diff --git a/README.md b/README.md index 6257a9c..f2cf65a 100644 --- a/README.md +++ b/README.md @@ -6,10 +6,13 @@ Pis (audio players, sensors, music mouse, etc.) plus one home server. ## Layout - `inventory.yml` — hosts and group vars (Pis under `iot`, plus `server`). -- `full.yml`, `working.yml`, `server.yml`, `newrpi-provisioning.yml`, - `octopisetup.yml` — top-level playbooks. `full.yml` is the closest thing to - a canonical "apply everything" playbook; the others are narrower/ad-hoc - runs kept around for specific hosts or one-off tasks. + `group_vars/` and `host_vars/` hold vars for the `mediapis` group (the four + parallel audio-player Pis) and their host-specific overrides. +- `mediapis.yml`, `working.yml`, `server.yml`, `newrpi-provisioning.yml`, + `octopisetup.yml` — top-level playbooks. `mediapis.yml` is the canonical + playbook for the `mediapis` group (`musikserverwohnzimmeroben`, `kitchenpi`, + `bedroompi`, `musicmouse`); the others are narrower/ad-hoc runs kept around + for specific hosts or one-off tasks. - `roles/` — one role per piece of functionality (audio backends, sensors, bluetooth monitoring, server basics, etc.). Each has a short `README.md`. - `update-packages.yml` — deliberate, fleet-wide package update (see @@ -41,7 +44,7 @@ password. ## Running a playbook ``` -ansible-playbook full.yml --limit +ansible-playbook mediapis.yml --limit ``` `ansible.cfg` points Ansible at `inventory.yml` and `roles/` by default, so @@ -49,13 +52,13 @@ no extra flags are needed for those. ## Keeping packages up to date -Regular playbook runs (`full.yml`, `server.yml`, etc.) use `state: present` +Regular playbook runs (`mediapis.yml`, `server.yml`, etc.) use `state: present` for packages, so they only install what's missing — they never upgrade anything as a side effect of an unrelated config change. Two separate, deliberate mechanisms handle upgrades instead: **Security patches — automatic.** The `unattended_upgrades` role (applied -to every host in `full.yml`/`server.yml`) configures `unattended-upgrades` +to every host in `mediapis.yml`/`server.yml`) configures `unattended-upgrades` to install security-origin updates automatically, with a scheduled reboot window (default 03:00, see `roles/unattended_upgrades/defaults/main.yml`) for patches that need one. Not scoped to full dist-upgrades. diff --git a/ansible.cfg b/ansible.cfg index 0671520..52003f8 100644 --- a/ansible.cfg +++ b/ansible.cfg @@ -2,5 +2,5 @@ inventory = inventory.yml roles_path = roles lookup_plugins = lookup_plugins -forks = 5 -strategy = free \ No newline at end of file +#strategy = free +serial = 5 \ No newline at end of file diff --git a/full.yml b/full.yml deleted file mode 100644 index 0e84b05..0000000 --- a/full.yml +++ /dev/null @@ -1,70 +0,0 @@ ---- -# - hosts: esszimmerradio -# roles: -# - pi_standard_setup -# - pi_squeezelite_custom -# - pi_shairport -# - pi_lirc -# - pi_sispmctl -# - -- name: Musikserver Wohnzimmer oben - hosts: musikserverwohnzimmeroben - roles: - - unattended_upgrades - - pi_modern_shell_env - - pi_standard_setup - - pi_hifiberry_amp - - pi_squeezelite_custom - - pi_shairport - - pi_irserver - - pi_dhtsensor - -- name: Kitchen pi - hosts: kitchenpi - roles: - - unattended_upgrades - - pi_modern_shell_env - - pi_standard_setup - - pi_hifiberry_amp - - pi_squeezelite_custom - - pi_shairport - - pi_lirc - - pi_dhtsensor - - pi_disable_onboard_bluetooth - - bluetooth_monitor - -- name: Bedroom pi - hosts: bedroompi - roles: - - unattended_upgrades - - pi_modern_shell_env - - pi_standard_setup - - pi_squeezelite_custom - - pi_shairport - - pi_lirc - - pi_dhtsensor - - pi_disable_onboard_bluetooth - - bluetooth_monitor - -- name: Musicmouse - hosts: musicmouse - roles: - - unattended_upgrades - - pi_modern_shell_env - - pi_standard_setup - - pi_hifiberry_amp - - pi_musicmouse - - pi_squeezelite_custom - - pi_shairport - - pi_lirc - - bluetooth_monitor - -# - hosts: octopi -# roles: -# - pi_dhtsensor - -# - hosts: newrpi -# roles: -# - pi_standard_setup -# - pi_lirc diff --git a/group_vars/mediapis.yml b/group_vars/mediapis.yml new file mode 100644 index 0000000..b71e1e0 --- /dev/null +++ b/group_vars/mediapis.yml @@ -0,0 +1,7 @@ +--- +mediapi_has_hifiberry_amp: false +mediapi_ir_control: lirc +mediapi_has_dhtsensor: false +mediapi_disable_onboard_bluetooth: false +mediapi_install_bluetooth_monitor: false +mediapi_install_kidsmusic: false diff --git a/host_vars/bedroompi.yml b/host_vars/bedroompi.yml new file mode 100644 index 0000000..8ea6497 --- /dev/null +++ b/host_vars/bedroompi.yml @@ -0,0 +1,13 @@ +--- +squeezelite_name: BedroomPi +pi_shairport_name: BedroomPi +alsa_card_name: Codec +sensor_room_name_ascii: schlafzimmer +sensor_room_name: Schlafzimmer +my_bt_monitor_watchdog_seconds: 600 +my_btmonitor_restart_ble_interface: hci0 +main_user: root + +mediapi_has_dhtsensor: true +mediapi_disable_onboard_bluetooth: true +mediapi_install_bluetooth_monitor: true diff --git a/host_vars/kitchenpi.yml b/host_vars/kitchenpi.yml new file mode 100644 index 0000000..6eaa91b --- /dev/null +++ b/host_vars/kitchenpi.yml @@ -0,0 +1,13 @@ +--- +squeezelite_name: KitchenPi +pi_shairport_name: KitchenPi +alsa_card_name: 0 +sensor_room_name_ascii: kueche +sensor_room_name: Küche +hifiberry_overlay: hifiberry-amp +main_user: root + +mediapi_has_hifiberry_amp: true +mediapi_has_dhtsensor: true +mediapi_disable_onboard_bluetooth: true +mediapi_install_bluetooth_monitor: true diff --git a/host_vars/musicmouse.yml b/host_vars/musicmouse.yml new file mode 100644 index 0000000..64ebb20 --- /dev/null +++ b/host_vars/musicmouse.yml @@ -0,0 +1,12 @@ +--- +squeezelite_name: MusicMouse +pi_shairport_name: MusicMouse +alsa_card_name: sndrpihifiberry +hifiberry_overlay: hifiberry-dacplus +sensor_room_name: Kinderzimmer +sensor_room_name_ascii: kinderzimmer +main_user: root + +mediapi_has_hifiberry_amp: true +mediapi_install_bluetooth_monitor: true +mediapi_install_kidsmusic: true diff --git a/host_vars/musikserverwohnzimmeroben.yml b/host_vars/musikserverwohnzimmeroben.yml new file mode 100644 index 0000000..026d967 --- /dev/null +++ b/host_vars/musikserverwohnzimmeroben.yml @@ -0,0 +1,12 @@ +--- +squeezelite_name: Wohnzimmer +pi_shairport_name: _Oben_Wohnzimmer +alsa_card_name: sndrpihifiberry +sensor_room_name_ascii: wohnzimmeroben +sensor_room_name: WohnzimmerOben +hifiberry_overlay: hifiberry-dacplus +main_user: root + +mediapi_has_hifiberry_amp: true +mediapi_ir_control: irserver +mediapi_has_dhtsensor: true diff --git a/inventory.yml b/inventory.yml index 584ab23..1021d3b 100644 --- a/inventory.yml +++ b/inventory.yml @@ -13,23 +13,6 @@ all: sensor_room_name: prusaprinter pi_dhtsensor_dht_pin: 26 main_user: root - bedroompi: - squeezelite_name: BedroomPi - pi_shairport_name: BedroomPi - alsa_card_name: Codec - sensor_room_name_ascii: schlafzimmer - sensor_room_name: Schlafzimmer - my_bt_monitor_watchdog_seconds: 600 - my_btmonitor_restart_ble_interface: hci0 - main_user: root - kitchenpi: - squeezelite_name: KitchenPi - pi_shairport_name: KitchenPi - alsa_card_name: 0 - sensor_room_name_ascii: kueche - sensor_room_name: Küche - hifiberry_overlay: hifiberry-amp - main_user: root esszimmerradio: # oben, eltern squeezelite_name: Esszimmer pi_shairport_name: _Oben_Esszimmer @@ -38,22 +21,6 @@ all: configure_wifi: true alsa_card_name: 1 main_user: root - musikserverwohnzimmeroben: # oben, eltern - squeezelite_name: Wohnzimmer - pi_shairport_name: _Oben_Wohnzimmer - alsa_card_name: sndrpihifiberry - sensor_room_name_ascii: wohnzimmeroben - sensor_room_name: WohnzimmerOben - hifiberry_overlay: hifiberry-dacplus - main_user: root - musicmouse: - squeezelite_name: MusicMouse - pi_shairport_name: MusicMouse - alsa_card_name: sndrpihifiberry - hifiberry_overlay: hifiberry-dacplus - sensor_room_name: Kinderzimmer - sensor_room_name_ascii: kinderzimmer - main_user: root newrpi: squeezelite_name: MyTestRaspberry pi_shairport_name: MyTestRaspberry @@ -70,9 +37,17 @@ all: homeassistant: sensor_room_name: Anschlussraum sensor_room_name_ascii: anschlussraum + children: + mediapis: + hosts: + musikserverwohnzimmeroben: + kitchenpi: + bedroompi: + musicmouse: vars: ansible_user: root ansible_python_interpreter: /usr/bin/python3 + ansible_ssh_common_args: "-o ForwardAgent=yes" pi_squeezelite_squeezeserver: 192.168.178.80 router_ip: 192.168.178.1 home_assistant_url: https://ha.bauer.tech diff --git a/justfile b/justfile index 5cf4ec4..7c1e0e1 100644 --- a/justfile +++ b/justfile @@ -22,7 +22,7 @@ ping group="all": inventory: {{venv_bin}}/ansible-inventory --graph -# Syntax-check a playbook, e.g. `just syntax full.yml` +# Syntax-check a playbook, e.g. `just syntax mediapis.yml` syntax playbook: {{venv_bin}}/ansible-playbook {{playbook}} --syntax-check @@ -30,13 +30,13 @@ syntax playbook: check playbook limit="all": {{venv_bin}}/ansible-playbook {{playbook}} --limit {{limit}} --check --diff -# Run a playbook against a host/group, e.g. `just run full.yml kitchenpi` +# Run a playbook against a host/group, e.g. `just run mediapis.yml kitchenpi` run playbook limit="all": {{venv_bin}}/ansible-playbook {{playbook}} --limit {{limit}} -# Run full.yml (pi roles) against one host/group, e.g. `just full kitchenpi` -full limit="all": - just run full.yml {{limit}} +# Run mediapis.yml (pi roles) against one host/group, e.g. `just mediapis kitchenpi` +mediapis limit="all": + just run mediapis.yml {{limit}} # Run server.yml against the server host server: diff --git a/mediapis.yml b/mediapis.yml new file mode 100644 index 0000000..36f81f0 --- /dev/null +++ b/mediapis.yml @@ -0,0 +1,23 @@ +--- +- name: Media Pis (squeezelite/shairport audio players) + hosts: mediapis + roles: + - unattended_upgrades + - pi_modern_shell_env + - pi_standard_setup + - role: pi_hifiberry_amp + when: mediapi_has_hifiberry_amp + - role: pi_musicmouse + when: mediapi_install_kidsmusic + - pi_squeezelite_custom + - pi_shairport + - role: pi_irserver + when: mediapi_ir_control == 'irserver' + - role: pi_lirc + when: mediapi_ir_control == 'lirc' + - role: pi_dhtsensor + when: mediapi_has_dhtsensor + - role: pi_disable_onboard_bluetooth + when: mediapi_disable_onboard_bluetooth + - role: bluetooth_monitor + when: mediapi_install_bluetooth_monitor diff --git a/roles/pi_modern_shell_env/defaults/main.yml b/roles/pi_modern_shell_env/defaults/main.yml index 9e66c53..58d72f0 100644 --- a/roles/pi_modern_shell_env/defaults/main.yml +++ b/roles/pi_modern_shell_env/defaults/main.yml @@ -12,9 +12,14 @@ pi_modern_shell_env_packages: - tmux - curl -# oh-my-posh isn't packaged in apt; installed via the official script -# instead, matching the prompt used in ~/nixconfig's home-manager setup. -pi_modern_shell_env_ohmyposh_install_url: https://ohmyposh.dev/install.sh +# oh-my-posh isn't packaged in apt; the binary is fetched directly from its +# CDN instead (see tasks/main.yml for why we don't use the official install +# script), matching the prompt used in ~/nixconfig's home-manager setup. +pi_modern_shell_env_ohmyposh_arch_map: + x86_64: amd64 + aarch64: arm64 + armv6l: arm + armv7l: arm pi_modern_shell_env_target_user: "{{ main_user | default('root') }}" diff --git a/roles/pi_modern_shell_env/tasks/main.yml b/roles/pi_modern_shell_env/tasks/main.yml index be6dd7a..63f722a 100644 --- a/roles/pi_modern_shell_env/tasks/main.yml +++ b/roles/pi_modern_shell_env/tasks/main.yml @@ -17,17 +17,17 @@ dest: /usr/local/bin/bat state: link -- name: Download oh-my-posh install script +- name: Download oh-my-posh binary ansible.builtin.get_url: - url: "{{ pi_modern_shell_env_ohmyposh_install_url }}" - dest: /tmp/ohmyposh-install.sh + # The official install script's own curl-based downloads are blocked by + # oh-my-posh's CDN on some devices (observed on Raspberry Pi OS's curl + # build: TLS handshake fails with SSL_ERROR_SYSCALL), while Ansible's + # get_url (Python urllib) succeeds against the same CDN. Download the + # binary directly instead of shelling out to the install script. + url: "https://cdn.ohmyposh.dev/releases/latest/posh-linux-{{ pi_modern_shell_env_ohmyposh_arch_map[ansible_architecture] }}" + dest: /usr/local/bin/oh-my-posh mode: "0755" -- name: Run oh-my-posh install script - ansible.builtin.command: - cmd: /tmp/ohmyposh-install.sh -d /usr/local/bin - creates: /usr/local/bin/oh-my-posh - - name: Determine target user's home directory ansible.builtin.set_fact: pi_modern_shell_env_target_home: "{{ '/root' if pi_modern_shell_env_target_user == 'root' else '/home/' + pi_modern_shell_env_target_user }}"