upgrade to openhab 3

README.md

@@ -1,24 +1,14 @@
 # openhab-ansible
-Ansible playbooks to setup openhab on a raspberry pi. It'll install mosquitto and mqttwarn as well. Mqttwarn is configured to send data to graphite.
+Ansible playbooks to setup openhab on a raspberry pi.
 
 ## Prepare Raspberry Pi
-
 ### Install raspian
+Using the [Raspberry Pi Imager](https://www.raspberrypi.org/software/) install the latest (buster) version.
 
-Download it from [https://www.raspberrypi.org/downloads/raspbian/](https://www.raspberrypi.org/downloads/raspbian/)
+Mount sd-card and create an empty file `ssh` at the top level directory. 
-
-Unzip and copy it onto an sdcard
-
-e.g on a mac with sdcard reader that would be:
-
-    sudo dd bs=1m if=2016-09-23-raspbian-jessie-lite.img of=/dev/rdiskXYZ
-
-
-mount sdcard and create an empty file `ssh` at the top level directory. 
 
 Eject card and then insert sdcard into rasberry pi and boot.
-    
+### Optional: Configure fixed ip address
-### Configure fixed ip address
 
 Edit the file `/etc/dhcpcd.conf` and add the following lines (according to your network) and reboot.
 
@@ -29,19 +19,25 @@ Edit the file `/etc/dhcpcd.conf` and add the following lines (according to your
 
 ### User setup
 
-- Change password of user pi.
+- Install /home/pi/.ssh/authorized_keys for user pi
-- Install ssh public key for user pi
+- delete password for user pi: `passwd --delete pi`
 
-## memory split
+### Dist Upgrade
 
-    sudo raspi-config
+Upgrade all packages to newest version: 
 
-Then from the advanced menu, change the memory split for the GPU to "16"
+    apt update
-restart.
+    apt dist-upgrade -y
 
 ## Run ansible playbook
 
+first install some galaxy roles:
+
+    ansible-galaxy collection install community.general
+    ansible-galaxy collection install community.docker
+
 Edit group_vars/all/vault.
+Edit inventory.
 Check/change other values in group_vars
 
 ansible-playbook -i inventory raspi.yml
@@ -50,8 +46,20 @@ ansible-playbook -i inventory raspi.yml
 
 https://github.com/openhab/openhab/wiki/Hardware-FAQ
 
-# install docker
+## Logging Config
-https://www.raspberrypi.org/blog/docker-comes-to-raspberry-pi/
-curl -sSL https://get.docker.com | sh
 
+add the following to /home/pi/userdata/etc/log4j2.xml
+
+                <!-- jython file appender -->
+                <RollingRandomAccessFile fileName="${sys:openhab.logdir}/jython.log" filePattern="${sys:openhab.logdir}/jython.log.%i" name="JYTHON">
+                        <PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%-5.5p] [%-36.36c] - %m%n"/>
+                        <Policies>
+                                <OnStartupTriggeringPolicy/>
+                                <SizeBasedTriggeringPolicy size="8 MB"/>
+                        </Policies>
+                </RollingRandomAccessFile>
+
+                <Logger additivity="false" level="INFO" name="jython">
+                        <AppenderRef ref="JYTHON"/>
+                </Logger>
 

ansible.cfg

@@ -1,6 +1,6 @@
 [defaults]
-interpreter_python = auto_silent
+#interpreter_python = auto_silent
-#interpreter_python = /usr/bin/python3
+interpreter_python = /usr/bin/python3
 retry_files_enabled = False
 
 vault_password_file = vault_password

group_vars/all/defaults

@@ -1,5 +1,13 @@
 ---
 
+jdk: "zulu11.45.27-ca-jdk11.0.10-linux_aarch32hf"
+jdk_url: "https://cdn.azul.com/zulu-embedded/bin/{{ jdk }}.tar.gz"
+
+openhab_version: "3.0.1"
+openhab_userid: "1000"
+openhab_groupid: "1000"
+openhab_root_dir: "/home/pi/openhab"
+
 timezone: "Europe/Zurich"
 locale: "en_US.UTF-8"
 
@@ -8,7 +16,7 @@ apt_config:
   cache_valid_time: 7200
 
 ntp:
-    - "ntp.bluewin.ch"
+    - "ch.pool.ntp.org"
     
 letsencrypt_email: christian.schnidrig@gmail.com
 

group_vars/all/vault

@@ -1,24 +1,24 @@
 $ANSIBLE_VAULT;1.1;AES256
-65343063363130666335313366396139653130333535653437376464666230653230656662663738
+34363564646666363162653136653537316337633261336362616364656530636162653963646330
-3239336161333434336264386436393738653637346561370a626437323632323866366139613339
+3361613432316635303066353866303666656562343634610a656266653533653639613262386434
-36343964666562636666663766613032333133303931356537353334353635333236396630323963
+62386533636564316236313932326365613833366438333862376538623132646430336230326436
-6133666333633837370a376266346364396264626136363766383735383362343366373134616231
+3939636266313732340a353834633862343339646631353230366163393636333937323663633038
-33303732316632376563373330336534623934393166346233633666343136653735653363653538
+64653237616539393035613663303636323066323163356133326630656262623433336239363766
-38613733393366303730323466383136346563386531376338333731643762326232373631653563
+62663464663664333261353230303139633666376662323038363166366661356232623635643031
-64333965313730363133663663613563396664613463333936363833396333363131313164646463
+30666564373865663439616638656138393165613566333161363765356637313963366232336238
-62393861633133366539656662643037616362633964626335373338383563663865306339616438
+31323234373337343764363432313138656166616338376134633963363437373835643530336466
-31373063623635316232313262353563646331346438376538343635373966313235623038643763
+32373039613361616365613835313765326635383161336462366238343264613235643432303232
-35633139363636663837323166393563616132663633633331363136326634363562376138356437
+34306130346562313266393030616236386666366431333435646663646261343432376231353739
-33303166306562663061306437353566386563633030623835376633393865303238313866656262
+61313230313031303538393266326164653965303661323834323963343163356332393164616638
-32653632643765343062363264623338336664656432373934656433663639313635383364646430
+63353661303461346566663039653731316534376631336434636431323564383362636264333231
-37653037386664333437663737626535373463656564623262613638313333643336613663393835
+66643835366531613535303164613166333864383064373363386332656638636230646365666335
-32613663393865643665393931323235653937626533366363326266663666393438623937643265
+34326435343339373931646661326636646633313536633334356435373831613966323365383334
-66626330363238663866393662636561623934633232646536393831623735343162303339313238
+39636430343362346435306538393233343831353162303732623133663736616662616535333131
-30376536343766333234396539386237333132356637623336313535356564356437303763383332
+36613935323336353230636230373931666438336331333034306437393038323664353334373364
-31383437313963306231343166623532383064383938636433313365363333646636383631326330
+31336633663934653438653162376666303464306438353231613863623934306366386237363961
-36653630653733383232663639303762653237306333393564323335333130356639393535613030
+32363663666235363763333265663431333366646534373730343837616431626233346135363464
-32386338326264343333396233633138363633663234346535346138326661643931306439316261
+62653936616636613032316264376634376464373964363235356263346138396564643137313265
-62373831373462326263316232613338626132353564383262643332623563626465363938623932
+31313335313866656664323936633566386466366163303030306665343366623638626230386431
-62303436363863386464343135306362636232363833303237393562393037663436353136336538
+31383030613739663638333062623462326163346263616239316263343563396364633732613335
-66646333653031306362393539363836333063353765313464366363353361616464333733303463
+31393338343863343866343438306264383163303164363137363533373965356434306264633832
-376331376261323236333164343761663362
+633138313233363566396463633661393538

group_vars/all/vault.sample

@@ -2,8 +2,6 @@
 
 # uncomment the variables and add info
 
-vault_openhab_config_repo: "ssh://<user>>@<host>:<port>/path/repo.git"
-
 vault_nginx_user: <user>
 vault_nginx_password: <pass>
 

group_vars/raspberry

@@ -1,16 +1,6 @@
 ---
 
-#bindings:
+user_name: pi
-#    - astro
-#    - ntp
-#    - rfxcom
-#    - weather
-#    - mqtt
-#    - zwave
-
-#persistence:
-#    - mqtt
-#    - mysql
 
 #graphite_server: 'grafana.dynv6.net'
 graphite_server: "192.168.1.96"
@@ -19,9 +9,7 @@ nginx_user: "{{ vault_nginx_user }}"
 nginx_password: "{{ vault_nginx_password }}"
 
 dynv6_name: "schnidrig.dynv6.net"
-#dynv6_name: "raspi4.dynv6.net"
 dynv6_device: "{{ vault_dynv6_device }}"
 dynv6_token: "{{ vault_dynv6_token }}"
 
 fqdn: "schnidrig.dynv6.net"
-#fqdn: "raspi4.dynv6.net"

inventory

@@ -1,9 +1,3 @@
-[controller]
+[raspberry]
-192.168.1.7 ansible_ssh_user=pi
+openhab ansible_ssh_user=pi
-192.168.1.12 ansible_ssh_user=pi
+raspi4 ansible_ssh_user=pi
-192.168.1.9 ansible_ssh_user=pi
-
-[raspis]
-#192.168.1.5 ansible_ssh_user=pi
-192.168.1.7 ansible_ssh_user=pi
-192.168.1.12 ansible_ssh_user=pi

openhab.yml

@@ -1,11 +1,11 @@
 ---
 
-- hosts: controller
+- hosts: raspberry
   become: true
   gather_facts: no
   roles:
     - raspberry
-    - mqttwarn
+    #- mqttwarn
-    - openhab2
+    - openhab
 
 

roles/openhab/tasks/habmin.yml

@@ -1,32 +0,0 @@
----
-
-
-- name: download HABmin
-  get_url:
-    url: https://github.com/cdjackson/HABmin/archive/master.zip
-    dest: /root/habmin_master.zip
-    mode: 0444
-  tags:
-    - habmin
-
-
-- name: unzip
-  unarchive:
-    remote_src: yes
-    src: /root/habmin_master.zip
-    dest: /usr/share/openhab/webapps/
-    creates: "/usr/share/openhab/webapps/habmin"
-  tags:
-    - habmin
-
-- name: rename
-  command: creates="/usr/share/openhab/webapps/habmin" mv "/usr/share/openhab/webapps/HABmin-master" "/usr/share/openhab/webapps/habmin"
-  tags:
-    - habmin
-
-- name: install addon
-  command: creates="/usr/share/openhab/addons/org.openhab.io.habmin-1.8.0.jar" mv "/usr/share/openhab/webapps/habmin/addons/org.openhab.io.habmin-1.7.0-SNAPSHOT.jar" "/usr/share/openhab/addons/org.openhab.io.habmin-1.8.0.jar"
-  tags:
-    - habmin
-
-

roles/openhab/tasks/jdk.yml

@@ -0,0 +1,22 @@
+
+- name: create directories
+  file: 
+    path: "{{ item }}"
+    owner: root
+    group: root
+    mode: '0755'
+    state: directory
+  loop:
+    - "/opt/jdk"
+
+- name: Get JDK
+  ansible.builtin.unarchive:
+    src: "{{ jdk_url }}"
+    dest: "/opt/jdk"
+    remote_src: yes
+    creates: "/opt/jdk/{{ jdk }}"
+
+- name: Set alternatives
+  shell: "update-alternatives --install /usr/bin/java java /opt/jdk/{{ jdk }}/bin/java 1"
+- name: Set alternatives
+  shell: "update-alternatives --install /usr/bin/javac javac /opt/jdk/{{ jdk }}/bin/javac 1"

roles/openhab/tasks/letsencrypt.yml

@@ -4,7 +4,7 @@
   apt: 
     pkg:
     - certbot
-    - python-certbot-nginx
+    #- python-certbot-nginx
     - python3-certbot-nginx
     update_cache: "{{apt_config.update_cache}}"
     cache_valid_time: "{{apt_config.cache_valid_time}}"

roles/openhab/tasks/main.yml

@@ -1,10 +1,37 @@
 ---
 
-- include: repo.yml
+- include: jdk.yml
-- include: packages.yml
+  tags:
+  - jdk
+  - openhab_all
 - include: openhab.yml
-- include: habmin.yml
+  tags:
-- include: nfs.yml
+  - openhab
-- include: mysql.yml
+  - openhab_all
+- include: rollershutters.yml
+  tags:
+  - rollershutters
+  - openhab_all
+- include: nginx.yml
+  tags:
+  - nginx
+  - openhab_all
+- include: dynv6.yml
+  tags:
+  - dynv6
+  - openhab_all
+- include: letsencrypt.yml
+  tags:
+  - letsencrypt
+  - openhab_all
+- include: scripts.yml
+  tags:
+  - scripts
+  - openhab_all
+# - include: gardena.yml
+#   tags:
+#   - gardena
+#   - openhab_all
+
 
 

roles/openhab/tasks/mysql.yml

@@ -1,29 +0,0 @@
----
-
-- name: install mysql packages
-  apt: 
-    pkg: "{{item}}"
-    update_cache: "{{apt_config.update_cache}}"
-    cache_valid_time: "{{apt_config.cache_valid_time}}"
-  with_items:
-     - mysql-server
-     - python-mysqldb
-  tags:
-     - mysql
-
-- name: Create openhab database
-  mysql_db:
-    name: openhab
-    state: present
-  tags:
-     - mysql
-
-- mysql_user:
-    name: openhab
-    password: openhab
-    priv: '*.*:ALL'
-    state: present
-  tags:
-     - mysql
-
-

roles/openhab/tasks/nfs.yml

@@ -1,30 +0,0 @@
----
-
-- name: ensure packages are installed
-  apt: 
-    pkg: "{{item}}"
-    update_cache: "{{apt_config.update_cache}}"
-    cache_valid_time: "{{apt_config.cache_valid_time}}"
-  with_items:
-     - nfs-common
-     - nfs-kernel-server
-  tags:
-     - packages
-     - nfs
-     - openhab
-
-- name: update /etc/exports
-  lineinfile:
-    dest=/etc/exports
-    regexp="^{{item.mount_point}}\s.*"
-    line="{{item.mount_point}} {{item.options}}"
-  notify: update exportfs
-  with_items:
-    - { mount_point: "/etc/openhab", options: "*(rw,sync,no_subtree_check,all_squash)" }
-  tags:
-    - nfs
-    - nfsconfig
-    - openhab
-
-
-

roles/openhab/tasks/nginx.yml

@@ -1,5 +1,13 @@
 ---
 
+- name: ensure packages are installed
+  apt: 
+    pkg:
+     - nginx
+     - python3-passlib
+    update_cache: "{{apt_config.update_cache}}"
+    cache_valid_time: "{{apt_config.cache_valid_time}}"
+
 - name: create nginx config
   template:
      src: nginx.conf.j2

roles/openhab/tasks/openhab.yml

@@ -1,20 +1,61 @@
----
 
-- name:
+- name: Add Openhab Repo Key
-  user: 
+  ansible.builtin.apt_key:
-    name: openhab
+    url: https://bintray.com/user/downloadSubjectPublicKey?username=openhab
-    groups: "dialout"
+    state: present
-    append: yes
+
-  tags:
+- name: Add Openhab Repo
+  ansible.builtin.apt_repository:
+    repo: "deb https://dl.bintray.com/openhab/apt-repo2 stable main"
+    state: present
+    filename: openhab
+
+- name: ensure packages are installed
+  apt: 
+    pkg:
      - openhab
-    - user
+    update_cache: "{{apt_config.update_cache}}"
+    cache_valid_time: "{{apt_config.cache_valid_time}}"
 
-- name: "configure systemd"
+
-  systemd:
+- name: Create a symbolic links
-    name: openhab
+  ansible.builtin.file:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: pi
+    group: pi
+    state: link
+  loop:
+    - {"src": "/usr/share/openhab", "dest": "/home/pi/openhab_bin"}
+    - {"src": "/usr/share/openhab/addons", "dest": "/home/pi/addons"}
+    - {"src": "/etc/openhab", "dest": "/home/pi/conf"}
+    - {"src": "/var/log/openhab", "dest": "/home/pi/logs"}
+    - {"src": "/var/lib/openhab", "dest": "/home/pi/userdata"}
+    - {"src": "/var/lib/openhab/backups", "dest": "/home/pi/backups"}
+    - {"src": "/usr/share/openhab/runtime/bin/client", "dest": "/home/pi/bin/client"}
+    - {"src": "/usr/share/openhab/runtime/bin/restore", "dest": "/home/pi/bin/restore"}
+
+- name: add directories
+  file: 
+    path: "{{ item }}"
+    owner: root
+    group: root
+    mode: '0755'
+    state: directory
+  loop:
+    - "/etc/systemd/system/openhab.service.d"
+
+# original file from '/lib/systemd/system/openhab.service'
+- name: openhab service
+  template:
+    src: openhab.service
+    dest: /etc/systemd/system/openhab.service.d/override.conf
+
+- name: force systemd to reread configs
+  ansible.builtin.systemd:
     daemon_reload: yes
-    enabled: true
-    state: started 
-  tags:
-    - openhab
 
+- name: Enable openhab service
+  ansible.builtin.service:
+    name: openhab
+    enabled: yes

roles/openhab/tasks/packages.yml

@@ -1,39 +0,0 @@
----
-
-- name: install main packages
-  apt: 
-    pkg: "{{item}}"
-    update_cache: "{{apt_config.update_cache}}"
-    cache_valid_time: "{{apt_config.cache_valid_time}}"
-  with_items:
-     - "{{jdk}}"
-     - openhab-runtime
-     - sysstat
-  tags:
-     - packages
-     - openhab
-
-- name: install bindings
-  apt: 
-    pkg: "openhab-addon-binding-{{item}}"
-    update_cache: "{{apt_config.update_cache}}"
-    cache_valid_time: "{{apt_config.cache_valid_time}}"
-  with_items: "{{bindings}}"
-  tags:
-     - packages
-     - bindings
-     - openhab
-
-- name: install persistence add ons
-  apt: 
-    pkg: "openhab-addon-persistence-{{item}}"
-    update_cache: "{{apt_config.update_cache}}"
-    cache_valid_time: "{{apt_config.cache_valid_time}}"
-  with_items: "{{persistence}}"
-  tags:
-     - packages
-     - persistence
-     - openhab
-
-
-

roles/openhab/tasks/repo.yml

@@ -1,18 +0,0 @@
----
-
-- name: install ppa key
-  apt_key: url=https://bintray.com/user/downloadSubjectPublicKey?username=openhab state=present
-  tags:
-     - repo
-     - openhab
-
-- name: install openhab repo
-  apt_repository:
-    repo='deb http://dl.bintray.com/openhab/apt-repo stable main'
-    state=present
-    update_cache=yes
-    filename=openhab
-  tags:
-     - repo
-     - openhab
-

roles/openhab/tasks/rollershutters.yml

@@ -0,0 +1,15 @@
+
+- name: Download Rollershutters dependencies
+  get_url:
+    url: "{{ item.src }}"
+    dest: "/usr/share/openhab/addons/{{ item.name }}"
+    mode: "0644"
+  loop:
+    # https://mvnrepository.com/artifact/org.apache.servicemix.bundles/org.apache.servicemix.bundles.quartz
+    - name: "org.apache.servicemix.bundles.quartz-2.3.2_1.jar"
+      src: "https://repo1.maven.org/maven2/org/apache/servicemix/bundles/org.apache.servicemix.bundles.quartz/2.3.2_1/org.apache.servicemix.bundles.quartz-2.3.2_1.jar"
+    # seems to be included in openhab already
+    #- name: "snakeyaml-1.27.jar"
+    #  src: "https://repo1.maven.org/maven2/org/yaml/snakeyaml/1.27/snakeyaml-1.27.jar"
+  tags:
+    - javalibs

roles/openhab/tasks/scripts.yml

@@ -2,15 +2,15 @@
 
 - name: create scripts dir
   file: 
-    dest: /root/bin
+    dest: "/home/pi/bin"
     state: directory
 
 - name: create scripts
   template:
-     src: "{{ item }}"
+     src: "{{ item }}.sh"
-     dest: "/root/bin/{{ item }}"
+     dest: "/home/pi/bin/{{ item }}"
      owner: root
      group: root
-     mode: "u=rwx,g=r,o=r"
+     mode: "u=rwx,g=xr,o=rx"
   loop:
-    - karaf.sh
+    - backup

roles/openhab/templates/backup.sh

@@ -0,0 +1,8 @@
+
+BACKUP_DIR=" /var/lib/openhab/backups"
+BACKUP_SERVER_URL="christian@ds3018:/volume1/backup/openhab"
+
+sudo /usr/share/openhab/runtime/bin/backup
+
+BACKUP_FILE=$(/bin/ls -tr ${BACKUP_DIR}/ |tail -1)
+scp ${BACKUP_DIR}/${BACKUP_FILE} ${BACKUP_SERVER_URL}/

roles/openhab/templates/nginx.conf.j2

@@ -1,12 +1,22 @@
+
+# redirect http to https
 server {
     listen                          [::]:80 ipv6only=off;
     server_name                     {{fqdn}};
     return 301                      https://$server_name$request_uri;
 }
+
 server {
     listen                          [::]:443 ipv6only=off ssl;
     server_name                     {{fqdn}};
 
+    # Cross-Origin Resource Sharing
+    add_header 'Access-Control-Allow-Origin' '*' always;
+    add_header 'Access-Control-Allow_Credentials' 'true' always;
+    add_header 'Access-Control-Allow-Headers' 'Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range' always;
+    add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS,PUT,DELETE,PATCH' always;
+
+    # certificate
     ssl_certificate                 /etc/letsencrypt/live/schnidrig.dynv6.net/fullchain.pem;
     ssl_certificate_key             /etc/letsencrypt/live/schnidrig.dynv6.net/privkey.pem;
     ssl_protocols                   TLSv1 TLSv1.1 TLSv1.2;
@@ -24,14 +34,31 @@ server {
         proxy_set_header X-Real-IP              $remote_addr;
         proxy_set_header X-Forwarded-For        $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto      $scheme;
+        proxy_read_timeout                      3600;
 
         auth_basic                              "Openhab";
         auth_basic_user_file                    /etc/nginx/htpasswd;
      }
+
+    location /logs/ {
+        proxy_pass                              http://localhost:9001/;
+        sub_filter_once                         off;
+        sub_filter_types                        text/html;
+        sub_filter                              'href="/' 'href="/logs/';
+        sub_filter                              'src="/' 'src="/logs/';
+        sub_filter                              "path: '/socket.io'" "path: '/logs/socket.io'";
+
+        proxy_http_version                      1.1;
+        proxy_set_header                        Upgrade $http_upgrade;
+        proxy_set_header                        Connection "upgrade";
+
+        auth_basic                              "Openhab";
+        auth_basic_user_file                    /etc/nginx/htpasswd;
+
+    }
+
     location /.well-known/acme-challenge/ {
         root                                    /var/www/html;
     }
 
 }
-
-

roles/openhab/templates/openhab.service

@@ -0,0 +1,5 @@
+[Service]
+User=
+User=pi
+Group=
+Group=pi

roles/openhab2/tasks/backup.yml

@@ -1,9 +0,0 @@
----
-
-- name: create backup script
-  template:
-     src: backup.sh.j2
-     dest: "/root/backup"
-     owner: root
-     group: root
-     mode: "u=rwx,g=r,o=r"

roles/openhab2/tasks/gardena.yml

@@ -1,41 +0,0 @@
-
-- name: install gardena service file
-  template:
-    src: "gardena/gardena.service"
-    dest: "/etc/systemd/system/gardena.service"
-    mode: u=rw,g=rw,o=r
-
-- name: install gardena service script
-  template:
-    src: "gardena/gardena_monitor_collector.py"
-    dest: "/etc/openhab2/automation/gardena/gardena_monitor_collector.py"
-    mode: u=rwx,g=rx,o=rx
-    group: root
-    owner: root
-
-- name: install gardena service config
-  template:
-    src: "gardena/gardena.yml"
-    dest: "/etc/openhab2/automation/gardena/gardena.yml"
-    mode: u=rw,g=r,o=r
-    group: openhab
-    owner: openhab
-
-- name: install gardena jsr223 script
-  template:
-    src: "gardena/gardena.py"
-    dest: "/etc/openhab2/automation/jsr223/gardena.py"
-    mode: u=rw,g=r,o=r
-    group: openhab
-    owner: openhab
-
-- name: enable gardena service
-  systemd:
-    daemon_reload: yes
-
-- name: Make sure gardena service is running
-  systemd:
-    state: started
-    name: gardena
-
-

roles/openhab2/tasks/habmin.yml

@@ -1,32 +0,0 @@
----
-
-
-- name: download HABmin
-  get_url:
-    url: https://github.com/cdjackson/HABmin/archive/master.zip
-    dest: /root/habmin_master.zip
-    mode: 0444
-  tags:
-    - habmin
-
-
-- name: unzip
-  unarchive:
-    remote_src: yes
-    src: /root/habmin_master.zip
-    dest: /usr/share/openhab/webapps/
-    creates: "/usr/share/openhab/webapps/habmin"
-  tags:
-    - habmin
-
-- name: rename
-  command: creates="/usr/share/openhab/webapps/habmin" mv "/usr/share/openhab/webapps/HABmin-master" "/usr/share/openhab/webapps/habmin"
-  tags:
-    - habmin
-
-- name: install addon
-  command: creates="/usr/share/openhab/addons/org.openhab.io.habmin-1.8.0.jar" mv "/usr/share/openhab/webapps/habmin/addons/org.openhab.io.habmin-1.7.0-SNAPSHOT.jar" "/usr/share/openhab/addons/org.openhab.io.habmin-1.8.0.jar"
-  tags:
-    - habmin
-
-

roles/openhab2/tasks/main.yml

@@ -1,50 +0,0 @@
----
-
-- include: repo.yml
-  tags:
-  - repo
-  - openhab2
-- include: packages.yml
-  tags:
-  - packages
-  - openhab2
-- include: openhab.yml
-  tags:
-  - openhab
-  - openhab2
-#- include: habmin.yml
-- include: nfs.yml
-  tags:
-  - nfs
-  - openhab2
-- include: mysql.yml
-  tags:
-  - mysql
-  - openhab2
-- include: backup.yml
-  tags:
-  - backup
-  - openhab2
-- include: nginx.yml
-  tags:
-  - nginx
-  - openhab2
-- include: dynv6.yml
-  tags:
-  - dynv6
-  - openhab2
-- include: letsencrypt.yml
-  tags:
-  - letsencrypt
-  - openhab2
-- include: scripts.yml
-  tags:
-  - scripts
-  - openhab2
-- include: gardena.yml
-  tags:
-  - gardena
-  - openhab2
-
-
-

roles/openhab2/tasks/mysql.yml

@@ -1,24 +0,0 @@
----
-
-- name: install mysql packages
-  apt: 
-    pkg:
-    - default-mysql-server
-    - python-mysqldb
-    update_cache: "{{apt_config.update_cache}}"
-    cache_valid_time: "{{apt_config.cache_valid_time}}"
-
-- name: Create openhab database
-  mysql_db:
-    name: openhab2
-    state: present
-  tags:
-     - mysql
-
-- mysql_user:
-    name: openhab2
-    password: openhab2
-    priv: '*.*:ALL'
-    state: present
-
-

roles/openhab2/tasks/nfs.yml

@@ -1,22 +0,0 @@
----
-
-- name: ensure packages are installed
-  apt: 
-    pkg:
-    - nfs-common
-    - nfs-kernel-server
-    update_cache: "{{apt_config.update_cache}}"
-    cache_valid_time: "{{apt_config.cache_valid_time}}"
-
-- name: update /etc/exports
-  lineinfile:
-    dest: "/etc/exports"
-    regexp: '^{{item.mount_point}}\s.*'
-    line: "{{item.mount_point}} {{item.options}}"
-  notify: update exportfs
-  with_items:
-    - { mount_point: "/etc/openhab2", options: "*(rw,sync,no_subtree_check,all_squash)" }
-    - { mount_point: "/var/lib/openhab2", options: "*(rw,sync,no_subtree_check,all_squash)" }
-
-
-

roles/openhab2/tasks/openhab.yml

@@ -1,62 +0,0 @@
----
-
-- name:
-  user: 
-    name: openhab
-    groups: 
-        - dialout
-        - tty
-        - bluetooth
-        - audio
-    append: yes
-
-- name: "configure systemd"
-  systemd:
-    name: openhab2
-    daemon_reload: yes
-    enabled: true
-    state: started 
-
-- name: Download Rollershutters dependencies
-  get_url:
-    url: "{{ item.src }}"
-    dest: "/usr/share/openhab2/runtime/lib/boot/{{ item.name }}"
-  loop:
-    - { name: "jython-standalone-2.7.1.jar", src: 'http://search.maven.org/remotecontent?filepath=org/python/jython-standalone/2.7.1/jython-standalone-2.7.1.jar' }
-    - { name: "snakeyaml-1.25.jar", src: "http://central.maven.org/maven2/org/yaml/snakeyaml/1.25/snakeyaml-1.25.jar" }
-
-- name: cron job
-  cron:
-    name: "restart openhab"
-    minute: "10"
-    hour: "5"
-    weekday: "0"
-    job: 'systemctl restart nginx.service'
-    cron_file: openhab2
-    user: root
-
-- name: cron job
-  cron:
-    name: "touch shutters"
-    minute: "20"
-    hour: "5"
-    weekday: "0"
-    job: 'touch /etc/openhab2/automation/jsr223/shutters.py'
-    cron_file: openhab2
-    user: root
-
-- name: install python modules for jython
-  pip: 
-    virtualenv: "/etc/openhab2/automation/lib/python"
-    virtualenv_command: "/usr/bin/virtualenv"
-    virtualenv_python: "/usr/bin/python2.7"
-    name: jsonmerge
-
-- name: set EXTRA_JAVA_OPTS
-  lineinfile:
-    path: "/etc/default/openhab2"
-    regexp: '^EXTRA_JAVA_OPTS='
-    line: 'EXTRA_JAVA_OPTS="-Dpython.path=/etc/openhab2/automation/lib/python/lib/python2.7/site-packages/ -Dgnu.io.rxtx.SerialPorts=/dev/ttyACM0:/dev/ttyACM1:/dev/ttyUSB0:/dev/ttyUSB1:/dev/ttyS0:/dev/ttyS2:/dev/ttyAMA0"'
-
-
-

roles/openhab2/tasks/packages.yml

@@ -1,18 +0,0 @@
----
-
-- name: install openhab packages
-  apt: 
-    pkg:
-    - zulu-embedded-8 # java 8
-    - openhab2
-    - openhab2-addons
-    - openhab2-addons-legacy
-    - sysstat
-    - nginx
-    - python-pip # jython only supports 2.7
-    - virtualenv
-    - python-passlib
-    update_cache: "{{apt_config.update_cache}}"
-    cache_valid_time: "{{apt_config.cache_valid_time}}"
-
-

roles/openhab2/tasks/repo.old.yml

@@ -1,22 +0,0 @@
----
-
-# http://docs.openhab.org/installation/linux.html#package-repository-installation
-
-- name: install ppa key
-  apt_key: 
-    url: "http://www.openhab.org/keys/public-key-snapshots.asc"
-    state: present
-  tags:
-     - repo
-     - openhab2
-
-- name: install openhab2 repo
-  apt_repository:
-    repo: 'deb https://openhab.ci.cloudbees.com/job/openHAB-Distribution/ws/distributions/openhab-offline/target/apt-repo/ /'
-    state: present
-    update_cache: yes
-    filename: openhab2
-  tags:
-     - repo
-     - openhab2
-

roles/openhab2/tasks/repo.yml

@@ -1,31 +0,0 @@
----
-
-# http://docs.openhab.org/installation/linux.html#package-repository-installation
-
-- name: install ppa key
-  apt_key: 
-    url: "https://bintray.com/user/downloadSubjectPublicKey?username=openhab"
-    state: present
-
-- name: install openhab2 repo
-  apt_repository:
-    repo: 'deb https://dl.bintray.com/openhab/apt-repo2 stable main'
-    state: present
-    update_cache: yes
-    filename: openhab2
-
-# Zulu
-# https://docs.azul.com/zulu/zuludocs/ZuluUserGuide/PrepareZuluPlatform/AttachAPTRepositoryUbuntuOrDebianSys.htm
-
-- name: install zulu key
-  apt_key:
-    keyserver: hkp://keyserver.ubuntu.com:80
-    id: B1998361219BD9C9
-    state: present
-
-- name: install zulu repo
-  apt_repository:
-    repo: 'deb http://repos.azulsystems.com/debian stable main'
-    state: present
-    update_cache: yes
-    filename: zulu

roles/openhab2/templates/backup.sh.j2

@@ -1,12 +0,0 @@
-# stop openhab instance (here: systemd service)
-#sudo systemctl stop openhab2.service
-
-# backup current installation with settings
-TIMESTAMP=`date +%Y%m%d`;
-tar -C / -czf /tmp/openhab2-backup-$TIMESTAMP.tgz  etc/openhab2 var/lib/openhab2
-
-echo "Now save the file /tmp/openhab2-backup-$TIMESTAMP.tgz"
-echo "  as regular user run: scp /tmp/openhab2-backup-$TIMESTAMP.tgz christian@ds3018:/volume1/backup"
-
-# start openhab instance
-#sudo systemctl start openhab2.service

roles/openhab2/templates/gardena/gardena.py

@@ -1,180 +0,0 @@
-# Copyright (c) 2019 by Christian Schnidrig.
-
-# https://github.com/TooTallNate/Java-WebSocket
-
-# jython imports
-from org.slf4j import LoggerFactory
-import uuid
-import math
-import sys
-import traceback
-import time
-import json
-import jsonmerge
-
-# java imports
-#from org.eclipse.smarthome.core.scheduler import CronExpression
-import profile
-from org.yaml.snakeyaml import Yaml
-from java.nio.file.StandardWatchEventKinds import ENTRY_CREATE, ENTRY_DELETE, ENTRY_MODIFY
-try:
-    from org.openhab.core.service import AbstractWatchService
-except:
-    from org.eclipse.smarthome.core.service import AbstractWatchService
-
-#######################################################
-#######################################################
-#######################################################
-# constants
-
-module_name = "gardena"
-logger_name = "jython." + module_name
-module_prefix = module_name + "_"
-
-# location of script
-openhab_base_dir = '/etc/openhab2'
-automationDir = openhab_base_dir + '/automation'
-gardenaDir = automationDir + '/gardena'
-gardena_config_file_name = 'gardena.yml'
-gardena_config_file = gardenaDir + '/' + gardena_config_file_name
-gardena_data_file_name = 'gardena.json'
-gardena_data_file = gardenaDir + '/' + gardena_data_file_name
-
-#######################################################
-# some globals
-config = None
-data = None
-
-# default logger
-logger = LoggerFactory.getLogger(logger_name)
-
-#######################################################
-#######################################################
-#######################################################
-# config
-class Config():
-  def __init__(self):
-    self.logger = LoggerFactory.getLogger(logger_name + ".Config")
-    self.gardenaConfig = Yaml().load(open(gardena_config_file))
-    self.logger.info("Config loaded")
-
-  def getDeviceMapping(self):
-    return self.gardenaConfig['device_mapping']
-
-  def getItemNamePrefix(self):
-    return self.gardenaConfig['item_name_prefix']
-
-  def getValueMapping(self):
-    return self.gardenaConfig['value_mapping']
-
-#######################################################
-#######################################################
-#######################################################
-# gardena monitor
-
-def gardena_monitor():
-  logger = LoggerFactory.getLogger(logger_name + ".gardena_monitor")
-  config = Config()
-
-  device_mapping = config.getDeviceMapping()
-
-  data = {}
-
-  with open (gardena_data_file, "r") as data_file:
-    lines=data_file.readlines()
-    for line in lines:
-      json_line = json.loads(line)
-      if 'attributes' in json_line.keys():
-        data = jsonmerge.merge(data, {json_line['type']: { json_line['id']: json_line['attributes'] }})
-  
-  logger.debug(json.dumps(data, indent=4))
-  value_mapping = config.getValueMapping()
-  prefix = config.getItemNamePrefix()
-  for type in value_mapping:
-    for value_set in data[type]:
-      valve_number = None
-      id = value_set
-      if type == "VALVE":
-        id, valve_number = id.split(':')
-      if id in device_mapping:
-        device_name = device_mapping[id]
-        if type == "VALVE":
-          device_name = device_name + "_" + str(valve_number)
-        logger.debug("Found device: " + device_name + " of type: " + type)
-        for value_name in value_mapping[type]:
-          if not value_name.endswith('_map'):
-            if value_name in data[type][value_set]:
-              item_suffix = value_mapping[type][value_name]
-              item_name = prefix + "_" + device_name + "_" + item_suffix
-              item = ir.get(item_name)
-              if item == None:
-                logger.info("Item not found: " + item_name)
-              else:
-                  value = str(data[type][value_set][value_name]['value'])
-                  if value_name + '_map' in value_mapping[type]:
-                    value = str(value_mapping[type][value_name + '_map'][value])
-                  logger.info("Set item " + item_name + " = " + value)
-                  events.postUpdate(item_name, value)
-
-#######################################################
-#######################################################
-#######################################################
-# fileWatcher
-
-class FileWatcher(AbstractWatchService):
-  def __init__(self, path, event_kinds=[ENTRY_CREATE, ENTRY_DELETE, ENTRY_MODIFY], watch_subdirectories=False):
-    AbstractWatchService.__init__(self, path)
-    self.logger = LoggerFactory.getLogger(logger_name + ".FileWatcher")
-    self.event_kinds = event_kinds
-    self.watch_subdirectories = watch_subdirectories
-    self.logger.debug("new fileWatcher for " + str(path) + " created.")
-
-  def getWatchEventKinds(self, path):
-    return self.event_kinds
-
-  def watchSubDirectories(self):
-    return self.watch_subdirectories
-
-  def processWatchEvent(self, event, kind, path):
-    try: 
-      self.logger.debug(event.toString())
-      self.logger.debug(kind.toString())
-      self.logger.debug(path.toString())
-      if str(path.toString()) == gardena_config_file or str(path.toString()) == gardena_data_file:
-        logger.info("File " + str(path.toString()) + " changed. Reloading.")
-        try:
-          gardena_monitor()
-        except:
-          logger.error("gardena_monitor failed.")
-          logger.error(traceback.format_exc())
-    except:
-      self.logger.error("processWatchEvent callback failed.")
-      self.logger.error(traceback.format_exc())
-    self.deactivate()
-    self.activate()
-
-#######################################################
-#######################################################
-#######################################################
-# __main__
-
-fileWatcherGardena = None
-
-#######################################################
-# script load/unload hooks
-def scriptLoaded(id):
-  try:
-    logger.info("scriptLoaded()")
-    fileWatcherGardena = FileWatcher(gardenaDir)
-    fileWatcherGardena.activate()
-    gardena_monitor()
-  except:
-    logger.error(traceback.format_exc())
-    if fileWatcherGardena is not None:
-      fileWatcherGardena.deactivate()
-
-def scriptUnloaded():
-  logger.info("scriptUnloaded()")
-  if fileWatcherGardena is not None:
-    fileWatcherGardena.deactivate()
-

roles/openhab2/templates/gardena/gardena.service

@@ -1,8 +0,0 @@
-[Unit]
-Description=Service monitoring gardena web service
-
-[Service]
-ExecStart=/etc/openhab2/automation/gardena/gardena_monitor_collector.py
-
-[Install]
-WantedBy=multi-user.target

roles/openhab2/templates/gardena/gardena.yml

@@ -1,26 +0,0 @@
-# Copyright (c) 2019 by Christian Schnidrig.
-
-########################
-device_mapping:
-  164f4132-08e0-4d5f-b7f7-85048dd88281: sensor1
-  ab9633cd-9a2a-4937-ac38-4f58717493b7: ic24
-
-item_name_prefix: "gardena"
-
-value_mapping:
-  SENSOR:
-    soilHumidity: soil_humidity
-    soilTemperature: soil_temperature
-    lightIntensity: light_intensity
-    ambientTemperature: ambient_temperature
-  VALVE:
-    activity: state
-    activity_map:
-      CLOSED: "CLOSED"
-      MANUAL_WATERING: "OPEN"
-      SCHEDULED_WATERING: "OPEN"
-    name: name
-  COMMON:
-    batteryLevel: battery_level
-    rfLinkLevel: link_level
-

roles/openhab2/templates/gardena/gardena_monitor_collector.py

@@ -1,135 +0,0 @@
-#!/usr/bin/python3
-
-import websocket
-from threading import Thread
-import time
-import sys
-import requests
-import logging
-import datetime
-
-logging.basicConfig(level=logging.DEBUG)
-
-##############################
-# account specific values
-USERNAME = '{{ vault_gardena_user }}'
-PASSWORD = '{{ vault_gardena_password }}'
-API_KEY = '{{ vault_gardena_api_key }}'
-
-##############################
-# other constants
-AUTHENTICATION_HOST = 'https://api.authentication.husqvarnagroup.dev'
-SMART_HOST = 'https://api.smart.gardena.dev'
-
-dataFileName = "/etc/openhab2/automation/gardena/gardena.json"
-logFileName = "/etc/openhab2/automation/gardena/gardena.json.log"
-
-##############################
-module_name = "monitor"
-logger_name = "gardena." + module_name
-# default logger
-logger = logging.getLogger(logger_name)
-
-##############################
-class Client:
-
-  def __init__(self, dataFile, logFile):
-    self.dataFileName = dataFileName
-    self.logFile = logFile
-    self.logger = logging.getLogger(logger_name + '.Client')
-    self.dataFile = None
-
-  def on_message(self, message):
-    if self.dataFile != None:
-      self.dataFile.write(message)
-      self.dataFile.write('\n')
-      self.dataFile.flush()
-    logFile.write(message)
-    logFile.write('\n')
-    logFile.flush()
-
-  def on_error(self, error):
-    self.logger.error(error)
-
-  def on_close(self):
-    self.live = False
-    self.logger.info("### closed ###")
-    self.dataFile.close()
-
-  def on_open(self):
-    self.logger.info("### connected ###")
-    self.dataFile = open(dataFileName, "w")
-
-    self.live = True
-
-    def run(*args):
-      while self.live:
-        time.sleep(1)
-
-    Thread(target=run).start()
-
-    
-
-##############################
-if __name__ == "__main__":
-
-  while True:
-
-    try: 
-      start = time.time()
-      logger.info(datetime.datetime.now())
-      logFile = open(logFileName, "a")
-
-      payload = {'grant_type': 'password', 'username': USERNAME, 'password': PASSWORD,
-                'client_id': API_KEY}
-
-      logger.debug("Logging into gardena system...")
-      r = requests.post('{}/v1/oauth2/token'.format(AUTHENTICATION_HOST), data=payload)
-      assert r.status_code == 200, r
-      auth_token = r.json()["access_token"]
-      logger.debug("Got token: {}".format(auth_token))
-
-      headers = {
-        "Content-Type": "application/vnd.api+json",
-        "x-api-key": API_KEY,
-        "Authorization-Provider": "husqvarna",
-        "Authorization": "Bearer " + auth_token
-      }
-
-      r = requests.get('{}/v1/locations'.format(SMART_HOST), headers=headers)
-      assert r.status_code == 200, r
-      assert len(r.json()["data"]) > 0, 'location missing - user has not setup system'
-      location_id = r.json()["data"][0]["id"]
-
-      payload = {
-        "data": {
-          "type": "WEBSOCKET",
-          "attributes": {
-            "locationId": location_id
-          },
-          "id": "does-not-matter"
-        }
-      }
-      logger.debug("Logged in (%s), getting WebSocket ID..." % auth_token)
-      r = requests.post('{}/v1/websocket'.format(SMART_HOST), json=payload, headers=headers)
-
-      assert r.status_code == 201, r
-      logger.info("WebSocket ID obtained, connecting...")
-      response = r.json()
-      websocket_url = response["data"]["attributes"]["url"]
-
-      # websocket.enableTrace(True)
-      client = Client(dataFileName, logFile)
-      ws = websocket.WebSocketApp(
-        websocket_url,
-        on_message=client.on_message,
-        on_error=client.on_error,
-        on_close=client.on_close)
-      ws.on_open = client.on_open
-      ws.run_forever(ping_interval=150, ping_timeout=1)
-
-    except:
-      delay = 15 * 60 - (time.time() - start)
-      if (delay > 0):
-        logger.info("Sleeping for: {} seconds before retrying.".format(delay))
-        time.sleep(delay)

roles/openhab2/templates/karaf.sh

@@ -1 +0,0 @@
-ssh -p 8101 openhab@localhost

roles/raspberry/files/alias

@@ -1,5 +0,0 @@
-alias openhablog='tail -n 100 -f /var/log/openhab2/openhab.log -f /var/log/openhab2/events.log'
-alias openhablog2='multitail /var/log/openhab2/openhab.log /var/log/openhab2/events.log'
-alias openhablog3='multitail /var/log/openhab2/openhab.log -ci yellow -I /var/log/openhab2/events.log'
-alias ls='/bin/ls -aF --color=auto'
-alias karafshell="sudo su -s /bin/bash -c '/usr/share/openhab2/runtime/bin/client' openhab"

roles/raspberry/handlers/main.yml

@@ -5,3 +5,8 @@
 
 - name: update exportfs
   shell: exportfs -rav
+
+- name: restart collectd
+  ansible.builtin.service:
+    name: collectd
+    state: restarted

roles/raspberry/tasks/_attic/ntp.yml

@@ -1,28 +0,0 @@
----
-
-- name: update ntp.conf
-  lineinfile:
-    dest=/etc/ntp.conf
-    regexp="^server\s+.*debian.pool.ntp.org.*"
-    insertafter="^server\s.*"
-    state=absent
-  notify: restart ntp
-  tags:
-    - ntp
-    - ntpconfig
-
-- name: update ntp.conf
-  lineinfile:
-    dest=/etc/ntp.conf
-    insertafter="# pool:"
-    line="server {{item}} iburst"
-  with_items: "{{ntp}}"
-  notify: restart ntp
-  tags:
-    - ntp
-    - ntpconfig
-
-- name: Start the ntp service
-  service: name=ntp state=started enabled=true
-  tags: ntp
-

roles/raspberry/tasks/_attic/timezone.yml

@@ -1,22 +0,0 @@
----
-
-- name: fix /etc/localtime
-  file: 
-     state: link
-     path: "/etc/localtime"
-     src: "/usr/share/zoneinfo/{{timezone}}"
-     owner: root
-     group: root
-     force: true
-  tags:
-    - timezone
-
-- name: fix /etc/timezone
-  copy:
-     dest: "/etc/timezone"
-     content: "{{timezone}}"
-     owner: root
-     group: root
-     mode: "u=rw,g=r,o=r"
-  tags:
-    - timezone

roles/raspberry/tasks/collectd.yml

@@ -0,0 +1,17 @@
+- name: ensure packages are installed
+  apt: 
+    pkg:
+     - collectd
+    update_cache: "{{apt_config.update_cache}}"
+    cache_valid_time: "{{apt_config.cache_valid_time}}"
+
+- name: collectd config
+  template:
+    src: collectd.conf
+    dest: /etc/collectd/collectd.conf
+  notify: restart collectd
+
+- name: remove local rrd files
+  file:
+    dest: /var/lib/collectd/rrd
+    state: absent

roles/raspberry/tasks/main.yml

@@ -3,16 +3,20 @@
 - include: packages.yml
   tags:
   - packages
-- include: timedate.yml
+
-  tags: 
-  - ntp
-# - include: locale.yml
-#   tags:
-#   - locale
 - include: skeleton.yml
   tags:
   - skeleton
 
+- include: ufw.yml
+  tags:
+  - ufw
 
+- include: timedate.yml
+  tags:
+  - timedate
 
+- include: collectd.yml
+  tags:
+  - collectd
 

roles/raspberry/tasks/packages.yml

@@ -6,11 +6,19 @@
      - apt-transport-https
      - tmux
      - python3-pip
-     - git
-     - multitail
      - python3-requests
      - python3-websocket
+     - ufw
+     - docker-compose
+     - python-docker
+     - socat
+     - tcpdump
     update_cache: "{{apt_config.update_cache}}"
     cache_valid_time: "{{apt_config.cache_valid_time}}"
 
 
+- name: set to iptables to legacy
+  command: "update-alternatives --set iptables /usr/sbin/iptables-legacy"
+
+- name: set to ip6tables to legacy
+  command: "update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy"

roles/raspberry/tasks/skeleton.yml

@@ -1,10 +1,19 @@
 ---
 
 - name: alias
-  copy:
+  template:
      src: alias
-     dest: "/home/pi/.bash_aliases"
+     dest: "{{ item.homedir }}/.bash_aliases"
-     owner: pi
+     owner: "{{ item.name }}"
-     group: pi
      mode: "u=rw,g=r,o=r"
+  loop:
+    - {name: "{{ user_name }}", homedir: "/home/{{ user_name }}" }
+    - {name: "root", homedir: "/root" }
 
+- name: root_bashrc
+  template:
+     src: root.bashrc
+     dest: "/root/.bashrc"
+     owner: root
+     group: root
+     mode: "u=rw,g=r,o=r"

roles/raspberry/tasks/ufw.yml

@@ -0,0 +1,37 @@
+---
+
+- name: "Allow SSH"
+  community.general.ufw:
+    rule: allow
+    name: OpenSSH
+
+- name: "Allow HTTP for letsencrypt"
+  community.general.ufw:
+    rule: allow
+    port: "80"
+    proto: tcp
+
+- name: "Allow HTTPS"
+  community.general.ufw:
+    rule: allow
+    port: "443"
+    proto: tcp
+
+- name: "Allow all private IPv4 networks"
+  community.general.ufw:
+    rule: allow
+    src: '{{ item }}'
+  with_items:
+    - 10.0.0.0/8
+    - 172.16.0.0/12
+    - 192.168.0.0/16
+
+- name: "Set logging" 
+  community.general.ufw:
+    logging: "on"
+
+- name: "Enable UFW"
+  community.general.ufw:
+    state: enabled
+    policy: deny
+

roles/raspberry/templates/alias

@@ -0,0 +1,5 @@
+alias ls='/bin/ls -aF --color=auto'
+#alias openhablog='tail -n 100 -f /var/log/openhab2/openhab.log -f /var/log/openhab2/events.log'
+#alias openhablog2='multitail /var/log/openhab2/openhab.log /var/log/openhab2/events.log'
+#alias openhablog3='multitail /var/log/openhab2/openhab.log -ci yellow -I /var/log/openhab2/events.log'
+#alias karafshell="sudo su -s /bin/bash -c '/usr/share/openhab2/runtime/bin/client' openhab"

roles/raspberry/templates/root.bashrc

@@ -0,0 +1,25 @@
+# ~/.bashrc: executed by bash(1) for non-login shells.
+
+# Note: PS1 and umask are already set in /etc/profile. You should not
+# need this unless you want different defaults for root.
+# PS1='${debian_chroot:+($debian_chroot)}\h:\w\$ '
+# umask 022
+
+# You may uncomment the following lines if you want `ls' to be colorized:
+# export LS_OPTIONS='--color=auto'
+# eval "`dircolors`"
+# alias ls='ls $LS_OPTIONS'
+# alias ll='ls $LS_OPTIONS -l'
+# alias l='ls $LS_OPTIONS -lA'
+#
+# Some more alias to avoid making mistakes:
+# alias rm='rm -i'
+# alias cp='cp -i'
+# alias mv='mv -i'
+
+if [ -f ~/.bash_aliases ]; then
+    . ~/.bash_aliases
+fi
+
+#PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ '
+PS1='\[\033[01;31m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '