Huge update once again. Hope I didn't leak any API tokens or whatever

group_vars/all/vars.yml

@@ -13,8 +13,12 @@ lan_network: "192.168.2.0/24"
 
 swag_network: "10.0.0.0/27"
 
+swag_base: "{{ '.'.join(swag_network.split('.')[0:3]) }}"
+
 swag_gateway: "{{ '.'.join(swag_network.split('.')[0:3]) }}.1"
 
+swag_interface: vlan.4
+
 lan_address: "{{ '.'.join(lan_network.split('.')[0:3]) }}.230"
 
 lan_gateway: "{{ '.'.join(lan_network.split('.')[0:3]) }}.1"
@@ -27,8 +31,11 @@ dmz_gateway: "{{ '.'.join(dmz_network.split('.')[0:3]) }}.1"
 
 iot_network: "{{ '.'.join(lan_gateway.split('.')[0:2]) }}.32.0/24"
 
-hass_ip: 192.168.32.168
+iot_gateway: "{{ '.'.join(iot_network.split('.')[0:3]) }}.1"
+
+iot_base: "{{ '.'.join(iot_network.split('.')[0:3]) }}"
 
+iot_interface: vlan.3
 
 #
 # Misc
@@ -93,14 +100,13 @@ extra_packages:
   - iotop
   - ncdu
   - hddtemp
-  - reptyr
 
 #
 # Apt mirrors
 #
 version: focal
 
-apt_mirror: http://ftp.uni-mainz.de/ubuntu/
+apt_mirror: http://de.ports.ubuntu.com
 
 
 #
@@ -188,7 +194,9 @@ enable_nextcloud: true
 
 enable_vaultwarden: true
 
-enable_swag: true
+enable_swag_public: false
+
+enable_swag_internal: false
 
 enable_bunkerized_nginx: false
 
@@ -208,7 +216,7 @@ enable_ikev2: true
 
 # Homepages
 
-enable_homer: true
+enable_homer: false
 
 enable_flame: false
 
@@ -237,6 +245,9 @@ enable_timemachine: true
 #
 ikev2_ondemand: true
 
+#
+# Samba
+#
 samba_server_string: "{{ hostname }}"
 
 samba_users:
@@ -249,7 +260,7 @@ samba_global_include: global-include.conf
 
 samba_apple_extensions: yes
 
-samba_mitigate_cve_2017_7494: false
+samba_mitigate_cve_2017_7494: true
 
 samba_server_max_protocol: "SMB3"
 

requirements.yml

@@ -7,4 +7,4 @@ roles:
   - name: stuvusit.smartd
   - name: oefenweb.dns
   - name: notthebee.ubuntu_autoinstall
-  - name: ironicbadger.ansible_role_snapraid
+  - name: ironicbadger.ansible_role_snapraid

roles/containers/homeautomation/deconz/defaults/main.yml

@@ -1,8 +1,10 @@
 ---
 container_name: deconz
 
-dashboard_url: "http://deconz.{{ host_local }}/"
+url: "deconz.{{ host_local }}"
+
+ip_address: "{{ swag_base }}.25"
 
 homer_category: smarthome
 
-dashboard_name: "Phoscon-GW"
+dashboard_name: "deCONZ"

roles/containers/homeautomation/deconz/handlers/main.yml

@@ -0,0 +1,4 @@
+---
+- name: Reboot pi
+  reboot:
+    msg: Rebooting due to a kernel update

roles/containers/homeautomation/deconz/tasks/docker.yml

@@ -0,0 +1,28 @@
+---
+- name: Check if the ZigBee device exists
+  find:
+    paths:
+      - "/dev"
+    patterns:
+      - "ttyAMA*" 
+    file_type:
+      any
+  register: zigbee_dev 
+
+- name: Make sure the {{ container_name }} container is created and running
+  docker_container:
+    name: "{{ container_name }}"
+    image: "deconzcommunity/deconz:stable"
+    networks:
+      - name: swag_internal_macvlan
+        ipv4_address: "{{ ip_address }}"
+    pull: yes
+    state: 'started'
+    env:
+      "TZ": "{{ timezone }}"
+      "DECONZ_VNC_MODE": "1"
+    volumes:
+      - "{{ docker_dir }}/{{ container_name }}:/opt/deCONZ"
+    devices:
+      - /dev/ttyAMA0
+    restart_policy: unless-stopped

roles/containers/homeautomation/deconz/tasks/main.yml

@@ -1,40 +1,4 @@
----
-- name: Check if the ZigBee device exists
-  find:
-    paths:
-      - "/dev"
-    patterns:
-      - "ttyACM*" 
-    file_type:
-      any
-  register: zigbee_dev 
+- include_tasks: raspbee.yml
+  when: ansible_facts['distribution'] == 'Debian'
 
-- name: Make sure the {{ container_name }} container is created and running if there's a Zigbee device
-  docker_container:
-    name: "{{ container_name }}"
-    image: "deconzcommunity/deconz:stable"
-    pull: yes
-    networks:
-      - name: swag_internal_macvlan
-        ipv4_address: 10.0.0.6
-    state: 'started'
-    labels:
-      "flame.type": "application"
-      "flame.name": "{{ dashboard_name }}"
-      "flame.url": "{{ dashboard_url }}"
-      "flame.icon": "custom"
-    volumes:
-      - "{{ docker_dir }}/{{ container_name }}:/opt/deCONZ"
-    devices:
-      - "{{ zigbee_dev.files[0].path }}"
-    env:
-      "TZ": "{{ timezone }}"
-      "DECONZ_WEB_PORT": "8085"
-      "DECONZ_WS_PORT": "4043"
-      "DEBUG_INFO": "1"
-      "DEBUG_APS": "0"
-      "DEBUG_ZCL": "0"
-      "DEBUG_ZDP": "0"
-      "DEBUG_OTAU": "0"
-    restart_policy: unless-stopped
-  when: zigbee_dev.files | length > 0
+- include_tasks: docker.yml

roles/containers/homeautomation/deconz/tasks/raspbee.yml

@@ -0,0 +1,125 @@
+- name: Install build packages
+  apt:
+    name:
+      - i2c-tools
+      - build-essential
+      - raspberrypi-kernel-headers
+      - curl
+    state: present
+
+- name: Check if RTC kernel module is installed
+  stat:
+    path: "/lib/modules/{{ ansible_kernel }}/extra/rtc-pcf85063.ko"
+    get_attributes: no
+    get_checksum: no
+    get_mime: no
+  register: kernel_module
+
+- block:
+  - name: Download master.zip
+    get_url:
+      url: https://github.com/dresden-elektronik/raspbee2-rtc/archive/master.zip
+      dest: /home/pi/master.zip
+      owner: pi
+      group: pi
+      mode: 0440
+    register: download_master
+
+
+  - name: Unpack master.zip
+    unarchive:
+      src: /home/pi/master.zip
+      dest: /home/pi
+      remote_src: yes
+      owner: pi
+      group: pi
+      mode: 0770
+      creates: /home/pi/raspbee2-rtc-master
+
+
+  - name: Build kernel module
+    shell: cd /home/pi/raspbee2-rtc-master && make
+
+
+  - name: Install kernel module
+    shell: cd /home/pi/raspbee2-rtc-master && make install
+    notify:
+      - Reboot pi
+
+  when: kernel_module.stat.exists != True
+
+
+- name: Remove source file for kernel module
+  file:
+    path: /home/pi/master.zip
+    state: absent
+
+
+- name: Remove build files for kernel module
+  file:
+    path: /home/pi/raspbee2-rtc-master
+    state: absent
+
+
+- name: Retrieve /boot/cmdline.txt
+  slurp:
+    src: "/boot/cmdline.txt"
+  register: boot_cmdline_txt_retrieve
+
+
+- name: Extract /boot/cmdline.txt
+  set_fact:
+    boot_cmdline_txt: "{{ boot_cmdline_txt_retrieve.content | b64decode }}"
+
+
+- name: Enable hardware serial port
+  command: 
+    cmd: raspi-config nonint do_serial 2
+  notify:
+    - Reboot pi
+  when: boot_cmdline_txt is search("console=serial0") or boot_cmdline_txt is search("console=console=ttyAMA0")
+
+
+- name: Stop hciuart
+  systemd:
+    name: hciuart
+    state: stopped
+    enabled: no
+  ignore_errors: True
+
+- name: Stop bluetooth.service
+  systemd:
+    name: bluetooth.service
+    state: stopped
+    enabled: no
+  ignore_errors: True
+
+
+
+- name: Remove Bluetooth packages
+  apt:
+    name:
+      - pi-bluetooth
+      - bluez
+    state: absent
+    purge: yes
+
+
+- name: Update /boot/config.txt
+  lineinfile:
+    dest: /boot/config.txt
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+    mode: 0644
+    owner: root
+    group: root
+    state: "{{ item.state }}"
+    create: yes
+  with_items:
+    - { regexp: '^#? *dtoverlay=pi3-disable-bt', line: 'dtoverlay=pi3-disable-bt', state: present }
+  notify:
+    - Reboot pi
+
+
+- name: Reboot Raspberry Pi
+  meta: flush_handlers

roles/containers/homeautomation/homeassistant/defaults/main.yml

@@ -1,10 +1,10 @@
 ---
 container_name: homeassistant
 
-dashboard_url: "https://homeassistant.{{ host_local }}"
+url: "homeassistant.{{ host_local }}"
+
+ip_address: "{{ iot_base }}.168"
 
 homer_category: smarthome
 
 dashboard_name: "Home Assistant"
-
-health_url: "http://{{ lan_address }}:3000/http://homeassistant.{{ host_local }}"

roles/containers/homeautomation/homeassistant/tasks/docker.yml

@@ -1,37 +1,11 @@
 ---
-- name: Create an "{{ container_name }}" network
-  docker_network:
-    name: hass_network
-
-- name: Make sure the Home Assistant MariaDB container is created and running
-  docker_container:
-    name: "ha-mariadb"
-    image: "mariadb:latest"
-    pull: yes
-    networks:
-      - name: hass_network
-    command: "--transaction-isolation=READ-COMMITTED --binlog-format=ROW --skip-innodb-read-only-compressed --innodb-read-only-compressed=OFF"
-    state: 'started'
-    env:
-      "PUID": "{{ guid }}"
-      "PGID": "{{ guid }}"
-      "TZ": "{{ timezone }}"
-      "MYSQL_ROOT_PASSWORD": "{{ ha_mysql_root_password }}"
-      "MYSQL_DATABASE": "{{ ha_mysql_db }}"
-      "MYSQL_USER": "{{ ha_mysql_user }}"
-      "MYSQL_PASSWORD": "{{ ha_mysql_password }}"
-    volumes:
-      - "{{ docker_dir }}/{{ container_name }}/mariadb/mysql:/var/lib/mysql"
-    restart_policy: unless-stopped
-
 - name: Make sure the {{ container_name }} container is created and running
   docker_container:
     name: "{{ container_name }}"
     image: "homeassistant/home-assistant:stable"
     networks:
-      - name: swag_internal_macvlan
-        ipv4_address: 10.0.0.12
-      - name: hass_network
+      - name: iot_macvlan
+        ipv4_address: "{{ ip_address }}"
     pull: yes
     state: 'started'
     env:

roles/containers/homeautomation/homeassistant/tasks/networks.yml

@@ -0,0 +1,10 @@
+- name: Create an internal macvlan network
+  when: enable_homeassistant | default(False)
+  docker_network:
+    name: iot_macvlan
+    driver: macvlan
+    driver_options:
+      parent: "{{ iot_interface }}"
+    ipam_config:
+      - subnet: "{{ iot_network }}"
+        gateway: "{{ iot_gateway }}"

roles/containers/homeautomation/mqtt/defaults/main.yml

@@ -1,2 +1,4 @@
 ---
 container_name: mqtt
+
+ip_address: "{{ swag_base }}.13"