70 lines
2.3 KiB
Plaintext
70 lines
2.3 KiB
Plaintext
---
|
|
- name: Развертывание Unprivileged LXC (Финал)
|
|
hosts: localhost
|
|
connection: local
|
|
become: yes
|
|
gather_facts: no
|
|
vars:
|
|
# Конфиг уже включает ID Mapping
|
|
base_conf: |
|
|
lxc.include = /usr/share/lxc/config/common.conf
|
|
lxc.include = /usr/share/lxc/config/debian.common.conf
|
|
lxc.arch = x86_64
|
|
lxc.idmap = u 0 100000 65536
|
|
lxc.idmap = g 0 100000 65536
|
|
lxc.net.0.type = veth
|
|
lxc.net.0.link = br0
|
|
lxc.net.0.flags = up
|
|
lxc.net.0.name = eth0
|
|
|
|
tasks:
|
|
- name: 1. Очистка старых контейнеров
|
|
shell: |
|
|
lxc-stop -n {{ item }} -k || true
|
|
lxc-destroy -n {{ item }} || true
|
|
zfs destroy -r pool/lxc/{{ item }} || true
|
|
loop: [ 'bit-srv-prn', 'mail-bit-it-ru' ]
|
|
failed_when: false
|
|
|
|
- name: 2. Мгновенный клон ZFS (уже с правами 100000)
|
|
shell: "zfs clone pool/lxc/template-debian12@snap0 pool/lxc/{{ item }}"
|
|
loop: [ 'bit-srv-prn', 'mail-bit-it-ru' ]
|
|
|
|
- name: 3. Установка legacy mountpoint
|
|
shell: "zfs set mountpoint=legacy pool/lxc/{{ item }}"
|
|
loop: [ 'bit-srv-prn', 'mail-bit-it-ru' ]
|
|
|
|
- name: 4. Подготовка папок LXC
|
|
file:
|
|
path: "/var/lib/lxc/{{ item }}"
|
|
state: directory
|
|
|
|
|
|
loop: [ 'bit-srv-prn', 'mail-bit-it-ru' ]
|
|
|
|
- name: 5. Права на внешние данные (для почты)
|
|
file:
|
|
path: /pool/bit-mail-data
|
|
owner: "100000"
|
|
group: "100000"
|
|
recurse: yes
|
|
|
|
- name: 6. Запись конфигов
|
|
copy:
|
|
dest: "/var/lib/lxc/{{ item.name }}/config"
|
|
content: |
|
|
{{ base_conf }}
|
|
lxc.net.0.veth.vlan.id = {{ item.vlan }}
|
|
lxc.rootfs.path = zfs:pool/lxc/{{ item.name }}
|
|
lxc.uts.name = {{ item.name }}
|
|
{% if item.mount is defined %}{{ item.mount }}{% endif %}
|
|
loop:
|
|
- { name: 'bit-srv-prn', vlan: '30' }
|
|
- { name: 'mail-bit-it-ru', vlan: '60', mount: 'lxc.mount.entry = /pool/bit-mail-data var/mail none bind,create=dir 0 0' }
|
|
|
|
- name: 7. Запуск
|
|
shell: "lxc-start -n {{ item.name }} -d"
|
|
loop:
|
|
- { name: 'bit-srv-prn' }
|
|
- { name: 'mail-bit-it-ru' }
|