changed local path for fetched and resent wireguard client configuration file

.gitignore

@@ -4,6 +4,7 @@
 /hosts.yml
 /hosts.yaml
 /hosts.json
+uv.lock
 
 # Ansible runtime and backups
 *.bak
@@ -19,7 +20,7 @@
 /.devcontainer/
 .lock
 /.cache/
-/roles/**/files/user/wg/containerized/*.conf
+/roles/**/files/user/wg/authorized_clients.d/*.conf
 
 # Try tyo avoid any plain-text passwords 
 *pwd*

README.md

@@ -2,6 +2,23 @@
 
 ## Installation
 
+Make sure you have `git`, `venv`, and `uv` installed. On GNU/Linux Debian-based distros with pre-installed `apt` package manager, the corresponding packages are:
+
+- `git`
+- `python3-venv`
+- [Follow this guide](https://docs.astral.sh/uv/getting-started/installation/) for installing `uv`
+
+Ansible must also be installed on your system (see [this guide](https://docs.ansible.com/projects/ansible/latest/installation_guide/index.html)). Then, in your interactive bash shell session, run the following in order:
+
+```bash
+git clone https://git.sukaato.moe/admin/skato-ansible.git
+cd ./skato-ansible
+uv venv .venv
+uv sync
+source .venv/bin/activate
+ansible-galaxy collections install -r ./collections/requirements.yml
+```
+
 ## Essential Background
 
 ### Software Management
@@ -72,7 +89,7 @@ Other common ones, especially for services, are `port` (which can be an integer
 
 ## Essential Usage
 
-Before running any Ansible playbooks in either development or production mode, make sure to specify the username and the home directory path of the user on the system you are currently using in `{ANSIBLE_PROJECT_ROOT}/vars/local_facts.yml`.
+Before running any Ansible [playbooks](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) in either development or production mode, make sure to specify the username and the home directory path of the user on the system you are currently using in `{ANSIBLE_PROJECT_ROOT}/vars/local_facts.yml`.
 
 ### Development Mode
 
@@ -81,15 +98,12 @@ For development purposes in the container routing case, either first manually se
 > [!WARNING]
 > Vagrantfiles for neither staging host has yet been tested. Proceed by your own discretion.
 
-If you intend to run the [playbooks](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) in production, the argument for this extra parameter should be "prod". The additional extra parameter of `chosen_host` should be adjusted to reflect the name of the host enlisted in the [YAML inventory file](https://docs.ansible.com/projects/ansible/latest/inventory_guide/intro_inventory.html) for production purposes.
+If you intend to run the [playbooks](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) in production, the argument for this extra parameter should be "prod" (skip to the [Production Mode](#production-mode) section). The additional extra parameter of `chosen_host` should be adjusted to reflect the name of the host enlisted in the [YAML inventory file](https://docs.ansible.com/projects/ansible/latest/inventory_guide/intro_inventory.html) for production purposes.
 
 > [!IMPORTANT]
 > The names of hosts should be equivalent to their intended final domain name for services on any given host for the [playbook](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) to work correctly.
 
-Double-check, of course, that the correct values are set for `chosen_user`. The first playbook you run for each host or IP should always have `chosen_user` as "root". Execute the below while in the `$ANSIBLE_PROJECT_ROOT` directory:
-
-> [!TIP]
-> The extra parameter `chosen_user` for the second `ansible-playbook` command of each pair of `ansible-playbook` commands shown below should take an argument whose value is the same as that of the `username` attribute of any of the items in the `admins` list in the [host variables file](https://docs.ansible.com/projects/ansible/latest/inventory_guide/intro_inventory.html#organizing-host-and-group-variables) for the given host.
+Anyway, for *any* mode double-check that the correct values are set for `chosen_user`. The first playbook you run for each host or IP in each pair of `ansible-playbook` commands in the upcoming shell script should always have `chosen_user` as "root". The extra parameter `chosen_user` for the second `ansible-playbook` command of each pair of `ansible-playbook` commands shown below should take an argument whose value is the same as that of the `username` attribute of any of the items in the `admins` list in the [host variables file](https://docs.ansible.com/projects/ansible/latest/inventory_guide/intro_inventory.html#organizing-host-and-group-variables) for the given host. With that in mind, execute the below for development mode for container routing case while in the `$ANSIBLE_PROJECT_ROOT` directory:
 
 ```bash
 #!/bin/bash
@@ -110,11 +124,13 @@ ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=staging1.test" --ext
 ```
 
 > [!WARNING]
-> In the container routing case, development mode may not supply an accurate test of the intended networking result if the virtual machines for staging were manually created, but the [playbook](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) should run successfully. This is because apppropriate networking must be set for the virtual machine itself for VPN client containers in one virtual machine to "speak" with the VPN server in another virtual machine. Th supplied Vagrantfiles are a WIP.
+> In the container routing case, development mode may not supply an accurate test of the intended networking result if the virtual machines for staging were manually created, but the [playbook](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) should run successfully. This is because apppropriate networking must be set for the virtual machine itself for VPN client containers in one virtual machine to "speak" with the VPN server in another virtual machine. The supplied Vagrantfiles are a WIP.
 
 ### Production Mode
 
-Its important to note that the above shell script example for development mode would have to be modified in production mode for the container routing case such that every `ansible-playbook` call instance has its extra parameter `chosen_host` share the same value throughout. This is due to the combination of how SSL/TLS and domain names are set up in the [playbook](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) and the requirements of the container routing case. However, `chosen_host`'s value being the same across all `ansible-playbook` commands does not mean that value should represent the same managed node or host IP throughout. Whether it does so is of course determined by whatever is in the [YAML inventory file](https://docs.ansible.com/projects/ansible/latest/inventory_guide/intro_inventory.html).
+Its important to note that the above shell script example for development mode would have to be modified in production mode for the container routing case such that every `ansible-playbook` call instance has its extra parameter `chosen_host` share the same value throughout. This is due to the combination of how SSL/TLS and domain names are set up in the [playbook](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) and the requirements of the container routing case. Namely, the former treats the inventory hostname used for the [playbook](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) as the [fully qualified domain name](https://en.wikipedia.org/wiki/Fully_qualified_domain_name) of that server host, while the container routing case requires that both server hosts share that [fully qualified domain name](https://en.wikipedia.org/wiki/Fully_qualified_domain_name).
+
+This means that `chosen_host`'s value being the same across all `ansible-playbook` commands does not mean that value should represent the same managed node or host [IP](https://en.wikipedia.org/wiki/IP_address) throughout. Whether it does so is of course determined by whatever is in the [YAML inventory file](https://docs.ansible.com/projects/ansible/latest/inventory_guide/intro_inventory.html), so that would need to be changed when running [playbooks](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) against the second chosen host in the container routing case.
 
 To drive all that home, in production we may instead need something like the following (again, executed while in the `$ANSIBLE_PROJECT_ROOT` directory):
 
@@ -141,31 +157,73 @@ sudo ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=${HOST_FQDN}" -
 ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=${HOST_FQDN}" --extra-vars "chosen_user=senpai" --extra-vars "mode=prod" administrate\@homeserver.yml
 ```
 
-### Custom Playbooks
-
-As long as you are matching the appropriate set of [playbook variable files](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_variables.html#defining-variables-in-included-files-and-roles) or settings files with the [playbook](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) according to its need of those variable definitions/declarations, mostly determined by [the intended targeted hosts' own variables](https://docs.ansible.com/projects/ansible/latest/inventory_guide/intro_inventory.html#host-variables) together with role [handlers](https://docs.ansible.com/projects/ansible/latest/inventory_guide/intro_inventory.html#host-variables), and as long as you have appropriately set up software installations, (see [Software Management](#software-management)) creating new/custom [playbooks](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) should be relatively easy.
-
-Depending on what you are trying to do with a new playbook, the best approach may be to just copy/duplicate the extant playbook files and then edit them, as this allows one to mitigate errors as well as have a reliable reference point for changes.
-
-### CLI Tool
-
-As an alternative, you can use the `skato-ansible` shell script in `$ANSIBLE_PROJECT_ROOT` as an abstraction of these `ansible-playbook` commands, though it is a WIP that currently only makes sense for development mode playbook executions. I plan to replace it with a CLI app.
-
-When using the `skato-ansible.sh` script in development mode for the container routing use case:
-
-> [!IMPORTANT]
-> If you have different SSH keypairs for staging, make sure to change the value of `SKANSIBLE_SSH_KEYS` environment variable in the `${ANSIBLE_PROJECT_ROOT}/skato-ansible.sh` shell script.
+**There *is* a way to avoid reassigning the IP address of the shared inventory hostname for each host the pair of playbooks is being run against in the container routing case under production.** This involves defining `fqdn` as a playbook variable or as an extra parameter for all `ansible-playbook` commands in the shell script, resulting in a shell script that looks more similar to our [development mode shell script](#development-mode):
 
 ```bash
 #!/bin/bash
 set -euo pipefail
 
-./skato-ansible.sh init vps -s 0 -v 2 -m dev -n staging0.test
-./skato-ansible.sh populate-agent staging
-./skato-ansible.sh bootstrap vps -s 1 -v 2 -m dev -n staging0.test
+SSH_KEYS=()
 
-./skato-ansible.sh init homeserver -s 0 -v 2 -m dev -n staging1.test
-# BELOW IS OPTIONAL, IF $SKANSIBLE_SSH_KEY altered in the shell script
-# ./skato-ansible.sh populate-agent staging
-./skato-ansible.sh bootstrap vps -s 1 -v 2 -m dev -n staging1.test
+sudo ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=staging0.test" --extra-vars "chosen_user=root" --extra-vars "mode=dev" --extra-vars "fqdn=web.site" init\@vps.yml
+$SSH_KEYS | xargs -I %k ssh-add %k # ADD NEEDED SSH KEY FILEPATHS
+ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=staging0.test" --extra-vars "chosen_user=senpai" --extra-vars "mode=dev" --extra-vars "fqdn=web.site" administrate\@vps.yml
+
+sudo ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=staging1.test" --extra-vars "chosen_user=root" --extra-vars "mode=dev" --extra-vars "fqdn=web.site" init\@homeserver.yml
+# UNCOMMENT BELOW TO REASSIGN ENVIRONMENT VARIABLE FOR NEW ARRAY OF SSH KEYPAIR FILEPATHS
+# SSH_KEYS=()
+# UNCOMMENT BELOW TO ADD UPDATED SSH KEY PAIR FILEPATHS TO SSH_AGENT
+# $SSH_KEYS | xargs -I %k ssh-add %k
+ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=staging1.test" --extra-vars "chosen_user=senpai" --extra-vars "mode=dev" --extra-vars "fqdn=web.site" administrate\@homeserver.yml
 ```
+
+> [!TIP]
+> Adding the extra parameter here to the `ansible-playbook` commands of the development mode execution for the container routing use-case may also improve the realism of its execution and final state, virtual machine network configurations notwithstanding. Consider doing so for more realistic networking tests under the container routing case.
+
+### Custom Playbooks
+
+As long as you are matching the appropriate set of [playbook variable files](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_variables.html#defining-variables-in-included-files-and-roles) or settings files with the [playbook](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) according to its need of those variable definitions/declarations, mostly determined by [the intended targeted hosts' own variables](https://docs.ansible.com/projects/ansible/latest/inventory_guide/intro_inventory.html#host-variables) together with role [handlers](https://docs.ansible.com/projects/ansible/latest/inventory_guide/intro_inventory.html#host-variables), and as long as you have appropriately set up software installations, (see [Software Management](#software-management)) creating new/custom [playbooks](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) should be relatively easy.
+
+Depending on what you are trying to do with a new [playbook](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html), the best approach may be to just copy/duplicate the extant [playbook files](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html) and then edit them, as this allows one to mitigate errors as well as have a reliable reference point for changes.
+
+### CLI Tool
+
+As an alternative, you can use the `skato-ansible` shell script in `$ANSIBLE_PROJECT_ROOT` as an abstraction of the `ansible-playbook` commands for the container routing case. I plan to replace it with a CLI app covering more intended use-cases.
+
+When using the `skato-ansible.sh` script in development mode for the container routing use case:
+
+```bash
+#!/bin/bash
+set -euo pipefail
+
+./skato-ansible.sh init vps -v 3 -m dev -n staging0.test
+./skato-ansible.sh populate-agent staging
+./skato-ansible.sh bootstrap vps -s 1 -v 3 -m dev -n staging0.test
+
+./skato-ansible.sh init homeserver -v 3 -m dev -n staging1.test
+# BELOW ONLY IF $SKANSIBLE_SSH_KEY ALTERED IN THE SHELL SCRIPT
+# ./skato-ansible.sh populate-agent staging
+./skato-ansible.sh bootstrap vps -s 1 -v 3 -m dev -n staging1.test
+```
+
+Otherwise, in production mode:
+
+```bash
+#!/bin/bash
+set -euo pipefail
+
+INVENTORY_HOSTNAMES=(web1 web2)
+FQDN=web.site
+
+./skato-ansible.sh init vps -v 3 -n "${INVENTORY_HOSTNAMES[0]}" -d "$FQDN"
+./skato-ansible.sh populate-agent staging
+./skato-ansible.sh bootstrap vps -s 1 -v 3 -n "${INVENTORY_HOSTNAMES[0]}" -d "$FQDN"
+
+./skato-ansible.sh init homeserver -v 3 -n "${INVENTORY_HOSTNAMES[1]}" -d "$FQDN"
+# BELOW ONLY IF $SKANSIBLE_SSH_KEY ALTERED IN THE SHELL SCRIPT
+# ./skato-ansible.sh populate-agent staging
+./skato-ansible.sh bootstrap vps -s 1 -v 3 -n "${INVENTORY_HOSTNAMES[1]}" -d "$FQDN"
+```
+
+> [!IMPORTANT]
+> If you have different SSH keypairs for staging, make sure to change the value of `SKANSIBLE_SSH_KEYS` environment variable in the `${ANSIBLE_PROJECT_ROOT}/skato-ansible.sh` shell script before running the above shell scripts from `$ANSIBLE_PROJECT_ROOT`.

host_vars/staging0.test.yml

@@ -195,6 +195,14 @@ pkgs:
         suites: ~
         comps: ~
         handler: default
+      - name: "kitty-terminfo"
+        uri: ~
+        sigkey: ~
+        sources: ~
+        types: ~
+        suites: ~
+        comps: ~
+        handler: default
       - name: "git-doc"
         uri: ~
         sigkey: ~

host_vars/staging1.test.yml

@@ -409,6 +409,14 @@ pkgs:
         suites: ~
         comps: ~
         handler: default
+      - name: minidlna
+        uri: ~
+        sigkey: ~
+        sources: ~
+        types: ~
+        suites: ~
+        comps: ~
+        handler: default
     userspace:
       - name: aria2
         uri: ~

init@homeserver.yml

@@ -34,13 +34,13 @@
     - name: Updating hostname
       become: true
       ansible.builtin.hostname:
-        name: "{{ inventory_hostname }}"
+        name: "{{ fqdn | default(inventory_hostname) }}"
     - name: Updating hosts file
       become: true
       ansible.builtin.lineinfile:
         path: /etc/hosts
         regexp: "^127\\.0\\.1\\.1"
-        line: "127.0.1.1  {{ inventory_hostname }}"
+        line: "127.0.1.1  {{ fqdn | default(inventory_hostname) }}"
         insertbefore: BOF
         state: present
     - name: Updating host icon name

init@vps.yml

@@ -37,13 +37,13 @@
     - name: Updating hostname
       become: true
       ansible.builtin.hostname:
-        name: "{{ inventory_hostname }}"
+        name: "{{ fqdn | default(inventory_hostname) }}"
     - name: Updating hosts file
       become: true
       ansible.builtin.lineinfile:
         path: /etc/hosts
         regexp: "^127\\.0\\.1\\.1"
-        line: "127.0.1.1  {{ inventory_hostname }}"
+        line: "127.0.1.1  {{ fqdn | default(inventory_hostname) }}"
         insertbefore: BOF
         state: present
     - name: Updating host icon name

pyproject.toml

@@ -0,0 +1,73 @@
+[project]
+name = "skato-ansible"
+version = "0.1.0"
+requires-python = ">=3.13"
+dependencies = [
+    "ansible==13.7.0",
+    "ansible-builder==3.1.1",
+    "ansible-compat==26.3.0",
+    "ansible-core==2.20.6",
+    "ansible-lint==26.4.0",
+    "ansible-navigator==26.4.0",
+    "ansible-runner==2.4.3",
+    "ansible-specdoc==0.0.20",
+    "appdirs==1.4.4",
+    "attrs==26.1.0",
+    "baron==0.10.1",
+    "bindep==2.14.0",
+    "black==26.5.1",
+    "bracex==2.6",
+    "certifi==2026.5.20",
+    "cffi==2.0.0",
+    "charset-normalizer==3.4.7",
+    "click==8.4.1",
+    "cryptography==48.0.0",
+    "deprecated==1.3.1",
+    "distro==1.9.0",
+    "enrich==1.2.7",
+    "filelock==3.29.0",
+    "idna==3.16",
+    "jinja2==3.1.6",
+    "jsonschema==4.26.0",
+    "jsonschema-specifications==2025.9.1",
+    "linode-api4==5.44.0",
+    "lockfile==0.12.2",
+    "markdown-it-py==4.2.0",
+    "markupsafe==3.0.3",
+    "mdurl==0.1.2",
+    "molecule==26.4.0",
+    "mypy-extensions==1.1.0",
+    "onigurumacffi==1.5.0",
+    "packaging==26.2",
+    "parsley==1.3",
+    "passlib==1.7.4",
+    "pathspec==1.0.4",
+    "pbr==7.0.3",
+    "pexpect==4.9.0",
+    "pip==25.1.1",
+    "platformdirs==4.9.6",
+    "pluggy==1.6.0",
+    "polling==0.3.2",
+    "ptyprocess==0.7.0",
+    "pycparser==3.0",
+    "pygments==2.20.0",
+    "python-daemon==3.1.2",
+    "pytokens==0.4.1",
+    "pyyaml==6.0.3",
+    "redbaron==0.9.2",
+    "referencing==0.37.0",
+    "requests==2.34.2",
+    "resolvelib==1.2.1",
+    "rich==15.0.0",
+    "rpds-py==0.30.0",
+    "rply==0.7.8",
+    "ruamel-yaml==0.19.1",
+    "ruamel-yaml-clib==0.2.15",
+    "setuptools==82.0.1",
+    "subprocess-tee==0.4.2",
+    "tzdata==2026.2",
+    "urllib3==2.7.0",
+    "wcmatch==10.1",
+    "wrapt==2.2.1",
+    "yamllint==1.38.0",
+]

requirements.txt

@@ -1,65 +0,0 @@
-ansible==13.7.0
-ansible-builder==3.1.1
-ansible-compat==26.3.0
-ansible-core==2.20.6
-ansible-lint==26.4.0
-ansible-navigator==26.4.0
-ansible-runner==2.4.3
-ansible-specdoc==0.0.20
-appdirs==1.4.4
-attrs==26.1.0
-baron==0.10.1
-bindep==2.14.0
-black==26.5.1
-bracex==2.6
-certifi==2026.5.20
-cffi==2.0.0
-charset-normalizer==3.4.7
-click==8.4.1
-cryptography==48.0.0
-deprecated==1.3.1
-distro==1.9.0
-enrich==1.2.7
-filelock==3.29.0
-idna==3.16
-jinja2==3.1.6
-jsonschema==4.26.0
-jsonschema-specifications==2025.9.1
-linode-api4==5.44.0
-lockfile==0.12.2
-markdown-it-py==4.2.0
-markupsafe==3.0.3
-mdurl==0.1.2
-molecule==26.4.0
-mypy-extensions==1.1.0
-onigurumacffi==1.5.0
-packaging==26.2
-parsley==1.3
-pathspec==1.0.4
-pbr==7.0.3
-pexpect==4.9.0
-platformdirs==4.9.6
-pluggy==1.6.0
-polling==0.3.2
-ptyprocess==0.7.0
-pycparser==3.0
-pygments==2.20.0
-python-daemon==3.1.2
-pytokens==0.4.1
-pyyaml==6.0.3
-redbaron==0.9.2
-referencing==0.37.0
-requests==2.34.2
-resolvelib==1.2.1
-rich==15.0.0
-rpds-py==0.30.0
-rply==0.7.8
-ruamel-yaml==0.19.1
-ruamel-yaml-clib==0.2.15
-setuptools==82.0.1
-subprocess-tee==0.4.2
-tzdata==2026.2
-urllib3==2.7.0
-wcmatch==10.1
-wrapt==2.2.1
-yamllint==1.38.0

roles/init-server/tasks/contingent/pkg/certbot.yml

@@ -38,10 +38,10 @@
     - name: Exemplifying needed ACME record
       ansible.builtin.set_fact:
         acme_record: |
-          {{ inventory_hostname }}    IN A    {{ ipify_public_ip }}
-          _acme-challenge.{{ inventory_hostname }}    IN  CNAME    {{ inventory_hostname }}.acme.{{ inventory_hostname }}.
-          acme.{{ inventory_hostname }}    IN  NS    ns.acme.{{ inventory_hostname }}.
-          ns.acme.{{ inventory_hostname }}    IN  A    {{ ipify_public_ip }}
+          {{ fqdn | default(inventory_hostname) }}    IN A    {{ ipify_public_ip }}
+          _acme-challenge.{{ fqdn | default(inventory_hostname) }}    IN  CNAME    {{ fqdn | default(inventory_hostname) }}.acme.{{ fqdn | default(inventory_hostname) }}.
+          acme.{{ fqdn | default(inventory_hostname) }}    IN  NS    ns.acme.{{ fqdn | default(inventory_hostname) }}.
+          ns.acme.{{ fqdn | default(inventory_hostname) }}    IN  A    {{ ipify_public_ip }}
     - name: Informing user of need to set up ACME record
       ansible.builtin.debug:
         msg: "Please set ACME record in domain name provider:\n {{ acme_record }}"

roles/init-server/tasks/contingent/pkg/dsnet.yml

@@ -67,12 +67,12 @@
   when: data_method.user_input == "fetch"
   block:
     - name: Informing user of inventory requirements for VPN clients
-      when: not item.name in groups.homeserver
+      when: ((fqdn is undefined or fqdn == None) and item.name != fqdn) or not item.name in groups.homeserver
       ansible.builtin.fail:
         msg: The VPN client must be the name of an inventory host in a homeserver group
       loop: "{{ vpn.clients }}"
     - name: Dupliciating DSNet VPN service client configuration files to control node
-      when: item.name in groups.homeserver
+      when: ((fqdn is defined and fqdn != None) and item.name == fqdn) or item.name in groups.homeserver
       ansible.builtin.fetch:
         src: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
         dest: "./.tmp/{{ inventory_hostname }}-dsnet/"
@@ -83,7 +83,7 @@
     - name: Dupliciating DSNet VPN service client configuration files to control node
       ansible.builtin.fetch:
         src: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
-        dest: "./roles/init-server/files/user/wg/containerized/{{ item.name }}{{ (idx | string) }}.conf"
+        dest: "./roles/init-server/files/user/wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
         flat: true
       loop: "{{ vpn.clients }}"
       loop_control:

roles/init-server/tasks/contingent/pkg/skato_compose.yml

@@ -173,7 +173,7 @@
   block:
     - name: Creating subdirectory for VPN client container specified by Compose file
       ansible.builtin.file:
-        path: "{{ ansible_user_home.stdout }}/.wg/containerized"
+        path: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d"
         recurse: true
         owner: "{{ ansible_user }}"
         group: "{{ ansible_user }}"
@@ -181,10 +181,10 @@
     - name: Copying VPN client configuration files
       become: true
       become_user: "{{ current_user.stdout }}"
-      when: item.name == inventory_hostname
+      when: ((fqdn is defined and fqdn != None) and item.name == fqdn) or item.name == inventory_hostname
       ansible.builtin.copy:
-        src: "user/wg/containerized/{{ item.name }}{{ (idx | string) }}.conf"
-        dest: "{{ ansible_user_home.stdout }}/.wg/containerized/"
+        src: "user/wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf"
+        dest: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/"
         owner: "{{ ansible_user }}"
         group: "{{ ansible_user }}"
         mode: "644"
@@ -772,7 +772,7 @@
     - name: Creating required tailnet container secret for tailnet container specified by Compose file
       become: true
       # become_user: "{{ current_user.stdout }}"
-      when: item.name == inventory_hostname
+      when: ((fqdn is defined and fqdn != None) and item.name == fqdn) or item.name == inventory_hostname
       ansible.builtin.copy:
         src: "{{ item.name }}-{{ headscale.users.admin.username }}@headscale/headscale{{ (idx | string) }}.key"
         dest: "{{ ansible_user_home.stdout }}/.podsecrets/headscale.key"

roles/init-server/templates/user/certbot.env.j2

@@ -1,6 +1,6 @@
 CERTBOT_EMAIL="{{ certbot.email }}"
 CERTBOT_AUTHENTICATOR={{ certbot.auth_method }}
-SERVER_WEBROOT_PATH={{ ansible_user_home.stdout + "/srv/acme." + inventory_hostname }}
+SERVER_WEBROOT_PATH={{ ansible_user_home.stdout + "/srv/certbot." + (fqdn | default(inventory_hostname)) }}
 {% if compose.mode == "dev" %}
 # @TODO find a better way to have processed the below in Ansible
 CERTBOT_CHALLENGE_DOMAINS={{ certbot.domains | map("regex_replace", "\\.([^\\.]*)$", ".test") | list | join(",") }}

roles/init-server/templates/user/config/caddy/Caddyfile.j2

@@ -1,11 +1,27 @@
-http://<< inventory_hostname >> {
+http://<< web_fqdn >> {
   handle /.well-known/acme-challenge/* {
     reverse_proxy localhost:80
   }
+  handle {
+    redir https://{host}{uri} 308
+  }
 }
-
 :80 {
-	root * /srv/<< inventory_hostname >>
-	file_server
-	encode gzip
+  root /srv/certbot.<< web_fqdn >>
+  browse
+}
+<< web_fqdn >> {
+  respond 503
+  # root /srv/<< web_fqdn >>
+  file_server
+  
+  header /.well-known/openpgpkey/* {
+    Content-Type application/octet-stream
+    Access-Control-Allow-Origin *
+  }
+  
+  handle_errors {
+    rewrite /error/{err.status_code}.html
+    templates
+  }
 }

skato-ansible.sh

@@ -15,24 +15,24 @@ if [[ "$1" == "version" ]]; then
 fi
 
 if [[ "$1" == "show-defaults" ]]; then
-    source "${SKANSIBLE_SCRIPT_PATH}/.env/bin/activate"
+    source "${SKANSIBLE_SCRIPT_PATH}/.venv/bin/activate"
     printf "Private SSH keys available throufh SSH agent: |\n%s\n" "$(ssh-add -l)"
 fi
 
 if [[ "$1" == "start-agent" ]]; then
-    source "${SKANSIBLE_SCRIPT_PATH}/.env/bin/activate"
+    source "${SKANSIBLE_SCRIPT_PATH}/.venv/bin/activate"
     eval "$(ssh-agent -s)"
 fi
 
 if [[ "$1" == "list-agent" ]]; then
-    source "${SKANSIBLE_SCRIPT_PATH}/.env/bin/activate"
+    source "${SKANSIBLE_SCRIPT_PATH}/.venv/bin/activate"
     ssh-add -l
 fi
 
 if [[ "$1" == "populate-agent" ]]; then
     shift 1
 
-    source "${SKANSIBLE_SCRIPT_PATH}/.env/bin/activate"
+    source "${SKANSIBLE_SCRIPT_PATH}/.venv/bin/activate"
     
     if [[ "$1" == "all" ]]; then
         for SKANSIBLE_SSH_KEY in ~/.ssh/*; do
@@ -69,7 +69,7 @@ fi
 if [[ "$1" == "init" ]]; then
     shift 1
 
-    source "${SKANSIBLE_SCRIPT_PATH}/.env/bin/activate"
+    source "${SKANSIBLE_SCRIPT_PATH}/.venv/bin/activate"
 
     if [[ "$1" == "vps" ]]; then
         SKANSIBLE_PLAY_HOST="$1"
@@ -82,7 +82,7 @@ if [[ "$1" == "init" ]]; then
         exit 1
     fi
 
-    while getopts "htm:s:n:v:u:" opt; do
+    while getopts "htd:m:s:n:v:u:" opt; do
         case $opt in
             h) Help "init";;
             s) SKANSIBLE_STAGE="$OPTARG";;
@@ -91,6 +91,7 @@ if [[ "$1" == "init" ]]; then
             t) SKANSIBLE_UNITTEST=True;;
             u) export ANSIBLE_REMOTE_USER="$OPTARG";;
             m) SKANSIBLE_MODE="$OPTARG";;
+            d) SKANSIBLE_FQDN="$OPTARG";;
             *) echo "Err: Invalid option set"; exit 1;;
         esac
     done
@@ -99,23 +100,23 @@ if [[ "$1" == "init" ]]; then
         # SKANSIBLE_CONN_HOST=staging${SKANSIBLE_STAGE}.test
         if [[ "$SKANSIBLE_STAGE" == 0 ]]; then
             if [[ "$SKANSIBLE_UNITTEST" == "True" ]]; then
-                sudo ansible-playbook -CKk -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-root}" --extra-vars "mode=${SKANSIBLE_MODE}" "init@${SKANSIBLE_PLAY_HOST}.yml"
+                sudo ansible-playbook -CKk -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-root}" --extra-vars "mode=${SKANSIBLE_MODE}" --extra-vars "fqdn=${SKANSIBLE_FQDN:-staging.test}" "init@${SKANSIBLE_PLAY_HOST}.yml"
             else
-                sudo ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-root}" --extra-vars "mode=${SKANSIBLE_MODE}" "init@${SKANSIBLE_PLAY_HOST}.yml"
+                sudo ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-root}" --extra-vars "mode=${SKANSIBLE_MODE}" --extra-vars "fqdn=${SKANSIBLE_FQDN:-staging.test}" "init@${SKANSIBLE_PLAY_HOST}.yml"
             fi
         elif [[ "$SKANSIBLE_STAGE" == 1 ]]; then
             if [[ "$SKANSIBLE_UNITTEST" == "True" ]]; then
-                sudo ansible-playbook -CK -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-root}" --extra-vars "mode=${SKANSIBLE_MODE}" "init@${SKANSIBLE_PLAY_HOST}.yml"
+                sudo ansible-playbook -CK -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-root}" --extra-vars "mode=${SKANSIBLE_MODE}" --extra-vars "fqdn=${SKANSIBLE_FQDN:-staging.test}" "init@${SKANSIBLE_PLAY_HOST}.yml"
             else
-                sudo ansible-playbook -K -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-root}" --extra-vars "mode=${SKANSIBLE_MODE}" "init@${SKANSIBLE_PLAY_HOST}.yml"
+                sudo ansible-playbook -K -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-root}" --extra-vars "mode=${SKANSIBLE_MODE}" --extra-vars "fqdn=${SKANSIBLE_FQDN:-staging.test}" "init@${SKANSIBLE_PLAY_HOST}.yml"
             fi
         fi
     else
-        if [[ -z "$SKANSIBLE_CONN_HOST" ]]; then
-            echo "When not doing staging, chosen or preferred host must be made explicit" 
+        if [[ -z "$SKANSIBLE_CONN_HOST" ]] && [[ -z "$SKANSIBLE_FQDN" ]]; then
+            echo "When not doing staging, chosen or preferred host must be made explicit as well as desired FQDN" 
             exit 1
         else
-            sudo ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-root}" --extra-vars "mode=prod" "init@${SKANSIBLE_PLAY_HOST}.yml"
+            sudo ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-root}" --extra-vars "mode=prod" --extra-vars "fqdn=${SKANSIBLE_FQDN}" "init@${SKANSIBLE_PLAY_HOST}.yml"
         fi
     fi
 
@@ -125,7 +126,7 @@ fi
 if [[ "$1" == "bootstrap" ]]; then
     shift 1
 
-    source "${SKANSIBLE_SCRIPT_PATH}/.env/bin/activate"
+    source "${SKANSIBLE_SCRIPT_PATH}/.venv/bin/activate"
 
     if [[ "$1" == "vps" ]]; then
         SKANSIBLE_PLAY_HOST="$1"
@@ -138,7 +139,7 @@ if [[ "$1" == "bootstrap" ]]; then
         exit 1
     fi
 
-    while getopts "htm:s:n:v:u:" opt; do
+    while getopts "htd:m:s:n:v:u:" opt; do
         case $opt in
             h) Help "bootstrap";;
             s) SKANSIBLE_STAGE="$OPTARG";;
@@ -147,6 +148,7 @@ if [[ "$1" == "bootstrap" ]]; then
             t) SKANSIBLE_UNITTEST=True;;
             u) export ANSIBLE_REMOTE_USER="$OPTARG";;
             m) SKANSIBLE_MODE="$OPTARG";;
+            d) SKANSIBLE_FQDN="$OPTARG";;
             *) echo "Err: Invalid option set"; exit 1;;
         esac
     done
@@ -155,23 +157,23 @@ if [[ "$1" == "bootstrap" ]]; then
         # SKANSIBLE_CONN_HOST=staging${SKANSIBLE_STAGE}.test
         if [[ "$SKANSIBLE_STAGE" == 0 ]]; then
             if [[ "$SKANSIBLE_UNITTEST" == "True" ]]; then
-                ansible-playbook -CKk -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-senpai}" --extra-vars "mode=${SKANSIBLE_MODE}" "administrate@${SKANSIBLE_PLAY_HOST}.yml"
+                ansible-playbook -CKk -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-senpai}" --extra-vars "mode=${SKANSIBLE_MODE}" --extra-vars "fqdn=${SKANSIBLE_FQDN:-staging.test}" "administrate@${SKANSIBLE_PLAY_HOST}.yml"
             else
-                ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-senpai}" --extra-vars "mode=${SKANSIBLE_MODE}" "administrate@${SKANSIBLE_PLAY_HOST}.yml"
+                ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-senpai}" --extra-vars "mode=${SKANSIBLE_MODE}" --extra-vars "fqdn=${SKANSIBLE_FQDN:-staging.test}" "administrate@${SKANSIBLE_PLAY_HOST}.yml"
             fi
         elif [[ "$SKANSIBLE_STAGE" == 1 ]]; then
             if [[ "$SKANSIBLE_UNITTEST" == "True" ]]; then
-                ansible-playbook -CK -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-senpai}" --extra-vars "mode=${SKANSIBLE_MODE}" "administrate@${SKANSIBLE_PLAY_HOST}.yml"
+                ansible-playbook -CK -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-senpai}" --extra-vars "mode=${SKANSIBLE_MODE}" --extra-vars "fqdn=${SKANSIBLE_FQDN:-staging.test}" "administrate@${SKANSIBLE_PLAY_HOST}.yml"
             else
-                ansible-playbook -K -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-senpai}" --extra-vars "mode=${SKANSIBLE_MODE}" "administrate@${SKANSIBLE_PLAY_HOST}.yml"
+                ansible-playbook -K -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-senpai}" --extra-vars "mode=${SKANSIBLE_MODE}" --extra-vars "fqdn=${SKANSIBLE_FQDN:-staging.test}" "administrate@${SKANSIBLE_PLAY_HOST}.yml"
             fi
         fi
     else
         if [[ -z "$SKANSIBLE_CONN_HOST" ]]; then
-            echo "When not doing staging, chosen or preferred host must be made explicit" 
+            echo "When not doing staging, chosen or preferred host must be made explicit as well as desired FQDN" 
             exit 1
         else
-            ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-senpai}" --extra-vars "mode=prod" "administrate@${SKANSIBLE_PLAY_HOST}.yml"
+            ansible-playbook -Kk -i hosts.yml --extra-vars "chosen_host=${SKANSIBLE_CONN_HOST}" --extra-vars "chosen_user=${ANSIBLE_REMOTE_USER:-senpai}" --extra-vars "mode=prod" --extra-vars "fqdn=${SKANSIBLE_FQDN}" "administrate@${SKANSIBLE_PLAY_HOST}.yml"
         fi
     fi
 

vars/certbot_settings@homeserver.yml

@@ -5,6 +5,6 @@ certbot:
   port: ~
   email: ajt95@prole.biz
   domains:
-    - "{{ inventory_hostname }}"
-    - "*.{{ inventory_hostname }}"
+    - "{{ fqdn | default(inventory_hostname) }}"
+    - "*.{{ fqdn | default(inventory_hostname) }}"
   cron: "2 6 24 1 *"

vars/certbot_settings@vps.yml

@@ -5,6 +5,6 @@ certbot:
   port: 53
   email: ajt95@prole.biz
   domains:
-    - "{{ inventory_hostname }}"
-    - "*.{{ inventory_hostname }}"
+    - "{{ fqdn | default(inventory_hostname) }}"
+    - "*.{{ fqdn | default(inventory_hostname) }}"
   cron: ~