K3s deploy on Rpis -- Rancher will live in Node

roles/Geth/tasks/general.yml

@@ -0,0 +1,40 @@
+---
+
+ - name: Copy install script
+   become: yes
+   ansible.builtin.copy:
+     src: get-k3s.sh
+     dest: /usr/local/sbin/get-k3s.sh
+     owner: root
+     group: root
+     mode: 0750
+
+ - name: Ensure cgroup
+   become: yes
+   register: cgroup_changed
+   ignore_errors: true
+   ansible.builtin.command:
+     cmd: /bin/bash -c "grep 'cgroup_memory=1 cgroup_enable=memory' /boot/firmware/cmdline.txt || (sed -i 's/$/ cgroup_memory=1 cgroup_enable=memory/' /boot/firmware/cmdline.txt && /bin/false)"
+
+ - name: Disable swap
+   become: yes
+   register: swap_changed
+   ansible.builtin.lineinfile:
+     path: /etc/rpi/swap.conf
+     regex: 'Mechanism='
+     line: 'Mechanism=none'
+
+ - name: Reboot if there was a change.
+   become: yes
+   ansible.builtin.command: "/usr/sbin/reboot"
+   async: 1
+   poll: 0
+   when: cgroup_changed is failed or swap_changed is changed
+
+ - name: Wait for the reboot to complete if there was a change.
+   wait_for_connection:
+     connect_timeout: 20
+     sleep: 5
+     delay: 5
+     timeout: 300
+   when: cgroup_changed is failed or swap_changed is changed

roles/Geth/tasks/main.yml

@@ -1,8 +1,19 @@
 ---
- - name: Geth packages
-   become: yes
-   package:
-     name:
-       - openhab2
 
- - name:
+ - name: General tasks
+   include_tasks: general.yml
+
+ - name: Primary tasks
+   include_tasks: primary.yml
+   when: "inventory_hostname == geth_primary "
+
+ #  - name: Rancher tasks
+ #    include_tasks: rancher.yml
+ #    when: "inventory_hostname == geth_primary "
+
+ - name: Worker tasks
+   include_tasks: worker.yml
+   when: "not inventory_hostname == geth_primary"
+
+ - name: Service tasks
+   include_tasks: services.yml

roles/Geth/tasks/primary.yml

@@ -0,0 +1,17 @@
+---
+
+- name: Set up primary
+  become: yes
+  ansible.builtin.command:
+    cmd: '/bin/bash -c "K3S_KUBECONFIG_MODE=644 /usr/local/sbin/get-k3s.sh"'
+    creates: /etc/systemd/system/k3s.service
+
+- name: Check the token
+  become: yes
+  ansible.builtin.command:
+    cmd: 'cat /var/lib/rancher/k3s/server/node-token'
+  register: k3s_token_cat
+
+- name: Ensure the token is in vault
+  assert:
+    that: k3s_token_cat.stdout_lines[0] is in secrets['Geth']['k3s_token']

roles/Geth/tasks/rancher.yml

@@ -0,0 +1,46 @@
+---
+
+- name: Rancher directories
+  become: yes
+  ansible.builtin.file:
+    state: directory
+    path: "{{ item }}"
+    mode: 0750
+    owner: root
+    group: root
+  loop:
+    - '/etc/rancher'
+    - '/etc/rancher/rke2'
+
+- name: Rancher config
+  become: true
+  ansible.builtin.template:
+    src: rancher.config.yaml.j2
+    dest: /etc/rancher/rke2/config.yaml
+    owner: root
+    group: root
+    mode: 0750
+
+- name: Copy install script
+  become: yes
+  ansible.builtin.copy:
+    src: get-rancher.sh
+    dest: /usr/local/sbin/get-rancher.sh
+    owner: root
+    group: root
+    mode: 0750
+
+- name: Run install script
+  become: yes
+  ansible.builtin.command:
+    cmd: /usr/local/sbin/get-rancher.sh
+
+- name: Enable rancherd
+  become: yes
+  ansible.builtin.service:
+    name: rancherd
+    state: restarted
+    enabled: yes
+
+- debug:
+    msg: 'Make sure to run `rancherd reset-admin` if this is a new cluster.'

roles/Geth/tasks/services.yml

@@ -0,0 +1,8 @@
+---
+
+- name: Enable k3s
+  become: yes
+  ansible.builtin.service:
+    name: k3s
+    state: restarted
+    enabled: yes

roles/Geth/tasks/worker.yml

@@ -0,0 +1,7 @@
+---
+
+ - name: Set up primary
+   become: yes
+   ansible.builtin.command:
+     cmd: '/bin/bash -c "K3S_TOKEN={{ secrets['Geth']['k3s_token'] }} K3S_URL=https://{{ geth_primary }}:6443 K3S_NODE_NAME=${HOSTNAME} /usr/local/sbin/get-k3s.sh"'
+     creates: /etc/systemd/system/k3s.service