ansible rework

ansible/roles/s3fs/defaults/main.yaml

@@ -0,0 +1,52 @@
+---
+# S3FS role defaults
+
+# S3 Configuration
+s3_endpoint: "https://{{ s3_region }}.your-objectstorage.com"
+s3_region: "hel1"
+
+# S3 Credentials (should be overridden in group_vars or vault)
+s3_access_key: ""
+s3_secret_key: ""
+
+# S3 Buckets to mount (non-replication buckets only)
+s3_buckets:
+  - name: asxpio-terraform-main
+    mount_point: /mnt/s3/terraform
+    owner: root
+    group: root
+    mode: "0755"
+  - name: asxpio-backups-main
+    mount_point: /mnt/s3/backups
+    owner: root
+    group: root
+    mode: "0755"
+  - name: asxpio-immich-main
+    mount_point: /mnt/s3/immich
+    owner: root
+    group: docker
+    mode: "0775"
+
+# S3FS mount options
+# Note: s3fs_ensure_diskfree is defined per-host in host_vars/
+s3fs_options:
+  - "passwd_file=/etc/s3fs/.passwd-s3fs"
+  - "use_path_request_style"
+  - "url={{ s3_endpoint }}"
+  - "allow_other"
+  - "umask=0022"
+  - "uid={{ s3fs_uid | default('0') }}"
+  - "gid={{ s3fs_gid | default('0') }}"
+  - "use_cache=/var/cache/s3fs"
+  - "ensure_diskfree={{ s3fs_ensure_diskfree | default(81920) }}"
+  - "max_stat_cache_size=10000"
+  - "stat_cache_expire=900"
+  - "parallel_count=15"
+  - "multipart_size=52"
+  - "nocopyapi"
+  - "enable_noobj_cache"
+
+# Package dependencies
+s3fs_packages:
+  - s3fs
+  - fuse3

ansible/roles/s3fs/tasks/main.yaml

@@ -0,0 +1,96 @@
+---
+# S3FS role tasks - Mount S3 buckets using s3fs
+
+- name: Install s3fs and dependencies
+  ansible.builtin.apt:
+    name: "{{ s3fs_packages }}"
+    state: present
+    update_cache: true
+
+- name: Create s3fs credentials directory
+  ansible.builtin.file:
+    path: /etc/s3fs
+    state: directory
+    mode: '0700'
+    owner: root
+    group: root
+
+- name: Create s3fs password file
+  ansible.builtin.template:
+    src: passwd-s3fs.j2
+    dest: /etc/s3fs/.passwd-s3fs
+    mode: '0600'
+    owner: root
+    group: root
+  no_log: true
+
+- name: Create S3 cache directory
+  ansible.builtin.file:
+    path: /var/cache/s3fs
+    state: directory
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Create mount points for S3 buckets
+  ansible.builtin.file:
+    path: "{{ item.mount_point }}"
+    state: directory
+    mode: "{{ item.mode }}"
+    owner: "{{ item.owner }}"
+    group: "{{ item.group }}"
+  loop: "{{ s3_buckets }}"
+  loop_control:
+    label: "{{ item.name }} -> {{ item.mount_point }}"
+
+- name: Add S3 buckets to /etc/fstab
+  ansible.builtin.lineinfile:
+    path: /etc/fstab
+    line: "{{ item.name }} {{ item.mount_point }} fuse.s3fs _netdev,{{ s3fs_options | join(',') }} 0 0"
+    regexp: "^{{ item.name }}\\s+{{ item.mount_point }}"
+    state: present
+  loop: "{{ s3_buckets }}"
+  loop_control:
+    label: "{{ item.name }} -> {{ item.mount_point }}"
+
+- name: Mount all S3 buckets
+  ansible.builtin.command:
+    cmd: "mount {{ item.mount_point }}"
+  loop: "{{ s3_buckets }}"
+  loop_control:
+    label: "{{ item.name }} -> {{ item.mount_point }}"
+  register: mount_result
+  changed_when: mount_result.rc == 0
+  failed_when: false
+
+- name: Verify S3 buckets are mounted
+  ansible.builtin.command:
+    cmd: "mountpoint -q {{ item.mount_point }}"
+  loop: "{{ s3_buckets }}"
+  loop_control:
+    label: "{{ item.name }} -> {{ item.mount_point }}"
+  register: verify_mount
+  changed_when: false
+  failed_when: verify_mount.rc != 0
+
+- name: Display mounted S3 buckets
+  ansible.builtin.debug:
+    msg: |
+      ✅ S3 Buckets mounted successfully:
+      {% for bucket in s3_buckets %}
+      - {{ bucket.name }} -> {{ bucket.mount_point }}
+      {% endfor %}
+
+- name: Test write access to Immich bucket
+  ansible.builtin.copy:
+    content: "S3FS test file created on {{ ansible_date_time.iso8601 }}"
+    dest: "{{ s3_buckets | selectattr('name', 'equalto', 'asxpio-immich-main') | map(attribute='mount_point') | first }}/.s3fs-test"
+    mode: '0644'
+  when: "'asxpio-immich-main' in s3_buckets | map(attribute='name')"
+  register: write_test
+
+- name: Remove test file
+  ansible.builtin.file:
+    path: "{{ s3_buckets | selectattr('name', 'equalto', 'asxpio-immich-main') | map(attribute='mount_point') | first }}/.s3fs-test"
+    state: absent
+  when: write_test is changed

ansible/roles/s3fs/templates/passwd-s3fs.j2

@@ -0,0 +1 @@
+{{ s3_access_key }}:{{ s3_secret_key }}