Restructure: move infra packages to root level

ansible-push/playbooks/roles/lxc_common/tasks/main.yml

@@ -0,0 +1,69 @@
+- name: Ensure apt cache is updated
+  ansible.builtin.apt:
+    update_cache: yes
+    cache_valid_time: 3600
+  become: true
+  no_log: true
+  when: ansible_os_family == "Debian"
+
+- name: Install git
+  ansible.builtin.apt:
+    name: git
+    state: present
+  become: true
+  no_log: true
+  when: ansible_os_family == "Debian"
+
+- name: Install Python pip (needed for ansible via pip)
+  ansible.builtin.apt:
+    name: python3-pip
+    state: present
+  become: true
+  no_log: true
+  when: ansible_os_family == "Debian"
+
+- name: Create jarvis user with UID 1000
+  ansible.builtin.user:
+    name: jarvis
+    uid: 1000
+    shell: /bin/bash
+    create_home: true
+    groups: sudo
+    append: true
+  become: true
+
+- name: Ensure jarvis .ssh directory exists
+  ansible.builtin.file:
+    path: /home/jarvis/.ssh
+    state: directory
+    owner: jarvis
+    group: jarvis
+    mode: "0700"
+  become: true
+
+- name: Copy root authorized_keys to jarvis
+  ansible.builtin.copy:
+    src: /root/.ssh/authorized_keys
+    dest: /home/jarvis/.ssh/authorized_keys
+    owner: jarvis
+    group: jarvis
+    mode: "0600"
+    remote_src: true
+  become: true
+
+- name: Ensure jarvis has passwordless sudo
+  ansible.builtin.lineinfile:
+    path: /etc/sudoers.d/jarvis
+    line: "jarvis ALL=(ALL) NOPASSWD:ALL"
+    create: true
+    mode: "0440"
+    validate: "visudo -cf %s"
+  become: true
+
+- name: Install ansible via pip as jarvis
+  ansible.builtin.pip:
+    name: ansible
+    state: present
+    break_system_packages: true
+  become: true
+  no_log: true

ansible-push/playbooks/roles/nfs_client/tasks/main.yml

@@ -0,0 +1,59 @@
+- name: Install nfs-common
+  ansible.builtin.apt:
+    name: nfs-common
+    state: present
+  become: true
+  when: ansible_os_family == "Debian"
+
+- name: Ensure NFS mount directories exists
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: '0755'
+    owner: jarvis
+    group: jarvis
+  become: true
+  loop: "{{ nfs_shares }}"
+  loop_control:
+    label: "Directory: {{ item.path }}"
+  when: ansible_os_family == "Debian"
+
+- name: Create local repogroup matching TrueNAS GID 568
+  ansible.builtin.group:
+    name: repogroup
+    gid: 568
+    state: present
+  become: true
+
+- name: Add jarvis to repogroup
+  ansible.builtin.user:
+    name: jarvis
+    groups:
+      - repogroup
+    append: true
+  become: true
+
+- name: Mount an NFS volume (root, because kernel mount)
+  ansible.posix.mount:
+    src: "{{ item.src }}"
+    path: "{{ item.path }}"
+    opts: "vers=4.2,proto=tcp,_netdev"
+    state: mounted
+    fstype: nfs
+  become: true
+  loop: "{{ nfs_shares }}"
+  loop_control:
+    label: "Mounted: {{ item.src }}"
+  when: ansible_os_family == "Debian"
+
+- name: Set mount permissions so jarvis (repogroup member) can write
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    mode: '0770'
+    owner: root
+    group: repogroup
+  become: true
+  loop: "{{ nfs_shares }}"
+  loop_control:
+    label: "Permission fix: {{ item.path }}"
+  when: ansible_os_family == "Debian"

ansible-push/playbooks/roles/prepare/tasks/main.yml

@@ -0,0 +1,12 @@
+- name: Run "apt update"
+  ansible.builtin.apt:
+    update_cache: yes
+    cache_valid_time: 3600
+  when: ansible_os_family == "Debian"
+
+- name: Upgrade the OS (apt-get dist-upgrade)
+  ansible.builtin.apt:
+    upgrade: dist
+  when:
+    - ansible_os_family == "Debian"
+    - not (gpu | default(false))

ansible-push/playbooks/roles/wolfstack/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Check for existing wolfstack installation
+  ansible.builtin.command: which wolfstack
+  register: wolfstack_exists
+  ignore_errors: true
+  changed_when: false
+
+- name: Run Wolfstack installer
+  ansible.builtin.shell: |
+    curl -sSL https://raw.githubusercontent.com/wolfsoftwaresystemsltd/WolfStack/master/setup.sh | bash
+  args:
+    executable: /bin/bash
+  when: wolfstack_exists.rc != 0
+
+- name: Ensure wolfstack service is running and enabled
+  ansible.builtin.systemd:
+    name: wolfstack
+    state: started
+    enabled: true
+    daemon_reload: true
+
+- name: Install keepalived package
+  ansible.builtin.apt:
+    name: keepalived
+    state: present
+    update_cache: true
+  when: ansible_os_family == "Debian"