Initial commit

2025-03-31 14:06:16 +03:00 · 2025-03-31 14:06:16 +03:00 · 2e68a84ead
commit 2e68a84ead
41 changed files with 937 additions and 0 deletions
--- a/.ansible-lint
+++ b/.ansible-lint
@ -0,0 +1,7 @@
+skip_list:
+  - fqcn
+  - yaml[new-line-at-end-of-file]
+  - yaml[truthy]
+  - yaml[line-length]  
+  - var-naming[no-role-prefix]
+  - 'ignore-errors'
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,173 @@
+# ---> Ansible
+*.retry
+
+# ---> Python
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+#poetry.lock
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#pdm.lock
+#   pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
+#   in version control.
+#   https://pdm.fming.dev/latest/usage/project/#working-with-version-control
+.pdm.toml
+.pdm-python
+.pdm-build/
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+#.idea/
+
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -0,0 +1,89 @@
+stages:
+  - lint
+  - test
+  - deploy
+  - notify
+
+services:
+  - name: docker:dind
+    command: ["--tls=false"]
+
+variables:
+  DOCKER_IMAGE: "hub.cism-ms.ru/ansible/ansible:latest"
+  DOCKER_TLS_CERTDIR: ""
+  ANSIBLE_FORCE_COLOR: "true"
+
+before_script:
+  - echo "$CI_REGISTRY_PASSWORD" | docker login hub.cism-ms.ru -u "$CI_REGISTRY_USER" --password-stdin
+  - docker pull $DOCKER_IMAGE
+  - echo "Fixing directory permissions..."
+  - chmod o-w $CI_PROJECT_DIR
+
+lint:
+  stage: lint
+  script:
+    - echo "Начинаем стейдж Lint"
+    - echo "Распаковываем секреты..."
+    - ansible-vault decrypt vars/secrets.yml --vault-password-file ./vault-password.txt
+    - echo "Запускаем ansible-lint..."
+    - ansible-lint roles/*
+    - echo "Упаковываем секреты..."
+    - ansible-vault encrypt vars/secrets.yml --encrypt-vault-id default --vault-password-file ./vault-password.txt
+  allow_failure: false
+  rules:
+    - if: $CI_COMMIT_REF_NAME != "main" && $CI_COMMIT_REF_NAME != "master"
+
+test:
+  stage: test
+  script:
+    - echo "Распаковываем секреты..."
+    - ansible-vault decrypt --vault-password-file ./vault-password.txt vars/secrets.yml
+    - echo "Запускаем тесты через Молекулу..."
+    - molecule test --parallel --destroy=always
+    - echo "Упаковываем секреты..."
+    - ansible-vault encrypt vars/secrets.yml --encrypt-vault-id default --vault-password-file ./vault-password.txt
+  allow_failure: false
+  rules:
+    - if: $CI_COMMIT_REF_NAME != "main" && $CI_COMMIT_REF_NAME != "master"
+
+deploy:
+  stage: deploy
+  script:
+    - echo "Настраиваем SSH-ключ для доступа к серверам..."
+    # Создаем директорию .ssh и настраиваем права доступа
+    - mkdir -p ~/.ssh
+    - chmod 700 ~/.ssh
+    # Записываем SSH-ключ в файл ~/.ssh/id_rsa
+    - echo "$SSH_PRIVATE_KEY" | tr -d '\r' > ~/.ssh/id_rsa
+    - chmod 600 ~/.ssh/id_rsa
+    # Запускаем основной пайплайн
+    - echo "Распаковываем секреты..."
+    - ansible-vault decrypt --vault-password-file ./vault-password.txt vars/secrets.yml
+    - echo "Все ок. Деплоим в прод..."
+    - ansible-playbook roles/deploy.yaml
+    - echo "Упаковываем секреты..."
+    - ansible-vault encrypt vars/secrets.yml --encrypt-vault-id default --vault-password-file ./vault-password.txt
+    # Удаляем ключ
+    - rm -rf ~/.ssh
+  rules:
+    - if: $CI_COMMIT_REF_NAME != "main" && $CI_COMMIT_REF_NAME != "master"
+  when: manual
+
+notify:
+  stage: notify
+  script:
+    - |
+      if [ "$CI_JOB_STATUS" == "success" ]; then
+        MESSAGE="✅ Пайплайн успешно завершен!%0AПроект: $CI_PROJECT_NAME%0AВетка: $CI_COMMIT_REF_NAME%0AСтатус: $CI_JOB_STATUS"
+      else
+        MESSAGE="❌ Пайплайн завершен с ошибкой!%0AПроект: $CI_PROJECT_NAME%0AВетка: $CI_COMMIT_REF_NAME%0AСтатус: $CI_JOB_STATUS"
+      fi
+#      curl -s -X POST "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/sendMessage" \
+#        -d "chat_id=$TELEGRAM_CHAT_ID" \
+#        -d "text=$MESSAGE"
+  rules:
+    - if: $CI_JOB_STATUS  # Отправлять уведомление только после завершения пайплайна
+
+after_script:
+  - echo "Работа пайплайна завершена"
+
--- a/.idea/.gitignore
+++ b/.idea/.gitignore
@ -0,0 +1,8 @@
+# Default ignored files
+/shelf/
+/workspace.xml
+# Editor-based HTTP Client requests
+/httpRequests/
+# Datasource local storage ignored files
+/dataSources/
+/dataSources.local.xml
--- a/.idea/AnsibleTemplate.iml
+++ b/.idea/AnsibleTemplate.iml
@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module type="PYTHON_MODULE" version="4">
+  <component name="NewModuleRootManager">
+    <content url="file://$MODULE_DIR$" />
+    <orderEntry type="inheritedJdk" />
+    <orderEntry type="sourceFolder" forTests="false" />
+  </component>
+  <component name="TemplatesService">
+    <option name="TEMPLATE_FOLDERS">
+      <list>
+        <option value="$MODULE_DIR$/roles/role/templates" />
+      </list>
+    </option>
+  </component>
+</module>
--- a/.idea/inspectionProfiles/Project_Default.xml
+++ b/.idea/inspectionProfiles/Project_Default.xml
@ -0,0 +1,47 @@
+<component name="InspectionProjectProfileManager">
+  <profile version="1.0">
+    <option name="myName" value="Project Default" />
+    <inspection_tool class="Eslint" enabled="true" level="WARNING" enabled_by_default="true" />
+    <inspection_tool class="HtmlUnknownAttribute" enabled="true" level="WARNING" enabled_by_default="true">
+      <option name="myValues">
+        <value>
+          <list size="1">
+            <item index="0" class="java.lang.String" itemvalue="setup" />
+          </list>
+        </value>
+      </option>
+      <option name="myCustomValuesEnabled" value="true" />
+    </inspection_tool>
+    <inspection_tool class="HtmlUnknownTag" enabled="true" level="WARNING" enabled_by_default="true">
+      <option name="myValues">
+        <value>
+          <list size="7">
+            <item index="0" class="java.lang.String" itemvalue="nobr" />
+            <item index="1" class="java.lang.String" itemvalue="noembed" />
+            <item index="2" class="java.lang.String" itemvalue="comment" />
+            <item index="3" class="java.lang.String" itemvalue="noscript" />
+            <item index="4" class="java.lang.String" itemvalue="embed" />
+            <item index="5" class="java.lang.String" itemvalue="script" />
+            <item index="6" class="java.lang.String" itemvalue="router-view" />
+          </list>
+        </value>
+      </option>
+      <option name="myCustomValuesEnabled" value="true" />
+    </inspection_tool>
+    <inspection_tool class="PyInterpreterInspection" enabled="false" level="WARNING" enabled_by_default="false" />
+    <inspection_tool class="PyPackageRequirementsInspection" enabled="false" level="WARNING" enabled_by_default="false">
+      <option name="ignoredPackages">
+        <value>
+          <list size="0" />
+        </value>
+      </option>
+    </inspection_tool>
+    <inspection_tool class="PyUnresolvedReferencesInspection" enabled="true" level="WARNING" enabled_by_default="true">
+      <option name="ignoredIdentifiers">
+        <list>
+          <option value="app.main.*" />
+        </list>
+      </option>
+    </inspection_tool>
+  </profile>
+</component>
--- a/.idea/inspectionProfiles/profiles_settings.xml
+++ b/.idea/inspectionProfiles/profiles_settings.xml
@ -0,0 +1,6 @@
+<component name="InspectionProjectProfileManager">
+  <settings>
+    <option name="USE_PROJECT_PROFILE" value="false" />
+    <version value="1.0" />
+  </settings>
+</component>
--- a/.idea/misc.xml
+++ b/.idea/misc.xml
@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="Black">
+    <option name="sdkName" value="Python 3.9 (Test)" />
+  </component>
+  <component name="ProjectRootManager" version="2" project-jdk-name="Python 3.9 (Test)" project-jdk-type="Python SDK" />
+</project>
--- a/.idea/modules.xml
+++ b/.idea/modules.xml
@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ProjectModuleManager">
+    <modules>
+      <module fileurl="file://$PROJECT_DIR$/.idea/AnsibleTemplate.iml" filepath="$PROJECT_DIR$/.idea/AnsibleTemplate.iml" />
+    </modules>
+  </component>
+</project>
--- a/.idea/vcs.xml
+++ b/.idea/vcs.xml
@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="VcsDirectoryMappings">
+    <mapping directory="" vcs="Git" />
+  </component>
+</project>
--- a/60
+++ b/60
@ -0,0 +1,60 @@
+# Используем более легкий базовый образ
+FROM python:3.12.9-slim-bullseye
+
+# Добавляем метаданные
+LABEL maintainer="Сергей Антропов <sergey@antropoff.ru>"
+LABEL description="Этот Dockerfile создан для внедрения подхода IaC в Ansible."
+LABEL version="0.1"
+LABEL contact.website="https://devops.org.ru"
+
+# Устанавливаем переменные окружения
+ENV PYTHONUNBUFFERED=1
+ENV EDITOR=nano
+
+# Устанавливаем системные зависимости
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+    git \
+    ssh \
+    gcc \
+    libffi-dev \
+    libssl-dev \
+    make \
+    sudo \
+    sshpass \
+    openssh-client \
+    nano \
+    less \
+    ca-certificates \
+    curl \
+    gnupg \
+    lsb-release \
+    && mkdir -p /etc/apt/keyrings \
+    && curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian bullseye stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null \
+    && apt-get update && \
+    apt-get install -y --no-install-recommends \
+    docker-ce-cli \
+    && rm -rf /var/lib/apt/lists/*
+
+# Устанавливаем зависимости Python для Ansible и Molecule
+RUN pip install --upgrade pip && \
+    pip install \
+    ansible \
+    ansible-lint \
+    ansible-vault \
+    molecule \
+    molecule-docker \
+    molecule-plugins \
+    ansible-compat \
+    docker
+
+# Копируем ssh ключ
+#COPY id_rsa /root/.ssh/id_rsa
+#RUN chmod 600 /root/.ssh/id_rsa
+
+# Устанавливаем рабочую директорию
+WORKDIR /ansible
+
+# Команда по умолчанию
+CMD ["/bin/bash"]
--- a/22
+++ b/22
@ -0,0 +1,22 @@
+# Сборка контейнера с systemd для удобного тестирования ролей Ansible через Molecule
+
+# Используем официальный образ Fedora
+FROM quay.io/fedora/python-312
+
+USER root
+
+# Обновляем пакеты и устанавливаем systemd
+RUN dnf -y update && \
+    dnf -y install systemd rsync && \
+    dnf clean all && \
+    rm -rf /var/cache/dnf /tmp/* /var/tmp/*
+
+# Настраиваем окружение для systemd
+ENV container=docker
+STOPSIGNAL SIGRTMIN+3
+
+# Создаем необходимые директории для systemd
+VOLUME [ "/sys/fs/cgroup" ]
+
+# Запускаем systemd при старте контейнера
+CMD ["/sbin/init"]
--- a/20
+++ b/20
@ -0,0 +1,20 @@
+# Сборка контейнера с systemd для удобного тестирования ролей Ansible через Molecule
+
+# Используем официальный образ Ubuntu 20.04
+FROM geerlingguy/docker-ubuntu2004-ansible:latest
+
+# Обновляем пакеты и устанавливаем systemd
+RUN apt-get update && \
+    apt-get install -y systemd systemd-sysv rsync && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+# Указываем, что контейнер использует systemd в качестве init-системы
+ENV container=docker
+STOPSIGNAL SIGRTMIN+3
+
+# Создаем необходимые директории для systemd
+VOLUME [ "/sys/fs/cgroup" ]
+
+# Запускаем systemd при старте контейнера
+CMD ["/sbin/init"]
--- a/151
+++ b/151
@ -0,0 +1,151 @@
+# Глобальные переменные
+IMAGE ?= ansible
+TAG ?= 0.1
+REGISTRY ?= hub.cism-ms.ru/ansible
+# По умолчанию используем docker. Для локальной разработки используйте docker-compose
+RUN_MODE ?= docker
+
+# Определение команды RUN в зависимости от RUN_MODE
+ifeq ($(RUN_MODE), docker-compose)
+  RUN = docker compose run --rm $(IMAGE)
+else ifeq ($(RUN_MODE), docker)
+  RUN = docker run -it --rm \
+    --name $(IMAGE) \
+    -v $(PWD):/ansible \
+    -v /var/run/docker.sock:/var/run/docker.sock \
+    -v ~/.ssh/id_rsa:/root/.ssh/id_rsa:ro \
+    -e ANSIBLE_VAULT_PASSWORD_FILE=/ansible/vault-password.txt \
+    --privileged \
+    --workdir /ansible \
+    $(REGISTRY)/$(IMAGE)
+else
+  $(error Invalid RUN_MODE. Use "docker-compose" or "docker")
+endif
+
+view create edit show delete test lint deploy new init build rebuild prune release images push pull shell:
+	@true
+
+####################################################################################################
+# Инициализация новой роли
+####################################################################################################
+init:
+	@echo "Шаг 1: Создание Docker-образа..."
+	@make docker build
+	@echo "Шаг 2: Создание Docker-образов для запуска Molecule..."
+	@make docker images
+	@echo "Шаг 3: Создание нового vault-файла с паролем..."
+	@read -p "Введите пароль для vault: " VAULT_PASSWORD; \
+	echo "$$VAULT_PASSWORD" > vault-password.txt; \
+	make vault create
+	@echo "Шаг 4: Создание нового брэнча в гите..."
+	@make git new
+	@echo "Шаг 5: Создание новой роли..."
+	@make role new
+
+####################################################################################################
+# Управление контейнерами с помощью docker compose или docker run
+####################################################################################################
+docker:
+	@case "$(word 2, $(MAKECMDGOALS))" in \
+		build) \
+		    docker buildx create --use --name multiarch-builder --driver docker-container; \
+			if [ "$(RUN_MODE)" = "docker-compose" ]; then \
+				docker compose build $(c); \
+			else \
+				docker build -t $(REGISTRY)/$(IMAGE) .; \
+			fi;; \
+		rebuild) \
+		    docker buildx create --use --name multiarch-builder --driver docker-container; \
+			if [ "$(RUN_MODE)" = "docker-compose" ]; then \
+				docker compose build --no-cache $(c); \
+			else \
+				docker build --no-cache -t $(REGISTRY)/$(IMAGE) .; \
+			fi;; \
+		prune) \
+			docker system prune -af;; \
+		shell) \
+			clear; \
+			echo "Entering to Ansible container shell..."; \
+			$(RUN) bash ;; \
+		release) \
+		    docker buildx create --use --name multiarch-builder --driver docker-container; \
+			docker login $(REGISTRY); \
+			docker buildx build -t $(REGISTRY)/$(IMAGE):$(TAG) -t $(REGISTRY)/$(IMAGE):latest --platform linux/amd64,linux/arm64 --push .;; \
+		images) \
+		    docker buildx create --use --name multiarch-builder --driver docker-container; \
+			docker login $(REGISTRY); \
+			docker buildx build -t $(REGISTRY)/centos:latest --platform linux/amd64,linux/arm64 --push -f Dockerfile-CentOS .; \
+			docker buildx build -t $(REGISTRY)/ubuntu:latest --platform linux/amd64,linux/arm64 --push -f Dockerfile-Ubuntu .;; \
+		*) echo "Unknown action. Available actions: build, rebuild, prune, release";; \
+	esac
+
+####################################################################################################
+# Работа с ролью
+####################################################################################################
+vault:
+	@case "$(word 2, $(MAKECMDGOALS))" in \
+		show) $(RUN) bash -c "ansible-vault view --vault-password-file vault-password.txt vars/secrets.yml";; \
+		create) $(RUN) bash -c "ansible-vault create --encrypt-vault-id default --vault-password-file vault-password.txt vars/secrets.yml";; \
+		edit) $(RUN) bash -c "ansible-vault edit --vault-password-file vault-password.txt vars/secrets.yml";; \
+		delete) $(RUN) bash -c "rm vars/secrets.yml";; \
+		rekey) $(RUN) bash -c "ansible-vault rekey --vault-password-file vault-password.txt vars/secrets.yml";; \
+		decrypt) $(RUN) bash -c "ansible-vault decrypt --vault-password-file vault-password.txt vars/secrets.yml";; \
+		encrypt) $(RUN) bash -c "ansible-vault encrypt --encrypt-vault-id default --vault-password-file vault-password.txt vars/secrets.yml";; \
+		*) echo "Unknown action";; \
+	esac
+
+role:
+	@case "$(word 2, $(MAKECMDGOALS))" in \
+		new) \
+			clear; \
+			echo "Введите название новой роли на английском:"; \
+			read ROLE_NAME; \
+			echo "Введите описание роли:"; \
+			read ROLE_DESC; \
+			cp -r default/ "roles/$${ROLE_NAME}"; \
+ 			printf "\n- name: $${ROLE_DESC}" >> roles/deploy.yaml; \
+			printf "\n  import_playbook: $${ROLE_NAME}/deploy.yaml" >> roles/deploy.yaml; \
+			printf '\n    - ../../roles/%s' "$$ROLE_NAME" >> molecule/default/converge.yml; \
+			printf "\n    - $${ROLE_NAME}" >> roles/$$ROLE_NAME/deploy.yaml;; \
+		lint) \
+			clear; \
+			echo "Check your role..."; \
+			$(RUN) bash -c "ansible-vault decrypt --vault-password-file vault-password.txt vars/secrets.yml"; \
+			$(RUN) bash -c "ansible-lint roles/*"; \
+			$(RUN) bash -c "ansible-vault encrypt vars/secrets.yml --encrypt-vault-id default --vault-password-file vault-password.txt";; \
+		test) \
+			clear; \
+			echo "Running test roles..."; \
+			$(RUN) bash -c "ansible-vault decrypt --vault-password-file vault-password.txt vars/secrets.yml"; \
+			$(RUN) bash -c "docker login $(REGISTRY) && molecule test --parallel --destroy=always"; \
+			$(RUN) bash -c "ansible-vault encrypt vars/secrets.yml --encrypt-vault-id default --vault-password-file vault-password.txt";; \
+		deploy) \
+			clear; \
+			echo "Deploying roles to production..."; \
+			$(RUN) bash -c "ansible-playbook roles/deploy.yaml";; \
+		*) echo "Unknown action";; \
+	esac
+
+####################################################################################################
+# Работа с Git
+####################################################################################################
+git:
+	@case "$(word 2, $(MAKECMDGOALS))" in \
+		push) \
+			git branch; \
+			read -p "Выберите ветку для пуша: " BRANCH; \
+			read -p "Введите описание коммита: " COMMIT; \
+			commitname=$$COMMIT; \
+			git add . ; \
+			git commit -m "$$commitname"; \
+			git push -u origin $$BRANCH; \
+			echo "Изменения внесены в Git";; \
+		pull) \
+			git pull;; \
+		new) \
+			read -p "Введите имя новой ветки: " BRANCH_NAME; \
+			NEW_BRANCH="$$BRANCH_NAME"; \
+			git checkout -b $$NEW_BRANCH; \
+			echo "Создана и переключена на новую ветку: $$NEW_BRANCH";; \
+		*) echo "Unknown action. Available actions: push, pull, cluster-branch";; \
+	esac
--- a/README.md
+++ b/README.md
@ -0,0 +1,61 @@
+# AnsibleTemplate
+
+Темплейт для создания, проверки и тестирование ролей Ansible с помощью контейнеров Docker.
+
+### С чего начать?
+
+На вашей машине вам необходимо сбилдить образ, где будут запускаться все роли через docker-compose.
+
+Это можно сделать самостоятельно:
+
+- **make docker build** - создание контейнера
+- **make docker rebuild** - пересоздание контейнера, если были внесены изменения в Dockerfile
+- **make docker prune** - очистить систему от лишних образов 
+- **make docker shell** - войти в контейнер Shell
+- **make docker release** - собирает образ контейнера и пушит его в докер реджистри
+- **make docker images** - собрать образы контейнеров с systemd, для удобного тестирования ролей.
+
+Или ввести команду:
+
+- **make init** - которая создаст файл секретов с паролем. Сбилдит образ. И создаст новую роль.
+
+### Работа с ролью
+- **make role new** - создать новую роль из шаблона. Название роли пишется на английском, описание роли на любом языке
+- **make role lint** - проверяет все роли в папке roles/* на наличие ошибок
+- **make role test** - позволяет тестировать роль, указанную в molecule/default/converge.yml
+сразу на двух контейнерах (RedHat и Ubuntu)
+- **make role deploy** - запускает роль в продакшен. Все хосты берет из файла inventory/hosts
+
+### Работа с файлом переменных
+
+Все переменные защищены через **Ansible-Vault** и находятся в папке vars/secrets.yml
+
+Для смены пароля измените его в файле **./vault-password.txt**
+
+- **make vault create** - создать новый файл с учетом пароля в файле **./vault-password.txt**
+- **make vault delete** - удалить файл с переменными
+- **make vault edit** - отредактировать файл переменных
+- **make vault show** - показать содержимое файла переменных
+- **make vault rekey** - сменить пароль шифрования
+- **make vault encrypt** - зашифровать файл секретов
+- **make vault decrypt** - расшифровать файл секретов
+
+### Работа с Git
+
+- **make git push** - запушить изменения. С выбором ветки и вводом коммита.
+- **make git pull** - получить изменения из репы
+- **make git new** - создание нового брэнча имя cluster-branch_name для IaC подхода.
+
+### Добавить свой образ контейнера для тестов
+
+Что бы добавить или изменить докер-образы для тестирования ролей измените файл настроек молекулы
+molecule/default/molecule.yml
+```yaml
+  - name: ubuntu-instance
+    image: "your.docker-registry.com/your-image:latest"
+    privileged: true
+    pre_build_image: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+```
+Помните, что образ обязательно должен содержать python не ниже версии 3.12 и systemd для нормального тестирования ролей.
--- a/ansible.cfg
+++ b/ansible.cfg
@ -0,0 +1,8 @@
+[defaults]
+inventory = inventory/hosts
+vault_password_file = vault-password.txt
+remote_user = devops
+host_key_checking = False
+enable_plugins = yaml, ini
+roles_path = roles/
+interpreter_python = auto
--- a/default/defaults/.gitkeep
+++ b/default/defaults/.gitkeep
--- a/default/deploy.yaml
+++ b/default/deploy.yaml
@ -0,0 +1,10 @@
+---
+- name: Deploy roles
+  hosts: all
+  become: true
+  become_user: root
+  become_method: ansible.builtin.sudo
+  gather_facts: true
+  vars_files:
+    - ../../vars/secrets.yml
+  roles:
--- a/default/files/.gitkeep
+++ b/default/files/.gitkeep
--- a/default/handlers/.gitkeep
+++ b/default/handlers/.gitkeep
--- a/default/meta/.gitkeep
+++ b/default/meta/.gitkeep
--- a/default/tasks/debian/main.yaml
+++ b/default/tasks/debian/main.yaml
@ -0,0 +1,4 @@
+---
+- name: Пример таски
+  debug:
+    msg: "Привет! Я запустился на Debian/Ubuntu!"
--- a/default/tasks/main.yaml
+++ b/default/tasks/main.yaml
@ -0,0 +1,12 @@
+---
+- name: "Определяем ОС"
+  set_fact:
+    os_family: "{{ ansible_facts['os_family'] }}"
+
+- name: "Подключаем таски для RedHat совместимых"
+  include_tasks: "redhat/main.yaml"
+  when: os_family == "RedHat"
+
+- name: "Подключаем таски для Debian/Ubuntu совместимых"
+  include_tasks: "debian/main.yaml"
+  when: os_family == "Debian"
--- a/default/tasks/redhat/main.yaml
+++ b/default/tasks/redhat/main.yaml
@ -0,0 +1,4 @@
+---
+- name: Пример таски
+  debug:
+    msg: "Привет! Я запустился на RedHat/CentOS/Fedora!"
--- a/default/templates/.gitkeep
+++ b/default/templates/.gitkeep
--- a/default/tests/.gitkeep
+++ b/default/tests/.gitkeep
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@ -0,0 +1,15 @@
+services:
+  ansible:
+    build:
+      context: .
+      ssh:
+        - default
+    container_name: ansible
+    volumes:
+      - .:/ansible
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - ANSIBLE_VAULT_PASSWORD_FILE=./vault-password.txt
+    tty: true
+    privileged: true
+    working_dir: /ansible
--- a/gitlab/config.json
+++ b/gitlab/config.json
@ -0,0 +1,8 @@
+{
+  "auths": {
+    "hub.cism-ms.ru": {
+      "username": "your-username",
+      "password": "your-password"
+    }
+  }
+}
--- a/gitlab/docker-compose.yaml
+++ b/gitlab/docker-compose.yaml
@ -0,0 +1,33 @@
+services:
+  gitlab-runner:
+    image: gitlab/gitlab-runner:latest
+    container_name: gitlab-runner
+    restart: always
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./runner:/etc/gitlab-runner
+      - ./config.json:/root/.docker/config.json
+    environment:
+      - CI_SERVER_URL=https://gitlab.com  # Замените на URL вашего GitLab
+      - REGISTRATION_TOKEN=your-registration-token  # Замените на ваш токен регистрации
+      - RUNNER_NAME=ansible-runner  # Имя раннера
+      - RUNNER_EXECUTOR=docker  # Используем Docker как исполнитель
+      - DOCKER_IMAGE=hub.cism-ms.ru/ansible/ansible:latest  # Образ Docker по умолчанию
+      - RUNNER_TAGS=docker,linux,ansible  # Теги для раннера
+      - DOCKER_PRIVILEGED=true  # Привилегированный режим
+      - DOCKER_TLS_VERIFY=false  # Отключить проверку TLS
+      - DOCKER_TTY=false  # Отключить TTY
+    command: >
+      register --non-interactive
+      --executor ${RUNNER_EXECUTOR}
+      --docker-image ${DOCKER_IMAGE}
+      --url ${CI_SERVER_URL}
+      --registration-token ${REGISTRATION_TOKEN}
+      --description ${RUNNER_NAME}
+      --tag-list ${RUNNER_TAGS}
+      --run-untagged="true"
+      --locked="false"
+      --docker-privileged=${DOCKER_PRIVILEGED}
+      --docker-tlsverify=${DOCKER_TLS_VERIFY}
+      --docker-disable-entrypoint-overwrite="false"
+      --docker-tty=${DOCKER_TTY}
--- a/gitlab/runner/config.toml
+++ b/gitlab/runner/config.toml
@ -0,0 +1,31 @@
+concurrent = 1
+check_interval = 0
+shutdown_timeout = 0
+
+[session_server]
+  session_timeout = 1800
+
+[[runners]]
+  name = "faa4e539628d"
+  url = "http://git.cism-ms.ru"
+  id = 115
+  token = "glrt-t3_5MD8hLs_69nChDbwXHLM"
+  token_obtained_at = 2025-03-17T15:35:01Z
+  token_expires_at = 0001-01-01T00:00:00Z
+  executor = "docker"
+  [runners.cache]
+    MaxUploadedArchiveSize = 0
+    [runners.cache.s3]
+    [runners.cache.gcs]
+    [runners.cache.azure]
+  [runners.docker]
+    tty = false
+    tls_verify = false
+    image = "hub.cism-ms.ru/ansible/ansible:latest"
+    privileged = true
+    disable_entrypoint_overwrite = false
+    oom_kill_disable = false
+    disable_cache = false
+    volumes = ["/var/run/docker.sock:/var/run/docker.sock", "/cache"]
+    shm_size = 0
+    network_mtu = 0
--- a/inventory/.gitkeep
+++ b/inventory/.gitkeep
--- a/inventory/hosts
+++ b/inventory/hosts
@ -0,0 +1 @@
+[all]
--- a/molecule/default/converge.yml
+++ b/molecule/default/converge.yml
@ -0,0 +1,6 @@
+---
+- name: Converge
+  hosts: all
+  vars_files:
+    - ../../vars/secrets.yml
+  roles:
--- a/molecule/default/destroy.yml
+++ b/molecule/default/destroy.yml
@ -0,0 +1,8 @@
+- name: Destroy containers on interrupt
+  hosts: localhost
+  tasks:
+    - name: Ensure containers are destroyed
+      docker_container:
+        name: "{{ item.name }}"
+        state: absent
+      loop: "{{ molecule_yml.platforms }}"
--- a/molecule/default/molecule.yml
+++ b/molecule/default/molecule.yml
@ -0,0 +1,61 @@
+---
+dependency:
+  name: galaxy
+  enabled: true
+  options:
+    requirements-file: requirements.yml
+
+driver:
+  name: docker
+
+platforms:
+  - name: centos
+    image: "hub.cism-ms.ru/ansible/centos:latest"
+    privileged: true
+    pre_build_image: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+    tmpfs:
+      - /tmp
+      - /run
+  - name: ubuntu
+    image: "hub.cism-ms.ru/ansible/ubuntu:latest"
+    privileged: true
+    pre_build_image: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+    tmpfs:
+      - /tmp
+      - /run
+
+provisioner:
+  name: ansible
+  connection_options:
+    ansible_connection: docker
+    ansible_user: root
+  env:
+    ANSIBLE_PYTHON_INTERPRETER: /usr/bin/python3
+  lint:
+    name: ansible-lint
+
+verifier:
+  name: ansible
+
+scenario:
+  name: default
+  test_sequence:
+    - dependency
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - side_effect
+    - verify
+    - cleanup
+    - destroy
+
--- a/molecule/default/no-prepare.yml
+++ b/molecule/default/no-prepare.yml
@ -0,0 +1,43 @@
+- name: Prepare
+  hosts: all
+  tasks:
+    - name: Detect OS family
+      ansible.builtin.setup:
+        gather_subset:
+          - "min"
+
+    - name: Обновляем пакеты для работы с Ansible в RockyLinux (Centos/RedHat)
+      when: ansible_facts['os_family'] == "RedHat"
+      block:
+        - name: Устанавливаем репозиторий AppStream (если его нет)
+          ansible.builtin.raw: dnf config-manager --set-enabled appstream
+          changed_when: false
+
+        - name: Установить rsync
+          ansible.builtin.raw: dnf install -y rsync
+          changed_when: false
+
+        - name: Устанавливаем Python 3.8
+          ansible.builtin.raw: dnf install -y python38 python38-pip
+          changed_when: false
+
+        - name: Обновляем символическую ссылку python3
+          ansible.builtin.raw: alternatives --set python /usr/bin/python3.8
+          changed_when: false
+#        - name: Fix repository URLs
+#          ansible.builtin.command:
+#            cmd: sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-*
+#          changed_when: false
+
+#        - name: Update baseurl
+#          ansible.builtin.command:
+#            cmd: sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-*
+#          changed_when: false
+
+#        - name: Install required packages
+#          ansible.builtin.yum:
+#            name:
+#              - epel-release
+#              - python3
+#              - python3-pip
+#            state: present
--- a/molecule/default/no-verify.yml
+++ b/molecule/default/no-verify.yml
@ -0,0 +1,7 @@
+---
+- name: Prepare
+  hosts: all
+  tasks:
+    - name: Reun verify
+      debug:
+        msg: "Hello, Verify!"
--- a/requirements.yml
+++ b/requirements.yml
@ -0,0 +1,4 @@
+---
+collections:
+  - name: maxhoesel.proxmox
+    version: 5.0.1
--- a/roles/deploy.yaml
+++ b/roles/deploy.yaml
@ -0,0 +1 @@
+---
--- a/vars/.gitkeep
+++ b/vars/.gitkeep
--- a/vault-password.txt
+++ b/vault-password.txt
@ -0,0 +1 @@
+password123