chore!: separated galaxy deps and own collections; modified ansible script generation to use two paths for collections

REQUIRES REGENERATING ansible.cfg!

ansible_collections/nullified/infrastructure/roles/k3s/tasks/agent.yml

@@ -0,0 +1,18 @@
+---
+# TODO: implement
+# TODO: disable swap
+
+- name: operation not supported
+  ansible.builtin.debug:
+    msg: Operation currently not supported
+  failed_when: true
+
+- name: setup firewall rules
+  become: true
+  ansible.builtin.template:
+    src: ../templates/nftables.d/k3s_agents.nft.j2
+    dest: /etc/nftables.d/k3s_agents.nft
+    mode: '0600'
+  notify:
+    - 'k3s : restart firewall service'
+    - 'k3s : restart k3s service'

ansible_collections/nullified/infrastructure/roles/k3s/tasks/main.yml

@@ -0,0 +1,55 @@
+---
+- name: group by cluster name
+  ansible.builtin.group_by:
+    key: "k3s_clusters_{{ k3s_cluster_name }}_{{ k3s_cluster_role }}"
+  changed_when: false
+
+- name: determine cluster type and members
+  ansible.builtin.set_fact:
+    k3s_cluster_type: "{{ 'ha' if groups['k3s_clusters_' ~ k3s_cluster_name ~ '_' ~ k3s_cluster_role] | length > 1 else 'single' }}"
+    k3s_cluster_servers: "{{ groups['k3s_clusters_' ~ k3s_cluster_name ~ '_server'] }}"
+    k3s_cluster_agents: "{{ groups['k3s_clusters_' ~ k3s_cluster_name ~ '_agent'] | default([]) }}"
+    k3s_nft_servers4: "{{ groups['k3s_clusters_' ~ k3s_cluster_name ~ '_server'] | default([]) | map('extract', hostvars, ['k3s_cluster_ip']) | ansible.utils.ipv4 }}"
+    k3s_nft_agents4: "{{ groups['k3s_clusters_' ~ k3s_cluster_name ~ '_agent'] | default([]) | map('extract', hostvars, ['k3s_cluster_ip']) | ansible.utils.ipv4 }}"
+    k3s_nft_servers6: "{{ groups['k3s_clusters_' ~ k3s_cluster_name ~ '_server'] | default([]) | map('extract', hostvars, ['k3s_cluster_ip']) | ansible.utils.ipv6 }}"
+    k3s_nft_agents6: "{{ groups['k3s_clusters_' ~ k3s_cluster_name ~ '_agent'] | default([]) | map('extract', hostvars, ['k3s_cluster_ip']) | ansible.utils.ipv6 }}"
+    k3s_nft_operators4: "{{ k3s_operator_ips | ansible.utils.ipv4 }}"
+    k3s_nft_operators6: "{{ k3s_operator_ips | ansible.utils.ipv6 }}"
+  changed_when: false
+
+- name: setup permissions
+  become: true
+  block:
+    - name: install sudo
+      ansible.builtin.apt:
+        update_cache: true
+        force_apt_get: true
+        cache_valid_time: 3600
+        pkg: [ sudo ]
+        state: present
+    - name: add operator to sudoers
+      ansible.builtin.lineinfile:
+        backup: true
+        path: /etc/sudoers
+        regexp: "^{{ k3s_operator_username }}\b.+$"
+        line: "{{ k3s_operator_username }} ALL=(ALL) NOPASSWD: ALL"
+        state: present
+      register: backup_sudoers
+      changed_when: false
+
+- name: setup server role
+  ansible.builtin.include_tasks: server.yml
+  tags: [helm, opentofu]
+  when: k3s_cluster_role is match("server")
+- name: setup agent role
+  ansible.builtin.include_tasks: agent.yml
+  tags: [helm, opentofu]
+  when: k3s_cluster_role is match("agent")
+
+- name: reset permissions
+  become: true
+  ansible.builtin.command:
+    cmd: "mv {{ backup_sudoers.backup }} /etc/sudoers"
+    removes: "{{ backup_sudoers.backup }}"
+  when: backup_sudoers.backup
+  changed_when: false

ansible_collections/nullified/infrastructure/roles/k3s/tasks/opentofu.yml

@@ -0,0 +1,77 @@
+- name: deploy OpenTofu resource
+  connection: local
+  block:
+    - name: set TF resource facts
+      ansible.builtin.set_fact:
+        k3s_tf_safe_item_name: "{{ item.name | regex_replace('[^\\w]', '') }}"
+        k3s_tf_project_git_path: "{{ provisioner_facts.artifacts_dir }}/{{ item.name | regex_replace('[^\\w]', '') }}.git"
+      changed_when: false
+
+    - name: check pre-existing TF state file
+      ansible.builtin.file:
+        path: "{{ provisioner_facts.k8s_states_dir }}/{{ k3s_tf_safe_item_name }}.tfstate"
+      register: tfstate_file_info
+      changed_when: false
+      failed_when: false
+      when: item.get("backend_override", false) is falsy
+
+    - name: fetch git repository
+      ansible.builtin.git:
+        repo: '{{ item.git_repository }}'
+        dest: '{{ k3s_tf_project_git_path }}'
+        version: '{{ item.git_revision }}'
+        force: true
+
+    - name: prepare variables file
+      ansible.builtin.copy:
+        content: '{{ item.tfvars_content }}'
+        dest: '{{ k3s_tf_project_git_path }}/{{ item.terraform_dir }}/terraform.tfvars'
+        mode: '0600'
+        force: true
+
+    - name: prepare tfstate file
+      ansible.builtin.copy:
+        src: '{{ provisioner_facts.k8s_states_dir }}/{{ k3s_tf_safe_item_name }}.tfstate'
+        dest: '{{ k3s_tf_project_git_path }}/{{ item.terraform_dir }}/terraform.tfstate'
+        force: true
+        mode: '0600'
+      when: item.get("backend_override", false) is falsy
+
+    - name: dump custom backend override
+      ansible.builtin.copy:
+        content: '{{ item.backend_override }}'
+        dest: '{{ k3s_tf_project_git_path }}/{{ item.terraform_dir }}/backend_override.tf'
+        mode: '0600'
+      when: item.get("backend_override", false) is truthy
+      changed_when: false
+
+    - name: deploy k8s resources
+      community.general.terraform:
+        binary_path: "{{ provisioner_facts.tofu_binary_path }}"
+        project_path: '{{ k3s_tf_project_git_path }}/{{ item.terraform_dir }}'
+        provider_upgrade: true
+        force_init: true
+      environment: '{{ item.get("backend_env", {}) }}'
+
+    - name: cleanup override file
+      ansible.builtin.file:
+        path: '{{ k3s_tf_project_git_path }}/{{ item.terraform_dir }}/backend_override.tf'
+        state: absent
+      when: item.get("backend_override", false) is truthy
+      changed_when: false
+
+    - name: backup source state file
+      ansible.builtin.copy:
+        src: '{{ provisioner_facts.k8s_states_dir }}/{{ k3s_tf_safe_item_name }}.tfstate'
+        dest: '{{ provisioner_facts.k8s_states_dir }}/{{ k3s_tf_safe_item_name }}.tfstate.previous'
+        force: true
+        mode: '0600'
+      when: item.get("backend_override", false) is falsy
+
+    - name: update source tfstate file
+      ansible.builtin.copy:
+        src: '{{ k3s_tf_project_git_path }}/{{ item.terraform_dir }}/terraform.tfstate'
+        dest: '{{ provisioner_facts.k8s_states_dir }}/{{ k3s_tf_safe_item_name }}.tfstate'
+        force: true
+        mode: '0600'
+      when: item.get("backend_override", false) is falsy

ansible_collections/nullified/infrastructure/roles/k3s/tasks/server.yml

@@ -0,0 +1,75 @@
+---
+# TODO: disable swap
+- name: setup firewall rules
+  become: true
+  ansible.builtin.template:
+    src: ../templates/nftables.d/k3s_servers.nft.j2
+    dest: /etc/nftables.d/k3s_servers.nft
+    mode: '0600'
+  notify:
+    - 'k3s : restart firewall service'
+    - 'k3s : restart k3s service'
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- name: install K3S cluster, single server
+  connection: local
+  ansible.builtin.command:
+    argv:
+      - "{{ provisioner_facts.k3sup_binary_path }}"
+      - install
+      - "--merge"
+      - "--local-path"
+      - "{{ provisioner_facts.kubeconfig_repository }}/{{ k3s_cluster_name }}.kubeconfig"
+      - "--context"
+      - "{{ k3s_kube_context }}"
+      - "--k3s-extra-args"
+      - "{{ k3s_extra_args }}"
+      - "--user"
+      - "{{ k3s_operator_username }}"
+      - "--ssh-key"
+      - "{{ k3s_operator_ssh_key_path }}"
+      - "--host"
+      - "{{ inventory_hostname }}.{{ global_dns_domainname }}"
+  register: k3s_init
+  when: k3s_cluster_type is match("single")
+  changed_when: not "No change detected so skipping service start" in k3s_init.stdout
+
+- name: install K3S cluster, HA
+  connection: local
+  debug: msg="Not supported yet"
+  when: k3s_cluster_type is match("ha")
+  failed_when: true
+
+- name: install K3S Helm customizations
+  become: true
+  ansible.builtin.copy:
+    dest: "{{ k3s_manifests_dir }}/{{ item.name | regex_replace('[^\\w]', '') }}.yaml"
+    content: '{{ item.content }}'
+    mode: '0600'
+    owner: root
+    group: root
+  loop: '{{ k3s_cluster_helm_customizations }}'
+  loop_control:
+    label: '{{ item.name }}'
+  no_log: true
+
+- name: install Helm charts
+  connection: local
+  kubernetes.core.helm: '{{ item }}'
+  loop: '{{ k3s_cluster_additional_helm_charts }}'
+  loop_control:
+    label: '{{ item.release_name }}'
+  no_log: true
+  tags: [helm]
+
+- name: install OpenTofu resources
+  ansible.builtin.include_tasks:
+    file: opentofu.yml
+    apply:
+      tags: [opentofu]
+  loop: '{{ k3s_cluster_additional_tf_resources }}'
+  loop_control:
+    label: '{{ item.name }}'
+  tags: [opentofu]