv.sh'
                - 'provisioning_docker_service_vars.yml'