Add encryption role and related files

ansible/host_vars/contabo01.a13labs.pt.yml

@@ -88,6 +88,26 @@ fail2ban_jails:
 unattended_reboot: true
 unattended_reboot_time: "04:30"
 
+# Encrypted volumes
+encryption_volumes:
+  - name: "microk8s_config"
+    size: "0.1G"
+    key_file_url: https://a13labs-infra-53d7as6g1sh19k.s3.fr-par.scw.cloud/keys/00_50_56_52_8c_74.key
+    fetch_key_service_before: snap.microk8s.daemon-kubelite.service
+    fetch_key_service_after: network-online.target
+    fetch_key_service_wantedby: snap.microk8s.daemon-kubelite.service
+    mount_service_before: snap.microk8s.daemon-kubelite.service
+    mount_service_wantedby: snap.microk8s.daemon-kubelite.service
+  - name: "microk8s_persistent"
+    size: "150G"
+    key_file_url: https://a13labs-infra-53d7as6g1sh19k.s3.fr-par.scw.cloud/keys/00_50_56_52_8c_74.key
+    fetch_key_service_before: snap.microk8s.daemon-kubelite.service
+    fetch_key_service_after: network-online.target
+    fetch_key_service_wantedby: snap.microk8s.daemon-kubelite.service
+    mount_service_before: snap.microk8s.daemon-kubelite.service
+    mount_service_wantedby: snap.microk8s.daemon-kubelite.service
+    mount_permission: "0755"
+
 # Kubernetes specific settings
 microk8s_version: 1.29
 microk8s_allowed_hosts:
@@ -96,7 +116,7 @@ microk8s_alt_names: "{{ hostname }}"
 
 # Let's encrypt issuer
 microk8s_issuer_email: c.alexandre.pires@alexpires.me
-microk8s_encryption_cfg: /a13labs/microk8s_encryption.yaml
+microk8s_encryption_cfg: /mnt/microk8s_config/microk8s_encryption.yaml
 microk8s_encryption_secret: "{{ lookup('env', 'MICROK8S_ENCRYPTION_SECRET') }}"
 microk8s_users:
   - username: operator
@@ -108,3 +128,6 @@ microk8s_users:
 # Duo Security
 duo_users: ["*", "!provision", "!git"]
 duo_api_hostname: api-7cda1654.duosecurity.com
+
+# Apps
+persistent_data: "/mnt/microk8s_persistent"