Major changes

ansible/files/dockerfiles/Dockerfile.mcp.gitea

@@ -1,26 +0,0 @@
-FROM python:3.11-slim
-ARG MCP_VERSION=0.2.0
-ARG UID=1000
-ARG GID=1000
-RUN groupadd --system --gid ${GID} worker && \
-    adduser --system --gid ${GID} --uid ${UID} --home /home/worker worker
-ENV PATH=/home/worker/.local/bin:$PATH
-WORKDIR /home/worker
-# Super user custom actions
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    tar \
-    && rm -rf /var/lib/apt/lists/*
-RUN curl -L https://gitea.com/gitea/gitea-mcp/releases/download/v${MCP_VERSION}/gitea-mcp_Linux_x86_64.tar.gz \
-    | tar -xz -C /usr/local/bin \
-    && chmod +x /usr/local/bin/gitea-mcp
-# End of super user custom actions
-USER worker
-RUN pip install mcpo uv
-EXPOSE 8000
-# Worker custom actions
-ENV GITEA_HOST="https://gitea.com"
-ENV GITEA_INSECURE="false"
-ENV GITEA_ACCESS_TOKEN="<your personal access token>"
-CMD ["uvx", "mcpo", "--host", "0.0.0.0", "--port", "8000", "--", "gitea-mcp"]
-# End of worker custom actions

ansible/host_vars/dev-01.alexpires.dev.yml

@@ -32,8 +32,7 @@ sshd_max_auth_tries: 10
 ufw_enable: true
 fw_allowed_ports:
   - { rule: "allow", port: "22", proto: "tcp" }
-  - { rule: "allow", port: "8000", proto: "tcp" }
-  - { rule: "allow", port: "8080", proto: "tcp" }
+  - { rule: "allow", port: "443", proto: "tcp" }
 
 ufw_outgoing_traffic:
   - 22 # SSH
@@ -42,8 +41,13 @@ ufw_outgoing_traffic:
   - 123 # NTP
   - 443 # HTTPS
   - 853 # DNS over TLS
-  - 11434 # Ollama
+  - 10250 # Kubelet
   - 8880 # Kokoro-FastAPI
+  - 11434 # Ollama
+  - 16443 # Kubernetes API
+  - 4443
+  - 9443
+  - 995 # POP3S
 
 ufw_default_forward_policy: "ACCEPT"
 
@@ -77,6 +81,18 @@ unattended_reboot_time: "04:30"
 duo_users: ["*", "!provision"]
 duo_api_hostname: api-7cda1654.duosecurity.com
 
+# Kubernetes specific settings
+microk8s_allowed_hosts:
+  - 10.19.4.0/24
+  - 10.5.5.5
+microk8s_alt_names: "{{ hostname }}"
+
+# Let's encrypt issuer
+microk8s_lets_encrypt_issuer: false
+microk8s_encryption_secret: "{{ lookup('env', 'MICROK8S_ENCRYPTION_SECRET') }}"
+microk8s_users:
+  - username: operator
+    enabled: true
+
 # podman services settings
-open_webui_home: "/srv/open-webui"
-mcp_home: "/srv/mcp"
+persistent_data: "/srv"

ansible/playbook_podman_open_webui.yml

@@ -1,22 +1,24 @@
 - name: Setup open-webui
   hosts: openwebui
-  vars:
-    podman_user: "{{ open_webui_user | default('openwebui') }}"
-    podman_group: "{{ open_webui_group | default('openwebui') }}"
-    podman_user_home: "{{ open_webui_home | default('/home/open-webui') }}"
-    podman_user_folders:
-      - data
-    pods:
-      - name: open-webui
-        repo:
-          image: ghcr.io/open-webui/open-webui
-          tag: main
-        ports:
-          - "0.0.0.0:{{ open_webui_port | default(8080) }}:8080/tcp"
-        volumes:
-          - "{{ open_webui_home }}/data:/app/backend/data:Z"
 
   tasks:
-    - name: Setup Pods
-      ansible.builtin.include_tasks:
-        file: tasks/podman.yml
+    - name: Set required facts
+      ansible.builtin.set_fact:
+        open_webui_home: "{{ persistent_data | default('/var/lib') }}/open_webui"
+        open_webui_user_id: 0
+        open_webui_group_id: 0
+      tags: always
+
+    - name: Create required open_webui data folder
+      become: true
+      ansible.builtin.file:
+        state: directory
+        path: "{{ item }}"
+        mode: "0750"
+        owner: "{{ open_webui_user_id }}"
+        group: "{{ open_webui_group_id }}"
+      with_items:
+        - "{{ open_webui_home }}"
+      tags:
+        - tasks
+        - tasks::folders

ansible/roles/microk8s/defaults/main.yml

@@ -11,6 +11,7 @@ microk8s_metallb_version: 0.14.9
 # certificate manager
 microk8s_issuer_email: webmaster@localhost.localdomain
 microk8s_certmgr_version: 1.14.5
+microk8s_lets_encrypt_issuer: true
 
 # microk8s specific
 microk8s_channel: "{{ microk8s_k8s_version }}/stable"
@@ -39,4 +40,4 @@ microk8s_iac_user: "provision"
 
 microk8s_encryption_secret: "a13labs"
 microk8s_encryption_cfg: "/etc/microk8s_encryption.yaml"
-microk8s_encryption_kms_socket:
+microk8s_encryption_kms_socket: ""

ansible/roles/microk8s/tasks/certmanager.yml

@@ -16,6 +16,7 @@
     wait: true
 
 - name: CertManager | Register LetsEncrypt (prod)
+  when: microk8s_lets_encrypt_issuer is true
   environment:
     PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
   vars:
@@ -46,6 +47,7 @@
                   class: public
 
 - name: CertManager | Register LetsEncrypt (staging)
+  when: microk8s_lets_encrypt_issuer is true
   environment:
     PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
   vars:

ansible/roles/microk8s/templates/encryption-provider-config.yml.j2

@@ -6,7 +6,7 @@ resources:
     - secrets
     - configmaps
     providers:
-{% if microk8s_encryption_kms_socket is defined %}
+{% if microk8s_encryption_kms_socket != "" %}
     - kms:
         apiVersion: v2
         name: aws-encryption-provider