connection/ssh_lxc: new style for containers

Now which *host* is hosting a specific container is not defined in the
playbook yaml file but centrally in the invetory under the
`ansible_lxc_host` variable.

The `lxc_guest` role is runned directly against the guest, even if it
doesn't exist yet, and lxc tasks are delegated to the lxc-running
physical host.

In this way it should be easier to scale-up and configure multiple
istance of a service on different containers without changing the
playbook.

Look at `/ldap.yaml` for a commented example.

connection_plugins/ssh_lxc.py

@@ -46,6 +46,7 @@ DOCUMENTATION = '''
               - name: ansible_lxc_name
               - name: ansible_ssh_lxc_name
               - name: ansible_docker_extra_args
+              - name: vm_name
           type: str
       host_key_checking:
           description: Determines if ssh should check host keys

hosts.example

@@ -9,9 +9,9 @@ authorities_request   ansible_host=10.150.40.8         ansible_user=request
 black                 ansible_host=10.150.40.42        ansible_user=root        vg_name=black-vg
 ca                    ansible_host=10.150.40.8         ansible_user=root
 
-# LXC GUEST  ------------------------------------------------------------------ <LXC Running Host> ------ <LXC Container Name>
-#blogs                ansible_host=10.150.42.17        ansible_user=root        ansible_lxc_host=black    ansible_lxc_name=blogs
-ldap                  ansible_host=10.150.42.10        ansible_user=root        ansible_lxc_host=black    ansible_lxc_name=ldap
+# LXC GUEST  ------------------------------------------------------------------ <LXC Running Host>
+#blogs                ansible_host=10.150.42.17        ansible_user=root        ansible_lxc_host=black
+ldap                  ansible_host=10.150.42.10        ansible_user=root        ansible_lxc_host=black
 #lists                ansible_host=10.150.42.15        ansible_user=root
 #login                ansible_host=10.150.42.100       ansible_user=root
 #mail                 ansible_host=10.150.42.36        ansible_user=root

ldap.yaml

@@ -1,17 +1,43 @@
 ---
-- hosts: biff
-  roles:
-    - role: lxc_guest
-      vm_name: ldap
-    - role: ssh_server
-      ansible_connection: ssh_lxc
-      ansible_ssh_lxc_name: ldap
+# 1) Deploy the lxc container(s)
+- hosts: ldap
+  # The host may not exist yet: do not gather facts
+  gather_facts: false
+  tags:
+    - lxc
+  tasks:
+    # Delegate lxc container deployment to `ansible_lxc_host`
+    - import_role: name='lxc_guest'
+      vars:
+        vm_name: '{{ inventory_hostname }}'
+        vm_size: '1G'
+        vg_name: '{{ hostvars[ansible_lxc_host]["vg_name"] }}'
+      delegate_to: '{{ ansible_lxc_host }}'
+    # The host may not be directly reachable: use `ssh_lxc` proxy to
+    # gather facts (setup) and configure SSH.
+    - set_fact: ansible_connection='ssh_lxc'
+    - setup:
+    - include_role: name='ssh_server'
+    # Now the host should be ssh-reachable
+    - set_fact: ansible_connection='ssh'
+
+# 2) Deploy LDAP server(s)
 - hosts: ldap
   roles:
       - role: dns_record
       - role: ldap
         ldap_domain: 'lilik.it'
         ldap_organization: 'LILiK'
+        fqdn_domain: 'dmz.{{ domain }}'
+        x509_suffix: 'o=LILiK,l=Firenze,st=IT'
+        virtual_domains:
+          - '{{ domain }}'
+        # Default values:
+        #ldap_tls_enabled: true
+        #renew_rootdn_pw: true
+        #check_tree: true
+
+# 3) Enable monitoring
 - hosts: status
   roles:
     - role: icinga2-monitoring

projects.yaml

@@ -1,17 +1,27 @@
 ---
-- hosts: emmett
-  roles:
-    - role: lxc_guest
-      vm_name: projects2
-    - role: ssh_server
-      ansible_connection: ssh_lxc
-      ansible_ssh_lxc_name: projects2
-- hosts: projects2
+- hosts: projects
+  gather_facts: false
+  tags:
+    - lxc
+  tasks:
+    - import_role: name='lxc_guest'
+      vars:
+        vm_name: '{{ inventory_hostname }}'
+        vm_size: '4G'
+        vg_name: '{{ hostvars[ansible_lxc_host]["vg_name"] }}'
+      delegate_to: '{{ ansible_lxc_host }}'
+    - set_fact: ansible_connection='ssh_lxc'
+    - setup:
+    - include_role: name='ssh_server'
+    - set_fact: ansible_connection='ssh'
+
+- hosts: projects
   roles:
     - role: dns_record
     - role: reverse_proxy
-      hostname: projects2
+      hostname: projects
     - role: gitlab
+
 - hosts: status
   roles:
     - role: icinga2-monitoring